diff options
Diffstat (limited to 'modules/services/unifi')
-rw-r--r-- | modules/services/unifi/default.nix | 87 |
1 files changed, 87 insertions, 0 deletions
diff --git a/modules/services/unifi/default.nix b/modules/services/unifi/default.nix new file mode 100644 index 0000000..1433725 --- /dev/null +++ b/modules/services/unifi/default.nix @@ -0,0 +1,87 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.my.services.unifi; + secrets = config.age.secrets; + allowedRules = { + # https://help.ubnt.com/hc/en-us/articles/218506997 + allowedTCPPorts = [ + 8080 # Port for UAP to inform controller. + 8880 # Port for HTTP portal redirect, if guest portal is enabled. + 8843 # Port for HTTPS portal redirect, ditto. + 6789 # Port for UniFi mobile speed test. + 9130 # Port for the prometheus exporter + ]; + allowedUDPPorts = [ + 3478 # UDP port used for STUN. + 10001 # UDP port used for device discovery. + ]; + }; +in { + options.my.services.unifi = with lib; { + enable = mkEnableOption "Unifi controller"; + vhostName = mkOption { + type = types.str; + example = "music.fcuny.net"; + description = "Name for the virtual host"; + }; + }; + + config = lib.mkIf cfg.enable { + networking.firewall = allowedRules; + users.users.unifi.group = "unifi"; + users.users.unifi.isSystemUser = true; + users.groups.unifi = { }; + + services.unifi = { + enable = true; + openPorts = true; + unifiPackage = pkgs.unifiStable; + }; + + services.unifi-poller = { + enable = true; + + unifi.defaults = { + url = "https://127.0.0.1:8443"; + user = "unifipoller"; + pass = secrets."unifi/unifi-poller".path; + verify_ssl = false; + }; + + influxdb.disable = true; + + prometheus = { http_listen = ":9130"; }; + }; + + systemd.services.unifi-available = { + description = "Wait for Unifi to be available"; + after = [ "unifi.service" ]; + before = [ "unifi-poller.service" ]; + wantedBy = [ "unifi-poller.service" ]; + serviceConfig = { + ExecStart = + "${pkgs.curl}/bin/curl --insecure 'https://localhost:8443/'"; + Restart = "on-failure"; + RestartSec = "10"; + Type = "oneshot"; + }; + }; + + services.nginx.virtualHosts."${cfg.vhostName}" = { + forceSSL = true; + useACMEHost = cfg.vhostName; + locations."/" = { + proxyPass = "http://127.0.0.1:8443"; + proxyWebsockets = true; + }; + }; + + security.acme.certs."${cfg.vhostName}" = { + dnsProvider = "gcloud"; + credentialsFile = secrets."acme/credentials".path; + }; + + my.services.backup = { paths = [ "/var/lib/unifi" ]; }; + }; +} |