Show HN: A self-hosted flight and ship tracker you can rewind

A live map you can rewind, that tells you where every contact came from.

There is no shortage of dashboards that draw aircraft and ships on a globe. Nearly all of them are stateless viewers of somebody else's API: they show you this instant, they cannot show you last Tuesday, and they render whatever the upstream asserts without saying who saw it or how long ago. Velocity is self-hosted and keyless like those, and then does the two things they don't.

It keeps history you own. Flightradar24 gates replay at 7 days free, MarineTraffic cut its free window to 24 hours, ADS-B Exchange killed its free API tier outright, and a self-hosted tool just doesn't have that problem. The archive is a Postgres + TimescaleDB hypertable (positions, 6 hour chunks, columnar compression segmented by id, plus an hourly positions_hourly rollup); migrating the old SQLite file copied 55,352,047 rows at ~120k rows/s and the compressed hypertable measured 13.46x smaller, 11,300,810,752 bytes down to 839,786,496. Velocity records position history to your own disk for as long as you give it room, with a scrubber to rewind to any past moment, and SQLite remains the keyless fallback when no HISTORY_PG_DSN is set. No account, no API key, nobody who can paywall, filter or cut off your archive.

It scores what it shows you. Anyone can upload whatever they like to a crowd-sourced ADS-B aggregator; a contact appearing on a map is not evidence it was ever broadcast. So every contact carries which independent sources reported it, how many agreed, and how old the fix actually is — with the confidence rule written out rather than implied. Cached sources report the age of the data, not the age of the response, so nothing sits on the map looking live because it was fresh when we fetched it this morning. /api/status/provenance gives you the same picture per source, including how many contacts each one is alone in seeing.

On top of that: live aircraft, ships, satellites, GPS jamming, dark vessels, TFR airspace, military bases, naval warnings, earthquakes, outages and conflict events, correlated on the server instead of leaving you to eyeball six tabs.

Honest scope, since this is a tool for people who check things: coverage is whatever the public feeds give you, it is not uniform, and the console tells you where it is thin rather than drawing a confident empty ocean.

And once you've found something worth keeping, it stays evidence: a chain-of-custody evidence locker hashes every capture (a URL snapshot, an upload, a feed freeze) with SHA-256 and an append-only custody log, then rolls a case up into a self-contained HTML / PPTX report where every claim carries its provenance. All of it keyless, all of it on your disk.

It also runs as an MCP server, so an AI agent can query the same live feeds instead of guessing from its training cut-off — everything it returns is labelled as automated output, not sold as "AI insight."

Quick start · The apps · Take the tour · Query it from an AI agent

One take, real data: the live world → Europe → click an aircraft → its dossier and owned track → rewind the last hour.

The short version, against the trackers you already use (free tiers, as of July 2026):

Live coverage is the same community feeder data everywhere; the columns above are the paywall. Each cell is checkable on the vendors' own pricing pages.

Before you get excited: it's a single-analyst tool. Live derived state — the current incident list, AOI selections, watch-officer briefs — lives in memory and clears on restart; what you deliberately keep is durable (see Scope and limits): the position-history archive, the local ontology store (objects, case files, situations) and the evidence locker's custody chain all persist to disk. AIS is densest over Northern Europe (global coverage is sparser and terrestrial-biased), and the 3D satellite mode is a VRAM hog.

Use at your own risk. No warranty; the authors take no responsibility for your use of this tool or the data it pulls. Velocity scrapes third-party sources that have not authorised it — their terms bind you, the requests come from your IP, and rate limits, bans, and legal exposure are yours to absorb. Feeds are often incomplete, delayed, or spoofed, and the AI summaries can be confidently wrong. Not for safety-of-life, navigation, or any use where being wrong hurts someone. Read DISCLAIMER.md before you run it.

Honestly, not much. There are two ways to run it, pick whichever you're set up for:

Either way, you need a browser that can do WebGL2, so any recent Chrome, Edge or Firefox. The globe leans on your GPU, so on a laptop with switchable graphics do yourself a favour and push it onto the discrete card before you judge the frame rate.

And no keys. The core feeds (planes, ships, quakes, satellites, the basemap) all run without a single API key. Keys only ever add reach; see What it pulls in for what each one buys you.

Docker is the short road. It brings up the API, the web app and nginx together:

git clone https://github.com/AndrewCTF/velocity.git cd velocity cp .env.example .env # optional, leave it empty and it still works docker compose up # api + web + nginx on :8080

Now open http://localhost:8080. It comes up live, planes moving, ships, quakes, the lot, with nothing to configure in between — and position history is already recording to a Docker volume, so it's still there the next time you run docker compose up (set ARCHIVE_MODE=1 in .env for an open-ended archive instead of the default rolling window; see Scope and limits). The first time in, a short tour points out where things live; you can pull it back up whenever from ⚙ Settings.

That dock along the bottom is the archive. Pick a window (1h, 6h, 24h, 3d, 7d), click anywhere on the density strip, and the globe rewinds to that moment; the header swaps from Live to Replay, and one button puts you back. Playback runs at 1x through 3600x. The dated day-picker and the recording since … · GB · fixes ownership chip live in the 2D console at /2d, which reads the same /api/history/coverage archive.

The Play button drives the clock through half-hour tar1090 replay chunks with a 24-entry cache, decoding readsb's 16-byte heatmap entries in a Web Worker and appending each contact's samples to its SampledPositionProperty. Aircraft reach back to 2024 through the public readsb heatmap archives the backend proxies and caches (GET /api/history/upstream/chunk|tracks|coverage); one decoded adsb.lol chunk (2024-06-01 12:00 UTC) held 180 slices of 10 s and 3,953 aircraft tracks over Europe. Vessels have no public equivalent, so they replay only as far back as your own archive goes.

Local (open) mode. The compute-heavy endpoints — the LLM-backed Reports tabs, recon, and OSINT enrichment — fail closed on a keyless box so a public deployment can't be made to spend GPU/credits by an anonymous caller. The dev docker compose up sets ALLOW_UNAUTHENTICATED=1 for you (the stack is loopback-only), so those features work out of the box and the UI shows an open-mode banner. Configure API_KEY or Supabase in .env and real auth takes over (the flag becomes irrelevant). For an internet-facing box use docker-compose.prod.yml, which leaves the flag unset. The globe, replay, evidence capture, and all keyless feeds never needed the flag.

The stack listens on 127.0.0.1 only, on purpose: the dev stack runs in open mode, so anything that can reach it can use it. To reach your own instance from your phone, put it on your tailnet instead of your LAN:

tailscale serve --bg 8080 # https://<this-machine>.<your-tailnet>.ts.net

Then add that origin to .env and restart, or the API refuses the new Host header (the DNS-rebinding guard in app/origin_guard.py):

CORS_ORIGINS=http://localhost:8080,https://<this-machine>.<your-tailnet>.ts.net

Only devices signed in to your tailnet can open it. Don't use tailscale funnel, which publishes it to the whole internet. For anything wider than your own devices, run docker-compose.prod.yml with Supabase sign-in configured (docs/security/auth-and-sessions.md); it fails closed without a credential.

make install # pnpm install + api venv cd apps/api && .venv/bin/uvicorn app.main:app # backend on :8000 pnpm dev # vite on :5173, proxies /api to localhost:8000

Set API_PROXY_TARGET if the backend isn't on http://127.0.0.1:8000; the dev server proxies /api, /tiles and /ws there, so the browser stays same-origin. (VITE_API_URL is different: it makes the browser call the API directly, cross-origin, and is only for builds with no proxy in front.) API_KEY is for servers, the CLI and the MCP server. Never build it into a hosted web bundle, because anyone who loads the page can read it. Browsers sign in with Supabase instead (docs/security/auth-and-sessions.md).

Velocity isn't one mega-dashboard; it's a workspace of fourteen apps that all share the same selection and time context, so switching never loses the object you had selected. The launcher in the top bar groups them:

The rest of this README tours the ones you'll live in. Everything below is a real screenshot of the current build (v1.0.1), taken against live feeds on 2026-08-08, not a mockup. node scripts/screenshot-readme.mjs re-shoots the whole set.

1. The whole planet, live. Thousands of aircraft plus vessels, satellites, quakes and more on one Cesium globe. Every aircraft and ship renders as its category icon, coloured and rotated to its heading; dense areas cluster into count badges you can drill into.

2. Zoom anywhere, toggle everything. Drag into a region and traffic, labels and coastlines fill in. The left rail is the whole intel stack in one tree — air, maritime, space, ground hazards, signals and 18 infrastructure layers — each with its live count. A right-side map toolbar adds the analyst verbs on top of the globe: measure a running great-circle distance, area-select a box and search every object inside it, annotate with dropped markers, or move a marker — plus one-click camera reset and zoom.

3. Click anything. Select an aircraft or vessel and the right panel fills with its dossier: identity, kinematics, the flight/route, ACARS, a pattern-of-life baseline, GPS integrity and the raw fields — while a magenta line traces its recent track on the globe. An AI assessment block (labelled, and grounded in the observed track) summarises what the dossier fields imply. Click empty space and it all clears.

4. Or query the whole store at once. The Explorer app is every live object in one filterable, sortable table — tens of thousands of tracks across vessels, aircraft and quakes, each tagged with the feed it came from and how long ago it was seen. Facet it, save the search, export the result to CSV.

5. Chokepoints and AOIs, watched continuously. A curated library of the world's maritime chokepoints — Hormuz, Bab-el-Mandeb, Malacca, the Taiwan Strait, the English Channel, undersea-cable corridors — each with live transit counts and the daily oil-flow figures that make it matter. Standing detections fire against them in the background.

6. Airspace, bases, ports and airports — operational context, still keyless. Toggle the TFR/Airspace layer and live FAA temporary flight restrictions draw as real polygons, coloured by reason with their altitude bands. Alongside them: 7,183 military bases (air, naval and army, from Wikidata), NGA NAVAREA broadcast warnings with mine areas flagged, 3,804 ports from the NGA World Port Index (harbour size and type, shelter, repairs, dry dock, pier and channel depths), and airports enriched with runways (length, surface, lighting, per-end ILS category from FAA NASR), tower/ground/ATIS frequencies, live METAR with flight category, and a LiveATC linkout. A basemap picker swaps between nine keyless map styles (Carto dark, 3D satellite + terrain, Apple satellite, Esri imagery/topo/dark, OpenTopoMap, USGS, Sentinel-2 cloudless), each probed live before it's offered and each carrying its required attribution.

7. Space, with real physics.