fix: Switch UniFi provider to API key auth and upgrade to ~>0.41

Newer UniFi OS requires API key authentication instead of
username/password login. Removes deprecated credential variables.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/deploy-infrastructure.yml

@@ -38,15 +38,13 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: tf_rfs_secret
       AWS_REGION: "us-east-1"
-      TF_VAR_unifi_username:
-        from_secret: unifi_username
-      TF_VAR_unifi_password:
-        from_secret: unifi_password
+      TF_VAR_unifi_api_key:
+        from_secret: unifi_api_key
       TF_VAR_unifi_api_url:
         from_secret: unifi_api_url
     commands:
       - apk add --no-cache git
-      - tofu init -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
+      - tofu init -upgrade -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
       - tofu plan -no-color
 
   - name: apply
@@ -70,10 +68,8 @@ steps:
       AWS_SECRET_ACCESS_KEY:
         from_secret: tf_rfs_secret
       AWS_REGION: "us-east-1"
-      TF_VAR_unifi_username:
-        from_secret: unifi_username
-      TF_VAR_unifi_password:
-        from_secret: unifi_password
+      TF_VAR_unifi_api_key:
+        from_secret: unifi_api_key
       TF_VAR_unifi_api_url:
         from_secret: unifi_api_url
       SSH_PRIVATE_KEY:
@@ -84,5 +80,5 @@ steps:
       - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
       - chmod 600 ~/.ssh/id_ed25519
       - printf "Host *\n\tStrictHostKeyChecking no\n" > ~/.ssh/config
-      - tofu init -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
+      - tofu init -upgrade -backend-config="access_key=$AWS_ACCESS_KEY_ID" -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
       - tofu apply -auto-approve

opentofu/.terraform.lock.hcl

@@ -59,25 +59,3 @@ provider "registry.opentofu.org/hashicorp/null" {
   ]
 }
 
-provider "registry.opentofu.org/ubiquiti-community/unifi" {
-  version     = "0.41.12"
-  constraints = "0.41.12"
-  hashes = [
-    "h1:B/jK5VsotLdJleBuYY/iILvKYwPaBa7Aih7e104ab7k=",
-    "zh:22b6b00886b041265e9e96669a3ed8f359e7a9e47a002a01837663e85ff41384",
-    "zh:2e57eb66b6f46bef0ba00db8fac4ad5cd5dd774ec30bf43d939fc45256813f1b",
-    "zh:376e528b0ddc73a33d34c23e2342a51042d2ae92d328352fcce667fe1ee3c5d2",
-    "zh:3ca2c82450c3e57158cb161927510886465006041cbf28a52dfb9bc5d7ba6150",
-    "zh:471342ef42eb8ac77503417ba3831bdbc6f863201d2b8e790452ded2e0a1fed5",
-    "zh:6a79496aafbdec844b6a065d1f79c7649e21927e4651689b8711e6437af26b7e",
-    "zh:6c2897e6989f2a4d08c5f6a815482ac1c91f8a5516bca3e653338792711695d7",
-    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:9bfed50e2bc4c7a917e83a341afc08e63984ddcaf609b5c7343d208b7ac0944c",
-    "zh:a31b7a19168ac76699de93e41d7dcebc3b7783533a0048a8250bfbd00c7df35b",
-    "zh:dfa3a63ba6e72c7fb5c17bcdf31f4010a2eabccf631860441775a6eb36624579",
-    "zh:eb25b6fe1ec1e336d09f18197548da1077cc2d16502152eba06e7182852c32f3",
-    "zh:eb66e34fe0ccec95f616abeec2e32a460d0b1fbdef845baf7e89a1bbc3628905",
-    "zh:f4a37bc2abfc50f6c7af23b462d8abf52a0f7647881128adfd6fafd28af7c38a",
-    "zh:ff9290e387aced795df9c2dab7e774c8f3e2b9e3c499747ebad63607f30ae5f3",
-  ]
-}

opentofu/providers.tf

@@ -21,7 +21,7 @@ terraform {
     }
     unifi = {
       source  = "ubiquiti-community/unifi"
-      version = "0.41.12"
+      version = "~> 0.41"
     }
   }
 }
@@ -50,8 +50,7 @@ provider "aws" {
 }
 
 provider "unifi" {
-  username       = var.unifi_username
-  password       = var.unifi_password
+  api_key        = var.unifi_api_key
   api_url        = var.unifi_api_url
   allow_insecure = var.unifi_insecure
 }

opentofu/variables_unifi.tf

@@ -1,18 +1,12 @@
 variable "unifi_api_url" {
   type        = string
   description = "The URL of the Unifi Controller (e.g., https://192.168.1.1)"
-  default     = "https://192.168.1.1" 
+  default     = "https://192.168.1.1"
 }
 
-variable "unifi_username" {
+variable "unifi_api_key" {
   type        = string
-  description = "The username for the Unifi Controller"
-  sensitive   = true
-}
-
-variable "unifi_password" {
-  type        = string
-  description = "The password for the Unifi Controller"
+  description = "The API key for the Unifi Controller"
   sensitive   = true
 }