Project overview
Writing template: Record the hardware, software versions, network design, and test results for your own deployment. Only track devices whose owners have given informed consent.
Describe how Traccar runs on a Raspberry Pi and receives location updates from phones running the Traccar Client app. Use Tailscale for private administration and remote shell access to the Pi. Use an ngrok endpoint only for the specific tracker listener needed by remote phones; do not make the Traccar web administration interface public.
Goals and prerequisites
- Raspberry Pi: [Model, memory, storage, and Raspberry Pi OS version]
- Traccar: [Server version and installation method]
- Tracker clients: [Phone models, client versions, and opt-in users]
- Private access: Tailscale account, device authorization, and access policy
- Remote tracker access: ngrok account, endpoint type, assigned address, and current plan limits
- Power and network: [Power supply, Wi-Fi/Ethernet, and expected availability]
Network design
Document the exact Traccar protocol and listener port used by each phone. Traccar protocols may use raw TCP or UDP rather than HTTP, so select an ngrok endpoint type that supports the chosen protocol. Record the ngrok-provided hostname and port in each opted-in Traccar Client; do not assume an HTTPS URL can carry a raw tracker protocol.
| Path | Access method | Intended access |
|---|---|---|
| Phone to Traccar listener | [ngrok TCP/UDP or supported HTTP endpoint] | Location updates from opted-in devices |
| Administrator to Raspberry Pi | Tailscale | Private shell and system administration |
| Administrator to Traccar web UI | Tailscale only | Private configuration and map access |
Keep the administration UI private. Limit any public tunnel to the required tracker listener, and verify current ngrok free-plan endpoint and address limitations before relying on a URL that may change.
Deployment
Prepare the Raspberry Pi
- Install a supported Raspberry Pi OS release and apply security updates.
- Assign reliable storage and power; configure time synchronization and a restart policy.
- Install Traccar using the current official instructions for the chosen server release.
- Use the default database only for a small test or select and configure a suitable persistent database for the expected history volume.
Configure private administration with Tailscale
- Install Tailscale on the Pi and the administrator's devices.
- Authorize only the devices and accounts that need access.
- Confirm the Traccar administration UI is reachable over the private tailnet.
- Keep SSH and administrative services off the public tunnel.
Connect remote phones through ngrok
- Confirm the Traccar server's device protocol and listener port from the server configuration.
- Create an ngrok endpoint type that supports that protocol and points only to the matching Pi listener.
- Configure each opted-in Traccar Client with the assigned ngrok host and port.
- If the free endpoint address changes, update the clients and document the new address. Never include account tokens or private access credentials in this project page.
- Test that remote updates arrive while the admin UI remains inaccessible from the public endpoint.
Verification
| Check | Expected result | Actual result |
|---|---|---|
| Traccar server starts after reboot | Service is running and persistent | [Record result] |
| Private administration via Tailscale | Authorized administrator can reach the UI | [Record result] |
| Remote tracker connection | An opted-in test phone reports updates using the configured endpoint | [Record result] |
| Public exposure review | Only the required tracker listener is tunneled | [Record result] |
| Location data handling | Consent, retention, and account access are documented | [Record result] |
Privacy and maintenance
Location history is sensitive. Get clear consent from each device owner, use unique device identifiers, restrict access to the map and stored history, and set a retention period. Keep Traccar, Raspberry Pi OS, and Tailscale updated; periodically review authorized devices, tunnel exposure, backups, and ngrok plan changes.