Help / Remote listening
Remote access: certificates, passwords and the Windows firewall
Vesari Stylus can serve your library to phones, tablets and other players on your network, but not until you switch it on. Do that and three things catch people out: the certificate warning, a password you never chose, and the Windows firewall prompt. All three are expected.
Nothing listens until you turn it on
Open Settings, go to the Advanced tab and find the Remote Access group. Enable remote access is the master switch, and it is off on a fresh install. While it is off the app binds no listening socket, so there is nothing on your network to find or guess a password against; the switch governs only what can reach in.
The change takes effect on the next launch, so restart. After that the server listens on port 4242 over HTTPS; switching it off and restarting closes it again. None of this is tier-gated: streaming is free, with no cap on connected devices.
What the switch exposes
Two things share that port, and both want credentials:
- The OpenSubsonic API. Any OpenSubsonic client can browse and search your library, stream or download tracks, manage playlists, star tracks and set ratings. It signs in with the username
adminand the OpenSubsonic Password. - A remote-control API. On top of the library it drives the player on your PC: play, pause, resume, stop, seek and volume. It authenticates with the API Bearer Token.
One route is deliberately open: a health check that replies "ok" and carries no library data, so a client can test that it reaches your PC. Everything else is refused without a credential.
Both are house keys: the password plays and downloads your whole collection, the token takes over the transport on your machine.
The password, the token and the log
You do not pick either one. On first run the app generates a 20 character password and a 32 character token and keeps them in Windows Credential Manager, not in its settings file. See Where Vesari Stylus keeps your files and settings.
Both appear in the Remote Access group with a Copy button, and the password also has a Regenerate button. The new password is stored at once, but the running server holds the old one until you restart; after that only the new one works, so update every connected client.
Remote requests go into the app log, which keeps 30 days of files. The password, the salted hash a client sends in its place, the salt and the username are all masked there, so the log you attach to a bug report carries no credentials. The bearer token never appears at all: it rides in a request header, not in the address. Failed sign-ins are logged, and an address that fails more than ten times in a minute is turned away unchecked.
Why your client warns about the certificate
On first run the app also generates its own TLS certificate and private key in its data folder. It is self signed, so no public authority vouches for it and a client cannot tell it from an impostor. A warning about an untrusted issuer is normal here; accept it once and the client remembers.
The certificate covers localhost, 127.0.0.1 and your PC's main local network address as detected when it was made, or loopback alone if that detection failed. If that address has since changed, or you connect by another one, the client may also say the name does not match. Two fixes: give the PC a fixed address on your router, or delete tls_cert.pem and tls_key.pem from the data folder and restart, which builds a fresh pair.
The API is HTTPS only and never quietly downgrades: if the certificate cannot be created or read, remote access does not start at all, so the fault looks like no server rather than an unencrypted one. The reason goes to the log.
The Windows firewall prompt
The first time the server binds its socket, Windows shows a firewall prompt naming Vesari Stylus. Tick the private network box, the one described as your home or work network, and leave the public box clear. Approving it changes a system setting, so Windows may want an administrator.
If you clicked Cancel, or the prompt opened behind another window, Windows records the app as blocked and nothing on your Wi-Fi will reach it. Fix that in Windows Security, under firewall and network protection: open the list of allowed apps and tick the private column for Vesari Stylus.
Neither the app nor its installer writes a firewall rule, so this is a one time step on each machine, including any new one. See Moving to a new PC.
Keeping it tight
- Do not forward port 4242 on your router. To reach your library from outside the house, put your own devices on a private network of their own: see Listening away from home.
- Regenerate the password if you have shared it, or if a device you lent it to is no longer yours.
If a client still refuses to connect, work through when a remote client cannot connect. If that does not explain it, use Report a Bug on the Support tab of Settings, saying which client you used and what the error said: see Is this a bug? How to report it.