matthew
e9464bb3c5
Last config blocker — basement-ui's store.Open() calls MkdirAll on BASEMENT_DATA_DIR (default /var/lib/basement-ui), which fails inside the container because / is read-only-ish for the unprivileged user. Mount /mnt/user/appdata/basement to /var/lib/basement-ui via a Path Config; install.sh pre-creates the directory (and host-agent's appdata while we're at it, since we never explicitly created that either — it had been working by luck). Source-checked the basement-ui repo for any other "is required" env vars; ADMIN_USER / ADMIN_PASSWORD_HASH / JWT_SECRET / DRIVER (+ the two DRIVER_GARAGE_* when DRIVER=garage) are the complete set. After this, container should reach Up.
62 lines
4.7 KiB
XML
62 lines
4.7 KiB
XML
<?xml version="1.0"?>
|
|
<!--
|
|
Unraid Community Apps template for basement-ui (Garage admin UI).
|
|
Source of truth: pq/scripts on Gitea (https://git.docker.pq.io/pq/scripts).
|
|
Served via gitea raw URL: https://git.docker.pq.io/pq/scripts/raw/branch/main/unraid-1/basement.template.xml
|
|
|
|
This file is NOT installed directly. install.sh fetches it, substitutes
|
|
__GARAGE_ADMIN_TOKEN__ (shared with the garage container) and
|
|
__BASEMENT_JWT_SECRET__ (generated alongside the garage secrets), and
|
|
writes the result to /boot/config/plugins/dockerMan/templates-user/my-basement.xml.
|
|
|
|
BASEMENT_ADMIN_USER and BASEMENT_ADMIN_PASSWORD_HASH must be set by hand
|
|
in the Unraid UI before Apply — install.sh leaves them blank.
|
|
Generate a bcrypt hash with: `htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'`
|
|
(or use any bcrypt tool; basement-ui expects the standard $2a$/$2b$ format).
|
|
|
|
Caddy on classe reverse-proxies https://basement.pq.io to this container's
|
|
port 8080. DNS for basement.pq.io and the Caddy vhost are managed on classe,
|
|
not here.
|
|
-->
|
|
<Container version="2">
|
|
<Name>basement</Name>
|
|
<Repository>ghcr.io/mattjackson/basement-ui:latest</Repository>
|
|
<Registry>https://github.com/mattjackson/basement-ui</Registry>
|
|
<Network>bridge</Network>
|
|
<MyIP/>
|
|
<Shell>sh</Shell>
|
|
<Privileged>false</Privileged>
|
|
<Support/>
|
|
<Project/>
|
|
<Overview>basement-ui: admin UI for the local garage S3 container. Caddy on classe terminates TLS for basement.pq.io and reverse-proxies to this container's port 8080.</Overview>
|
|
<Category>Network:Web Cloud:</Category>
|
|
<WebUI>http://[IP]:[PORT:8080]/</WebUI>
|
|
<TemplateURL/>
|
|
<Icon>https://garagehq.deuxfleurs.fr/img/logo.svg</Icon>
|
|
<ExtraParams>--restart=unless-stopped --add-host=host.docker.internal:host-gateway --label com.centurylinklabs.watchtower.enable=true</ExtraParams>
|
|
<PostArgs/>
|
|
<CPUset/>
|
|
<DateInstalled/>
|
|
<DonateText/>
|
|
<DonateLink/>
|
|
<Description>
|
|
Admin UI for the garage container running on this host.
|
|
|
|
Reaches garage's admin API at http://host.docker.internal:3903 (the host-gateway alias resolves to unraid-1's docker bridge IP, where the garage container publishes port 3903). The admin token below is shared with the garage container — install.sh pre-fills both.
|
|
|
|
Publicly served at https://basement.pq.io via Caddy on classe (reverse proxy → unraid-1:8080).
|
|
</Description>
|
|
|
|
<Config Name="WebUI" Target="8080" Default="8080" Mode="tcp" Description="HTTP port. Caddy on classe proxies basement.pq.io here." Type="Port" Display="always" Required="true" Mask="false">8080</Config>
|
|
|
|
<Config Name="Data dir" Target="/var/lib/basement-ui" Default="/mnt/user/appdata/basement" Mode="rw" Description="Persistent state (audit log, sessions). basement-ui's default BASEMENT_DATA_DIR; container can't mkdir under / so this mount is required." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/basement</Config>
|
|
|
|
<Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Target="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Default="http://host.docker.internal:3903" Mode="" Description="Garage admin API base URL (reaches the sibling garage container via the host-gateway alias). basement-ui namespaces driver-specific config as BASEMENT_DRIVER_GARAGE_*." Type="Variable" Display="always" Required="true" Mask="false">http://host.docker.internal:3903</Config>
|
|
<Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Target="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Default="" Mode="" Description="Bearer token for Garage admin API. Pre-filled by install.sh (same value as the garage container's GARAGE_ADMIN_TOKEN)." Type="Variable" Display="always" Required="true" Mask="true">__GARAGE_ADMIN_TOKEN__</Config>
|
|
|
|
<Config Name="BASEMENT_DRIVER" Target="BASEMENT_DRIVER" Default="garage" Mode="" Description="Storage backend driver. 'garage' for this deployment." Type="Variable" Display="always" Required="true" Mask="false">garage</Config>
|
|
<Config Name="BASEMENT_ADMIN_USER" Target="BASEMENT_ADMIN_USER" Default="" Mode="" Description="Login username for the basement UI. Pick something; you'll log in with this + the password whose hash goes below." Type="Variable" Display="always" Required="true" Mask="false"/>
|
|
<Config Name="BASEMENT_ADMIN_PASSWORD_HASH" Target="BASEMENT_ADMIN_PASSWORD_HASH" Default="" Mode="" Description="Bcrypt hash of the admin password ($2a$/$2b$ format). Generate with: htpasswd -bnBC 12 '' yourpassword | tr -d ':\n'" Type="Variable" Display="always" Required="true" Mask="true"/>
|
|
<Config Name="BASEMENT_JWT_SECRET" Target="BASEMENT_JWT_SECRET" Default="" Mode="" Description="HMAC secret for signing UI session JWTs. Pre-filled by install.sh from secrets.env (auto-generated, persisted across re-runs)." Type="Variable" Display="always" Required="true" Mask="true">__BASEMENT_JWT_SECRET__</Config>
|
|
</Container>
|