A collection of practical advice for running the CloudSOE UniFi Network image in production, on either cloud.
Turn on auto-backups first
Before adopting a single device, enable scheduled backups in Settings → System → Backups. The controller writes .unf files to /usr/lib/unifi/data/backup/autobackup — download them regularly or sync that directory off the instance (S3, Azure Blob). A .unf file restores your entire controller — sites, devices, settings — onto any fresh controller of the same or newer version.
Cloud snapshots (EBS on AWS, disk snapshots on Azure) are a good complement, but the .unf backup is what makes controller migration painless.
Keep things updated — carefully
The controller installs from Ubiquiti’s official stable apt repository and MongoDB from MongoDB’s 8.0 repository, so updates arrive through the normal channel:
sudo apt update && sudo apt upgradeDownload a backup before upgrading the controller — UniFi versions can’t be downgraded with the same database. Devices update their firmware separately, from the controller UI.
Adoption troubleshooting
A device stuck in Adopting or never appearing usually comes down to one of three things:
- Firewall — the device’s site must reach your instance on TCP 8080 (inform) and UDP 3478 (STUN). Check your security group / NSG and the remote site’s egress rules.
- Inform address — run
set-inform http://<public-ip>:8080/informon the device again after clicking Adopt; factory-fresh devices sometimes need it twice before they persist the address. - Stale state — a device previously adopted elsewhere must be factory-reset (hold the reset button ~10 s) before it will accept a new controller.
A persistent STUN warning in the UI with otherwise working devices means UDP 3478 is blocked somewhere on the path.
Never let the controller’s IP change
Every adopted device phones home to the inform address. On AWS, use an Elastic IP; on Azure, set the public IP to Static (also remember an Azure VM often can’t reach its own public IP from inside — always test the UI from your own machine). Better still, use a DNS name as the inform host as described in the configuration guide — then the address is yours to move.
Migrating to a new controller
Launch a fresh CloudSOE UniFi instance, walk through the wizard, then Settings → System → Backups → Restore with your latest .unf file. If the inform host is a DNS name, repoint the record; if it’s an IP, move the Elastic/static IP to the new instance and the devices follow automatically.
Security hardening
- Restrict ports 22 and 8443 to your own IP range — only devices need 8080 and 3478.
- Skip the guest-portal ports (8880/8843) in your firewall entirely unless you actually run guest hotspots.
- Use a strong admin password and enable two-factor authentication on the account you created in the wizard.
- Leave MongoDB alone — it listens locally for the controller and needs no inbound rules.
Troubleshooting the controller itself
sudo systemctl status unifi mongod
sudo tail -n 100 /usr/lib/unifi/logs/server.logThe UI takes a minute or two to come up after a restart — a browser error immediately after systemctl restart unifi is normal. The MOTD banner captures the public IP at first boot; if you’ve since re-assigned the address, edit /etc/motd (the controller itself is unaffected).