Is the database up?
Opens a real connection to the host and port your app will use. Not a ping — a connection.
Does it actually serve?
Requests the health endpoint and requires a 2xx. A 503 is a failure, not a warning.
Is the environment complete?
Names every missing key. Presence only — Muster never reads or stores what a secret contains.
Are migrations applied?
Runs the status command, never the migrate command. A check that mutates your database is not a check.
Your own precondition.
Any command you name has to exit 0. The escape hatch for the thing only you know.
Is it really provisioned?
Asks the OpenTofu state, not the cloud console — state is what the apply actually wrote.
Will the data survive?
Compares the device behind your data path against the root disk. Invisible until the instance is replaced.
Has the backup ever restored?
The timer being enabled is not the bar. Muster runs the restore and requires it to verify.
Your deploy said it worked.
Your customer says otherwise.
postgres127.0.0.1:5433 accepted a connection
postgres-persistenton /dev/nvme1n1, mounted at /mnt/data
postgres-backuprestore verified: 24 tables
migrationsat head
env-completeSESSION_SECRET is missing — the app boots and quietly does nothing
healthwaiting — blocked upstream
Blocked at env-complete. Traffic was not cut over.
One gate. Two mornings.
Without the gate
- 502 Bad Gateway
- 502 Bad Gateway
- Session store unreachable
- 1,284 sessions dropped
- Rollback started 11 minutes later
What actually happened
- Cutover refused at the gate
- Previous version still serving
- 0 requests affected
- One missing key to fix
- Deploy retried, green, 4 minutes later
Almost nothing breaks because the code was wrong. It breaks because a key was missing, the database was not up, migrations had not run, or the disk holding your data dies with the instance.
No card required. Read-only — it observes your server, it never changes it.
It runs your preconditions in order.
Each answer decides whether the next question is even asked. The database has to be reachable before migrations are worth checking; migrations have to be at head before health means anything.
Then it refuses.
Not by convention, and not with a warning someone can merge past. The cutover is downstream of the gate, so a failed check physically cannot reach it.
- 0
- customers served the broken build
- 6
- gates that all had to hold
Three things, in order
The order is the point. Each answer decides whether the next question is even asked.
01
It reads your app
Point Muster at the code. It works out the services, databases, queues, environment keys and migrations — and tells you every single thing it had to guess, so nothing is decided behind your back.
02
It checks your server
Over SSH, against the machine you actually run on. Is the database reachable? Are migrations applied? Is the data on a disk that survives the instance? Has the backup ever been restored?
03
It blocks the deploy
Each answer gates the next. Nothing reaches your customers until every precondition holds — not by convention, but because the check physically cannot get there.
Your cloud. Your code. Your keys.
Muster runs against your account, not ours. It never stores a cloud key, an SSH key, or the value of any secret — it verifies that your environment variables are present, never what they contain. The infrastructure code it writes is yours: plain OpenTofu you can read, keep, and take with you if you stop paying us.
Priced per app, not per person
Adding a teammate costs nothing. You pay for what Muster watches.
Free
Free
One app, checked as often as you like.
- ✓One watched app
- ✓Every readiness gate
- ✓Monthly cost estimate
- ✓Check history
Starter
$29/mo
For a small team running a handful of services.
- ✓Five watched apps
- ✓Everything in Free
- ✓Scheduled daily checks
- ✓Email when a gate breaks
Agency
$99/mo
For an agency running many client apps at once.
- ✓Fifty watched apps
- ✓Everything in Starter
- ✓Per-client grouping
- ✓Client-facing readiness reports