{"id":13426412,"url":"https://github.com/maptiler/tileserver-gl","last_synced_at":"2026-04-06T03:05:55.230Z","repository":{"id":4331789,"uuid":"52776929","full_name":"maptiler/tileserver-gl","owner":"maptiler","description":"Vector and raster maps with GL styles. Server side rendering by MapLibre GL Native. Map tile server for MapLibre GL JS, Android, iOS, Leaflet, OpenLayers, GIS via WMTS, etc.","archived":false,"fork":false,"pushed_at":"2025-05-06T17:31:46.000Z","size":10065,"stargazers_count":2410,"open_issues_count":239,"forks_count":658,"subscribers_count":64,"default_branch":"master","last_synced_at":"2025-05-07T12:45:08.819Z","etag":null,"topics":["docker","gl-styles","mapbox-gl-js","maplibre-gl-js","openmaptiles","raster-map","tileserver","tileserver-gl","vector-tiles","wmts"],"latest_commit_sha":null,"homepage":"https://tileserver.readthedocs.io/en/latest/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/maptiler.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2016-02-29T08:47:38.000Z","updated_at":"2025-05-07T12:39:46.000Z","dependencies_parsed_at":"2023-10-17T04:32:42.719Z","dependency_job_id":"d192433b-1c96-4daa-8f09-8192f3fa2c43","html_url":"https://github.com/maptiler/tileserver-gl","commit_stats":{"total_commits":1118,"total_committers":85,"mean_commits":"13.152941176470588","dds":0.5805008944543828,"last_synced_commit":"760653901e52b70767bf9c724f6fb54dd0fd859a"},"previous_names":["klokantech/tileserver-gl"],"tags_count":104,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maptiler%2Ftileserver-gl","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maptiler%2Ftileserver-gl/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maptiler%2Ftileserver-gl/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maptiler%2Ftileserver-gl/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/maptiler","download_url":"https://codeload.github.com/maptiler/tileserver-gl/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254149638,"owners_count":22022846,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","gl-styles","mapbox-gl-js","maplibre-gl-js","openmaptiles","raster-map","tileserver","tileserver-gl","vector-tiles","wmts"],"created_at":"2024-07-31T00:01:33.882Z","updated_at":"2026-04-06T03:05:55.221Z","avatar_url":"https://github.com/maptiler.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","Tile Servers","docker","Apps","Servers"],"sub_categories":["JavaScript","Development"],"readme":"![tileserver-gl](https://cloud.githubusercontent.com/assets/59284/18173467/fa3aa2ca-7069-11e6-86b1-0f1266befeb6.jpeg)\n\n# TileServer GL\n[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/maptiler/tileserver-gl/pipeline.yml)](https://github.com/maptiler/tileserver-gl/actions/workflows/pipeline.yml)\n[![Docker Hub](https://img.shields.io/badge/docker-hub-blue.svg)](https://hub.docker.com/r/maptiler/tileserver-gl/)\n\nVector and raster maps with GL styles. Server-side rendering by MapLibre GL Native. Map tile server for MapLibre GL JS, Android, iOS, Leaflet, OpenLayers, GIS via WMTS, etc.\n\nDownload vector tiles from [OpenMapTiles](https://data.maptiler.com/downloads/planet/).\n## Getting Started with Node\n\nMake sure you have Node.js version **20** or above installed. Node 24 is recommended. (running `node -v` it should output something like `v24.x.x`). Running without docker requires [Native dependencies](https://maptiler-tileserver.readthedocs.io/en/latest/installation.html#npm) to be installed first.\n\nInstall `tileserver-gl` with server-side raster rendering of vector tiles with npm. \n\n```bash\nnpm install -g tileserver-gl\n```\n\nOnce installed, you can use it like the following examples.\n\nusing a mbtiles file\n```bash\nwget https://github.com/maptiler/tileserver-gl/releases/download/v1.3.0/zurich_switzerland.mbtiles\ntileserver-gl --file zurich_switzerland.mbtiles\n[in your browser, visit http://[server ip]:8080]\n```\n\nusing a config.json + style + mbtiles file\n```bash\nwget https://github.com/maptiler/tileserver-gl/releases/download/v1.3.0/test_data.zip\nunzip test_data.zip\ntileserver-gl\n[in your browser, visit http://[server ip]:8080]\n```\n\nAlternatively, you can use the `tileserver-gl-light` npm package instead, which is pure javascript, does not have any native dependencies, and can run anywhere, but does not contain rasterization on the server side made with Maplibre GL Native.\n\n## Getting Started with Docker\n\nAn alternative to npm to start the packed software easier is to install [Docker](https://www.docker.com/) on your computer and then run from the tileserver-gl directory\n\nExample using a mbtiles file\n```bash\nwget https://github.com/maptiler/tileserver-gl/releases/download/v1.3.0/zurich_switzerland.mbtiles\ndocker run --rm -it -v $(pwd):/data -p 8080:8080 maptiler/tileserver-gl:latest --file zurich_switzerland.mbtiles\n[in your browser, visit http://[server ip]:8080]\n```\n\nExample using a config.json + style + mbtiles file\n```bash\nwget https://github.com/maptiler/tileserver-gl/releases/download/v1.3.0/test_data.zip\nunzip test_data.zip\ndocker run --rm -it -v $(pwd):/data -p 8080:8080 maptiler/tileserver-gl:latest\n[in your browser, visit http://[server ip]:8080]\n```\n\nExample using a different path\n```bash\ndocker run --rm -it -v /your/local/config/path:/data -p 8080:8080 maptiler/tileserver-gl:latest\n```\nreplace '/your/local/config/path' with the path to your config file\n\n\nAlternatively, you can use the `maptiler/tileserver-gl-light:latest` docker image instead, which is pure javascript, does not have any native dependencies, and can run anywhere, but does not contain rasterization on the server side made with Maplibre GL Native.\n\n## Getting Started with Linux cli\n\nTest from command line\n```bash\nwget https://github.com/maptiler/tileserver-gl/releases/download/v1.3.0/test_data.zip\nunzip -q test_data.zip -d test_data\nxvfb-run --server-args=\"-screen 0 1024x768x24\" npm test\n```\n\nRun from command line\n```bash\nxvfb-run --server-args=\"-screen 0 1024x768x24\" node .\n```\n\n## Documentation\n\nYou can read the full documentation of this project at https://tileserver.readthedocs.io/en/latest/.\n\n## Security: Host header poisoning (HNP) mitigation\n\nWhen the server is started **without** `--public_url`, URLs in responses (WMTS, TileJSON, style JSON) are built from the request’s `Host` and `X-Forwarded-*` headers. If an attacker can influence these headers, the server may return URLs pointing to an attacker-controlled host (Host header poisoning). Clients that use those URLs can then be directed to malicious servers.\n\n**Recommended for production:**\n\n1. **Set a canonical public URL** so the server never derives host from the request:\n   ```bash\n   tileserver-gl --public_url https://your-domain.com/ --file your.mbtiles\n   ```\n\n2. **Or** restrict which hosts are allowed when not using `--public_url`, via the **allowed-hosts** list (default is `*`, i.e. no restriction):\n   - Set the environment variable **`TILESERVER_GL_ALLOWED_HOSTS`** to a comma-separated list of allowed hostnames (e.g. `localhost,myapp.example.com`). If the request’s host (or `X-Forwarded-Host`) is not in this list, the server returns **path-only** URLs instead of absolute URLs, so responses cannot be poisoned with an attacker’s host.\n   - Example:\n     ```bash\n     export TILESERVER_GL_ALLOWED_HOSTS=\"localhost,map.example.com\"\n     tileserver-gl --file your.mbtiles\n     ```\n   - If you do not set this variable (or set it to `*`), behavior is unchanged and all hosts are accepted; for public-facing deployments you should either use `--public_url` or set `TILESERVER_GL_ALLOWED_HOSTS` to your known host(s). See [SECURITY.md](SECURITY.md) for details.\n\n## Alternative\n\nDiscover MapTiler Server if you need a [map server with easy setup and user-friendly interface](https://www.maptiler.com/server/).\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaptiler%2Ftileserver-gl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmaptiler%2Ftileserver-gl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaptiler%2Ftileserver-gl/lists"}