A Selfhostr project
SuckerPot

Install

Three steps. One machine you can lose.

A small VM or a cheap VPS is enough. Keep nothing on it that matters: it is meant to be attacked. Just want to help the network, without a dashboard? Three commands.

Steps

From a clean Linux machine to a running dashboard.

The installer does not use curl piped to bash. Read the script first, then run it from the checkout.

  1. 01

    Get the code

    You need Linux and Docker 24 or newer with the Compose plugin.

    shell
    git clone --depth 1 --branch v0.7.1 https://github.com/selfhostr/suckerpot.git
cd suckerpot

  2. 02

    Run the installer

    It checks the machine, asks a few questions and generates every secret on this host. A VPN and API keys are optional. By default the recommended sensors are on (6); --sensors all turns on all twelve.

    shell
    ./scripts/install.sh

  3. 03

    Open the dashboard

    Open the address the installer prints and follow the setup checklist before you open any port. Check the stack any time:

    shell
    ./scripts/status.sh

Requirements

What the machine needs.

The installer checks all of this and refuses to go on if something is missing.

Operating systemLinux on x86_64 (amd64) or aarch64 (arm64).
Shell toolsBash 4 or newer, git, curl and the usual GNU tools.
Docker Engine24 or newer. Your user must run docker without sudo.
Docker Composev2.24 or newer, as the Compose plugin.
Memory2 GiB minimum. A low-memory mode exists for machines below 6 GiB.
Free disk15 GiB minimum, 30 GiB recommended.
RouterPort forwarding for the sensors you choose.

Two modes

Full, or participant.

Pick by what you want from it. You can go from participant to full later and keep your data.

full (default)

runs
Sensors, database, ingest, API and dashboard, plus the VPN service (idle until you add a WireGuard file).
use it when
You want the dashboard, reports and blocklists.

participant

runs
Sensors, database, ingest and the network node. No dashboard, no admin account.
use it when
You only want to help the network. Join the network.

What the installer does

Secrets stay on your machine.

  • Checks the machine, asks its questions (every one has a default) and checks the ports.
  • Generates every database, Redis and proxy password. Each is at least 24 characters.
  • Hashes the admin password in a container with no network. It never appears in a command line or a file.
  • Writes .env with mode 0600, creates the data volumes, and checks the port layout.
  • Verifies the signature of each release image, starts the stack and waits until every service is healthy.
  • It asks whether to join the SuckerPot network. --yes counts as yes, and --no-network declines.
  • Never edits your sshd_config.

Ports to forward

Only the sensors you turned on.

Your router forwards the standard port of each service. The installer prints the table for your choice.

  • Never forward the dashboard port (8443 by default) or your own admin SSH port.
  • Do not put the machine in your router’s DMZ. A DMZ forwards every port, the dashboard’s included.
  • If your router’s WAN address is in 100.64.0.0/10 (carrier-grade NAT), forwarding cannot work. Ask your provider for a public address.
  • The Ports page shows “Receiving” once a sensor gets its first event. Bots arrive within minutes.

The sensor list shows the standard port of each service.

Full install guide Source code