Skip to content

Operator portal

The portal is an operator-only interface for publishing public or VPN-restricted DTED datasets. It runs on admin.dted.org in the public deployment and can use any hostname on an on-premises installation.

Authentication

Nginx authenticates the operator through the suite-wide OAuth2 Proxy and passes the secret-guarded AndKit identity contract to the loopback-only portal. The application requires both X-AndKit-Subject and a constant-time match of X-AndKit-Proxy-Auth against DTED_PROXY_IDENTITY_SECRET; a caller-controlled identity header by itself is rejected. Install the standard includes from snstac/andkit-auth under /etc/andkit-auth.

Never expose the portal container port directly. The application rejects requests without the trusted identity header and rejects cross-origin mutations.

Publishing a dataset

  1. Create the dataset with a DNS-safe ID, display name, source provenance, license, and visibility.
  2. For restricted data, add the approved VPN CIDRs and use the private-{id}.dted.org endpoint.
  3. Select a ZIP containing cells in wDDD/nDD.dt0 through .dt3 layout.
  4. Upload it through the resumable uploader. The browser sends bounded chunks and the server calculates SHA-256.
  5. Monitor the queued job. Successful custom-data jobs validate every recognized cell and build an immutable candidate. They do not activate it.
  6. Review the candidate and explicitly promote or reject it. State datasets must use the receipt-backed state quality workflow and require ATAK plus WinTAK attestations.

The dashboard and dtedctl rollout-status --output /srv/dted-data show CLI-built state releases alongside automated QA, preview, ATAK, WinTAK, promotion, and active state. Status inspection is lightweight; preview, attestation, and promotion still re-hash every release artifact before changing state.

The manifest's allowed CIDRs document the intended audience. Enforcement is deliberately centralized at the reverse proxy: add the approved network union to /etc/dted/vpn_allowlist.conf, run nginx -t, and reload Nginx. The shipped allowlist is empty, so restricted endpoints deny all non-loopback clients until an operator explicitly configures it.

Unrecognized files are reported as warnings. Unsafe paths, symlinks, archive bombs, malformed DTED headers, coordinate mismatches, and equal-priority duplicates fail the release.

CLI operation

The same engine is available without the portal:

dtedctl validate custom.zip
dtedctl build dataset.yml \
  --baseline dted_nw_hemi.zip \
  --baseline dted_ne_hemi.zip \
  --baseline dted_sw_hemi.zip \
  --baseline dted_se_hemi.zip \
  --output /srv/dted-data

Review a custom candidate before using the low-level activate command. Release directories are immutable. Public states use dtedctl promote-state and can roll back only with dtedctl rollback-state to a previously certified release; activate does not permit state releases.

To update generated QR codes and other client configuration without rebuilding terrain archives, create and explicitly activate an immutable client-asset successor:

dtedctl refresh-client-assets CA release-id --output /srv/dted-data
dtedctl activate-client-assets CA successor-id \
  --output /srv/dted-data --operator operator-name

Activation succeeds only when the named source is currently active and all terrain artifacts, source metadata, and quality results are unchanged. It writes a maintenance record rather than a promotion or client attestation.