UniFi-Dash: Secure UniFi Network Dashboard for Raspberry Pi.

Monitor The Situation, Harder Than Ever Before. (in it's current state, this is a walkthrough)

An always-on dashboard showing your UniFi infra's health & network stats with extreme granularity, running on a Raspberry Pi 4 (2gb RAM). Hardened Pi uses UniFi API to pull stats safely from a read-only account without auto-logout. Strict security controls make it a hard box to pop/pivot by a threat actor.

Visibility: You can see incredibly granular, overlayed metrics pulled from all your Ubiquiti gear. These are the dashboards I use, you can also create your own with any of the following data:

USG / Gateway insights:

Uptime, uplink latency, CPU/RAM usage, Load Average, WAN/LAN throughput, WAN/LAN packets sent/s, WAN/LAN packets dropped/s.

UAP / Wifi insights:

Which Radios are broadcasting which vlans, CPU/RAM usage, Clients connected to each AP, Load-average per AP, OUI client metrics, user radio band jumps, Average AP client RSSI, Average client signal, 2.4/5ghz connection quality, 2.4/5ghz channel utilization, 2.4/5ghz Total traffic on each AP, 2.4/5ghz Packets/s sent and dropped on all APs, or drill down onto each.

USW / PoE Switch insights:

Device Temp, Average Load, CPU/RAM usage, TX/RX Data Transfer, TX/RX/Broadcast/Multicast/Errors by switchport, PoE power/voltage/current by switchport, Port/Uplink data.

Client Insights:

All clients connected can be organized by MAC, IP, Vlan, Name, Channel, Radio, AP, SSID, Uptime, Wired/Wireless or TX/RX bytes. Client Bandwidth for Echos, FireTVs, Cameras. Client RSSI, Wireless Signal, UAP Client Stats/Noise, TX/RX attempts/rate, TX Power, Anomalies, Client Satisfaction, Connection Quality, Roam Count, camera bandwidth, plenty more.

Security:

• loopback-only binds: every service (prometheus, unpoller, grafana) listens on 127.0.0.1, unreachable over the network.
• least-privilege account: unpoller uses a verified read-only UniFi Viewer account, so a compromise yields a view, not control.
• locked creds: the gateway/controller creds live in a config file restricted to root and chmod 600.
• hardened kiosk browser: a root-owned Chromium managed policy blocks traffic from leaving the dashboard and restricts downloads, sign-in, dev tools + extensions. This can be turned off.
• Host Firewall: on the Pi, ufw enforces default-deny inbound as a layer behind the loopback binds.
• Gateway Firewall: Off-box fw policy scoped to the Pi's IP allows only controller/DNS/NTP/updates, making lateral movement tough.
• Supply-chain hygiene: everything installs from signed, apt-tracked repos so patches land automatically via unattended-upgrades.

This Build Uses:

• Grafana for dashboard GUI, database queries
• Prometheus for DB
• Unpoller for hitting UniFi API w/ a read-only account
• hardened chromium for kiosk mode

Hardware

• Raspberry Pi 4 (I used a 2gb model, with a 30gb mini-sd card).
• A monitor. this build only works with a horizontal monitor, long story. 1920x1080p.
• A UniFi network with a gateway/controller reachable at https://192.168.1.1
• A managed switch path that can carry the Pi's VLAN, see WALKTHROUGH.md Chapter 1.

how I do?

The whole build is one file: WALKTHROUGH.md, with an optional downstream switch tutorial Trunk_Port_Walkthrough.md, only applicable if the Pi is being plugged into an access layer switch instead of the router or first switch out of the router.