#Quick Start

This guide takes you from a clean Docker host to a running platform with your first Attack & Defense (A&D) or King of the Hill (KotH) game. You stand the platform up from the TCP1P/gzctf-platform-template repo: it ships the published image, Traefik + Let's Encrypt TLS, and a one-shot wizard. Three make commands and you have a live, HTTPS platform.

The short version:

git clone https://github.com/TCP1P/gzctf-platform-template
cd gzctf-platform-template
make wizard       # interactive — prompts for your hostname, prints the admin password ONCE
make setup        # create the external docker networks
make platform-up  # start gzctf + db + cache + traefik (+ wireguard + ssh-jump for A&D)

Then log in at https://PUBLIC_ENTRY as user Admin with the password the wizard printed.

For exhaustive deployment options see /guide/deployment/docker; for every configuration key see /config/appsettings.

#Prerequisites

• Docker Engine with the Compose v2 plugin (docker compose ..., not the legacy docker-compose binary).
• The Docker daemon socket at /var/run/docker.sock — the gzctf container bind-mounts it so it can spawn and manage challenge containers directly on the host.
• A DNS name pointing at the host: set PUBLIC_ENTRY to a hostname (e.g. ctf.example.com) whose A record resolves to this machine. Let's Encrypt issues the TLS cert over an HTTP-01 challenge, so the name must be publicly reachable on port 80 at boot.
• Inbound ports: 80/tcp + 443/tcp (Traefik / ACME / web UI). For A&D you also need 51820/udp (WireGuard) and 22022/tcp (SSH jump, override with AD_SSH_PUBLIC_PORT).
• A host kernel with the tun module available (/dev/net/tun) if you run the WireGuard sidecar for A&D VPN access.

#1. Clone + run the wizard

git clone https://github.com/TCP1P/gzctf-platform-template
cd gzctf-platform-template
make wizard

make wizard (scripts/wizard.sh) is an interactive first-time setup. It prompts for:

Everything else is auto-generated so you never hand-pick a secret:

• WORKSPACE — a gzctf-<8 hex> compose project name + Traefik route suffix.
• XOR_KEY — openssl rand -hex 32; encrypts registry passwords + repo-binding tokens at rest.
• ADMIN_PASSWORD — the seed password for the initial Admin user. The Aa1 prefix satisfies ASP.NET Identity's password policy (uppercase + lowercase + digit).
• POSTGRES_PASSWORD — the Postgres credential, kept in step between the db container and gzctf's connection string.

The wizard writes compose/.env and compose/appsettings.json (both chmod 600, both gitignored) and refuses to overwrite an existing appsettings.json — delete it first if you need to re-run.

#2. Create the networks + bring it up

make setup        # creates the external 'traefik' + 'challenges' docker networks (idempotent)
make platform-up  # renders appsettings.json if missing, then 'docker compose up -d'

make platform-up first runs init-config (which renders compose/appsettings.json from appsettings.example.json if it is not already present) and then docker compose -f compose.yml -f compose.traefik.yml up -d. That brings up the full stack:

Watch progress and verify health:

make platform-logs    # tail all services
make gzctf-logs       # tail gzctf only

make help lists every target — including platform-down, platform-restart, flush-cache (redis FLUSHALL, rebuilds the scoreboard cache on next request), and the image-update flows (pull / update, or the targeted pull-gzctf / update-gzctf which only recreates the gzctf container).

#3. Log in

Open the web UI:

https://PUBLIC_ENTRY

Log in as user Admin with the password the wizard printed in step 1, then change it from the profile menu. From here, head to the admin area to set up your game.

make platform-up-no-traefik

#Load example challenges

The fastest way to see the A&D/KotH engine end to end is to import the public, ready-to-run event repo TCP1P/TCP1PADTesting. The GZCTF server clones the repo itself, globs its .gzevent manifest, and creates one game with four challenges — no challenge authoring required.

1. In the admin area open Repo Bindings and click Add:
   • Repo URL: https://github.com/TCP1P/TCP1PADTesting
   • Ref: leave empty (default branch)
   • Interval (seconds): 60
   • Token: none — the repo is public
2. Click Scan now to import immediately rather than waiting for the poll interval.

The scan creates one game, "TCP1P A&D + KotH Testing", with four challenges under events/tcp1p-testing/:

None of the four pins a containerImage or checkerImage, so each ships an auto-built src/ service plus an enochecker3 checker that builds on import. Watch the 8 images (a service + a checker per challenge) come up under admin → Builds.

The game imports hidden. To run it, open admin → game → Info, set the start/end times, and unhide it.

#The A&D/KotH challenge types

When you author challenges by hand instead, the challenge editor lets you pick the challenge type. Alongside the classic jeopardy types (Static/Dynamic Attachment, Static/Dynamic Container), this fork adds two A&D-engine types:

Both A&D-engine types run as managed containers and skip the per-flag configuration jeopardy challenges use — the flags are issued and rotated by the A&D engine each round, not entered by hand. Selecting AttackDefense or KingOfTheHill surfaces the container image and the relevant A&D fields and hides the manual flag inputs.

#A&D round settings live on the game's Info page

The settings that govern the rhythm of an A&D/KotH event are per-game, not per-challenge, and they live in admin → game → Info (the Info tab of the game editor). The key fields and their defaults, straight from the editor:

There is also a get-flag window fraction and related fields below these in the same section. Set the tick length and flag lifetime here before the game starts — they define how the whole event is scored.

#Where to go next

• /guide/deployment/docker — full deployment detail: the standalone (no-TLS) overlay, the Kubernetes container backend, host kernel tuning for many containers, and capacity ceilings.
• /config/appsettings — every configuration key in appsettings.json, including all ContainerProvider, Ad.Vpn / Ad.Ssh, HoneypotConfig, and FlagEgressConfig settings.
• /guide/authoring/repo-bindings — importing whole events from a Git repo.
• /guide/authoring/challenge-yaml — authoring A&D/KotH and jeopardy challenges.
• /guide/features/scoring — how rounds, SLA, and flag captures are scored.