Manage analyst and admin accounts across UNOCC, DPPA, and EOSG portals.
Stored in the dashboard_users table on Supabase.
Note: authentication itself still runs against the hardcoded list in
index.html — this panel manages the profile directory only.
Loading users…
API Registry
Searchable catalogue of API endpoints used across UNOCC projects — ACLED, USGS, WFP ArcGIS services, and more.
Add new endpoints, copy curl commands, and browse auth/parameter details.
HDX Resources
Auto-harvested catalogue of dataset URLs from the Humanitarian Data Exchange (HDX). Filter by data type,
country, format, or organization. Re-populated by 08_AUTOMATION/Scripts/hdx_harvest.py.
Add user
Geostats Analysis
ECDC Basemap
Add layer from API registry
Loading registry…
Self-Service Mapping Tool — Project Plan
Rollout proposal for UNOCC, DPPA/DPO & EOSG · Drafted 2026-04-23 · Updated 2026-06-10 ·
Open source markdown →
LIVE v1.0
1. Executive summary
The UNOCC Self-Service Mapping Tool is an internal web application that consolidates GIS map production,
request tracking, incident monitoring, and country factpacks into a single operational surface.
This plan scales it to a service for UNOCC, DPPA/DPO, and EOSG at a projected
~500 users within 12 months, on self-hosted infrastructure owned and funded by UNOCC.
Status (2026-06-10): the platform is LIVE. The public stack — TLS edge, API with
per-user auth + email allowlist, job queue, object storage, and a containerized QGIS render engine
producing all nine map products — is in production on a single KVM4 VPS. The native mobile app,
Orbis, is live on Android (sideloaded standalone build, verified on user devices) and
in TestFlight rollout on iOS under a paid Apple Developer membership. The LLM chat tier
(constraint 1) remains the principal unbuilt component of this plan.
1
LLM chat for every user — token cost scales with total headcount, not just analysts.
2
Self-hosted only — no managed PaaS. Inference can either go to a commercial LLM API over outbound HTTPS, or run on-prem.
3
Manual account issuance — no SSO in year 1; onboarding is a human step.
4
UNOCC-procured & UNOCC-funded from day one — a KVM4-class VPS is the baseline.
The chat backend routes each request to a capability tier. Specific models are chosen at deployment time
based on what procurement and security approve; the architecture does not hardcode a vendor or version.
Tier
Purpose
~ $/interaction
T1 — Lightweight
Simple Q&A, tracker lookups, short commands
$0.005
T2 — Standard
Multi-step reasoning, map chat with context
$0.015
T3 — Advanced
Heavy analyst tasks (opt-in, role-gated)
$0.07
Blended avg at a 70/30 T1/T2 mix ≈ $0.007 per interaction.
4. Live architecture ● IN PRODUCTION
Clients · Web + Mobile
Web dashboard (JWT login)
Orbis Android — sideloaded APK · LIVE
Orbis iOS — TestFlight · rolling out
Email delivery of finished maps
API plane · KVM4 (Docker)
Caddy TLS edge (maps.shirob.com)
FastAPI — auth, allowlist, audit
Baserow — job queue + users
MinIO — outputs, presigned URLs
Render plane · same VPS
QGIS 4.0.2 headless worker
9 products incl. PPTX decks
4 geostats pipelines (precise dates)
ACLED · UN Geodata · OSM · WB
LLM chat · NOT YET BUILT
Option A — commercial API (default)
Option B — on-prem open-weights
Tier 1 / 2 / 3 routing
Gates Phase 1 of this plan
All components are containerized and run on a single KVM4 VPS today (concurrency 1 on the render worker).
The proposed migration re-points these same containers onto UN Azure managed services —
Container Apps (API + UI, Baserow), PostgreSQL Flexible, Blob Storage, and a queue-triggered render Job — a
re-host, not a rebuild. Because everything is already Dockerized, cutover is a re-pointing
exercise (~2–3 weeks part-time) with zero downtime; the current environment keeps serving until the flip.
The self-service workflow (2026-06-11) — Request · Authenticate · Queue · Render · Store · Deliver,
with the full product catalog and the self-service advantage. Click to open the full-resolution PNG. Companion briefing:
unocc-dashboard-architecture-v2.md
· v1 (April 2026, superseded).
5. Cost model (USD)
Target platform: UN Azure (Container Apps, PaaS). Hosting is consumption-based - actual spend
tracks usage. Figures below are Azure public pay-as-you-go list prices (East US, June 2026); final figures
confirmed with OICT/UNOCC at provisioning.
Realistic ~30 users - year 1
~$235/mo
~$2,800 / year
Container Apps (API + UI, Baserow)$100
PostgreSQL Flexible$50
QGIS render job (per-second)$35
Storage + egress$13
Monitoring + security + other$37
Growth ~75 users - year 2+
~$405/mo
~$4,900 / year
Container Apps (API x2 + UI, Baserow)$175
PostgreSQL Flexible$75
QGIS render job (per-second)$70
Storage + egress$23
Monitoring + security + other$59
Proposed budget - held flat at a growth-scenario ceiling
Azure hosting
$450/mo
$5,400 / yr - growth ceiling + ~10% margin
Tools, APIs and analytical services
$550/mo
$6,600 / yr - dev + analysis tooling, API + data access
Total budget
$1,000/mo
~$12,000 / yr for year 1
Cost discipline built in: billing is consumption-based, so hosting tracks usage (~$235/mo at today's realistic load)
- the $450 line is a ceiling, not a burn rate. 1-year reservations on always-on services cut 20-35%
once usage is proven; retiring Baserow into native Postgres saves ~$30/mo. Budget alerts at 50/80/100% from day one.
Versus today: the platform currently runs on a shared commercial VPS at ~$15-30/mo, billed
personally, with no UN identity, SLA, or continuity. The Azure budget buys UN tenancy, Entra ID SSO, managed
backups/monitoring, and a platform a successor can operate.
6. Migration plan
Everything is already containerized - the hard work (QGIS rendering off the Mac into Linux Docker) is
done. Migration is a re-pointing exercise, not a rebuild: about 2 to 3 weeks part-time,
zero-downtime (the current environment keeps serving until cutover).
Phase 0
UN Azure access (about 1 wk, mostly waiting)
Subscription / resource group via OICT/UNOCC
Confirm Container Apps availability + billing
Naming, tagging, DNS for maps.un-domain
Exit: tenancy + budget approved
Phases 1-4
Lift to Azure (about 1 to 2 wks)
Storage: MinIO to Azure Blob + SAS presign
Data: Postgres Flexible + Baserow Container App
API: image to ACR to Container App + custom domain
Render: Azure Files + ACA Job (queue-triggered); test all products end to end
Phase 5
Cutover (2 to 3 days)
Repoint web users to maps.un-domain
Rebuild Orbis, new TestFlight build
Freeze + final data sync
Decommission VPS UNOCC containers
Phase 6
Hardening (1 to 2 wks post-cutover)
Entra ID SSO + Key Vault
Budget alerts + Defender for Cloud baseline
Optionally retire Baserow into Postgres
7. Key risks
#
Risk
Mitigation
R1
UN tenant policy blocks Container Apps / public ingress
Confirm in Phase 0; fall back to the same containers on a single Azure VM
R2
QGIS render slower on Azure Files than local disk
Benchmark in Phase 4; bake data into image or premium files (+$10-15/mo)
R3
Procurement / tenancy approval lead time
Start Phase 0 now; current environment keeps serving (zero downtime)
R4
Egress costs grow with adoption
Maps are 0.2 to 2.5 MB; even 5,000 downloads/mo is about $1 egress
R5
ehsa / dppa / factpack-PPTX product gaps
Independent of hosting; tracked separately
8. Decisions to unblock Phase 0
Azure subscription / resource group sponsored via OICT/UNOCC - billing arrangement + Container Apps policy confirmation.
Production DNS - agree the hostname (maps.un-domain).
Budget line - approve US$ 1,000/mo (about US$ 12,000/yr): $450 Azure hosting + $550 tools, APIs and analytical services.
Identity - Entra ID SSO scope + group mapping for Phase 6 hardening.
UAT lead nominated for the Phase 5 cutover (web + Orbis TestFlight).
