TAK Server Configuration via Environment Variables

[chriselsen]

Fixes #710

Problem

CloudTAK has a chicken-and-egg configuration problem for automated deployments:

1. Manual Configuration Required: TAK server connection must be configured via web UI on first boot
2. Authentication Barrier: The /api/server PATCH endpoint requires a bearer token for configuration
3. Token Generation Impossible: Bearer tokens cannot be generated until the TAK server is already configured
4. Blocks Automation: This prevents fully automated CloudTAK deployments and container orchestration

Solution

Add support for TAK server configuration via environment variables during CloudTAK startup, bypassing the authentication requirement.

New Environment Variables

Variable	Description
CLOUDTAK_Server_name	TAK Server name/description
CLOUDTAK_Server_url	TAK Server connection URL (e.g., ssl://tak.example.com:8089)
CLOUDTAK_Server_api	TAK Server API URL (e.g., https://tak.example.com:8443)
CLOUDTAK_Server_webtak	TAK Server WebTAK URL
CLOUDTAK_Server_auth_cert	Client certificate (PEM format)
CLOUDTAK_Server_auth_key	Client private key (PEM format)
CLOUDTAK_Server_auth_p12_secret_arn	AWS Secrets Manager ARN for P12 certificate
CLOUDTAK_Server_auth_password	Password for P12/PKCS12 file
CLOUDTAK_ADMIN_USERNAME	Admin username for CloudTAK system
CLOUDTAK_ADMIN_PASSWORD	Admin password for CloudTAK system

Implementation

• Modified api/lib/config.ts: Added server environment variable processing during startup
• Fixed admin user creation: Added required auth field with password for database schema compliance
• Created comprehensive documentation: Added docs/ENVIRONMENT_VARIABLES.md
• Follows existing patterns: Uses CLOUDTAK_ prefix consistent with other configuration variables
• Override behavior: Environment variables override database values when present

Benefits

✅ Enables automated deployment - No manual web UI configuration required
✅ Maintains security - Certificates injected via secure environment variables or AWS Secrets Manager
✅ Backward compatible - Existing functionality unchanged
✅ Container-friendly - Perfect for Docker/Kubernetes deployments
✅ Admin user automation - Automatically creates admin users with system privileges
✅ AWS integration - Supports P12 certificates from AWS Secrets Manager

Usage Example

export CLOUDTAK_Server_name="Production TAK Server"
export CLOUDTAK_Server_url="ssl://tak.example.com:8089"
export CLOUDTAK_Server_api="https://tak.example.com:8443"
export CLOUDTAK_Server_webtak="https://tak.example.com:8446"

# AWS Secrets Manager approach (recommended)
export CLOUDTAK_Server_auth_p12_secret_arn="arn:aws:secretsmanager:region:account:secret:tak-cert"
export CLOUDTAK_Server_auth_password="atakatak"

# Admin user creation
export CLOUDTAK_ADMIN_USERNAME="admin"
export CLOUDTAK_ADMIN_PASSWORD="secure-password"

[chriselsen]

Added automatic admin user creation when CLOUDTAK_ADMIN_USERNAME and CLOUDTAK_ADMIN_PASSWORD are provided.

[chriselsen]

Summary of Changes

Key additions to the original PR:

1. Added AWS Secrets Manager support: CLOUDTAK_Server_auth_p12_secret_arn for P12 certificates stored in AWS Secrets Manager
2. Added admin user automation: CLOUDTAK_ADMIN_USERNAME and CLOUDTAK_ADMIN_PASSWORD for automatic admin user creation with system privileges
3. Fixed critical bugs:
   • Admin user creation database schema compliance (added required auth field)
4. Enhanced documentation: Created comprehensive docs/ENVIRONMENT_VARIABLES.md and docs/GITHUB_AUTO_PULL.md
5. AWS integration: Full support for AWS deployment patterns with Secrets Manager integration

Testing status: ✅ Successfully tested and deployed - All functionality has been validated in a live deployment environment, confirming automated server configuration, admin user creation, and secrets manager access work correctly.