#Configuration Reference

This page is the authoritative list of every knob the A&D / KotH fork exposes, grouped by where it lives:

• App config — process-level settings read from appsettings.json or environment variables at startup (database, Redis, container backend, the Ad:* infrastructure keys, XorKey).
• Per-game — event-wide A&D / KotH policy stored on the Game row; most are editable in the admin Game → Info form.
• Per-challenge — the ad: block on an individual A&D challenge.

Every default below is taken from the code. Where a value is read straight from configuration with no strongly-typed model, that is stated.

#App-level configuration

App config binds from appsettings.json (and appsettings.{Environment}.json) or, in containerised deploys, from environment variables using the standard .NET double-underscore nesting convention (Section__SubKey). The fork's reference deploy sets everything via the environment: block in docker-compose.yml; the JSON shapes below are equivalent.

#Connection strings

{
  "ConnectionStrings": {
    "Database": "Host=postgres;Database=gzctf;Username=gzctf;Password=gzctf",
    "Redis": "redis:6379,password=gzctf"
  }
}

As environment variables (compose style):

ConnectionStrings__Database=Host=postgres;Database=gzctf;Username=gzctf;Password=gzctf
ConnectionStrings__Redis=redis:6379,password=gzctf

#XorKey

XorKey is the master obfuscation key. It XOR-protects every secret stored at rest — the per-game Ed25519 signing private key (see Game.GenerateKeyPair / Game.Sign), the API encryption / token key pairs, and the XOR-obfuscated passwords in the admin config (build registry, SMTP, pull registry, captcha secret).

XorKey=gzctf-xor-key

#Container provider

The ContainerProvider section selects and configures the backend that launches challenge containers. It maps to the ContainerProvider model in Models/Internal/Configs.cs.

#Docker sub-config (ContainerProvider:DockerConfig)

# docker-compose.yml — Docker backend
environment:
  - ContainerProvider__Type=Docker
  - ContainerProvider__PortMappingType=PlatformProxy
  - ContainerProvider__EnableTrafficCapture=true
  - ContainerProvider__DockerConfig__ChallengeNetwork=challenges
  # EnforceEgressIsolation defaults to true; set false only to debug.

#Kubernetes sub-config (ContainerProvider:KubernetesConfig)

# docker-compose.yml — Kubernetes backend
environment:
  - ContainerProvider__Type=Kubernetes
  - ContainerProvider__KubernetesConfig__KubeConfig=/app/kube-config.yaml
  - ContainerProvider__KubernetesConfig__Namespace=gzctf-challenges
  - ContainerProvider__KubernetesConfig__ImagePullPolicy=IfNotPresent
  - ContainerProvider__KubernetesConfig__AllowCidr__0=172.0.12.0/24

#Ad:* infrastructure keys

These configure the A&D supporting sidecars (flag delivery, WireGuard VPN, SSH jump host, checker concurrency). They are read directly from IConfiguration at runtime (e.g. IConfiguration["Ad:Vpn:ConfigDir"], IConfiguration["Ad:FlagPullBaseUrl"]) — there is no strongly-typed config class, so set them exactly as named.

environment:
  - Ad__FlagPullBaseUrl=http://172.0.12.1:8080      # K8s only
  - Ad__Vpn__ConfigDir=/wg-config
  - Ad__Vpn__ClientCidr=10.13.37.0/24
  - Ad__Vpn__ServerEndpoint=1pc.tf:51820
  - Ad__Ssh__InternalSecret=$(openssl rand -hex 32)  # rotate before prod
  - Ad__Ssh__PublicHost=1pc.tf
  - Ad__Ssh__PublicPort=22022
  - Ad__Checker__MaxParallel=10
  - Ad__Checker__TimeoutSeconds=30

For the full deployment topology of these sidecars, see /guide/deployment/docker.

#Per-game A&D settings (admin → Game → Info)

These are stored as columns on the Game row (Models/Data/Game.cs) and are event-wide: every A&D service in the game shares one tick, one flag lifetime, one warm-up, and so on. Rounds span the whole game.

Each field is editable in the admin Game → Info form via GameInfoModel. The fields are nullable in the edit model and only overwrite the stored value when the caller actually supplies one (Game.Update does if (model.X is { } v) X = v;), so leaving a field blank keeps the existing value.

#Runtime-only A&D state (not in the Info form)

Two Game fields are toggled by the engine / operator at runtime rather than configured ahead of time and are not part of GameInfoModel:

#KotH scoring knobs (DB-only)

The two King of the Hill tuning parameters live on the Game row but are not exposed in GameInfoModel / the admin Game → Info form, and are not carried in the .gzevent manifest. Changing them requires a direct edit of the Game row in the database.

UPDATE "Games"
SET "KothHoldPointsPerTick" = 2.0,
    "KothRefreshTicks" = 8
WHERE "Id" = <gameId>;

See /guide/features/king-of-the-hill for how these feed into scoring, and /guide/features/scoring for SLA scoring details. Unlike SLA (which scales by sqrt(active teams)), KotH hold points are flat per held tick — KotH is a zero-sum race for one marker, so field size doesn't dilute it.

#Per-challenge A&D settings

A&D challenge knobs live on the GameChallenge row and are authored in the ad: block of a challenge's YAML (alias mapping in ChallengeYamlModel.AdSection), or edited per challenge in the admin challenge form (ChallengeUpdateModel). They are only consulted when the challenge type is AttackDefense.

# challenge.yml
name: notes-php
type: AttackDefense
category: Web
container:
  containerImage: registry.example.com/ad/notes-php:latest
  exposePort: 80
ad:
  checkerImage: registry.example.com/ad/notes-php-checker:latest
  allowEgress: true     # default
  allowSelfReset: true  # default

For the full challenge YAML schema (containers, flags, hints, provide files) and the .gzevent event manifest, see /guide/authoring/challenge-yaml and /guide/authoring/repo-bindings.