Deploy hosted layers

Meratyn includes a Docker Compose profile for a headless GeoNode 5.1 and GeoServer 2.28 stack. Meratyn remains the admin application; the GeoNode web interface is infrastructure, not an embedded user workflow.

Local stack

Copy .env.example to .env, replace every hosted-layer password, and run:

docker compose -f docker/compose/admin.yaml --profile hosted-layers up --build -d
docker compose -f docker/compose/admin.yaml --profile hosted-layers ps

The first GeoNode initialization can take several minutes. Share is available at https://admin.mappview.mapptech.com.co, the Meratyn viewer at https://mappview.mapptech.com.co, and the optional loopback-only GeoNode diagnostic proxy at http://localhost:8081. Users should work in Share at /layers; the diagnostic port exists for administrators and health investigation.

GeoServer binds to 127.0.0.1:18081 for the host nginx route only. Install scripts/deploy/nginx/admin.mappview.mapptech.com.co.conf on the production host and reload nginx before deploying the stack. The route exposes OGC and GeoWebCache traffic while rejecting GeoServer administration paths. GeoServer is part of the normal code-service deployment batch so the loopback mapping is applied before the WMS health check runs.

The plugin registry is built and served by the plugins Compose service on 127.0.0.1:8789. Install scripts/deploy/nginx/plugins.mappview.mapptech.com.co.conf on the production host so the public plugin origin proxies to that container; do not maintain a second generated registry under /var/www.

Stop without deleting data:

docker compose -f docker/compose/admin.yaml --profile hosted-layers down

Named volumes retain admin objects, PostgreSQL databases, GeoServer data, GeoNode static/media data, and Redis state. Adding --volumes intentionally deletes the local environment and is not recoverable unless those volumes were backed up.

Services

Service	Role
`admin`	Product API, catalogue projection, policy, and admin UI
`geonode-django`	GeoNode metadata and ingestion API
`geonode-celery`	Asynchronous imports and provider jobs
`geoserver`	OGC and tile publication
`geonode-db`	GeoNode and spatial PostGIS databases
`geonode-redis`	Celery broker and results
`geonode-memcached`	GeoNode cache
`geoserver-data`	Initializes the GeoServer data directory
`geonode-proxy`	GeoNode nginx/static proxy; diagnostic exposure locally

The image versions match the official GeoNode 5.1 deployment family and are pinned in docker/compose/admin.yaml. Upgrade the GeoNode, GeoServer, data-directory, nginx, and PostGIS images as one tested stack.

geoserver-data copies the GeoNode GeoServer data directory into its named volume on first start and remains running after that. GeoServer waits for its global.xml healthcheck before it starts.

Configuration

The important Share/provider variables are:

Variable	Purpose
`GEONODE_API_URL`	Internal Django origin used by Share
`GEONODE_PUBLIC_URL`	Canonical proxy origin used when generating public links
`GEONODE_PUBLIC_HOST`	Host and port advertised by the publishing service
`GEONODE_HTTP_SCHEME`	Public `http` or `https` scheme
`GEONODE_ADMIN_USERNAME`	Service account used by the adapter
`GEONODE_ADMIN_PASSWORD`	Service account secret
`GEONODE_OAUTH2_CLIENT_ID`	OAuth2 client identifier used by the stock service stack
`GEONODE_OAUTH2_CLIENT_SECRET`	OAuth2 client secret; replace the development value
`GEONODE_REQUEST_TIMEOUT_MS`	Provider request timeout
`MAX_LAYER_BYTES`	Maximum local upload size accepted by the development service
`LAYER_ACCESS_TTL_SECONDS`	Direct-asset access-session lifetime, 60–3600 seconds

The Compose file also supplies database, map server, broker, site, host, administrator, and the stock image’s required STATIC_ROOT and MEDIA_ROOT mount paths. Values in .env.example are development placeholders, not production credentials.

Production rules

Terminate TLS at one public reverse proxy and expose Share as the product origin.
Do not publish Django, GeoServer administration, PostGIS, Redis, or memcached.
Prefer a dedicated least-privilege GeoNode service account over the bootstrap administrator once the required permissions are known.
Store credentials as platform secrets rather than Compose environment values.
Use S3-compatible storage and resumable multipart uploads for large datasets.
Set explicit request, archive, ingestion, and GeoServer resource limits.
Back up Share state, object storage, both PostGIS databases, and GeoServer data on a coordinated schedule, and test restoration.
Monitor failed import jobs, Celery queues, provider reconciliation, database capacity, asset storage, and tile/OGC latency.

GeoNode and GeoServer are stateful application services. A production upgrade requires release-note review, database backup, migration rehearsal, and a rollback plan; changing only an image tag is not a safe upgrade procedure.