Clément Désiles
95a743ddeb
Same bug as immich (556fae8): 'Writing manifest' goes to stderr, so
changed_when never matched and the restart handlers never fired after
image upgrades. Compare local image IDs before/after pull instead, and
notify the restart handler only on a genuinely new image.
Applies to fdroid, gitea, metabase, ntfy, unifi, uptime-kuma.
UniFi Controller
Deploys the UniFi Network Controller via rootless Podman using the jacobalberty/unifi image (embedded MongoDB, no external DB required).
Configuration
See defaults/main.yml for all variables.
Required variables (inventory)
| Variable | Description | Example |
|---|---|---|
unifi_bind_address |
LAN IP for AP communication | 192.168.2.1 |
Optional variables
| Variable | Description | Default |
|---|---|---|
unifi_admin_address |
Bind address for web UI (8443) | unifi_bind_address |
Set unifi_admin_address to a WireGuard IP to restrict admin access to VPN only while keeping AP ports on the LAN.
# Example: LAN for APs, VPN-only admin
unifi_bind_address: 192.168.2.1 # lan1 — APs reach this
unifi_admin_address: 192.168.20.4 # wg0 — admin via VPN only
Firewall ports
On unifi_bind_address (LAN):
| Port | Protocol | Purpose |
|---|---|---|
| 8080 | TCP | Device inform |
| 3478 | UDP | STUN |
| 10001 | UDP | AP discovery |
On unifi_admin_address (defaults to unifi_bind_address):
| Port | Protocol | Purpose |
|---|---|---|
| 8443 | TCP | Web UI |
AP adoption
APs on the same L2 network discover the controller automatically via port 10001/udp. For L3 adoption, configure the AP inform URL: http://<unifi_bind_address>:8080/inform.