Reitti

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Reitti by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

RG="reitti-prod"; LOCATION="eastus"; VM_NAME="reitti-01" IMAGE_URN="sac1647283583153:reitti-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name reitti-vnet --address-prefix 10.100.0.0/16 --subnet-name reitti-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name reitti-nsg az network nsg rule create -g "$RG" --nsg-name reitti-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name reitti-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:reitti-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name reitti-vnet --subnet reitti-subnet --nsg reitti-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

The stack runs as four containers (the Reitti app, PostGIS, Redis and the map tile cache) under one reitti.service, fronted by nginx. Confirm that the services are active and list the containers:

sudo systemctl is-active docker reitti nginx
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

The services report active and the four containers report healthy. Only the Reitti app is published, to 127.0.0.1:8090. PostGIS, Redis and the tile cache have no host port at all.

nginx on :80 is the single public front door. It proxies to the app, including the WebSocket/SSE live location stream.

Reitti ships upstream with a built-in admin account whose password is the well-known default admin. On the first boot of this VM, that password was rotated to a unique random value. A unique database password and cache password were also generated, and all the values were written to a root-only file.

The public :80 door stays closed until the rotation completes, so the default is never reachable over the network. Read the credentials:

sudo cat /root/reitti-credentials.txt

The file (mode 0600 root:root) holds ADMIN_USERNAME and ADMIN_PASSWORD, the account you sign in to the web UI with, plus WEB_URL and VM_IP. None of these values ship in the image. Every value is unique to this VM, so no two instances share a credential and there is no working default login.

The login page and the health endpoint are reachable without authentication. Every application page requires a logged-in session, and the upstream default admin / admin no longer works.

Run the following checks. They confirm that the login page and health endpoint are live, that the app root is protected when unauthenticated, that the default login is rejected, and that the per-instance admin credential authenticates:

ADMIN_PASSWORD=$(sudo grep '^ADMIN_PASSWORD=' /root/reitti-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'login page (no auth): %{http_code}\n' http://localhost/login
curl -s -o /dev/null -w 'health (no auth): %{http_code}\n' http://localhost/actuator/health
curl -s -o /dev/null -w 'app root (no auth): %{http_code}\n' http://localhost/ jar=$(mktemp);
curl -s -o /dev/null -c "$jar" --data-urlencode username=admin --data-urlencode password=admin http://localhost/login
curl -s -o /dev/null -w 'default admin/admin (authed root): %{http_code}\n' -b "$jar" http://localhost/ jar2=$(mktemp);
curl -s -o /dev/null -c "$jar2" --data-urlencode username=admin --data-urlencode "password=$ADMIN_PASSWORD" http://localhost/login
curl -s -o /dev/null -w 'per instance admin (authed root): %{http_code}\n' -b "$jar2" http://localhost/ rm -f "$jar" "$jar2"

The login page and health endpoint return 200. The app root returns 302, a redirect to the login page, so it is protected. The default admin / admin session is still redirected with 302, which means it is rejected. Only the per-instance admin session reaches the app root with 200.

This is the security model: no working default login, and the public door opens only after the per-instance admin password is set.

The same round trip is bundled as a single script on the image. It proves that the credential works end to end:

sudo /usr/local/sbin/reitti-roundtrip.sh

Browse to http://<vm-ip>/. Sign in with the ADMIN_USERNAME (admin) and the per-instance ADMIN_PASSWORD from Step 5.

The main view is an interactive map with a day timeline. After you connect a data source (next step) and Reitti processes the incoming points, your movements appear as a track for the selected day. The detected visits and trips are laid out along the timeline.

Use the date strip to move between days and the time slider to scrub through a day.

Open Settings then Integrations to connect the sources of your location data. Reitti accepts live data from the OwnTracks and GPSLogger phone apps, the Overland app, and an OwnTracks Recorder or MQTT feed. For one-off imports of GPX files or a Google Takeout export, open Settings then Import Data.

Each integration shows a ready-made setup URL that already contains this instance's address and the selected API token, so your phone can start sending points in minutes.

Open Settings then Devices to manage the devices that send you location data. Each device has a name, an accent color used to draw its track on the map, and a show-on-map toggle. A multi-device household can see each person's movements in their own color.

Add a device to get a token for a new phone, or set a default device for imports.

Reitti waits a short grace period after the last incoming point, then processes unprocessed data in batches. It filters implausible points, clusters stays into visits, connects them into trips, and reverse geocodes them into significant places.

You can tune visit sensitivity, transportation modes and the geocoding service under Settings. Larger imports are processed in the background, and the Job Status page under Settings shows progress.

All location data lives in the PostGIS database on a Docker volume. Uploaded files live on the Reitti data volume. Both volumes are on the VM's OS disk.

To back up, snapshot the disk from Azure or dump the database:

sudo docker exec reitti-postgis-1 pg_dump -U reitti reittidb | gzip > reitti-backup-$(date +%F).sql.gz

To export your own history, open Settings then Export Data. It produces GPX or GeoJSON that you can take elsewhere.

The image includes these components:

Application Reitti v5.1.0 (Spring Boot, AGPL-3.0, pinned by image digest)

Database PostgreSQL 17 + PostGIS 3.5 (pinned by image digest)

Cache Redis 7.2 (pinned by image digest)

Tile cache Reitti tile cache v5.1.0 (nginx OSM proxy, pinned by image digest)

Reverse proxy nginx on port 80 (single public front door)

Base image Ubuntu 24.04 LTS, fully patched at build time