{"id":14224306,"url":"https://github.com/kchristensen/udm-le","last_synced_at":"2025-08-09T20:31:06.329Z","repository":{"id":37764492,"uuid":"245029154","full_name":"kchristensen/udm-le","owner":"kchristensen","description":"Let's Encrypt support for Ubiquiti UniFi OS","archived":false,"fork":false,"pushed_at":"2024-08-05T13:09:25.000Z","size":131,"stargazers_count":574,"open_issues_count":3,"forks_count":80,"subscribers_count":27,"default_branch":"main","last_synced_at":"2024-08-05T15:05:58.996Z","etag":null,"topics":["letsencrypt","ssl","ubiquiti","udm","udmp","udw","unifi","unifios"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kchristensen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-03-04T23:57:10.000Z","updated_at":"2024-08-05T13:09:29.000Z","dependencies_parsed_at":"2022-09-13T08:20:16.295Z","dependency_job_id":"4021f085-ba6f-48cf-9fca-45a1a288c5e7","html_url":"https://github.com/kchristensen/udm-le","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kchristensen%2Fudm-le","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kchristensen%2Fudm-le/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kchristensen%2Fudm-le/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kchristensen%2Fudm-le/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kchristensen","download_url":"https://codeload.github.com/kchristensen/udm-le/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":216059895,"owners_count":15969838,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["letsencrypt","ssl","ubiquiti","udm","udmp","udw","unifi","unifios"],"created_at":"2024-08-19T23:00:54.351Z","updated_at":"2025-08-09T20:31:06.299Z","avatar_url":"https://github.com/kchristensen.png","language":"Shell","funding_links":[],"categories":["Shell","Dream Machine Utilities"],"sub_categories":["Other Platforms"],"readme":"# Let's Encrypt for Ubiquiti UniFi OS\n\n## Overview\n\nThis should work on UniFi devices running UniFi OS 2.x or later, including:\n\n* UniFi Dream Machine\n* UniFi Dream Machine Pro\n* UniFi Dream Machine SE\n* UniFi Dream Router\n* UniFi Dream Wall\n* UniFi Express\n* UniFi Network Video Recorder\n* UniFi Network Video Recorder Professional\n* UniFi Enterprise Fortress Gateway\n\nThis script supports issuing Let's Encrypt SSL certificates via DNS using [Lego](https://go-acme.github.io/lego/).\n\nOut of the box, it has tested support for select [DNS providers](#dns-providers) but with little work you could get it working with any of the supported [Lego DNS Providers](https://go-acme.github.io/lego/dns/).\n\n## Installation\n\n1. Copy the contents of this repo to your device at `/data/udm-le`.\n2. Edit `/data/udm-le/udm-le.env` and tweak variables to meet your needs.\n3. If necessary, create and populate the `/data/udm-le/.secrets` directory with the files required by your DNS provider.\n4. Run `/data/udm-le/udm-le.sh initial`. This will handle your initial certificate generation and setup a systemd service to start the service on boot, as well as a systemd timer to attempt certificate renewal each morning between 0300 and 0305.\n\n## Uninstallation\n\n```bash\n# Disable udm-le from running at boot\nsystemctl disable udm-le\n\n# Delete any udm-le related data\nrm -rf /data/udm-le /mnt/data/udm-le\nrm -f /etc/systemd/system/udm-le.*\n\n# Delete any generated certificates, and restart services to generate new self-signed certificates\nrm -f /data/unifi-core/config/*.crt /data/unifi-core/config/*.key /data/unifi-core/config/*.pem\nsystemctl restart unifi-core\nsystemctl restart freeradius\n```\n\n## DNS Providers\n\n### AWS Route53\n\nIf you use Amazon Route53 as your DNS provider, set the `DNS_PROVIDER` to `route53` and configure variables in `udm-le.env` that start with `AWS_`.\n\n### Azure DNS\n\nIf not done already, [delegate a domain to an Azure DNS zone](https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns).\n\nAssuming the DNS zone lives in subscription `00000000-0000-0000-0000-000000000000` and resource group `udm-le`, with help of the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/) provision an identity to manage the DNS zone by running:\n\n```bash\n# Login\naz login\n\n# Create a service principal with contributor (default) permissions over the godns resource group\naz ad sp create-for-rbac --name godns --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/udm-le --role contributor\n```\n\n### Cloudflare\n\nIn your Cloudflare account settings, create an API token with the following permissions:\n\n* Zone \u003e Zone \u003e Read\n* Zone \u003e DNS \u003e Edit\n\nOnce you have your token generated, add the value to `udm-le.env`.\n\n### Digital Ocean\n\nIf you use DigitalOcean as your DNS provider, set your `DNS_PROVIDER` to `digitalocean` and configure your `DO_AUTH_TOKEN`. Note: Quoting your `DO_AUTH_TOKEN` seems to cause issues with Lego.\n\n### DuckDNS\n\nIf you use DuckDNS as your DNS provider, set your `DNS_PROVIDER` to `duckdns` and configure your `DUCKDNS_TOKEN`.\n\n### Gandi Live DNS (v5)\n\nIf you use Gandi Live DNS (v5) as your DNS provider, set your `DNS_PROVIDER` to `gandiv5` and configure your `GANDIV5_PERSONAL_ACCESS_TOKEN`. You can obtain your Personal Access Token (PAT) from your [account settings](https://account.gandi.net/).\n\n### Google Cloud DNS\n\nGCP Cloud DNS can be configured by establishing a service account with the role [`roles/dns.admin`](https://cloud.google.com/iam/docs/understanding-roles#dns-roles) and exporting a [service account key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys) for that service account. Ensure that `gcloud` is set for `DNS_PROVIDER` in `udm-le.env`, and `GCE_SERVICE_ACCOUNT_FILE` references the path to the service account key (e.g. `./root/.secrets/my_service_account.json`) . Create a new directory called `.secrets` in `/data/udm-le` and add the service account file.\n\nThe CLI will output a JSON object. Use the printed properties to initialize your configuration in [udm-le.env](./udm-le.env).\n\nNote:\n\n* The `password` value is a secret and as such you may want to omit it from [udm-le.env](./udm-le.env) and instead set it in a `.secrets/client-secret.txt` file\n* The `appId` value is what [Lego](https://go-acme.github.io/lego/) calls a client id\n\n### Google Domains\n\nIf you use Google Domains as your DNS provider, set the `DNS_PROVIDER` to `googledomains` and configure `GOOGLE_DOMAINS_ACCESS_TOKEN` with your access token. You can create an access token in your Google Domains dashboard under YOUR_DOMAIN \u003e Security \u003e ACME DNS API.\n\n### Linode DNS\n\nIf you use Linode as your DNS provider, set your `DNS_PROVIDER` to `linode` and configure `LINODE_TOKEN` with the value of an API token. The API token must have a scope which allows Read/Write access to \"Domains\". API tokens can be created in the Linode Control panel.\n\n### Loopia\n\nIf you use Loopia as your DNS provider, set your `DNS_PROVIDER` to `loopia` and configure `LOOPIA_API_USER` and `LOOPIA_API_PASSWORD`. The API user must be created at the [loopia customer zone](https://customerzone.loopia.com/api) with the following privileges:\n\n* addZoneRecord\n* getZoneRecords\n* removeZoneRecord\n* removeSubdomain\n\n### Name.com\n\nFollow [these instructions](https://www.name.com/support/articles/360007597874-signing-up-for-api-access) from name.com support to enable api access.\n\nAt the time of writing, the first few steps our out of date and I had to click `API for resellers` under the more menu which should get you to step 3.\n\nIf using Multifactor to login then you will need to read [this article](https://www.name.com/support/articles/360007989433-using-api-with-two-step-authentication) about how to disable multifactor for api only.\n\nThere are two values needed for the `udm-le.env` file: your name.com username; your generated api token for production.\n\n### Oracle Cloud Infrastructure (OCI) DNS\n\nTo configure the Oracle Cloud Infrastructure (OCI) DNS provider, you will need a [private API signing key](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) and your [tenancy and user account OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#five). The quickest way to get all that is to install the [OCI CLI](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cliconcepts.htm) locally and use its [interactive setup process](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile).\n\nThe setup process will create a `~/.oci/config` directory in which you can find your tenancy and user account OCIDs and key fingerprint and the API signing key will be stored in `~/.oci/oci_api_key.pem`. The following CLI command will return the compartment OCID for the specified OCI DNS zone:\n\n```bash\n$ oci dns zone get --zone-name-or-id example.com | jq -r '.data.\"compartment-id\"'\nocid1.compartment.oc1..secret\n```\n\n#### To configure the provider\n\n\u003e **Important: do not wrap the values of the `OCI_*` variables in `udm-le.env` with quotes. The lack of quotes around the example values provided in [`udm-le.env`](./udm-le.env) is intentional and must be maintained.\n\n1. Set the `DNS_PROVIDER` value to `\"oraclecloud\"`\n1. Uncomment and copy the values from each `~/.oci/config` variable to the similarly named `OCI_*` variable in `udm-le.env`.\n1. Create a new directory at `/data/udm-le/.secrets` and copy the `oci_api_key.pem` file that directory.\n\n### Zonomi\n\nIf you use Zonomi as your DNS provider, set your `DNS_PROVIDER` to `zonomi` and configure your `ZONOMI_API_KEY`.\n\nThe API key can be obtained [in your control panel](https://zonomi.com/app/cp/apikeys.jsp) under the DNS key type.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkchristensen%2Fudm-le","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkchristensen%2Fudm-le","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkchristensen%2Fudm-le/lists"}