[debian] Unifi Controller

[MatthewL]

Is anyone using Debian to host a Unifi Controller and secondly have you put a wildcard certificate on to secure it?

[DalekSec]

I use these scripts for our Unifi (On Ubuntu Server):

 

https://glennr.nl/s/unifi-network-controller

 

With thanks to @BKGarry

 

No cert for us, but we only have the 1 device on it!

[BlueScreen]

We have ours installed on Windows but I have updated the certificate (to one generated by an internal CA). I believe the process is mostly identical on Windows and Linux.

 

You will have to use Java Keystore to edit the [unifi install location]/data/keystore file with the updated certificate.

 

I believe you can use this guide to manually update the certificate:

https://www.jeroentielen.nl/ubiquiti-unifi-controller-ssl-certificate-creation-process/

 

Or from the command line:

keytool -import -alias unifi -file $certfile -trustcacerts -noprompt -keystore $KeyStoreFile -storepass $KeyStorePassword

Then restart the unifi network application to pick up the new certificate.

Systemctl restart unifi

 

You will have to adjust the command (see the site link above), and combine your CA, all intermediate and wildcard certificates as well as the private key into the $certfile which is imported into the key store.

[MatthewL]

Hi DalekSec that is the script I am using to install with no issues.

 

We have ours on Windows but its a pain to update and its resource hungry. I will have another look at them, they are similar to what I have looked at but other steps.

[jthompson]

We have ours running on Ubuntu, installed and kept updated via APT. That'll work for Debain, too. Works well, although in the past the repo details needed to be amended for each new major version, but I don't think that that's the case any longer. Certainly, it upgraded from v5 to v6 recently without needing new repo details. https://help.ui.com/hc/en-us/articles/220066768-UniFi-Network-How-to-Install-and-Update-via-APT-on-Debian-or-Ubuntu

I haven't added our wildcard cert for it, as I'm happy to just put up with the browser warning step.

Edited April 12, 2022 by jthompson

[dhicks]

Is anyone using Debian to host a Unifi Controller

 

We were, but we've moved to UniFi's own controller hardware for network and CCTV. When we had a Debian host I had the UniFi applications behind a Nginx reverse proxy which handled the SSL part of thing, automatically updated via Let's Encrypt. It took a bit of fiddling to get HTTP sockets set up properly, I think I've still got the config file somewhere.

[MatthewL]

Interesting re Nginx, did you just do the 8080 and 8443 and then STUN direct to it? It was something we were discussing.

[dhicks]

Interesting re Nginx, did you just do the 8080 and 8443 and then STUN direct to it?

 

We seem to have been having Nginx listen on port 443 (HTTPS) and forward to port 7080 (HTTP) of the Ubiquiti CCTV server, with seprate entries for "/" and "/ws/" locations. Traffic over the internal network would have been unencrypted, but that should be fine as all that traffic should all be contained within one core switch. For websockets, we were proxying port 7446 on the proxy directly to port 7446 on the Ubiquiti server. Sorry, I don't know what a STUN server / setup is.

[MatthewL]

Will look into it next week when back in but thanks for the replies.