Graticula / v1 / source-available
A GIS server and its portal, from one container and one Postgres.
Server does what a GIS Server site does: services at /rest/services, published out of PostGIS, Oracle, SQL Server, MySQL, MariaDB or GeoParquet files — on the server, on the web or in S3 — opened by the clients you already have. Studio does what the portal does — items, members, roles, groups, sharing. They are one process and one API with two doors, because the three tiers are fused rather than federated: no site to create, no data store tier to install, no portal to federate.
5 service types 22 of 22 geometry operations 1 process, 1 database 171 decision records
GET /rest/info
{
"currentVersion": 12.1,
"fullVersion": "12.1.0",
"authInfo": {
"isTokenBasedSecurity": true,
"tokenServicesUrl": "…/rest/generateToken",
"shortLivedTokenValidity": 720
}
}
The first document any ArcGIS client asks for, answered by this
server. isTokenBasedSecurity is what makes Pro prompt for credentials
instead of guessing from a 401.
The shape
If you have run ArcGIS Enterprise, you already know the shape of this
Same vocabulary, fewer moving parts — and two rows that map onto nothing, kept here rather than saved for later.
| In ArcGIS Enterprise | Here |
|---|---|
| A GIS Server site — SOM, SOCs, several machines | One server process. There is no site to create. |
| ArcGIS Data Store, installed and registered separately | The same PostgreSQL the server already needs. |
| An enterprise geodatabase registered as a data store | Your own PostGIS, Oracle, SQL Server, MySQL or MariaDB, registered — read and write where rights allow. Oracle’s SDO_GEOMETRY tables are served as they are, with no geodatabase installed. |
| A folder of files registered as a data store | A folder of GeoParquet files, an s3:// prefix or an https:// file, registered by name and read in place by DuckDB — for reading only. |
| Server Manager | Server, the console an operator signs in to. |
| Portal for ArcGIS | Studio, where publishers work — items, members, roles, groups and sharing. One API, two doors, nothing to federate. |
| /arcgis/rest/services/… | /rest/services/… — the same document shapes. |
| Tokens from generateToken | Tokens from generateToken, at all three of its spellings. |
| not here: Publishing from Pro | Not supported. Publish on Server › Publish, in Studio, or over the admin API. |
| not here: Web tools and geoprocessing services | Not here at all, and not scheduled. |
What runs
Five service types, and what each one still cannot do
Read out of the code rather than off a roadmap. Where a surface is partial, the entry names the missing part.
Feature services
Query and edit a registered PostGIS, Oracle, SQL Server, MySQL or MariaDB table or a hosted layer, and query a GeoParquet file where it lies. Identity, relationships and attachments are declared rather than reverse-engineered. A query answers as JSON, GeoJSON or PBF, filters by time where a layer has a time field, and keeps Z and M.
queryapplyEditsattachmentsqueryRelatedRecordsgenerateRenderer
Map services
Server-side drawing, by time where a layer has one. A layer published without a style gets a generated appearance that reports itself as generated.
exportidentifylegendquery
Vector tile services
Tiles from the data this server holds, as ArcGIS serves them from hosted data — a registered database or file is served as features and maps — with a style document and a checked-in glyph set, so a label actually draws instead of silently rendering nothing. Labels draw in Latin, Greek, Cyrillic, Arabic, Hebrew, Armenian, Georgian and Thai; Devanagari, Bengali and Tamil are served and MapLibre draws them unshaped; Chinese, Japanese and Korean need an image built for them. A service may carry several named styles, and a publisher uploads a sprite sheet per service, so a style can draw icons; the server checks the style's icon names against it. The cache can be seeded before the first request, and an expired tile stands in while its source refuses. A service may be cut on a TUREF grid instead of Web Mercator, and every TUREF grid holds the whole of Türkiye, its seas included. An edit made through this server empties the layer's tiles at once; a registered table edited in another tool can be drawn up to its cache lifetime late, five minutes by default. A layer's own picture markers are drawn on every face: the server packs them into the service's sprite sheet and the style draws them from it. There is no shared icon library.
tileresources/stylesexportTiles
Image services
GeoTIFF, JPEG 2000, NetCDF, HDF, ERDAS Imagine and ASCII grids uploaded from Studio, or GeoTIFFs registered where they lie; a NetCDF of variables over time and depth becomes a multidimensional service of slices. Each service is a mosaic dataset's catalog, queried, ordered or composited by a mosaic rule — seamlines included — reordered in Studio and edited as ArcGIS edits one. Eleven raster functions from Hillshade and NDVI to Clip and Statistics, measurement on the ground, a raster attribute table, Download and pyramids. MrSID and ECW are refused by name: only their makers' SDKs read them.
exportImageidentifyquerymeasuregetSamples
Geometry service
All 22 operations, including buffer, intersect,
union, difference, cut, project,
autoComplete, reshape and trimExtend. Cost is
bounded by a worker with a deadline rather than by a cap on your input.
findTransformations lists the datum transformations between two
references, and project applies the one you name.
And around them
ArcGIS Pro
Add a portal connection, sign in, browse My Content, add a layer and edit it. Measured against Pro over seven rounds, each read out of the request log. Vector tile services draw in Pro 3.x, classified styles included.
Composing a service
Drag tables from a registered database into a tree, group them, order them, and publish the lot in one request and one transaction. The map beside it is drawn by the server out of those tables before any of it exists, so what you approve is what gets served. The coordinate system is the map’s own property: search every reference your PostGIS knows — by name, not just by number — or paste the definition for a grid that has no EPSG code.
Members, roles and sharing
An item is private to its owner until it is shared. Role privileges are editable rather than fixed. Every mutation is audited, and the log is a thing you can query.
Getting data in
Import GeoJSON, a zipped shapefile or a File Geodatabase — or define an
empty schema and fill it through applyEdits. A table already in a
database you registered needs no import at all: it is composed into a service where
it lies.
OGC clients
The same layers over OGC API – Features (filtered in CQL2), WFS 2.0 and 1.1 with WFS-T editing, and WMS 1.3.0 with SLD — image services
in WMS too, and each service at its own ArcGIS-style WMSServer and
WFSServer address, image tiles over WMTS, image values as WCS 2.0.1 coverages and any map in Google Earth through
generateKml, each switched on and off per service and each an INSPIRE View or Download service when its owner says so — and the same
vector tiles over OGC API – Tiles, TileJSON 3.0 and WMTS 1.0. No client has been
watched reading the three tile faces yet.
Tiles to take offline
A vector tile service exports as a VTPK, through ArcGIS’s
exportTiles, or as a PMTiles archive — off until the service’s
owner turns it on. ArcGIS Pro opens both kinds of VTPK, on Web Mercator and on TUREF;
Esri’s own export client — the Maps SDK Field Maps is built on — completes
exportTiles against it; pmtiles verify accepts the archive and
MapLibre draws it. The Field Maps app itself has not been watched.
What is not here
What is missing, and what it costs you
This list is on the front page on purpose. Every item is a limit today, not a smaller version of something that works.
PostGIS, Oracle, SQL Server, MySQL and MariaDB, for databases
No file geodatabase served in place. Oracle since v1.0.441: a registered database’s SDO_GEOMETRY tables are queried and edited in place, with Z and M, GlobalIDs, row versions and related records, and with attachments and a history where an administrator switches them on, as for a registered PostGIS table — no versioning, and a new row’s key made by the database. An Esri enterprise geodatabase’s own ST_GEOMETRY tables are not read. MySQL 8.0 or later since v1.0.446, to the same scope — x and y only, since MySQL stores no Z or M, and a history only where the server lets the connected user create triggers. ArcGIS Pro has no MySQL connection; it reaches these layers through the FeatureServer. The console registers both beside PostGIS. MariaDB 10.6 or later since v1.0.447, as a dialect of the same provider and to the same scope; a publish says MariaDB’s validity was not measured, and counts rows held in another reference than the column’s. SQL Server 2016 or later since v1.0.449: geometry and geography tables queried and edited in place, x and y, with attachments since v1.0.450, without a history or related records yet, registered through the admin API; it does not run on the demo’s arm64 server. No registered source serves vector tiles. The other engines are deferred, not cancelled. GeoParquet files are the one thing served where they lie — on the server, over https or in S3 — and only for reading (a DuckDB database file or a MotherDuck database is edited since v1.0.449, where it can be opened for writing): no edits, no attachments, no related records, and a distance filter only in a projected reference. Every other spatial relation is decided by the geometry engine the Geometry service runs.
Single sign-on, not yet proven against a real provider
OpenID Connect (Entra ID, Keycloak, Okta, Google), LDAP and Active Directory, and SAML 2.0 (AD FS, Entra ID) sign people in, and their groups there can decide their role and groups here. Each is tested against a provider the test suite runs, not yet against a real Entra ID, AD FS or Active Directory. There is no SCIM: an account is made at its first sign-in or by hand, and a change of groups arrives at the person's next sign-in. Nested Active Directory groups are not followed, a SAML assertion must not be encrypted, and signing out ends this server's session only.
No offline editing
No createReplica and no sync, so Field Maps offline areas and
Pro’s Download Map cannot take this server’s features offline.
Deferred from v1 by decision, not overlooked. Vector tiles can be taken offline as a
package, which Pro opens and Esri’s Maps SDK fetches through exportTiles.
No geocoding service
Address parsing, matching and reverse geocoding are designed and unbuilt.
No apps or dashboards
Studio is the portal's job for content and people — items, members, roles, groups, sharing. It authors one thing: a web map, saved as an ArcGIS Web Map that Pro and the Maps SDK open. There is no app builder, no dashboards and no Living Atlas. Bring your own client; the services are the product.
No New ArcGIS Server connection
Pro’s server connection is a SOAP handshake that is not built and is not planned. A portal connection reaches the same content.
Migration from ArcGIS Server, definitions only
graticula tools inventory reports what an existing site would bring
across; graticula tools migrate publishes its layers’ drawing and
field aliases over tables already registered here. The data stays where it is.
Sharing, editing settings, domains and subtypes are not carried, and GeoServer is
not read.
Labels, script by script
Latin, Greek, Cyrillic, Armenian, Georgian, Thai, Arabic and Hebrew label on
every face; MapLibre needs its RTL text plugin for Arabic and Hebrew. Devanagari,
Bengali and Tamil are drawn correctly on map images and unshaped by MapLibre.
Chinese, Japanese and Korean need an image built with GLYPHS_CJK=1.
One machine
No site, no clustering, no failover. If the process is down, the services are down.
Not yet operated in production
Released as v1, a patch for every change. It runs and it is tested; it has not yet been operated in production by anybody but its author.
Still fits?
Run it in four stepsStart
Docker is the only thing you install
No .NET SDK, no PostgreSQL, no openssl.
-
Make a key for sealing credentials
There is no default. A published default key would make every credential in every deployment that forgot to change it readable from a backup.
docker compose run --rm --no-deps server keygen echo "GIS_SECRET_KEY=<the value it printed>" > .env
-
Create the schema
Explicit, never automatic: an old image started by accident must not rewrite a newer schema.
docker compose run --rm server migrate --apply
-
Start it
It generates its own certificate on first run and keeps it in a volume, so it survives a container replacement.
docker compose up -d
-
Claim the server
A fresh server has no administrator, so it refuses everything except setup and writes a single-use token to its log.
docker compose logs server | grep -A2 "SETUP REQUIRED" curl -k -X POST https://localhost:8443/rest/setup \ -H "Content-Type: application/json" \ -d '{"token":"…","name":"root","password":"a properly long password"}'
Then register a database and publish one of its tables — two calls to
/admin — and it is a feature service you can open in Pro, QGIS or
the JavaScript API:
/rest/services/places/FeatureServer/0
The record
Every claim above has a file behind it
This project writes down each decision with the alternatives it beat, each assumption with the status of its evidence, and each temporary compromise with the condition that will force it to be repaid. The status page is generated from those files rather than typed, because the two versions that were typed went stale within a day. If you want the reasoning behind anything on this page, it is there — including the arguments that lost.
Graticula Community License 1.1. Use it, run it commercially, deploy it for clients, host it for third parties as a paid service, pass on unmodified copies. Changing it needs the copyright holder's written permission. That is the whole restriction.
A graticule is the net of meridians and parallels drawn on a map. Graticula is the Medieval Latin word English borrowed it from.