FAQ

FAQ

Do I need anything installed first? Yes, and these are separate from redStackPRO: Terraform, Python 3.8 or newer, the AWS CLI, the gcloud CLI, or the Azure CLI (whichever cloud you target), and a cloud account with credentials and billing set up. (ssh and tar are needed too; they ship with macOS, Linux, and Git for Windows.) redStackPRO generates the files; it does not install any of these for you. See Getting Started and Deploying a Range, and Cloud Prerequisites for the permissions your cloud identity needs and CLI setup quick-starts.

Does redStackPRO hold my cloud credentials? No. It generates a working directory and hands it to you. You drive the deploy yourself, under your own credentials: Terraform runs on your machine, and deploy.sh installs and runs Ansible on your jumpbox. See Concepts.

Which providers can I deploy to? GCP, AWS, and Azure, tested end to end for both target ranges and attack infrastructure. Proxmox and ESXi are on the roadmap, not yet supported. They cannot allocate a public address on their own, so redirector reachability there depends on a network redStackPRO does not control. See Providers.

My Azure deploy stopped before apply. Why? Azure subscriptions differ in which VM sizes they may use and how many vCPUs and public IPs they get, and a new or trial subscription often has very little. The Azure deploy runs a read-only preflight before it creates anything, and when the topology will not fit it stops and prints what to change: a vm_sizes block for deploy.tfvars, the quota to raise, or the az provider register command to run. See Cloud Prerequisites.

Can multiple operators share one deployment? Yes, on an Offense (attack infrastructure) jumpbox. Name your operators (handle plus role) and each gets their own Guacamole portal login on the shared lab password. Set the jumpbox access_mode to wireguard or openvpn and every operator also gets a personal VPN credential generated on the jumpbox during provisioning, and you can add or remove a teammate on the running box with sudo rsp-operator add <handle>. On the default public portal, add them to operators and deploy again. A Defense range ignores operators and access_mode and keeps the plain public portal. See Deploying a Range.

What is the difference between the canvas and the topology? The canvas is the surface you work on. The topology is what you build on it, the infrastructure as nodes and edges. The topology is the thing that compiles and deploys.

Can I edit a shipped lab? Yes. A shipped lab opens locked so the baseline stays intact. Click Unlock to edit, then Save: you get a private topology of your own, and the shipped blueprint is unchanged. See Library and Blueprints.

Where do the walkthrough solutions come from? They ship with the labs, under docs/solutions/ in the repo (one folder per lab, linked from Labs). Each one is generated from, or hand-authored against, the same topology that gets deployed. Read the status line at the top of each page: some are validated live, others are authored and not yet run against a live range. redStackPRO is a validation range, so the solutions are references, not spoilers.

Docker or from source? Docker is the fastest way to run the canvas. From source is for developing on redStackPRO itself. See Getting Started.

Can I use Postgres instead of SQLite? Yes. The Compose file has an optional Postgres profile for a shared deployment. SQLite is the default for a single user.

Why does the compiler refuse my redirector? It needs a real domain. A redirector answers to the internet by name, and nothing can invent that. Supply one with --hostname or in the inspector. See Redirectors and Cover Stories.

Is it free? Yes, MIT. The GOAD range blueprints are derived from GOAD and carry GPLv3.