lexlex0/unifarr repository overview

⁠Unifarr

Unlock the full potential of your firewall.

Logs, analysis, reports and configuration changes for UniFi gateways, with the experience of an enterprise firewall. Self-hosted, ready in minutes with Docker. The interface is available in English and French.

⁠Why Unifarr?

• See everything: every allowed or blocked connection and every IPS alert, live or over twelve months.
• Understand everything: which rules are used, which are useless or shadowed, and where attacks come from.
• Act safely: change rules, objects, NAT and VLANs with staging, safeguards and rollback.
• Prove it: compliance PDF reports (PCI DSS, ISO 27001, NIS2, HIPAA) and an audit log.
• Lose nothing: encrypted snapshots of the UniFi configuration, automatic backups to a folder or a NAS.

⁠Features

⁠The image

• Based on Python 3.13 Alpine, without pip in the final image
• Runs as a non-root user (UID 10001)
• Built-in health check (/healthz)
• Requires PostgreSQL 16 + TimescaleDB (see the example below)

⁠Quick start

docker-compose.yml:

services:
  db:
    image: timescale/timescaledb:2.17.2-pg16
    restart: unless-stopped
    environment:
      POSTGRES_DB: unifarr
      POSTGRES_USER: unifarr
      POSTGRES_PASSWORD: ${DB_PASSWORD:?Set DB_PASSWORD in .env}
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U unifarr -d unifarr"]
      interval: 10s
      timeout: 5s
      retries: 10

  app:
    image: YOUR_NAMESPACE/unifarr:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://unifarr:${DB_PASSWORD}@db:5432/unifarr
      SNAPSHOT_KEY: ${SNAPSHOT_KEY:-}
      TZ: ${TZ:-Europe/Paris}
    volumes:
      - app-data:/data
      - app-export:/etc/export
    ports:
      - "8080:8080"
      - "514:5514/udp"
      - "514:5514/tcp"
      - "2055:2055/udp"

volumes:
  db-data:
  app-data:
  app-export:

.env:

DB_PASSWORD=change-me
SNAPSHOT_KEY=
TZ=Europe/Paris

Start it with docker compose up -d, then:

1. Open http://<server>:8080 and create the administrator account (the setup code is shown in docker compose logs app).
2. On the UniFi console, send syslog to port 514 of the server (CyberSecure › Traffic Logging › Activity Logging, all categories), then enable Syslog Logging on the rules to log.
3. In Unifarr › Settings › UniFi API, add a local console account to read rules and objects.
4. Optional: send IPFIX / NetFlow to port 2055 for bandwidth charts.

⁠Ports and volumes

⁠Environment variables

Generate a key for SECRET_KEY or SNAPSHOT_KEY (use two different keys) and keep it off the server:

openssl rand -base64 32 | tr '+/' '-_'

⁠Updating

docker compose pull && docker compose up -d

Database migrations are applied automatically on start. As an alpha release, back up the database before updating.

⁠Licence

MIT licence. GeoIP databases remain subject to their own licences. UniFi is a trademark of Ubiquiti Inc. and FortiGate a trademark of Fortinet, Inc.; Unifarr is not affiliated with either company.