kburdett/rpi_unifi.md

## rpi_unifi.md

      
    Raw
  

              rpi_unifi.md
            
          
    Compatibility

I currently run Ubiquiti's UniFi Controller on a Raspberry Pi 3B without issue. I have tried with a Raspberry Pi 1B, but the application crashes on startup. I assume it is due to a lack of RAM. Presumably, it would run on a Raspberry Pi 2B as well (same amount of RAM), but I have not tested it on this model. YMMV.
Instructions


Install Raspbian on a SD card. I tested this with Jessie Lite (headless)


Use raspi-config to expand the filesystem, rename your PI, etc
sudo raspi-config


Reboot the PI for the filesystem changes to take effect


Update packages
sudo apt-get update
sudo apt-get upgrade -y


Install Java 7 (OpenJDK) and MongoDB
sudo apt-get install -y openjdk-7-jre-headless mongodb


Disable the default MongoDB instance to free up resources (UniFi will run its own copy)
sudo service mongodb stop
sudo service mongodb disable


Add Ubiquiti's source list
echo "deb http://www.ubnt.com/downloads/unifi/debian stable ubiquiti" | sudo tee /etc/apt/sources.list.d/100-ubnt.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv C0A52C50
sudo apt-get update


Install the UniFi controller software
apt-get install -y unifi


Create log rotation to avoid disk space issues NOTE: downloads unifi_logrotate.d.sh from this Gist
sudo wget https://gist.githubusercontent.com/kburdett/006a16316afa62148b16/raw/unifi_logrotate.d.sh -O /etc/logrotate.d/unifi


Generate yourself a CSR, replace the details as desired
sudo java -jar lib/ace.jar new_cert unifi.mydomain.dom "My Company Name" City State US
This will generate a CSR for you at /var/lib/unifi/unifi_certificate.csr.pem


Generate the certificate using your own CA, or a buy a certificate from a real CA


Download your certificate(s) to /var/lib/unifi/


Import the certificate
cd /var/lib/unifi
sudo java -jar /usr/lib/unifi/lib/ace.jar import_cert unifi_certificate.cert.pem intermediate.cert.pem root.cert.pem
sudo service unifi restart
NOTE: I am importing a certificate, plus the intermediate and root certs to establish a chain, your chain may differ


Verify your service is exposed with netstat, like this:
pi@hostname:~ $ sudo netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:27117         0.0.0.0:*               LISTEN      542/mongod      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      499/sshd        
tcp6       0      0 :::8843                 :::*                    LISTEN      509/java        
tcp6       0      0 :::8880                 :::*                    LISTEN      509/java        
tcp6       0      0 :::8080                 :::*                    LISTEN      509/java        
tcp6       0      0 :::22                   :::*                    LISTEN      499/sshd        
tcp6       0      0 :::8443                 :::*                    LISTEN      509/java


Now you are ready to start using your controller! You can reach it at https://<your-hostname-or-ip>:8443


Bonus

If you (like me) prefer easy to type (and remember) URLs, then we can move the UniFi controller to ports 80 & 443 (standard HTTP and HTTPS ports). This way, no port will be required in the URL bar. The UniFi controller runs under a limited user and cannot bind to these ports, so we cannot do this with UniFi configuration alone. So... iptables to the rescue :) We will set up an internal port forward.


Set up the rules
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
sudo ip6tables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo ip6tables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443


Install iptables-persistent to automatically reload these for us
sudo apt-get install iptables-persistent
Answer "yes" to both prompts to save the rules on install (one for IPv4, one for IPv6), and we are done!


Test your controller at https://<your-hostname-or-ip>


## unifi_logrotate.d.sh
/var/log/unifi/*.log {
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    copytruncate
}
	/var/log/unifi/*.log {
	rotate 7
	daily
	missingok
	notifempty
	delaycompress
	compress
	copytruncate
	}