Run the ISN UniFi connector as a service

sudo mkdir -p /opt/isn-connector
sudo curl -fsSL "THE-LINK-FROM-YOUR-DASHBOARD" -o /opt/isn-connector/isn-unifi-connector.js

curl -fsSL https://isnfreewifi.co.za/isn/connector/install-isn-connector.sh -o install-isn-connector.sh
less install-isn-connector.sh

sudo UNIFI_URL="https://192.168.1.2" UNIFI_USER="isn-connector" bash install-isn-connector.sh

sha256sum install-isn-connector.sh
# expected: 3d0e854a71422c3eca792aa2b9ec9c37a555a956c2bc8f3d41ac367dd22d73a6

#!/usr/bin/env bash
# ISN UniFi connector: run it as a service that starts by itself after every reboot (Linux, systemd).
#
# 1. Put the connector program in /opt/isn-connector/isn-unifi-connector.js (download it from your ISN dashboard).
# 2. Run this script as root, giving the controller address and the LOCAL UniFi account the connector signs in with.
#    You are asked for the password, so it is never written in your command history or in the system log:
#
#      sudo UNIFI_URL="https://192.168.1.2" UNIFI_USER="isn-connector" bash install-isn-connector.sh
#
#    (Setting UNIFI_PASS on the command line also works, but then the password is recorded in your shell history and the sudo log.)
#
# To remove the service again:   sudo bash install-isn-connector.sh --uninstall
# Read this file before you run it. It only creates the files named below and one systemd service.
set -euo pipefail

APP_DIR=/opt/isn-connector
APP_FILE="$APP_DIR/isn-unifi-connector.js"
ENV_FILE=/etc/isn-connector.env
UNIT_FILE=/etc/systemd/system/isn-connector.service
SERVICE_USER=isn-connector

say() { printf '%s\n' "$*"; }
die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || die "Run this as root, for example: sudo bash $0"
command -v systemctl >/dev/null 2>&1 || die "This script needs systemd. On another system use Docker (see the ISN connector guide)."

if [ "${1:-}" = "--uninstall" ]; then
  systemctl disable --now isn-connector.service 2>/dev/null || true
  rm -f "$UNIT_FILE" "$ENV_FILE"
  systemctl daemon-reload
  say "The ISN connector service was removed. The program file in $APP_DIR was left in place; delete it yourself if you want."
  exit 0
fi

# Node.js 18 or newer is required.
NODE_BIN="$(command -v node || true)"
[ -n "$NODE_BIN" ] || die "Node.js is not installed. Install Node.js 18 or newer first (for example from nodejs.org or your package manager)."
case "$NODE_BIN" in /home/*|/root/*) die "Node.js is installed in a personal folder ($NODE_BIN). Install the system-wide Node.js (your package manager or NodeSource) so the service does not depend on one person's files." ;; esac
NODE_MAJOR="$("$NODE_BIN" -p 'process.versions.node.split(".")[0]')"
[ "$NODE_MAJOR" -ge 18 ] || die "Node.js $NODE_MAJOR found, but 18 or newer is required."

[ -f "$APP_FILE" ] || die "The connector program is missing. Put it at $APP_FILE first (download it from your ISN dashboard)."

UNIFI_URL="${UNIFI_URL:-}"; UNIFI_USER="${UNIFI_USER:-}"; UNIFI_PASS="${UNIFI_PASS:-}"
[ -n "$UNIFI_URL" ]  || die "Set UNIFI_URL, for example https://192.168.1.2"
[ -n "$UNIFI_USER" ] || die "Set UNIFI_USER to the local UniFi account for the connector."
if [ -z "$UNIFI_PASS" ]; then
  [ -t 0 ] || die "Set UNIFI_PASS (or run this in a terminal and type it when asked)."
  read -r -s -p "Password for $UNIFI_USER: " UNIFI_PASS; printf '\n'
fi

# A dedicated account with no login and no home folder: the connector needs no special rights.
id "$SERVICE_USER" >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin "$SERVICE_USER"
chown -R root:"$SERVICE_USER" "$APP_DIR"; chmod 750 "$APP_DIR"; chmod 640 "$APP_FILE"

# systemd reads this file as root, so only root needs to be able to read it. Quotes and backslashes are escaped for systemd.
esc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'; }
umask 077
{
  printf 'UNIFI_URL="%s"\n' "$(esc "$UNIFI_URL")"
  printf 'UNIFI_USER="%s"\n' "$(esc "$UNIFI_USER")"
  printf 'UNIFI_PASS="%s"\n' "$(esc "$UNIFI_PASS")"
} > "$ENV_FILE"
chmod 600 "$ENV_FILE"; chown root:root "$ENV_FILE"

cat > "$UNIT_FILE" <<UNIT
[Unit]
Description=ISN UniFi connector
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=$SERVICE_USER
EnvironmentFile=$ENV_FILE
ExecStart=$NODE_BIN $APP_FILE
Restart=always
RestartSec=10
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
UNIT
chmod 644 "$UNIT_FILE"

systemctl daemon-reload
systemctl enable --now isn-connector.service
sleep 3
systemctl --no-pager --lines=8 status isn-connector.service || true
say ""
say "Done. The connector now starts by itself after every reboot and restarts if it stops."
say "Check it:        systemctl status isn-connector"
say "Watch its log:   journalctl -u isn-connector -f"
say "Update it:       replace $APP_FILE with the new download, then: sudo systemctl restart isn-connector"

mkdir C:\ProgramData\ISN-Connector
curl.exe -fsSL "THE-LINK-FROM-YOUR-DASHBOARD" -o C:\ProgramData\ISN-Connector\isn-unifi-connector.js

curl.exe -fsSL https://isnfreewifi.co.za/isn/connector/install-isn-connector.ps1 -o install-isn-connector.ps1
Get-FileHash .\install-isn-connector.ps1 -Algorithm SHA256   # expected: dffd03246c031de91a6a8c8fd9111bf2507c5e9c68e1694fa6f9edf914b6ead7
notepad install-isn-connector.ps1
powershell -ExecutionPolicy Bypass -File .\install-isn-connector.ps1 -UnifiUrl "https://192.168.1.2" -UnifiUser "isn-connector"

<#
  ISN UniFi connector: run it as a Windows scheduled task that starts by itself after every reboot.

  1. Install Node.js 18 or newer (nodejs.org, 64-bit).
  2. Download the connector program from your ISN dashboard to  C:\ProgramData\ISN-Connector\isn-unifi-connector.js
  3. Open PowerShell as Administrator and run:

       powershell -ExecutionPolicy Bypass -File .\install-isn-connector.ps1 -UnifiUrl "https://192.168.1.2" -UnifiUser "isn-connector"

     (you are asked for the password; or add -UnifiPass 'the-password')

  To remove it again:  .\install-isn-connector.ps1 -Uninstall
  To only show what would be done:  add -DryRun

  Read this file before you run it. It creates one folder under C:\ProgramData, one scheduled task, and nothing else.
#>
[CmdletBinding()]
param(
  [string]$UnifiUrl,
  [string]$UnifiUser,
  [string]$UnifiPass,
  [switch]$Uninstall,
  [switch]$DryRun
)
$ErrorActionPreference = 'Stop'
$AppDir  = Join-Path $env:ProgramData 'ISN-Connector'
$AppFile = Join-Path $AppDir 'isn-unifi-connector.js'
$Runner  = Join-Path $AppDir 'run-connector.cmd'
$LogFile = Join-Path $AppDir 'connector.log'
$TaskName = 'ISN UniFi Connector'

function Say($m) { Write-Host $m }
function Do-It($what, [scriptblock]$action) { if ($DryRun) { Say "[dry run] $what" } else { & $action } }

$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin -and -not $DryRun) { throw 'Run this in a PowerShell window opened with "Run as administrator".' }

if ($Uninstall) {
  Do-It "Stop and remove the scheduled task '$TaskName'" {
    if (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue) { Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue; Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false }
    if (Test-Path $Runner) { Remove-Item $Runner -Force }
  }
  Say "The ISN connector task was removed. The folder $AppDir was left in place; delete it yourself if you want."
  return
}

# Node.js 18 or newer
$node = Get-Command node -ErrorAction SilentlyContinue
if (-not $node) { throw 'Node.js is not installed. Install Node.js 18 or newer (64-bit) from nodejs.org first.' }
# The task runs as SYSTEM, so the Node.js it starts must not sit in a folder an ordinary user can change.
if ($node.Source -like "$env:SystemDrive\Users\*") { throw "Node.js is installed in a user folder ($($node.Source)). Install the system-wide Node.js from nodejs.org (it goes in Program Files) and run this again." }
$major = [int](& $node.Source -p "process.versions.node.split('.')[0]")
if ($major -lt 18) { throw "Node.js $major found, but 18 or newer is required." }

if (-not (Test-Path $AppFile) -and -not $DryRun) { throw "The connector program is missing. Download it from your ISN dashboard to $AppFile first." }
if (-not $UnifiUrl)  { throw 'Give -UnifiUrl, for example https://192.168.1.2' }
if (-not $UnifiUser) { throw 'Give -UnifiUser, the local UniFi account for the connector.' }
if (-not $UnifiPass) {
  if ($DryRun) { $UnifiPass = 'dry-run' }
  else {
    $secure = Read-Host -AsSecureString "Password for $UnifiUser"
    $UnifiPass = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure))
  }
}
# cmd.exe special characters in the values would break the runner file, so refuse them rather than guess.
foreach ($v in @($UnifiUrl, $UnifiUser, $UnifiPass)) { if ($v -match '[&|<>^%"\r\n]') { throw 'The address, user name and password cannot contain these characters: & | < > ^ % " . Pick a password without them for this account.' } }

Do-It "Lock $AppDir to Administrators and SYSTEM, then write $Runner" {
  New-Item -ItemType Directory -Force -Path $AppDir | Out-Null
  # Lock the folder FIRST (and the files already in it, such as the connector program), so nobody else can read the password even for a moment.
  & icacls $AppDir /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' /T | Out-Null
  if ($LASTEXITCODE -ne 0) { throw "Could not restrict access to $AppDir, so nothing was written." }
  $lines = @('@echo off', "set UNIFI_URL=$UnifiUrl", "set UNIFI_USER=$UnifiUser", "set UNIFI_PASS=$UnifiPass", "`"$($node.Source)`" `"$AppFile`" >> `"$LogFile`" 2>&1")
  Set-Content -Path $Runner -Value $lines -Encoding ASCII
}

Do-It "Register the scheduled task '$TaskName' (runs at startup as SYSTEM, restarts if it stops)" {
  if (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue) { Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false }
  $action    = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument "/c `"$Runner`""
  $trigger   = New-ScheduledTaskTrigger -AtStartup
  $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
  $settings  = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -StartWhenAvailable -MultipleInstances IgnoreNew -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
  Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Description 'ISN UniFi connector (starts at boot)' | Out-Null
  Start-ScheduledTask -TaskName $TaskName
}

Say ''
Say 'Done. The connector now starts by itself after every reboot and restarts if it stops.'
Say "Check it:       Get-ScheduledTask -TaskName '$TaskName' | Get-ScheduledTaskInfo"
Say "Its log:        Get-Content '$LogFile' -Tail 30"
Say "Update it:      replace $AppFile with the new download, then  Stop-ScheduledTask -TaskName '$TaskName'; Start-ScheduledTask -TaskName '$TaskName'"

UNIFI_URL=https://192.168.1.2
UNIFI_USER=isn-connector
UNIFI_PASS=the-password

services:
  isn-connector:
    image: node:20-alpine
    container_name: isn-connector
    restart: unless-stopped
    working_dir: /app
    command: ["node", "/app/isn-unifi-connector.js"]
    volumes:
      - ./isn-unifi-connector.js:/app/isn-unifi-connector.js:ro
    env_file:
      - ./isn-connector.env