TAK — the Team Awareness Kit — is the situational-awareness system the US military built and then released to the world: everyone on your team appears as a marker on everyone else's map, live. Search-and-rescue units, event medics, hunting parties and airsoft teams all use it now, and the server side is free. The catch is that most guides assume Android and a comfortable relationship with Linux. This one assumes an iPhone and about an afternoon.
What you're building
Three pieces:
- A TAK server — the hub every device connects to. We'll use OpenTAKServer (OTS), a free, open-source server that runs happily on a $5/month VPS or a Raspberry Pi on your shelf.
- Clients — the apps on the phones. On iPhone that's Tactical GPS or iTAK; Android teammates use ATAK-CIV.
- Certificates — TAK encrypts everything with TLS, so each device enrolls for a client certificate once. OTS makes this a QR-code scan.
Step 1: get a server
Any small Ubuntu 22.04/24.04 machine works. Two sensible options:
- A cheap VPS (Hetzner, DigitalOcean, Vultr… the smallest tier is enough for a team). Best if your team spreads across cell networks — the server is reachable from anywhere.
- A Raspberry Pi at home — free to run, but you'll need to forward ports through your router, and your home IP becomes your server address. Fine for testing; a VPS is less friction for real use.
If you go the VPS route, also point a cheap domain (or a free subdomain from your registrar) at its IP. It's optional, but it unlocks a trusted TLS certificate later, which makes phone enrollment dramatically smoother.
Step 2: install OpenTAKServer
SSH in as a regular user (not root — the installer refuses) and run the official installer:
curl https://i.opentakserver.io/ubuntu_installer -L | bash -It installs Python, RabbitMQ, nginx and the server itself, generates a certificate authority, and sets everything up as system services. On a small VPS expect it to run for a while — get coffee. When it finishes, the web UI is at:
https://YOUR_SERVER_ADDRESS:8443Your browser will complain about the self-signed certificate on first visit — expected at this stage. Log in with the default administrator account and change the password immediately, then create a normal (non-admin) account for each person on your team.
Open the right ports in your VPS firewall or router before going further — see the table below. If enrollment or connection mysteriously fails later, a closed port is the cause more often than everything else combined.
| Port | Purpose |
|---|---|
8443 | Web UI and API (HTTPS) |
8446 | Certificate enrollment |
8089 | CoT streaming — TLS (the connection your phone keeps open) |
8088 | CoT streaming — plain TCP (avoid; unencrypted) |
Step 3 (recommended): a real TLS certificate
If you pointed a domain at the server, follow the OTS Let's Encrypt guide to replace the self-signed certificate with a trusted one. Ten minutes, free, and worth it: iPhones trust the server instantly, QR enrollment works without warnings, and you never have to shepherd teammates through certificate-trust dialogs.
Step 4: enroll your iPhone
In the OTS web UI, generate an enrollment QR code (you can give it an expiry date and a maximum number of uses — do both for anything you'll share around). Then, on the phone:
- Open the TAK settings in Tactical GPS and scan the QR code. The app requests a client certificate from the server, receives it, and configures the connection — one scan, done. The same QR works in iTAK.
- Watch for the connected indicator. Your callsign is now on the server.
Repeat per teammate — each person scans with their own account. Don't share one account across devices; per-user certificates are what let you remove a lost phone from the server without re-keying everyone. The app-side steps, including manual enrollment without a QR code, are in the Tactical GPS manual: Team — TAK Server.
Step 5: verify it actually works
- Open the map in the OTS web UI — your phone's marker should be there, moving as you move.
- Enroll a second device and confirm each sees the other on the map.
- Turn one phone to airplane mode and back — it should reconnect on its own or with one tap.
That's a working TAK network. Everything else — data packages, map overlays shared to the whole team, chat — builds on this foundation.
When things don't connect
- Enrollment fails instantly: port
8446is closed, or the address in the QR doesn't match how your phone reaches the server (public IP vs. LAN IP). - Enrolls fine, never connects: port
8089is closed. This split — enrollment works, streaming doesn't — is the classic signature of a half-opened firewall. - Certificate errors: self-signed server and the phone doesn't trust the CA. Fastest durable fix is Step 3 (Let's Encrypt).
- Everything worked yesterday: check whether your home IP changed (Pi setups) or the VPS firewall got reset by a rebuild.
Alternatives, for completeness
The official TAK Server from tak.gov is the reference implementation — heavier to run and aimed at government users. FreeTAKServer is another open-source option. For a small civilian team on iPhones, OTS hits the sweet spot of free, maintained, and genuinely easy — which is why this guide uses it, and why Tactical GPS's QR enrollment is built to work with it out of the box.
