feat: replace legacy Unifi with UniFi OS Server v5.1.15

Deploys ghcr.io/lemker/unifi-os-server replacing linuxserver/unifi-network-application.
Data dirs moved to /var/lib/unifi-os/ locally (NFS root_squash blocks chown needed by
postgres/mongodb/nginx init). Only /persistent remains on NAS for config backups.
Access: https://192.168.86.100:11443

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -55,8 +55,7 @@ GPU workstation / Jeremy's PC (192.168.86.27, Ubuntu 24.04 — migrated from Win
 ├── RTX 3090 (24GB VRAM), i7-13700KF, 32GB RAM
 ├── [COMPOSE] Ollama (:11434) -- 21 local models, v0.24.0
 ├── [COMPOSE] Open WebUI (:8080) -- AI chat, points to local Ollama
-├── [COMPOSE] vLLM-Hermes (:8001) -- Hermes 4.3 36B AWQ, OpenAI-compat, tool-call-parser hermes
-│   └── Endpoint: http://192.168.86.27:8001/v1  model name: hermes
+├── [REMOVED] vLLM-Hermes -- removed 2026-05-29, VRAM freed for Speaches CUDA
 ├── [COMPOSE] Speaches (:8000) -- STT/TTS via faster-whisper + Kokoro, CUDA
 ├── [COMPOSE] LiveKit (:7880/:7881) -- WebRTC for VoiceCoach, key: devkey
 ├── [COMPOSE] Portainer (:9000, :8002)
@@ -67,7 +66,7 @@ GPU workstation / Jeremy's PC (192.168.86.27, Ubuntu 24.04 — migrated from Win
 └── Model cache: /home/glyptic/Docker/data/models/
 
 hf-pdocker-02 (7.6GB RAM, i7-6700T, HDD)
-├── [COMPOSE] Unifi + unifi-db (MongoDB)
+├── [COMPOSE] UniFi OS Server (:11443 HTTPS, :8080 inform, :3478/udp STUN) -- ghcr.io/lemker/unifi-os-server v5.1.15, replaced legacy linuxserver/unifi 2026-05-31. Data local at /var/lib/unifi-os/, /persistent on NAS.
 ├── [COMPOSE] Gitea + gitea-db (PostgreSQL)
 ├── [COMPOSE] Semaphore + semaphore-db (MySQL)
 ├── [COMPOSE] Wiki.js + wikijs-db (PostgreSQL)

compose/hf-pdocker-02/unifi/docker-compose.yml

@@ -1,67 +1,52 @@
 services:
-  unifi:
-    image: lscr.io/linuxserver/unifi-network-application:latest
-    container_name: unifi
+  unifi-os-server:
+    image: ghcr.io/lemker/unifi-os-server:latest
+    container_name: unifi-os-server
     restart: unless-stopped
+    cgroup: host
+    cap_add:
+      - NET_RAW
+      - NET_ADMIN
+    extra_hosts:
+      host.docker.internal: host-gateway
+    tmpfs:
+      - /run:exec
+      - /run/lock
+      - /tmp:exec
+      - /var/lib/journal
+      - /var/opt/unifi/tmp:size=64m
     environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Chicago
-      - MONGO_USER=${UNIFI_MONGO_USER}
-      - MONGO_PASS=${UNIFI_MONGO_PASS}
-      - MONGO_HOST=unifi-db
-      - MONGO_PORT=27017
-      - MONGO_DBNAME=unifi
+      - UOS_SYSTEM_IP=192.168.86.100
     volumes:
-      - /mnt/docker-data/configs/unifi/data:/config
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      # /persistent on NAS (config backups, survives reinstall)
+      - /mnt/docker-data/configs/unifi-os/persistent:/persistent
+      # All other dirs local — NFS root_squash blocks the chown calls these services need
+      - /var/lib/unifi-os/var-log:/var/log
+      - /var/lib/unifi-os/data:/data
+      - /var/lib/unifi-os/srv:/srv
+      - /var/lib/unifi-os/var-lib-unifi:/var/lib/unifi
+      - /var/lib/unifi-os/var-lib-mongodb:/var/lib/mongodb
+      - /var/lib/unifi-os/etc-rabbitmq-ssl:/etc/rabbitmq/ssl
     ports:
-      - "8443:8443"
-      - "3478:3478/udp"
-      - "10001:10001/udp"
+      - "11443:443"
       - "8080:8080"
-      - "1900:1900/udp"
-      - "8843:8843"
-      - "8880:8880"
+      - "3478:3478/udp"
+      - "10003:10003/udp"
       - "6789:6789"
+      - "8444:8444"
+      - "8880:8880"
+      - "8881:8881"
+      - "8882:8882"
+      - "5671:5671"
       - "5514:5514/udp"
-    depends_on:
-      unifi-db:
-        condition: service_healthy
-    networks:
-      - unifi-internal
-    mem_limit: 1G
-    memswap_limit: 1G
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-
-  unifi-db:
-    image: mongo:7.0
-    container_name: unifi-db
-    restart: unless-stopped
-    user: "1024:100"
-    volumes:
-      - /mnt/docker-data/databases/unifi-db:/data/db
-    networks:
-      - unifi-internal
+      - "9543:9543"
+      - "5005:5005"
+      - "127.0.0.1:11084:11084"
     labels:
       - "com.centurylinklabs.watchtower.enable=false"
-    mem_limit: 1G
-    memswap_limit: 1G
-    healthcheck:
-      test: ["CMD-SHELL", "mongosh --eval 'db.adminCommand(\"ping\")' --quiet"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
     logging:
       driver: "json-file"
       options:
-        max-size: "50m"
+        max-size: "100m"
         max-file: "3"
-
-networks:
-  unifi-internal:
-    driver: bridge