Upload providers

Stores files on the local filesystem. This is the default provider.

1
uploadProvider:
2
  name: uploads/local
3
  options:
4
    uploadDirectory: /path/to/uploads # Optional

Files are served by the API server at /uploads/*. Path traversal protection is built in.

Stores files in an Amazon S3 bucket.

1
uploadProvider:
2
  name: uploads/s3
3
  options:
4
    bucketName: my-ctf-uploads
5
    awsKeyId: AKIAIOSFODNN7EXAMPLE
6
    awsKeySecret: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
7
    awsRegion: us-east-1

Files are stored with public-read ACL and attachment content disposition. The bucket has to allow public reads.

Stores files in a Cloudflare R2 bucket.

1
uploadProvider:
2
  name: uploads/r2
3
  options:
4
    bucketName: my-ctf-uploads
5
    cfAccountId: 0123456789abcdef0123456789abcdef
6
    cfKeyId: 0123456789abcdef0123456789abcdef
7
    cfKeySecret: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
8
    publicBaseUrl: https://cdn.example.com
9
    jurisdiction: default # optional: default, eu, or fedramp

The R2 API token needs permission to read, write, and delete objects. Configure the bucket for public access and set publicBaseUrl to its custom domain. Set jurisdiction for buckets created in the EU or FedRAMP jurisdiction; the location hint used when creating a default-jurisdiction bucket does not change this setting.

Stores files in a Google Cloud Storage bucket.

1
uploadProvider:
2
  name: uploads/gcs
3
  options:
4
    projectId: my-gcp-project
5
    bucketName: my-ctf-uploads
6
    credentials:
7
      type: service_account
8
      project_id: my-gcp-project
9
      private_key_id: ...
10
      private_key: ...
11
      client_email: ...

Files are stored with public visibility. The bucket has to be configured to allow public access.

cd deploy/terraform/storage/main
terraform init
terraform apply -var="region=eu-west-3" -var="bucket_name=my-ctf-uploads"

Read the credentials for the dedicated rctf-bucket IAM user from the sensitive outputs (rctf_iam_user_arn and bucket are printed to stdout on apply):

terraform output -raw access_key_id
terraform output -raw secret_access_key

Drop the credentials into your config:

1
uploadProvider:
2
  name: uploads/s3
3
  options:
4
    bucketName: my-ctf-uploads
5
    awsKeyId: <access_key_id output>
6
    awsKeySecret: <secret_access_key output>
7
    awsRegion: eu-west-3

The module sets up CORS (GET, HEAD from any origin by default, which you can override with -var="cors_allowed_origins=[\"https://ctf.example.com\"]") and grants the IAM user s3:GetObject, s3:PutObject, s3:DeleteObject, plus the matching ACL actions and s3:ListBucket.

cd deploy/terraform/storage/r2
terraform init
terraform apply -var="cloudflare_api_token=[your bootstrap token]" -var="location=weur" -var="bucket_name=my-ctf-uploads" -var="zone_id=your-domain-zone-id"

The location variable is an R2 location hint; see the available hints for the possible values.

The public R2 hostname defaults to cdn.<your-zone-domain>. Override the optional subdomain variable if you want a different hostname, for example with -var="subdomain=files".

Terraform requires a Cloudflare account API token with Workers R2 Storage: Edit, Account API Tokens: Edit, and Zone: Read. Create one with this preconfigured token template and pass it as the sensitive cloudflare_api_token variable. The module derives the account ID and base domain from the supplied zone ID, then creates a separate account API token with object access scoped to the new bucket. Only use the bootstrap token for Terraform; use the generated bucket-scoped credentials in rCTF.

Buckets are created in the standard jurisdiction by default. Pass -var="jurisdiction=eu" or -var="jurisdiction=fedramp" to create the bucket, its custom domain, and the bucket-scoped token inside a jurisdiction, and set the matching jurisdiction option in the rCTF config.

Read the generated values from the Terraform outputs. The access key and secret are sensitive, so Terraform does not print them after apply:

terraform output -raw access_key_id
terraform output -raw secret_access_key

Drop the outputs into your config:

1
uploadProvider:
2
  name: uploads/r2
3
  options:
4
    bucketName: <bucket output>
5
    cfAccountId: <account_id output>
6
    cfKeyId: <access_key_id output>
7
    cfKeySecret: <secret_access_key output>
8
    publicBaseUrl: <public_base_url output>

The module creates the R2 bucket, connects the derived hostname as its public custom domain, and creates an account API token with object read, write, and delete access scoped to that bucket. Cloudflare creates the custom domain’s DNS record when it connects the bucket, so the hostname must not already have a conflicting DNS record. It also allows CORS GET and HEAD requests from any origin by default. Restrict the allowed origins with -var="cors_allowed_origins=[\"https://ctf.example.com\"]".

cd deploy/terraform/storage/gcs
terraform init
terraform apply -var="project_id=my-gcp-project" -var="region=europe-west1" -var="bucket_name=my-ctf-uploads"

Read the key for the dedicated rctf-bucket service account from the sensitive output (rctf_sa_email and bucket are printed to stdout on apply):

terraform output -raw service_account_key

Drop the credentials into your config (paste the key JSON under credentials):

1
uploadProvider:
2
  name: uploads/gcs
3
  options:
4
    projectId: my-gcp-project
5
    bucketName: my-ctf-uploads
6
    credentials:
7
      type: service_account
8
      project_id: my-gcp-project
9
      # ...rest of the service_account_key output

The module sets up CORS (GET, HEAD from any origin by default, which you can override with -var="cors_allowed_origins=[\"https://ctf.example.com\"]") and grants the service account a custom role with storage.objects.create, storage.objects.get, storage.objects.list, and storage.objects.delete.