Add UniFi Network Controller role

2026-07-03 00:09:02 +02:00
parent 501f4e1f87
commit 75d6aae668
6 changed files with 267 additions and 0 deletions
@@ -0,0 +1,117 @@
+---
+- name: Validate required variables are set
+  ansible.builtin.assert:
+    that:
+      - unifi_bind_address is defined
+      - unifi_bind_address | length > 0
+    fail_msg: |
+      unifi_bind_address is required (IP of the interface to bind to).
+      See roles/unifi/defaults/main.yml for configuration instructions.
+    success_msg: "Variable validation passed"
+
+- name: Create unifi project directory
+  ansible.builtin.file:
+    path: "{{ podman_projects_dir | default('/opt/podman') }}/unifi"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create unifi data directory
+  ansible.builtin.file:
+    path: "{{ unifi_data_dir }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Pull UniFi container image
+  ansible.builtin.command: "podman pull {{ unifi_image }}:{{ unifi_version }}"
+  changed_when: pull_result.stdout is search('Writing manifest')
+  register: pull_result
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Deploy Kubernetes YAML for unifi
+  ansible.builtin.template:
+    src: unifi.yaml.j2
+    dest: "{{ podman_projects_dir | default('/opt/podman') }}/unifi/unifi.yaml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Restart unifi
+
+- name: Get home directory for {{ ansible_user }}
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ ansible_user }}"
+
+- name: Set user home directory fact
+  ansible.builtin.set_fact:
+    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
+
+- name: Create systemd user directory for unifi
+  ansible.builtin.file:
+    path: "{{ user_home_dir }}/.config/systemd/user"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create systemd service for unifi (user scope)
+  ansible.builtin.template:
+    src: unifi.service.j2
+    dest: "{{ user_home_dir }}/.config/systemd/user/unifi.service"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Reload systemd user
+
+- name: Enable lingering for user {{ ansible_user }}
+  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
+  when: ansible_user != 'root'
+
+- name: Setup firewall rules for UniFi (TCP)
+  community.general.ufw:
+    rule: allow
+    src: "{{ item.0 }}"
+    port: "{{ item.1.port }}"
+    proto: tcp
+    direction: in
+    comment: "UniFi {{ item.1.name }}"
+  loop: "{{ unifi_firewall_allowed_sources | product(unifi_tcp_ports) }}"
+  vars:
+    unifi_tcp_ports:
+      - { port: "8080", name: "device inform" }
+      - { port: "8443", name: "web interface" }
+  retries: 5
+  delay: 2
+  register: ufw_result
+  until: ufw_result is succeeded
+
+- name: Setup firewall rules for UniFi (UDP)
+  community.general.ufw:
+    rule: allow
+    src: "{{ item.0 }}"
+    port: "{{ item.1.port }}"
+    proto: udp
+    direction: in
+    comment: "UniFi {{ item.1.name }}"
+  loop: "{{ unifi_firewall_allowed_sources | product(unifi_udp_ports) }}"
+  vars:
+    unifi_udp_ports:
+      - { port: "3478", name: "STUN" }
+      - { port: "10001", name: "device discovery" }
+  retries: 5
+  delay: 2
+  register: ufw_result
+  until: ufw_result is succeeded
+
+- name: Enable and start unifi service (user scope)
+  ansible.builtin.systemd:
+    name: unifi.service
+    enabled: true
+    state: started
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"