Skip to content
Flagpost

What is Flagpost? A self-hosted CTF platform

Flagpost is an open-source, self-hosted CTF platform — a complete competition system for capture-the-flag organisers: publish challenges, score solves the moment they land, support competitors, and automate the whole event from one app you run yourself. It is licensed under the Apache-2.0 licence, free to run, and designed to be operated on your own infrastructure.

What sets it apart

Section titled “What sets it apart”
  • Real-time everything. The scoreboard, “who’s viewing this challenge” presence, notifications, and support-ticket threads all update live over WebSockets. Nothing polls, nobody refreshes.
  • A visual automation engine. No-code When → If → Then rules react to any platform event — announce first blood, release a hint wave, call a hardened webhook, open the feedback survey an hour before the end.
  • Live collaborative notes. CRDT (Y.js) co-editing gives every team a shared scratchpad per challenge, and staff a private notes pad per ticket.
  • Permissions as data. Roles live in the database. Clone the built-ins and craft custom roles with granular, per-competition or site-wide scope.
  • A deep challenge model. Static, regex, and multiple-choice flags; dynamic (decay) scoring; prerequisite unlock chains; scheduled release; managed tags and difficulty; per-competition guess caps.
  • On-demand challenge instances. An optional module gives each competitor or team an isolated, TTL-reaped container copy of a challenge on a Docker or Kubernetes backend, with unique-per-instance flags and staff kill/extend controls — off by default until an operator wires up a backend.
  • Custom brand themes. Beyond the built-in palettes and accent colours, upload or author a full colour-token theme and apply it site-wide with no rebuild.
  • A scoreboard done right. First blood, brackets/divisions, a freeze for the final stretch, a public spectator board, and a CTFtime feed.
  • Recognition and wrap-up. Shareable certificates for participants and post-event reports for organisers.
  • Speaks four languages. The interface ships in four languages, switchable per device.
  • CTFd-compatible and portable. Bulk challenge import/export in the ctfcli YAML format, plus a full-fidelity platform backup.
  • Bring your own identity provider. OIDC/OAuth2, SAML 2.0, and LDAP/Active Directory single sign-on (Google, Okta, Keycloak, Entra, Shibboleth, AD, …) alongside local accounts, with local login surviving as break-glass.
  • Optional AI assistants, your model. An organiser assistant for operational questions and a guard-railed competitor assistant with organiser-set guidance levels and reviewable transcripts — off by default, bring your own OpenAI-compatible endpoint (or a fully local model, so nothing leaves your install).
  • Secure by default. argon2 hashing, timing-safe auth, SSRF-hardened webhooks, ReDoS-contained regex flags — and no shipped credentials.

What it deliberately is not (yet)

Section titled “What it deliberately is not (yet)”

Flagpost is a competition system first. On-demand challenge instances are an optional module — off by default, and inert until an operator connects a container backend — not a general-purpose hosting platform for arbitrary services. Third-party marketplace modules are not yet open — the module system currently runs trusted, in-repo code only (the roadmap tracks the module SDK and marketplace).

The stack

Section titled “The stack”
Layer Technology
Backend Python · FastAPI (async) · SQLAlchemy 2 · Alembic
Data PostgreSQL · Redis · MinIO (S3-compatible)
Frontend Next.js (App Router) · React · TypeScript · Tailwind v4
Real-time Native WebSockets · Y.js (CRDT)
Deployment Docker Compose behind a Caddy reverse proxy

Where to go next

Section titled “Where to go next”