Unifi Controller

Unifi Controller on Uniquiti Unifi -sarjalle tarkoitettu hallintaohjelmisto. Ohjelmiston avulla on helppo hallinnoida keskitetystä Ubiquitin Unifi-sarjan tuotteista.

Asennus

Lataa Unifi Controller-sovellus: https://www.ubnt.com/download/unifi

wget http://dl.ubnt.com/unifi/5.6.22/unifi_sysvinit_all.deb

Asenna dpkg-komennon avulla palvelimelle.

sudo dpkg -i unifi_sysvinit_all.deb
sudo apt install -f

Kirjaudu hallintaan https://ip-osoite:8443

Konfigurointi

Nginx reverse proxy

Esimerkki konfiguraatio

server {
        listen 80 default_server;

        include /etc/nginx/snippets/letsencryptauth.conf;

        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        root /var/www/html;

        server_name xxxxx.xxxxx.xxxxx;

        location /inform {
                proxy_pass http://localhost:8080/inform;
                include /etc/nginx/proxy_params;
        }
 
        location / {
                return 301 https://localhost$request_uri;
        }
}

server {
        listen 443 ssl http2;
        server_name xxxxx.xxxxx.xxxxx;

        ssl on;

        ssl_certificate /etc/letsencrypt/live/xxxxx.xxxxx.xxxxx/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/xxxxx.xxxxx.xxxxx/privkey.pem;
        ssl_trusted_certificate /etc/nginx/ssl/default/unifi.pem;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;
        add_header Strict-Transport-Security "max-age=31536000" always;

        server_tokens off;

        proxy_ssl_verify off;
        proxy_ssl_session_reuse on;
        proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        proxy_cache off;
        proxy_store off;


        location /wss {
            proxy_pass https://localhost:8443/wss;
            proxy_redirect off;
            proxy_buffering off;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_ssl_verify off;
        }

        location / {
            proxy_pass https://127.0.0.1:8443;
            proxy_set_header Host             $host;
            proxy_set_header        X-Forwarded-Proto   $scheme;
            proxy_intercept_errors  on;
            proxy_http_version      1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}