Add unifi version support

7 files changed, 175 insertions, 46 deletions

diff --git a/unifi/.dockerignore b/unifi/.dockerignore
new file mode 100644
index 0000000..f3c7a7c
--- /dev/null
+++ b/unifi/.dockerignore
@@ -0,0 +1 @@
+Makefile
diff --git a/unifi/Dockerfile b/unifi/Dockerfile
index 7fe3ec9..27ef95d 100644
--- a/unifi/Dockerfile
+++ b/unifi/Dockerfile
@@ -1,40 +1,51 @@
-FROM ubuntu:16.04
-MAINTAINER Michael Crute <mike@crute.us>
+FROM alpine:latest
+LABEL maintainer="Mike Crute <mike@crute.us>"
 
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    echo 'Acquire::http::Proxy "http://genesis.sea1.crute.me:3142";' > /etc/apt/apt.conf && \
-    apt-get update && \
-    apt-get install -y curl software-properties-common sudo psmisc mongodb-server openjdk-8-jre-headless jsvc && \
-    apt-add-repository -y "deb http://www.ubnt.com/downloads/unifi/debian stable ubiquiti" && \
-    apt-key adv --keyserver keyserver.ubuntu.com --recv C0A52C50 && \
-    apt-get update && \
-    apt-get install -y unifi && \
+ARG version
+ARG checksum_file
 
-# Clean up
-    rm /etc/apt/apt.conf && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    rm -rf /tmp/*
+ADD custom/ /tmp
 
-# Inform Port
-# HTTPS Web UI & API 
-EXPOSE 8080 8443
-VOLUME ["/var/lib/unifi", "/var/log/unifi"]
+RUN \
+    # Validate required arguments were passed
+    test -z "${version}"       && { echo -e "\033[31mMissing build parameter 'version'\033[39m"; exit 1; }; \
+    test -z "${checksum_file}" && { echo -e "\033[31mMissing build parameter 'checksum_file'\033[39m"; exit 1; }; \
+    \
+    # Install build and run dependencies
+    apk add --no-cache --virtual .build-deps curl ca-certificates binutils \
+    && apk add --no-cache openjdk8-jre-base java-snappy mongodb libcap \
+    \
+    # Fetch the Unifi package and validate the checksum before unpacking
+    && cd /tmp \
+    && curl -sO "https://dl.ubnt.com/unifi/${version}/unifi_sysvinit_all.deb" \
+    && curl -s "${checksum_file}" | sed -En 's/^SHA256\(([^\)]+)\)= (.*)/\2 *\1/gp' | grep 'unifi_sysvinit_all.deb' > checksums.txt \
+    && sha256sum -sc checksums.txt \
+    \
+    # Unpack the debian package and "install" it
+    && ar x unifi_sysvinit_all.deb \
+    && tar -xJf data.tar.xz \
+    && rm usr/lib/unifi/bin/unifi.init \
+    && mv usr/lib/unifi /usr/lib \
+    \
+    # Create directories and link everything together
+    && mkdir -p /var/lib/unifi /var/log/unifi /var/run/unifi \
+    && ln -sf /usr/bin/mongod /usr/lib/unifi/bin/mongod \
+    && ln -sf /var/lib/unifi /usr/lib/unifi/data \
+    && ln -sf /var/log/unifi /usr/lib/unifi/logs \
+    && ln -sf /var/run/unifi /usr/lib/unifi/run \
+    \
+    # The version vended with Unifi is built against libc but alpine uses musl
+    # so we have to use their version instead otherwise informs will fail
+    && rm /usr/lib/unifi/lib/snappy-java-1.1.2.6.jar  \
+    && ln -s /usr/share/java/snappy-java-1.1.2.6.jar /usr/lib/unifi/lib/snappy-java-1.1.2.6.jar \
+    \
+    # Install our customizations
+    && mv /tmp/entrypoint.sh / \
+    && mv /tmp/log4j.properties /usr/lib/unifi \
+    && mv /tmp/su-exec-alpine /usr/sbin/su-exec \
+    \
+    # Cleanup
+    && apk del .build-deps \
+    && rm -rf /tmp/*
 
-CMD [ \
-    "/usr/bin/jsvc", "-nodetach", \
-    "-home", "/usr/lib/jvm/java-8-openjdk-amd64", \
-    "-cp", "/usr/share/java/commons-daemon.jar:/usr/lib/unifi/lib/ace.jar", \
-    "-pidfile", "/var/run/unifi/unifi.pid", \
-    "-procname", "unifi", \
-    "-outfile", "SYSLOG", \
-    "-errfile", "SYSLOG", \
-    "-Djava.awt.headless=true", \
-    "-Dunifi.datadir=/var/lib/unifi", \
-    "-Dunifi.logdir=/var/log/unifi", \
-    "-Dunifi.rundir=/var/run/unifi", \
-    "-Djava.awt.headless=true", \
-    "-Dfile.encoding=UTF-8", \
-    "-Xmx1024M", \
-    "com.ubnt.ace.Launcher" \
-]
+ENTRYPOINT "/entrypoint.sh"
diff --git a/unifi/Makefile b/unifi/Makefile
index ef6a8d0..cae032c 100644
--- a/unifi/Makefile
+++ b/unifi/Makefile
@@ -1,21 +1,33 @@
-IMAGE=unifi:latest
 REPO=575365190010.dkr.ecr.us-west-2.amazonaws.com
+VERSION=5.6.20
+IMAGE=unifi:$(VERSION)-alpine
+CHECKSUM_FILE="https://community.ubnt.com/ubnt/attachments/ubnt/Blog_UniFi/275/1/checksums.txt"
 
 all:
-        docker build -t unifi:latest .
+        docker build \
+                --build-arg=version=$(VERSION) \
+                --build-arg=checksum_file=$(CHECKSUM_FILE) \
+                -t $(IMAGE) .
 
 all-no-cache:
-        docker build --no-cache -t unifi .
+        docker build \
+                --no-cache \
+                --build-arg=version=$(VERSION) \
+                --build-arg=checksum_file=$(CHECKSUM_FILE) \
+                -t $(IMAGE) .
 
 run:
-        docker run -d --privileged \
-                -p 8080:8080 \
-                -p 8443:8443 \
-                -v /srv/unifi:/var/lib/unifi \
-                -v /var/log/docker/unifi:/var/log/unifi \
-                unifi:latest
+        docker run -d -p 8080:8080 -p 8443:8443 $(IMAGE)
 
 publish:
         eval $$(aws ecr get-login --region us-west-2)
-        docker tag $(IMAGE) $(REPO)/$(IMAGE)
+        docker tag $(IMAGE) mcrute/unifi-controller:$(VERSION)
+        docker tag $(IMAGE) mcrute/unifi-controller:stable
+        docker tag $(IMAGE) $(REPO)/unifi:$(VERSION)-alpine
+        docker tag $(IMAGE) $(REPO)/unifi:latest-alpine
+        docker tag $(IMAGE) $(REPO)/unifi:latest
         docker push $(REPO)/$(IMAGE)
+        docker push mcrute/unifi-controller:$(VERSION)
+        docker push mcrute/unifi-controller:stable
+        docker push $(REPO)/unifi:latest-alpine
+        docker push $(REPO)/unifi:latest
diff --git a/unifi/README.md b/unifi/README.md
new file mode 100644
index 0000000..c1566b2
--- /dev/null
+++ b/unifi/README.md
@@ -0,0 +1,50 @@
+[(Dockerfile)]: https://code.crute.me/mcrute/dockerfiles/tree/unifi/Dockerfile
+[Changelog]: https://community.ubnt.com/t5/UniFi-Updates-Blog/UniFi-5-6-20-Stable-has-been-released/ba-p/2119397?attachment-id=85425
+
+# Supported tags and respective `Dockerfile` links
+
+* `5.6.20`, `stable` [(Dockerfile)][] [Changelog][]
+
+
+[![unifi](https://dl.ubnt.com/press/logo-UniFi.jpg)](https://unifi-sdn.ubnt.com/)
+
+# Ubiquiti Unifi SDN Controller
+
+The UniFi Controller software is a powerful, enterprise wireless software engine ideal for high-density client deployments requiring low latency and high uptime performance. This unofficial image is a minimalist re-packaging of the upstream binaries into an Alpine Linux based container. The image has been adapted to better fit the Docker tooling by logging everything to stdout and running with reduced privileges.
+
+## Usage
+At a minimum users should mount a data volume over `/var/lib/unifi` for storage of their databases and downloaded firmware.
+
+A minimal run command would be:
+
+```
+docker run \
+    -v /your-unifi-path:/var/lib/unifi \
+    -p 8080:8080 \
+    -p 8443:8443 \
+    mcrute/unifi-controller:stable
+```
+
+After bootstrap the controller will run as the `unifi` user within the container. It is possible to map the unifi user id and group id within the container to a custom uid/gid using the `UNIFI_UID` and `UNIFI_GID` environment variables. The default is uid 101 and gid 102.
+
+An example of this:
+
+```
+docker run \
+    -v /your-unifi-path:/var/lib/unifi \
+    -e UNIFI_UID=201 \
+    -e UNIFI_GID=302 \
+    -p 8080:8080 \
+    -p 8443:8443 \
+    mcrute/unifi-controller:stable
+```
+
+## License
+View [license information](https://www.ubnt.com/eula/) for the software contained in this image.
+
+As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
+
+## Used Software
+This container builds on [Alpine Linux](http://alpinelinux.org/) and uses [su-exec](https://github.com/ncopa/su-exec) for privilege separation.
diff --git a/unifi/custom/entrypoint.sh b/unifi/custom/entrypoint.sh
new file mode 100755
index 0000000..c95c29c
--- /dev/null
+++ b/unifi/custom/entrypoint.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+BASEDIR=/usr/lib/unifi
+UNIFI_UID=${UNIFI_UID:-101}
+UNIFI_GID=${UNIFI_GID:-102}
+
+cd ${BASEDIR}
+
+# Create the user and group
+addgroup -g ${UNIFI_GID} -S unifi
+adduser -u ${UNIFI_UID} -S -h /var/lib/unifi -H -D -G unifi unifi
+
+# Update permissions on the root directories
+chown unifi /var/lib/unifi /var/log/unifi /var/run/unifi
+chown unifi /usr/lib/unifi/dl
+
+# Cleanup mongodb lock file if it exists otherwise the controller will freeze
+# forever trying to start Mongo
+[ -f data/db/mongod.lock ] && rm data/db/mongod.lock
+
+/usr/sbin/su-exec unifi /usr/lib/jvm/default-jvm/bin/java \
+        -cp `find /usr/lib/unifi/lib/ -name '*.jar' | tr '\n' ':'` \
+        -Dlog4j.configuration=file:${BASEDIR}/log4j.properties \
+        -Dunifi.datadir=${BASEDIR}/data \
+        -Dunifi.logdir=${BASEDIR}/logs \
+        -Dunifi.rundir=${BASEDIR}/run \
+        -Xmx1024M \
+        -Djava.awt.headless=true \
+        -Dfile.encoding=UTF-8 \
+        com.ubnt.ace.Launcher start
diff --git a/unifi/custom/log4j.properties b/unifi/custom/log4j.properties
new file mode 100644
index 0000000..643c623
--- /dev/null
+++ b/unifi/custom/log4j.properties
@@ -0,0 +1,25 @@
+log4j.rootLogger=INFO,server_log
+
+log4j.appender.server_log=org.apache.log4j.ConsoleAppender
+log4j.appender.server_log.layout=org.apache.log4j.PatternLayout
+log4j.appender.server_log.layout.ConversionPattern=[%d{ISO8601}] <%t> %-5p %-6c{1} - %m%n
+
+log4j.logger.java=INFO
+log4j.logger.javax=INFO
+log4j.logger.javax.jmdns=INFO
+log4j.logger.sun=INFO
+log4j.logger.org.apache=INFO
+log4j.logger.httpclient.wire=INFO
+log4j.logger.net.schmizz=INFO
+log4j.logger.com.codahale=INFO
+log4j.logger.org.apache.jasper=INFO
+log4j.logger.org.apache.tomcat=INFO
+log4j.logger.org.apache.commons=INFO
+log4j.logger.org.apache.catalina=INFO
+
+log4j.logger.org.springframework=INFO
+log4j.logger.de.javawi.jstun=INFO
+log4j.logger.com.mongodb=INFO
+
+log4j.logger.com.ubnt=INFO
+log4j.logger.com.ubiquiti=INFO
diff --git a/unifi/custom/su-exec-alpine b/unifi/custom/su-exec-alpine
new file mode 100755
index 0000000..f4905ab
--- /dev/null
+++ b/unifi/custom/su-exec-alpine