feat: replace legacy Unifi with UniFi OS Server v5.1.15

Deploys ghcr.io/lemker/unifi-os-server replacing linuxserver/unifi-network-application.
Data dirs moved to /var/lib/unifi-os/ locally (NFS root_squash blocks chown needed by
postgres/mongodb/nginx init). Only /persistent remains on NAS for config backups.
Access: https://192.168.86.100:11443

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/hf-pdocker-02/unifi/docker-compose.yml

@@ -1,67 +1,52 @@
 services:
-  unifi:
-    image: lscr.io/linuxserver/unifi-network-application:latest
-    container_name: unifi
+  unifi-os-server:
+    image: ghcr.io/lemker/unifi-os-server:latest
+    container_name: unifi-os-server
     restart: unless-stopped
+    cgroup: host
+    cap_add:
+      - NET_RAW
+      - NET_ADMIN
+    extra_hosts:
+      host.docker.internal: host-gateway
+    tmpfs:
+      - /run:exec
+      - /run/lock
+      - /tmp:exec
+      - /var/lib/journal
+      - /var/opt/unifi/tmp:size=64m
     environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Chicago
-      - MONGO_USER=${UNIFI_MONGO_USER}
-      - MONGO_PASS=${UNIFI_MONGO_PASS}
-      - MONGO_HOST=unifi-db
-      - MONGO_PORT=27017
-      - MONGO_DBNAME=unifi
+      - UOS_SYSTEM_IP=192.168.86.100
     volumes:
-      - /mnt/docker-data/configs/unifi/data:/config
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      # /persistent on NAS (config backups, survives reinstall)
+      - /mnt/docker-data/configs/unifi-os/persistent:/persistent
+      # All other dirs local — NFS root_squash blocks the chown calls these services need
+      - /var/lib/unifi-os/var-log:/var/log
+      - /var/lib/unifi-os/data:/data
+      - /var/lib/unifi-os/srv:/srv
+      - /var/lib/unifi-os/var-lib-unifi:/var/lib/unifi
+      - /var/lib/unifi-os/var-lib-mongodb:/var/lib/mongodb
+      - /var/lib/unifi-os/etc-rabbitmq-ssl:/etc/rabbitmq/ssl
     ports:
-      - "8443:8443"
-      - "3478:3478/udp"
-      - "10001:10001/udp"
+      - "11443:443"
       - "8080:8080"
-      - "1900:1900/udp"
-      - "8843:8843"
-      - "8880:8880"
+      - "3478:3478/udp"
+      - "10003:10003/udp"
       - "6789:6789"
+      - "8444:8444"
+      - "8880:8880"
+      - "8881:8881"
+      - "8882:8882"
+      - "5671:5671"
       - "5514:5514/udp"
-    depends_on:
-      unifi-db:
-        condition: service_healthy
-    networks:
-      - unifi-internal
-    mem_limit: 1G
-    memswap_limit: 1G
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-
-  unifi-db:
-    image: mongo:7.0
-    container_name: unifi-db
-    restart: unless-stopped
-    user: "1024:100"
-    volumes:
-      - /mnt/docker-data/databases/unifi-db:/data/db
-    networks:
-      - unifi-internal
+      - "9543:9543"
+      - "5005:5005"
+      - "127.0.0.1:11084:11084"
     labels:
       - "com.centurylinklabs.watchtower.enable=false"
-    mem_limit: 1G
-    memswap_limit: 1G
-    healthcheck:
-      test: ["CMD-SHELL", "mongosh --eval 'db.adminCommand(\"ping\")' --quiet"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
     logging:
       driver: "json-file"
       options:
-        max-size: "50m"
+        max-size: "100m"
         max-file: "3"
-
-networks:
-  unifi-internal:
-    driver: bridge