[BUG] 9.1.120 upgrade from 9.0.114 causing 500 errors on aggregated-dashboard and authorization failures

[francocm]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Upgrading linuxserver/unifi-network-application from 9.0.114 to 9.1.120 causes dashboard crash, authorization failures and wifi reboots.

Observed problems:

1. Whilst on manage/default/dashboard the underlying API call to GET /v2/api/site/default/aggregated-dashboard?historySeconds=86400 fails with a 500 (Internal Server Error).
2. The Docker application logs output this error: unifi-db | {"t":{"$date":"2025-05-19T22:52:09.867+00:00"},"s":"I", "c":"ACCESS", "id":20436, "ctx":"conn12","msg":"Checking authorization failed","attr":{"error":{"code":13,"codeName":"Unauthorized","errmsg":"not authorized on unifi_audit to execute command { aggregate: \"traffic_flow\", pipeline: [ { $match: { site_id: ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx'), time: { $gte: 1747609200000, $lte: 1747695300000 }, $and: [ { policies.type: { $in: [ 21, 6 ] } } ] } }, { $group: { _id: 1, n: { $sum: 1 } } } ], cursor: {}, $db: \"unifi_audit\", lsid: { id: UUID(\"e9ea5aeb-38cc-4ec6-a57f-22d8aef86690\") } }"}}}
   • I have redacted the ObjectId in the content above
3. Whilst still running this broken build, the site Wifi network becomes unstable and occasionally restarting
   • No such problems happen even when unifi-network-application is completely offline. Only this state seems to be triggering Wifi failure

Restoring backup (rolling back to previous version) recovers.

Expected Behavior

Upgrade to work seamlessly similar to all other updates before it.

Steps To Reproduce

1. docker compose down
2. Backup full directory (including mounts)
3. Modify docker-compose.yml by changing only 9.0.114 to 9.1.120 on the line saying image: linuxserver/unifi-network-application:9.0.114
4. docker compose up -d
5. Wait for application to start up

Then simply try to use it / observe wifi network / see logs.

Environment

- OS: Ubuntu 24.04.2 LTS (on RaspberryPi 5 8GB RAM)
- How docker service was installed: https://docs.docker.com/engine/install/ubuntu/

CPU architecture

arm64

Docker creation

The `linuxserver/unifi-network-application` uses the following `docker-compose.yml` _(I have replaced sensitive values with `xxxxx...`)_


services:
  unifi-db:
    image: docker.io/mongo:8.0.9
    container_name: unifi-db
    environment:
      - MONGO_INITDB_ROOT_USERNAME=root
      - MONGO_INITDB_ROOT_PASSWORD=xxxxxxxxxxxxxxxxxxxxxxxxxxx
      - MONGO_USER=unifi
      - MONGO_PASS=xxxxxxxxxxxxxxxxxxxxxx
      - MONGO_DBNAME=unifi
      - MONGO_AUTHSOURCE=admin
    volumes:
      - ./mongo-data/data:/data/db
      - ./mongo-data/init-mongo.sh:/docker-entrypoint-initdb.d/init-mongo.sh:ro
    restart: unless-stopped
    networks:
      - unifi-app
    healthcheck:
      test: bash -c "if mongosh --eval 'quit(db.runCommand({ping:1 }).ok?0:2)'; then exit 0; fi; exit 1;"
      interval: 10s
      timeout: 10s
      retries: 5
      start_period: 40s
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "10"
  unifi-network-application:
    image: linuxserver/unifi-network-application:9.0.114
    container_name: unifi-network-application
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - MONGO_USER=unifi
      - MONGO_PASS=xxxxxxxxxxxxxxxxxxxxxx
      - MONGO_HOST=unifi-db
      - MONGO_PORT=27017
      - MONGO_DBNAME=unifi
      - MONGO_AUTHSOURCE=admin
      - MEM_LIMIT=1024 #optional
      - MEM_STARTUP=1024 #optional
      - MONGO_TLS= #optional
    volumes:
      - ./unifi-data:/config
    depends_on:
      unifi-db:
        condition: service_healthy
    ports:
      - 3478:3478/udp
      - 10001:10001/udp
      - 8080:8080
      - 1900:1900/udp #optional
      - 8880:8880 #optional
      - 8843:8843 #optional
      - 6789:6789 #optional
      - 5514:5514/udp #optional
    restart: unless-stopped
    networks:
      - proxied-services
      - unifi-app
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "10"
networks:
  unifi-app:
    name: unifi-app
  proxied-services:
    name: proxied-services
    external: true

Container logs

unifi-db                   | {"t":{"$date":"2025-05-19T22:52:09.867+00:00"},"s":"I",  "c":"ACCESS",   "id":20436,   "ctx":"conn12","msg":"Checking authorization failed","attr":{"error":{"code":13,"codeName":"Unauthorized","errmsg":"not authorized on unifi_audit to execute command { aggregate: \"traffic_flow\", pipeline: [ { $match: { site_id: ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx'), time: { $gte: 1747609200000, $lte: 1747695300000 }, $and: [ { policies.type: { $in: [ 21, 6 ] } } ] } }, { $group: { _id: 1, n: { $sum: 1 } } } ], cursor: {}, $db: \"unifi_audit\", lsid: { id: UUID(\"e9ea5aeb-38cc-4ec6-a57f-22d8aef86690\") } }"}}}

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

That's an upstream issue, most likely nothing to do with our docker image. I also noticed wifi instability upon upgrading with my 3 APs. I since cold power cycled all 3 APs and they've been fine.

Unfortunately Ubiquiti is known to push faulty updates and sometimes even pull them later.

There is nothing we can do.

[peap]

I was also seeing problems 1 and 2 after doing the same upgrade and have been able to resolve those.

Since setting up everything initially under 9.0.114, there was a commit that added the "dbOwner" role for the "unifi_audit" database to MONGO_USER in the init-mongo.sh script: 54eaf81. I think the upgrade path needs to include that addition, too.

So, I updated my local init-mongo.sh in case I ever recreate the database, then resolved the error for my live database like so:

$ docker compose exec unifi-db sh -c 'echo "db.grantRolesToUser('\''${MONGO_USER}'\'', [{ db: '\''${MONGO_DBNAME}_audit'\'', role: '\''dbOwner'\'' }])" > /tmp/update.sh ; mongosh -u ${MONGO_INITDB_ROOT_USERNAME} -p ${MONGO_INITDB_ROOT_PASSWORD} ${MONGO_AUTHSOURCE} /tmp/update.sh'

Afterwards, I connected to Mongo to ensure the new role was there:

$ docker compose exec unifi-db sh -c 'mongosh -u ${MONGO_INITDB_ROOT_USERNAME}  -p ${MONGO_INITDB_ROOT_PASSWORD} ${MONGO_AUTHSOURCE}'
$ db.getUser('unifi')  # my $MONGO_USER
# ...now shows three roles, including "dbOwner" for "unifi_audit")

Now the dashboard loads normally :)

[rdehuyss]

See PR #154.

The Readme.md is wrong. After fixing the mongo-init.sh script, all is working fine.

[francocm]

@peap awesome stuff! Just went through your steps and issue seems resolved 👏

One minor comment on the upgrade steps: use docker compose instead of docker-compose (deprecated).

Thank you!