Coder Social home page Coder Social logo

docker-atak-server's Introduction

Run TAK Java server in container

tldr:

cp takserver.env.example takserver.env
# edit the env
# export the variables gomplate uses (see the .tpl files)
docker compose pull --include-deps --ignore-pull-failures
docker compose -p tak up -d

or use docker compose.local.yml without gomplate for local dev (rebuilding containers):

export DOCKER_TAG_EXTRA="-dev"
docker build --no-cache --progress=plain -t takserver:latest${DOCKER_TAG_EXTRA} -t takserver:4.7-RELEASE-32${DOCKER_TAG_EXTRA} -t pvarki/takserver:4.7-RELEASE-32${DOCKER_TAG_EXTRA} .
cp takserver.env.example takserver.env
# edit the env
docker compose -f docker-compose.local.yml -p tak up

Note, for things that live in the volumes (like TAK certs) you must nuke the volumes to see changes:

docker compose -f docker-compose.local.yml -p tak down -v ; docker compose -f docker-compose.local.yml -p tak rm -vf

Creating client packages locally

Using the REST API is probably nicer though

Create client package:

docker compose -p tak exec takserver_api /bin/bash -c 'CLIENT_CERT_NAME=replaceme /opt/scripts/make_client_zip.sh'

Then get /opt/tak/certs/files/clientpkgs/replaceme.zip out of the container:

docker compose -p tak exec taktakserver_apiserver /bin/bash -c 'base64 /opt/tak/certs/files/clientpkgs/replaceme.zip' | base64 -id >replaceme.zip

This approach also works for recovering the admin cert (/opt/tak/certs/files/admin.p12 unless you changed the ADMIN_CERT_NAME ENV)

Creating new admin users

Create the user on the takserver container:

docker compose -p tak exec takserver_api /bin/bash -c 'cd /opt/tak/data/certs/ && CAPASS=$CA_PASS PASS=replaceme_user_cert_pass ./makeCert.sh client replaceme_username && ADMIN_CERT_NAME=replaceme_username /opt/scripts/enable_admin.sh'

See above about the hard way of getting the cert file, or use the REST API.

Gradle builds

Build the distribution:

mkdir outputs
docker build --progress=plain -f Dockerfile_build --target files -t atakbuild:files  .
docker run --rm -it -v `pwd`/outputs:/output atakbuild:files

Now you have the build artefacts in outputs -directory.

docker-atak-server's People

Contributors

rambo avatar syvanen avatar virtuoosi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

docker-atak-server's Issues

WinTAK tietohuolto

Ohje tietojen poistosta käytön jälkeen.

Pelkkä ohjelman poisto ei riitä, vaan tiedot pitää poistaa winTAK:n sisällä, koska muuten edellisten käyttöjen tiedot (mm. palvelin) jäävät WinTAK:iin.

  • Word
  • Online

WebTAK does not work

complains something about not being able to load some resources, investigate.

Need capability to synchronize data between multiple devices

Need to install DataSync TAK Plugin into a TAK server.

DataSync

The Data Synchronization plug-in is used to synchronize multiple ATAK devices involved in the same exercise or event. This plug-in requires TAK Server 1.3.3+. TAK Server stores all data for a "mission" in a server side database. Clients may subscribe to a mission to receive dynamic updates when a mission changes, or to synchronize data missed while a given device was disconnected.

Plugin can be fould from the Github repository TAK-Product-Center/Server

Have to find out which pluggins are needed to fill needed fuctionality. Possible plugin could be.

  • PluginDataFeed
  • PluginMissionApi

Investigate what it will take to Dockerize TAKServer properly

The official distribution docker is a mess to put it lightly, the shell scripts are fragile, everything runs as root etcetc.

There are multiple Java processes so the "right" way probably would be to make a docker composition where each process is in their own container but they talk to each other, all the certificate and client mission package stuff should probably be wrapped into Python (or some other less quick-and-dirty than bash -language) to make them less fragile, same for the initialisation stuff (which in a composition should be it's own container the others depend on). Make things run with least privilege etc.

Then split all of these things into tasks (remember that task:l is 4h) with clear descriptions.

Admin user creation via REST API needs to be able to talk to the TAKServer and tell it to add and authorize the user, IDK if the best way is to run some sort of RPC on the container with the server process and have the REST API call that via the internal network.

TAK-server admin-tunnukset tilaajalle

Tilaajalla tai käyttäjällä tarve päästä luomaan uusia User Grouppeja, jotka mahdollistavat datafiidien näkyvyyden rajoittamisen.

Päätettävä toteutetaanko näin vain toiinallisuutena TAK Admin loppukäyttäjän työkaluun.

Kuinka saadaan
[ ] admin-tunnukset tilaajalle
[ ] admin-sivun url-tilaajalle

Feature: REST API for creating and fetching client mission zips

@jhulkko pls add your notes...

  • bearer-token auth for endpoints (except /openapi.json), given to container like all the other things right now, via ENV
  • API container needs letsencrypt/cerbot to a trusted https cert
  • GET /api/v1/client/{clientname} returns the client-zip if it exists
  • POST /api/v1/client/{clientname} returns bad request if client-zip exists, otherwise creates and returns it
    • needs to be atomic, the "does client already exists" -check must be made also before moving the zip to the directory where the ready ones are held, needs changes to make_client_zip.sh
  • GET /api/v1/client returns list of existing client zips

This API is intended for internal use only, end-users will not fetch their client-configs via it, there is a separate frontend for that (see Markus Sandelins flowchart).

FastAPI is probably a decent way to do the API part, we also need certbot (see the mumbleserver docker for example) to get TLS certs for the API since it won't be using MTLS

Remember https://github.com/PVARKI-projekti/markdown-pvarki-best_practises/blob/main/python.md

Since this is actually more than a large task split into smaller units: #9, #10 and #8

Sync toiminnallisuus

[ ] Pluginien toimivuus (Android, iOS, Windows)

  • Luo ja Testaa erillaiset käyttötapaukset eri versioiden välillä
  • Testitapaukset
  • Tavoitteena saada ymmärrys miten erillaiset toimenpiteet näkyvät eri versioissa/ logi merkinnöissä--> Mahdollistaa toimintatavoista päättämisen ja ohjeistuksen luomisen

[ ] TAK Missiot toiminnallisuus ja tarvittavat vakio Missiot (Suunnittele)

  • Thtävä päätös onko yksi vai kaksi Misionia aluksi. Testaaminen ja suunnittelu aloitetaan yhdellä missionilla

Linkatut issuet

Feature: REST API for fetching user certificates

Extension to #4 see other requirements from there

  • GET /api/v1/user/{username} returns the users pkcs12 certificate if it exists, note the private keys are encrypted and server does not store the password.

Changes to the default configuration file

Following changes are needed to default configuration file TAK_defaults.pref

  • All measurement configuration
    • have to be defined
  • location send interval
    • have to be defined
  • Toolbar configuration
    • Add and remove tools, have to be defined
  • Tools Arrange, remove and add needed icons
    • have to be defined

Correct values have to be tested for first two cases.

  • "alt_unit_pref" class="class java.lang.String">1< --> value should be 2 (meters (m))
  • "speed_unit_pref" class="class java.lang.String">1< --> value should be (KM per Hour (kmph))
  • "rng_meters_display_pref" class="class java.lang.String">2000< --> value should be 1000

Changes to the default configuration file, default reporting times

Have to make decision concerning default reporting rates. When decision is made changes to default configuration file have to be done.

Things to consider
We don't want to drain user devices batterys.
What is needed reporting times in basic use cases.

  • dynamicReportingRateStationary

  • dynamicReportingRateMin

  • dynamicReportingRateMax

  • constantReportingRate

What would be way of working when defaults values have to be changed? This have to be opened in to a user manual. Also defaults values have to be told to users. Also other battery usage matters have to be opened to users.

**Following vallues have to be updated to the TAK_defaults.pref **
"dynamicReportingRateMaxUnreliable" class="class java.lang.String">15<
"dynamicReportingRateMinUnreliable" class="class java.lang.String">45<
"dynamicReportingRateStationaryUnreliable" class="class java.lang.String">240<

"dynamicReportingRateMaxReliable" class="class java.lang.String">10<
"dynamicReportingRateMinReliable" class="class java.lang.String">20<
"dynamicReportingRateStationaryReliable" class="class java.lang.String">300<

"constantReportingRateUnreliable" class="class java.lang.String">45<
"constantReportingRateReliable" class="class java.lang.String">45<

[ATAK] Datapackage query from server returns a certificate error from ATAK client, yet no problem with ITAK/Wintak

Image

When attempting to check takserver for available datapackages, the ATAK client on Android returns this error. This effectively disables a command post of sharing data packages tailored for a certain mission (e.g., points, grids, perimeter boundaries and so on).

Reference talk in TAK community discord: https://discord.com/channels/698067185515495436/699262529767211108/773969279401328650

Feature: REST API for creating user certificates

Extension to #4 see other requirements from there

  • POST /api/v1/user/{username} returns bad request if client cert exists, otherwise creates and returns it.
    • password is a required POST parameter
    • needs to be atomic

Split into separate issue from #5 because during implementation I found out that this cannot be done without some redesigns on the takserver container side.

Havainnon käsittelyn toimintatavantestaus

Kumpi malli toimintamalli toimii?

1.) KOPA luo havainnoista täysin uuden vahvistetun merkin ja poistaa havainnot
2.) KOPA muokkaa havainnon vahvistetuksi merkiksi ja poistaa mahdolliset dublikaatit

Figure out how to cleanly (and *quickly*) reload CRLs in takapi process

HUP restarts whole process, which is sloooooow. USR1 is unknown and kills the process USR2 causes segfault...

Another option is to automatically create a config XML that does not have CRL enabled and use that for the takapi process. since CoT handles CRL changes cleanly the user in question will at least drop out of updates and lose admin privileges so their remaining WebTAK access is going to be rather impotent.

#61 is relevant.

TAK-server admin-ohje

Käyttäjien, missioiden ja groupien hallinnointiin toimenpiteet, jotta DataSync saadaan toimimaan halutusti

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.