CLI
Operational command-line tool for deployment tasks, managing admin permissions, seeding demo data, and exporting archives.
The rctf CLI bundles rCTF’s operational tooling: deployment helpers, admin management, database seeding, and static exports.
Invocation
From a source checkout, run it through the root script:
bun rctf user list-adminsThe production Docker image includes rctf on PATH, so commands can run inside the container next to the live instance:
docker exec rctf-rctf-1 rctf user list-adminsThe CLI reads the same rctf.d/ configuration as the API, or the directory set by RCTF_CONF_PATH, and talks to the database and Redis directly.
Commands
rctf user promote
Grants permissions to the user with the given email. Without --perms, the command grants full admin access.
bun rctf user promote admin@example.combun rctf user promote author@example.com --perms challsRead,challsWrite| Flag | Default | Description |
|---|---|---|
--perms |
all permissions | Comma-separated permission names. |
rctf user demote
Resets a user’s permissions to zero.
bun rctf user demote author@example.comrctf user list-admins
Lists every user holding any permissions.
rctf seed
Wipes the database and fills it with demo data.
bun rctf seedWarning
Seeding deletes all users, challenges, solves, submissions, and settings. When NODE_ENV=production, the command refuses to run unless --force is passed.
rctf export
Exports a static, read-only archive of a running instance. See Static export for the full flag reference.
rctf deployment generate-csp
Generates nginx security-header directives from the current configuration and outputs it to stdout. The output includes a provider-aware Content-Security-Policy header plus Referrer-Policy, X-Frame-Options, and X-Content-Type-Options. The command reads Svelte’s generated CSP directives from --web-build (default: apps/web/build/), merges them with the runtime policy and any extra sources from the csp config option, and removes duplicate sources.
The production container runs this command automatically at startup.
rctf deployment generate-avatar-body-limit
Generates a nginx client_max_body_size directive for the avatar upload endpoint and outputs it to stdout. The limit is the maxAvatarSize config option plus headroom for the multipart request framing, so the proxy never rejects uploads the API would accept.
The production container runs this command automatically at startup.