Clément Désiles
1970564c8f
podman, postgres, valkey, and nginx are shared services deployed once per host. Declaring them in meta/main.yml re-ran them on every service deploy, adding significant time to targeted runs. Playbooks now list shared services first (tagged 'infra') and every role entry carries a group tag plus its own name, so '--tags <role>' deploys just that role. Roles still fail fast when a shared service is missing (password asserts, postgresql tasks). Prerequisites are documented in role READMEs. CLAUDE.md updated to reflect the new convention.
UniFi Controller
Deploys the UniFi Network Controller via rootless Podman using the jacobalberty/unifi image (embedded MongoDB, no external DB required).
Configuration
See defaults/main.yml for all variables.
Required variables (inventory)
| Variable | Description | Example |
|---|---|---|
unifi_bind_address |
LAN IP for AP communication | 192.168.2.1 |
Optional variables
| Variable | Description | Default |
|---|---|---|
unifi_admin_address |
Bind address for web UI (8443) | unifi_bind_address |
Set unifi_admin_address to a WireGuard IP to restrict admin access to VPN only while keeping AP ports on the LAN.
# Example: LAN for APs, VPN-only admin
unifi_bind_address: 192.168.2.1 # lan1 — APs reach this
unifi_admin_address: 192.168.20.4 # wg0 — admin via VPN only
Firewall ports
On unifi_bind_address (LAN):
| Port | Protocol | Purpose |
|---|---|---|
| 8080 | TCP | Device inform |
| 3478 | UDP | STUN |
| 10001 | UDP | AP discovery |
On unifi_admin_address (defaults to unifi_bind_address):
| Port | Protocol | Purpose |
|---|---|---|
| 8443 | TCP | Web UI |
AP adoption
APs on the same L2 network discover the controller automatically via port 10001/udp. For L3 adoption, configure the AP inform URL: http://<unifi_bind_address>:8080/inform.