hotloop
GitHub
UniFiRead-only since 4.17.0

Your UniFi network, next to the machines it feeds.

When a PLC goes quiet, the first question is always the same: is it the PLC or the wire? Today you answer it by walking to the UniFi app, or to the rack. HotLoop has a native UniFi integration, built in Go from scratch, so the answer sits on the same screen as the machine: which switch port it's on, whether that port is up, and what it's drawing.

The read-only driver shipped in 4.17.0, and the screens and events in 4.18.10. Nothing writes to a console yet.

The Network driver, the clients work, the screens and the events are out, and the Edge Relay can poll a console too. Writes come only after the write path has been proven on a lab controller and one empty port, so nothing in this release can cycle a port or change a setting on your network. It lives in the base of the lineup, so every HotLoop product gets it. The setup, down to pinning the console's certificate, is in the docs.

Already paid for itself

It got fooled by a dead backup link, once.

On 2026-09-28 the read-only driver went onto the house Cloud Gateway and an Express 7 for the first time, and it said the 5G backup WAN was up. It wasn't. It had been unplugged for two days. The console's WAN block still said up, with a stale 80% signal, and that's the field HotLoop read. Only the console's own health checks knew the truth, and nothing had needed the backup yet, so nobody else knew either.

So the driver reads the health checks now, a dead backup reads down, and a test holds it to those exact fields. That's the whole reason this integration exists: you find out on a Monday afternoon, not the night the fiber gets cut.

The order

Network first, then everything that hangs off it.

  1. Network, read-only

    In 4.18.10

    Every adopted device, switch port, PoE draw and WAN link, and which WAN is carrying traffic, as tags that sync themselves. A switch adopted tomorrow shows up by itself, and one that disappears goes bad quality instead of vanishing out from under its alarms. Read on two real consoles. A PoE draw above zero has not been seen on real gear yet, because nothing on those consoles was drawing PoE.

  2. Clients and OT watch

    In 4.18.10

    Clients keyed by MAC, never IP, because the controller shows addresses a machine left hours ago. Mark a network as OT, accept what is on it, and anything new raises an alarm. Link a PLC to its switch port once, and when it goes quiet it tells you which port and whether the link is up. Proven against a lab controller and read on two real consoles. A real cable pull and a phone joining SCADA on purpose still have to happen on real gear, and until they do, those two alarms are proven in the lab and nowhere else.

  3. Screens and the topology map

    In 4.18.10

    An overview with a WAN strip that goes amber when the site is running on the backup link, and a topology map laid out the same way every time, so nothing jiggles on a wall board, that zooms to eight times and pinches on a touch screen. Click a switch, see which lines on the Plant tree it feeds. Switch faceplates show a port's traffic as a trace, WAN latency gets one too, and one button makes the usual alarms: device offline, uplink down, gateway on its backup, and PoE over a limit you give. Proven against a lab controller, with touch emulated. Not yet looked at on real gear, and a PoE alarm firing and a WAN throughput trace are not proven or built.

  4. Events

    In 4.18.10

    The controller's events websocket, so a switch dropping off shows up in seconds and lands in the logbook. Polling stays the truth: a dead websocket costs speed, never correctness. Events are filed under the switch or access point they are about, and an agent can ask over MCP for the topology and the console's latest events. Proven on the lab controller: a client joining reached the logbook six seconds after the cable went in.

  5. Network writes

    Not built yet

    Locate LED first, because it is zero risk and proves the whole write path on real gear. Then PoE mode, port power-cycle, WLAN on and off, client block, and shutting the port an unknown device just showed up on. Every one through the write gate.

  6. Protect, Access and PDUs

    Not built yet

    Cameras as entities with detections as triggers and a snapshot on the alarm that pages you. Door events in the logbook and unlock behind the gate. Outlet power feeding the energy numbers. Each one merges after it has run on real gear, not before.

How it works

A protocol driver, not a side system.

A UniFi console is a device in HotLoop, same as a PLC, and its switches, ports and WAN links are tags. That one decision means alarms, trends, entities, rules, the audit, OPC UA and MCP all work on your network the day the driver does, without building half of each again for one vendor.

One login, not forty

One session per console, reused for every read, with a login budget. Logging in on every check got our own Cloud Gateway to lock us out, twice.

A pinned certificate

The first connect fails on purpose and shows the console's key fingerprint. Paste it in, and a console with a different key is refused before your password is sent.

WAN failover

Which WAN is carrying traffic, as a tag you can alarm on. Know the plant failed over to the backup link before the data bill tells you.

Protected ports, when writes land

HotLoop won't cycle an uplink, or the port powering the backup WAN, no matter who asks. Worked out from the topology, not typed in.

A cooldown on power-cycles

Fifteen minutes per port. A rule that cycles a PLC every two minutes is how you cook a power supply.

What it will never do

No VLANs, firewall rules, DHCP, static IPs, SSIDs or firmware. That's the UniFi app's job. HotLoop does the few things an operator needs at 2am.

The full detail behind these cards

One login, not forty

One session per console, reused for every read, with a budget on how often it logs in. Logging in on every check got our own Cloud Gateway to lock us out, twice. HotLoop waits a lockout out instead of making it longer.

A pinned certificate

The first connect fails on purpose and shows you the console's key fingerprint. Check it, paste it in. From then on a console with a different key is refused during the handshake, before your password goes anywhere.

Protected ports, when writes land

HotLoop won't cycle an uplink, or the port powering the backup WAN, no matter who asks. Worked out from the topology, not typed in by hand, so nobody forgets one.

A cooldown on power-cycles

Fifteen minutes per port. A rule that cycles a PLC every two minutes is how you cook a power supply, and one that needs more than one cycle has a problem a cycle won't fix.

What it will never do

No VLANs, firewall rules, DHCP, static IPs, SSIDs or firmware. We've watched a switch lose its controller over one static IP change. That's the UniFi app's job. HotLoop does the few things an operator needs at 2am.

Console passwords are entered in HotLoop and stored encrypted, with the key kept outside the database, so a dump or a backup doesn't hand anybody the keys to your network.

UniFi is a trademark of Ubiquiti Inc. HotLoop is not affiliated with, endorsed by, or a partner of Ubiquiti. This is an independent integration that talks to your own console, on your own network.