This guide covers the layout and day-two configuration of the CloudSOE UniFi OS Server image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).
How the image is put together
UniFi OS Server is Ubiquiti’s self-hosted UniFi OS console. The image installs it with Ubiquiti’s official installer, downloaded straight from Ubiquiti’s firmware API and verified against the API’s sha256 checksum at build time. The installer creates a dedicated uosserver system user and runs the console as rootless podman containers — no Docker daemon, no root-owned container runtime.
Services
Three systemd units matter:
| Unit | Purpose |
|---|---|
uosserver.service | The UniFi OS console itself |
uosserver-updater.service | Ubiquiti’s built-in updater |
uosserver-firstboot.service | One-time: writes your public IP into the login banner |
Manage the console like any other service:
sudo systemctl status uosserver
sudo systemctl restart uosserver
sudo journalctl -u uosserver --no-pager -n 100Ubiquiti also ships a small CLI:
sudo uosserver statusThe first-boot unit only runs until it succeeds once; after that it exits immediately thanks to its marker file (/var/lib/uosserver-firstboot.done).
Updates
You don’t manage UniFi OS Server versions by hand. The uosserver-updater service keeps the console updated through Ubiquiti’s own release channel:
sudo systemctl status uosserver-updater
sudo journalctl -u uosserver-updater --no-pagerOS security updates still come from Ubuntu’s repositories: sudo apt update && sudo apt upgrade on your own schedule.
Port reference
The login banner lists every port the console may use:
| Port(s) | Typical use |
|---|---|
| 11443 | Management UI (HTTPS) |
| 8080 | Device inform |
| 3478 | STUN |
| 8880-8882, 8444 | Guest portal / hotspot |
| 6789 | Speed test |
| 5514 | Remote syslog from devices |
| 10003, 5005, 9543 | Device discovery and other console services |
Only 11443 (from your admin addresses) and 8080 plus 3478 (from your devices’ networks) are needed for a minimal deployment. Keep everything else closed until a feature needs it.
TLS certificate
The console serves the management UI on port 11443 with a self-signed certificate, so browsers warn on first visit. This is normal for UniFi OS consoles; verify the fingerprint on first connection and proceed. If you front the console with your own reverse proxy or load balancer, terminate trusted TLS there and restrict 11443 to that proxy.
Backups
Configure scheduled backups from within the UniFi console’s system settings and download them off the instance regularly — a backup stored only on the console protects you from nothing. Cloud-level snapshots (EBS on AWS, disk snapshots on Azure) are a good complement: the entire console state lives on the one 40 GB disk.
Next steps
- Tips & tricks — WAN adoption, troubleshooting and sizing