Why can't an agent run within a Unifi Mesh Network?

[nberardi]

Why do we need an HTTPS proxy and to expose the Network Optimizer externally, instead of just allowing secure communications inside a Unifi Mesh Network?

[tvancott42]

The recommended deployment architecture for a full NO install is reverse-proxy fronted for TLS, internal or not. You don't need to expose it externally for same-site installs, it's not a requirement at all. But DNS-01 TLS certs w/ Traefik, Caddy, etc with a real domain name (with internal DNS entries only) make it very convenient and maintainable.

You can custom-configure an agent to allow internal self-signed certs and then configure Kestrel on 8042 to do TLS instead w/ self-signed cert the way that 8043 (agent tunnel does). The agent has an --insecure installation option and config (in docs) if you want to run this way. But the agent will never support open HTTP, it is far too powerful to leave open, even internally.