openctf-server 1.0.0__tar.gz

openctf_server-1.0.0/PACKAGE_README.md

@@ -0,0 +1,36 @@
+# openctf-server
+
+Flask API and sandboxed target-website service for [OpenCTF](https://github.com/XHIiddenProjects/OpenCTF), a self-hosted lab CTF platform. This package is the server half only - the desktop client is published separately on npm as `openctf`.
+
+## Install
+```bash
+pip install openctf-server
+```
+
+## Quick start
+
+```bash
+export SECRET_KEY=$(python -c "import secrets; print(secrets.token_hex(32))")
+export JWT_SECRET_KEY=$(python -c "import secrets; print(secrets.token_hex(32))")
+export FLAG_PEPPER=$(python -c "import secrets; print(secrets.token_hex(32))")
+export TARGET_ACCESS_SECRET=$(python -c "import secrets; print(secrets.token_hex(32))")
+export ADMIN_PASSWORD=set-a-real-password
+
+openctf-server           # main API on :5000
+openctf-server-target     # sandboxed target-website service on :5001 (separate terminal)
+openctf-server-seed       # load the starter set of preset challenges (one-off)
+```
+
+Both processes need the same `SECRET_KEY`, `TARGET_ACCESS_SECRET`, and `DATABASE_URL` (if you set one) to talk to each other correctly - they share one database and one signed-URL secret between the two services.
+
+## Configuration
+
+All configuration is via environment variables - there's no config file. See the main repository's `server/.env.example` for the full list (`DATABASE_URL`, `CORS_ORIGINS`, `TARGET_SERVER_URL`, `OLLAMA_URL`, `OLLAMA_MODEL`, and the secrets above).
+
+## Docker
+
+If you'd rather not manage two processes and env vars by hand, the main repository ships a `docker-compose.yml` that runs both services correctly out of the box - see the [repository README](https://github.com/XHIiddenProjects/OpenCTF#installation) for that path.
+
+## Security
+
+Read `SECURITY.md` in the main repository before exposing this to more than your own laptop - in particular, the target-website service is *intentionally* vulnerable (that's the point, it hosts the challenges) and should never be reachable from outside your lab's own network.

openctf_server-1.0.0/PKG-INFO

@@ -0,0 +1,61 @@
+Metadata-Version: 2.4
+Name: openctf-server
+Version: 1.0.0
+Summary: Flask API and sandboxed target-website service for the OpenCTF lab CTF platform
+Author: OpenCTF
+License: MIT
+Project-URL: Homepage, https://github.com/XHiddenProjects/OpenCTF
+Project-URL: Repository, https://github.com/XHiddenProjects/OpenCTF
+Project-URL: Security Policy, https://github.com/XHiddenProjects/OpenCTF/blob/main/SECURITY.md
+Keywords: ctf,capture-the-flag,security,lab,flask
+Classifier: Programming Language :: Python :: 3
+Classifier: Framework :: Flask
+Classifier: Topic :: Security
+Classifier: Topic :: Education
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: Flask>=3.0.3
+Requires-Dist: Flask-SQLAlchemy>=3.1.1
+Requires-Dist: Flask-Cors>=4.0.1
+Requires-Dist: Flask-JWT-Extended>=4.6.0
+Requires-Dist: Werkzeug>=3.0.3
+Requires-Dist: gunicorn>=22.0.0
+
+# openctf-server
+
+Flask API and sandboxed target-website service for [OpenCTF](https://github.com/XHIiddenProjects/OpenCTF), a self-hosted lab CTF platform. This package is the server half only - the desktop client is published separately on npm as `openctf`.
+
+## Install
+```bash
+pip install openctf-server
+```
+
+## Quick start
+
+```bash
+export SECRET_KEY=$(python -c "import secrets; print(secrets.token_hex(32))")
+export JWT_SECRET_KEY=$(python -c "import secrets; print(secrets.token_hex(32))")
+export FLAG_PEPPER=$(python -c "import secrets; print(secrets.token_hex(32))")
+export TARGET_ACCESS_SECRET=$(python -c "import secrets; print(secrets.token_hex(32))")
+export ADMIN_PASSWORD=set-a-real-password
+
+openctf-server           # main API on :5000
+openctf-server-target     # sandboxed target-website service on :5001 (separate terminal)
+openctf-server-seed       # load the starter set of preset challenges (one-off)
+```
+
+Both processes need the same `SECRET_KEY`, `TARGET_ACCESS_SECRET`, and `DATABASE_URL` (if you set one) to talk to each other correctly - they share one database and one signed-URL secret between the two services.
+
+## Configuration
+
+All configuration is via environment variables - there's no config file. See the main repository's `server/.env.example` for the full list (`DATABASE_URL`, `CORS_ORIGINS`, `TARGET_SERVER_URL`, `OLLAMA_URL`, `OLLAMA_MODEL`, and the secrets above).
+
+## Docker
+
+If you'd rather not manage two processes and env vars by hand, the main repository ships a `docker-compose.yml` that runs both services correctly out of the box - see the [repository README](https://github.com/XHIiddenProjects/OpenCTF#installation) for that path.
+
+## Security
+
+Read `SECURITY.md` in the main repository before exposing this to more than your own laptop - in particular, the target-website service is *intentionally* vulnerable (that's the point, it hosts the challenges) and should never be reachable from outside your lab's own network.

openctf_server-1.0.0/__init__.py

@@ -0,0 +1,12 @@
+"""OpenCTF server - Flask API, sandboxed target-website service, and
+challenge-seeding CLI for the OpenCTF lab platform.
+
+This file exists so the flat `server/` directory (app.py, target_app.py,
+seed_challenges.py) can also be published to PyPI as a proper namespaced
+package (`openctf_server`), without moving any of those files - see
+pyproject.toml's `[tool.setuptools] package-dir` mapping. Running things
+directly from this directory (`python app.py`, `python target_app.py`,
+`python seed_challenges.py`) is unaffected either way.
+"""
+
+__version__ = "0.1.0"