# UniFi Controller Migration — CHANGELOG

## 2026-07-15

### Phase 1 — Fresh deploy on app2
- **Action:** Deployed jacobalberty/unifi:latest (v10.0.162) in Docker on app2
- **Image:** Bundles MongoDB internally — single container, no external DB
- **Caddy proxy:** unifi.itpropartner.com:443 → localhost:8443 with tls_insecure_skip_verify
- **Status:** ✅ Controller running, healthy

### Phase 2 — Admin account creation
- **Obstacle:** Fresh controller has zero admin users — can't log in
- **Fix:** Created admin via MongoDB shell (mongosh port 27117) using openssl passwd -6
- **Credentials:** info@itpropartner.com / TempChangeMe123! (changed by user)
- **Status:** ✅

### Phase 3 — Old controller backup discovery
- **Obstacle:** `.unf` files on old server are encrypted BSON, not standard zip
- **Fix:** Pulled autobackups from 178.156.131.57:/var/lib/unifi/backup/autobackup/
- **Files:** 8 backups (161KB each), base backup 9.0.114.unf (686KB) from Oct 2025
- **S3 sync set up:** Daily cron → s3://hermes-vps-backups/unifi-backups/
- **Status:** ✅ Backups safe in S3

### Phase 4 — Restore attempts
- **Obstacle:** ace.jar restore fails with Spring context errors — can't run concurrently with active controller
- **Attempts:** Stopped UniFi process, ran restore — still failed. Docker volume vs bind mount path confusion.
- **Resolution:** Emailed .unf files to user for manual upload through setup wizard
- **Status:** ⚠️ Pending manual restore by user

### Phase 5 — Old controller decommissioning
- **Action:** Stopped UniFi service, disabled from boot on 178.156.131.57
- **Hetzner deletion:** ID 59987821 (178.156.131.57) removed
- **Backup cron removed:** unifi-backup-sync shut down (source deleted)
- **Status:** ✅

## Lessons

- jacobalberty/unifi Docker image uses TWO storage volumes: /config (bind mount) + /unifi (anonymous volume)
- ace.jar restore requires MongoDB running but NOT the UniFi Java process — yet the Spring context still collides
- UniFi 10.x API requires CSRF token + session cookie; NoSiteContext errors even with valid login
- mongosh replaces mongo on MongoDB 5+ — different binary, same port
- Always verify port ownership (Caddy on 443, UniFi on 8443) before deployment