#cloud-config
# UniFi OS Server VM cloud-init. Wrapped into a Secret (userDataSecretRef) by the kustomization's
# secretGenerator because it exceeds KubeVirt's 2048-byte inline cloudInitNoCloud.userData limit.
# NON-SENSITIVE (a public SSH key + a public installer script), so it is NOT SOPS-encrypted.
#
# install-uos resolves the LATEST UniFi OS Server linux-x64 installer from Ubiquiti's PUBLIC firmware
# API (fw-update.ui.com/api/firmware-latest, no auth) — no per-release URL to bump (override with
# UOS_URL=<href>). cloud-init installs the prerequisites, downloads the installer (~840MB) and runs it
# NON-INTERACTIVELY (`yes |`). The UI comes up on https://<vip>:11443 once installed.
hostname: unifi
fqdn: unifi.home.keithjackson.dev
# Break-glass OS access on the default `ubuntu` user (public key — safe to commit) for ops/debugging.
# qemu-guest-agent (below) additionally enables `virtctl` guest access.
ssh_pwauth: false
ssh_authorized_keys:
  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq3JM7CD3P+OExaD4sQARLDQUf5QqDRemAO0qWA3fG7O/6ncgX0d/xN95lJ5Ei8LewlzXF5cCVe43oJ5CJRjh41igWZ38XXgOQcbAbY0lZTJlJg/SAj9Xni++JY3Jws5Nslm8qCrqt1bDsP3O3Lnp4hmBVZ+1eJy3v9HlJ2/1mVOukIob/zVXQNdOpVx1+oubNqo+UYt3l1IxqF8x+2JlHt+POaTBMqbC3JDCaStkkHN20xItpydHZ2uSamXaTx2MH+rQjrABjuD6Xxbhxhx0hG2XrVDWyAuq91aZUpuDkybcuHnpQUSHeZJCMqDCd3Q8yd/dyifDZE8QcnY5hiVHJF8VzJT/r5+em+I4LESlE5WNfq80TWG42d9gw7Yi/8xT38iDm+0nArMd/laAPpH0JGvdIyMdWcVZgfWTgcT6EZ9cIK2J4N+ijrh/V+xwzApmYyMdVsu2UjMeKrJG4VZk43XKnpfJCLJ2LmwtPMKqrI+wyge9Bav2+t+taznKP141gL6YJW3gwArzj+oktK+/fbahtBAUnjh5emLb2rv0gbAHC9cNbovEIdA3A6FDME96zAlozU4AtoCTA7SA1AqIHuAOHkqGYFBV77eriO85K0J1qo0FwuByFINI6G/JtEnNa+CjJLvh0clJonw+6+iR2vB1hwfDmLLwrE7QRT7Ho9w== me@keithjackson.dev
package_update: true
package_upgrade: false
packages:
  - qemu-guest-agent
  - podman
  - uidmap
  - slirp4netns
  - ca-certificates
  - curl
  - jq
  - cloud-guest-utils
write_files:
  # Install (or reinstall) UniFi OS Server. URL is public/no-auth; override at runtime with:
  #   sudo UOS_URL='https://fw-download.ubnt.com/...' install-uos
  - path: /usr/local/sbin/install-uos
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail
      # Resolve the latest UOS linux-x64 installer from Ubiquiti's public firmware API (no auth).
      # Override by exporting UOS_URL=<href> to pin a specific build.
      if [ -z "${UOS_URL:-}" ]; then
        UOS_URL="$(curl -fsSL https://fw-update.ui.com/api/firmware-latest | jq -r '
          ._embedded.firmware
          | map(select(.product == "unifi-os-server" and .platform == "linux-x64"))
          | sort_by(.version_major, .version_minor, .version_patch)
          | last._links.data.href')"
      fi
      [ -n "${UOS_URL}" ] && [ "${UOS_URL}" != "null" ] || { echo "could not resolve UOS installer URL"; exit 1; }
      tmp="$(mktemp /tmp/uos-installer.XXXXXX)"
      echo "Downloading UOS installer: ${UOS_URL}"
      curl -fL --retry 5 --retry-delay 10 -o "$tmp" "$UOS_URL"
      chmod +x "$tmp"
      echo "Running UOS installer non-interactively"
      yes | "$tmp"
      echo "UOS install finished; 'uosserver status' should report running (UI :11443)"
runcmd:
  - [ systemctl, enable, --now, qemu-guest-agent ]
  - [ systemctl, enable, --now, podman.socket ]
  # Full unattended install; tee to the serial console AND /var/log/uos-install.log for visibility.
  # Non-fatal so a failed install leaves the VM up for `sudo install-uos`.
  - [ 'bash', '-lc', '/usr/local/sbin/install-uos 2>&1 | tee /var/log/uos-install.log | tee /dev/console; echo "install-uos exit=${PIPESTATUS[0]}" | tee -a /var/log/uos-install.log > /dev/console' ]
final_message: "cloud-init finished; UOS install log at /var/log/uos-install.log (UI :11443)"