SuckerPot
EN
GitHub Install

Download

Three steps. One machine you can lose.

A spare VM or a cheap VPS is enough. Keep nothing on it that matters: it is meant to be attacked. Just want to help the network, without a dashboard? Three commands.

Steps

From a clean Linux machine to a running dashboard.

No curl piped to bash. Read the script first, then run it from the checkout.

  1. 01

    Get the code

    You need Linux and Docker 24 or newer with the Compose plugin. Docker 28 is recommended: the installer warns on older versions, where internal networks are not isolated from the host.

    shell
    git clone --depth 1 --branch v0.9.0 https://github.com/selfhostr/suckerpot.git
cd suckerpot

  2. 02

    Run the installer

    It checks the machine, asks a few questions and generates every secret on this host. A VPN and API keys are optional. Six recommended sensors are on by default; --sensors all turns on all twelve.

    shell
    ./scripts/install.sh

  3. 03

    Open the dashboard

    Open the address the installer prints and follow the setup checklist before you open any port. Check the stack any time:

    shell
    ./scripts/status.sh

Ports to forward

Only the sensors you turned on.

Your router forwards the standard port of each service. The installer prints the table for your choice, and the sensor list shows every port.

  • Never forward the dashboard port (8443 by default) or your own admin SSH port.
  • Do not put the machine in your router's DMZ. A DMZ forwards every port, the dashboard's included.
  • If your router's WAN address is in 100.64.0.0/10 (carrier-grade NAT), forwarding cannot work. Ask your provider for a public address.
  • The Ports page shows "Receiving" once a sensor gets its first event. Bots arrive within minutes.

Requirements

What the machine needs.

The installer checks all of this and refuses to go on if something is missing.

Operating systemLinux on x86_64 (amd64) or aarch64 (arm64).
Shell toolsBash 4 or newer, git, curl and the usual GNU tools.
Docker Engine24 or newer, 28 recommended. Your user must run docker without sudo.
Docker Composev2.24 or newer, as the Compose plugin.
Memory2 GiB minimum. A low-memory mode exists for machines below 6 GiB.
Free disk15 GiB minimum, 30 GiB recommended.
RouterPort forwarding for the sensors you choose.

Two modes

Full, or participant.

You can go from participant to full later and keep your data.

full (default)

runs
Sensors, database, ingest, API and dashboard, plus the VPN service (idle until you add a WireGuard file).
use it when
You want the dashboard, reports and blocklists.

participant

runs
Sensors, database, ingest and the network node. No dashboard, no admin account.
use it when
You only want to help the network. Join the network.

What the installer does

Secrets stay on your machine.

Full install guide Source code
  • Asks its questions (every one has a default) and checks the machine and the ports.
  • Generates every database, Redis and proxy password, each at least 24 characters.
  • Hashes the admin password in a container with no network. It never appears in a command line or a file.
  • Writes .env with mode 0600 and creates the data volumes.
  • Verifies the signature of each release image, starts the stack and waits until every service is healthy.
  • Asks whether to join the SuckerPot network. --yes counts as yes, and --no-network declines.
  • Never edits your sshd_config.

Support the project

Support SuckerPot

SuckerPot is free and has no company behind it. If it saves you time, a donation pays for the test hardware and for the time it takes.

Sponsor us on GitHub