This guide covers the layout and day-two configuration of the CloudSOE UniFi Network image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).
File locations
The image installs the official Ubiquiti package, so everything is in the standard places:
| Path | Purpose |
|---|---|
/usr/lib/unifi | UniFi Network application |
/usr/lib/unifi/data | Controller data, including system.properties |
/usr/lib/unifi/data/backup/autobackup | Scheduled auto-backup files (.unf) |
/usr/lib/unifi/logs/server.log | Main controller log |
/usr/lib/unifi/logs/mongod.log | Controller database log |
/var/lib/unifi-firstboot.done | Marker that the one-time first-boot service ran |
Services
The controller and its database are managed by systemd and enabled at boot:
sudo systemctl status unifi mongod
sudo systemctl restart unifi # after config changes; allow a minute to come backThe controller runs on Java 21 and stores its data in MongoDB 8.0 — both installed from their official repositories, so apt keeps them updated.
The port map
The image leaves the standard UniFi ports untouched:
| Port | Protocol | Purpose |
|---|---|---|
| 8443 | TCP | Web UI (HTTPS) |
| 8080 | TCP | Device inform |
| 3478 | UDP | STUN |
| 10001 | UDP | Device discovery (local network only) |
| 8880 | TCP | Guest portal HTTP |
| 8843 | TCP | Guest portal HTTPS |
Ports can be changed in /usr/lib/unifi/data/system.properties (e.g. unifi.https.port=8443), but stick with the defaults unless you have a conflict — devices expect them.
The inform host
For a cloud controller the single most important setting is Settings → System → Advanced → Override Inform Host, set to your instance’s public IP (or a DNS name pointing at it). Every adopted device stores this address and phones home to it on TCP 8080.
Using a DNS name instead of the raw IP is worth the small setup cost: if you ever migrate the controller, you move the DNS record instead of re-informing every device.
Controller memory
The controller’s JVM heap defaults to 1 GB. On a 4 GB instance managing many devices you can raise it in /usr/lib/unifi/data/system.properties:
unifi.xmx=2048Restart the unifi service afterwards. The image also raises fs.file-max and per-user file/process limits system-wide, so large device counts won’t hit descriptor limits.
The web UI certificate
The UI on port 8443 uses a self-signed certificate generated by the controller. Since only administrators visit the UI (devices don’t validate it), most cloud deployments simply accept the warning or restrict port 8443 to admin IPs. If you want a trusted certificate, point a DNS name at the instance and import a certificate into the controller’s keystore at /usr/lib/unifi/data/keystore per Ubiquiti’s documentation.
Next steps
- Tips & tricks — backups, updates, adoption troubleshooting and hardening