We should be clear here that there are multiple types of "self-hosted". Ubiquiti makes essentially little (weaker) Raspberry Pi devices with PoE that are dedicated to just the controller, and a few years back they also forced their (garbage) "Protect" onto their hardware only. They (confusingly) call these "Cloud Keys", though they have nothing to do with the cloud. However, you can also get 100% standalone versions of the Controller that will run on any server or VM you've got, Linux, Windows, or Mac. This is just the Java 8-based controller software and that's it, and you can lock those down arbitrarily hard for any WAN access same as any other LAN network software, no general internet access is needed at all and no firmware is involved.

A lot of people quite reasonably got CKs seeing them as very easy ways to have a low power always on local controller since they didn't have some other server running 24/7 already. If the firmware on those was updated to require tie-in to Ubiquiti's SSO that's a horrible betrayal. But I'm confident in saying the full standalone Controller doesn't since I have mine locked down from any general net access, remote L3 management was done to IP only at the firewall and I've been switching to just putting it all through WireGuard.

They forced cloud authentication on self hosted software too.[1]

[1] https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_...

Wow, that's awful.

I have a few Ubiquiti devices I haven't updated in months, that don't use any cloud accounts, and I used to run their controller software in a container that I only started when I needed to administer something. But now I guess I'm never updating and will be looking to get rid of all their equipment.

What an incredibly consumer hostile and incompetent company. Shame, because the hardware pretty much works reliably.

Im a bit confused by this. I run a UniFi Controller in a docker container, have a few APs and a router, and everything works fine. No cloud stuff going on here.

Am i just lucky or something that i havent been forced to the cloud yet, or is it something i am missing here?

I think its just the cloud key. I have a unifi controller install as well and use a local account with no issues.

I have a cloud key with no cloud access. It's just that cloud access is the user directed workflow for sure. Setup without cloud access was not clear at all [1].

[1]: I don't even remember the steps, to be honest!

Hmm, even the self-hosted SW can use SSO from cloud... so I'm now worried that our equipment is still vulnerable by whatever system allows cloud logins.

Apparently I was... Now, updated the firmware and it says server certificate changed. Frikkin A. Now I am in 'what the hell' land

It probably just regenerated after the firmware updated, to be honest. I think it does it after a factory reset, and it's signed by the local device.