Graticula / v0.1.0 / source-available
A GIS server and its portal, from one container and one Postgres.
Server does what a GIS Server site does: services at /rest/services, published out of PostGIS, opened by the clients you already have. Studio does what the portal does — items, members, roles, groups, sharing. They are one process and one API with two doors, because the three tiers are fused rather than federated: no site to create, no data store tier to install, no portal to federate.
5 service types 18 of 22 geometry operations 1 process, 1 database 58 decision records
GET /rest/info
{
"currentVersion": 10.81,
"fullVersion": "10.81.0",
"authInfo": {
"isTokenBasedSecurity": true,
"tokenServicesUrl": "…/rest/generateToken",
"shortLivedTokenValidity": 720
}
}
The first document any ArcGIS client asks for, answered by this
server. isTokenBasedSecurity is what makes Pro prompt for credentials
instead of guessing from a 401.
The shape
If you have run ArcGIS Enterprise, you already know the shape of this
Same vocabulary, fewer moving parts — and two rows that map onto nothing, kept here rather than saved for later.
| In ArcGIS Enterprise | Here |
|---|---|
| A GIS Server site — SOM, SOCs, several machines | One server process. There is no site to create. |
| ArcGIS Data Store, installed and registered separately | The same PostgreSQL the server already needs. |
| An enterprise geodatabase registered as a data store | Your own PostGIS, registered — read and write where rights allow. |
| Server Manager | Server, the console an operator signs in to. |
| Portal for ArcGIS | Studio, where publishers work — items, members, roles, groups and sharing. One API, two doors, nothing to federate. |
| /arcgis/rest/services/… | /rest/services/… — the same document shapes. |
| Tokens from generateToken | Tokens from generateToken, at all three of its spellings. |
| not here: Publishing from Pro | Not supported. Publish on Server › Publish, in Studio, or over the admin API. |
| not here: Web tools and geoprocessing services | Not here at all, and not scheduled. |
What runs
Five service types, and what each one still cannot do
Read out of the code rather than off a roadmap. Where a surface is partial, the entry names the missing part.
Feature services
Query and edit a registered PostGIS table or a hosted layer. Identity, relationships and attachments are declared rather than reverse-engineered.
queryapplyEditsattachmentsqueryRelatedRecordsgenerateRenderer
Map services
Server-side drawing. A layer published without a style gets a generated appearance that reports itself as generated.
exportidentifylegend
Vector tile services
Tiles from hosted data, with a style document and a checked-in glyph set, so a label actually draws instead of silently rendering nothing. The sprite sheet answers and is empty — there is no icon library and no way to upload one.
Image services
Imagery is registered where it lies and never copied into the server. Raster function chains and mosaic datasets are not in it.
exportImageidentifytile
Geometry service
18 of 22 operations, including buffer, intersect,
union, difference and cut. Cost is bounded by
a worker with a deadline rather than by a cap on your input.
The four that are missing each refuse in their own words, with the reason
that applies to them and not a shared excuse.
And around them
ArcGIS Pro
Add a portal connection, sign in, browse My Content, add a layer and edit it. Measured against Pro over seven rounds, each read out of the request log.
Composing a service
Drag tables from a registered database into a tree, group them, order them, and publish the lot in one request and one transaction. The map beside it is drawn by the server out of those tables before any of it exists, so what you approve is what gets served. The coordinate system is the map’s own property: search every reference your PostGIS knows — by name, not just by number — or paste the definition for a grid that has no EPSG code.
Members, roles and sharing
An item is private to its owner until it is shared. Role privileges are editable rather than fixed. Every mutation is audited, and the log is a thing you can query.
Getting data in
Import GeoJSON, a zipped shapefile or a File Geodatabase — or define an
empty schema and fill it through applyEdits. A table already in a
database you registered needs no import at all: it is composed into a service where
it lies.
What is not here
What is missing, and what it costs you
This list is on the front page on purpose. Every item is a limit today, not a smaller version of something that works.
PostGIS, and nothing else
No Oracle, no SQL Server, no file geodatabase served in place. An enterprise geodatabase on Oracle has to move before this can serve it. The other engines are deferred, not cancelled.
No single sign-on
Local accounts and server-issued tokens only. There is no SAML, no OIDC, no Active Directory and no SCIM, so every account is one you create here. For a site with an identity provider, this is the first thing to weigh.
No geocoding service
Address parsing, matching and reverse geocoding are designed and unbuilt.
No web maps, apps or dashboards
Studio is the portal's job for content and people — items, members, roles, groups, sharing. It authors nothing: there is no web map to save, no app builder and no Living Atlas. Bring your own client; the services are the product.
No New ArcGIS Server connection
Pro’s server connection is a SOAP handshake that is not built and is not planned. A portal connection reaches the same content.
No migration tooling yet
Reading an existing site’s inventory and importing its service definitions is scoped and unwritten. Moving today means republishing by hand.
Labels in three scripts
The shipped glyph set covers Latin, Greek and Cyrillic. Chinese, Japanese, Korean and Devanagari are not in it, so a map cannot be labelled in them without generating further ranges first.
One machine
No site, no clustering, no failover. If the process is down, the services are down.
Not 1.0
v0.1.0. It runs and it is tested; it has not yet been operated in production by anybody but its author.
Still fits?
Run it in four stepsStart
Docker is the only thing you install
No .NET SDK, no PostgreSQL, no openssl.
-
Make a key for sealing credentials
There is no default. A published default key would make every credential in every deployment that forgot to change it readable from a backup.
docker compose run --rm --no-deps server keygen echo "GIS_SECRET_KEY=<the value it printed>" > .env
-
Create the schema
Explicit, never automatic: an old image started by accident must not rewrite a newer schema.
docker compose run --rm server migrate --apply
-
Start it
It generates its own certificate on first run and keeps it in a volume, so it survives a container replacement.
docker compose up -d
-
Claim the server
A fresh server has no administrator, so it refuses everything except setup and writes a single-use token to its log.
docker compose logs server | grep -A2 "SETUP REQUIRED" curl -k -X POST https://localhost:8443/rest/setup \ -H "Content-Type: application/json" \ -d '{"token":"…","name":"root","password":"a properly long password"}'
Then register a database and publish one of its tables — two calls to
/admin — and it is a feature service you can open in Pro, QGIS or
the JavaScript API:
/rest/services/places/FeatureServer/0
The record
Every claim above has a file behind it
This project writes down each decision with the alternatives it beat, each assumption with the status of its evidence, and each temporary compromise with the condition that will force it to be repaid. The status page is generated from those files rather than typed, because the two versions that were typed went stale within a day. If you want the reasoning behind anything on this page, it is there — including the arguments that lost.
Elastic License 2.0. Read it, run it, change it, distribute it, charge money for it. The one thing you may not do is offer it to third parties as a hosted or managed service. That is the whole restriction.
A graticule is the net of meridians and parallels drawn on a map. Graticula is the Medieval Latin word English borrowed it from.