Erich Blume
657bb28fd1
## Summary - Abandon the UniFi Pulumi IaC approach after provider bugs caused a network outage (no-op update reset undeclared properties on the default LAN network) - Remove untracked IaC artifacts (`pulumi/unifi/`, `mise-tasks/unifi-preview`, `mise-tasks/unifi-up`) locally - Mark `add-unifi-pulumi-stack` plan as Abandoned with explanation - Create new `segment-home-network` plan for manual three-network segmentation (Main/IoT/Guest) via UX7 web UI - Rewrite UniFi reference card to remove all Pulumi/IaC references - Update plan and how-to indexes ## Test plan - [x] `docs-check-links` passes - [x] `docs-check-index` passes - [x] Pre-commit hooks pass - [ ] Review segmentation plan for completeness before executing manually 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/189
2.7 KiB
| title | modified | tags | ||
|---|---|---|---|---|
| UniFi | 2026-02-14 |
|
UniFi
Home WiFi router and network controller, managed via the UX7 web UI.
Quick Reference
| Property | Value |
|---|---|
| Model | UniFi Express 7 (UX7) |
| LAN IP | 192.168.1.1 |
| Management URL | https://192.168.1.1 |
| Management | Web UI only (no IaC — see add-unifi-pulumi-stack) |
| Power | Battery-backed via UPS (see power) |
What It Does
The UX7 is the home WiFi access point and network gateway. It provides:
- WiFi (main, guest, IoT networks)
- DHCP for all network subnets
- Built-in UniFi controller for managing adopted devices (switches)
- Zone-based firewall and traffic management
Networks
| Network | VLAN | Subnet | Purpose |
|---|---|---|---|
| Main | 1 (default) | 192.168.1.0/24 | Trusted devices (indri, sifaka, gilbert, mouse) |
| Guest | 2 | 192.168.2.0/24 | Visitors, internet-only |
| IoT | 3 | 192.168.3.0/24 | Smart devices (Frame TV, appliances) |
See segment-home-network for the full segmentation plan and firewall rules.
Network Topology
ISP Modem
└── UniFi Express 7 [WAN]
└── [LAN port] ──→ Switch A (by router/sifaka)
├── sifaka (Synology NAS)
└── ~12ft Cat6 ──→ Switch B (on desk)
├── indri (Mac Mini, primary server)
└── gilbert (USB-C adapter)
All wired devices share the default VLAN (192.168.1.0/24). The two daisy-chained UniFi Switch Flex Minis provide enough ports for all devices while using the UX7's single LAN port.
Operations
| Task | Method |
|---|---|
| Manage networks/WiFi/firewall | https://192.168.1.1 web UI |
| Backup configuration | Settings → System → Backup |
| Restore from backup | Settings → System → Backup → Restore |
Authentication
Local admin account on the UX7. Credentials stored in 1Password (vault blumeops). WiFi passphrase stored in 1Password item "Radio New Vegas" (Wireless Router type) in vault blumeops.
Why Not IaC?
Attempted Feb 2026 with the ubiquiti-community/unifi Terraform provider via Pulumi. A "no-op" update on the default LAN network reset undeclared properties, bricking the network and requiring a factory reset. The provider ecosystem is too immature for single-device infrastructure. See add-unifi-pulumi-stack for details.
Related
- segment-home-network — Network segmentation plan
- add-unifi-pulumi-stack — Previous IaC approach (abandoned)
- hosts — Device inventory
- power — UPS power chain
- indri — Primary server (wired connection)
- tailscale — Tailnet networking