UniFi Alarm Panel

Arming	Entry delay	Alarm

Overview	Audit log	Sensors

Not affiliated with Ubiquiti. UniFi is a trademark of Ubiquiti Inc.

Why this exists

UniFi Alarm Manager handles the sensors, arming and notifications. What it doesn't have is the human side of an alarm at the door: someone walks in, a countdown starts, they type their own PIN, and the system knows who disarmed it. This app adds that layer and keeps UniFi for what it does well (sensors, cameras, the console).

• Arm with a tap at the door, no code needed to leave. Disarm with a personal 4-digit PIN.
• Entry and exit delays per sensor, a door-open check before arming, and a real ALARM with a camera snapshot in the alert.
• A duress PIN that disarms normally but alerts admins silently.
• An append-only audit log of who armed, who disarmed and what tripped.
• No monitoring subscription and no cloud service. Everything runs on your LAN.

Quick start

You need a UniFi console with Protect, a Linux host or container host on the same LAN, and a tablet for the wall.

git clone https://github.com/FelixLeChat/unifi-alarm-panel.git
cd unifi-alarm-panel
cat > .env <<EOF
ADMIN_TOKEN=$(openssl rand -hex 24)
WEBHOOK_SHARED_SECRET=$(openssl rand -hex 24)
SECRETS_KEY=$(openssl rand -base64 32)
EOF
docker compose up -d

Open http://<this-host>:3000/admin, sign in with ADMIN_TOKEN, and the setup wizard walks you through the console connection, notifications and the kiosk. Then point the tablet at http://<this-host>:3000/panel.

Keep a copy of SECRETS_KEY: without it, stored credentials have to be re-entered. Run one app container only, the alarm's timers live in that process.

On Proxmox VE, one command creates the container and installs everything: see docs/INSTALL.md, which also covers systemd on a bare box.

How it works

Arming lives on this server, not in UniFi. UniFi (Alarm Manager) is an event source and camera layer. It webhooks every sensor trip to this app, which owns the armed/disarmed state, the PINs, the audit log and the alert logic. Adopting sensors forces Alarm Manager into "Global" mode, where arm/disarm isn't reliably controllable through the API, and this design gives per-person accountability.

UniFi's own arm state is mirrored into this app when someone arms from the console, but it never overrides a local change. See docs/UNIFI.md.

One Next.js and TypeScript app serves the kiosk (/panel), the admin UI (/admin) and the API as a single long-lived Node process, with SQLite for state. A restart partway through a countdown still escalates to ALARM on the original schedule.

Open docs/architecture/how-it-works.html in a browser for an interactive version that traces routes and exports the diagram.

Features

• Kiosk: door list in every state, countdown that grows in the last 10 seconds, sounds with quiet hours, PIN lockout that raises ALARM, weather strip.
• Alerts: Slack, ntfy, Telegram and Signal, each with its own routing for Alarm, Duress and Health, snapshots from Protect, and a per-channel test button.
• Admin: Overview, Sensors, PINs, Delays, Audit log, Events, Tasks and Settings, plus a first-run setup wizard. Live camera view through go2rtc.
• UniFi: webhook and realtime-stream intake, console arm-state sync, device health, a watchdog for a silent sensor feed.
• Hardening: credentials encrypted at rest, throttled admin and webhook guards, CSP, pnpm audit and CodeQL in CI.

Tested with

• UniFi Dream Machine Pro, Protect 7.x
• UP-Sense sensors (door and motion mode) over Bluetooth through an access point
• G5 Turret Ultra cameras for snapshots and live view
• An Amazon Fire HD 10 tablet (amazon.ca) running /panel fullscreen in Fully Kiosk Browser
• The server: any Linux box or container host on the same LAN as the console

How it was built

Most of this code was written with Claude Code, directed and reviewed by one person. The design (arming lives on this server, per-person PINs, the duress path, the shared PIN lockout) is the author's, and every change goes through the same gate as a contributor's: pnpm lint, pnpm typecheck, the Vitest unit suite, a Playwright suite that drives the real panel and admin UI in a browser, pnpm audit and CodeQL in CI, then a run on the author's own hardware. It has been the alarm at the author's house and office since September 2026.

If you review it, read it as you would any other codebase. If you contribute, AI_POLICY.md says what is expected of a pull request.

Possible improvements

• Tie arm and disarm to UniFi Access, for example a G3 Fingerprint reader at the door, so a fingerprint can disarm without typing a PIN on the panel.

Documentation

Read it as a site: felixlechat.github.io/unifi-alarm-panel. The same pages live in docs/.

Doc	What it covers
INSTALL.md	Docker Compose and systemd installs
CONFIGURATION.md	Settings, alert channels and routing, upgrade notes, advanced keys
UNIFI.md	Sensor-event sources, arm-state sync, camera streaming
SIGNAL.md	Signal alerts through signal-cli-rest-api
OPERATIONS.md	Audit log, backups, watchdog, TLS
RUNBOOK.md	One page for whoever is on call
DEVELOPMENT.md	Repo layout, running it locally, faking UniFi

Contributing and support

Bug reports, ideas and pull requests are welcome. CONTRIBUTING.md says where to start and what a good pull request looks like. Questions and ideas go in Discussions, bugs in Issues. To report a vulnerability, see SECURITY.md.

License

MIT. Third-party notices in NOTICE.