Clément Désiles
0ec6224941
- Add per-job `schedule` (systemd OnCalendar) overrides and document the global `backup_schedule` / `backup_randomized_delay` knobs. - Run `restic unlock` before backup/forget/check so a run killed mid-flight no longer wedges every later run on a stale exclusive lock. - Publish backup manifests for fdroid, immich and unifi, so the inventory decides only where (repositories, retention, schedule). - Document that `read_data_subset` re-reads on every job targeting the repository, so a large repository wants a small fraction.
UniFi Controller
Deploys the UniFi Network Controller via rootless Podman using the jacobalberty/unifi image (embedded MongoDB, no external DB required).
Configuration
See defaults/main.yml for all variables.
Required variables (inventory)
| Variable | Description | Example |
|---|---|---|
unifi_bind_address |
LAN IP for AP communication | 192.168.2.1 |
Optional variables
| Variable | Description | Default |
|---|---|---|
unifi_admin_address |
Bind address for web UI (8443) | unifi_bind_address |
Set unifi_admin_address to a WireGuard IP to restrict admin access to VPN only while keeping AP ports on the LAN.
# Example: LAN for APs, VPN-only admin
unifi_bind_address: 192.168.2.1 # lan1 — APs reach this
unifi_admin_address: 192.168.20.4 # wg0 — admin via VPN only
Firewall ports
On unifi_bind_address (LAN):
| Port | Protocol | Purpose |
|---|---|---|
| 8080 | TCP | Device inform |
| 3478 | UDP | STUN |
| 10001 | UDP | AP discovery |
On unifi_admin_address (defaults to unifi_bind_address):
| Port | Protocol | Purpose |
|---|---|---|
| 8443 | TCP | Web UI |
AP adoption
APs on the same L2 network discover the controller automatically via port 10001/udp. For L3 adoption, configure the AP inform URL: http://<unifi_bind_address>:8080/inform.