@Virgo @d0ugmac1 thank you very much for your reply! I will have to wait till our tenants take off to update the controller, then.... perhaps after Easter.

As for updating of the controller, my controller is on Raspberry pi 4, I followed this instruction:

https://community.tp-link.com/en/business/forum/topic/261734

Would it be right if I do this:

1. save the config of the current one, then "stop" it on portainer

2. Install a new one exactly the same way. Upload the config. Check that everything works

3. delete the old one through portainer

?

Would it be also OK if I update EAP's first meanwhile ? That's a lot easier than updating the controller, takes just a few minutes,  I don't have to wait till the people move out. But I'm a bit scared of updating the controller: I need time for it.

I am generally a bit worried about updating/upgrading because updating is where bad things happen with Unifi system. But if nobody suggests otherwise, I'm going to find a moment to update them.

Meanwhile, I decided to change the portal back to openNDS: I was using Omada Portal for a while because openNDS had some problem. But now the author of it fixed it and running stable on my other router (where Unifi APs' are), so I went back to it. Omada Portal doesn't have "idle out", so people will be kicked out after authentication time out, possibly in the middle of doing something. But with "idle time out" feature which openNDS has, if a device is off-line for a certain length of time (you can set how long), it will have to log in again when they come back on-line, thus resetting the authentication time, so unlikely to be interrupted, as long as auth-time-out is long enough (I set it 24h). Perhaps it's a feature to be considered for Omada-Portal as well ? Or perhaps already implemented? 

  @d0ugmac1 and Virgo

thank you for your replies! I think the link from Virgo is yet another method, not on a container like I have mine. I guess I will stick with it.  @d0ugmac1  I guess you are right about updating of the Controller not being so scary: it's just that I've installed it about 1.5 years ago, and since then I haven't done anything, forgot everything, didn't even remember the port number of the portainer !! The fact that I didn't have to do anything is a good thing, though: there was simply no issue that was obviously because of the controller. 

But yes, especially since I don't run the portal over the controller anymore, I shouldn't worry much about making a big time window, beyond the time needed for the APs to get adopted to the new controller.  I can do your 1+2 at my convenient time, and for 3-5 I should perhaps get up at 4am to do it to have 1 hour.... something like that. Right?

In fact I've done something like this for Unifi, in fact many times, it should go the same.... but that's also a long time ago, I've forgotten.....

As for installation of the newer version, am I right that the instruction here:

https://community.tp-link.com/en/business/forum/topic/261734

is still valid, in terms of port numbers to enter, paths, etc?

And as for

@d0ugmac1  I run my Controller with host networking, if you use bridging

I don't know what I'm using (in other words, I don't know what a "host networking" is, nor "bridging")  How can I tell ?

And, speaking of updating, I actually haven't updated raspi OS or anything on it. I just let Omada run on it, and a script for water-sensor in case of flood in the basement. Otherwise I don't do anything on that Raspi. Should I update the raspi OS, too?

  @d0ugmac1 wow, thanks a lot for detailed answers !!! I really appreciate it a lot!.

As for a backup for raspi, I do have one for each Raspi (one for Omada, one for Unifi). I am afraid of accidental power cycling (e.g. due to power outage) that might kill the card, and also it might die for whatever reason. I got a few of the high-end ones that were recommended back then, which are supposed not to die easily (Samsung endurance pro, and another similar one.). But if you recommend me some, that would be nice. I don't know what exactly "industry-grade" SD cards are.

I also have one spare raspi: it used to be a router (with openwrt), but I decided not to use raspi as a router. So that can be used as a replacement if something happens.

Do you know how to clone an SD card while running ?  Or else, how do you clone fast? It takes hours using my laptop. (Macbook pro mid 2012: upgraded.)

As for the network, now I found it: mine is bridge. I think it was default. If "host networking" is so much easier, why isn't everybody using host networking? Is there any disadvantage to it?

Now, I think i found one maybe-answer to it on my own..... my Unifi controller is apparently "host networking": it doesn't show the IP.  Whenever Raspi restarts, there is a weird competition of port with java. I have to kill the PID of java a few times till Unifi runs.  Now I don't restart Raspi at all, so I don't have to worry much (I used to have a shut-off button installed, but the button was too sensitive/unstable, when I'm doing something else near by or move the raspi a bit, it shuts it off! So I uninstalled it), but perhaps it's related to the fact that it's host networking.....

I guess I will stay with bridge, since it's been working totally fine with omada.

And

@d0ugmac1   type magic should

What is a "type magic" ?