Using generator for more then 1 Unifi device

[jlengelbrecht]

What would be the best way to use this for more then one device. I am looking into expanding this keeping 2 UDMs in sync using the terraform this generates.

[robbycuenot]

Hey @jlengelbrecht, that depends on what all you're trying to sync, and whether it is one-way or bi-directional. The tool uses the _id field on most items to name the resources -- for example, a guest network would be generated like this:

resource "unifi_network" "id_659f5a02c1bb8534c1b372e8" {
  name          = "Guest"
  site          = local.unifi_site_Default.name
  purpose       = "guest"
  network_group = "LAN"

  subnet             = "10.0.176.1/24"
  vlan_id            = 176

  dhcp_enabled               = true
  dhcp_lease                 = 86400
  dhcp_relay_enabled         = false
  dhcp_start                 = "10.0.176.100"
  dhcp_stop                  = "10.0.176.254"
  dhcp_v6_dns_auto           = true
  dhcpd_boot_enabled         = false
  domain_name                = "guest.lan"
  igmp_snooping              = false
  internet_access_enabled    = true
  ipv6_interface_type        = "none"
  ipv6_ra_enable             = false
  ipv6_ra_preferred_lifetime = 14400
  ipv6_ra_valid_lifetime     = 86400
  multicast_dns              = true

  lifecycle {
    prevent_destroy = true
  }
}

A bit of a digression explaining this:
Using this immutable ID has some advantages. Using any other mutable field, such as name, would mean that any time a resource name is changed, the state would have to be modified to track the newly renamed resource. With the immutable ID, you can change any attribute without worrying about the resource name changing. In addition, many rest responses from the unifi API reference other objects via those IDs, so building code that links the resources to one another can be done by looking up maps of IDs to resources.

Why this matters:
If you are trying to sync two UDMs via one way sync, the actual name of the resources will not matter too much (at least for non-physical objects). You could directly copy and apply the networks, firewall rules, wlans, static routes, port forwarding rules, and ddns settings without much issue. The trouble comes in with bi-directional sync. You'd need to update the code to name the resources something more environment agnostic. This is where using the "name" attribute to generate the resource name would make more sense.

I hope this ramble makes some sense lol

[robbycuenot]

I'm glad you're seeing some value in it! You're the first tester I've had so I'm happy to walk you through the setup if you need help lol. I'd recommend just generating the config first to see what it looks like, and then you can figure out how to tweak it for your use case

[jlengelbrecht]

Looks like Unifi is making some changes. Will this impact the ability to use terraform with since all accounts will now require MFA going forward? I set up the automation account without MFA, but I am curious if this will have an impact or not.
https://community.ui.com/questions/Upcoming-Multi-Factor-Authentication-MFA-Requirement-for-All-UI-Accounts-in-July-2024/e0d06d3c-c0ae-4af6-aa67-53c159d486a8

[robbycuenot]

Looks like that's only for UI.com accounts, meaning through the SSO portal. Local accounts should be unaffected. Have you had a chance to test this out yet?

[jlengelbrecht]

I have built something out in my homelab repo but decided that this would need to be separated out into its own repo due to all the moving pieces etc. Part i am trying to figure out at the moment is the TF provider. I see there is a section for cloud {
organization = "example" do I need to update this? OR can the provider.tf just be used as is?

[robbycuenot]

Ah, I wrote that for use with Terraform Cloud, which is what I use. You can remove the entire cloud block if you're just running this locally. Now, make sure for the unifi provider block you read the docs on what needs to be provided. The block is blank in the example as I use environment variables defined in the TFC workspace. You'll need to provide those in your local environment. You can either provide the params in the provider block, or set the environment variables on your local system.

Here's an example provider block for unifi:

provider "unifi" {
  username = var.username # optionally use UNIFI_USERNAME env var
  password = var.password # optionally use UNIFI_PASSWORD env var
  api_url  = var.api_url  # optionally use UNIFI_API env var

  # you may need to allow insecure TLS communications unless you have configured
  # certificates for your controller
  allow_insecure = var.insecure # optionally use UNIFI_INSECURE env var

  # if you are not configuring the default site, you can change the site
  # site = "foo" or optionally use UNIFI_SITE env var
}

[jlengelbrecht]

Hi @robbycuenot sorry for my delay in response. Had some other projects come my way. Playing around with this again and got this run on a self-hosted action runner in my github org.

Had some trouble trying to figure out the providers.tf file but I think I got it now. I am not very experienced with terraform but I am doing my best to learn. I was able to generate the the tf files and starting to explore how to automate from this. From what I can tell any modification to the .tf files within the repo is not automatically synced correct?

In order to update lets say DNS A records or Firewall rules on my UDM SE with tf. I would need to create a action for my runner to push these changes? Sorry still trying to figure out the terraform cloud piece of this.

Additionally does the repo in its current state support DNS records? DNS was added as a feature a few months back. I saw some terraform for dynamic dns but from the tf files generated I don't see anything that shows me a list of DNS records.

My goal is to use this to update DNS records and firewall rules between multiple UDMs and my Unifi Express travel router. Any guidance you could give me is much appreciated.