Skip to content

FastTAK Configuration

FastTAK configuration is spread across a few files, each with a distinct purpose.

Deployment Modes

FastTAK supports two deployment modes controlled by DEPLOY_MODE in .env.

SERVER_ADDRESS

The address clients and services use to reach this deployment. Can be an IP address, a Tailscale hostname, or a fully qualified domain name (FQDN):

SERVER_ADDRESS=192.168.1.10
SERVER_ADDRESS=my-node.tail1234.ts.net
SERVER_ADDRESS=tak.example.com

DEPLOY_MODE=direct

Use when: you don't have public DNS — air-gapped networks, Tailscale, local IP, or any address that isn't resolvable by Let's Encrypt.

  • Caddy serves HTTPS on a single port, using its internal CA (self-signed)
  • Services are routed by port number (see port variables below)
  • No DNS required — works with IPs and private hostnames
  • TLS is still enforced; browsers will show an untrusted certificate warning on first visit

Self-signed certificate warnings: See Self-signed certificate warnings in the certificate guide for how to suppress browser warnings.

TAK enrollment: Some TAK client versions do not support IP-only enrollment URLs — they expect an FQDN. This is a platform limitation, not a FastTAK issue.

DEPLOY_MODE=subdomain

Use when: you have a public FQDN with DNS that Let's Encrypt can resolve.

  • Caddy terminates HTTPS using Let's Encrypt certificates (automatic)
  • Services are routed by subdomain (e.g., tak.example.com, monitor.example.com)
  • Requires DNS records pointing to the host running FastTAK
  • The subdomain variables in .env (e.g., TAKSERVER_SUBDOMAIN, MONITOR_SUBDOMAIN) are only used in this mode

Port variables (direct mode only)

These control which host ports Caddy exposes for each service. Defaults are used if not set. In direct mode, the bare https://<SERVER_ADDRESS> (port 443) redirects to the Monitor dashboard. These variables are ignored in subdomain mode.

Variable Default Service
TAKSERVER_ADMIN_PORT 8446 TAK Server admin UI
NODERED_PORT 1880 Node-RED
MONITOR_PORT 8180 Monitor dashboard
MEDIAMTX_PORT 8888 MediaMTX streaming

TAK client ports (8443, 8089) are not configurable — they connect directly to TAK Server, not through Caddy.

Troubleshooting

If Caddy or auth is misconfigured and you're locked out, access services directly via docker compose exec for debugging without going through the reverse proxy.

.env

The primary configuration interface. All deployment settings — hostnames, credentials, feature flags, database tuning, data retention, and monitoring threshold overrides — are set here. See .env.example for all available variables with inline documentation.

Monitoring threshold overrides

The monitoring system's default thresholds are defined in thresholds.yml (see below), but you should override them via .env rather than editing the YAML directly. This keeps your customizations separate from the defaults that ship with FastTAK. Use the FASTAK_MON_ prefix:

# Override disk warning from 80% to 85%
FASTAK_MON_DISK__THRESHOLDS__PERCENT__WARNING=85

# Poll database health every 2 minutes instead of 60 seconds
FASTAK_MON_DATABASE__INTERVAL=120

# Only email on config drift if it reaches warning level
FASTAK_MON_CONFIG__ALERT_MIN_LEVEL=warning

The naming convention: FASTAK_MON_<SERVICE>__<KEY> for top-level settings, FASTAK_MON_<SERVICE>__THRESHOLDS__<METRIC>__<LEVEL> for threshold values. See .env.example for more examples.

monitor/config/thresholds.yml

Monitoring policy defaults: health check intervals, alert levels, and numeric thresholds (e.g., when disk usage triggers a warning vs. critical alert). This file ships with FastTAK and defines sensible defaults for all services.

Do not edit this file for deployment-specific tuning. Use .env overrides instead (see above). Direct edits to thresholds.yml will be overwritten on upgrades. The YAML file is the reference for what settings are available and what the defaults are.

tak/conf/ (init-config output)

TAK Server XML configuration, generated by the init-config container at startup from your .env values. You generally don't edit these files directly — set the corresponding .env variable and recreate init-config:

docker compose up -d --force-recreate init-config tak-server

See database-management.md for the one case where direct YAML editing is appropriate (retention for files/missions when no .env retention variables are set).

Federation

TAK Server federation is effectively disabled in FastTAK: CoreConfig.xml does not enable it, and the federation ports (9000/9001) are not published by Docker Compose. Enabling federation in the TAK admin UI will not make it reachable — the listener stays isolated inside the container. See DD-046 in decisions.md for the reasoning, and issue #72 for what proper support would require.