Merge branch 'unifi-redux'

roles/unifi/defaults/main.yml

@@ -1,5 +1,5 @@
 unifi_version: latest
-unifi_container_image: lscr.io/linuxserver/unifi-controller
+unifi_container_image: git.pyrocufflink.net/containerimages/unifi
 unifi_storage_path: /var/lib/unifi
 
 unifi_exporter_container_image: docker.io/jessestuart/unifi_exporter

roles/unifi/tasks/deploy.yml

@@ -1,48 +1,3 @@
-- name: ensure unifi group exists
-  group:
-    name: unifi
-    gid: 911
-    system: true
-    state: present
-  tags:
-  - user
-  - group
-- name: ensure unifi user exists
-  user:
-    name: unifi
-    uid: 911
-    group: unifi
-    home: /var/lib/unifi
-    createhome: false
-    system: true
-    state: present
-  tags:
-  - user
-
-- name: ensure containers subuid is configured
-  lineinfile:
-    path: /etc/subuid
-    create: true
-    line: containers:39290640:1048576
-  tags:
-  - user
-- name: ensure containers subgid is configured
-  lineinfile:
-    path: /etc/subgid
-    line: containers:39290640:1048576
-  tags:
-  - user
-
-- name: ensure unifi storage path exists
-  file:
-    path: '{{ unifi_storage_path }}'
-    owner: unifi
-    group: unifi
-    mode: u=rwx,go=
-    state: directory
-  tags:
-  - datadir
-
 - name: ensure unifi.container systemd unit exists
   template:
     src: unifi.container.j2
@@ -75,23 +30,12 @@
   tags:
   - firewalld
 
-- name: ensure nginx is configured to proxy for unifi
+- name: ensure caddy is configured to proxy for unifi
   template:
-    src: unifi.nginx.conf.j2
-    dest: /etc/nginx/default.d/unifi.conf
-    mode: u=rw,go=r
+    src: unifi.caddyfile.j2
+    dest: /etc/caddy/Caddyfile.d/unifi.caddyfile
     owner: root
     group: root
+    mode: u=rw,go=r
   notify:
-  - reload nginx
-  tags:
-  - nginx
-
-- name: ensure selinux allows nginx to proxy for unifi
-  seboolean:
-    name: httpd_can_network_connect
-    persistent: true
-    state: true
-  tags:
-  - nginx
-  - selinux
+  - reload caddy

roles/unifi/tasks/main.yml

@@ -3,8 +3,5 @@
     tags:
     - install
   - import_tasks: deploy.yml
-  - import_tasks: exporter.yml
-    tags:
-    - unifi-exporter
   tags:
   - unifi

roles/unifi/templates/unifi.caddyfile.j2

@@ -0,0 +1,13 @@
+{{ unifi_server_name }} {
+    reverse_proxy localhost:8443 {
+        transport http {
+            tls_insecure_skip_verify
+        }
+    }
+{% if unifi_caddy_acme|d %}
+
+    tls {{ unifi_caddy_acme.email }} {
+        ca {{ unifi_caddy_acme.url }}
+    }
+{% endif %}
+}

roles/unifi/templates/unifi.container.j2

@@ -5,14 +5,17 @@ After=network.target
 
 [Container]
 Image={{ unifi_container_image }}:{{ unifi_version }}
-Volume={{ unifi_storage_path }}:/config:rw,Z
+Volume=%S/%N:/var/lib/unifi:rw,U,Z
+Volume=%L/%N:/var/log/unifi:rw,U,Z
 Network=host
 NoNewPrivileges=yes
-UserNS=auto:gidmapping=911:911:1,uidmapping=911:911:1
-VolatileTmp=yes
+ReadOnly=yes
+ReadOnlyTmpfs=true
 Notify=yes
 
 [Service]
+StateDirectory=%N
+LogsDirectory=%N
 TimeoutStartSec=5min
 Restart=always
 PrivateTmp=yes
@@ -23,7 +26,7 @@ ProtectProc=invisible
 ProtectSystem=strict
 ReadWritePaths=/run
 ReadWritePaths=/var/lib/containers/storage
-ReadWritePaths={{ unifi_storage_path }}
+ReadWritePaths=%S/%N
 RestrictRealtime=yes
 UMask=0077
 

roles/unifi/templates/unifi.nginx.conf.j2

@@ -1,9 +0,0 @@
-location / {
-    proxy_pass https://127.0.0.1:8443/;
-    proxy_ssl_verify off;
-    client_max_body_size 50m;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-}