Skip to content
Flagpost
bash full guide → 
$ git clone https://github.com/tbcsec/flagpost.git
$ cd flagpost
$ docker compose up --build

✓ caddy · serving on :8080

✓ backend · migrations applied, event bus up

→ open localhost:8080 — the setup wizard takes it from here

The Flagpost handbook

Everything to run, operate, and extend the open-source CTF platform — from first docker compose up to shipping your own module.
Quick startWhat is Flagpost?GitHub

Choose your path

Look something up

Event cataloguechallenge.solvedEvery event, its payload fields, and its trigger permission.Automation referenceWhen → If → ThenOperators and all thirteen actions, field by field.Permissionschallenge_viewThe full catalogue and what each built-in role holds.ctfcli formatchallenge.ymlThe CTFd-compatible import/export field map.

Roadmap

  1. More authentication modules Shipped · v1.3.0OIDC/OAuth2 SSO landed in v1.2.0; SAML 2.0 and LDAP/Active Directory followed in v1.3.0 — one identity-provider framework.
  2. AI chatbot Shipped · v1.4.0An administrator assistant and a guard-railed competitor assistant — an optional module, off by default, bring your own provider.
  3. Custom certificate generation Shipped · v1.5.0An optional module: an in-app A4 designer over server-rendered PNGs, drawn from final standings, released and shared per participant or in bulk.
  4. On-demand challenge instances Shipped · v1.6.0Isolated, containerised challenge copies per team — unique per-instance flags, TTL reaping, Docker/Kubernetes provisioners.
  5. Module SDK, importing & marketplace Shipped · v1.7.0Install signed, trust-tiered content packs from an open, mirrorable registry — off until an operator opts in — plus an SDK to build, sign and validate modules. Declarative and signed-code modules, and a sandbox, are still to come.
  6. Programming challenges Shipped · v1.8.0A built-in code judge: competitors upload or write code and get live verdicts against hidden tests, on the same scoreboard as flags — an optional module, off until an operator connects a judge runtime. An ICPC-style ranking mode is still to come.
  7. Cheat detection engineFlag-sharing and anomaly signals surfaced to judges — evidence, not auto-bans.

Sequence, not dates — shaped in the open on GitHub Discussions. The fuller story lives at flagpost.io.

New to the platform? Start with What is Flagpost? and the core concepts — or see it pitched at flagpost.io.