.env.example

# generated by: setup/ctf-setup.sh secrets
# This is the list a normal compose event sets. Every variable docker-compose.yml
# reads, plus the per-service knobs it does NOT forward (poll interval, scorer
# port, judge timeouts...), is tabulated in docs/hosting.md under
# "Environment variables".
BETTER_AUTH_SECRET=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# Required for Secure Development: the GitHub App sync polls the forks with
# (org-scoped tokens). Create one from
# sync/app-manifest.json, install it on the event org, base64 the private key
# (`base64 < app.pem`).
GITHUB_APP_ID=
GITHUB_APP_PRIVATE_KEY=          # base64-encoded PEM
GITHUB_APP_INSTALLATION_ID=      # optional; auto-discovered if the App has one installation
SRH_TOKEN=             # local Redis REST token (any random string)
# Redis's requirepass. `docker compose up` REFUSES TO START without it —
# deliberately, so the control cannot silently degrade to "off". Only the srh
# proxy is given this value; app/scorer/sync never see it and have no network
# route to redis:6379 at all.
REDIS_PASSWORD=        # any random string; ctf-setup.sh secrets generates one
SCORER_TOKEN=          # bearer token sync uses against the scorer's POST /score
# Must be https:// for any real event — the session cookie is only marked
# Secure over HTTPS, and this app keeps no server-side session store, so a
# sniffed cookie IS the account (an organizer's included). A production start
# with http:// on a non-loopback host refuses to serve; set
# ALLOW_INSECURE_EVENT_URL=1 only for a deliberately TLS-less closed network.
EVENT_URL=http://localhost
# The GitHub org the target repos live in; used for fork links. Empty means
# the challenge browser renders bare repo names instead of a link.
GITHUB_ORG=
# Comma-separated GitHub logins (case-insensitive) allowed into /admin.
# Empty means nobody can use /admin; changing it needs an env edit and a
# restart of the app container.
ADMIN_LOGINS=
# Your scorer image, built from scorer/ (see docs/scorer.md), e.g.
# ghcr.io/<your-event-org>/score:latest. The upstream ghcr.io/owasp-ctf/score
# is private and the kit does not assume access to it.
SCORE_IMAGE=