unraid-template.xml

<?xml version="1.0"?>
<Container version="2">
  <Name>rackstack-server</Name>
  <Repository>ghcr.io/neverendingcode/rackstack-server:latest</Repository>
  <Registry>https://ghcr.io/neverendingcode/rackstack-server</Registry>
  <Network>bridge</Network>
  <MyIP/>
  <Shell>sh</Shell>
  <Privileged>false</Privileged>
  <Support>https://github.com/NeverEndingCode/rackstack-server</Support>
  <Project>https://github.com/NeverEndingCode/rackstack-server</Project>
  <Overview>RackStack self-hosted server. Persists save data to Postgres (recommended) or a local SQLite database, and requires a stable JWT_SECRET for logins to survive updates - do not leave it blank or change it after first run.</Overview>
  <Category>Tools:</Category>
  <WebUI>http://[IP]:[PORT:3000]/</WebUI>
  <TemplateURL>https://raw.githubusercontent.com/NeverEndingCode/rackstack-server/main/unraid-template.xml</TemplateURL>
  <Icon/>
  <ExtraParams/>
  <PostArgs/>
  <CPUset/>
  <DateInstalled/>
  <DonateText/>
  <DonateLink/>
  <Requires/>

  <Config Name="WebUI Port" Target="3000" Default="3000" Mode="tcp" Description="Port the web UI is served on" Type="Port" Display="always" Required="true" Mask="false">3000</Config>

  <Config Name="Data" Target="/app/data" Default="/mnt/user/appdata/rackstack-server/data" Mode="rw" Description="SQLite database storage. Still required even when using Postgres (below) - it is the migration source on first cutover and your rollback path afterward. Do not remove this mapping when updating the container." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/rackstack-server/data</Config>

  <Config Name="JWT_SECRET" Target="JWT_SECRET" Default="" Mode="" Description="Required. Signs login cookies. Generate once with 'openssl rand -hex 32' and never change it after first run, or all existing users will be logged out." Type="Variable" Display="always" Required="true" Mask="true"></Config>

  <Config Name="SUPER_ADMIN_IDS" Target="SUPER_ADMIN_IDS" Default="" Mode="" Description="Required. Comma-separated user ids in provider:providerId form (e.g. github:37058311, discord:123456789012345678) that always own every admin role, regardless of the database. This is the only way to reach any admin route (balance-tuning dashboard, roles management, user list) - set it to your own id or nobody will have admin access. Log in once first if you don't know your id yet." Type="Variable" Display="always" Required="true" Mask="false"></Config>

  <Config Name="DATABASE_URL" Target="DATABASE_URL" Default="" Description="Postgres connection string, e.g. postgresql://rackstack:PASSWORD@192.168.1.10:5432/rackstack - use the host's LAN IP, not localhost. Leave blank to keep using the SQLite file. On first boot with this set, existing SQLite data is migrated across automatically and verified before the server starts; your SQLite file is left untouched so you can roll back by blanking this field." Type="Variable" Display="always" Required="false" Mask="true"></Config>

  <Config Name="AUTH_MODE" Target="AUTH_MODE" Default="" Mode="" Description="Which login stack runs. Leave blank unless you are actively rolling out SuperTokens - blank means the stack RackStack has always used. Valid values: passport (default; SuperTokens is not initialised at all), dual (both login paths work, sessions from either accepted - this is where the rollout happens), supertokens (SuperTokens ONLY - implemented in v1.9, but it has never completed a login against a real SuperTokens core, so reach it through dual and confirm a real sign-in first; dual is still the intended resting state). Rolling back is setting this back to passport or blanking it and restarting; existing login cookies stay valid for their full 90 days through every transition, so nobody is logged out by changing this. An unrecognised value stops the container on purpose rather than quietly falling back, so a typo cannot look like a completed rollout." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>

  <Config Name="SUPERTOKENS_CONNECTION_URI" Target="SUPERTOKENS_CONNECTION_URI" Default="" Mode="" Description="Where the SuperTokens core container is reachable, e.g. http://192.168.1.10:3567 - use the host's LAN IP, not localhost. Only read when AUTH_MODE is dual or supertokens; ignored otherwise. The SuperTokens core needs its OWN database on your Postgres server, separate from the rackstack one, and its own connection string must use the postgresql:// scheme (it rejects postgres://, unlike DATABASE_URL above which accepts either)." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>
  <Config Name="SUPERTOKENS_API_KEY" Target="SUPERTOKENS_API_KEY" Default="" Mode="" Description="API key for the SuperTokens core. NOT optional unless the core is on this same host: a core without one serves its whole API unauthenticated, and that API can mint a login session for ANY user id - including every id in SUPER_ADMIN_IDS - without any request reaching RackStack. RackStack refuses to start in dual/supertokens mode if the core is remote and this is blank. Generate one with `openssl rand -hex 32` and set the SAME value as API_KEYS on the SuperTokens core container. Also do not publish the core's port 3567 to your LAN." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
  <Config Name="PUBLIC_ORIGIN" Target="PUBLIC_ORIGIN" Default="" Mode="" Description="The public origin this server is reached at, e.g. https://rackstack.example.com. Only read when AUTH_MODE is dual or supertokens. Leave blank and it is derived from your GitHub/Discord callback URLs, which is correct for almost everyone - set it explicitly only if you sit behind a proxy where the public origin differs from your OAuth callback host. If the container refuses to start saying it cannot determine the public origin, this is the field to fill in." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>

  <Config Name="DISCORD_CLIENT_ID" Target="DISCORD_CLIENT_ID" Default="" Mode="" Description="Discord OAuth client ID. Leave blank to disable Discord login." Type="Variable" Display="always" Required="false" Mask="false"></Config>

  <Config Name="DISCORD_CLIENT_SECRET" Target="DISCORD_CLIENT_SECRET" Default="" Mode="" Description="Discord OAuth client secret." Type="Variable" Display="always" Required="false" Mask="true"></Config>

  <Config Name="DISCORD_CALLBACK_URL" Target="DISCORD_CALLBACK_URL" Default="" Mode="" Description="Must match the redirect URL configured on the Discord OAuth app." Type="Variable" Display="always" Required="false" Mask="false"></Config>

  <Config Name="GITHUB_CLIENT_ID" Target="GITHUB_CLIENT_ID" Default="" Mode="" Description="GitHub OAuth client ID. Leave blank to disable GitHub login." Type="Variable" Display="always" Required="false" Mask="false"></Config>

  <Config Name="GITHUB_CLIENT_SECRET" Target="GITHUB_CLIENT_SECRET" Default="" Mode="" Description="GitHub OAuth client secret." Type="Variable" Display="always" Required="false" Mask="true"></Config>

  <Config Name="GITHUB_CALLBACK_URL" Target="GITHUB_CALLBACK_URL" Default="" Mode="" Description="Must match the authorization callback URL configured on the GitHub OAuth app." Type="Variable" Display="always" Required="false" Mask="false"></Config>
</Container>