Skip to content

Self-hosting and deployment

DTED.org runs with Docker Compose, local filesystem storage, SQLite, a single build worker, and Nginx. Internet access is needed for optional authoritative source acquisition and public ACME issuance. Conversion itself runs with PROJ network access disabled and best-operation-only selection. Custom datasets can be built and served entirely offline with operator-provided certificates.

Requirements

  • Linux with Docker Engine and Docker Compose.
  • Nginx 1.22 or newer.
  • Enough storage for baseline sources, uploads, the active release, and at least one rollback release.
  • Operator-managed PROJ vertical-grid files for Copernicus and 3DEP conversion. The project container pins the GDAL/PROJ package versions; grids are mounted read-only and pinned by SHA-256.
  • A wildcard DNS record when dataset subdomains are used.
  • A wildcard certificate, or an equivalent certificate supplied by the operator.

Installation

Copy .env.example to .env, set the host data, baseline, and source paths, and set DTED_UID and DTED_GID to the account that owns the data directory. Put operator-provided archives such as CA-DTED.zip in the source directory. Then:

make install
make test
docker compose build
docker compose up -d

After reviewing and obtaining the vertical transformation grids required by the selected provider, create an immutable local bundle:

sudo install -d -m 0755 /srv/dted-grids
sudo .venv/bin/dted-pin-grids /operator/reviewed/grid-one.tif \
  /operator/reviewed/grid-two.tif --output /srv/dted-grids

Set DTED_GRID_ROOT to that host directory. Compose mounts it read-only at /grids, and conversion reads /grids/manifest.json through DTED_PROJ_GRID_MANIFEST. The generated manifest format is:

{
  "files": [
    {"path": "provider-grid-a.tif", "sha256": "64-lowercase-hexadecimal-characters"},
    {"path": "provider-grid-b.tif", "sha256": "64-lowercase-hexadecimal-characters"}
  ]
}

Use the actual distribution filenames; the example names are not download instructions. The pinning command copies the reviewed files and computes their hashes. Provider credentials remain separate root-only files under /etc/dted and are passed only to dtedctl acquire-region.

For a bind-mounted local checkout, the container UID/GID must match the data owner. make portal supplies the current account automatically; when invoking Compose directly, set DTED_UID=$(id -u) and DTED_GID=$(id -g) in .env.

The portal binds to 127.0.0.1:8780; Nginx is the only public listener. Install the central AndKit OAuth2 proxy configuration first, provide the same DTED_PROXY_IDENTITY_SECRET to the proxy and portal, then install web/DTED.org-nginx.conf, the VPN allowlist, and TLS links using:

sudo tools/install_production.sh

The installer fails closed if the AndKit forward-auth includes or proxy identity secret are missing. Operators sign in at auth.andkit.io; DTED does not maintain a separate browser password or user database.

The installer also creates a dedicated documentation virtual environment, runs mkdocs build --strict, and publishes the generated site from /srv/dted/site through docs.dted.org. This keeps public documentation deployable even when the source repository is private. A documentation build failure stops installation before Nginx is reloaded.

When investigating an existing California archive, operators may explicitly run dtedctl normalize-legacy into a separate source under the data root. Structural validation rejects a truncated candidate and accepts a replacement only when the same coordinate has a complete DTED matrix. The production installer and portal never auto-repair or auto-publish state data.

Before publishing restricted data, put only trusted VPN or management networks in /etc/dted/vpn_allowlist.conf using Nginx geo syntax. This is a global restricted-data boundary; per-dataset CIDRs in the portal are policy metadata and should be included only when their union is appropriate for the host. The default file grants no remote network access.

QA preview hosts are public by default. The installer preserves an existing /etc/dted/qa_allowlist.conf; new installations receive the public policy from web/qa_allowlist.conf. To opt into restricted QA, replace the public entries with only trusted test-device CIDRs, set DTED_PUBLIC_QA_DISCOVERY=0 in the deployment environment, recreate the portal container, and reload Nginx. The installer defaults discovery to 1 only when the installed allowlist matches the repository's public policy. Preview data must remain public information even when a deployment applies this additional network restriction.

TLS

The production DNS provider is Name.com. State and preview hosts require a certificate containing both dted.org and *.dted.org; a certificate for California alone is insufficient. Store API credentials in root-readable /etc/dted/namecom.env:

NAMECOM_USERNAME=your-account
NAMECOM_API_TOKEN=your-token

Set DTED_ACME_EMAIL, then run sudo -E tools/issue_wildcard_certificate.sh. The DNS hook creates only the required ACME TXT record, removes it afterward, and never logs the token. Other installations may replace the hook or link /etc/dted/tls/fullchain.pem and privkey.pem to operator-managed certificates.

Public SRTM acquisition

An application token alone is not download authorization. In ERS Profile Home, select Request Access, choose M2M API, and submit the access questionnaire. USGS normally reviews the request separately. After approval, place USGS_USERNAME and USGS_APPLICATION_TOKEN in the operator environment, enter them at the secure prompts, or store them in a root-only file such as /etc/dted/usgs.env:

USGS_USERNAME=your-account
USGS_APPLICATION_TOKEN=your-token

The file must be mode 0600. Check authentication, dataset discovery, scene search, and download authorization without downloading data:

sudo .venv/bin/dtedctl check-usgs-access CA --credential-file /etc/dted/usgs.env

Then acquire the state source:

SOURCE_ROOT=$(awk -F= '$1 == "DTED_SOURCE_ROOT" { print $2 }' /srv/dted/.env)
sudo install -d -m 0755 /var/lib/dted/boundaries
sudo env DTED_BOUNDARY_CACHE_DIR=/var/lib/dted/boundaries \
  .venv/bin/dtedctl acquire-state CA \
  --output "$SOURCE_ROOT" \
  --manifest-dir datasets \
  --credential-file /etc/dted/usgs.env

The tool discovers the current SRTM 1 Arc-Second dataset, searches the Census state geometry, requests DTED-format products, atomically assembles normalized cells, writes an acquisition receipt and dataset manifest when needed, and logs out. Credentials, session tokens, and expiring download URLs are not written to the receipt or printed. Follow the quality-gate workflow for CA, then NC, then TX; a build creates a candidate and never activates a state.

Direct EarthExplorer exports supplied by an operator use a separate receipt type; the importer never fabricates M2M scene identifiers. It records the original and normalized hashes, declaration, boundary crop, and transformation warnings:

make import-state STATE=TN ARCHIVE=DTED2-TN.zip OPERATOR=name
make audit-state STATE=TN

An imported archive still must pass every automated and client gate before it can be built or promoted.

Backups and rollback

Back up the SQLite database, uploads that must be retained, /srv/dted-data/releases, /srv/dted-data/active, Nginx configuration, and the root-managed secret files. Active links are separated into active/public and active/restricted; this prevents a restricted release from being served through an unprefixed hostname. Do not back up an active SQLite database by copying it without a SQLite backup or stopping the services.

Deployment must validate nginx -t, wildcard TLS, container health, the 180×360 SDS index, ZIP signatures, HTTP range requests, representative DTED2 cells, the public quality summary, and both required TAK client attestations before promotion. The previous certified release remains available for atomic rollback.