├── .github └── ISSUE_TEMPLATE │ └── 1_Bug_report.md ├── .gitignore ├── CHANGELOG.md ├── CoreConfig.xml ├── FAQ.md ├── LICENSE ├── README.md ├── docker-compose.arm.yml ├── docker-compose.yml ├── docker ├── amd64 │ ├── Dockerfile.takserver │ └── Dockerfile.takserver-db └── arm64 │ ├── Dockerfile.takserver │ └── Dockerfile.takserver-db ├── img ├── allyourtak.png ├── banana.png ├── tak-server-download.jpg ├── tak.jpg ├── tak.png ├── takserverpasswords.jpg └── warning.jpg ├── postgresql1.conf ├── scripts ├── certDP.sh ├── cleanup.sh ├── setup.sh └── shareCerts.sh ├── tak-md5checksum.txt └── tak-sha1checksum.txt /.github/ISSUE_TEMPLATE/1_Bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: "Bug report" 3 | about: "Report something that's broken." 4 | labels: bug 5 | --- 6 | 7 | 15 | 16 | # Environment 17 | 18 | Please provide as much information as possible about your environment: 19 | 20 | - Hardware Make/Model: XXX 21 | - Operating System and Version (e.g. `cat /etc/os-release`): XXX 22 | - Docker Version (`docker -v`): XXX 23 | - Docker Compose Version (`docker compose version`) or (`docker-compose version`): XXX 24 | - CPU Details (make/model and/or speed/core count): XXX 25 | - RAM (e.g. `free -h`): XXX 26 | - Disk Availability (e.g. `df -h`): XXX 27 | - TAK Server Version From TAK.gov: XXX 28 | 29 | 30 | 31 | # Description 32 | 33 | 34 | 35 | # Steps to Reproduce 36 | 37 | 38 | 39 | # Debug Output 40 | 41 | 50 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .env 2 | *.war 3 | takserver-*.zip 4 | tak/ 5 | investigation/ 6 | originalWAR/ 7 | chatbot/ 8 | server.pref 9 | manifest.xml -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # CloudRF TAK Server Wrapper Changelog 2 | 3 | ## Upcoming 4 | 5 | - Check for active ports during setup no longer false flagging ephemeral ports. 6 | - Changelog converted to markdown. 7 | - Improvements to README. 8 | 9 | ## 24/11/2022 - 4.7 REL 20 10 | 11 | - Added 7zip support. 12 | - Added warnings to prevent 13 | - Increased Postgres connection limits to 400 for slower boxes which loop the setup and accumulate stale Postgres connections. 14 | - Improved setup messages. 15 | - Automatic CA generation. CA is `LOL` and CN is `takserver`. 16 | - No more "Do you want to kill this process as sudo etc". If a port is used - the script stops. 17 | - Tested against TAK Server 4.7 REL 20 on AMD64 architecture. 18 | 19 | ## 23/11/2022 - 4.7 REL 20 20 | 21 | - Edited Posgres configuration to reduce memory requirement. 22 | - Removed hardcoded Postgres memory options in startup scripts. 23 | - Added mini web server to deploy setup data packages. 24 | - Updated `CoreConfig.xml` IP addresses to enable rate limiter and federation server. 25 | - Fixed startup race condition which caused HTTPS `8443` to fail to HTTP `8080`. 26 | 27 | ## 18/10/2022 - 4.7 REL 20 28 | 29 | - Automatic generation of user certificates. 30 | - Automatic generation of certificate data packages for users. 31 | - Streamlined setup with removal of a bogus Docker start/stop. 32 | - Fixed issue with random passwords failing to meet complexity requirement. 33 | - Tested against ATAK 4.7 and iTAK 2.3. 34 | 35 | ## 17/08/2022 - 4.7 REL 18 36 | 37 | - Automatic SSL setup 38 | - Removes insecure protocols 39 | - Fixes broken Docker database authentication in upstream release. 40 | - Enforces HTTPS only. 41 | -------------------------------------------------------------------------------- /CoreConfig.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | pref 81 | 82 | 83 | 84 | 85 | 86 | 87 | -------------------------------------------------------------------------------- /FAQ.md: -------------------------------------------------------------------------------- 1 | # FREQUENTLY ASKED QUESTIONS 2 | 3 | ## docker-compose not found? 4 | If you have definitely installed Docker, try "docker compose" (with a space). This pointless modification broke scripts around the world but it's only Docker right! 5 | We have fixed this in the latest script to handle both. 6 | 7 | ## Where are the docs? 8 | 9 | You can find the PDF manual in the tak/docs folder and get help from *community volunteers* via the TAK Discord server. If you ask a bone FAQ already covered in the manual, or demand urgent assistance, expect to get some grief. **RTFM and be patient**. 10 | 11 | ## How do I start over? 12 | ``` 13 | sudo ./scripts/cleanup.sh 14 | ``` 15 | 16 | This script will stop the TAK Server container, remove the mapped database volume and remove the folder "tak" which is created in the project root directory (cloned from github) during the setup process. 17 | 18 | WARNING: If you have data in an existing TAK database container it will be lost. 19 | 20 | ## How do I make a new certificate for my EUDs? 21 | 22 | You can generate certificates making use of the command below which runs the `makeCert.sh` script: 23 | 24 | ```bash 25 | docker exec -it -w /opt/tak/certs tak-server-tak-1 ./makeCert.sh client EUD1 26 | ``` 27 | 28 | You can collect your `EUD1.p12` file from `./tak/certs/files/`. 29 | 30 | ## Why does my EUD not connect? 31 | Ensure you have created EUD certificates and have configured the following properly on your ATAK server settings: 32 | 33 | - Address: Can you reach this with a browser on Android? If not - fix your network. 34 | - Protocol: SSL 35 | - Server Port: 8089 36 | - Uncheck "Use default SSL/TLS Certificates" 37 | - Import truststore-root.p12 to "Import Trust Store" with password atakatak 38 | - Import {user}.p12 to "Import Client Certificate" with the name you chose during setup and the same password 39 | 40 | On the server check: 41 | 42 | - You have added a user eg. EUD1 https://takserver:8443/user-management/index.html#!/ 43 | - You have created a certificate for this user with the same name/callsign so EUD1 needs a matching file within ./tak/certs/files called EUD1.p12 44 | 45 | ## How do I enable Certificate Enrollment? 46 | 47 | Visit https://localhost:8443/Marti/security/index.html#!/modifySecConfig and click Edit. 48 | Enable "Enable Certificate Enrollment" and then Submit. 49 | 50 | ## I can't import the certificate to my browser? 51 | Ensure the admin.p12 file is owned by you. Use the atakatak password when prompted and ensure you enable the TAK authority to "authenticate websites" in Firefox. 52 | 53 | ## How can I change the logo at the footer of the web page 54 | 55 | The BBN logo can be changed **without** stopping or setting up the TAK Server again. 56 | 57 | *Since about 5.x this was removed but you can use this process to edit the HTML like Marti/menubar.html. See below* 58 | 59 | ![meh](img/banana.png "A banana") 60 | 61 | The script takes one command line argument which is the full path to the **PNG** or **JPG** image of new logo. Sudo permission may not be needed depending on your docker permissions. 62 | 63 | ``` 64 | chmod +x scripts/logo-replacement.sh 65 | sudo ./scripts/logo-replacement.sh /home/eric/banana.jpg 66 | ```` 67 | 68 | The script will check for all dependencies required, and if not present, the script will attempt to install them for you. The dependencies needed are __*openJDK*__ (JAVA environment is required to be able to repack the jar correctly) and ImageMagick for conversion. 69 | 70 | ## Edit the HTML 71 | WARNING: You may break your server. Use at your own risk: 72 | ![meh](img/allyourtak.png "All your tak") 73 | 74 | The following command, run from inside the TAK container will extract HTML to a folder structure so you can edit it. Once done, copy back the modified file(s). 75 | 76 | jar -xvf /opt/tak/takserver.war 77 | (edit .html pages in Marti/...) 78 | jar -uvf /opt/tak/takserver.war Marti/menubar.html 79 | 80 | Once copied over, reload your interface and enjoy :) 81 | 82 | ## How can I upload a data package to Marti sync? 83 | This is uber-secret. 84 | A successful POST will return a JSON message containing a SHA256 hash. This hash is the unique filename on the server 85 | 86 | ### Upload 87 | 88 | curl 'https://127.0.0.1:8443/Marti/sync/upload' \ 89 | --cert ssl/user.pem:atakatak \ 90 | --key ssl/user.key \ 91 | --cacert ssl/ca.pem \ 92 | -F assetfile=@BIGPLAN.MK2.zip \ 93 | -F Name=BIGPLAN.MK2 \ 94 | -k -v 95 | 96 | ### Download 97 | 98 | https://takserver:8443/Marti/sync/content?hash=a10f4b65b27fd9ce047bf7c94f5841a503d1910d76cd156f749c4ff69e90ac33 99 | 100 | ## How do I renabled TCP on port 8087 101 | 102 | Edit docker-compose.yml and add port mappings for "8087:8087" around line 28. 103 | Rebuild. 104 | 105 | docker-compose build 106 | 107 | # Known issues 108 | 109 | ## Loads of repeat java exceptions eg java.lang.RuntimeException... 110 | One or two is expected behaviour due to the time the backend processes take to start up. If you get lots or it's still ongoing after 2 minutes, run the cleanup script as sudo to prune stale images. 111 | 112 | ## Failed to initialize pool: Connection to tak-database:5432 refused 113 | This indicates a docker network issue. Run the clean up script as sudo to prune stale networks. 114 | 115 | ## The login screen doesn't take my password? 116 | Just wait a minute or two. This is expected behaviour due to the time the backend processes take to start up. 117 | 118 | ## Running the /setup wizard breaks the database? 119 | This script **is the wizard** so it gets you past the setup wizard (Section 4.4 in the configuration guide) and populates the database tables. Only run the wizard if you know what you're doing as **this will break your database connection** - at which point you should set this up the hard way. 120 | 121 | ## ERROR: could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network 122 | Stop your vpn, prune your networks 123 | ``` 124 | service openvpn stop 125 | docker network prune 126 | ``` 127 | ## My custom logo doesn't show up? 128 | If the script ran as sudo and completed ok, refresh your browser's cache with Ctrl-F5 -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU General Public License 2 | ========================== 3 | 4 | _Version 3, 29 June 2007_ 5 | _Copyright © 2007 Free Software Foundation, Inc. <>_ 6 | 7 | Everyone is permitted to copy and distribute verbatim copies of this license 8 | document, but changing it is not allowed. 9 | 10 | ## Preamble 11 | 12 | The GNU General Public License is a free, copyleft license for software and other 13 | kinds of works. 14 | 15 | The licenses for most software and other practical works are designed to take away 16 | your freedom to share and change the works. By contrast, the GNU General Public 17 | License is intended to guarantee your freedom to share and change all versions of a 18 | program--to make sure it remains free software for all its users. We, the Free 19 | Software Foundation, use the GNU General Public License for most of our software; it 20 | applies also to any other work released this way by its authors. You can apply it to 21 | your programs, too. 22 | 23 | When we speak of free software, we are referring to freedom, not price. Our General 24 | Public Licenses are designed to make sure that you have the freedom to distribute 25 | copies of free software (and charge for them if you wish), that you receive source 26 | code or can get it if you want it, that you can change the software or use pieces of 27 | it in new free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you these rights or 30 | asking you to surrender the rights. Therefore, you have certain responsibilities if 31 | you distribute copies of the software, or if you modify it: responsibilities to 32 | respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether gratis or for a fee, 35 | you must pass on to the recipients the same freedoms that you received. You must make 36 | sure that they, too, receive or can get the source code. And you must show them these 37 | terms so they know their rights. 38 | 39 | Developers that use the GNU GPL protect your rights with two steps: **(1)** assert 40 | copyright on the software, and **(2)** offer you this License giving you legal permission 41 | to copy, distribute and/or modify it. 42 | 43 | For the developers' and authors' protection, the GPL clearly explains that there is 44 | no warranty for this free software. For both users' and authors' sake, the GPL 45 | requires that modified versions be marked as changed, so that their problems will not 46 | be attributed erroneously to authors of previous versions. 47 | 48 | Some devices are designed to deny users access to install or run modified versions of 49 | the software inside them, although the manufacturer can do so. This is fundamentally 50 | incompatible with the aim of protecting users' freedom to change the software. The 51 | systematic pattern of such abuse occurs in the area of products for individuals to 52 | use, which is precisely where it is most unacceptable. Therefore, we have designed 53 | this version of the GPL to prohibit the practice for those products. If such problems 54 | arise substantially in other domains, we stand ready to extend this provision to 55 | those domains in future versions of the GPL, as needed to protect the freedom of 56 | users. 57 | 58 | Finally, every program is threatened constantly by software patents. States should 59 | not allow patents to restrict development and use of software on general-purpose 60 | computers, but in those that do, we wish to avoid the special danger that patents 61 | applied to a free program could make it effectively proprietary. To prevent this, the 62 | GPL assures that patents cannot be used to render the program non-free. 63 | 64 | The precise terms and conditions for copying, distribution and modification follow. 65 | 66 | ## TERMS AND CONDITIONS 67 | 68 | ### 0. Definitions 69 | 70 | “This License” refers to version 3 of the GNU General Public License. 71 | 72 | “Copyright” also means copyright-like laws that apply to other kinds of 73 | works, such as semiconductor masks. 74 | 75 | “The Program” refers to any copyrightable work licensed under this 76 | License. Each licensee is addressed as “you”. “Licensees” and 77 | “recipients” may be individuals or organizations. 78 | 79 | To “modify” a work means to copy from or adapt all or part of the work in 80 | a fashion requiring copyright permission, other than the making of an exact copy. The 81 | resulting work is called a “modified version” of the earlier work or a 82 | work “based on” the earlier work. 83 | 84 | A “covered work” means either the unmodified Program or a work based on 85 | the Program. 86 | 87 | To “propagate” a work means to do anything with it that, without 88 | permission, would make you directly or secondarily liable for infringement under 89 | applicable copyright law, except executing it on a computer or modifying a private 90 | copy. Propagation includes copying, distribution (with or without modification), 91 | making available to the public, and in some countries other activities as well. 92 | 93 | To “convey” a work means any kind of propagation that enables other 94 | parties to make or receive copies. Mere interaction with a user through a computer 95 | network, with no transfer of a copy, is not conveying. 96 | 97 | An interactive user interface displays “Appropriate Legal Notices” to the 98 | extent that it includes a convenient and prominently visible feature that **(1)** 99 | displays an appropriate copyright notice, and **(2)** tells the user that there is no 100 | warranty for the work (except to the extent that warranties are provided), that 101 | licensees may convey the work under this License, and how to view a copy of this 102 | License. If the interface presents a list of user commands or options, such as a 103 | menu, a prominent item in the list meets this criterion. 104 | 105 | ### 1. Source Code 106 | 107 | The “source code” for a work means the preferred form of the work for 108 | making modifications to it. “Object code” means any non-source form of a 109 | work. 110 | 111 | A “Standard Interface” means an interface that either is an official 112 | standard defined by a recognized standards body, or, in the case of interfaces 113 | specified for a particular programming language, one that is widely used among 114 | developers working in that language. 115 | 116 | The “System Libraries” of an executable work include anything, other than 117 | the work as a whole, that **(a)** is included in the normal form of packaging a Major 118 | Component, but which is not part of that Major Component, and **(b)** serves only to 119 | enable use of the work with that Major Component, or to implement a Standard 120 | Interface for which an implementation is available to the public in source code form. 121 | A “Major Component”, in this context, means a major essential component 122 | (kernel, window system, and so on) of the specific operating system (if any) on which 123 | the executable work runs, or a compiler used to produce the work, or an object code 124 | interpreter used to run it. 125 | 126 | The “Corresponding Source” for a work in object code form means all the 127 | source code needed to generate, install, and (for an executable work) run the object 128 | code and to modify the work, including scripts to control those activities. However, 129 | it does not include the work's System Libraries, or general-purpose tools or 130 | generally available free programs which are used unmodified in performing those 131 | activities but which are not part of the work. For example, Corresponding Source 132 | includes interface definition files associated with source files for the work, and 133 | the source code for shared libraries and dynamically linked subprograms that the work 134 | is specifically designed to require, such as by intimate data communication or 135 | control flow between those subprograms and other parts of the work. 136 | 137 | The Corresponding Source need not include anything that users can regenerate 138 | automatically from other parts of the Corresponding Source. 139 | 140 | The Corresponding Source for a work in source code form is that same work. 141 | 142 | ### 2. Basic Permissions 143 | 144 | All rights granted under this License are granted for the term of copyright on the 145 | Program, and are irrevocable provided the stated conditions are met. This License 146 | explicitly affirms your unlimited permission to run the unmodified Program. The 147 | output from running a covered work is covered by this License only if the output, 148 | given its content, constitutes a covered work. This License acknowledges your rights 149 | of fair use or other equivalent, as provided by copyright law. 150 | 151 | You may make, run and propagate covered works that you do not convey, without 152 | conditions so long as your license otherwise remains in force. You may convey covered 153 | works to others for the sole purpose of having them make modifications exclusively 154 | for you, or provide you with facilities for running those works, provided that you 155 | comply with the terms of this License in conveying all material for which you do not 156 | control copyright. Those thus making or running the covered works for you must do so 157 | exclusively on your behalf, under your direction and control, on terms that prohibit 158 | them from making any copies of your copyrighted material outside their relationship 159 | with you. 160 | 161 | Conveying under any other circumstances is permitted solely under the conditions 162 | stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 163 | 164 | ### 3. Protecting Users' Legal Rights From Anti-Circumvention Law 165 | 166 | No covered work shall be deemed part of an effective technological measure under any 167 | applicable law fulfilling obligations under article 11 of the WIPO copyright treaty 168 | adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention 169 | of such measures. 170 | 171 | When you convey a covered work, you waive any legal power to forbid circumvention of 172 | technological measures to the extent such circumvention is effected by exercising 173 | rights under this License with respect to the covered work, and you disclaim any 174 | intention to limit operation or modification of the work as a means of enforcing, 175 | against the work's users, your or third parties' legal rights to forbid circumvention 176 | of technological measures. 177 | 178 | ### 4. Conveying Verbatim Copies 179 | 180 | You may convey verbatim copies of the Program's source code as you receive it, in any 181 | medium, provided that you conspicuously and appropriately publish on each copy an 182 | appropriate copyright notice; keep intact all notices stating that this License and 183 | any non-permissive terms added in accord with section 7 apply to the code; keep 184 | intact all notices of the absence of any warranty; and give all recipients a copy of 185 | this License along with the Program. 186 | 187 | You may charge any price or no price for each copy that you convey, and you may offer 188 | support or warranty protection for a fee. 189 | 190 | ### 5. Conveying Modified Source Versions 191 | 192 | You may convey a work based on the Program, or the modifications to produce it from 193 | the Program, in the form of source code under the terms of section 4, provided that 194 | you also meet all of these conditions: 195 | 196 | * **a)** The work must carry prominent notices stating that you modified it, and giving a 197 | relevant date. 198 | * **b)** The work must carry prominent notices stating that it is released under this 199 | License and any conditions added under section 7. This requirement modifies the 200 | requirement in section 4 to “keep intact all notices”. 201 | * **c)** You must license the entire work, as a whole, under this License to anyone who 202 | comes into possession of a copy. This License will therefore apply, along with any 203 | applicable section 7 additional terms, to the whole of the work, and all its parts, 204 | regardless of how they are packaged. This License gives no permission to license the 205 | work in any other way, but it does not invalidate such permission if you have 206 | separately received it. 207 | * **d)** If the work has interactive user interfaces, each must display Appropriate Legal 208 | Notices; however, if the Program has interactive interfaces that do not display 209 | Appropriate Legal Notices, your work need not make them do so. 210 | 211 | A compilation of a covered work with other separate and independent works, which are 212 | not by their nature extensions of the covered work, and which are not combined with 213 | it such as to form a larger program, in or on a volume of a storage or distribution 214 | medium, is called an “aggregate” if the compilation and its resulting 215 | copyright are not used to limit the access or legal rights of the compilation's users 216 | beyond what the individual works permit. Inclusion of a covered work in an aggregate 217 | does not cause this License to apply to the other parts of the aggregate. 218 | 219 | ### 6. Conveying Non-Source Forms 220 | 221 | You may convey a covered work in object code form under the terms of sections 4 and 222 | 5, provided that you also convey the machine-readable Corresponding Source under the 223 | terms of this License, in one of these ways: 224 | 225 | * **a)** Convey the object code in, or embodied in, a physical product (including a 226 | physical distribution medium), accompanied by the Corresponding Source fixed on a 227 | durable physical medium customarily used for software interchange. 228 | * **b)** Convey the object code in, or embodied in, a physical product (including a 229 | physical distribution medium), accompanied by a written offer, valid for at least 230 | three years and valid for as long as you offer spare parts or customer support for 231 | that product model, to give anyone who possesses the object code either **(1)** a copy of 232 | the Corresponding Source for all the software in the product that is covered by this 233 | License, on a durable physical medium customarily used for software interchange, for 234 | a price no more than your reasonable cost of physically performing this conveying of 235 | source, or **(2)** access to copy the Corresponding Source from a network server at no 236 | charge. 237 | * **c)** Convey individual copies of the object code with a copy of the written offer to 238 | provide the Corresponding Source. This alternative is allowed only occasionally and 239 | noncommercially, and only if you received the object code with such an offer, in 240 | accord with subsection 6b. 241 | * **d)** Convey the object code by offering access from a designated place (gratis or for 242 | a charge), and offer equivalent access to the Corresponding Source in the same way 243 | through the same place at no further charge. You need not require recipients to copy 244 | the Corresponding Source along with the object code. If the place to copy the object 245 | code is a network server, the Corresponding Source may be on a different server 246 | (operated by you or a third party) that supports equivalent copying facilities, 247 | provided you maintain clear directions next to the object code saying where to find 248 | the Corresponding Source. Regardless of what server hosts the Corresponding Source, 249 | you remain obligated to ensure that it is available for as long as needed to satisfy 250 | these requirements. 251 | * **e)** Convey the object code using peer-to-peer transmission, provided you inform 252 | other peers where the object code and Corresponding Source of the work are being 253 | offered to the general public at no charge under subsection 6d. 254 | 255 | A separable portion of the object code, whose source code is excluded from the 256 | Corresponding Source as a System Library, need not be included in conveying the 257 | object code work. 258 | 259 | A “User Product” is either **(1)** a “consumer product”, which 260 | means any tangible personal property which is normally used for personal, family, or 261 | household purposes, or **(2)** anything designed or sold for incorporation into a 262 | dwelling. In determining whether a product is a consumer product, doubtful cases 263 | shall be resolved in favor of coverage. For a particular product received by a 264 | particular user, “normally used” refers to a typical or common use of 265 | that class of product, regardless of the status of the particular user or of the way 266 | in which the particular user actually uses, or expects or is expected to use, the 267 | product. A product is a consumer product regardless of whether the product has 268 | substantial commercial, industrial or non-consumer uses, unless such uses represent 269 | the only significant mode of use of the product. 270 | 271 | “Installation Information” for a User Product means any methods, 272 | procedures, authorization keys, or other information required to install and execute 273 | modified versions of a covered work in that User Product from a modified version of 274 | its Corresponding Source. The information must suffice to ensure that the continued 275 | functioning of the modified object code is in no case prevented or interfered with 276 | solely because modification has been made. 277 | 278 | If you convey an object code work under this section in, or with, or specifically for 279 | use in, a User Product, and the conveying occurs as part of a transaction in which 280 | the right of possession and use of the User Product is transferred to the recipient 281 | in perpetuity or for a fixed term (regardless of how the transaction is 282 | characterized), the Corresponding Source conveyed under this section must be 283 | accompanied by the Installation Information. But this requirement does not apply if 284 | neither you nor any third party retains the ability to install modified object code 285 | on the User Product (for example, the work has been installed in ROM). 286 | 287 | The requirement to provide Installation Information does not include a requirement to 288 | continue to provide support service, warranty, or updates for a work that has been 289 | modified or installed by the recipient, or for the User Product in which it has been 290 | modified or installed. Access to a network may be denied when the modification itself 291 | materially and adversely affects the operation of the network or violates the rules 292 | and protocols for communication across the network. 293 | 294 | Corresponding Source conveyed, and Installation Information provided, in accord with 295 | this section must be in a format that is publicly documented (and with an 296 | implementation available to the public in source code form), and must require no 297 | special password or key for unpacking, reading or copying. 298 | 299 | ### 7. Additional Terms 300 | 301 | “Additional permissions” are terms that supplement the terms of this 302 | License by making exceptions from one or more of its conditions. Additional 303 | permissions that are applicable to the entire Program shall be treated as though they 304 | were included in this License, to the extent that they are valid under applicable 305 | law. If additional permissions apply only to part of the Program, that part may be 306 | used separately under those permissions, but the entire Program remains governed by 307 | this License without regard to the additional permissions. 308 | 309 | When you convey a copy of a covered work, you may at your option remove any 310 | additional permissions from that copy, or from any part of it. (Additional 311 | permissions may be written to require their own removal in certain cases when you 312 | modify the work.) You may place additional permissions on material, added by you to a 313 | covered work, for which you have or can give appropriate copyright permission. 314 | 315 | Notwithstanding any other provision of this License, for material you add to a 316 | covered work, you may (if authorized by the copyright holders of that material) 317 | supplement the terms of this License with terms: 318 | 319 | * **a)** Disclaiming warranty or limiting liability differently from the terms of 320 | sections 15 and 16 of this License; or 321 | * **b)** Requiring preservation of specified reasonable legal notices or author 322 | attributions in that material or in the Appropriate Legal Notices displayed by works 323 | containing it; or 324 | * **c)** Prohibiting misrepresentation of the origin of that material, or requiring that 325 | modified versions of such material be marked in reasonable ways as different from the 326 | original version; or 327 | * **d)** Limiting the use for publicity purposes of names of licensors or authors of the 328 | material; or 329 | * **e)** Declining to grant rights under trademark law for use of some trade names, 330 | trademarks, or service marks; or 331 | * **f)** Requiring indemnification of licensors and authors of that material by anyone 332 | who conveys the material (or modified versions of it) with contractual assumptions of 333 | liability to the recipient, for any liability that these contractual assumptions 334 | directly impose on those licensors and authors. 335 | 336 | All other non-permissive additional terms are considered “further 337 | restrictions” within the meaning of section 10. If the Program as you received 338 | it, or any part of it, contains a notice stating that it is governed by this License 339 | along with a term that is a further restriction, you may remove that term. If a 340 | license document contains a further restriction but permits relicensing or conveying 341 | under this License, you may add to a covered work material governed by the terms of 342 | that license document, provided that the further restriction does not survive such 343 | relicensing or conveying. 344 | 345 | If you add terms to a covered work in accord with this section, you must place, in 346 | the relevant source files, a statement of the additional terms that apply to those 347 | files, or a notice indicating where to find the applicable terms. 348 | 349 | Additional terms, permissive or non-permissive, may be stated in the form of a 350 | separately written license, or stated as exceptions; the above requirements apply 351 | either way. 352 | 353 | ### 8. Termination 354 | 355 | You may not propagate or modify a covered work except as expressly provided under 356 | this License. Any attempt otherwise to propagate or modify it is void, and will 357 | automatically terminate your rights under this License (including any patent licenses 358 | granted under the third paragraph of section 11). 359 | 360 | However, if you cease all violation of this License, then your license from a 361 | particular copyright holder is reinstated **(a)** provisionally, unless and until the 362 | copyright holder explicitly and finally terminates your license, and **(b)** permanently, 363 | if the copyright holder fails to notify you of the violation by some reasonable means 364 | prior to 60 days after the cessation. 365 | 366 | Moreover, your license from a particular copyright holder is reinstated permanently 367 | if the copyright holder notifies you of the violation by some reasonable means, this 368 | is the first time you have received notice of violation of this License (for any 369 | work) from that copyright holder, and you cure the violation prior to 30 days after 370 | your receipt of the notice. 371 | 372 | Termination of your rights under this section does not terminate the licenses of 373 | parties who have received copies or rights from you under this License. If your 374 | rights have been terminated and not permanently reinstated, you do not qualify to 375 | receive new licenses for the same material under section 10. 376 | 377 | ### 9. Acceptance Not Required for Having Copies 378 | 379 | You are not required to accept this License in order to receive or run a copy of the 380 | Program. Ancillary propagation of a covered work occurring solely as a consequence of 381 | using peer-to-peer transmission to receive a copy likewise does not require 382 | acceptance. However, nothing other than this License grants you permission to 383 | propagate or modify any covered work. These actions infringe copyright if you do not 384 | accept this License. Therefore, by modifying or propagating a covered work, you 385 | indicate your acceptance of this License to do so. 386 | 387 | ### 10. Automatic Licensing of Downstream Recipients 388 | 389 | Each time you convey a covered work, the recipient automatically receives a license 390 | from the original licensors, to run, modify and propagate that work, subject to this 391 | License. You are not responsible for enforcing compliance by third parties with this 392 | License. 393 | 394 | An “entity transaction” is a transaction transferring control of an 395 | organization, or substantially all assets of one, or subdividing an organization, or 396 | merging organizations. If propagation of a covered work results from an entity 397 | transaction, each party to that transaction who receives a copy of the work also 398 | receives whatever licenses to the work the party's predecessor in interest had or 399 | could give under the previous paragraph, plus a right to possession of the 400 | Corresponding Source of the work from the predecessor in interest, if the predecessor 401 | has it or can get it with reasonable efforts. 402 | 403 | You may not impose any further restrictions on the exercise of the rights granted or 404 | affirmed under this License. For example, you may not impose a license fee, royalty, 405 | or other charge for exercise of rights granted under this License, and you may not 406 | initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging 407 | that any patent claim is infringed by making, using, selling, offering for sale, or 408 | importing the Program or any portion of it. 409 | 410 | ### 11. Patents 411 | 412 | A “contributor” is a copyright holder who authorizes use under this 413 | License of the Program or a work on which the Program is based. The work thus 414 | licensed is called the contributor's “contributor version”. 415 | 416 | A contributor's “essential patent claims” are all patent claims owned or 417 | controlled by the contributor, whether already acquired or hereafter acquired, that 418 | would be infringed by some manner, permitted by this License, of making, using, or 419 | selling its contributor version, but do not include claims that would be infringed 420 | only as a consequence of further modification of the contributor version. For 421 | purposes of this definition, “control” includes the right to grant patent 422 | sublicenses in a manner consistent with the requirements of this License. 423 | 424 | Each contributor grants you a non-exclusive, worldwide, royalty-free patent license 425 | under the contributor's essential patent claims, to make, use, sell, offer for sale, 426 | import and otherwise run, modify and propagate the contents of its contributor 427 | version. 428 | 429 | In the following three paragraphs, a “patent license” is any express 430 | agreement or commitment, however denominated, not to enforce a patent (such as an 431 | express permission to practice a patent or covenant not to sue for patent 432 | infringement). To “grant” such a patent license to a party means to make 433 | such an agreement or commitment not to enforce a patent against the party. 434 | 435 | If you convey a covered work, knowingly relying on a patent license, and the 436 | Corresponding Source of the work is not available for anyone to copy, free of charge 437 | and under the terms of this License, through a publicly available network server or 438 | other readily accessible means, then you must either **(1)** cause the Corresponding 439 | Source to be so available, or **(2)** arrange to deprive yourself of the benefit of the 440 | patent license for this particular work, or **(3)** arrange, in a manner consistent with 441 | the requirements of this License, to extend the patent license to downstream 442 | recipients. “Knowingly relying” means you have actual knowledge that, but 443 | for the patent license, your conveying the covered work in a country, or your 444 | recipient's use of the covered work in a country, would infringe one or more 445 | identifiable patents in that country that you have reason to believe are valid. 446 | 447 | If, pursuant to or in connection with a single transaction or arrangement, you 448 | convey, or propagate by procuring conveyance of, a covered work, and grant a patent 449 | license to some of the parties receiving the covered work authorizing them to use, 450 | propagate, modify or convey a specific copy of the covered work, then the patent 451 | license you grant is automatically extended to all recipients of the covered work and 452 | works based on it. 453 | 454 | A patent license is “discriminatory” if it does not include within the 455 | scope of its coverage, prohibits the exercise of, or is conditioned on the 456 | non-exercise of one or more of the rights that are specifically granted under this 457 | License. You may not convey a covered work if you are a party to an arrangement with 458 | a third party that is in the business of distributing software, under which you make 459 | payment to the third party based on the extent of your activity of conveying the 460 | work, and under which the third party grants, to any of the parties who would receive 461 | the covered work from you, a discriminatory patent license **(a)** in connection with 462 | copies of the covered work conveyed by you (or copies made from those copies), or **(b)** 463 | primarily for and in connection with specific products or compilations that contain 464 | the covered work, unless you entered into that arrangement, or that patent license 465 | was granted, prior to 28 March 2007. 466 | 467 | Nothing in this License shall be construed as excluding or limiting any implied 468 | license or other defenses to infringement that may otherwise be available to you 469 | under applicable patent law. 470 | 471 | ### 12. No Surrender of Others' Freedom 472 | 473 | If conditions are imposed on you (whether by court order, agreement or otherwise) 474 | that contradict the conditions of this License, they do not excuse you from the 475 | conditions of this License. If you cannot convey a covered work so as to satisfy 476 | simultaneously your obligations under this License and any other pertinent 477 | obligations, then as a consequence you may not convey it at all. For example, if you 478 | agree to terms that obligate you to collect a royalty for further conveying from 479 | those to whom you convey the Program, the only way you could satisfy both those terms 480 | and this License would be to refrain entirely from conveying the Program. 481 | 482 | ### 13. Use with the GNU Affero General Public License 483 | 484 | Notwithstanding any other provision of this License, you have permission to link or 485 | combine any covered work with a work licensed under version 3 of the GNU Affero 486 | General Public License into a single combined work, and to convey the resulting work. 487 | The terms of this License will continue to apply to the part which is the covered 488 | work, but the special requirements of the GNU Affero General Public License, section 489 | 13, concerning interaction through a network will apply to the combination as such. 490 | 491 | ### 14. Revised Versions of this License 492 | 493 | The Free Software Foundation may publish revised and/or new versions of the GNU 494 | General Public License from time to time. Such new versions will be similar in spirit 495 | to the present version, but may differ in detail to address new problems or concerns. 496 | 497 | Each version is given a distinguishing version number. If the Program specifies that 498 | a certain numbered version of the GNU General Public License “or any later 499 | version” applies to it, you have the option of following the terms and 500 | conditions either of that numbered version or of any later version published by the 501 | Free Software Foundation. If the Program does not specify a version number of the GNU 502 | General Public License, you may choose any version ever published by the Free 503 | Software Foundation. 504 | 505 | If the Program specifies that a proxy can decide which future versions of the GNU 506 | General Public License can be used, that proxy's public statement of acceptance of a 507 | version permanently authorizes you to choose that version for the Program. 508 | 509 | Later license versions may give you additional or different permissions. However, no 510 | additional obligations are imposed on any author or copyright holder as a result of 511 | your choosing to follow a later version. 512 | 513 | ### 15. Disclaimer of Warranty 514 | 515 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. 516 | EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES 517 | PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER 518 | EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 519 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE 520 | QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE 521 | DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 522 | 523 | ### 16. Limitation of Liability 524 | 525 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY 526 | COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS 527 | PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, 528 | INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE 529 | PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE 530 | OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE 531 | WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE 532 | POSSIBILITY OF SUCH DAMAGES. 533 | 534 | ### 17. Interpretation of Sections 15 and 16 535 | 536 | If the disclaimer of warranty and limitation of liability provided above cannot be 537 | given local legal effect according to their terms, reviewing courts shall apply local 538 | law that most closely approximates an absolute waiver of all civil liability in 539 | connection with the Program, unless a warranty or assumption of liability accompanies 540 | a copy of the Program in return for a fee. 541 | 542 | _END OF TERMS AND CONDITIONS_ 543 | 544 | ## How to Apply These Terms to Your New Programs 545 | 546 | If you develop a new program, and you want it to be of the greatest possible use to 547 | the public, the best way to achieve this is to make it free software which everyone 548 | can redistribute and change under these terms. 549 | 550 | To do so, attach the following notices to the program. It is safest to attach them 551 | to the start of each source file to most effectively state the exclusion of warranty; 552 | and each file should have at least the “copyright” line and a pointer to 553 | where the full notice is found. 554 | 555 | 556 | Copyright (C) 557 | 558 | This program is free software: you can redistribute it and/or modify 559 | it under the terms of the GNU General Public License as published by 560 | the Free Software Foundation, either version 3 of the License, or 561 | (at your option) any later version. 562 | 563 | This program is distributed in the hope that it will be useful, 564 | but WITHOUT ANY WARRANTY; without even the implied warranty of 565 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 566 | GNU General Public License for more details. 567 | 568 | You should have received a copy of the GNU General Public License 569 | along with this program. If not, see . 570 | 571 | Also add information on how to contact you by electronic and paper mail. 572 | 573 | If the program does terminal interaction, make it output a short notice like this 574 | when it starts in an interactive mode: 575 | 576 | Copyright (C) 577 | This program comes with ABSOLUTELY NO WARRANTY; for details type 'show w'. 578 | This is free software, and you are welcome to redistribute it 579 | under certain conditions; type 'show c' for details. 580 | 581 | The hypothetical commands `show w` and `show c` should show the appropriate parts of 582 | the General Public License. Of course, your program's commands might be different; 583 | for a GUI interface, you would use an “about box”. 584 | 585 | You should also get your employer (if you work as a programmer) or school, if any, to 586 | sign a “copyright disclaimer” for the program, if necessary. For more 587 | information on this, and how to apply and follow the GNU GPL, see 588 | <>. 589 | 590 | The GNU General Public License does not permit incorporating your program into 591 | proprietary programs. If your program is a subroutine library, you may consider it 592 | more useful to permit linking proprietary applications with the library. If this is 593 | what you want to do, use the GNU Lesser General Public License instead of this 594 | License. But first, please read 595 | <>. 596 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # TAK SERVER 2 | 3 | ![TAK logo](img/tak.jpg) 4 | 5 | This is a Docker wrapper for an official 'OG' TAK server from [TAK Product Center](https://tak.gov/) intended for beginners. It will give you a turnkey TAK server with SSL which works with ATAK, iTAK, WinTAK. 6 | 7 | 8 | ## IMPORTANT: Download the Official TAK Release 9 | 10 | Before you can build this, you must download a **TAKSERVER-DOCKER-X.X-RELEASE**. 11 | 12 | Releases are now public at [https://tak.gov/products/tak-server](https://tak.gov/products/tak-server) 13 | 14 | Please follow account registration process, and once completed go to the link above. 15 | 16 | The integrity of the release will be checked at setup against the MD5/SHA1 checksums in this repo. **THESE MUST MATCH**. If they do not match, **DO NOT** proceed unless you trust the release. 17 | 18 | Old releases are a security risk as they contain known vulnerabilities. For more information, read the big red notices on tak.gov 19 | 20 | ![TAK release download](img/tak-server-download.jpg) 21 | 22 | ## TAK Server Release Checksums 23 | 24 | | Release Filename | Bytes | MD5 Checksum | SHA1 Checksum | 25 | | ------------------------------------- | ----------- | ---------------------------------- | ------------------------------------------ | 26 | | `takserver-docker-5.1-RELEASE-50.zip`| `615MB` | `c6d1485ae3f81bd30c35be836a001cd0` | `99467f0be91e682714e72c34196c6d8bf40c92d3` | 27 | | `takserver-docker-5.2-RELEASE-30.zip`| `517MB` | `b691d1d7377790690e1e5ec0e4a29a56` | `98f13f9140470ee65351e3d25dec097603bfb582` | 28 | | `takserver-docker-5.2-RELEASE-43.zip`| `517MB` | `0a7398383253707dd7564afc88f29b3b` | `824d7b89fbe6377cb5570f50bb35e6e05c12b230` | 29 | | `takserver-docker-5.3-RELEASE-24.zip`| `527MB` | `e8a5dc855c4eb67d170bf689017516e8` | `1eaad8c4471392a96c60f56bc2d54f9f3b6d719e` | 30 | 31 | ## Requirements 32 | 33 | - Debian-based operating system, such as Debian or Ubuntu 34 | - Docker with `compose` (https://docs.docker.com/engine/install/ubuntu/ or https://docs.docker.com/engine/install/debian/) 35 | - A TAK server release 36 | - 4GB memory 37 | - Network connection 38 | - `unzip` and `netstat` utilities 39 | 40 | ## Setup Video 41 | 42 | Please use the below link to see a short video on a complete setup of TAK Server. 43 | 44 | [TAK Server install (Docker)](https://www.youtube.com/watch?v=h4PA9NN-cDk) 45 | 46 | ## Prerequisites 47 | 48 | Fetch the dependencies, then clone the git repository and `cd` into the directory 49 | 50 | ```bash 51 | sudo apt update 52 | sudo apt install net-tools unzip zip 53 | git clone https://github.com/Cloud-RF/tak-server.git 54 | cd tak-server 55 | ``` 56 | 57 | ### Setup Docker's apt repository 58 | 59 | First, set up Docker's apt repository. These steps are already completed on the WarDragon. Open a terminal and run the following commands: 60 | 61 | ```bash 62 | # Add Docker's official GPG key: 63 | sudo apt-get update 64 | sudo apt-get install ca-certificates curl gnupg 65 | sudo install -m 0755 -d /etc/apt/keyrings 66 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg 67 | sudo chmod a+r /etc/apt/keyrings/docker.gpg 68 | 69 | # Add the repository to Apt sources: 70 | echo \ 71 | "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ 72 | "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \ 73 | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null 74 | sudo apt-get update 75 | 76 | # Install the Docker packages. 77 | # To install the latest version, run: 78 | sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin 79 | ``` 80 | 81 | ### Docker Security 82 | 83 | **IT IS NOT RECOMMENDED TO RUN PRIVILEGED CONTAINERS ON THE DOCKER HOST.** 84 | 85 | These scripts assume you don't need to `sudo` for `docker` and `docker-compose`. As such it is assumed that your user account is a member of the `docker` group as is indicated during the correct installation of Docker. This will allow you to run `docker` commands without `sudo`. 86 | 87 | For more information please consult [the official installation documentation provided by Docker](https://docs.docker.com/engine/install/linux-postinstall/). 88 | 89 | To test if you are able to run `docker` commands without `sudo` you can test with the following command: 90 | 91 | ```bash 92 | docker run hello-world 93 | ``` 94 | 95 | ### AMD64 & ARM64 (Pi4) setup 96 | 97 | The script will auto-detect your architecture and use the ARM Docker file if the architecture is determined to be `arm64`. 98 | 99 | ## Installation 100 | 101 | You should copy your downloaded **TAKSERVER-DOCKER-X.X-RELEASE** ZIP file to the `tak-server` directory. 102 | 103 | Assuming that your current working directory is the `tak-server` as cloned previously, you can then proceed to run the [setup.sh script](./scripts/setup.sh). 104 | 105 | ```bash 106 | chmod +x scripts/setup.sh 107 | ./scripts/setup.sh 108 | ``` 109 | 110 | The `setup.sh` script will populate configuration files, start up TAK server with a PostgreSQL database via Docker compose and generate the required certificates. There will be prompts and some input required from the user such as certificate names. At the end of the setup the user will be given random passwords and a link to access the web interface where further settings can be applied. 111 | 112 | For more information on using TAK server refer to [the documentation on the TAK Product Center GitHub](https://github.com/TAK-Product-Center/Server/tree/main/src/docs). 113 | 114 | ### Network Ports 115 | 116 | TAK server needs the following port numbers to operate. Services already using these will cause a problem which the script will detect and offer a resolution for. 117 | 118 | - `5432` 119 | - `8089` 120 | - `8443` 121 | - `8444` 122 | - `8446` 123 | - `9000` 124 | - `9001` 125 | 126 | If you are going to expose these ports be careful. Not all of them run secure protocols. For peace of mind, and for working through firewalls and NAT routers run this on a VPN like OpenVPN or NordVPN. 127 | 128 | ### Successful Installation 129 | 130 | If your TAK Server was able to successfully be installed then you should see in your console a similar message: 131 | 132 | ```console 133 | Import the admin.p12 certificate from this folder to your browser as per the README.md file 134 | Login at https://10.0.0.6:8443 with your admin account. No need to run the /setup step as this has been done. 135 | Certificates and *CERT DATA PACKAGES* are in tak/certs/files 136 | 137 | Setup script sponsored by CloudRF.com - "The API for RF" 138 | 139 | ---------PASSWORDS---------------- 140 | 141 | Admin user name: admin 142 | Admin password: 143 | Postgresql password: 144 | 145 | ---------PASSWORDS---------------- 146 | 147 | MAKE A NOTE OF YOUR PASSWORDS. THEY WON'T BE SHOWN AGAIN. 148 | Docker containers should automatically start with the docker service from now on. 149 | ``` 150 | 151 | ## Admin Login 152 | 153 | The login to the web interface requires the certificate created during setup. The certificate needs to be uploaded to the browser first. The name of this certificate is the one which you have typed after specifying the State, City, and Company during the certificate creation. 154 | 155 | Default certificate name is `admin.p12`. The certificates names can be checked by: 156 | 157 | ```bash 158 | docker exec -it tak-server-tak-1 ls -hal /opt/tak/certs/files 159 | ``` 160 | 161 | ### Installing Your Admin Certificate 162 | 163 | The `admin.p12` certificate needs to be copied from `./tak/certs/files/` and installed in a web browser for you to be able to administer your TAK Server. This not only provides TLS transport security with mutual authentication (Client > Server, Server > Client) but it proves your identity and saves you having to type a tedious password each time. 164 | 165 | 166 | #### Google Chrome 167 | 168 | * Go to **"Settings"** --> **"Privacy and Security"** --> **"Security"** --> **"Manage Certificates"** 169 | * Navigate to **"Your certificates"** 170 | * Press **"Import"** button and choose your `.p12` file (Default password is `atakatak`) 171 | 172 | The web UI should be now accessible via the address given below. 173 | 174 | #### Mozilla Firefox 175 | 176 | * Go to **"Settings"** --> **"Privacy & Security"** --> scroll down to **"Certificates"** section. 177 | * Click the button **"View Certificates"** 178 | * Choose **"Your Certificates"** section and **"Import"** your `.p12` certificate (Default password is `atakatak`) 179 | * Choose the **"Authorities"** section 180 | * Locate **"TAK"** line, there should be your certificate name displayed underneath it 181 | * Click your certificate name and press button **"Edit Trust"** 182 | * __*TICK*__ the box with **"This certificate can identify web sites"** statement, then click **"OK"** 183 | 184 | The web UI should be now accessible via the address given below. 185 | 186 | ## Web UI Access 187 | 188 | The web user interface can be only accessed via **SSL** on port **8443**. 189 | 190 | The login prompt will not show up as the server authenticates the user based on the uploaded certificate. 191 | 192 | The user interface is available at the below address and on all other NICs. Check your firewall as you may not want this exposed on a public NIC. 193 | 194 | `https://localhost:8443` 195 | 196 | ### Re-Starting Server After Shutdown 197 | 198 | Make sure you are in the main `tak-server` directory and append the `-d` flag to run the process in the background. 199 | 200 | ```bash 201 | cd tak-server 202 | docker compose up -d 203 | ``` 204 | 205 | ### Shutting Down Running TAK Server 206 | 207 | Make sure you are in the main `tak-server` directory. 208 | 209 | ```bash 210 | cd tak-server 211 | docker compose down 212 | ``` 213 | 214 | ### Logging 215 | 216 | You can access a shell in the running Docker container with this command: 217 | 218 | ```bash 219 | docker exec -it tak-server-tak-1 tail -f /opt/tak/logs/takserver.log 220 | ``` 221 | 222 | To tail the server log from **OUTSITE** the container as the `tak` folder is mapped: 223 | 224 | tail -f ./tak/logs/takserver.log 225 | 226 | ### Clean Up 227 | 228 | ```bash 229 | sudo ./scripts/cleanup.sh 230 | ``` 231 | 232 | This script will stop the TAK Server container, remove the mapped database volume and remove the folder `tak` which is created in the project root directory (cloned from GitHub) during the setup process. 233 | 234 | **WARNING** - If you have data in an existing TAK database container it will be lost. 235 | 236 | ## Adding Your First EUD / ATAK Device 237 | 238 | If you've never setup ATAK with a server before you need server and user certificates. You can load these manually as `.p12` files or the easier way is with a `.zip` data package and a manifest. 239 | 240 | You can find ready made data packages in the `tak/certs/files` directory. You need to copy these to your device's SD card then import the `.zip` into ATAK / iTAK with the "Import" function and choose "Local SD". 241 | 242 | This will add a server, certificates and a user account. You will still need to create this user with the matching name for example, `user1`, in your TAK server user management dashboard and assign them to a common group. 243 | 244 | ## Federated TAK server 245 | 246 | If you would like to federate TAK servers you will need to exchange ca.pem files between servers. On this docker setup, I find that I have to manually import the ca.pem from the command line as the webui seems unable to add 247 | the it to the fed truststore. Typically the fed-truststore is located in the project directory at tak-server/tak/certs/files. You'll likely find the ca.pem in that location as well, location may vary depending on install method. 248 | 249 | ```bash 250 | keytool -importcert -file ca.pem -keystore fed-truststore.jks -alias "tak" 251 | ``` 252 | 253 | ### Transferring Your ZIP files Via HTTP 254 | 255 | If you like to live dangerously, you can run a script to serve the `.zip` files on TCP port `12345`, for example, http://0.0.0.0:12345. This launches a mini Python web server and serves the content of the `share` folder which will contain your certificates. Note that sharing certificates via insecure protocols is not secure. 256 | 257 | ```console 258 | ./scripts/shareCerts.sh 259 | Serving HTTP on 0.0.0.0 port 12345 (http://0.0.0.0:12345/) ... 260 | 10.0.0.5 - - [23/Nov/2022 15:49:52] "GET / HTTP/1.1" 200 - 261 | 10.0.0.5 - - [23/Nov/2022 15:49:54] "GET /user1-10.0.0.3.dp.zip HTTP/1.1" 200 262 | ``` 263 | 264 | Stop the script with `Ctrl-C` once done to stop randoms fetching your certificates. 265 | 266 | # FAQ 267 | 268 | See [Frequently Asked Questions](FAQ.md). 269 | 270 | ## Contributing 271 | 272 | Please feel free to open merge requests. A beginner's guide to GitHub.com is here: 273 | 274 | https://www.freecodecamp.org/news/how-to-make-your-first-pull-request-on-github-3/ 275 | 276 | ## Authors and Acknowledgment 277 | 278 | Thanks to the TAK product center for open-sourcing and maintaining all things TAK. 279 | 280 | Thanks to James Wu 'wubar' on GitLab/Discord for publishing the Docker wrapper on which this was built. 281 | 282 | Thanks to protectionist dinosaurs, on both sides of the pond, who are threatened by TAK's open source model for the motivation :p 283 | 284 | ## Useful Links 285 | 286 | - [TAK server on TAK.gov](https://tak.gov/products/tak-server) 287 | - [ATAK-CIV on Google Play](https://play.google.com/store/apps/details?id=com.atakmap.app.civ&hl=en_GB&gl=US) 288 | - [iTak on Apple App store](https://apps.apple.com/my/app/itak/id1561656396) 289 | - [WinTAK-CIV on TAK.gov](https://tak.gov/products/wintak-civ) 290 | -------------------------------------------------------------------------------- /docker-compose.arm.yml: -------------------------------------------------------------------------------- 1 | services: 2 | db: 3 | build: 4 | context: . 5 | dockerfile: ./docker/arm64/Dockerfile.takserver-db 6 | volumes: 7 | - "db_data:/var/lib/postgresql/data:z" 8 | - "./tak:/opt/tak:z" 9 | networks: 10 | tak: 11 | aliases: 12 | - tak-database 13 | restart: unless-stopped 14 | tak: 15 | build: 16 | context: . 17 | dockerfile: ./docker/arm64/Dockerfile.takserver 18 | env_file: 19 | - .env 20 | volumes: 21 | - "./tak:/opt/tak:z" 22 | ports: 23 | - "8443:8443" 24 | - "8444:8444" 25 | - "8446:8446" 26 | - "8089:8089" 27 | - "9000:9000" 28 | - "9001:9001" 29 | networks: 30 | tak: 31 | depends_on: 32 | - db 33 | restart: unless-stopped 34 | volumes: 35 | db_data: 36 | networks: 37 | tak: 38 | -------------------------------------------------------------------------------- /docker-compose.yml: -------------------------------------------------------------------------------- 1 | services: 2 | db: 3 | build: 4 | context: . 5 | dockerfile: ./docker/amd64/Dockerfile.takserver-db 6 | volumes: 7 | - "db_data:/var/lib/postgresql/data:z" 8 | - "./tak:/opt/tak:z" 9 | networks: 10 | tak: 11 | aliases: 12 | - tak-database 13 | restart: unless-stopped 14 | tak: 15 | build: 16 | context: . 17 | dockerfile: ./docker/amd64/Dockerfile.takserver 18 | env_file: 19 | - .env 20 | volumes: 21 | - "./tak:/opt/tak:z" 22 | ports: 23 | - "8443:8443" 24 | - "8444:8444" 25 | - "8446:8446" 26 | - "8089:8089" 27 | - "9000:9000" 28 | - "9001:9001" 29 | networks: 30 | tak: 31 | depends_on: 32 | - db 33 | restart: unless-stopped 34 | volumes: 35 | db_data: 36 | networks: 37 | tak: 38 | -------------------------------------------------------------------------------- /docker/amd64/Dockerfile.takserver: -------------------------------------------------------------------------------- 1 | FROM eclipse-temurin:17 2 | RUN apt update && apt-get install -y emacs-nox net-tools 3 | ENTRYPOINT ["/bin/bash", "-c", "/opt/tak/configureInDocker.sh init &>> /opt/tak/logs/takserver.log"] 4 | -------------------------------------------------------------------------------- /docker/amd64/Dockerfile.takserver-db: -------------------------------------------------------------------------------- 1 | FROM postgres:15.11 2 | RUN apt-get update && apt install -y postgresql-15-postgis-3 openjdk-17-jdk 3 | ENTRYPOINT ["/bin/bash", "-c", "/opt/tak/db-utils/configureInDocker.sh"] 4 | -------------------------------------------------------------------------------- /docker/arm64/Dockerfile.takserver: -------------------------------------------------------------------------------- 1 | FROM eclipse-temurin:17 2 | RUN apt update && apt-get install -y emacs-nox net-tools 3 | ENTRYPOINT ["/bin/bash", "-c", "/opt/tak/configureInDocker.sh init &>> /opt/tak/logs/takserver.log"] 4 | -------------------------------------------------------------------------------- /docker/arm64/Dockerfile.takserver-db: -------------------------------------------------------------------------------- 1 | FROM postgres:15.11 2 | RUN apt-get update && apt install -y postgresql-15-postgis-3 openjdk-17-jdk 3 | ENTRYPOINT ["/bin/bash", "-c", "/opt/tak/db-utils/configureInDocker.sh"] 4 | -------------------------------------------------------------------------------- /img/allyourtak.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/allyourtak.png -------------------------------------------------------------------------------- /img/banana.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/banana.png -------------------------------------------------------------------------------- /img/tak-server-download.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/tak-server-download.jpg -------------------------------------------------------------------------------- /img/tak.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/tak.jpg -------------------------------------------------------------------------------- /img/tak.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/tak.png -------------------------------------------------------------------------------- /img/takserverpasswords.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/takserverpasswords.jpg -------------------------------------------------------------------------------- /img/warning.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alphafox02/tak-server/9bc008942ea59aac1d91fe82881b8eff3d3adc45/img/warning.jpg -------------------------------------------------------------------------------- /postgresql1.conf: -------------------------------------------------------------------------------- 1 | # ----------------------------- 2 | # PostgreSQL configuration file 3 | # ----------------------------- 4 | # 5 | # This file consists of lines of the form: 6 | # 7 | # name = value 8 | # 9 | # (The "=" is optional.) Whitespace may be used. Comments are introduced with 10 | # "#" anywhere on a line. The complete list of parameter names and allowed 11 | # values can be found in the PostgreSQL documentation. 12 | # 13 | # The commented-out settings shown in this file represent the default values. 14 | # Re-commenting a setting is NOT sufficient to revert it to the default value; 15 | # you need to reload the server. 16 | # 17 | # This file is read on server startup and when the server receives a SIGHUP 18 | # signal. If you edit the file on a running system, you have to SIGHUP the 19 | # server for the changes to take effect, run "pg_ctl reload", or execute 20 | # "SELECT pg_reload_conf()". Some parameters, which are marked below, 21 | # require a server shutdown and restart to take effect. 22 | # 23 | # Any parameter can also be given as a command-line option to the server, e.g., 24 | # "postgres -c log_connections=on". Some parameters can be changed at run time 25 | # with the "SET" SQL command. 26 | # 27 | # Memory units: kB = kilobytes Time units: ms = milliseconds 28 | # MB = megabytes s = seconds 29 | # GB = gigabytes min = minutes 30 | # TB = terabytes h = hours 31 | # d = days 32 | 33 | 34 | #------------------------------------------------------------------------------ 35 | # FILE LOCATIONS 36 | #------------------------------------------------------------------------------ 37 | 38 | # The default values of these variables are driven from the -D command-line 39 | # option or PGDATA environment variable, represented here as ConfigDir. 40 | 41 | #data_directory = 'ConfigDir' # use data in another directory 42 | # (change requires restart) 43 | #hba_file = 'ConfigDir/pg_hba.conf' # host-based authentication file 44 | # (change requires restart) 45 | #ident_file = 'ConfigDir/pg_ident.conf' # ident configuration file 46 | # (change requires restart) 47 | 48 | # If external_pid_file is not explicitly set, no extra PID file is written. 49 | #external_pid_file = '' # write an extra PID file 50 | # (change requires restart) 51 | 52 | 53 | #------------------------------------------------------------------------------ 54 | # CONNECTIONS AND AUTHENTICATION 55 | #------------------------------------------------------------------------------ 56 | 57 | # - Connection Settings - 58 | 59 | listen_addresses = '*' # what IP address(es) to listen on; 60 | # comma-separated list of addresses; 61 | # defaults to 'localhost'; use '*' for all 62 | # (change requires restart) 63 | #port = 5432 # (change requires restart) 64 | max_connections = 500 # (change requires restart) 65 | #superuser_reserved_connections = 3 # (change requires restart) 66 | #unix_socket_directories = '/var/run/postgresql, /tmp' # comma-separated list of directories 67 | # (change requires restart) 68 | #unix_socket_group = '' # (change requires restart) 69 | #unix_socket_permissions = 0777 # begin with 0 to use octal notation 70 | # (change requires restart) 71 | #bonjour = off # advertise server via Bonjour 72 | # (change requires restart) 73 | #bonjour_name = '' # defaults to the computer name 74 | # (change requires restart) 75 | 76 | # - Security and Authentication - 77 | 78 | #authentication_timeout = 1min # 1s-600s 79 | #ssl = off 80 | #ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers 81 | #ssl_prefer_server_ciphers = on 82 | #ssl_ecdh_curve = 'prime256v1' 83 | #ssl_dh_params_file = '' 84 | #ssl_cert_file = 'server.crt' 85 | #ssl_key_file = 'server.key' 86 | #ssl_ca_file = '' 87 | #ssl_crl_file = '' 88 | #password_encryption = md5 # md5 or scram-sha-256 89 | #db_user_namespace = off 90 | #row_security = on 91 | 92 | # GSSAPI using Kerberos 93 | #krb_server_keyfile = '' 94 | #krb_caseins_users = off 95 | 96 | # - TCP Keepalives - 97 | # see "man 7 tcp" for details 98 | 99 | #tcp_keepalives_idle = 0 # TCP_KEEPIDLE, in seconds; 100 | # 0 selects the system default 101 | #tcp_keepalives_interval = 0 # TCP_KEEPINTVL, in seconds; 102 | # 0 selects the system default 103 | #tcp_keepalives_count = 0 # TCP_KEEPCNT; 104 | # 0 selects the system default 105 | tcpip_socket = true 106 | 107 | #------------------------------------------------------------------------------ 108 | # RESOURCE USAGE (except WAL) 109 | #------------------------------------------------------------------------------ 110 | 111 | # - Memory - 112 | 113 | shared_buffers = 256MB # min 128kB 114 | # (change requires restart) 115 | #huge_pages = try # on, off, or try 116 | # (change requires restart) 117 | #temp_buffers = 8MB # min 800kB 118 | #max_prepared_transactions = 0 # zero disables the feature 119 | # (change requires restart) 120 | # Caution: it is not advisable to set max_prepared_transactions nonzero unless 121 | # you actively intend to use prepared transactions. 122 | #work_mem = 4MB # min 64kB 123 | #maintenance_work_mem = 64MB # min 1MB 124 | #replacement_sort_tuples = 150000 # limits use of replacement selection sort 125 | #autovacuum_work_mem = -1 # min 1MB, or -1 to use maintenance_work_mem 126 | #max_stack_depth = 2MB # min 100kB 127 | dynamic_shared_memory_type = posix # the default is the first option 128 | # supported by the operating system: 129 | # posix 130 | # sysv 131 | # windows 132 | # mmap 133 | # use none to disable dynamic shared memory 134 | # (change requires restart) 135 | 136 | # - Disk - 137 | 138 | #temp_file_limit = -1 # limits per-process temp file space 139 | # in kB, or -1 for no limit 140 | 141 | # - Kernel Resource Usage - 142 | 143 | #max_files_per_process = 1000 # min 25 144 | # (change requires restart) 145 | #shared_preload_libraries = '' # (change requires restart) 146 | 147 | # - Cost-Based Vacuum Delay - 148 | 149 | #vacuum_cost_delay = 0 # 0-100 milliseconds 150 | #vacuum_cost_page_hit = 1 # 0-10000 credits 151 | #vacuum_cost_page_miss = 10 # 0-10000 credits 152 | #vacuum_cost_page_dirty = 20 # 0-10000 credits 153 | #vacuum_cost_limit = 200 # 1-10000 credits 154 | 155 | # - Background Writer - 156 | 157 | #bgwriter_delay = 200ms # 10-10000ms between rounds 158 | #bgwriter_lru_maxpages = 100 # 0-1000 max buffers written/round 159 | #bgwriter_lru_multiplier = 2.0 # 0-10.0 multiplier on buffers scanned/round 160 | #bgwriter_flush_after = 512kB # measured in pages, 0 disables 161 | 162 | # - Asynchronous Behavior - 163 | 164 | #effective_io_concurrency = 1 # 1-1000; 0 disables prefetching 165 | #max_worker_processes = 8 # (change requires restart) 166 | #max_parallel_workers_per_gather = 2 # taken from max_parallel_workers 167 | #max_parallel_workers = 8 # maximum number of max_worker_processes that 168 | # can be used in parallel queries 169 | #old_snapshot_threshold = -1 # 1min-60d; -1 disables; 0 is immediate 170 | # (change requires restart) 171 | #backend_flush_after = 0 # measured in pages, 0 disables 172 | 173 | 174 | #------------------------------------------------------------------------------ 175 | # WRITE AHEAD LOG 176 | #------------------------------------------------------------------------------ 177 | 178 | # - Settings - 179 | 180 | #wal_level = replica # minimal, replica, or logical 181 | # (change requires restart) 182 | #fsync = on # flush data to disk for crash safety 183 | # (turning this off can cause 184 | # unrecoverable data corruption) 185 | #synchronous_commit = on # synchronization level; 186 | # off, local, remote_write, remote_apply, or on 187 | #wal_sync_method = fsync # the default is the first option 188 | # supported by the operating system: 189 | # open_datasync 190 | # fdatasync (default on Linux) 191 | # fsync 192 | # fsync_writethrough 193 | # open_sync 194 | #full_page_writes = on # recover from partial page writes 195 | #wal_compression = off # enable compression of full-page writes 196 | #wal_log_hints = off # also do full page writes of non-critical updates 197 | # (change requires restart) 198 | #wal_buffers = -1 # min 32kB, -1 sets based on shared_buffers 199 | # (change requires restart) 200 | #wal_writer_delay = 200ms # 1-10000 milliseconds 201 | #wal_writer_flush_after = 1MB # measured in pages, 0 disables 202 | 203 | #commit_delay = 0 # range 0-100000, in microseconds 204 | #commit_siblings = 5 # range 1-1000 205 | 206 | # - Checkpoints - 207 | 208 | #checkpoint_timeout = 5min # range 30s-1d 209 | #max_wal_size = 1GB 210 | #min_wal_size = 80MB 211 | #checkpoint_completion_target = 0.5 # checkpoint target duration, 0.0 - 1.0 212 | #checkpoint_flush_after = 256kB # measured in pages, 0 disables 213 | #checkpoint_warning = 30s # 0 disables 214 | 215 | # - Archiving - 216 | 217 | #archive_mode = off # enables archiving; off, on, or always 218 | # (change requires restart) 219 | #archive_command = '' # command to use to archive a logfile segment 220 | # placeholders: %p = path of file to archive 221 | # %f = file name only 222 | # e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f' 223 | #archive_timeout = 0 # force a logfile segment switch after this 224 | # number of seconds; 0 disables 225 | 226 | 227 | #------------------------------------------------------------------------------ 228 | # REPLICATION 229 | #------------------------------------------------------------------------------ 230 | 231 | # - Sending Server(s) - 232 | 233 | # Set these on the master and on any standby that will send replication data. 234 | 235 | #max_wal_senders = 10 # max number of walsender processes 236 | # (change requires restart) 237 | #wal_keep_segments = 0 # in logfile segments, 16MB each; 0 disables 238 | #wal_sender_timeout = 60s # in milliseconds; 0 disables 239 | 240 | #max_replication_slots = 10 # max number of replication slots 241 | # (change requires restart) 242 | #track_commit_timestamp = off # collect timestamp of transaction commit 243 | # (change requires restart) 244 | 245 | # - Master Server - 246 | 247 | # These settings are ignored on a standby server. 248 | 249 | #synchronous_standby_names = '' # standby servers that provide sync rep 250 | # method to choose sync standbys, number of sync standbys, 251 | # and comma-separated list of application_name 252 | # from standby(s); '*' = all 253 | #vacuum_defer_cleanup_age = 0 # number of xacts by which cleanup is delayed 254 | 255 | # - Standby Servers - 256 | 257 | # These settings are ignored on a master server. 258 | 259 | #hot_standby = on # "off" disallows queries during recovery 260 | # (change requires restart) 261 | #max_standby_archive_delay = 30s # max delay before canceling queries 262 | # when reading WAL from archive; 263 | # -1 allows indefinite delay 264 | #max_standby_streaming_delay = 30s # max delay before canceling queries 265 | # when reading streaming WAL; 266 | # -1 allows indefinite delay 267 | #wal_receiver_status_interval = 10s # send replies at least this often 268 | # 0 disables 269 | #hot_standby_feedback = off # send info from standby to prevent 270 | # query conflicts 271 | #wal_receiver_timeout = 60s # time that receiver waits for 272 | # communication from master 273 | # in milliseconds; 0 disables 274 | #wal_retrieve_retry_interval = 5s # time to wait before retrying to 275 | # retrieve WAL after a failed attempt 276 | 277 | # - Subscribers - 278 | 279 | # These settings are ignored on a publisher. 280 | 281 | #max_logical_replication_workers = 4 # taken from max_worker_processes 282 | # (change requires restart) 283 | #max_sync_workers_per_subscription = 2 # taken from max_logical_replication_workers 284 | 285 | 286 | #------------------------------------------------------------------------------ 287 | # QUERY TUNING 288 | #------------------------------------------------------------------------------ 289 | 290 | # - Planner Method Configuration - 291 | 292 | #enable_bitmapscan = on 293 | #enable_hashagg = on 294 | #enable_hashjoin = on 295 | #enable_indexscan = on 296 | #enable_indexonlyscan = on 297 | #enable_material = on 298 | #enable_mergejoin = on 299 | #enable_nestloop = on 300 | #enable_seqscan = on 301 | #enable_sort = on 302 | #enable_tidscan = on 303 | 304 | # - Planner Cost Constants - 305 | 306 | #seq_page_cost = 1.0 # measured on an arbitrary scale 307 | #random_page_cost = 4.0 # same scale as above 308 | #cpu_tuple_cost = 0.01 # same scale as above 309 | #cpu_index_tuple_cost = 0.005 # same scale as above 310 | #cpu_operator_cost = 0.0025 # same scale as above 311 | #parallel_tuple_cost = 0.1 # same scale as above 312 | #parallel_setup_cost = 1000.0 # same scale as above 313 | #min_parallel_table_scan_size = 8MB 314 | #min_parallel_index_scan_size = 512kB 315 | #effective_cache_size = 4GB 316 | 317 | # - Genetic Query Optimizer - 318 | 319 | #geqo = on 320 | #geqo_threshold = 12 321 | #geqo_effort = 5 # range 1-10 322 | #geqo_pool_size = 0 # selects default based on effort 323 | #geqo_generations = 0 # selects default based on effort 324 | #geqo_selection_bias = 2.0 # range 1.5-2.0 325 | #geqo_seed = 0.0 # range 0.0-1.0 326 | 327 | # - Other Planner Options - 328 | 329 | #default_statistics_target = 100 # range 1-10000 330 | #constraint_exclusion = partition # on, off, or partition 331 | #cursor_tuple_fraction = 0.1 # range 0.0-1.0 332 | #from_collapse_limit = 8 333 | #join_collapse_limit = 8 # 1 disables collapsing of explicit 334 | # JOIN clauses 335 | #force_parallel_mode = off 336 | 337 | 338 | #------------------------------------------------------------------------------ 339 | # ERROR REPORTING AND LOGGING 340 | #------------------------------------------------------------------------------ 341 | 342 | # - Where to Log - 343 | 344 | log_destination = 'stderr' # Valid values are combinations of 345 | # stderr, csvlog, syslog, and eventlog, 346 | # depending on platform. csvlog 347 | # requires logging_collector to be on. 348 | 349 | # This is used when logging to stderr: 350 | logging_collector = on # Enable capturing of stderr and csvlog 351 | # into log files. Required to be on for 352 | # csvlogs. 353 | # (change requires restart) 354 | 355 | # These are only used if logging_collector is on: 356 | log_directory = 'log' # directory where log files are written, 357 | # can be absolute or relative to PGDATA 358 | log_filename = 'postgresql-%a.log' # log file name pattern, 359 | # can include strftime() escapes 360 | #log_file_mode = 0600 # creation mode for log files, 361 | # begin with 0 to use octal notation 362 | log_truncate_on_rotation = on # If on, an existing log file with the 363 | # same name as the new log file will be 364 | # truncated rather than appended to. 365 | # But such truncation only occurs on 366 | # time-driven rotation, not on restarts 367 | # or size-driven rotation. Default is 368 | # off, meaning append to existing files 369 | # in all cases. 370 | log_rotation_age = 1d # Automatic rotation of logfiles will 371 | # happen after that time. 0 disables. 372 | log_rotation_size = 0 # Automatic rotation of logfiles will 373 | # happen after that much log output. 374 | # 0 disables. 375 | 376 | # These are relevant when logging to syslog: 377 | #syslog_facility = 'LOCAL0' 378 | #syslog_ident = 'postgres' 379 | #syslog_sequence_numbers = on 380 | #syslog_split_messages = on 381 | 382 | # This is only relevant when logging to eventlog (win32): 383 | # (change requires restart) 384 | #event_source = 'PostgreSQL' 385 | 386 | # - When to Log - 387 | 388 | #log_min_messages = warning # values in order of decreasing detail: 389 | # debug5 390 | # debug4 391 | # debug3 392 | # debug2 393 | # debug1 394 | # info 395 | # notice 396 | # warning 397 | # error 398 | # log 399 | # fatal 400 | # panic 401 | 402 | #log_min_error_statement = error # values in order of decreasing detail: 403 | # debug5 404 | # debug4 405 | # debug3 406 | # debug2 407 | # debug1 408 | # info 409 | # notice 410 | # warning 411 | # error 412 | # log 413 | # fatal 414 | # panic (effectively off) 415 | 416 | #log_min_duration_statement = -1 # -1 is disabled, 0 logs all statements 417 | # and their durations, > 0 logs only 418 | # statements running at least this number 419 | # of milliseconds 420 | 421 | 422 | # - What to Log - 423 | 424 | #debug_print_parse = off 425 | #debug_print_rewritten = off 426 | #debug_print_plan = off 427 | #debug_pretty_print = on 428 | #log_checkpoints = off 429 | #log_connections = off 430 | #log_disconnections = off 431 | #log_duration = off 432 | #log_error_verbosity = default # terse, default, or verbose messages 433 | #log_hostname = off 434 | log_line_prefix = '%m [%p] ' # special values: 435 | # %a = application name 436 | # %u = user name 437 | # %d = database name 438 | # %r = remote host and port 439 | # %h = remote host 440 | # %p = process ID 441 | # %t = timestamp without milliseconds 442 | # %m = timestamp with milliseconds 443 | # %n = timestamp with milliseconds (as a Unix epoch) 444 | # %i = command tag 445 | # %e = SQL state 446 | # %c = session ID 447 | # %l = session line number 448 | # %s = session start timestamp 449 | # %v = virtual transaction ID 450 | # %x = transaction ID (0 if none) 451 | # %q = stop here in non-session 452 | # processes 453 | # %% = '%' 454 | # e.g. '<%u%%%d> ' 455 | #log_lock_waits = off # log lock waits >= deadlock_timeout 456 | #log_statement = 'none' # none, ddl, mod, all 457 | #log_replication_commands = off 458 | #log_temp_files = -1 # log temporary files equal or larger 459 | # than the specified size in kilobytes; 460 | # -1 disables, 0 logs all temp files 461 | log_timezone = 'America/New_York' 462 | 463 | 464 | # - Process Title - 465 | 466 | #cluster_name = '' # added to process titles if nonempty 467 | # (change requires restart) 468 | #update_process_title = on 469 | 470 | 471 | #------------------------------------------------------------------------------ 472 | # RUNTIME STATISTICS 473 | #------------------------------------------------------------------------------ 474 | 475 | # - Query/Index Statistics Collector - 476 | 477 | #track_activities = on 478 | #track_counts = on 479 | #track_io_timing = off 480 | #track_functions = none # none, pl, all 481 | #track_activity_query_size = 1024 # (change requires restart) 482 | #stats_temp_directory = 'pg_stat_tmp' 483 | 484 | 485 | # - Statistics Monitoring - 486 | 487 | #log_parser_stats = off 488 | #log_planner_stats = off 489 | #log_executor_stats = off 490 | #log_statement_stats = off 491 | 492 | 493 | #------------------------------------------------------------------------------ 494 | # AUTOVACUUM PARAMETERS 495 | #------------------------------------------------------------------------------ 496 | 497 | #autovacuum = on # Enable autovacuum subprocess? 'on' 498 | # requires track_counts to also be on. 499 | #log_autovacuum_min_duration = -1 # -1 disables, 0 logs all actions and 500 | # their durations, > 0 logs only 501 | # actions running at least this number 502 | # of milliseconds. 503 | #autovacuum_max_workers = 3 # max number of autovacuum subprocesses 504 | # (change requires restart) 505 | #autovacuum_naptime = 1min # time between autovacuum runs 506 | #autovacuum_vacuum_threshold = 50 # min number of row updates before 507 | # vacuum 508 | #autovacuum_analyze_threshold = 50 # min number of row updates before 509 | # analyze 510 | #autovacuum_vacuum_scale_factor = 0.2 # fraction of table size before vacuum 511 | #autovacuum_analyze_scale_factor = 0.1 # fraction of table size before analyze 512 | #autovacuum_freeze_max_age = 200000000 # maximum XID age before forced vacuum 513 | # (change requires restart) 514 | #autovacuum_multixact_freeze_max_age = 400000000 # maximum multixact age 515 | # before forced vacuum 516 | # (change requires restart) 517 | #autovacuum_vacuum_cost_delay = 20ms # default vacuum cost delay for 518 | # autovacuum, in milliseconds; 519 | # -1 means use vacuum_cost_delay 520 | #autovacuum_vacuum_cost_limit = -1 # default vacuum cost limit for 521 | # autovacuum, -1 means use 522 | # vacuum_cost_limit 523 | 524 | 525 | #------------------------------------------------------------------------------ 526 | # CLIENT CONNECTION DEFAULTS 527 | #------------------------------------------------------------------------------ 528 | 529 | # - Statement Behavior - 530 | 531 | #client_min_messages = notice # values in order of decreasing detail: 532 | # debug5 533 | # debug4 534 | # debug3 535 | # debug2 536 | # debug1 537 | # log 538 | # notice 539 | # warning 540 | # error 541 | #search_path = '"$user", public' # schema names 542 | #default_tablespace = '' # a tablespace name, '' uses the default 543 | #temp_tablespaces = '' # a list of tablespace names, '' uses 544 | # only default tablespace 545 | #check_function_bodies = on 546 | #default_transaction_isolation = 'read committed' 547 | #default_transaction_read_only = off 548 | #default_transaction_deferrable = off 549 | #session_replication_role = 'origin' 550 | #statement_timeout = 0 # in milliseconds, 0 is disabled 551 | #lock_timeout = 0 # in milliseconds, 0 is disabled 552 | #idle_in_transaction_session_timeout = 0 # in milliseconds, 0 is disabled 553 | #vacuum_freeze_min_age = 50000000 554 | #vacuum_freeze_table_age = 150000000 555 | #vacuum_multixact_freeze_min_age = 5000000 556 | #vacuum_multixact_freeze_table_age = 150000000 557 | #bytea_output = 'hex' # hex, escape 558 | #xmlbinary = 'base64' 559 | #xmloption = 'content' 560 | #gin_fuzzy_search_limit = 0 561 | #gin_pending_list_limit = 4MB 562 | 563 | # - Locale and Formatting - 564 | 565 | datestyle = 'iso, mdy' 566 | #intervalstyle = 'postgres' 567 | timezone = 'America/New_York' 568 | #timezone_abbreviations = 'Default' # Select the set of available time zone 569 | # abbreviations. Currently, there are 570 | # Default 571 | # Australia (historical usage) 572 | # India 573 | # You can create your own file in 574 | # share/timezonesets/. 575 | #extra_float_digits = 0 # min -15, max 3 576 | #client_encoding = sql_ascii # actually, defaults to database 577 | # encoding 578 | 579 | # These settings are initialized by initdb, but they can be changed. 580 | lc_messages = 'en_US.UTF-8' # locale for system error message 581 | # strings 582 | lc_monetary = 'en_US.UTF-8' # locale for monetary formatting 583 | lc_numeric = 'en_US.UTF-8' # locale for number formatting 584 | lc_time = 'en_US.UTF-8' # locale for time formatting 585 | 586 | # default configuration for text search 587 | default_text_search_config = 'pg_catalog.english' 588 | 589 | # - Other Defaults - 590 | 591 | #dynamic_library_path = '$libdir' 592 | #local_preload_libraries = '' 593 | #session_preload_libraries = '' 594 | 595 | 596 | #------------------------------------------------------------------------------ 597 | # LOCK MANAGEMENT 598 | #------------------------------------------------------------------------------ 599 | 600 | #deadlock_timeout = 1s 601 | #max_locks_per_transaction = 64 # min 10 602 | # (change requires restart) 603 | #max_pred_locks_per_transaction = 64 # min 10 604 | # (change requires restart) 605 | #max_pred_locks_per_relation = -2 # negative values mean 606 | # (max_pred_locks_per_transaction 607 | # / -max_pred_locks_per_relation) - 1 608 | #max_pred_locks_per_page = 2 # min 0 609 | 610 | 611 | #------------------------------------------------------------------------------ 612 | # VERSION/PLATFORM COMPATIBILITY 613 | #------------------------------------------------------------------------------ 614 | 615 | # - Previous PostgreSQL Versions - 616 | 617 | #array_nulls = on 618 | #backslash_quote = safe_encoding # on, off, or safe_encoding 619 | #default_with_oids = off 620 | #escape_string_warning = on 621 | #lo_compat_privileges = off 622 | #operator_precedence_warning = off 623 | #quote_all_identifiers = off 624 | #standard_conforming_strings = on 625 | #synchronize_seqscans = on 626 | 627 | # - Other Platforms and Clients - 628 | 629 | #transform_null_equals = off 630 | 631 | 632 | #------------------------------------------------------------------------------ 633 | # ERROR HANDLING 634 | #------------------------------------------------------------------------------ 635 | 636 | #exit_on_error = off # terminate session on any error? 637 | #restart_after_crash = on # reinitialize after backend crash? 638 | #data_sync_retry = off # retry or panic on failure to fsync 639 | # data? 640 | # (change requires restart) 641 | 642 | 643 | #------------------------------------------------------------------------------ 644 | # CONFIG FILE INCLUDES 645 | #------------------------------------------------------------------------------ 646 | 647 | # These options allow settings to be loaded from files other than the 648 | # default postgresql.conf. 649 | 650 | #include_dir = '' # include files ending in '.conf' from 651 | # a directory, e.g., 'conf.d' 652 | #include_if_exists = '' # include file only if it exists 653 | #include = '' # include file 654 | 655 | 656 | #------------------------------------------------------------------------------ 657 | # CUSTOMIZED OPTIONS 658 | #------------------------------------------------------------------------------ 659 | 660 | # Add settings for extensions here 661 | -------------------------------------------------------------------------------- /scripts/certDP.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Makes an ATAK / iTAK friendly data package containing CA, user cert, user key 3 | if [ $# -eq 0 ] 4 | then 5 | echo "No arguments supplied. Need an IP and a user eg. ./certDP.sh 192.168.0.2 user1" 6 | exit 7 | fi 8 | 9 | IP=$1 10 | USER=$2 11 | 12 | # server.pref 13 | 14 | echo "" > server.pref 15 | echo "" >> server.pref 16 | echo " " >> server.pref 17 | echo " 1" >> server.pref 18 | echo " TAK Server" >> server.pref 19 | echo " true" >> server.pref 20 | echo " $IP:8089:ssl" >> server.pref 21 | echo " " >> server.pref 22 | echo " " >> server.pref 23 | echo " true" >> server.pref 24 | echo " cert/$IP.p12" >> server.pref 25 | echo " atakatak" >> server.pref 26 | echo " atakatak" >> server.pref 27 | echo " cert/$USER.p12" >> server.pref 28 | echo " " >> server.pref 29 | echo "" >> server.pref 30 | 31 | 32 | # manifest.xml 33 | 34 | echo "" > manifest.xml 35 | echo " " >> manifest.xml 36 | echo " " >> manifest.xml 37 | echo " " >> manifest.xml 38 | echo " " >> manifest.xml 39 | echo " " >> manifest.xml 40 | echo " " >> manifest.xml 41 | echo " " >> manifest.xml 42 | echo " " >> manifest.xml 43 | echo " " >> manifest.xml 44 | echo " " >> manifest.xml 45 | echo "" >> manifest.xml 46 | 47 | zip -j tak/certs/files/$USER-$IP.dp.zip manifest.xml server.pref tak/certs/files/$IP.p12 tak/certs/files/$USER.p12 48 | echo "-------------------------------------------------------------" 49 | echo "Created certificate data package for $USER @ $IP as tak/certs/files/$USER-$IP.dp.zip" 50 | -------------------------------------------------------------------------------- /scripts/cleanup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DOCKER_COMPOSE="docker-compose" 4 | 5 | if ! command -v docker-compose 6 | then 7 | DOCKER_COMPOSE="docker compose" 8 | echo "Docker compose command set to new style $DOCKER_COMPOSE" 9 | fi 10 | 11 | $DOCKER_COMPOSE down 12 | docker volume rm --force tak-server_db_data 13 | rm -rf tak 14 | rm -rf /tmp/takserver 15 | 16 | # Comment me out to save yourself rebuilding........ 17 | docker image rm tak-server-db --force 18 | docker image rm tak-server-tak --force 19 | -------------------------------------------------------------------------------- /scripts/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | color() { 4 | STARTCOLOR="\e[$2"; 5 | ENDCOLOR="\e[0m"; 6 | export "$1"="$STARTCOLOR%b$ENDCOLOR" 7 | } 8 | color info 96m 9 | color success 92m 10 | color warning 93m 11 | color danger 91m 12 | 13 | DOCKER_COMPOSE="docker-compose" 14 | 15 | if ! command -v docker-compose 16 | then 17 | DOCKER_COMPOSE="docker compose" 18 | echo "Docker compose command set to new style $DOCKER_COMPOSE" 19 | fi 20 | 21 | 22 | printf $success "\nTAK server setup script sponsored by CloudRF.com - \"The API for RF\"\n" 23 | printf $info "\nStep 1. Download the official docker image as a zip file from https://tak.gov/products/tak-server \nStep 2. Place the zip file in this tak-server folder.\n" 24 | printf $warning "\nYou should install this as a user. Elevated privileges (sudo) are only required to clean up a previous install eg. sudo ./scripts/cleanup.sh\n" 25 | 26 | arch=$(dpkg --print-architecture) 27 | 28 | DOCKERFILE=docker-compose.yml 29 | 30 | if [ $arch == "arm64" ]; 31 | then 32 | DOCKERFILE=docker-compose.arm.yml 33 | printf "\nBuilding for arm64...\n" "info" 34 | fi 35 | 36 | 37 | ### Check if required ports are in use by anything other than docker 38 | netstat_check () { 39 | 40 | ports=(5432 8089 8443 8444 8446 9000 9001) 41 | 42 | for i in ${ports[@]}; 43 | do 44 | netstat -lant | grep -w $i 45 | if [ $? -eq 0 ]; 46 | then 47 | printf $warning "\nAnother process is still using port $i. Either wait or use 'sudo netstat -plant' to find it, then 'ps aux' to get the PID and 'kill PID' to stop it and try again\n" 48 | exit 0 49 | else 50 | printf $success "\nPort $i is available.." 51 | fi 52 | done 53 | 54 | } 55 | 56 | tak_folder () { 57 | ### Check if the folder "tak" exists after previous install or attempt and remove it or leave it for the user to decide 58 | if [ -d "./tak" ] 59 | then 60 | printf $warning "\nDirectory 'tak' already exists. This will be removed along with the docker volume, do you want to continue? (y/n): " 61 | read dirc 62 | if [ $dirc == "n" ]; 63 | then 64 | printf "Exiting now.." 65 | sleep 1 66 | exit 0 67 | elif [ $dirc == "no" ]; 68 | then 69 | printf "Exiting now.." 70 | sleep 1 71 | exit 0 72 | fi 73 | rm -rf tak 74 | rm -rf /tmp/takserver 75 | docker volume rm --force tak-server_db_data 76 | fi 77 | } 78 | 79 | 80 | checksum () { 81 | printf "\nChecking for TAK server release files (..RELEASE.zip) in the directory....\n" 82 | sleep 1 83 | 84 | if [ "$(ls -hl *-RELEASE-*.zip 2>/dev/null)" ]; 85 | then 86 | printf $warning "SECURITY WARNING: Make sure the checksums match! You should only download your release from a trusted source eg. tak.gov:\n" 87 | for file in *.zip; 88 | do 89 | printf "Computed SHA1 Checksum: " 90 | sha1sum $file 91 | printf "Computed MD5 Checksum: " 92 | md5sum $file 93 | done 94 | printf "\nVerifying checksums against known values for $file...\n" 95 | sleep 1 96 | printf "SHA1 Verification: " 97 | sha1sum --ignore-missing -c tak-sha1checksum.txt 98 | if [ $? -ne 0 ]; 99 | then 100 | printf $danger "SECURITY WARNING: The file is either different OR is not listed in the known releases.\nDo you really want to continue with this setup? (y/n): " 101 | read check 102 | if [ "$check" == "n" ]; 103 | then 104 | printf "\nExiting now..." 105 | exit 0 106 | elif [ "$check" == "no" ]; 107 | then 108 | printf "Exiting now..." 109 | exit 0 110 | fi 111 | fi 112 | printf "MD5 Verification: " 113 | md5sum --ignore-missing -c tak-md5checksum.txt 114 | if [ $? -ne 0 ]; 115 | then 116 | printf $danger "SECURITY WARNING: The checksum is not correct, so the file is different. Do you really want to continue with this setup? (y/n): " 117 | read check 118 | if [ "$check" == "n" ]; 119 | then 120 | printf "\nExiting now..." 121 | exit 0 122 | elif [ "$check" == "no" ]; 123 | then 124 | printf "Exiting now..." 125 | exit 0 126 | fi 127 | fi 128 | else 129 | printf $danger "\n\tPlease download the release of docker image as per instructions in README.md file. Exiting now...\n\n" 130 | sleep 1 131 | exit 0 132 | fi 133 | } 134 | 135 | netstat_check 136 | tak_folder 137 | if [ -d "tak" ] 138 | then 139 | printf $danger "Failed to remove the tak folder. You will need to do this as sudo: sudo ./scripts/cleanup.sh\n" 140 | exit 0 141 | fi 142 | checksum 143 | 144 | # The actual container setup starts here 145 | 146 | ### Vars 147 | 148 | release=$(ls -hl *.zip | awk '{print $9}' | cut -d. -f -2) 149 | 150 | printf $warning "\nPausing to let you know release version $release will be setup in 5 seconds.\nIf this is wrong, hit Ctrl-C now..." 151 | sleep 5 152 | 153 | 154 | ## Set up directory structure 155 | if [ -d "/tmp/takserver" ] 156 | then 157 | rm -rf /tmp/takserver 158 | fi 159 | 160 | # ifconfig? 161 | export PATH=$PATH:/sbin 162 | if ! command -v ifconfig 163 | then 164 | printf $danger "\nRTFM: You need net-tools: apt-get install net-tools\n" 165 | exit 1 166 | fi 167 | 168 | # unzip or 7z? 169 | if ! command -v unzip 170 | then 171 | if ! command -v 7z 172 | then 173 | printf $danger "\n .----------------. .----------------. .----------------. .----------------.\n" 174 | printf $danger "| .--------------. || .--------------. || .--------------. || .--------------. |\n" 175 | printf $danger "| | _______ | || | _________ | || | _________ | || | ____ ____ | |\n" 176 | printf $danger "| | |_ __ \ | || | | _ _ | | || | |_ ___ | | || ||_ \ / _|| |\n" 177 | printf $danger "| | | |__) | | || | |_/ | | \_| | || | | |_ \_| | || | | \/ | | |\n" 178 | printf $danger "| | | __ / | || | | | | || | | _| | || | | |\ /| | | |\n" 179 | printf $danger "| | _| | \ \_ | || | _| |_ | || | _| |_ | || | _| |_\/_| |_ | |\n" 180 | printf $danger "| | |____| |___| | || | |_____| | || | |_____| | || ||_____||_____|| |\n" 181 | printf $danger "| | | || | | || | | || | | |\n" 182 | printf $danger "| '--------------' || '--------------' || '--------------' || '--------------' |\n" 183 | printf $danger " '----------------' '----------------' '----------------' '----------------' \n" 184 | printf $danger "You require either unzip OR 7z to decompress the TAK release\n" 185 | printf $danger "https://github.com/Cloud-RF/tak-server/blob/main/README.md\n" 186 | exit 1 187 | else 188 | 7z x $release.zip -o/tmp/takserver 189 | fi 190 | else 191 | unzip $release.zip -d /tmp/takserver 192 | fi 193 | 194 | if [ ! -d "/tmp/takserver/$release/tak" ] 195 | then 196 | printf $danger "\n .----------------. .----------------. .----------------. .----------------.\n" 197 | printf $danger "| .--------------. || .--------------. || .--------------. || .--------------. |\n" 198 | printf $danger "| | _______ | || | _________ | || | _________ | || | ____ ____ | |\n" 199 | printf $danger "| | |_ __ \ | || | | _ _ | | || | |_ ___ | | || ||_ \ / _|| |\n" 200 | printf $danger "| | | |__) | | || | |_/ | | \_| | || | | |_ \_| | || | | \/ | | |\n" 201 | printf $danger "| | | __ / | || | | | | || | | _| | || | | |\ /| | | |\n" 202 | printf $danger "| | _| | \ \_ | || | _| |_ | || | _| |_ | || | _| |_\/_| |_ | |\n" 203 | printf $danger "| | |____| |___| | || | |_____| | || | |_____| | || ||_____||_____|| |\n" 204 | printf $danger "| | | || | | || | | || | | |\n" 205 | printf $danger "| '--------------' || '--------------' || '--------------' || '--------------' |\n" 206 | printf $danger " '----------------' '----------------' '----------------' '----------------' \n" 207 | printf $danger "A decompressed folder was NOT found at /tmp/takserver/$release\n" 208 | printf $danger "https://github.com/Cloud-RF/tak-server/blob/main/README.md\n" 209 | exit 1 210 | fi 211 | 212 | mv -f /tmp/takserver/$release/tak ./ 213 | chown -R $USER:$USER tak 214 | 215 | # This config uses a docker alias of postgresql://tak-database:5432/ 216 | cp ./CoreConfig.xml ./tak/CoreConfig.xml 217 | 218 | ## Set admin username and password and ensure it meets validation criteria 219 | user="admin" 220 | pwd=$(cat /dev/urandom | tr -dc '[:alpha:][:digit:]' | fold -w ${1:-11} | head -n 1) 221 | password=$pwd"Meh1!" 222 | 223 | ## Set postgres password and ensure it meets validation criteria 224 | pgpwd="$(cat /dev/urandom | tr -dc '[:alpha:][:digit:]' | fold -w ${1:-11} | head -n 1)" 225 | pgpassword=$pgpwd"Meh1!" 226 | 227 | # get IP 228 | NIC=$(route | grep default | awk '{print $8}' | head -n 1) 229 | IP=$(ip addr show $NIC | grep -m 1 "inet " | awk '{print $2}' | cut -d "/" -f1) 230 | 231 | printf $info "\nProceeding with IP address: $IP\n" 232 | sed -i "s/password=\".*\"/password=\"${pgpassword}\"/" tak/CoreConfig.xml 233 | # Replaces HOSTIP for rate limiter and Fed server. Database URL is a docker alias of tak-database 234 | sed -i "s/HOSTIP/$IP/g" tak/CoreConfig.xml 235 | 236 | # Replaces takserver.jks with $IP.jks 237 | sed -i "s/takserver.jks/$IP.jks/g" tak/CoreConfig.xml 238 | 239 | # Better memory allocation: 240 | # By default TAK server allocates memory based upon the *total* on a machine. 241 | # In the real world, people not on a gov budget use a server for more than one thing. 242 | # Instead we allocate a fixed amount of memory 243 | #read -p "Enter the amount of memory to allocate, in kB. Default 4000000 (4GB): " mem 244 | if [ -z "$mem" ]; 245 | then 246 | mem="4000000" 247 | fi 248 | 249 | sed -i "s%\`awk '/MemTotal/ {print \$2}' /proc/meminfo\`%$mem%g" tak/setenv.sh 250 | 251 | # Commented out since everyone just kept hitting enter x4. dumb=dumb 252 | 253 | ## Set variables for generating CA and client certs 254 | #printf $warning "SSL setup. Hit enter (x4) to accept the defaults:\n" 255 | #read -p "Country (for cert generation). Default [US] : " country 256 | #read -p "State (for cert generation). Default [state] : " state 257 | #read -p "City (for cert generation). Default [city]: " city 258 | #read -p "Organizational Unit (for cert generation). Default [org]: " orgunit 259 | 260 | if [ -z "$country" ]; 261 | then 262 | country="GB" 263 | fi 264 | 265 | if [ -z "$state" ]; 266 | then 267 | state="Warwickshire" 268 | fi 269 | 270 | if [ -z "$city" ]; 271 | then 272 | city="Coventry" # British joke 273 | fi 274 | 275 | if [ -z "$orgunit" ]; 276 | then 277 | orgunit="TAK" 278 | fi 279 | 280 | # Update local env 281 | export COUNTRY=$country 282 | export STATE=$state 283 | export CITY=$city 284 | export ORGANIZATIONAL_UNIT=$orgunit 285 | 286 | 287 | # Writes variables to a .env file for docker-compose 288 | cat << EOF > .env 289 | COUNTRY=$country 290 | STATE=$state 291 | CITY=$city 292 | ORGANIZATIONAL_UNIT=$orgunit 293 | EOF 294 | 295 | ### Update cert-metadata.sh with configured country. Fallback to US if variable not set. 296 | sed -i -e 's/COUNTRY=US/COUNTRY=${COUNTRY}/' $PWD/tak/certs/cert-metadata.sh 297 | 298 | 299 | ### Runs through setup, starts both containers 300 | $DOCKER_COMPOSE --file $DOCKERFILE up --force-recreate -d 301 | 302 | ### Checking if the container is set up and ready to set the certificates 303 | 304 | while : 305 | do 306 | sleep 5 # let the PG stderr messages conclude... 307 | printf $warning "------------CERTIFICATE GENERATION--------------\n" 308 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/certs && ./makeRootCa.sh --ca-name CRFtakserver" 309 | if [ $? -eq 0 ]; 310 | then 311 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/certs && ./makeCert.sh server $IP" 312 | if [ $? -eq 0 ]; 313 | then 314 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/certs && ./makeCert.sh client $user" 315 | if [ $? -eq 0 ]; 316 | then 317 | # Set permissions so user can write to certs/files 318 | # The ubuntu user has uid 1000 which should map to our host user id 1000. Type 'id' to find yours :) 319 | $DOCKER_COMPOSE exec tak bash -c "chown -R 1000:1000 /opt/tak/certs/" 320 | #$DOCKER_COMPOSE stop tak 321 | break 322 | fi 323 | else 324 | sleep 5 325 | fi 326 | fi 327 | done 328 | 329 | printf $info "Creating certificates for 2 users in tak/certs/files for a quick setup via TAK's import function\n" 330 | 331 | # Make 2 users 332 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/certs && ./makeCert.sh client user1" 333 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/certs && ./makeCert.sh client user2" 334 | $DOCKER_COMPOSE exec tak bash -c "chown -R 1000:1000 /opt/tak/certs/" 335 | 336 | ./scripts/certDP.sh $IP user1 337 | ./scripts/certDP.sh $IP user2 338 | 339 | printf $info "Waiting for TAK server to connect to DB. This should loop several times only...\n" 340 | #$DOCKER_COMPOSE start tak 341 | sleep 5 342 | 343 | ### Checks if java is fully initialised 344 | while : 345 | do 346 | sleep 5 347 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/ && java -jar /opt/tak/utils/UserManager.jar usermod -A -p $password $user" 348 | if [ $? -eq 0 ]; 349 | then 350 | $DOCKER_COMPOSE exec tak bash -c "cd /opt/tak/ && java -jar utils/UserManager.jar certmod -A certs/files/$user.pem" 351 | if [ $? -eq 0 ]; 352 | then 353 | $DOCKER_COMPOSE exec tak bash -c "java -jar /opt/tak/db-utils/SchemaManager.jar upgrade" 354 | if [ $? -eq 0 ]; 355 | then 356 | 357 | break 358 | else 359 | sleep 5 360 | fi 361 | else 362 | sleep 5 363 | fi 364 | else 365 | printf $info "No joy with DB at $IP, will retry in 5s. If this loops more than 10 times give up.\n" 366 | fi 367 | done 368 | 369 | cp ./tak/certs/files/$user.p12 . 370 | 371 | ### Post-installation message to user including randomly generated passwrods to use for account and PostgreSQL 372 | docker container ls 373 | 374 | printf $warning "\n\nImport the $user.p12 certificate from this folder to your browser's certificate store as per the README.md file\n" 375 | printf $success "Login at https://$IP:8443 with your admin account. No need to run the /setup step as this has been done.\n" 376 | printf $info "Certificates and .zip data packages are in tak/certs/files \n\n" 377 | printf $success "Setup script sponsored by CloudRF.com - \"The API for RF\"\n\n" 378 | printf $danger "---------PASSWORDS----------------\n\n" 379 | printf $danger "Admin user name: $user\n" # Web interface default user name 380 | printf $danger "Admin password: $password\n" # Web interface default random password created during setup 381 | printf $danger "PostgreSQL password: $pgpassword\n\n" # PostgreSQL password randomly generated during set up 382 | printf $danger "---------PASSWORDS----------------\n\n" 383 | printf $warning "MAKE A NOTE OF YOUR PASSWORDS. THEY WON'T BE SHOWN AGAIN.\n" 384 | printf $info "Docker containers should automatically start with the Docker service from now on.\n" 385 | -------------------------------------------------------------------------------- /scripts/shareCerts.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo "WARNING: UNAUTHENTICATED USERS CAN NOW FETCH *CERTIFICATES*. THIS IS RISKY" 3 | mkdir -p share 4 | cp tak/certs/files/*.zip share 5 | cd share 6 | python3 -m http.server 12345 7 | -------------------------------------------------------------------------------- /tak-md5checksum.txt: -------------------------------------------------------------------------------- 1 | dc63cb315f950025707dbccf05bdf183 takserver-docker-4.6-RELEASE-26.zip 2 | 5b011b74dd5f598fa21ce8d737e8b3e6 takserver-docker-4.7-RELEASE-4.zip 3 | 44b6fa8d7795b56feda08ea7ab793a3e takserver-docker-4.7-RELEASE-18.zip 4 | 1cb0208c62d4551f1c3185d00a5fd8bf takserver-docker-4.7-RELEASE-20.zip 5 | c07f01d74960287bfc7dc08ecd6cbc3a takserver-docker-4.8-RELEASE-31.zip 6 | 5068d5fd70cbc9ecf53f2259dc9383f7 takserver-docker-4.10-RELEASE-50.zip 7 | 2c80c289f67de4878ca596bf479ef698 takserver-docker-5.0-RELEASE-58.zip 8 | ecfc16b2daf78bdb8f10d99b8767deb7 takserver-docker-5.1-RELEASE-11.zip 9 | c6d1485ae3f81bd30c35be836a001cd0 takserver-docker-5.1-RELEASE-50.zip 10 | b691d1d7377790690e1e5ec0e4a29a56 takserver-docker-5.2-RELEASE-30.zip 11 | 0a7398383253707dd7564afc88f29b3b takserver-docker-5.2-RELEASE-43.zip 12 | e8a5dc855c4eb67d170bf689017516e8 takserver-docker-5.3-RELEASE-24.zip 13 | -------------------------------------------------------------------------------- /tak-sha1checksum.txt: -------------------------------------------------------------------------------- 1 | 7ca58221b8d35d40df906144c5834e6d9fa85b47 takserver-docker-4.6-RELEASE-26.zip 2 | b688359659a05204202c21458132a64ec1ba0184 takserver-docker-4.7-RELEASE-4.zip 3 | cd56406d3539030ab9b9b3fbae08b56b352b9b53 takserver-docker-4.7-RELEASE-18.zip 4 | f427ae3e860fddb8907047f157ada5764334c48d takserver-docker-4.7-RELEASE-20.zip 5 | 387ea4f593763d3adcfda5128a89dda4fd82e937 takserver-docker-4.8-RELEASE-31.zip 6 | 177ed55a66ce8126424937dd3bc7375feb12d3eb takserver-docker-4.10-RELEASE-50.zip 7 | 944052011887101fd1019b3019f5c9583a1683f3 takserver-docker-5.0-RELEASE-58.zip 8 | 3fa400e96234a17fde2ad2c314b409973676c497 takserver-docker-5.1-RELEASE-11.zip 9 | 99467f0be91e682714e72c34196c6d8bf40c92d3 takserver-docker-5.1-RELEASE-50.zip 10 | 98f13f9140470ee65351e3d25dec097603bfb582 takserver-docker-5.2-RELEASE-30.zip 11 | 824d7b89fbe6377cb5570f50bb35e6e05c12b230 takserver-docker-5.2-RELEASE-43.zip 12 | 1eaad8c4471392a96c60f56bc2d54f9f3b6d719e takserver-docker-5.3-RELEASE-24.zip 13 | --------------------------------------------------------------------------------