Team Awareness Kit Infrastructure Management Platform.
One clone. One password. One URL. Manage everything from your browser.
Current release: v10.1.9-alpha
Older releases on the GitHub Releases tab — each tag carries its full release notes.
Something broken? Wrong sidebar version, Update Now error, merge/rebase/tag-clobber messages, or you are not sure the VPS ever pulled the real repo → go to Universal recovery (SSH) and run the one block there. Point people at that section; it is the single source of truth.
Universal installer. Supported platforms: Ubuntu 22.04 LTS, Rocky Linux / RHEL 9, and ARM64 (aarch64, e.g. Jetson Orin). The same one-clone install detects your OS, package manager (apt/dnf), and architecture and configures the firewall (ufw on Ubuntu, firewalld on RHEL) automatically. Ubuntu is pinned to 22.04 — newer Ubuntu (24.04) and other Debian-family distros wait on TAK Server's certificate tooling supporting OpenSSL 3.x. ARM64 caveats: Cesium 3D-tiles (pmtiles) and Federation Hub are not yet available on ARM — see the release notes.
Use this on the VPS when anything below is true:
- Update Now failed (including
would clobber existing tag, merge/rebase errors, or a vague git error). - The sidebar VERSION does not match the Latest release line at the top of this README (e.g. stuck on v0.2.4 while the README says v0.4.5-alpha).
- You are unsure whether
git remote -vpoints atgithub.com/takwerx/infra-TAK(forks, typos, and old mirrors leaveorigin/mainyears behind —git fetch originis not safe untiloriginis fixed).
This pulls main from the official repo URL (same as Quick Start), checks VERSION, restarts the service. Your .config/ is not touched.
cd $(grep -oP 'WorkingDirectory=\K.*' /etc/systemd/system/takwerx-console.service)
git fetch https://github.com/takwerx/infra-TAK.git main
git checkout --force -B main FETCH_HEAD
grep '^VERSION' app.py
sudo systemctl restart takwerx-consoleCheck: The grep line should show VERSION = "…" matching the current Latest release at the top (without the v, e.g. 0.6.2-alpha). If it still shows an old number, you are in the wrong directory (compare with grep WorkingDirectory /etc/systemd/system/takwerx-console.service) or the fetch failed (network).
Fix origin once (recommended): so future git fetch origin hits upstream:
git remote set-url origin https://github.com/takwerx/infra-TAK.gitNo grep -oP? Run grep WorkingDirectory /etc/systemd/system/takwerx-console.service, cd to that path, then run the four lines starting with git fetch https://github.com/... (skip the cd line).
Shallow / single-branch clone (fetch errors): clone the full repository (not a single-branch or shallow clone) and re-run start.sh from that directory.
After the console is up: If Guard Dog is installed, open Guard Dog and click ↻ Update Guard Dog once (see Guard Dog note under Quick Start).
Why: Older builds used git pull --rebase or bulk git fetch --tags, which break on many field installs. Current Update Now (v0.4.1+) is safer, but recovery over SSH must not trust a wrong origin — always use the https://github.com/takwerx/infra-TAK.git fetch above.
A unified web console for deploying and managing TAK ecosystem infrastructure:
- TAK Server — Upload your .deb, configure, deploy, manage CoreConfig — all from the browser
- Federation Hub — Deploy and manage a TAK Server Federation Hub on this machine or a remote VPS, with Authentik SSO, certificate management, and Guard Dog monitoring
- Authentik — Identity provider with automated LDAP configuration for TAK Server auth
- TAK Portal — User and certificate management portal with auto-configured Authentik + TAK Server integration
- Caddy SSL — Let's Encrypt certificates and reverse proxy management
- CloudTAK — Browser-based TAK client
- MediaMTX — Video streaming server for real-time feeds (mutually exclusive with TAK Video Restreamer — they share streaming ports)
- TAK Video Restreamer — Flask + MediaMTX + FFmpeg streaming server (RTSP, RTSPS, SRT, HLS ABR, RTMP, KLV) deployed as a Docker container (mutually exclusive with standalone MediaMTX). Lives behind Caddy at
stream.<FQDN>. Has its own admin login (not Authentik SSO — TVR has built-in auth); password is displayed on the module page and changeable without rebuilding the container. - Node-RED — Flow-based automation engine, protected behind Authentik forward auth
- Email Relay — Outbound email for notifications and alerts
- Guard Dog — TAK Server health monitoring and auto-recovery (port 8089, processes, OOM, PostgreSQL, CoT DB size, disk, disk I/O performance, certificates; optional monitors for Authentik, Node-RED, MediaMTX, CloudTAK, Federation Hub)
No more SSH. No more editing XML by hand. No more running scripts and hoping.
# Ensure git is installed (Ubuntu usually has it; bare RHEL/Rocky cloud AMIs often don't)
command -v git >/dev/null 2>&1 || sudo apt-get install -y git 2>/dev/null || sudo dnf install -y git
git clone --depth 1 https://github.com/takwerx/infra-TAK.git
cd infra-TAK
sudo ./start.shFirst boot / automatic updates: On a new Ubuntu VPS, apt may run right after SSH is available. systemctl status unattended-upgrades often shows active (running) for unattended-upgrade-shutdown — that idle process is normal and is not blocking installs. If apt-get still reports “Could not get lock”, wait until sudo fuser /var/lib/dpkg/lock-frontend shows nothing, then run sudo ./start.sh again. start.sh waits for real apt/dpkg activity and for dpkg/apt lock files before installing packages.
Branches: Default clone uses main (stable; tagged releases). For latest features and fixes before they're merged to main, use the dev branch: git clone --depth 1 -b dev https://github.com/takwerx/infra-TAK.git. The README and changelog here reflect main; dev may include remote deployment, UI tweaks, and fixes not yet in a release.
The script will:
- Detect your OS, package manager (Ubuntu 22.04
aptor Rocky/RHEL 9dnf), and architecture (x86-64 or ARM64) — and on RHEL install + start firewalld automatically - Wait if automatic updates hold apt/dpkg, then install Python dependencies
- Ask you to set an admin password
- Start the web console
Then open your browser to the URL shown and log in.
Updating: After git pull or Update Now, restart the console with sudo systemctl restart takwerx-console. Your password and config live in the install directory's .config/. If you run start.sh from a different clone or path, the service keeps using the original install directory so your password continues to work. Node-RED / Configurator code (nodered/): after pulling on the VPS, also run bash nodered/deploy.sh from that install directory.
Guard Dog — automatic since v0.4.7-alpha: Guard Dog scripts are automatically re-deployed when the console detects a version change. No manual button press needed after upgrading. The button still exists as a fallback if you change alert email or server nickname. Set Notifications → alert email and use Send test email to verify. Details: docs/GUARDDOG.md.
Upgrading from v0.1.x to v0.2.0: v0.2.0 switches from Flask dev server to gunicorn (production server). The upgrade is automatic — just git pull and restart. On first restart, the console installs gunicorn, rewrites the systemd service, and starts the production server transparently. No manual steps needed.
Password not working after update? Use the backdoor: https://<VPS_IP>:5001. If login spins or fails, on the server run (from the directory where you do git pull, e.g. /home/takwerx/infra-TAK): sudo ./fix-console-after-pull.sh — it pins the config path in the systemd unit and prompts you to set a new password so you can log in again. Alternatively run sudo ./reset-console-password.sh from that same directory. After pulling, open the Caddy module and re-save your domain once so the Caddyfile (login bypass) is applied.
Git / version / Update Now issues: use Universal recovery (SSH) above, not this section.
If Authentik or Caddy is down and you can't reach https://infratak.yourdomain.com:
- Backdoor: Open https://<VPS_IP>:5001 in your browser (use the server's real IP, not the domain). Log in with the console password you set when you ran
start.sh. That path skips Caddy and Authentik, so you can get back into the console and fix things.
The console password is stored as a hash in the install directory at .config/auth.json (e.g. /home/takwerx/infra-TAK/.config/auth.json). You cannot recover the plaintext password from that file. If you forget it:
cd /home/takwerx/infra-TAK # or your install path
sudo ./reset-console-password.shEnter a new password twice; the script updates .config/auth.json and restarts the console. Then use https://<VPS_IP>:5001 with the new password. Store the console password somewhere safe (e.g. password manager); it's your only way in when the domain or Authentik is broken.
Deploy services in this order — each step auto-configures the next:
1. Caddy SSL Set your FQDN, get Let's Encrypt certs (recommended first if using a domain)
↓
2. Authentik Identity provider + LDAP outpost (automated deploy)
↓
3. Email Relay Optional; configure SMTP for password recovery
↓
4. TAK Server Upload .deb, deploy, configure ports + certs
↓
5. Connect LDAP On TAK Server page — patches CoreConfig, creates webadmin in Authentik
↓
6. TAK Portal User/cert management portal
↓
7. Anything else CloudTAK, Node-RED, MediaMTX — any order
Connect LDAP runs after TAK Server deploy and wires LDAP auth to CoreConfig. 8446 webadmin login and QR enrollment work immediately after. For MediaMTX-only (or standalone Authentik): Deploy Authentik without TAK Server — it skips CoreConfig and webadmin; add TAK Server later and use Connect LDAP.
Authentik, CloudTAK, MediaMTX, and Node-RED can be deployed to a remote host (separate from the infra-TAK console). You configure the target in each module's "Deployment target" (e.g. "On another server via SSH") and deploy from the console; the console SSHs to the remote and runs Docker/scripts there.
TAK Server supports a two-server split: Server One (PostgreSQL database) and Server Two (TAK Server core) on separate hosts. Configure both hosts in the TAK Server settings and deploy from the console.
Firewall: Depending on how you deploy, the infra-TAK host and remote host may need to reach each other for the automation to work. For example:
- SSH: The console must reach the remote on port 22 (or your SSH port) to run deploy and management commands.
- Authentik remote: After containers start, the console calls the remote Authentik API on port 9090 (e.g.
http://<remote>:9090) to inject the LDAP outpost token. If the infra-TAK server and the remote are in different networks or behind firewalls, open port 9090 from the infra-TAK host to the remote so the token step can succeed; otherwise you'll see "Connection refused" in the deploy log and the LDAP container may stay unhealthy (403 token errors). - Two-server TAK: Server Two (core) must reach Server One (database) on the PostgreSQL port (default 5432); open that port on Server One's firewall for Server Two's IP.
If a remote deploy fails at "token" or "API" steps, or a service reports unhealthy, check that the hosts can reach the required ports (SSH, 9090 for Authentik, 5432 for two-server DB, etc.).
Authentik Deploy (~7 minutes): Console ensures 4GB swap and starts PostgreSQL first, then server/worker after the DB is ready (reduces OOM and 502s on small VPS). Bootstrap credentials generated, LDAP blueprint installed, Docker Compose patched with standalone LDAP container, API polled for outpost token, CoreConfig.xml patched with LDAP auth block, TAK Server restarted.
TAK Portal Deploy (~4 minutes): Repository cloned, container built, TAK Server certs (admin.p12, tak-ca.pem) copied into container, settings.json auto-configured with Authentik URL/token and TAK Server connection, forward auth configured in Caddy, 2-minute sync wait for Authentik outpost.
After deployment, create users in TAK Portal — they flow through Authentik → LDAP → TAK Server automatically.
- Ubuntu 22.04 LTS (currently the only supported platform; goal is a universal installer). Fresh installation recommended.
- Root access
- RAM: 8 GB+ recommended for TAK Server; more if you run the full stack (Authentik, TAK Portal, Node-RED, MediaMTX, CloudTAK, Guard Dog).
- Disk: At max deployment (all modules) you can sit around 26 GB used. Plan for growth: CoT data, logs, and retention. 50 GB+ disk is recommended so you have headroom; TAK Server's own minimum is 40 GB per the official configuration guide. Apply Docker log limits (Guard Dog → Apply Docker log limits) to avoid containers filling the disk.
- Disk I/O: SSD-backed storage strongly recommended. Test your VPS before deploying — slow disk I/O causes Docker build timeouts, service startup failures, and unreliable boots. See VPS disk I/O check below.
- CPU: Enough cores for all processes (TAK Server, PostgreSQL, Authentik, Caddy, Node-RED, etc.). TAK Server's minimum is 4 cores; more is better for the full stack.
- Internet connection for initial setup.
- TAK Server .deb package from tak.gov.
Run this on your VPS before deploying. Poor disk I/O is the #1 cause of slow deploys and unreliable service startups.
# Write speed (sequential, sync)
dd if=/dev/zero of=/tmp/testfile bs=1M count=1024 oflag=dsync 2>&1 | tail -1
# Read speed
dd if=/tmp/testfile of=/dev/null bs=1M 2>&1 | tail -1
# Clean up
rm -f /tmp/testfile| Write speed | Assessment |
|---|---|
| 400+ MB/s | Good — SSD-backed, full stack will deploy and boot quickly |
| 200–400 MB/s | Acceptable — deploys work, boot may be slightly slower |
| < 200 MB/s | Poor — expect slow Docker builds, service timeouts, longer boot sequences |
| < 100 MB/s | Bad — likely throttled or HDD-backed; migrate to a different node or provider |
Some VPS providers place instances on overloaded or HDD-backed storage nodes. If your write speed is consistently under 200 MB/s, contact your provider about migrating to a different node before troubleshooting service issues. The difference between a bad node and a good one can be 50 MB/s vs 500 MB/s on the same provider.
start.sh ← One CLI command to launch everything
├── app.py ← Gunicorn web application (HTTPS on :5001)
├── uploads/ ← Uploaded .deb packages
└── .config/ ← Auth + settings (gitignored)
v0.9.12 hardening: Every host port is classified by exposure tier. Tier 1 (Public) is reachable from the internet, Tier 3 (Caddy-loopback) binds to
127.0.0.1and is reached only via Caddy on 443, Tier 4 (Docker-internal) has no host port at all, Tier 5 (Source-scoped) is allowed only from a specific peer IP.
| Service | Port | Protocol | Description |
|---|---|---|---|
| infra-TAK Console | 5001 | HTTPS | Management web UI (backdoor: direct IP access) |
| Caddy | 80 | HTTP | Redirect to HTTPS |
| Caddy | 443 | HTTPS | Reverse proxy for all services (Let's Encrypt) |
| TAK Server | 8089 | TLS | TAK client connections (ATAK, iTAK, WinTAK) |
| TAK Server | 8443 | HTTPS | Admin WebGUI (client certificate auth) |
| TAK Server | 8446 | HTTPS | Admin WebGUI (Let's Encrypt, password/LDAP auth) |
| MediaMTX / TAK Video Restreamer | 8554 | RTSP | Video streaming clients (publish + play) |
| MediaMTX | 8322 | RTSPS | TLS-wrapped RTSP |
| MediaMTX | 8890 | SRT | SRT streaming clients |
| MediaMTX | 8000/8001 | UDP | RTP/RTCP companion ports for RTSP |
| CloudTAK Media | 18554 | RTSP | CloudTAK video tab — RTSP clients |
| CloudTAK Media | 11935 | RTMP | CloudTAK video tab — RTMP publishers |
| CloudTAK Media | 18890 | SRT | CloudTAK video tab — SRT clients |
Reached only through Caddy on 443 via the public FQDN. Raw ports are NOT reachable from the internet. v0.9.12 enforces this via !reset Docker port overrides plus UFW deny rules.
| Service | Port | Description |
|---|---|---|
| Authentik | 9090/9443 | Identity provider HTTP/HTTPS (Caddy proxies https://authentik.example.com) |
| TAK Portal | 3000 | User/cert management portal (Caddy proxies https://portal.example.com) |
| Node-RED | 1880 | Flow editor (Caddy proxies https://nodered.example.com with forward_auth) |
| MediaMTX | 8888 | HLS playback (Caddy proxies /hls-proxy/ on the MediaMTX FQDN) |
| MediaMTX | 5080 | MediaMTX webedit (Caddy proxies the MediaMTX FQDN) |
| MediaMTX | 9898 | MediaMTX admin API (consumed by webedit on loopback) |
| CloudTAK | 5000 | CloudTAK API (Caddy proxies https://cloudtak.example.com) |
| CloudTAK | 5002 | CloudTAK tiles |
| CloudTAK | 18888 | CloudTAK media HLS |
| CloudTAK | 9997 | CloudTAK media admin API |
| CloudTAK | 9002 | MinIO web console (operator SSH-tunnels for bucket management) |
| Service | Internal endpoint | Description |
|---|---|---|
| Authentik PostgreSQL | postgresql:5432 |
Authentik DB |
| Authentik Redis | redis:6379 |
Authentik task queue |
| CloudTAK PostGIS | postgis:5432 |
CloudTAK DB (was Tier 1 + default creds pre-v0.9.11 — root cause of the PG_MEM incident) |
| CloudTAK MinIO S3 | store:9000 |
CloudTAK S3 storage |
| CloudTAK events | events:5003 |
CloudTAK background worker |
| Service | Port | Source | Description |
|---|---|---|---|
| Server One PostgreSQL | 5432 (default) | Server Two IP | Two-server TAK Server DB (was unconditional allow 5432/tcp pre-v0.9.12) |
| Guard Dog health agent | 8080 | Console IP (settings.server_ip) |
Two-server DB health endpoint on Server One |
| LDAP Outpost | 389/636 | Console IP | Reachable only when Authentik is deployed remotely; consumed by TAK Server's LDAP auth block |
| Email Relay | 25 | localhost | Local Postfix relay (apps send here) |
Each page has buttons that do specific things. Here's what they do and when to use them.
| Button | What it does | When to use it |
|---|---|---|
| Update Config | Regenerates Caddyfile, reloads Caddy, installs Let's Encrypt cert on 8446, restarts TAK Server | After changing the TAK Server domain/FQDN in Caddy settings |
| Connect TAK Server to LDAP | Full LDAP setup: repairs Authentik blueprint, ensures service account + webadmin, writes LDAP auth block into CoreConfig.xml (without flat-file), restarts TAK Server | After deploying Authentik (if TAK Server was deployed first), or if LDAP auth stops working |
| Resync LDAP to TAK Server | Same as Connect LDAP — full re-run of the LDAP fix flow | If QR registration fails, if 8446 login stops working, after pulling console updates |
| Sync webadmin to Authentik | Pushes the 8446 webadmin password from settings into Authentik (no TAK Server restart) | After changing the webadmin password |
| Disable/Enable flat-file auth | Adds or removes UserAuthenticationFile.xml from the CoreConfig auth block, restarts TAK Server |
When you want LDAP-only auth (disable) or need local password fallback (enable) |
| Set JVM Heap | Writes -Xms/-Xmx to /opt/tak/setenv.sh, restarts TAK Server |
TAK Server running out of memory (OutOfMemoryError in logs) |
| Button | What it does | When to use it |
|---|---|---|
| Sync TAK Server to TAK Portal | Forces TAK Portal to re-read the TAK Server connection (IP, certs, API URL) | If TAK Portal dashboard doesn't show TAK Server uptime/disk usage |
| Update Config | Rewrites TAK Portal's settings.json with current Authentik + TAK Server URLs, restarts the container |
After changing FQDN, after Authentik redeploy, if TAK Portal can't reach TAK Server or Authentik |
| Sync TAK Server CA | Copies the current tak-ca.pem into the TAK Portal container |
After CA rotation — TAK Portal needs the new CA to generate valid client certs |
| Button | What it does | When to use it |
|---|---|---|
| Update Config & Reconnect | Patches docker-compose.yml (PostgreSQL tuning, blueprint mounts), ensures all forward auth apps exist (infra-TAK, TAK Portal, Node-RED, etc.), repairs embedded outpost, updates LDAP CoreConfig, reloads Caddy | After pulling console updates, if forward auth breaks, if apps disappear from Authentik, if LDAP stops working |
| Fix LDAP Token | Re-fetches the LDAP outpost token from Authentik API and injects it into docker-compose.yml, restarts the LDAP container | If LDAP container shows "unhealthy" or "403 Forbidden" in logs |
| Button | What it does | When to use it |
|---|---|---|
| Switch Provider | Reconfigures Postfix with new SMTP credentials/host, restarts Postfix | Changing email provider or From address |
| Configure Authentik | Pushes relay settings (localhost:25, From address) into Authentik so password recovery emails work | After deploying or switching Email Relay provider |
- Deploy order matters: Caddy → Authentik → Email Relay → TAK Server → TAK Portal → everything else
- After pulling console updates: Hit "Update Config" on Authentik, then optionally on TAK Server if you changed FQDN
- If TAK Portal can't reach TAK Server: Hit "Sync TAK Server to TAK Portal" on the TAK Portal page
- If LDAP auth breaks: Hit "Connect TAK Server to LDAP" on the TAK Server page
- If forward auth breaks (502/blank on FQDN URLs): Hit "Update Config" on the Authentik page
- After CA rotation: Hit "Sync TAK Server CA" on the TAK Portal page, then have users re-enroll
IP Address Mode — Self-signed certificate, works anywhere (field deployments, no DNS needed)
FQDN Mode — Caddy + Let's Encrypt for proper SSL. Required for TAK client QR enrollment. Can upgrade from IP mode through the web console without SSH.
| Client | Status | Notes |
|---|---|---|
| ATAK (Android) | ✅ Working | Requires FQDN mode with Let's Encrypt |
| TAKAware (iOS) | ✅ Working | Works in both IP and FQDN mode |
- Password required before any access (set during
./start.sh) - HTTPS from the start (self-signed or Let's Encrypt)
- Session-based authentication
- All config files are 600 permissions
- Authentik bootstrap credentials auto-generated per deployment
- Authentik login branding — Custom CSS vs Brand → Attributes (
theme: dark), black backgrounds, flow wording; links to official Authentik docs and community guides. - Guard Dog — How Guard Dog works: monitors, 15‑minute boot delay and cooldowns, TAK Server soft start (after PostgreSQL and network), 4GB swap on deploy for memory stability, and restart-loop protection. Apply Docker container log limits from the Guard Dog page without redeploying a module.
v10.1.9-alpha — 2026-07-26 — Two-server database links are encrypted, fail2ban stops locking you out of your own server, and wasted disk gets reclaimed
Headline: the connection between a split TAK Server and its database is now encrypted, three ways fail2ban could lock you out or quietly stop protecting you are fixed, and servers built with unusable disk space get it back. Encrypted split-server database link. When TAK Server and PostgreSQL run on two separate machines, traffic between them — including credentials — was crossing the network unencrypted. It is now encrypted, on existing deployments as well as new ones, and the change only completes after a live encrypted connection is verified. fail2ban, three field-reported failures. On some server images fail2ban was crashing at startup, which silently stopped every jail — the server looked protected and wasn't. It could also ban the very connection used to manage the server, taking a remote box offline with no way back in; management tunnels are now permanently exempt and any existing ban on one is released. And the never-ban list is now visible in plain English instead of one opaque string, with a warning when the address you are connected from isn't covered — the case that strands someone on a server they can't walk up to. Reclaims stranded disk. Servers provisioned with a large, unusable partition (common on Rocky/RHEL images) can now hand that space back to TAK, with the existing data verified byte-for-byte before anything is removed. Red Hat installs (GH #56). A repository step could fail silently on Red Hat in the cloud and resurface three steps later as a baffling PostGIS dependency error. The installer now asks the system which repository actually exists instead of guessing. Config safety. TAK Server's main configuration file is rewritten by roughly a dozen operations and none of them kept a copy — the previous version is now always saved first. Firewall. If you had restricted the console to specific addresses, restarting it quietly reopened the port to the entire internet; it now leaves a deliberate restriction alone. Plus tighter permissions on files holding passwords and keys, and CloudTAK's approved version moves to 13.54.3. Upgrade: applied automatically on the next console update.
Full notes: v10.1.9-alpha release notes.
v10.1.8-alpha — 2026-07-24 — CloudTAK video playback fixed end-to-end, settings can no longer silently lose module config, and RHEL installs fail loudly instead of mysteriously
Headline: Video in the CloudTAK web map actually plays now — external camera feeds and live phone/drone streams both — and two classes of silent failure are gone. CloudTAK video, fixed at every layer. Clicking play on a map marker with a public camera feed (state DOT traffic cams, any public HLS URL) failed with a 404 on every deployment — the web player's requests were routed to the wrong internal service. Live RTSP streams (phones running TAK ICU, drones) were separately broken by an outdated media component CloudTAK still pins, which couldn't handle non-HTTP sources. Both are fixed: routing corrected with an automatic self-heal for existing deployments (manual Caddy patches are superseded, not fought), the media component updated to the current upstream release with its kernel requirements applied automatically, and the streaming ingest ports actually opened in the firewall — publishes into CloudTAK leases used to be silently dropped. Validated live end-to-end: phone → restreamer → CloudTAK web player, seconds behind live. ARM note: upstream ships no ARM build of the newer media component, so ARM boxes keep the current one (external feeds play; RTSP-lease browser playback remains unavailable there — upstream ask filed). Settings hardening. A rare write-race could silently drop module settings (mail relay, database config, admin credentials) while preserving core identity — recovery required manual repair. The guard now restores every setting from the last good copy, not just the core keys. RHEL 9 installs fail loudly. On genuine RHEL 9, a repository step could fail silently and surface three steps later as a baffling PostGIS dependency error (GH #56). The installer now uses the correct RHEL path automatically, verifies it, and stops with the exact fix if it can't — no more misleading errors. Plus plugin update failures can no longer leave a half-updated image behind. Upgrade: applied automatically on the next console update.
Full notes: v10.1.8-alpha release notes.
v10.1.7-alpha — 2026-07-24 — Caddy always comes back after a reboot, proactive update emails, and a new SAR containment plugin
Headline: Servers reliably restore all their web services after a power loss or reboot, you get an email when an update is waiting, and search-and-rescue teams get a new CloudTAK containment tool. Caddy reboot resilience. On some servers — particularly small edge boxes on DHCP — the web front end (Caddy) could fail to come back after a reboot because it started before the network was fully up, taking down every site behind it (the map, TAK admin, SSO, portal) until someone manually restarted it. That's fixed: Caddy now waits for the network and self-recovers if it still loses the race, so a server returns to full service on its own after a power loss or reboot — no console, no SSH. Validated across Ubuntu, Rocky/RHEL, and ARM. Proactive update emails. The console now emails you (through the same alerting path Guard Dog uses) when an update is pending — a CloudTAK plugin, CloudTAK itself, or the console — so you find out without having to open the page. You get one email per new version, not a reminder every hour. New plugin: Search Containment. An ATAK Chokepoint-style tool for SAR is now installable from the CloudTAK plugins panel: pick a shape, line, or point, set a containment distance, and it drops numbered markers wherever the trail network crosses the ring, posted straight into the active mission. Plus a clear "dev" marker on plugin cards for boxes tracking a plugin's test channel. Upgrade: applied automatically on the next console update.
Full notes: v10.1.7-alpha release notes.
v10.1.6-alpha — 2026-07-21 — Hardened deployments get map-engine updates again, and CloudTAK moves to the tested 13.50 release
Headline: On security-hardened deployments — the strictest lockdown posture, where certificate files are mounted read-only — the automatic Node-RED map-engine update could silently fail, leaving the box on the previous engine even though the console itself updated fine. That's fixed: the update now routes file delivery around the read-only mounts, so hardened boxes pick up new map-engine releases (including v10.1.5's Clear Ghosts and feed-lifecycle improvements) automatically like everyone else. Your saved Configurator feeds and settings are preserved through the update — this was validated end-to-end on the hardened posture, including configs surviving a full deploy cycle. Alongside that, CloudTAK moves to the tested 13.50 release across Ubuntu, Rocky/RHEL, and ARM, with plugin compatibility and post-update self-checks carried forward. One known ARM-only caveat: CloudTAK's optional tiles service doesn't start on ARM64 due to an upstream dependency issue — the map, API, and everything else are unaffected. Upgrade: applied automatically on the next console update.
Full notes: v10.1.6-alpha release notes.
v10.1.5-alpha — 2026-07-21 — Fire perimeters and other snapshot map layers stop leaving dead shapes stuck on devices, plus fresh installs and updates that just work
Headline: DataSync feeds built from snapshot sources — fire perimeters being the main one — no longer strand outdated shapes on tablets that were offline when the data changed, and a device that reconnects days later cleans itself up automatically. Feeds also stop the constant add/remove churn that used to flicker shapes on the map. Alongside that, several fresh-install and update paths that could stall are fixed. Updating is recommended; healthy boxes are left untouched. Snapshot map feeds get a real lifecycle. Sources like the California fire-perimeter layer publish a brand-new record every time a fire grows, which used to mean each update was a delete-and-re-add — and any device that happened to be offline at that moment kept the old outline on its map forever. Feeds can now follow a stable identity per real-world entity (e.g. per fire) so a growing fire updates the same shape in place instead of piling up ghosts, the map stops flip-flopping between competing versions of the same feature, and a new one-tap Clear Ghosts action sweeps already-orphaned shapes off every device as it reconnects over the following two weeks — no per-device cleanup, no touching anyone's tablet. The map bridge sees every channel again. On deployments where the built-in map's server connection had gotten pinned to an empty channel set, live feeds now reliably reach it. Fresh installs and updates are more robust: a brand-new server that doesn't yet have Docker now installs it correctly on locked-down setups, the automatic post-update step that refreshes map feeds could silently skip on some servers and now runs every time, and an internal permissions issue that could make a feed refresh fail on the strictest security posture is resolved. Upgrade: applied automatically on the next console update.
Full notes: v10.1.5-alpha release notes.
v10.1.4-alpha — 2026-07-18 — CloudTAK 13.49 with plugins that survive updates, a password reset that can't leave you in someone else's session, and installs/updates that heal themselves
Headline: CloudTAK moves to the tested 13.49 release and your browser plugins carry across the update automatically; the password-reset flow on hardened boxes now always ends at a fresh sign-in (never dropped into a session that was already open in that browser); and a batch of self-healing so updates and installs recover on their own instead of getting stuck. Updating is recommended; healthy boxes are left untouched. CloudTAK updates cleanly to 13.49 across Ubuntu, Rocky/RHEL, and ARM — the update carries your installed plugins (like Dispatcher) across CloudTAK's new internal layout and rebuilds them for you, and after an update the browser picks up the new version on the next reload instead of showing a blank map from a stale cache. Password recovery is safer on hardened deployments: finishing a reset now signs the browser out and returns you to the sign-in page, so a reset opened on a shared or admin machine can never leave the new user inside a session that was already open there — and completing a reset always walks you through multi-factor setup as intended. Updates and installs heal themselves: a box whose files had been left owned by the wrong user (from an earlier manual fix) could half-apply an update and quietly run two versions at once — the console now repairs ownership and completes the update on its own, telling you plainly to reboot if a step needs it, with no command line. Also in this release: new-install reliability fixes so a fresh server missing Docker or PostgreSQL is handled gracefully instead of failing mid-deploy; a Guard Dog maintenance job no longer shows a false failure on split-database boxes; and a security-hardening pass that keeps database credentials out of the audit log. Upgrade: applied automatically on the next console update.
Full notes: v10.1.4-alpha release notes.
v10.1.3-alpha — 2026-07-15 — CloudTAK updates that actually finish, a database that repairs itself, and a version pin you can trust
Headline: CloudTAK updating is fixed end to end — updates complete on slow connections, a database-password mismatch that could leave CloudTAK dead after an update now repairs itself automatically, and CloudTAK is pinned to a tested release so an update can't jump you onto a version that breaks your browser plugins. Updating is recommended; healthy boxes are left untouched. Three things went wrong when updating CloudTAK, and all three are closed. Updates no longer time out — a large rebuild on a slow VPS connection used to get killed partway through; the build now streams its progress and is given the time it actually needs. CloudTAK no longer comes back dead with a database error — PostgreSQL only accepts its password the first time a database is created and ignores it forever after, so any box whose configuration had drifted from its database would fail with "password authentication failed" the moment an update restarted it. The console now checks the two against each other after every start and repairs the mismatch itself, so affected boxes heal on their next update with no intervention. And CloudTAK now follows the same tested-version track as the identity provider and NetBird: the main channel installs only the release the fleet has validated, so a newer upstream version that hasn't been checked against browser plugins can't land on your box by surprise — including on brand-new installs, which previously pulled whatever was newest. Every module card now reads the same way: your version · what main is pinned to · update (only if there's actually one to install). Also in this release: a box whose public IP changed (common after a cloud stop/start) could write bad data into its own settings and then fail to start the console at all — that's now prevented and self-healing; CloudTAK now validates the console's certificate instead of skipping verification, so its connections are properly checked; a TAK Portal map fix so the map isn't empty for admins; and a batch of security hardening. Upgrade: applied automatically on the next console update.
Full notes: v10.1.3-alpha release notes.
v10.1.2-alpha — 2026-07-12 — Connectivity Wizard (beta): get any box online and reachable — homelab, on-prem, or in a truck
Headline: the Connectivity Wizard grows up into a field-ready (beta) tool for getting a box online and reachable anywhere — a permanent home rack, an on-prem server, or a portable kit on the move — plus power controls and platform fixes. Updating is recommended; healthy boxes are left untouched. The wizard detects your network (clean public IP, carrier-grade NAT, double-NAT) and picks the right path. The big one for portable and CGNAT boxes: a WireGuard relay on a free-tier cloud VM (e.g. Oracle Always-Free) gives your box the equivalent of a static public IP — clients connect by name, no business ISP and no port-forwarding required. Setup WiFi turns a headless box with no connection into its own access point: strand it, walk up with a phone, join its network, and pick an uplink — it comes back reachable by name, proven end-to-end over cellular. Reachability diagnostics are now honest — instead of falsely reporting "not reachable" when a box simply can't probe its own public address (normal on cloud VMs and home routers), it says so plainly and points you to a quick phone-on-cellular check, and it self-installs a detection dependency that was missing after in-place updates. This release also fixes hardened/compliance posture on boxes using a custom (bring-your-own) SSL certificate — arming the hardened posture no longer fails with a false certificate-validation error, so custom-cert deployments can enable it cleanly. Plus console Power Off / Reboot buttons (password-confirmed) and a batch of platform reliability fixes for Rocky/RHEL and portable networking. Connectivity ships as beta. Upgrade: applied automatically on the next console update.
Full notes: v10.1.2-alpha release notes.
v10.1.1-alpha — 2026-07-09 — Stability & disk protection: stops runaway database growth, fixes downloads and video on standard installs, and quiets false alerts
Headline: a reliability release that closes a disk-fill risk, restores certificate and video downloads on the standard console, and stops noisy false alarms. Updating is recommended — healthy boxes are left untouched. The big one: a background Authentik table could quietly grow without bound and fill the disk on long-running boxes; the console now watches its real size, cleans it automatically, reclaims the space, and Guard Dog raises it on the monitoring board with an alert if notifications aren't set up — so a box can never silently fill up this way again. On the standard (non-root) console, downloading certificate files (.p12/.key for client-cert admin/user login) and watching video streams in the browser both work again — two things that regressed when the console moved off root. For two-server deployments, Guard Dog no longer sends false "database not healthy" emails when the database is actually fine (it now only acts on a real outage, never restarts a healthy database, and caps repeat alerts), and its database-maintenance timers now actually run to keep the CoT database from bloating. Also included: defense-in-depth hardening on top of the v10.1.0 login-security fix, and an access-point fix so a headless box's hotspot comes up cleanly. Upgrade: applied automatically on the next console update.
Full notes: v10.1.1-alpha release notes.
v10.1.0-alpha — 2026-07-09 — Connectivity Wizard: get any box online and reachable from the browser — plus security patches
Headline: a new Connectivity Wizard that takes a fresh mini-PC from "just plugged in" to "reachable by TAK clients" entirely from the browser — plus important security and stability fixes. Updating is strongly recommended. The Connectivity Wizard (Connectivity page) detects your network situation, then walks you through the right path: set up a relay so friends and clients reach your box from anywhere with no VPN (one button — you create a free VPS, upload its key, the console does the rest), or the direct DDNS + port-forward path for a home connection with a public IP. It manages WiFi the way a phone does — scan and join, pre-provision a network you're not on yet so a portable box connects the moment it arrives, switch between known networks, and forget old ones. New Setup WiFi mode turns a headless box into its own access point when it has no connection, so you can walk up in a new location, join it from a laptop, and pick a network — no screen, no keyboard, no cable. Verify Reachability proves clients can actually reach every TAK port from the public internet (green/red per port, so you stop guessing), and your relay's health now shows on the Guard Dog board. Also in this release: security patches — updating is recommended — and a fix so TAK Server LDAP login self-heals on a fresh deploy (no more manual "Resync LDAP" after installing a new box). Upgrade: applied automatically on the next console update; healthy boxes are left untouched.
Full notes: v10.1.0-alpha release notes.
v10.0.9-alpha — 2026-07-06 — Self-healing cleanup: user management, streaming, and safer module updates
Headline: a batch of reliability fixes that repair affected boxes automatically on the next update — no manual steps. If your TAK Portal Users page ever showed "Missing AUTHENTIK_TOKEN" and you couldn't add or list users, that's fixed: the console detects the cleared identity-provider token and restores it on restart, and prevents it from being wiped in the first place. Video streaming keeps working across automatic certificate renewals — a renewal used to quietly revoke the streaming server's access to the fresh certificate and could take streaming down until a redeploy; the console now re-grants that access on startup and after any renewal. NetBird now updates on a tested-version track, the same model as the identity provider: the console shows you when a newer NetBird has shipped upstream, but only installs versions that have been validated first — so an update can't leave your overlay VPN rejecting every login. Deploying Email Relay while your identity provider is running no longer risks a timing collision that could knock the provider offline (the deploy now waits it out and self-recovers). And uploading the wrong TAK Server package for your OS now gives a clear, immediate message instead of a confusing late error. Upgrade: applied automatically on the next console update; affected boxes repair themselves on restart, and healthy boxes are left untouched.
Full notes: v10.0.9-alpha release notes.
Headline: the least-privilege "guard" that mediates every privileged action can now actually block anything outside its allow-list — and turning that on is a deliberate, one-way operator choice, so it can never surprise a production box. For several releases the guard has run in watch mode: it records what a compromised console would try but lets everything through. This release completes the allow-list so the guard recognizes every legitimate operation your servers perform (validated with zero false-flags across Ubuntu 22.04, Rocky / RHEL 9, and ARM64), then adds enforcement — but opt-in. A box never flips itself: after it has run 72 hours with a completely clean record it becomes eligible, and a new "Turn on enforcing" button appears on the Cyber Controls page. Enabling it is confirmed and one-way from the browser (turning it back off requires SSH break-glass), so a hacked console can only ever make a box more locked down. Existing boxes stay in watch mode until you press the button; brand-new installs are opted-in but still watch for 72 hours first, so a fresh box never breaks its own setup. Also in this release: TAK Server snapshots on unprivileged consoles now capture a real database dump (previously they silently shipped config-only backups with no database), with dumps authenticated so only genuine snapshots can be restored; the CloudTAK cryptominer scanner now runs correctly under the guard; and a batch of hardening from an internal security review. Upgrade: applied automatically on the next console update — your boxes keep running exactly as before, in watch mode, until you choose to enforce.
Full notes: v10.0.8-alpha release notes.
v10.0.7-alpha — 2026-07-03 — One TURN port per job: Remote Assist always on 3479, NetBird always on 3478
Headline: the Remote Assist TURN server (CoTURN) and NetBird now have a permanent port split, so they can be installed on the same server in any order without conflicts. Previously the suggested CoTURN port depended on whether NetBird was already installed — which meant the "right" port changed from box to box, and installing CoTURN first on the standard port would make a later NetBird deployment fail with a raw Docker error. Now it's fixed and fleet-wide: CoTURN always installs on 3479, and 3478 is permanently reserved for NetBird (Remote Assist clients are told the port explicitly, so nothing needs the standard port). The NetBird deploy also gained a pre-flight check: if an older CoTURN install is still holding 3478, it refuses up front with clear instructions (uninstall CoTURN, reinstall — it lands on 3479 automatically) instead of failing mid-deploy. Existing CoTURN installs keep working unchanged on their current port. Remember to open UDP/TCP 3479 + UDP 50000–50050 in your cloud security group for new installs. Validated on Ubuntu 22.04, Rocky / RHEL 9, and ARM64 (fresh ARM64 install landed on 3479 first try). Upgrade: applied automatically on the next console update; no action required unless you plan to add NetBird to a box whose CoTURN sits on 3478.
Full notes: v10.0.7-alpha release notes.
v10.0.6-alpha — 2026-07-03 — WebODM single sign-on, TURN alongside NetBird, same-domain email fixed, and scheduled TAK backups that actually run
Headline: three user-reported issues fixed end-to-end, and scheduled TAK Server snapshots now genuinely work. WebODM (GitHub #50): the TAK Incident Overlay plugin now actually appears after install (the upstream plugin shipped a packaging defect the deploy now patches automatically), and the double login is gone — WebODM's login page becomes a single "Login with Authentik" button using WebODM's native OpenID Connect, with the reverse-proxy gate still in front. Existing WebODM installs get both fixes without losing projects via the new "⟳ Reapply Plugin & Config" button on the WebODM page. Email Relay (GitHub #48): mail sent to your own domain no longer bounces with 550 User unknown — the relay is now strictly send-only and routes everything through your provider; redeploying the Email Relay applies the fix on existing boxes. TURN for EUD Remote Assist (GitHub #49): CoTURN now coexists with NetBird — on boxes running a NetBird hub it installs cleanly on an alternate port (the UI suggests one automatically), and on legacy NetBird installs it can share NetBird's own TURN with dedicated credentials; credential fields gained show/hide toggles and stricter validation. Scheduled snapshots: the TAK Server snapshot schedule used to silently never run (and left a red failed unit in systemctl) — scheduling now runs inside the console itself, catches up missed runs, enforces the retention count you configure, and cleans up the old broken timer automatically. Also fixed: the Update Now button no longer locks out for 20 minutes after a successful update; servers upgraded from older releases now reliably start Authentik's redis cache; snapshots on managed/RDS databases can capture a real database dump; and RHEL boxes lose a noisy every-few-seconds package-manager error. Works identically on Ubuntu 22.04, Rocky / RHEL 9, and ARM64. Upgrade: applied automatically on the next console update; WebODM boxes should click Reapply Plugin & Config once, Email Relay boxes should redeploy the relay (Switch Provider → same provider) to pick up the mail fix.
Full notes: v10.0.6-alpha release notes.
Headline: the infra-TAK console — and the whole TAK stack it manages — can now run as an unprivileged user instead of root, and existing servers can switch over with a single click. New installs come up non-root automatically; existing deployments get a Switch to non-root button on the Cyber Controls page. It migrates the running console to an unprivileged user, carries all of its state across, and relocates every managed service (Authentik/SSO, CloudTAK, TAK Portal, NetBird, Node-RED and more) into the new home so they stay manageable — with automatic rollback if anything doesn't come back cleanly, and without dropping SSO or your hardened firewall posture. Underneath, a small privileged broker mediates the handful of genuinely root-level operations the console still needs, so routine management no longer runs with full root. This release also completes the non-root switch on Rocky / RHEL 9 (SELinux-aware migration and firewalld-correct port hardening, so admin services stay behind the reverse proxy) and strengthens two-server (separate database host) deployments. Also fixed: TAK Video Restreamer Update Now (updates were aborting on a config conflict — they now refresh cleanly and preserve your settings), and Docker build-cache cleanup on large disks (the automatic reclaim only ran when the disk was nearly full, so big disks could accumulate hundreds of GB of stale build cache — it now caps the cache to a fixed size on every run). Upgrade: applied automatically on the next console update; switching to non-root is opt-in from the Cyber Controls page.
Full notes: v10.0.5-alpha release notes.
v10.0.4-alpha — 2026-06-24 — See exactly what your server exposes — and a server that heals its own address when the cloud changes it
Headline: a new read-only Service Exposure panel shows, at a glance, whether every part of your stack is reachable the way it should be — and cloud servers now automatically repair themselves when their public IP changes. Open the Firewall page and you get a green / yellow / red board comparing what each service should expose against what it's actually doing right now: internet-facing services (TAK, the console, streaming) are green by design; admin-only services that should sit behind the reverse proxy are flagged red the moment they're actually reachable from the internet — the exact kind of silent misconfiguration that has caused real incidents elsewhere. It's purely informational (it never changes a firewall rule), it understands both Ubuntu's UFW and Rocky/RHEL's firewalld, it correctly treats firewall-blocked and TAK Server's own connector ports as safe, and a small Exposure badge on the Console dashboard gives you the one-glance verdict with a click through to the detail. Alongside it, server-address self-healing: a cloud server that is stopped and restarted is often handed a brand-new public IP (common on AWS without a static address), which used to leave the console pointing at a dead address — a certificate-name mismatch and firewall rules aimed at the old IP. The console now re-detects its real address on startup and, only when it has genuinely changed, repairs its settings, regenerates the self-signed console certificate, and re-scopes its firewall rules automatically — so the box comes back reachable instead of broken. Works identically on Ubuntu 22.04, Rocky / RHEL 9, and ARM64. Upgrade: applied automatically on the next console update; no action required.
Full notes: v10.0.4-alpha release notes.
v10.0.3-alpha — 2026-06-24 — Your server can no longer lose its own domain: hardened config + self-healing startup
Headline: a rare race condition could corrupt the console's settings file and make a perfectly healthy server suddenly behave as if it had no domain — showing a "No Domain Configured" banner, dropping to self-signed certificates, and cascading into broken single sign-on if the domain was then re-entered. v10.0.3 makes that class of failure impossible. The settings file is now written atomically (it can never be caught half-written, even under heavy background activity or a restart), it refuses to drop the server's core identity (domain, SSL mode, OS, install paths) no matter what writes it, and on every startup the console self-heals any missing core setting — re-detecting the OS and recovering the domain from the server's own configuration — so a box comes back up on its real domain instead of a degraded state. Four related hardening fixes ride along: the domain-change flow no longer produces a malformed sign-on hostname (which could break SSO with an "Authentik — Not found"); single sign-on redirects always point at a browser-reachable address; the console always finishes starting even if Authentik's LDAP component is briefly unhealthy (it heals in the background instead of hanging); and the identity provider can no longer get stuck in a database-lock restart loop on a slow disk. Finally, servers that installed TAK Server natively on ARM before container support existed are now correctly detected as running (they were wrongly shown as "Stopped"). Works identically on Ubuntu 22.04, Rocky / RHEL 9, and ARM64. Upgrade: applied automatically on the next console update; no action required — and the protection is most valuable on long-running servers.
Full notes: v10.0.3-alpha release notes.
v10.0.2-alpha — 2026-06-22 — Guard Dog reclaims runaway Docker build cache before it fills your disk
Headline: Guard Dog now automatically reclaims dead Docker build cache, a hidden disk hog that can quietly fill a server's root disk and look like a database or log problem when it isn't. Servers that update containers over time (CloudTAK and other module rebuilds) silently accumulate tens — sometimes hundreds — of gigabytes of stale Docker BuildKit cache. On a smaller disk that can climb toward 100% and start breaking things, even when TAK's own database and logs are perfectly healthy. Guard Dog now watches for this and cleans it up on its own: it keeps the last 7 days of cache so rebuilds stay fast, and only acts when the root disk is getting tight (70%+), so boxes with plenty of room are left untouched. It self-heals within the hour (riding the existing hourly disk monitor) and also runs a daily pass, and it never touches your running containers, images, or named volumes — only dead build cache. Reclaimed space is logged and shown on the Guard Dog page. Works identically on Ubuntu 22.04, Rocky / RHEL 9, and ARM64. Upgrade: applied automatically on the next console update; no action required.
Full notes: v10.0.2-alpha release notes.
Headline: the universal-installer goal is here — infra-TAK now deploys and self-manages on Rocky Linux / RHEL 9 and on ARM64 hardware, in addition to Ubuntu 22.04, from the same single-clone install. The installer detects your OS, package manager, and CPU architecture and configures the whole stack accordingly — including the firewall, which now works identically on RHEL's firewalld and Ubuntu's ufw: the firewall page and the one-click Cyber Controls hardening (default-deny, console lockdown, SSO + MFA) behave the same on every platform, with no change to how you use them. Fresh RHEL installs come up hands-free — firewalld is installed and started automatically (without ever locking you out), TLS/Caddy self-heals around an EL9 packaging quirk that could otherwise abort the very first deploy, and service-health detection understands RHEL's package and service names. This release also folds in EUD Remote Assist improvements: cleaner module naming, administrator rights passed through from your single sign-on, hardened security headers, more reliable in-place updates, the device API correctly opened on RHEL, and a clean automatic migration from the previous install. ARM64 caveats: Cesium 3D-tiles (pmtiles) and Federation Hub are not yet available on ARM. Upgrade: applied automatically on the next console update; existing Ubuntu deployments are unaffected.
Full notes: v10.0.1-alpha release notes.
v0.9.60-alpha — 2026-06-15 — EUD Remote Assist: accurate version checks and an on-demand update check
Headline: the EUD Remote Assist module now reports its available version reliably and refreshes the moment you ask it to. The module's "newest version available" check has been reworked to query GitHub directly and cache results sensibly, so the displayed version stays accurate and no longer gets stuck. A new 🔄 Check button lets you re-check for a newer release on demand — handy when a new build has just been published — and the installed-version and update-ready indicators update in place without a full page reload. Upgrade: applied automatically on the next console update.
Full notes: v0.9.60-alpha release notes.
Headline: a new marketplace module for remotely managing company-owned Android end-user devices — device registration, live location, ping, and full screen view with remote touch — all behind your existing single sign-on. Deploy EUD Remote Assist from the Marketplace and the console clones it into Docker, provisions an Authentik OIDC application, and publishes an admin portal at https://remote.<your-domain>. Sign-in is restricted to the same administrators as the console (the authentik Admins group); Android devices connect over a dedicated, separately-firewalled device API. One-click deploy, update, start/stop, logs, and removal are built in, with the portal's own version tracked alongside the console's other modules. Upgrade: applied automatically on the next console update; open the Marketplace and choose EUD Remote Assist to deploy (requires a configured domain and Authentik).
Full notes: v0.9.59-alpha release notes.
Headline: the console dashboard stays usable on SSO-protected deployments, and brute-force protection can no longer accidentally lock out your own gateway. On deployments where the console sits behind single sign-on, the dashboard's background calls — the "Check for new release" and "What's using CPU/RAM" buttons and the live gauges — could fail once your login session lapsed: the page still looked logged in, but those controls quietly errored until you reloaded. The console now handles an expired session cleanly so the buttons keep working as expected. Brute-force protection (fail2ban) gains a trusted-upstream whitelist: on a box behind a reverse proxy, load balancer, or cloud gateway, the upstream's address is never banned — preventing a self-inflicted outage where one traffic blip could block every site at once. The console's web server also picks up its full thread count on a plain restart (not only via Update Now), so busy single-worker consoles stay responsive. Upgrade: applied automatically on the next console update.
Full notes: v0.9.58-alpha release notes.
Headline: every deployment now updates to Authentik 2026.5.3 — the performance-fixed release — not just dev-channel boxes. v0.9.57 fixed the Authentik high-CPU / sluggish-sign-on issue by moving to Authentik 2026.5.3, but only for boxes on the development channel; standard deployments stayed on the older 2026.2.3. This patch promotes 2026.5.3 to all deployments, so your identity provider updates to the current, performance-validated release on the next console update — snappier single sign-on and lower idle CPU. The 2026.2.3 → 2026.5.3 upgrade path was validated on a live production deployment and the test fleet. Upgrade: Authentik pulls 2026.5.3 and restarts automatically on the next console update.
Full notes: v0.9.57.1-alpha release notes.
v0.9.57-alpha — 2026-06-14 — Authentik performance fix + self-healing, console reliability, and TAK Portal QR enrollment
Headline: Authentik runs cool again, the console dashboard stays responsive under load, and TAK Portal enrollment QR codes point devices at the right server. Authentik is updated to 2026.5.3, which fixes an upstream bug that pegged the identity provider's CPU and made single sign-on feel sluggish even on an idle system — logins are snappy again. A box that had already built up a large Authentik background-task backlog now clears it automatically on the next console restart, so the high-CPU condition self-heals without any manual database work. The console dashboard is more reliable on busy boxes: the "What's using CPU/RAM" and "Check for new release" buttons no longer fail while the page's background refreshes are running, and the memory gauge now reads accurately. Guard Dog no longer raises a false "network down" alert on cloud/Azure hosts that block ping (it confirms real internet egress another way), and it now reclaims leftover swap automatically after a memory spike. And TAK Portal enrollment QR codes once again carry your server's real hostname instead of an internal Docker address, so scanning a QR enrolls a device correctly — while the Portal still reaches an on-box TAK Server reliably. Upgrade: applied automatically on the next console restart.
Full notes: v0.9.57-alpha release notes.
Headline: cloud and gateway-fronted deployments get more reliable — TAK Portal reconnects to a local TAK Server even behind a load balancer, fresh CloudTAK deploys come up clean, and Authentik stops growing its database without bound. TAK Portal now reaches an on-box TAK Server through the Docker host even when your domain resolves to a TLS-terminating front end (an App Gateway or load balancer) whose certificate doesn't chain to TAK's CA — the case that previously left the Portal unable to sync — and it derives the TAK certificate password from the certificate itself, so a mismatched setting can't silently break the connection. Fresh CloudTAK deploys now harden their container ports before the containers start, so the video port no longer collides with the web proxy and leaves a blank map page — the map serves correctly on the first deploy. Authentik event-log retention is now capped to a sane window instead of the year-long default that let the events table — and its CPU cost — grow without bound. In the hardened security posture, the 30-minute idle auto-logout now truly re-prompts through single sign-on instead of silently refreshing, and a new off-box audit option (syslog/CEF to your SIEM) keeps a tamper-resistant copy of the console's audit trail. Upgrade: applied automatically on the next console restart; the CloudTAK port fix takes effect on its next deploy.
Full notes: v0.9.56-alpha release notes.
Headline: flip your whole TAK stack into a hardened security posture in one click — and back out just as easily. The new Cyber Controls page adds a Standard↔Hardened toggle that closes the security gaps a reviewer fails a system for, then self-documents what it did. In Hardened posture: per-user single sign-on with enforced multi-factor authentication on every app behind Authentik (console, Node-RED, TAK Portal, WebODM, MediaMTX, NetBird), with MFA force-enrolled at first login so no account slips through; the admin console is taken off the public internet (reachable only through authenticated SSO) and its shared password becomes an on-box break-glass recovery, not a network login; a 30-minute idle auto-logout; a per-user audit log (who/what/when); read-only boundary checks (firewall deny-by-default, intrusion prevention, TAK Tomcat exposure); and a printable readiness report plus an editable "what to tell your security office" statement. Every control is reversible with one click, and the on-box recovery path means hardening can never permanently lock you out. TAK clients (ATAK/iTAK/CloudTAK) and TAK Server keep their native authentication and are unaffected. Login screens also got plainer, on-brand wording. Upgrade: the Cyber Controls page appears automatically; the default stays Standard (no change to current behavior) — enroll an MFA device, then flip to Hardened when you're ready.
Full notes: v0.9.55-alpha release notes.
Headline: Guard Dog now catches the slow-disk problem that silently takes TAK stacks down — and the CloudTAK "update available" banner stops crying wolf. On shared/cloud hosting, a disk can pass a normal speed test while individual database writes stall for seconds — exactly the condition that quietly snowballs into an Authentik/login slowdown. Guard Dog now measures small-write commit latency directly (the metric that actually matters for the database), charts it alongside throughput, and warns you when it crosses a safe ceiling. Even better, when slow commits coincide with the database having clients waiting, Guard Dog sends a distinct "provider disk contention — act now" alert that points you at your host before an outage instead of after — and its disk report now matches the small-write numbers your provider quotes. Also in this release: CloudTAK's "Update Now" no longer shows a stuck "update available" badge after a successful update — CloudTAK's upstream sometimes ships a release whose internal version label lags the release tag, which made the console think an update never took; the console now reads the release correctly and shows the true version. Upgrade: applied automatically; the new disk-latency watch rides Guard Dog's existing schedule and the CloudTAK fix takes effect on the next console restart.
Full notes: v0.9.54-alpha release notes.
Headline: stand up a private, self-hosted VPN for your TAK deployment in one click — with single sign-on built in. NetBird gives you a zero-trust WireGuard overlay network deployed straight from the console — no SSH, no third-party VPN service, no cloud dependency. You sign in with your existing Authentik accounts (the same identity as the rest of your TAK stack), and access is restricted to operators: the VPN is bound to your admin group, so an ordinary SSO user can't join the network. Use it to securely reach your TAK box, or to link sites and remote sensors over an encrypted private overlay. The module pins vetted NetBird images for fleet-consistent installs and reloads the web proxy gracefully so other services stay online during deploy. Upgrade: the NetBird module appears in the console — deploy it when you want it; existing services are unaffected.
Full notes: v0.9.53-alpha release notes.
Headline: ArcGIS feeds can now be styled per feature class, and coded data fields show their real labels everywhere. Polygon and polyline feeds get per-class styling — distinct stroke color, fill color, fill opacity, line thickness, and line style for each class, with anything you leave unset inheriting the feed's uniform style. Coded-value fields (a field that stores a number like 1/2 that actually means something like "Infested Zone"/"Adjacent Surveillance Zone") now display the human label everywhere — the configurator preview, the class and source-filter pickers, the on-map callsign, and the DataSync feed's item names — instead of the raw code. Large polygons render much smoother in TAK while staying light enough not to stall the web client: each feed automatically gets a per-shape point budget tuned to how many features it has, so a handful of big boundaries keep their detail while a feed of hundreds stays performant — no tuning required. Also in this release: style and label edits now reliably reach TAK on the next sync; the per-feed TAK group is no longer hardcoded; and the dev-channel update path is more reliable. Upgrade: applied automatically; existing feeds are unaffected and pick up the improvements on their next sync.
Full notes: v0.9.52-alpha release notes.
Headline: you can now use your own TLS certificate instead of Let's Encrypt. When you set up your domain (or later on the Caddy page) you can choose Custom certificate and upload your own full-chain PEM + private key. It's applied to every subdomain and to TAK Server's enrollment endpoint, so infra-TAK works behind a corporate gateway/WAF or on networks where automatic (ACME) certificates can't be issued — the box never even attempts Let's Encrypt in this mode. Your upload is validated first (the key matches the certificate, it isn't expired, and it covers your hostnames), Caddy reloads with no downtime, and there's a one-click switch back to automatic. Renewal is a manual re-upload, with the existing certificate-expiry indicator and Guard Dog alert watching the date. Also in this release: uninstalling a service (MediaMTX, TAK Video Restreamer, Node-RED) now removes it cleanly from Authentik instead of leaving a dead entry behind — and any box that already had a leftover is tidied up automatically on the next restart; and the TAK Video Restreamer "update available" check is now reliable. Upgrade: applied automatically; no action required.
Full notes: v0.9.51-alpha release notes.
Headline: updating your box will no longer wipe the feeds you built in the Node-RED Configurator. Configurator configs (ArcGIS/TAK feeds, TextChat, PulsePoint, IPAWS, TAK settings) live in Node-RED's in-memory state, and a chain of flaws in the backup/restore path could erase them on an update or restart — and the emergency restore sometimes loaded nothing. This release hardens that path end to end: configs are now backed up to disk the instant you save or delete one; the persistence setting is written to the file Node-RED actually reads (and verified); a restore can never replace your live feeds with an older, smaller backup (it keeps the larger set); and the restore screen now tells you the real config counts instead of silently "succeeding" with an empty backup. Field-validated on two boxes (≥99-min soak): a full update kept every config, and they also survived a Node-RED restart. Also: CloudTAK's /sw.js is now served no-cache so the browser picks up new builds sooner, and stale "hard-refresh" advice (which never worked) was replaced with the Clear site data steps that do. Upgrade: applied automatically. Configs already lost before this release can't be recovered, but anything you (re)create now will stick.
Full notes: v0.9.50-alpha release notes.
Headline: updating CloudTAK from the console works again, and the version readout tells the truth. Two fixes. (1) "Update Now" no longer fails at the final step. Updating to the current CloudTAK release used to die with address already in use on port :9997: the update checks out the new version, which resets CloudTAK's container port bindings back to the public defaults, and that collided with the auth-gated video proxy added in v0.9.48. The updater now re-applies the loopback port hardening immediately after checkout, so the rebuild completes and the box lands on the latest CloudTAK — this also re-closes a set of CloudTAK admin ports that every past update briefly re-exposed until the next restart. (2) No more phantom "update available." When CloudTAK's published version number lags its release tag, a fully-updated box used to show a permanent "update available" badge; the console now recognizes it is current and clears the badge, while still flagging a genuinely failed update. Upgrade: applied automatically — after updating the console, run CloudTAK Update Now to move to the latest CloudTAK.
Full notes: v0.9.49-alpha release notes.
Headline: CloudTAK's built-in video proxy now works end-to-end. When a CoT carries a video URL from a separate media server — an RTSP or SRT feed (e.g. a drone published to another MediaMTX) — CloudTAK's embedded media server now ingests it and serves browser-playable HLS, and it keeps playing instead of dropping after ~10 seconds. Four root causes fixed: (1) CloudTAK addresses its media server on port :9997, which the console's reverse proxy never exposed, so every video lease timed out — the console now fronts that port (still TLS + auth-gated, no new attack surface); (2) the embedded media server's HLS profile is tuned for low-latency playback (~3s behind the source); (3) a teardown bug that deleted the active viewer's stream every 10 seconds is fixed, so video holds while open and is still cleaned up on close (no leak); (4) SRT feeds whose stream id contains # (e.g. ATAK's UAS Tool) now connect automatically with no manual URL edits. All of it is applied as a self-heal that converges on every box and survives CloudTAK updates. Also in this release: the CloudTAK updater now surfaces the real error when an upstream rebuild fails (instead of a misleading "docker-compose: not found"), and the console reports the actually-running CloudTAK version. Upgrade: applied automatically on update — no action needed.
Full notes: v0.9.48-alpha release notes.
v0.9.47-alpha — 2026-06-07 — Custom TAK Portal domain · Network & Fanout metrics · WebODM resource cap
Headline: three areas. (1) TAK Portal links + Authentik forward-auth now honor a custom Caddy domain. If you set a custom TAK Portal domain in the Caddy module (e.g. portal.<fqdn> instead of the default takportal.<fqdn>), the console's TAK Portal buttons, the Self-Service Enrollment URL, and — critically — Authentik's proxy external_host now all resolve that configured domain instead of hardcoding takportal.<fqdn>. The startup canonicalizer used to silently revert Authentik's external_host back to the default on every restart, breaking forward auth on the custom host (GH #41); it no longer does. IP-only / no-FQDN boxes are unchanged. (2) Network & Fanout monitoring panel (Guard Dog extension) makes TAK Server CoT-fanout load browser-visible — external NIC throughput, kernel :8089 send-queue depth (the leading indicator of fanout backpressure, separated from stalled connections), connected-client count, and JVM heap, each with an inline "how to read it" guide. (3) WebODM hardening: a co-located ODM processing job is now hard-capped (CPU + memory + thread concurrency) so it can't starve or OOM the rest of the TAK stack — applied at deploy and self-healed onto existing WebODM installs on the next console restart, no redeploy (GH #32); plus the WebODM remote-deployment Test connection / Save / SSH-key buttons now correctly show success instead of a false red error (GH #31).
Full notes: v0.9.47-alpha release notes.
Headline: two areas, both surfaced by a field-reported split (two-server) deployment. (1) Federation Hub can no longer be deployed on the same OS as TAK Server. The hub's JVM + MongoDB would contend with TAK Server's JVM + Postgres for RAM (MongoDB alone defaults to ~50% of system memory) and a single outage would take down both. The Deployment Target page now disables the "this machine" option and forces a separate SSH target when TAK Server is present — a dedicated console host with no TAK Server still deploys the hub locally; an already-deployed local hub is grandfathered with a migrate-recommended notice. (2) Split-deployment security + reliability hardening. The Guard Dog Health Agent on the remote DB server now turns green on private-LAN splits: its :8080 UFW rule is scoped to the source IP the DB box actually sees from the console ($SSH_CLIENT), not a possibly-private configured server_ip — and a UFW rule-ordering bug (a deny appended above the allow, so first-match-wins kept blocking) is fixed. The remote Postgres 5432 and the Federation Hub UI 8080/9100 ports that earlier builds left ALLOW Anywhere (Postgres and the hub admin UI, incl. plaintext 8080, reachable from the internet) are now scoped to the console and denied to the world — the legacy broad allow that shadowed the deny is deleted, the core never loses its DB, and the Fed Hub firewall re-converges on every console restart with no .deb update. The Guard Dog DB-auth check no longer false-fails when the database password contains an XML-special character (&/</>/"/') — it decodes CoreConfig's XML entities like TAK's JDBC does, and surfaces the real PostgreSQL error (password vs pg_hba vs missing-db) instead of a blanket "rejected". And remote VACUUM/REINDEX no longer leak a harmless-but-alarming could not change directory to "/root" warning.
Full notes: v0.9.46-alpha release notes.
Headline: webadmin 8446 login now works on self-hosted boxes behind NAT that lack hairpin routing (home lab / Hyper-V / Starlink) — even with a public IP and full port forwarding. The Authentik LDAP outpost's internal→FQDN routing migration was silently aborting on those boxes: its pre-check needed NAT hairpin (a container reaching its own host's public IP), the docker exec wget probe hung until a 15s timeout, and the box stayed on spiral-prone internal routing — so webadmin cold binds died with exceeded stage recursion depth (a flow spiral, not a wrong password) and 8446 rejected the correct password. The migration now treats the hairpin timeout as the signal it is and routes the outpost to Caddy via the host gateway (extra_hosts: host-gateway) instead, with the existing post-recreate validation + auto-rollback as the safety net; the Resync LDAP to TAK Server button runs it directly and visibly. Plus three supporting fixes: the LDAP bind verifier no longer shows a false-red "NOT READY" when ldapsearch can't be installed (tri-state OK / FAIL / UNVERIFIED, with a hardened install that rides out apt locks); the outpost-log diagnostic is un-truncated and classifies the failure (flow spiral vs invalid credentials vs authenticated); and the Download Certificates password no longer shows the pre-deploy default until you refresh.
Full notes: v0.9.45-alpha release notes.
Headline: the console (takwerx-console, gunicorn 1 worker / 4 threads) can wedge — the worker stops serving while port 5001 stays in LISTEN, so systemd still reports active (running) and nothing recovers it; front door and backdoor both hang while Authentik stays up (observed in the field after 5–7 days of uptime). The only periodic restart in the project was Authentik's — the console had none. This adds takconsolerestart.timer: a daily 04:00 oneshot that bounces the console (idle-gated via a new localhost-only GET /api/console/restart-safe, so it defers if a deploy/update is in flight and restarts immediately if the worker is unresponsive). Self-installs on every boot via _startup_migrations, so fresh installs and existing boxes both get it on their next restart. Bonus: a long-lived console now loads pulled code instead of running a stale process across git pulls.
Full notes: v0.9.44-alpha release notes.
Headline: two areas. (1) CloudTAK Dispatcher plugin — a Computer-Aided Dispatch panel inside CloudTAK, installed from CloudTAK → Plugins and deployed from its own public repo (takwerx/cloudtak-dispatcher-plugin, like the ping plugin). Works standalone with no TAK-CAD server plugin: incidents are server-backed in CloudTAK's own Postgres (shared across dispatchers), drawn on the map as native CoT and optionally pushed into a DataSync feed so every client (ATAK/iTAK/TAK Aware/WinTAK) sees them; multi-select responder assignment with notification over mission thread + direct message; markers use a foldered color-less iconsetpath that renders on all field clients. Auto-upgrades to full TAK-CAD mode when the TAK-CAD server plugin is detected. (2) webadmin LDAP spiral deploy hardening — fresh TAK Server installs on boxes that can't reach FQDN/Caddy routing (no public IP / no LE cert / slow disk) were dead-ending at the final webadmin LDAP-bind verification with exceeded stage recursion depth (a flow spiral, not a bad password). The deploy now repairs the flow before retrying, the verifier no longer destroys the webadmin user on a spiral verdict (which had wiped the cached session and locked the box into a cold-spiral loop), and a verify miss no longer aborts the whole deploy. Plus CloudTAK plugin install/update robustness (copy-not-symlink, restore plugins after a CloudTAK update, container-ID version check, GitHub-tag-fetch tolerance).
Full notes: v0.9.43-alpha release notes.
New Marketplace module: TAK Video Restreamer (raytheonbbn/tak-video-restreamer) — a Flask + MediaMTX + FFmpeg streaming server deployed as a Docker container, behind Caddy at stream.<FQDN>. Mutually exclusive with the standalone MediaMTX module (shared streaming ports; the console blocks deploying both). Built-in Flask admin login (separate from Authentik), changeable without a rebuild. RTSP/RTSPS/SRT/RTMP/HLS-ABR endpoints, Guard Dog HTTP monitor on /login:3100, Update Now via git pull + docker compose up -d --build.
Full notes: v0.9.42-alpha release notes.
Two bug areas: (1) LDAP identification-stage spiral — a silent PATCH failure left every webadmin bind returning error 49, spiraling across resync attempts. (2) Azure External DB — five hardening fixes covering extension provisioning, deploy gating, SchemaManager execution, uninstall cleanup, and a malformed-XML crash from & in generated passwords.
Full notes: v0.9.41-alpha release notes.
v0.9.40-alpha — 2026-05-27 — Azure PostgreSQL end-to-end support + CloudTAK first-time setup guide + MediaMTX readiness fix
Headline: four areas. (1) Azure PostgreSQL Flexible Server — full end-to-end External DB support: auto-create cot database, grant azure_pg_admin to martiuser, pre-create all 5 required extensions as admin so SchemaManager never hits the extension permission wall, Test Connection Azure extension probe with exact portal instructions if any are missing, collapsible Azure pre-flight guide in the UI, uninstall drops the remote cot database for clean re-deploy. (2) External DB UX fixes — button order corrected (Provision → Test), admin username field uses placeholder instead of hardcoded postgres, passwords with # no longer break psql -v parser, provision correctly targets postgres DB first, deploy mode preserved after Configure. (3) CloudTAK first-time setup guide — collapsible three-step card on the CloudTAK page: create cloudtakadmin in TAK Portal (with org-suffix warning), download user.p12 + cert password from Certificates page, configure CloudTAK with takserver.fqdn + credentials + cert; bootstrap is one-time, subsequent users just log in with username and password. (4) MediaMTX readiness poll — deploy now waits up to 30s for systemctl is-active mediamtx before declaring success, eliminating the "Not Found" error when operators hit stream.fqdn immediately after deploy.
Full notes: v0.9.40-alpha release notes.
Older releases: GitHub Releases tab — each tag carries its full release notes.
MIT
Built by TAKWERX for emergency services.