Networking and security
Connection direction
The Runner starts every connection. You do not need to open UniFi Access to the public internet or allow an inbound connection from Musterly.
| Source | Destination | Purpose |
|---|---|---|
| Runner | Your UniFi Access host | Read configured access data |
| Runner | app.musterly.io:443 | Pairing, settings, status and sync |
| Installer/Runner | api.github.com:443 | Resolve published Runner updates |
| Installer/Runner | github.com:443 and GitHub release download hosts | Download Runner files |
The Runner also needs DNS and accurate system time. Incorrect time can make otherwise valid HTTPS certificates appear expired or not yet valid.
Only allow the listed destinations that your deployment requires.
Credentials
- Pairing codes are one-time and short-lived.
- After pairing, the Runner stores its own token in its local data directory.
- On Linux,
/etc/musterly-runner/envis readable only by root. - Use a dedicated UniFi API token with read access to Access devices.
- Rotate the UniFi token according to your organisation’s policy and update the connector afterwards.
- Never put tokens, pairing codes or credential-bearing URLs into tickets.
Proxies and TLS inspection
If outbound traffic uses a proxy, configure it for the account running the Windows Runner or for the Linux systemd service. A browser proxy setting does not necessarily apply to either.
TLS inspection must present a certificate trusted by the Runner machine. UniFi Access must also present a valid certificate trusted by that machine.
Runner host
Treat the Runner machine as part of your access-control environment:
- keep the operating system patched
- restrict administrator access
- prevent unnecessary software from being installed
- monitor free disk space and service health
- keep system time synchronised
The Linux service uses /var/lib/musterly-runner for its data and a private temporary directory.
Data sent to Musterly
The Runner sends the access-control data needed for the enabled Musterly features, such as people, doors and access events. It does not provide a general inbound route into the UniFi controller.