Run your own TAK server

For ZYRNTOPO Team Sync · free and self-hosted

1. Install it

curl -fsSL https://zyrntopo.com/tak-server.sh | sh

irm https://zyrntopo.com/tak-server.ps1 | iex

Either one downloads the kit, checks it against the published SHA-256, unpacks it to ~/zyrntopo-tak-server and runs the installer. It refuses to continue on a checksum mismatch. Expect a few minutes on a desktop and closer to twenty on a Pi — it builds from source.

To pass the installer an option, give sh a -s -- first — or on Windows set ZYRN_TAK_ARGS, since a script piped into iex has no arguments:

curl -fsSL https://zyrntopo.com/tak-server.sh | sh -s -- --tailscale

$env:ZYRN_TAK_ARGS='-ExposeAdmin'; irm https://zyrntopo.com/tak-server.ps1 | iex

2. What you need

A machine that stays on. A Raspberry Pi 4 with 4 GB is enough, and so is any spare laptop or a small VPS. About 4 GB of disk. You do not need Docker beforehand — the installer adds it, starts it, and opens ports 8090, 8089 and 8443 on ufw or firewalld if either is running. Pass --no-docker-install (-NoDockerInstall on Windows) or --no-firewall to manage those yourself.

macOS gets colima rather than Docker Desktop because Docker Desktop is a GUI app with a licence dialog on first launch, and no script can click through one. colima is the same engine in a small VM with nothing to click. An existing Docker Desktop is used as it is and never touched.

3. What gets installed

OpenTAKServer and a WebSocket relay, both in Docker. The script generates its own secrets, creates the certificate authority, provisions the relay, and tests the path end to end before it claims success. It prints the URL to paste into ZYRNTOPO when it finishes.

4. Ports — ZYRNTOPO uses 8090, not 8089

A TAK server's client port, 8089, is raw TLS over TCP. ZYRNTOPO speaks WebSocket rather than raw TCP on every platform it ships for. That is what the relay on 8090 is for. ATAK and WinTAK still use 8089 against the same server, so a mixed team works.

Pass --expose-admin to bind the admin UI to all interfaces. Only do that on a network you trust.

5. Reaching it from outside your network

On a LAN the printed URL is all anyone needs. Off it, --tailscale publishes the relay over Tailscale with TLS and prints the address to use. TLS is not optional here for the web app: a browser refuses a ws:// connection from an https:// page as mixed content.

curl -fsSL https://zyrntopo.com/tak-server.sh | sh -s -- --tailscale

Use --no-tailscale to skip the question and stay LAN-only.

6. Running it

From the install directory. Windows takes the same switches in PowerShell form — .\setup-tak-server.ps1 -Status, -Stop, -Uninstall:

Re-running the installer is safe, and is the normal way to repair a stack: existing secrets, the certificate authority and issued certificates are never regenerated.

7. Download and verify by hand

If you would rather not pipe a script into a shell — a reasonable position — take the kit directly. It is the same archive the command above fetches.

zyrntopo-tak-server-1.15.10.tar.gz (42 KB) · .zip for Windows.

tar xzf zyrntopo-tak-server-1.15.10.tar.gz
cd zyrntopo-tak-server-1.15.10
./setup-tak-server.sh

8. Pointing ZYRNTOPO at it

Open Team Sync in the app and enter the URL the installer printed. Full walkthrough, including joining an existing session and connecting ATAK clients, is in the Team Sync documentation.