TAK plugin

wsctl tak deploys a TAK Server into your Waveshift deployment and manages its users, groups and certificates, including on-device certificate enrollment for ATAK.

Read Plugins first for installation and prerequisites. TAK also needs openssl on your PATH, for certificate revocation.

Quick start

wsctl tak deploy             # TAK takes a few minutes to start after boot
wsctl tak status

wsctl tak bootstrap          # once per device: trust the Waveshift CA
wsctl tak user add alice
wsctl tak enroll alice       # scan the QR on the device; ATAK enrolls itself

wsctl tak destroy            # before 'wsctl destroy infrastructure'

Connecting

TAK listens on these ports inside the VPC, at tak.<domain>:

Port	Purpose	Authentication	Used by
8089	Streaming (TLS)	Client certificate	ATAK, WinTAK, iTAK
8443	Web UI and API	Client certificate	Browsers and tools with a certificate
8446	Web UI login and certificate enrollment	Password	Browsers, enrollment

Web UI from your workstation

wsctl tak proxy opens an SSM tunnel to port 8446. Browse to https://localhost:8446 and sign in as admin. The password is generated at deploy:

jq -r .plugins.tak.admin_password wsctl.json

Your browser warns about the certificate unless your machine trusts the Waveshift CA (wsctl cert export). For the client-certificate interface, forward 8443 instead: wsctl tak proxy --local-port 9443 --remote-port 8443.

Shell

wsctl tak connect opens a shell on the TAK host. wsctl tak connect --container goes straight into the TAK Server container, where TAK's own tools live (/opt/tak, UserManager.jar).

Devices

Devices need network access to the VPC, through the Waveshift VPN. Enrolling a device takes two steps:

1. Trust. wsctl tak bootstrap builds a data package containing only the CA certificate and prints a QR code to import it. Do this once per device.
2. Enrol. wsctl tak enroll <user> sets a one-time password on the user and prints a tak:// enrollment QR code. ATAK generates its own key pair, has it signed on port 8446 and connects on 8089. The private key never leaves the device.

For clients that cannot enrol, wsctl tak user export <user> --format datapackage produces a data package with a certificate instead.

Commands

Every command takes --help.

Lifecycle

Command	Notes
wsctl tak deploy	--version TAK image tag (default 5.5-RELEASE-58), --instance-type (default t4g.large, 8 GB memory minimum). Each falls back to the previous deploy's value. Refuses if TAK is already deployed.
wsctl tak destroy	Keeps the version and instance type for a redeploy.
wsctl tak status	Reads wsctl.json only; makes no AWS calls.
wsctl tak proxy	--local-port (default 8446, or the next free port), --remote-port (default 8446). Reports [OK] once the tunnel is up.
wsctl tak connect	Shell on the TAK host. --root for a root shell; --container for the TAK Server container.

Users: wsctl tak user <action> [flags] <username>

Action	Notes
add	--role ROLE_ADMIN, ROLE_READONLY or ROLE_ANONYMOUS (default); --groups a,b; --validity days (default 365)
list
update	--role; --add-groups, --remove-groups, --set-groups, and the same with -in (send only) and -out (receive only)
disable	Blocks the user but keeps their certificate, role and groups
enable	--role, --groups to override what was kept
remove	Revokes the certificate and deletes the user. --keep-cert skips revocation. revoke is an alias.
export	--format p12 (default), pem or datapackage; --output; --password; --team, --role (ATAK team colour and role, data package only); --qr, --qr-expiry (default 24h)

Groups, revocation and enrollment

Command	Notes
wsctl tak group list
wsctl tak group delete <group>	Removes the group from every user
wsctl tak crl show	Shows the certificate revocation list. Revoking happens in user remove.
wsctl tak bootstrap	--host (default: the TAK name), --output, --password, --qr-expiry (default 7 days)
wsctl tak enroll <user>	--host, --groups, --admin, --show-token (for WinTAK, which has no URL handler), --qr-output

Configuration

State lives in wsctl.json under plugins.tak:

Field	Set by	Cleared by destroy
version, instance_type, container_registry	deploy	No
instance_id, private_ip, domain, volume_size, deployed_at	deploy	Yes
keystore_password, database_password, admin_password	deploy (generated)	Yes

Everything else (region, profile, VPC, subnet, hosted zone, domain, assets bucket) comes from the core configuration. The assets bucket holds TAK's configuration template, user certificate backups, data packages and the revocation list under tak/, so wsctl destroy infrastructure removes them too.

Troubleshooting

Symptom	Cause
unknown command "tak" for "wsctl"	wsctl predates plugin support, or wsctl-tak is not on your PATH.
infrastructure not deployed: run 'wsctl deploy' first	Wrong directory, or core infrastructure is not deployed.
TAK Server already deployed	Run wsctl tak destroy first. The version and instance type are kept unless you pass new ones.
The device says the server's identity could not be verified, bootstrap import does nothing, or enroll hangs on Pending	Usually an undersized instance. TAK runs six Java services and PostgreSQL and needs 8 GB or more; below that, failures look like certificate faults.
Enrollment fails when --host is an IP address	The server certificate has DNS names only. Use the TAK name.
wsctl destroy infrastructure fails on VPC dependencies	TAK is still deployed. Run wsctl tak destroy first.

Never delete wsctl.json

It is the only record of the deployed infrastructure, and TAK's state is inside it.