Automated deployment of TAK Server on Ubuntu/Debian using Ansible. This project converts the interactive installTAK bash installer into a fully automated, repeatable Ansible role.

• Control node: Ansible 2.14+ with the community.general collection
• Target host: Ubuntu 22.04 LTS or 24.04 LTS (Debian 12 also supported)
• TAK Server .deb: Place the installer (e.g., takserver_5.3-RELEASE4_all.deb) in the project root or set tak_deb_file to its path
• Minimum RAM: 8 GB on the target host
• SSH access: Passwordless sudo on the target

1. Clone the repo and place your TAK Server .deb in the project root:

git clone https://github.com/cwilliams001/TAK-Ansible.git
cd TAK-Ansible
cp /path/to/takserver_5.3-RELEASE4_all.deb .

2. Edit inventory.ini with your target host:

[tak_servers]
192.168.1.100 ansible_user=ubuntu

3. Customize variables in group_vars/tak_servers.yml:

cert_country: "US"
cert_state: "Virginia"
cert_city: "McLean"
cert_organization: "MyOrg"
enable_cert_enrollment: true
enable_federation: true

4. Run the playbook:

ansible-playbook -i inventory.ini site.yml

5. Retrieve your artifacts from fetched_files/<hostname>/:
   • webadmin.p12 - Admin certificate for browser import
   • enrollmentDP.zip - DataPackage for ATAK/iTAK client enrollment
   • caCert.p12 - CA truststore (if enrollment is disabled)

TAK-Ansible/
├── site.yml                          # Main playbook
├── inventory.ini                     # Target hosts
├── group_vars/
│   └── tak_servers.yml               # User-configurable overrides
└── roles/
    └── takserver/
        ├── defaults/main.yml         # All default variable values
        ├── handlers/main.yml         # Service restart handler
        ├── tasks/
        │   ├── main.yml              # Task orchestration
        │   ├── prerequisites.yml     # System packages, PostgreSQL repo
        │   ├── install.yml           # TAK .deb installation
        │   ├── certificates.yml      # Full PKI chain generation
        │   ├── coreconfig.yml        # CoreConfig.example.xml manipulation
        │   ├── federation.yml        # Federation XML configuration
        │   ├── service.yml           # Service start and readiness wait
        │   ├── enrollment.yml        # DataPackage creation and cert fetch
        │   └── firewall.yml          # UFW firewall rules
        └── templates/
            ├── cert-metadata.sh.j2   # Certificate DN configuration
            ├── config.pref.j2        # ATAK client connection preferences
            └── MANIFEST.xml.j2       # DataPackage manifest

All variables are defined in roles/takserver/defaults/main.yml and can be overridden in group_vars/tak_servers.yml or on the command line with -e.

Run specific sections of the playbook with --tags:

ansible-playbook -i inventory.ini site.yml --tags certificates
ansible-playbook -i inventory.ini site.yml --tags coreconfig
ansible-playbook -i inventory.ini site.yml --tags firewall

Available tags: prerequisites, install, certificates, coreconfig, federation, service, enrollment, firewall

# group_vars/tak_servers.yml
cert_country: "US"
cert_state: "Virginia"
cert_city: "McLean"
cert_organization: "MyOrg"

# group_vars/tak_servers.yml
cert_country: "US"
cert_state: "Virginia"
cert_city: "McLean"
cert_organization: "MyOrg"
cert_organizational_unit: "Operations"
ca_root_name: "MYORG-ROOT-CA-01"
ca_intermediate_name: "MYORG-ID-CA-01"
cert_password: "strongpassword"
enable_cert_enrollment: true
enable_federation: true
enable_ssl: true
enable_quic: true
enable_admin_ui: true
enable_webtak: true
server_endpoint: "tak.example.com"

# group_vars/tak_servers.yml
enable_fips: true
cert_password: "fips-compliant-password"

After the playbook completes, the webadmin.p12 admin certificate is fetched to fetched_files/<hostname>/webadmin.p12 on your control node. Import it into your browser to access the TAK Server admin UI at https://<server-ip>:8443.

1. Go to Settings > Privacy and Security > Security > Manage certificates
2. Click Import under the Your certificates tab
3. Select the webadmin.p12 file
4. Enter the certificate password (default: atakatak or your cert_password value)
5. Navigate to https://<server-ip>:8443 and select the imported certificate when prompted

1. Go to Settings > Privacy & Security > Certificates > View Certificates
2. Under the Your Certificates tab, click Import
3. Select the webadmin.p12 file and enter the certificate password
4. Navigate to https://<server-ip>:8443 and select the certificate when prompted

1. Double-click the webadmin.p12 file to open it in Keychain Access
2. Enter the certificate password when prompted
3. The certificate will appear in your login keychain
4. Navigate to https://<server-ip>:8443 in Safari

curl -k --cert-type P12 --cert fetched_files/<hostname>/webadmin.p12:<cert_password> \
  https://<server-ip>:8443/Marti/api/version

• The default certificate password atakatak is well-known. Change cert_password for any non-lab deployment.
• Consider using ansible-vault to encrypt group_vars/tak_servers.yml if it contains sensitive passwords:

  ansible-vault encrypt group_vars/tak_servers.yml
  ansible-playbook -i inventory.ini site.yml --ask-vault-pass

• Admin certificates (webadmin.p12) are fetched to the control node under fetched_files/. Protect this directory.
• The randomize_db_password option (enabled by default) generates a unique PostgreSQL password per deployment.

When configure_firewall: true, UFW rules are applied based on enabled features:

This role automates every interactive dialog prompt from the installTAK bash installer: