UniFi in a Home Lab: Worth the Tax?

You wanted a network. You got a lifestyle.

It starts with one bad WiFi AP. You read a few forum threads, and every answer says the same word: UniFi. Three weeks later you own a gateway, two APs, a PoE switch, and a strong opinion about the color of a topology map.

UniFi is good. It is also priced like it knows that. The question for a home lab is whether the premium buys you something an OPNsense router, a cheap managed switch, and standalone APs cannot.

Short answer: pay for the APs and the switch, skip the gateway. Run the controller yourself, and let OPNsense do the routing. One wrinkle as of October 2026: Ubiquiti froze the standalone controller at version 10.6, so “run it yourself” now has two flavors. The rest of this post shows the numbers, the trade-offs, both controller options, and a Compose file.

Full example: Clone the working files at github.com/KingPin/sumguy-examples/networking/unifi-home-lab-tax

What the “UniFi tax” actually is

The tax has five parts. Only the first one shows up on the receipt.

1. Price per box. A UniFi AP or switch costs more than a comparable standalone device.
2. A controller you must run. One UI manages everything, which means something has to host it. That is either a UniFi gateway, a dedicated appliance, or your own server.
3. Single-vendor gravity. The good features appear when every device is UniFi. Mix in a third-party switch and the topology map, port profiles, and firmware pushes stop covering it.
4. Firmware churn. Ubiquiti ships release candidates and an early access channel, and new hardware often launches with a rough controller. You decide how fast to follow.
5. Less router. A UniFi gateway is a good appliance router. It covers the common cases and stops there.

The prices, as of October 2026

Ubiquiti’s US store shows a list price and a second price labeled “Surcharge incl.” Checkout charges the second one. The list price is what you remember from a review. The surcharge price is what leaves your card. Everything below is the checkout figure, from the product pages on store.ui.com on 2026-10-22.

The older U6 Long-Range AP shows $179 on its store page and is currently unavailable. The Cloud Key Gen2 Plus ($199) and U6 Lite ($99) were sold out at fetch time.

Here is a small, realistic build: a gateway, two WiFi 7 APs, and an 8-port PoE switch.

• UCG-Ultra: $142
• 2 x U7 Lite: $218
• USW-Lite-8-PoE: $120
• Total: $480

Drop the gateway and you pay $338 for the APs and switch. The router becomes your problem, in a good way. Deciso, the company behind OPNsense, lists its DEC677 desktop appliance at EUR 598 on its shop (the listing does not say whether that includes VAT). A used mini PC with two NICs also works, and costs whatever your local used market says. I will not guess at a number for that.

So the router is where the DIY route is not cheaper. A UCG-Ultra at $142 is hard to beat with new hardware. The savings only show up if you already own a box, or if you want the features below.

What the DIY stack gives you

The DIY stack is OPNsense (or pfSense) on a router, a cheap managed switch, and APs running vendor firmware or OpenWrt. If you want the router comparison, pfSense vs OPNsense covers it.

What a home labber gets from OPNsense that a UniFi gateway does not match:

• A real firewall toolbox. Suricata IDS/IPS and WireGuard are built in, and CrowdSec, FRR (BGP and OSPF), and HAProxy install as plugins.
• Gateway groups and multi-WAN control. You decide failover and load-balancing rules per rule. See OPNsense multi-WAN failover.
• DNS control. Unbound with host overrides, DNS-over-TLS, and blocklists, all on the router.
• No lock-in on the box. Replace the hardware, restore the config, keep going.

You also get a different failure mode. When OPNsense breaks at 2 AM, you own every layer. That is the real cost of the DIY route: your time.

What the polish buys you

This part is real.

One pane of glass. You create a VLAN, tag a port profile, and bind an SSID to it, all in one UI. On the DIY stack that is three devices, three web interfaces, and one typo that takes down the IoT network. If you have not set up VLANs before, VLAN basics for a home lab explains the model, and VLAN trunking gotchas lists what breaks.

Adoption. A new device appears in the controller, you click adopt, and it receives its config. No per-device static IP, no copying SSID settings by hand.

Roaming. The controller coordinates the APs as a group: same SSID, shared settings, minimum RSSI options, band steering. Standalone APs can do 802.11r/k/v too, but you configure each one and hope the settings match.

The topology view and client list. A live map of what is plugged into which port, with per-client signal and traffic. It sounds like a toy until you hunt for a loop.

The ecosystem. If you ever add cameras or door readers, Protect and Access live in the same family. That only matters if you want those products.

The middle path: UniFi APs and switch, OPNsense router

This is the layout I would push most readers toward.

1. OPNsense routes, firewalls, and does DNS and VPN.
2. A UniFi PoE switch connects the APs and the lab, with VLAN trunks to OPNsense.
3. UniFi APs broadcast the SSIDs, mapped to VLANs.
4. A self-hosted controller (UniFi OS Server or the Network Application container) manages the APs and the switch.

You pay UniFi prices for the parts where the polish is real (WiFi and switching) and skip the part where OPNsense is stronger. The gateway is the one UniFi device you do not need, because the controller runs on hardware you already own.

The only catch is the trunk. OPNsense gets the VLAN interfaces, and the switch port facing it must carry the VLANs tagged. On the OPNsense side, create the VLANs under Interfaces, Devices, VLAN, then assign each one and enable its interface and DHCP. On the UniFi side, create the matching networks with the router set to Third-party Gateway (VLAN IDs only, since there is no UniFi gateway to serve DHCP) and set the uplink port profile to allow them.

If your cameras and smart plugs need isolation without breaking casting, IoT VLANs without breaking Chromecast shows the rules to write on the router.

Self-hosting the controller

The controller does not need a Cloud Key. You have two self-hosted options, and Ubiquiti recently changed which one it backs.

In September 2026 Ubiquiti announced that UniFi Network 10.6 is the final release of the standalone Network Application. Network 11 and later ship only on UniFi OS Server and UniFi consoles. A 10.6 controller keeps managing your devices, but it gets no new features, and Ubiquiti has not said how long 10.6 receives fixes.

So the choice is:

• The Network Application container. Docker, a Compose file, MongoDB beside it. Frozen at 10.6. For a handful of APs and a switch, 10.6 already does the job.
• UniFi OS Server. The supported path going forward, covered at the end of this section. It installs on the host with Podman, not as a container you drop into your Compose stack.

The container route

The linuxserver.io image runs the Network Application, and it needs a MongoDB container beside it. The supported MongoDB range depends on the app version: per the linuxserver.io docs, 3.6 through 7.0 for the 8.1 line, with 8.0 added at 9.0. The current image at the time of writing is 10.6.106, so this file pins MongoDB 8.0.34. Per the same docs, MongoDB above 4.4 on x86_64 needs a CPU with AVX, which Celeron and Pentium chips from before Tiger Lake lack. On those, pin mongo 4.4 instead.

services:
  unifi-db:
    image: docker.io/mongo:8.0.34
    container_name: unifi-db
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASS:?set in .env}
      MONGO_USER: unifi
      MONGO_PASS: ${MONGO_PASS:?set in .env}
      MONGO_DBNAME: unifi
      MONGO_AUTHSOURCE: admin
    volumes:
      - ./data/db:/data/db
      - ./init-mongo.sh:/docker-entrypoint-initdb.d/init-mongo.sh:ro
    restart: unless-stopped

  unifi-network-application:
    image: lscr.io/linuxserver/unifi-network-application:10.6.106
    container_name: unifi-network-application
    depends_on:
      - unifi-db
    environment:
      PUID: 1000
      PGID: 1000
      TZ: ${TZ:-Etc/UTC}
      MONGO_USER: unifi
      MONGO_PASS: ${MONGO_PASS:?set in .env}
      MONGO_HOST: unifi-db
      MONGO_PORT: 27017
      MONGO_DBNAME: unifi
      MONGO_AUTHSOURCE: admin
      MEM_LIMIT: 1024
      MEM_STARTUP: 1024
    volumes:
      - ./data/config:/config
    ports:
      - 8443:8443        # web UI (HTTPS)
      - 8080:8080        # device inform / adoption
      - 3478:3478/udp    # STUN
      - 10001:10001/udp  # device discovery
      - 1900:1900/udp    # optional: L2 discovery
      - 8843:8843        # optional: guest portal HTTPS
      - 8880:8880        # optional: guest portal HTTP
      - 6789:6789        # optional: mobile speed test
      - 5514:5514/udp    # optional: remote syslog
    restart: unless-stopped

The Network Application cannot create its own database user, so MongoDB needs an init script. This one comes from the linuxserver.io docs. It runs once, when the data directory is empty.

#!/bin/bash
if which mongosh > /dev/null 2>&1; then
  mongo_init_bin='mongosh'
else
  mongo_init_bin='mongo'
fi
"${mongo_init_bin}" <<EOS
use ${MONGO_AUTHSOURCE}
db.auth("${MONGO_INITDB_ROOT_USERNAME}", "${MONGO_INITDB_ROOT_PASSWORD}")
db.createUser({
  user: "${MONGO_USER}",
  pwd: "${MONGO_PASS}",
  roles: [
    "clusterMonitor",
    { db: "${MONGO_DBNAME}", role: "dbOwner" },
    { db: "${MONGO_DBNAME}_stat", role: "dbOwner" },
    { db: "${MONGO_DBNAME}_audit", role: "dbOwner" },
    { db: "${MONGO_DBNAME}_restore", role: "dbOwner" }
  ]
})
EOS

Copy the example .env, change both passwords, then start it. Stick to letters and digits in MONGO_PASS: the linuxserver.io docs want special characters URL-encoded for the app, while the init script hands the same string to MongoDB raw.

cp .env.example .env
$EDITOR .env
docker compose up -d
curl -sk https://localhost:8443/status

I ran this stack on a Docker host and the controller reported "up":true on version 10.6.106 after a few minutes. The first requests return “starting up” while the app initializes, so wait before you suspect a problem.

Two ports deserve a note. Port 8080 is the inform port, and every device must reach it. Port 10001/udp handles AP discovery, which only works when the container host shares a broadcast domain with the devices. If your controller lives on another VLAN, use the inform command below and skip discovery.

One setting is not optional. Inside Docker the controller only knows its container IP, which your APs cannot reach, so it hands them an inform address that goes nowhere. Before you adopt anything, enable Inform Host Override and set it to the Docker host’s IP or hostname. The linuxserver.io docs place it under UniFi Devices, Device Updates and Settings, Device SSH Settings, and warn that Ubiquiti moves it every few releases, so search the settings for “Inform” if it is not there.

Adopting a device

Open the AP’s page in your DHCP list to find its IP, then SSH in and point it at the controller:

ssh <device-user>@<device-ip>
set-inform http://<controller-ip>:8080/inform

A factory-reset UniFi device accepts ui for both username and password (ubnt / ubnt on older devices). A device that belonged to another controller uses that controller’s SSH credentials, so reset it first. Once the device shows up, click adopt. If it sits at “Adopting” and then drops offline, the Inform Host Override above is the usual culprit.

Back up data/config before upgrades, and pin image tags rather than following latest. The controller database is the one thing you cannot rebuild by clicking.

The UniFi OS Server route

UniFi OS Server is a self-hosted copy of the full UniFi OS, free and license-free per Ubiquiti, and it is where Network 11 lands. Ubiquiti’s Self-Hosting UniFi article lists the requirements:

• An x86-64 CPU, at least 2 GB of RAM, 10 GB of free storage, and wired Ethernet.
• Ubuntu 24.04 or later, Debian 13 or later, or another systemd distro with Podman 4.9.3 or newer. Windows 10 and later (through WSL 2) and macOS also work.

On Debian or Ubuntu the install is a package step plus a downloaded installer. The download link comes from Ubiquiti’s download page:

sudo apt-get update && sudo apt-get install podman slirp4netns
curl -O <uos-server-download-link>
chmod +x <uos-server-installer>
sudo ./<uos-server-installer>
sudo systemctl enable uosserver

Two limits matter for a home lab. Ubiquiti’s FAQ says UniFi OS Server will not ship as a standalone Docker or Podman container, because it needs host services for discovery, adoption, and updates. Give it its own small VM rather than your container host. Also, a Cloud Gateway (UCG, UDM) cannot join a UniFi OS Server site, because the gateway runs its own controller. Pairing a UniFi router with a self-hosted controller means a UXG-series gateway. With OPNsense in front, none of that applies.

To migrate later, take a backup from the 10.6 container, stop it, install UniFi OS Server, and move the site over with Ubiquiti’s Site Export tool, per the same Ubiquiti article.

Who should pay the tax

Pay it if:

• You manage more than two APs, or any VLAN-backed SSIDs. The one-UI workflow saves the most time here.
• Other people live on this network and the WiFi has to just work.
• You want cameras or door access later.
• You treat the network as infrastructure that other things depend on.

Skip it if:

• You enjoy configuring OpenWrt and already have a working AP.
• You have one AP and one flat network. A standalone AP does that job.
• You need the router to do things beyond a normal home gateway: BGP, custom IDS rules, HAProxy, or tight multi-WAN policy. Buy the router separately.
• You dislike vendor lock-in enough that it will bother you every time a UniFi-only feature appears.

The verdict. Buy UniFi APs and a UniFi switch, and put OPNsense in front. For the controller, a new build should start on UniFi OS Server in a small VM, since that is where Ubiquiti’s updates go. If you already run Docker and want the controller in your Compose stack, the 10.6 container is fine for APs and switches today; just plan the move before Ubiquiti stops patching it. If you would rather not run a second box at all, buy a UCG-Ultra and let it be router and controller in one. If you already own an OPNsense box, the gateway is the one purchase you can skip, and you save $142 on the entry model.

Common Questions

Do I need a Cloud Key to run UniFi?

No. A Cloud Key is a hardware controller, and free UniFi OS Server on a small VM replaces it, as does the Network Application in Docker (frozen at 10.6). A UniFi Cloud Gateway also hosts the controller. The Cloud Key Gen2 Plus listed at $199 and was sold out in Ubiquiti’s store in October 2026.

Can UniFi APs work without a UniFi gateway?

Yes. UniFi APs and switches adopt into a self-hosted controller and work behind any router. You lose gateway-specific features, like the firewall UI and the gateway’s traffic stats. DHCP, DNS, and routing come from your router, such as OPNsense, which is the setup this post recommends.

How do I move away from UniFi if I change my mind?

Reset each device to factory defaults, then adopt it into a new controller or flash alternate firmware where supported. Export the controller backup first so you keep your SSID and VLAN settings for reference. Switches and APs forget their config on reset, so plan a maintenance window for the whole network.

Is the surcharge on Ubiquiti’s store real?

Yes. In October 2026 the store showed a list price and a higher “Surcharge incl.” price on many products, and checkout charged the higher one. A UCG-Ultra listed at $129 cost $142. Compare prices using the surcharge figure, and recheck at checkout because the store changes.

Is the standalone UniFi Network Application discontinued?

Yes, for new features. Ubiquiti said in September 2026 that UniFi Network 10.6 is the last standalone release, and Network 11 ships only on UniFi OS Server and UniFi consoles. A 10.6 controller keeps managing devices, but Ubiquiti has not said how long 10.6 gets security fixes.

Related Reading

• pfSense vs OPNsense in 2026
• Mikrotik RouterOS for Home Lab
• PoE Injectors and Switches for the Home Lab
• Cheap Managed Switches That Don’t Suck
• VLAN Basics for Home Labs: Segment Your Network Before It Segments You