Clément Désiles
49 lines
1.4 KiB
Markdown
49 lines
1.4 KiB
Markdown
# UniFi Controller
|
|
|
|
Deploys the [UniFi Network Controller](https://ui.com/) via rootless Podman using the [`jacobalberty/unifi`](https://github.com/jacobalberty/unifi-docker) image (embedded MongoDB, no external DB required).
|
|
|
|
## Configuration
|
|
|
|
See [defaults/main.yml](defaults/main.yml) for all variables.
|
|
|
|
### Required variables (inventory)
|
|
|
|
| Variable | Description | Example |
|
|
|---|---|---|
|
|
| `unifi_bind_address` | LAN IP for AP communication | `192.168.2.1` |
|
|
|
|
### Optional variables
|
|
|
|
| Variable | Description | Default |
|
|
|---|---|---|
|
|
| `unifi_admin_address` | Bind address for web UI (8443) | `unifi_bind_address` |
|
|
|
|
Set `unifi_admin_address` to a WireGuard IP to restrict admin access to VPN only while keeping AP ports on the LAN.
|
|
|
|
```yaml
|
|
# Example: LAN for APs, VPN-only admin
|
|
unifi_bind_address: 192.168.2.1 # lan1 — APs reach this
|
|
unifi_admin_address: 192.168.20.4 # wg0 — admin via VPN only
|
|
```
|
|
|
|
## Firewall ports
|
|
|
|
On `unifi_bind_address` (LAN):
|
|
|
|
| Port | Protocol | Purpose |
|
|
|---|---|---|
|
|
| 8080 | TCP | Device inform |
|
|
| 3478 | UDP | STUN |
|
|
| 10001 | UDP | AP discovery |
|
|
|
|
On `unifi_admin_address` (defaults to `unifi_bind_address`):
|
|
|
|
| Port | Protocol | Purpose |
|
|
|---|---|---|
|
|
| 8443 | TCP | Web UI |
|
|
|
|
## AP adoption
|
|
|
|
APs on the same L2 network discover the controller automatically via port 10001/udp. For L3 adoption, configure the AP inform URL: `http://<unifi_bind_address>:8080/inform`.
|
|
|