Gridbase TAK Server Installer

Automated installer for OpenTAKServer with MediaMTX, monitoring, and Cloudflare Tunnel support.

Features

✅ One-command installation - Fully automated setup
✅ Interactive configuration - Guided prompts for all settings
✅ Complete TAK stack - OpenTAKServer, MediaMTX, PostgreSQL, RabbitMQ
✅ Built-in monitoring - Health checks with Discord/email alerts
✅ Security hardened - Firewall, secure defaults, auto-generated secrets
✅ Optional integrations - Cloudflare Tunnel, ZeroTier
✅ Production ready - Systemd services, automatic restarts, log rotation

What Gets Installed

Core Services

OpenTAKServer v1.6.0+ - TAK server for situational awareness
MediaMTX v1.15.3 - Real-time media streaming
PostgreSQL 15 - Primary database
RabbitMQ - Message queue for COT routing
nginx - Web server and reverse proxy

Monitoring

sanity-check - Comprehensive health report (every 8 hours)
alert-check - Fast failure detection (every 10 minutes)
Discord webhooks and email alerts
Automatic recovery notifications

Requirements

Hardware: Raspberry Pi 4/5 (4GB+ RAM recommended)
OS: Raspberry Pi OS (64-bit) or Debian 11/12
Network: Internet connection via Ethernet
Storage: 10GB+ free space
Access: Root/sudo privileges

Quick Start

Option 1: Direct Download & Run

# Download installer
curl -sSL https://raw.githubusercontent.com/yourusername/gridbase-tak-installer/main/install.sh -o install.sh

# Run installer
sudo bash install.sh

Option 2: Clone Repository

# Clone repository
git clone https://github.com/yourusername/gridbase-tak-installer.git
cd gridbase-tak-installer

# Run installer
sudo ./install.sh

Installation Process

The installer will guide you through:

Pre-flight Checks - Verify system requirements
Configuration Wizard - Set up your preferences:
- System username/password
- Email configuration (Gmail)
- Discord webhook
- Location (for airplane/ship tracking)
- Certificate Authority details
- Optional: Cloudflare Tunnel
- Optional: ZeroTier network
Automated Installation - Sit back while it installs everything
Service Startup - All services configured and started
Credentials Summary - Access details saved to /root/gridbase-credentials.txt

Configuration Wizard Prompts

Required Information

System Username - Default: tak
System Password - Auto-generated or custom
Email for Alerts - Where to send notifications
Discord Webhook - For real-time alerts

Optional Configuration

Gmail Credentials - For email alerts (requires app password)
Cloudflare Tunnel - For remote access without port forwarding
ZeroTier Network - For VPN-style connectivity
Location - Latitude/longitude for tracking features

Auto-Generated Secrets

The installer automatically generates secure random values for:

Database passwords
Certificate authority password
Security tokens and secrets
API tokens

All credentials are saved to /root/gridbase-credentials.txt

Post-Installation

1. Create Admin User

sudo -u tak /home/tak/.opentakserver_venv/bin/ots-manage user create admin

2. Access Web Interface

HTTP: http://<your-pi-ip>:8080
HTTPS: https://<your-pi-ip>:8443

3. Check Service Status

# All services
systemctl status opentakserver eud_handler eud_handler_ssl mediamtx

# Monitoring
systemctl status sanity-check.timer alert-check.timer

# View logs
tail -f /var/log/gridbase-installer.log
tail -f /home/tak/ots/logs/opentakserver.log

4. Configure Cloudflare Tunnel (if enabled)

# Login to Cloudflare
cloudflared tunnel login

# Create tunnel
cloudflared tunnel create gridbase-tak

# Configure tunnel
cloudflared tunnel route dns gridbase-tak tak.yourdomain.com

# Run tunnel
cloudflared tunnel run gridbase-tak

5. Authorize ZeroTier (if enabled)

Go to https://my.zerotier.com
Find your network
Authorize the new device
Note the assigned IP address

Monitoring & Alerts

Discord Webhooks

Your server sends automatic Discord notifications for:

✅ Every 8 hours - Full health report (always)
❌ Immediate - When failures are detected
♻️ Recovery - When issues are resolved

Email Alerts

Email alerts are sent only for failures, containing:

Detailed error information
Service logs
Recovery instructions

Manual Health Check

# Run sanity check manually
sudo /usr/local/bin/sanity-check

# Run alert check manually
sudo /usr/local/bin/alert-check

# View monitoring logs
tail -f /var/log/sanity-check.log
tail -f /var/log/alert-check.log

File Locations

/home/tak/
├── ots/
│   ├── config.yml              # Main OTS configuration
│   ├── ca/                     # Certificate authority
│   ├── logs/                   # Application logs
│   ├── uploads/                # User uploads
│   └── mediamtx/               # MediaMTX installation
├── .opentakserver_venv/        # Python virtual environment
└── gridbase-tak-installer/     # Installer files (can be deleted)

/etc/gridbase/
└── monitoring.conf             # Monitoring configuration

/usr/local/bin/
├── sanity-check                # Health check script
└── alert-check                 # Failure detection script

/etc/systemd/system/
├── opentakserver.service
├── eud_handler.service
├── eud_handler_ssl.service
├── mediamtx.service
├── sanity-check.timer
└── alert-check.timer

/root/
└── gridbase-credentials.txt    # Saved credentials (KEEP SECURE!)

Troubleshooting

Services Not Starting

# Check service status
systemctl status opentakserver
journalctl -u opentakserver -n 50

# Restart services
sudo systemctl restart opentakserver eud_handler eud_handler_ssl mediamtx

Port Already in Use

# Find process using port 8080
sudo netstat -tlnp | grep 8080

# Kill process if needed
sudo kill -9 <PID>

Database Connection Issues

# Check PostgreSQL status
sudo systemctl status postgresql

# Test connection
sudo -u tak psql -U ots -d ots -h 127.0.0.1

Monitoring Not Working

# Check timer status
systemctl list-timers | grep -E "sanity|alert"

# Run checks manually
sudo /usr/local/bin/sanity-check
sudo /usr/local/bin/alert-check

# Check Discord webhook
curl -X POST -H "Content-Type: application/json" \
  -d '{"content": "Test message"}' \
  "<your-discord-webhook-url>"

Reinstall

If you need to start over:

# Stop all services
sudo systemctl stop opentakserver eud_handler eud_handler_ssl mediamtx

# Remove user and data (WARNING: Destroys all data!)
sudo userdel -r tak
sudo rm -rf /home/tak
sudo -u postgres dropdb ots
sudo -u postgres dropuser ots

# Run installer again
cd gridbase-tak-installer
sudo ./install.sh

Security Considerations

Default Security Measures

The installer implements:

✅ Firewall (UFW) with only required ports open
✅ Auto-generated secure passwords (25+ characters)
✅ Restricted file permissions (600 for sensitive files)
✅ PostgreSQL accessible only from localhost
✅ RabbitMQ with guest user restricted to localhost

Recommended Additional Steps

Change Default Passwords

passwd tak
sudo -u postgres psql -c "ALTER USER ots WITH PASSWORD 'new-secure-password';"

Enable Fail2Ban (Optional)

sudo apt-get install fail2ban
sudo systemctl enable fail2ban

SSL Certificates - Use Let's Encrypt or your own certificates
SSH Key Authentication - Disable password auth for SSH

Regular Updates

sudo apt-get update && sudo apt-get upgrade
sudo -u tak /home/tak/.opentakserver_venv/bin/pip install --upgrade OpenTAKServer

Updating OpenTAKServer

# Stop services
sudo systemctl stop opentakserver eud_handler eud_handler_ssl

# Update
sudo -u tak /home/tak/.opentakserver_venv/bin/pip install --upgrade OpenTAKServer

# Restart services
sudo systemctl start opentakserver eud_handler eud_handler_ssl

Uninstall

# Stop and disable services
sudo systemctl stop opentakserver eud_handler eud_handler_ssl mediamtx sanity-check.timer alert-check.timer
sudo systemctl disable opentakserver eud_handler eud_handler_ssl mediamtx sanity-check.timer alert-check.timer

# Remove service files
sudo rm /etc/systemd/system/{opentakserver,eud_handler,eud_handler_ssl,mediamtx,sanity-check,alert-check}.{service,timer}
sudo systemctl daemon-reload

# Remove scripts
sudo rm /usr/local/bin/{sanity-check,alert-check}

# Remove user and data
sudo userdel -r tak

# Remove database
sudo -u postgres dropdb ots
sudo -u postgres dropuser ots

# Remove configs
sudo rm -rf /etc/gridbase
sudo rm /root/gridbase-credentials.txt

Support & Contributing

Issues: Report bugs or request features
Documentation: Contributions welcome
Security: Report vulnerabilities privately

License

MIT License - See LICENSE file

Credits

Built on:

OpenTAKServer
MediaMTX
PostgreSQL, RabbitMQ, nginx

Made with ☕ for the TAK community

Name		Name	Last commit message	Last commit date
config		config
scripts		scripts
services		services
.gitignore		.gitignore
LICENSE		LICENSE
QUICKSTART.md		QUICKSTART.md
README.md		README.md
install.sh		install.sh

Latest commit

History

Folders and files

Repository files navigation