Engine — CEI Labs

SEC 01 / MISSION

Engine decouples core range infrastructure from individual training modules. It orchestrates CTF environments, threat-hunting sandboxes, and network-analysis pipelines on hardware you own — no cloud dependency, no per-seat cost.

SEC 02 / DEPLOYMENT MODES

Mode	Nodes	vCPUs	RAM	Storage	Max operators
single	1 (combined)	4	16 GB	100 GB SSD	10
dual	2 (segregated)	4 + 4	16 + 16 GB	100 + 100 GB	20
cluster	3 (HA dedicated)	4 + 4 + 4	32 + 16 + 16 GB	256 + 100 + 100 GB	30

SEC 03 / TOPOLOGY

Production cluster

Three bare-metal nodes, one control plane, workloads pinned by role.

NODE 1 — CONTROL PLANE

OptiPlex 7080 · i5 · 32 GB · 256 GB SSD

K3s server (leader)
CTFd + MariaDB (PVC)
Local registry (PVC)
Traefik / MetalLB

NODE 2 — JUICE SHOP

N100 mini-PC · 16 GB · 512 GB SSD

K3s agent · role=juiceshop
MultiJuicer (up to 30 dynamic pods)

NODE 3 — ANALYST + TARGETS

N100 mini-PC · 16 GB · 512 GB SSD

K3s agent · role=analyst
SSH analyst containers
Kali noVNC workstations
Self-hosted CTF targets

SEC 04 / VERSION MATRIX

Component	Version	Component	Version
K3s	v1.32.5+k3s1	MetalLB	latest
Helm	v4.2.0	Traefik	v3.x
CTFd	v3.8.2	MariaDB	10.11
MultiJuicer	v10.0.0	Redis	7-alpine
OWASP Juice Shop	v17+	Ubuntu	24.04 LTS

SEC 05 / TRAINING SPRINTS

Three gated stages. Each gate is a real proof of work — passwords and flags from the previous sprint unlock the next.

UNLOCKED

Sprint 1 — Foundational Fluency

OverTheWire Bandit 0–15 · CmdChallenge 1–20.

GATE → passwords from Bandit 15 + final CmdChallenge unlock Sprint 2.

LOCKED

Sprint 2 — Systems, Web & Forensics

Bandit 16–34 · Natas 0–15 · Krypton · Leviathan. Self-hosted Juice Shop (100+ challenges via MultiJuicer) and PCAP/log forensics.

GATE → Sprint 1 complete + 25 Juice Shop flags + 5 PCAP challenges.

LOCKED

Sprint 3 — Advanced Operations

Narnia & Behemoth (binary exploitation) · Natas 16–34 · OWASP crAPI · advanced skilling labs · full-scenario exercises.

DESTINATION → open sandbox, no downstream restrictions.

SEC 06 / QUICK START

operator@cei-labs:~$ — deploy sequence

# 1 — clone
$ git clone https://github.com/stoptalkingishh/cei-labs-engine.git && cd cei-labs-engine
# 2 — configure inventory + variables
$ vi ansible/group_vars/all.yml ansible/inventory.ini
# 3 — prepare cases
$ ./scripts/setup-cases.sh
# 4 — provision the cluster
$ ansible-playbook -i ansible/inventory.ini ansible/site.yml
# 5 — bring the platform up
$ ./scripts/platform-up.sh
# 6 — load content
$ ./scripts/juice-shop-ctf-import.sh && ./scripts/challenges-load.sh
# 7 — verify
$ kubectl get nodes -o wide && kubectl get pods -A
$

OTHER MODULES

MODULE 02 — COURSE OF FIREWargames

59 challenges, three tracks, one fail-closed deploy.

MODULE 03 — TERRAINNet

Built to survive 80 operators scanning it on purpose.

MODULE 04 — THE OPERATIONEvent

A full-scale, self-hosted CTF experience — 80 operators, 59 challenges.

MODULE 05 — LOADOUTAgent

A friendly CTF coaching AI that runs on your own laptop.