Tim's blah blah blah

Upgrading UniFi Network Server/controller on Proxmox

My UniFi Network Server (the controller required to configure Unifi devices) was working fine for 4 years, but with new APs I want to upgrade to a new version. Below I document my successful migration from 7.3 to 10.6.

Approach

  1. Upgrade UniFi Network Server from 7.3 (installed via apt) to 10.6 (via binary download) –> looked a bit tricky from Debian 11 to 13 and Unifi from 7.3 to 10.6, including Mongo requirements
  2. Install fresh UniFi Network Server 10.6 (via binary download), then swap and decommission old server –> current approach
  3. Migrate to new Unifi OS Server method 5.1.42 –> maybe later

Backup

  1. Run proxmox backup of the UniFi Network Server LXC - automatically
  2. Download configuration backup from UniFi Network Server - manually

Migrating

Create fresh LXC

Create new Debian LXC

pveam update
pveam available
pveam download local debian-13-standard_13.6-1_amd64.tar.zst
pvesm status

pct create 204 local:vztmpl/debian-13-standard_13.6-1_amd64.tar.zst --description "Debian13 LXC Unifi Network Application" --hostname deb13unifi --rootfs local-zfs:8 --unprivileged 1 --cores 2 --memory 2048 --ssh-public-keys /root/.ssh/id_rsa.pub --net0 name=eth0,bridge=vmbr0,firewall=0,gw=172.17.10.1,ip=172.17.10.9/24,tag=10
pct set 204 --onboot 1
pct set 204 --searchdomain lan.vanwerkhoven.org --nameserver 172.17.10.1

Set up basic server config

pct start 204
pct enter 204

passwd
apt install sudo vim
dpkg-reconfigure locales
dpkg-reconfigure tzdata

pct shutdown 204
pct set 204 --features nesting=1
pct start 204

apt update && apt upgrade

apt install unattended-upgrades
# Comment 'label=Debian' to not auto-update too much
vi /etc/apt/apt.conf.d/50unattended-upgrades

# Tweak some settings
cat << 'EOF' | sudo tee -a /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
EOF

sudo unattended-upgrades --dry-run --debug

Install UniFi Network Server

From Updating and Installing Self-Hosted UniFi Network Servers (Linux) (ui.com)

apt-get update && apt-get install ca-certificates apt-transport-https

Get MongoDB 8.0 (the newest version supported by UniFi Network Servers 10.6) and Java dependencies

sudo apt-get install gnupg curl
curl -fsSL https://pgp.mongodb.com/server-8.0.asc | \
   sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg \
   --dearmor

echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/8.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list
apt-get update
apt-get install mongodb-org-server 

apt install openjdk-25-jre-headless
dpkg --configure -a
apt -f install

Install UniFi Network Server via dpkg

wget https://dl.ui.com/unifi/10.6.101/unifi_sysvinit_all.deb
dpkg --install unifi_sysvinit_all.deb

systemctl is-enabled unifi
systemctl enable unifi

Setup firewall 

set firewall ipv4 name FW_TRUST2INFRA rule 231 action 'return'
set firewall ipv4 name FW_TRUST2INFRA rule 231 description 'accept ssh to deb13unifi controller'
set firewall ipv4 name FW_TRUST2INFRA rule 231 destination address '172.17.10.x'
set firewall ipv4 name FW_TRUST2INFRA rule 231 destination port '22,443,8443'
set firewall ipv4 name FW_TRUST2INFRA rule 231 protocol 'tcp'

Configure and swap servers

  1. Now boot new Unifi Network server
  2. Restore backup from other Unifi server
  3. Shut down both machines
  4. Change IP of new LXC to old LXC’s IP
  5. Decomission old LXC, enable new LXC
  6. Start new Unifi Server, log in, see devices appear within 1-2 minutes
  7. Profit!

#Debian #Linux #Networking #Proxmox #Security #Server #Unifi