Skip to content
Flagpost
bash full guide → 
$ git clone https://github.com/tbcsec/flagpost.git
$ cd flagpost
$ docker compose up --build

✓ caddy · serving on :8080

✓ backend · migrations applied, event bus up

→ open localhost:8080 — the setup wizard takes it from here

The Flagpost handbook

Everything to run, operate, and extend the open-source CTF platform — from first docker compose up to shipping your own module.
Quick startWhat is Flagpost?GitHub

Choose your path

Look something up

Event cataloguechallenge.solvedEvery event, its payload fields, and its trigger permission.Automation referenceWhen → If → ThenOperators and all thirteen actions, field by field.Permissionschallenge_viewThe full catalogue and what each built-in role holds.ctfcli formatchallenge.ymlThe CTFd-compatible import/export field map.

Roadmap

  1. More authentication modules Shipped · v1.3.0OIDC/OAuth2 SSO landed in v1.2.0; SAML 2.0 and LDAP/Active Directory followed in v1.3.0 — one identity-provider framework.
  2. AI chatbot Shipped · v1.4.0An administrator assistant and a guard-railed competitor assistant — an optional module, off by default, bring your own provider.
  3. Custom certificate generation Shipped · v1.5.0An optional module: an in-app A4 designer over server-rendered PNGs, drawn from final standings, released and shared per participant or in bulk.
  4. On-demand challenge instancesIsolated, containerised challenge copies per team — unique per-instance flags, TTL reaping, Docker/Kubernetes provisioners.
  5. Module SDK, importing & marketplaceA documented SDK, installable modules, and a marketplace with verified publishers.
  6. Programming challengesProgramming and secure-coding formats as first-class competition types.
  7. Cheat detection engineFlag-sharing and anomaly signals surfaced to judges — evidence, not auto-bans.

Sequence, not dates — shaped in the open on GitHub Discussions. The fuller story lives at flagpost.io.

New to the platform? Start with What is Flagpost? and the core concepts — or see it pitched at flagpost.io.