On-premises wayfinding: run DigiMaps on your own server, even with no internet.
DigiMaps Server puts the whole platform on one machine on your network: Studio, the kiosk and visitor Wayfinder, the API, the database and nightly encrypted backups. It runs on Ubuntu Server, makes no outbound calls by default and takes updates from a file you carry in. A kiosk that has loaded the map once keeps working if the server goes down.
-
caddyTLS and routing. The only service with open ports -
apiREST API, live channel, kiosk fleet, statistics -
postgresPostGIS and pgvector database -
redisLive-event bus and rate limits -
wayfinderKiosk and visitor app -
studioMap editing and administration -
backupNightly encrypted backup
Three ways to run DigiMaps. This page is about the third.
Every option runs the same Studio, Wayfinder and API. On-premises suits hospitals, government buildings and any site whose policy keeps visitor data inside the building, or that has no internet connection at all.
Cloud, hosted by us
We run the servers. Kiosks, signage players, phones and staff browsers connect over HTTPS.
- Tenancy
- Shared platform, each organisation in its own account
- Connection
- HTTPS from every screen and browser
- Data location
- The region agreed in your contract
- If the internet drops
- Kiosks keep searching and routing from their cached map, then catch up
- Good fit
- One venue or a portfolio, with no server of your own to run
Dedicated cloud
A separate instance for one organisation, running the same software as the shared cloud.
- Tenancy
- Single tenant: only your organisation on the instance
- Connection
- HTTPS from every screen and browser
- Data location
- The region agreed in your contract
- If the internet drops
- Kiosks keep searching and routing from their cached map, then catch up
- Good fit
- Groups whose IT policy rules out shared hosting
On-premises server
One machine on your LAN runs the API, database, Studio and Wayfinder. Your data stays on that server and its backups.
- Operating system
- Ubuntu 22.04 or 24.04, or Windows 11 (22H2 or later) or Windows Server 2025 via WSL2
- Small site
- 16 GB RAM and 4 CPU cores. Medium and large profiles for bigger sites
- TLS
- Your own certificates, or a built-in internal certificate authority
- Network
- Firewalled to your kiosk and admin subnets
- Backups
- Nightly and encrypted, with a second copy and a verified restore
- Upgrades
- Health check after each upgrade, automatic rollback if it fails
- Air-gapped option
- No outbound calls by default, an offline update bundle, AI features off by default
- Good fit
- Hospitals, government buildings and sites with no internet connection
Same Studio, same Wayfinder, same API in every option.
What you need on install day.
One machine, wired to the LAN, on a UPS. The installer checks the operating system, memory, disk and ports, verifies the bundle checksums, writes random secrets and waits until every service is healthy. Running it again is safe.
| Profile | Typical host |
|---|---|
small
|
16 GB RAM, 4 cores for example an i5 mini-PC |
medium
|
32 GB RAM, 8 cores |
large
|
64 GB RAM, 16 cores |
The installer picks a profile from the memory it finds. We don’t publish a kiosk count per profile: the commissioning load check runs your kiosk count, plus a margin, against the real server.
Operating system
- Linux
- Ubuntu Server 22.04 or 24.04 LTS (amd64) with Docker Engine
- Windows
- Windows 11 Pro, Enterprise or IoT Enterprise 22H2 or later, or Windows Server 2025, through WSL2. Documented, but not yet run on a real Windows host: ask us for its status
- Virtual machine
- An Ubuntu VM on Hyper-V, if your policy prefers a conventional VM
The machine
- Free disk
- At least 60 GB on Linux or 100 GB on Windows, plus room for backup sets
- Network
- Wired, with a static address or a DHCP reservation
- Power
- On a UPS with the kiosk switch, set to power on after a power cut
Access and certificates
- Open ports
- 80 and 443 only, and only from the kiosk and admin subnets you list
- TLS
- Your site’s own certificates, or the built-in internal certificate authority
- Studio
- On the same server, at
studio.<your host>
Operator tools
- CLI
updownstatusbackupbackupsrestoreupgraderollbackcreate-adminfirewalllogsversion- Windows
- PowerShell scripts that drive the same CLI inside WSL
Kiosks on their own VLAN, with no route to the internet.
This is the layout we suggest to your network contractor, who owns the final design. Kiosks need no internet at all, so block the kiosk VLAN’s egress at the site firewall. The server’s own firewall accepts web traffic only from the subnets you list at install.
Kiosk VLAN 10.20.30.0/24
- K-01 Main entrance
- K-02 Outpatients
- K-03 Level 1 lifts
- K-04 Level 2 lifts
Wired where possible. No internet access needed.
Server VLAN
Site firewall routes the kiosk VLAN here
3Admin subnet 10.20.1.0/24
- Facilities office
- IT
- 1 Kiosks never need the internet. The server makes no outbound calls unless you configure them.
- 2 Port 80 serves the root certificate while kiosks are set up. Close it afterwards if you like.
- 3 Recommended: server in its own VLAN. Very small sites can put it in the kiosk VLAN.
- 4 Opening 443 to guest Wi-Fi also shows Studio’s sign-in page there. Your decision.
- 5 Many Android boards lose the time after a power cut, and a wrong clock breaks TLS.
| From | To | Port | For | Needed |
|---|---|---|---|---|
| Kiosk VLAN | Server |
TCP 443
|
App, venue map, API, live channel, heartbeats, statistics | Yes |
| Kiosk VLAN | Server |
TCP 80
|
Root-certificate download and the redirect to HTTPS | While setting up kiosks |
| Admin subnet | Server |
TCP 443
|
Studio and Wayfinder | Yes |
| Kiosks, server | Site NTP |
UDP 123
|
Time. TLS fails on a device with the wrong clock | Yes |
| Kiosks | Site DNS |
UDP/TCP 53
|
Find the server by name | Yes, unless hosts files |
| Server | Mail relay |
As configured
|
Kiosk offline alerts and reports by e-mail | Optional |
| Guest Wi-Fi | Server |
TCP 443
|
Visitors’ phones opening a QR hand-off | Your decision |
| Anything else | Server or internet |
Any
|
Deny |
What leaves the server: nothing, unless you switch it on.
DigiMaps Server runs with no internet connection: no outbound calls by default, and offline updates. Features that would need the outside world start switched off. Any outbound flow is one you configure yourself.
Off or absent by default
- AI-assisted floor-plan tracing. It proposes room outlines that your team reviews and completes. It can be switched off, and is off by default on-prem
- Font downloads. Latin, Cyrillic and Arabic map fonts ship inside the app. Other scripts, such as Devanagari, need a font file you supply
- Update checks and telemetry. None
- Outdoor basemap tiles. Off in the server build
Only when you configure them
- A mail relay for kiosk offline alerts and reports
- Webhook receivers, such as your paging or ticketing system
- Transit or flight-information feeds, with your own credentials
The server refuses webhook and feed targets on its own container network, loopback and link-local addresses.
How you check it
- Our build pipeline compiles the Wayfinder with networking disabled and flags any new third-party URL in its source
- At commissioning, an egress check opens the kiosk pages on your server in a real browser and lists every request that leaves it
- The offline check cuts the network in a real browser and confirms the kiosk still searches and routes
Updates arrive as one file you carry in, and roll back if they fail.
We build each release as one offline bundle on a connected machine: every container image, the installers and a checksum file. Nothing is pulled or built on site, and a bundle whose checksums don’t match is refused.
- 1 Back up An encrypted backup and a database snapshot. If either fails, nothing changes
- 2 Load The new images, from the bundle you carried in
- 3 Switch The server points at the new release
- 4 Migrate Database changes for the new release run once
- 5 Start The whole stack comes up
- Health gate Every service healthy, and the ready check answers through the proxy
The new release serves kiosks and Studio.
The previous release and the database snapshot come back on their own. digimaps rollback does the same by hand.
# On the server. The bundle came in on removable media.
sha256sum -c digimaps-server-X.Y.Z-amd64.tar.sha256
sudo digimaps upgrade digimaps-server-X.Y.Z-amd64.tar
sudo digimaps status
# Windows host, in an administrator PowerShell:
.\Upgrade-DigiMaps.ps1 -BundlePath E:\digimaps-server-X.Y.Z-amd64.tar- The pre-upgrade database snapshot is unencrypted and readable by root only, so a rollback works without the backup key. It is deleted after 24 hours once a newer backup succeeds, and after 7 days at most
- Database migrations run as part of the upgrade. Nobody runs them by hand
- Our build pipeline has tests for the CLI, the Windows scripts and a backup-to-restore round trip
Backups you can restore, and a status page that tells you first.
Every night the server writes an encrypted backup set and copies it to a second disk, then checks the copy. The database is encrypted as it is written, so the backup disk never holds a plain copy. The installer creates the decryption key for you to move off the server, and the status check warns while it is still there.
A restore checks itself before it swaps anything
- Stops the API, Wayfinder and Studio
- Verifies the checksums, decrypts the set and restores it into a side database
- Compares venue, release and user counts with the backup’s manifest
- Only then swaps the database in, keeping the previous one beside it
- Restarts everything and waits until it is healthy
Know this before you choose on-premises.
A server in your building gives you control, and some work that a cloud service would do for you. Settle these six points with your IT team before you choose.
- Row-level security is not enforced on the server. It serves one organisation, and separation between organisations relies on the API’s per-request tenant checks. We don’t claim row-level security for the on-premises edition.
- The Windows installer has not yet been run on a real Windows host. Our build pipeline checks that the Windows scripts parse and behave, but scheduled tasks, WSL and the Windows firewall need a real machine. Ask us for its current status before you plan on Windows.
- Kiosks must trust the server’s certificate, or offline mode cannot start. On Android 7 and later, WebView kiosk browsers ignore user-installed certificates unless the app opts in, so a certificate from a CA your devices already trust is the easiest route.
- QR hand-off to visitors’ phones needs guest Wi-Fi that reaches the server and a public-CA certificate. Otherwise switch it off.
- Floor plans in DXF import without AI. PDF tracing needs the AI service, so on an air-gapped site our team converts drawings or you work from CAD. See turning CAD and PDF floor plans into a live map.
- Your team runs the box. Operating-system patches, the UPS, a mail relay for alerts and moving the backup key off the server sit with your IT team. Backups are nightly, so up to a day of changes can be lost in a failure.
Questions IT teams ask about on-premises
Hospital teams: see how hospital wayfinding keeps staff-only areas off public screens.
Can DigiMaps run without an internet connection?
Yes. DigiMaps Server runs with no internet connection: no outbound calls by default, and updates arrive as an offline bundle you carry in. AI features are off by default on-premises, the map fonts ship inside the app, and there are no update checks or telemetry. Kiosks need one online load from the server before they can run from their cache.
What hardware does the on-premises server need?
One machine. The small profile is a 16 GB, 4-core host such as an i5 mini-PC, with medium (32 GB, 8 cores) and large (64 GB, 16 cores) profiles for bigger sites. It runs on Ubuntu Server 22.04 or 24.04 with at least 60 GB of free disk. A Windows option through WSL2 is documented; ask us for its current status before you plan on it.
What happens to the kiosks if the server goes down?
Kiosks keep working from the map they have cached, including search and directions, as long as they have loaded it once while online. Statistics queue on the kiosk and are sent when the server is back. Live closures and notices resume when the connection returns.
How do updates work on an air-gapped site?
We build an offline bundle that holds every image, the installers and checksums, so nothing is downloaded on site. The upgrade takes an encrypted backup and a database snapshot first, then runs a health gate. If the migration or the health gate fails, the previous release and the snapshot are restored automatically.
Can visitors’ phones use the map when the server is on our LAN?
Only if their phones can reach it. QR hand-off needs your guest Wi-Fi to reach the server on port 443 and a certificate from a public certificate authority, because phones will not trust the internal one. If that is not possible, switch QR hand-off off for the venue and kiosks still give directions on screen.
Does the on-premises edition include AI floor-plan tracing?
AI-assisted floor-plan tracing proposes room outlines that your team reviews and completes. It can be switched off, and is off by default on-prem, because it relies on a third-party AI service. DXF CAD drawings import without any AI, and our team can convert other drawings for you.
Plan an on-premises pilot
Tell us about your server, your network and how many kiosks you run. We will go through sizing, the firewall rules and the offline update routine with your IT team before anything is installed.