### Install OpenTAKServer on Ubuntu

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Downloads and executes the Ubuntu installer script for OpenTAKServer. The installation log is saved to ~/ots_ubuntu_installer.log. This script installs OpenTAKServer and its dependencies.

```shell
curl https://i.opentakserver.io/ubuntu_installer -L | bash - | tee ~/ots_ubuntu_installer.log
```

--------------------------------

### Install and Join ZeroTier Network (Bash)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Automates the installation of ZeroTier and joins a specified network. It imports GPG keys, downloads and verifies the installer script, installs ZeroTier, and then attempts to join the provided network ID. Finally, it lists network status and provides instructions for authorization and configuration.

```bash
#!/bin/bash

# ZeroTier installation is prompted during main installation
# or can be done manually:

# Import ZeroTier GPG key
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40zerotier.com.gpg' | gpg --import

# Download and verify installer
curl -s 'https://install.zerotier.com/' -o /tmp/zerotier_installer.sh

# Verify signature and install
if gpg --verify /tmp/zerotier_installer.sh; then
    sudo bash /tmp/zerotier_installer.sh
else
    echo "GPG verification failed!"
    exit 1
fi

# Join your ZeroTier network
NETWORK_ID="a1b2c3d4e5f6g7h8"
sudo zerotier-cli join $NETWORK_ID

# Check status
sudo zerotier-cli listnetworks

# Expected output:
# 200 listnetworks <nwid> <name> <mac> <status> <type> <dev> <ZT assigned ips>
# 200 listnetworks a1b2c3d4e5f6g7h8 MyTAKNetwork de:ad:be:ef:00:00 OK PRIVATE zt0 10.147.20.123/16

# Authorize node in ZeroTier Central web interface
# https://my.zerotier.com/network/$NETWORK_ID

# Configure OpenTAKServer to bind to ZeroTier interface
# Edit ~/ots/config.yml and set OTS_LISTENER_ADDRESS to ZeroTier IP
```

--------------------------------

### Install OpenTAKServer on Windows

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Installs OpenTAKServer on Windows using PowerShell. It first installs Chocolatey, then uses it to install prerequisites like RabbitMQ and nginx. The installer also sets up services for MediaMTX and OpenTAKServer. User interaction may be required for security prompts and password entry.

```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://i.opentakserver.io/windows_installer'))
```

--------------------------------

### Install OpenTAKServer on Raspberry Pi OS

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Downloads and executes the Raspberry Pi OS installer script for OpenTAKServer. The installation log is saved to ~/ots_rpi_installer.log. This script installs OpenTAKServer and its dependencies.

```shell
curl https://i.opentakserver.io/raspberry_pi_installer -L | bash - | tee ~/ots_rpi_installer.log
```

--------------------------------

### Create systemd Service for MediaMTX

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Sets up a systemd service for the MediaMTX streaming server, ensuring it starts automatically and manages logs. Requires root privileges for service management. Depends on the network being available.

```bash
#!/bin/bash

# Create systemd service file
sudo tee /etc/systemd/system/mediamtx.service > /dev/null << EOF
[Unit]
Description=MediaMTX Streaming Server
After=network.target

[Service]
Type=simple
User=$(whoami)
WorkingDirectory=/home/$(whoami)/ots/mediamtx
ExecStart=/home/$(whoami)/ots/mediamtx/mediamtx /home/$(whoami)/ots/mediamtx/mediamtx.yml
Restart=always
RestartSec=10
StandardOutput=append:/home/$(whoami)/ots/mediamtx/mediamtx.log
StandardError=append:/home/$(whoami)/ots/mediamtx/mediamtx_error.log

[Install]
WantedBy=multi-user.target
EOF

# Enable and start service
sudo systemctl daemon-reload
sudo systemctl enable mediamtx.service
sudo systemctl start mediamtx.service

# Check service status
sudo systemctl status mediamtx.service

# View logs
tail -f ~/ots/mediamtx/mediamtx.log
```

--------------------------------

### Install OpenTAKServer on Windows

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Installs OpenTAKServer on Windows using PowerShell. It bypasses execution policy restrictions temporarily, downloads and executes the installer, and then restores the execution policy. Requires PowerShell to be run as Administrator.

```powershell
# Open PowerShell as Administrator
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://i.opentakserver.io/windows_installer'))

# After installation, restore execution policy
Set-ExecutionPolicy Restricted -Scope Process -Force
```

--------------------------------

### Install OpenTAKServer on Rocky Linux

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Executes the Rocky Linux installation script using curl and bash. This script is intended for Rocky Linux and RHEL-compatible distributions that use the DNF package manager. Installation logs are saved to 'ots_rocky_installer.log'.

```bash
curl https://i.opentakserver.io/rocky_installer -L | bash - | tee ~/ots_rocky_installer.log
```

--------------------------------

### Install Bleeding Edge OpenTAKServer on Ubuntu

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Installs the latest unstable version of OpenTAKServer and OpenTAKServer-UI on Ubuntu for testing purposes. This script is not recommended for production environments. The log is saved to ~/ots_ubuntu_upgrade.log.

```shell
curl -L https://i.opentakserver.io/ubuntu_updater | bash -s -- --bleeding-edge | tee ~/ots_ubuntu_upgrade.log
```

--------------------------------

### Install Bleeding Edge OpenTAKServer on Raspberry Pi

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Installs the latest unstable version of OpenTAKServer and OpenTAKServer-UI on Raspberry Pi OS for testing purposes. This script is not recommended for production environments. The log is saved to ~/ots_rpi_upgrade.log.

```shell
curl -L https://i.opentakserver.io/raspberry_pi_installer | bash -s -- --bleeding-edge | tee ~/ots_rpi_upgrade.log
```

--------------------------------

### Configure WebRTC Streaming - YAML

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Sets up MediaMTX for WebRTC streaming, enabling HTTPS for secure connections. This configuration specifies the WebRTC port, encryption settings, and the server certificate and key paths. It also includes options for controlling cross-origin requests and local UDP address, with an example of STUN server configuration for improved NAT traversal. Publishing and viewing instructions are provided.

```yaml
# mediamtx.yml excerpt
webrtc: yes
webrtcAddress: :8889
webrtcEncryption: yes
webrtcServerKey: /home/user/ots/ca/certs/opentakserver/opentakserver.nopass.key
webrtcServerCert: /home/user/ots/ca/certs/opentakserver/opentakserver.pem
webrtcAllowOrigin: '*'
webrtcLocalUDPAddress: :8189
webrtcIPsFromInterfaces: yes

# Optional STUN server for NAT traversal
webrtcICEServers2:
  - url: stun:stun.l.google.com:19302

# Example: Publish WebRTC stream and view in browser
# Publish: Use OBS Studio with WebRTC output plugin
# URL: https://opentakserver.example.com:8889/mystream/whip
# View: https://opentakserver.example.com:8889/mystream/

```

--------------------------------

### Upgrade OpenTAKServer on Raspberry Pi

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Provides commands to upgrade OpenTAKServer on Raspberry Pi OS. It supports both stable upgrades and bleeding-edge upgrades (for testing only) by passing the '--bleeding-edge' argument to the installer script. Logs are saved to 'ots_rpi_upgrade.log'.

```bash
# Stable upgrade
curl -L https://i.opentakserver.io/raspberry_pi_installer | bash - | tee ~/ots_rpi_upgrade.log

# Bleeding edge upgrade (testing only)
curl -L https://i.opentakserver.io/raspberry_pi_installer | bash -s -- --bleeding-edge | tee ~/ots_rpi_upgrade.log
```

--------------------------------

### Upgrade OpenTAKServer on Ubuntu to Bleeding Edge

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Executes the Ubuntu upgrade script with the '--bleeding-edge' flag to install unstable versions from the main development branch. This is intended for testing purposes only and not recommended for production environments. Logs are saved to 'ots_ubuntu_upgrade.log'.

```bash
# WARNING: Only use for testing, not production
curl -L https://i.opentakserver.io/ubuntu_updater | bash -s -- --bleeding-edge | tee ~/ots_ubuntu_upgrade.log
```

--------------------------------

### Configure Nginx Media Stream Proxying (HLS/WebRTC)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Nginx configuration snippet for proxying media streams, including HLS and WebRTC, from MediaMTX. This setup ensures that the streaming traffic is correctly forwarded to the client.

```nginx
# Excerpt from ots_https configuration
location /hls {
    proxy_pass http://127.0.0.1:8888/;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

location /webrtc {
    proxy_pass http://127.0.0.1:8888/webrtc;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $remote_addr;
}
```

--------------------------------

### Create systemd Service for OpenTAKServer

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configures a systemd service unit for OpenTAKServer, enabling automatic startup, process management, and log redirection. Requires root privileges for service management. Dependencies include network and database/messaging services.

```bash
#!/bin/bash

# Create systemd service file
sudo tee /etc/systemd/system/opentakserver.service > /dev/null << EOF
[Unit]
Description=OpenTAKServer
After=network.target postgresql.service rabbitmq-server.service

[Service]
Type=simple
User=$(whoami)
WorkingDirectory=/home/$(whoami)/ots
ExecStart=/home/$(whoami)/.opentakserver_venv/bin/opentakserver
Restart=always
RestartSec=10
StandardOutput=append:/home/$(whoami)/ots/opentakserver.log
StandardError=append:/home/$(whoami)/ots/opentakserver_error.log

[Install]
WantedBy=multi-user.target
EOF

# Enable and start service
sudo systemctl daemon-reload
sudo systemctl enable opentakserver.service
sudo systemctl start opentakserver.service

# Check service status
sudo systemctl status opentakserver.service

# View logs
journalctl -u opentakserver.service -f

# Service management commands:
# sudo systemctl stop opentakserver.service
# sudo systemctl restart opentakserver.service
# sudo systemctl disable opentakserver.service
```

--------------------------------

### Initialize PostgreSQL Database with PostGIS (Bash)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Initializes a PostgreSQL database for OpenTAKServer, creating a dedicated role, setting a secure random password, creating the database with the PostGIS extension, and granting necessary privileges. It also updates the OpenTAKServer configuration file with the generated password and runs database migrations.

```bash
#!/bin/bash

# Create PostgreSQL role for OpenTAKServer
POSTGRESQL_PASSWORD=$(tr -dc 'A-Za-z0-9!?%=' < /dev/urandom | head -c 20)
sudo su postgres -c "psql -c \"CREATE ROLE ots WITH LOGIN PASSWORD '${POSTGRESQL_PASSWORD}';\""

# Create database with PostGIS
sudo su postgres -c "psql -c 'CREATE DATABASE ots;'"
sudo su postgres -c "psql -d ots -c 'CREATE EXTENSION postgis;'"

# Grant privileges
sudo su postgres -c "psql -c 'GRANT ALL PRIVILEGES ON DATABASE \"ots\" TO ots;'"
sudo su postgres -c "psql -d ots -c 'GRANT ALL ON SCHEMA public TO ots;'"

# Update OpenTAKServer config
sed -i "s/POSTGRESQL_PASSWORD/${POSTGRESQL_PASSWORD}/g" ~/ots/config.yml

# Run database migrations
cd ~/.opentakserver_venv/lib/python3.*/site-packages/opentakserver
source ~/.opentakserver_venv/bin/activate
flask db upgrade

# Connection string format:
# postgresql://ots:${POSTGRESQL_PASSWORD}@localhost:5432/ots
```

--------------------------------

### Migrate OpenTAKServer Database (Bash)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Provides a script to back up the current PostgreSQL database, activate the OpenTAKServer virtual environment, and then perform database migrations using Flask-Migrate. It includes commands to check migration status, view history, and upgrade the database. Instructions for restoring from backup are also included.

```bash
#!/bin/bash

# Backup database before migration
BACKUP_FILE=~/ots_backup_$(date +%Y%m%d_%H%M%S).sql
sudo su postgres -c "pg_dump ots" > $BACKUP_FILE
echo "Database backed up to $BACKUP_FILE"

# Activate virtual environment
source ~/.opentakserver_venv/bin/activate

# Navigate to OpenTAKServer directory
cd ~/.opentakserver_venv/lib/python3.*/site-packages/opentakserver

# Check migration status
flask db current

# View pending migrations
flask db history

# Upgrade to latest version
flask db upgrade

# If migration fails, restore from backup:
# sudo su postgres -c "dropdb ots"
# sudo su postgres -c "createdb ots"
# sudo su postgres -c "psql ots" < $BACKUP_FILE
```

--------------------------------

### Convert Certificate Formats (PEM, PKCS12, JKS) with OpenSSL and Keytool

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Converts certificates between PEM, PKCS#12, and JKS formats using OpenSSL and the Java keytool. Also includes extraction of private keys and conversion to PKCS#8 DER format. Requires OpenSSL, keytool, and certificate files.

```bash
#!/bin/bash

CERT_NAME="client-device-01"
PASSWORD="atakatak"

# PEM to PKCS#12
openssl pkcs12 -export \
    -in ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.pem \
    -inkey ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.key \
    -out ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.p12 \
    -name "${CERT_NAME}" \
    -CAfile ~/ots/ca/ca.pem \
    -passin pass:${PASSWORD} \
    -passout pass:${PASSWORD}

# PKCS#12 to JKS
keytool -importkeystore \
    -deststorepass "${PASSWORD}" \
    -destkeypass "${PASSWORD}" \
    -destkeystore ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.jks \
    -srckeystore ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.p12 \
    -srcstoretype PKCS12 \
    -srcstorepass "${PASSWORD}" \
    -alias "${CERT_NAME}"

# Extract private key without password
openssl rsa \
    -in ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.key \
    -passin pass:${PASSWORD} \
    -out ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.nopass.key

# Convert private key to PKCS#8 DER format (for Java)
openssl pkcs8 -topk8 -outform DER \
    -in ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.key \
    -passin pass:${PASSWORD} \
    -out ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.key.pk8 \
    -nocrypt

# View certificate details
openssl x509 -in ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.pem -text -noout
openssl pkcs12 -info -in ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.p12 -passin pass:${PASSWORD}
keytool -list -v -keystore ~/ots/ca/certs/${CERT_NAME}/${CERT_NAME}.jks -storepass ${PASSWORD}
```

--------------------------------

### Upgrade OpenTAKServer on Ubuntu

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Downloads and executes the Ubuntu upgrade script for OpenTAKServer. The upgrade log is saved to ~/ots_ubuntu_upgrade.log. It is recommended to back up the database before running this script.

```shell
curl -L https://i.opentakserver.io/ubuntu_updater | bash - | tee ~/ots_ubuntu_upgrade.log
```

--------------------------------

### Generate Database Client Certificate - Bash

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Generates a specific client certificate designed for PostgreSQL client authentication. This script uses a helper script and a metadata source to create the certificate, outputting it in multiple formats including .key, .pem, .p12, and .jks, as well as a PKCS#8 formatted key suitable for Java applications. A default name 'martiuser' is used if no custom name is provided.

```bash
#!/bin/bash

source /tmp/ots_installer/cert-metadata.sh

# Generate database client certificate (uses default name 'martiuser')
bash /tmp/ots_installer/makeCert.sh dbclient

# Output files in ~/ots/ca/certs/martiuser/:
# - martiuser.key (encrypted private key)
# - martiuser.key.pk8 (PKCS#8 format for Java)
# - martiuser.pem (certificate with chain)
# - martiuser.p12 (PKCS#12 bundle)
# - martiuser.jks (Java keystore)

```

--------------------------------

### Generate Client Certificate - Bash

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Creates client certificates for TAK applications, ensuring proper key usage extensions are set. It allows for both custom and auto-generated names for the client certificates. The generated certificates are provided in formats suitable for ATAK import (.p12) and Java keystores (.jks). The script depends on a metadata script for cryptographic details, including the password for .p12 files.

```bash
#!/bin/bash

source /tmp/ots_installer/cert-metadata.sh

# Generate client certificate with custom name
bash /tmp/ots_installer/makeCert.sh client user-tablet-01

# Generate client certificate with auto-generated name
bash /tmp/ots_installer/makeCert.sh client

# Output files in ~/ots/ca/certs/user-tablet-01/:
# - user-tablet-01.key (encrypted private key)
# - user-tablet-01.pem (certificate with chain)
# - user-tablet-01.p12 (PKCS#12 for ATAK import)
# - user-tablet-01.jks (Java keystore)
# - user-tablet-01.csr (certificate signing request)

# Import into ATAK: Share the .p12 file to the device
# Password is the value of $PASS from cert-metadata.sh (default: atakatak)

```

--------------------------------

### Configure Video Stream Recording - YAML

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configures MediaMTX to record video streams. This YAML excerpt enables recording by default, specifies the recording format (fmp4 or mpegts), and defines a path template for storing recordings. It also includes settings for automatic deletion of old recordings and configures webhooks to trigger notifications upon segment creation and completion, sending event details to a specified URL.

```yaml
# mediamtx.yml excerpt
pathDefaults:
  # Enable recording for all paths
  record: yes

  # Recording format (fmp4 or mpegts)
  recordFormat: fmp4

  # Path template for recordings
  recordPath: /home/user/ots/mediamtx/recordings/%path/%Y-%m-%d_%H-%M-%S-%f

  # Segment duration (1 hour segments)
  recordSegmentDuration: 1h

  # Auto-delete after 7 days (0s disables)
  recordDeleteAfter: 168h

  # Webhook on segment creation
  runOnRecordSegmentCreate: curl -s http://localhost:8081/api/mediamtx/webhook?path=$MTX_PATH&rtsp_port=$RTSP_PORT&segment_path=$MTX_SEGMENT_PATH&event=segment_record&token=MTX_TOKEN > /dev/null

  # Webhook on segment completion
  runOnRecordSegmentComplete: curl -s http://localhost:8081/api/mediamtx/webhook?path=$MTX_PATH&rtsp_port=$RTSP_PORT&segment_path=$MTX_SEGMENT_PATH&event=segment_record_complete&token=MTX_TOKEN > /dev/null

# Example: Recording from RTSP camera
paths:
  outdoor_camera:
    source: rtsp://username:password@192.168.1.50:554/stream1
    record: yes
    recordPath: /home/user/ots/mediamtx/recordings/outdoor_camera/%Y-%m-%d_%H-%M-%S-%f

```

--------------------------------

### Generate and Sign CSR with OpenSSL

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Generates a Certificate Signing Request (CSR) using OpenSSL, signs it with a Certificate Authority (CA), and verifies the resulting certificate. Requires OpenSSL and pre-existing CA files.

```bash
# View CSR details
openssl req -text -noout -verify -in server.csr

# Sign with CA
openssl x509 -req -days 730 \
    -in server.csr \
    -CA ~/ots/ca/ca.pem \
    -CAkey ~/ots/ca/ca-do-not-share.key \
    -CAcreateserial \
    -out server.crt \
    -extensions v3_req \
    -extfile server_san.cnf \
    -passin pass:atakatak

# Verify certificate
openssl x509 -in server.crt -text -noout | grep -A1 "Subject Alternative Name"
```

--------------------------------

### Upgrade OpenTAKServer on Raspberry Pi OS

Source: https://github.com/brian7704/opentakserver-installer/blob/master/README.md

Downloads and executes the Raspberry Pi OS upgrade script for OpenTAKServer. The upgrade log is saved to ~/ots_rpi_upgrade.log. It is recommended to back up the database before running this script.

```shell
curl -L https://i.opentakserver.io/raspberry_pi_installer | bash - | tee ~/ots_rpi_upgrade.log
```

--------------------------------

### Create Root Certificate Authority (CA)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

A bash script to generate a new root Certificate Authority (CA) for OpenTAKServer. It requires setting environment variables for certificate metadata and a password for the CA key. The script downloads necessary components and then executes the CA creation script. Output files, including certificates and keys, are placed in the '~/ots/ca/' directory.

```bash
#!/bin/bash

# Configure certificate metadata
export COUNTRY="US"
export STATE="California"
export CITY="San Francisco"
export ORGANIZATION="MyOrganization"
export ORGANIZATIONAL_UNIT="IT"
export CAPASS="strongPasswordHere123!"

# Download and execute CA creation script
wget https://github.com/brian7704/OpenTAKServer-Installer/raw/master/cert-metadata.sh -qO /tmp/ots_installer/cert-metadata.sh
wget https://github.com/brian7704/OpenTAKServer-Installer/raw/master/config.cfg -qO /tmp/ots_installer/config.cfg
wget https://github.com/brian7704/OpenTAKServer-Installer/raw/master/makeRootCa.sh -qO /tmp/ots_installer/makeRootCa.sh

# Run with automatic CA name
bash /tmp/ots_installer/makeRootCa.sh --ca-name "MyTAKServer-RootCA"

# Output files in ~/ots/ca/:
# - ca.pem (root certificate, distribute to clients)
# - ca-do-not-share.key (private key, keep secure)
# - ca-trusted.pem (trusted certificate chain)
# - truststore-root.p12 (PKCS#12 truststore)
# - truststore-root.jks (Java keystore)
# - ca.crl (certificate revocation list)
```

--------------------------------

### Generate OpenSSL CSR with SANs (Bash)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Generates a Certificate Signing Request (CSR) using OpenSSL, including Subject Alternative Names (SANs) for multiple domains and IP addresses. It first defines an OpenSSL configuration file with the necessary extensions and then uses it to create a private key and the CSR.

```bash
#!/bin/bash

# Create OpenSSL configuration for SAN
cat > server_san.cnf << EOF
[req]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = California
L = San Francisco
O = MyOrganization
OU = IT
CN = opentakserver.example.com

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = opentakserver.example.com
DNS.2 = ots.example.com
DNS.3 = tak.example.com
IP.1 = 192.168.1.100
IP.2 = 10.0.0.50
EOF

# Generate private key and CSR openssl req -new -newkey rsa:2048 -nodes \
    -keyout server.key \
    -out server.csr \
    -config server_san.cnf

```

--------------------------------

### Configure RTSP Authentication - YAML

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configures MediaMTX to use HTTP-based authentication for RTSP streams, integrating with the OpenTAKServer API for authorization. This YAML snippet enables RTSP, sets the listening address, and specifies the authentication method as 'http' with the API endpoint for validation. It details the expected API request format for authentication and the expected response codes (200 for authorized, 403 for denied).

```yaml
# mediamtx.yml excerpt
rtsp: yes
rtspAddress: :8554
authMethod: http
authHTTPAddress: http://127.0.0.1:8081/api/external_auth

# API request format for authentication:
# POST http://127.0.0.1:8081/api/external_auth
# {
#   "user": "username",
#   "password": "password",
#   "ip": "192.168.1.100",
#   "action": "publish|read|playback",
#   "path": "stream_name",
#   "protocol": "rtsp",
#   "id": "connection_id",
#   "query": "query_params"
# }
# Returns: 200 for authorized, 403 for denied

# Example: Publishing to authenticated RTSP stream

```

--------------------------------

### Generate Server Certificate - Bash

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Generates a server certificate signed by a Certificate Authority (CA). It supports Subject Alternative Names (SANs) for both IP addresses and DNS names, creating various key and certificate formats for use with different applications like Nginx and Java keystores. The script relies on a pre-sourced metadata script for CA information.

```bash
#!/bin/bash

# Ensure CA exists and metadata is loaded
source /tmp/ots_installer/cert-metadata.sh

# Generate server certificate for domain name
bash /tmp/ots_installer/makeCert.sh server opentakserver.example.com

# Generate server certificate for IP address
bash /tmp/ots_installer/makeCert.sh server 192.168.1.100

# Output files in ~/ots/ca/certs/opentakserver.example.com/:
# - opentakserver.example.com.key (encrypted private key)
# - opentakserver.example.com.nopass.key (unencrypted for nginx)
# - opentakserver.example.com.pem (certificate with chain)
# - opentakserver.example.com.p12 (PKCS#12 bundle)
# - opentakserver.example.com.jks (Java keystore)
# - opentakserver.example.com.csr (certificate signing request)

```

--------------------------------

### Stream Video to RTSP with FFmpeg

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Command to stream a video file to an RTSP server. It uses direct copying of streams without re-encoding for efficiency. Ensure the input file and RTSP URL are correctly specified.

```bash
ffmpeg -re -i input.mp4 -c copy -f rtsp rtsp://username:password@opentakserver.example.com:8554/mystream
```

--------------------------------

### Configure Nginx Certificate Enrollment Endpoint

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Nginx configuration for the certificate enrollment service on port 8446. This server block listens for SSL connections and proxies requests to the certificate signing endpoint of the backend service. It allows for secure enrollment of new client certificates.

```nginx
server {
    listen 8446 ssl;
    server_name opentakserver_cert_enroll;

    ssl_certificate /home/user/ots/ca/certs/opentakserver/opentakserver.pem;
    ssl_certificate_key /home/user/ots/ca/certs/opentakserver/opentakserver.nopass.key;

    # Certificate enrollment endpoint
    location /Marti/api/tls {
        proxy_pass http://127.0.0.1:8081;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    client_max_body_size 10M;
}
```

--------------------------------

### Configure HLS Low-Latency Streaming with HTTPS (MediaMTX)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configuration excerpt for MediaMTX to enable HLS low-latency streaming with HTTPS. This requires specifying certificate paths and enabling relevant HLS options. The stream can be accessed via a web browser or a video player like video.js.

```yaml
hls: yes
hlsAddress: :8888
hlsEncryption: yes
hlsServerKey: /home/user/ots/ca/certs/opentakserver/opentakserver.nopass.key
hlsServerCert: /home/user/ots/ca/certs/opentakserver/opentakserver.pem
hlsVariant: lowLatency
hlsSegmentCount: 7
hlsSegmentDuration: 1s
hlsPartDuration: 200ms
hlsAllowOrigin: '*'
```

--------------------------------

### Configure Nginx WebSocket Proxying (Socket.IO)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Nginx configuration excerpt to proxy WebSocket connections, specifically for Socket.IO. It includes essential headers like 'Upgrade' and 'Connection' to facilitate the WebSocket handshake and maintain the connection. This is crucial for real-time communication features.

```nginx
location /socket.io {
    proxy_pass http://127.0.0.1:8081/socket.io;
    proxy_http_version 1.1;
    proxy_buffering off;

    # WebSocket upgrade headers
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
}
```

--------------------------------

### Configure Nginx HTTPS with Client Certificate Auth (Marti API)

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Nginx server block configuration to enable HTTPS on port 8443 for Marti API access. It enforces client certificate verification using the provided CA certificate and proxies requests to the backend. Note the specific handling for the certificate enrollment endpoint.

```nginx
server {
    listen 8443 ssl;
    server_name opentakserver_8443;
    root /var/www/html/opentakserver;

    # SSL certificates
    ssl_certificate /home/user/ots/ca/certs/opentakserver/opentakserver.pem;
    ssl_certificate_key /home/user/ots/ca/certs/opentakserver/opentakserver.nopass.key;

    # Require client certificate verification
    ssl_verify_client on;
    ssl_client_certificate /home/user/ots/ca/ca.pem;

    # Block certificate enrollment on this port
    location /Marti/api/tls {
        return 404;
    }

    # Only allow Marti API on this port (requires client cert)
    location /Marti {
        proxy_pass http://127.0.0.1:8081;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Ssl-Cert $ssl_client_escaped_cert;
    }

    location /api {
        proxy_pass http://127.0.0.1:8081;
        proxy_http_version 1.1;
        proxy_set_header Host $host:8443;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Ssl-Cert $ssl_client_escaped_cert;
    }

    client_max_body_size 100M;
}
```

--------------------------------

### Embed HLS Stream in HTML with Video.js

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

HTML code to embed an HLS stream using the Video.js player. It includes the necessary CSS and JavaScript libraries and configures the video tag with the HLS stream source.

```html
<!DOCTYPE html>
<html>
<head>
  <link href="https://vjs.zencdn.net/8.0.4/video-js.css" rel="stylesheet" />
</head>
<body>
  <video id="player" class="video-js vjs-default-skin" controls>
    <source src="https://opentakserver.example.com:8888/mystream/index.m3u8" type="application/x-mpegURL">
  </video>
  <script src="https://vjs.zencdn.net/8.0.4/video.min.js"></script>
  <script>
    var player = videojs('player');
  </script>
</body>
</html>
```

--------------------------------

### Configure Nginx Proxy for WebRTC

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configures Nginx to proxy WebRTC requests to MediaMTX. It sets up headers for WebSocket upgrades and forwards client information. This is crucial for real-time communication through the server.

```nginx
location ~ ^/webrtc(/?)(.*) {
    proxy_pass https://127.0.0.1:8889/$2$is_args$args;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect off;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
```

--------------------------------

### Configure Nginx Proxy for HLS

Source: https://context7.com/brian7704/opentakserver-installer/llms.txt

Configures Nginx to proxy HLS (HTTP Live Streaming) requests to MediaMTX. Similar to WebRTC proxying, it ensures proper headers for streaming and forwards client details. This enables HLS playback through the server.

```nginx
location ~ ^/hls(/?)(.*) {
    proxy_pass https://127.0.0.1:8888/$2$is_args$args;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect off;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.