Run your own TAK server

For ZYRNTOPO Team Sync · free and self-hosted

The short version: one command on a VPS, a Raspberry Pi or any Linux or Mac box installs the whole stack under Docker. Your team's positions, messages and markers stay on hardware you own and never reach a ZYRNTOPO server.

1. Install it

Install

curl -fsSL https://zyrntopo.com/tak-server.sh | sh

That downloads the kit, checks it against the published SHA-256, unpacks it to ~/zyrntopo-tak-server and runs the installer. It refuses to continue on a checksum mismatch. Expect a few minutes on a desktop and closer to twenty on a Pi — it builds from source.

To pass the installer an option, give sh a -s -- first:

Install with an option

curl -fsSL https://zyrntopo.com/tak-server.sh | sh -s -- --tailscale

Variable	Effect
`ZYRN_TAK_DIR`	Where the kit unpacks. Default `~/zyrntopo-tak-server`.
`ZYRN_TAK_NORUN=1`	Unpack only — read the scripts before running anything.
`ZYRN_TAK_KIT`	Pin a specific kit URL rather than the current one.

2. What you need

A machine that stays on. A Raspberry Pi 4 with 4 GB is enough, and so is any spare laptop or a small VPS. About 4 GB of disk. You do not need Docker beforehand — the script installs it, enables the daemon, and opens ports 8090, 8089 and 8443 on ufw or firewalld if either is running. Pass --no-docker-install or --no-firewall to manage those yourself.

On a VPS, check the provider firewall too. Most clouds have a second firewall in their console that nothing on the machine can reach. The same three ports have to be open there.

64-bit only. A 32-bit Raspberry Pi OS will not work. Several Python dependencies ship no armv7 wheel and cannot be built. Use the 64-bit image.

Windows is supported but has no curl | sh route. Download the kit below and run setup-tak-server.ps1 with Docker Desktop installed.

3. What gets installed

OpenTAKServer and a WebSocket relay, both in Docker. The script generates its own secrets, creates the certificate authority, provisions the relay, and tests the path end to end before it claims success. It prints the URL to paste into ZYRNTOPO when it finishes.

4. Ports — ZYRNTOPO uses 8090, not 8089

A TAK server's client port, 8089, is raw TLS over TCP. ZYRNTOPO speaks WebSocket rather than raw TCP on every platform it ships for. That is what the relay on 8090 is for. ATAK and WinTAK still use 8089 against the same server, so a mixed team works.

Port	Used by	Open by default
`8090`	ZYRNTOPO (WebSocket relay)	Yes
`8089`	ATAK / WinTAK (TLS CoT)	Yes
`8443`	Certificate enrolment for ATAK	Yes
`8081`	Admin web UI	Localhost only

Pass --expose-admin to bind the admin UI to all interfaces. Only do that on a network you trust.

5. Reaching it from outside your network

On a LAN the printed URL is all anyone needs. Off it, --tailscale publishes the relay over Tailscale with TLS and prints the address to use. TLS is not optional here for the web app: a browser refuses a ws:// connection from an https:// page as mixed content.

Publish over Tailscale

curl -fsSL https://zyrntopo.com/tak-server.sh | sh -s -- --tailscale

Use --no-tailscale to skip the question and stay LAN-only.

6. Running it

From the install directory:

Command	What it does
`./setup-tak-server.sh --status`	Is it running, and on what address
`./setup-tak-server.sh --stop`	Stop it, keep the data
`./setup-tak-server.sh --uninstall`	Stop it and delete all data

7. Download and verify by hand

If you would rather not pipe a script into a shell — a reasonable position — take the kit directly. It is the same archive the command above fetches.

zyrntopo-tak-server-1.15.9.tar.gz (39 KB) · .zip for Windows.

tar xzf zyrntopo-tak-server-1.15.9.tar.gz
cd zyrntopo-tak-server-1.15.9
./setup-tak-server.sh

Verify what you downloaded. SHA-256:
d86c021f8a8509ee4e5201b05fef6b578492ed31a4dd9172540263027f7edc1f .tar.gz
2aed1d40c49d15e7b1ec971a5b2ada50d2239dbfe20208134530c11aae64b3c4 .zip
sha256sum zyrntopo-tak-server-1.15.9.tar.gz on Linux and Mac, or Get-FileHash on Windows. The full manifest is at SHA256SUMS-tak-server-1.15.9.txt.

8. Pointing ZYRNTOPO at it

Open Team Sync in the app and enter the URL the installer printed. Full walkthrough, including joining an existing session and connecting ATAK clients, is in the Team Sync documentation.