CEI-LABS // MODULE 02 — COURSE OF FIRE

Wargames

Fifty-nine challenges across three tracks — Bandit, Krypton, Natas — built on OverTheWire's wargames, validated fail-closed, and deployed into a running CTFd with one script.

59 CHALLENGES·3 TRACKS·58 MAPPED ENVIRONMENTS·FAIL-CLOSED DEPLOY
EXPLORE THE TRACKS SOURCE ↗
SEC 01 / TRACKS

Bandit

Unix/Linux fundamentals.

35
LEVELS
  • writeups.md — instructor answer key. Not for participant distribution.
  • learning-objectives.md — skills by concept, not level number.
  • cheatsheet.md — fast lookup for instructors running a live room.

Krypton

Cryptography.

08
LEVELS
  • writeups.md — instructor answer key. Not for participant distribution.
  • learning-objectives.md — skills by concept, not level number.
  • cheatsheet.md — fast lookup for instructors running a live room.

Natas

Server-side web security.

16
LEVELS
  • writeups.md — instructor answer key. Not for participant distribution.
  • learning-objectives.md — skills by concept, not level number.
  • cheatsheet.md — fast lookup for instructors running a live room.
SEC 02 / DEPLOY PIPELINE
01 / BUILD

build_bandit.py · build_krypton.py · build_natas.py

→
02 / VALIDATE

validate_game_stages.py · validate_generated.py

→
03 / DEPLOY

deploy.sh with CTFD_URL, CTFD_TOKEN, CTFD_SYNC_SECRET

The preflight is fail-closed. It requires authenticated CTFd inventory access, a successful challenge install/sync, a successful instance-launcher mapping sync, and exact totals — 59 challenges, 58 mapped environments, 3 visible launchers — or the deploy stops. .ctf/config is written mode 0600.

Loading content does not start a game clock — the administrator starts Bandit, Krypton, and Natas independently in Engine.

SEC 03 / SUPPLY-CHAIN INTEGRITY
IMMUTABLE IMAGES

Production releases require name@sha256:<digest> image references. Release mode rejects latest and every floating tag.

CI GATE

validate.yml runs the generation gate on every push and PR.

SBOM + PROVENANCE

The manually dispatched build-targets.yml requires an immutable Engine base-image digest and publishes SBOM and provenance metadata for all three target images.

PINNED ACTIONS

All third-party GitHub Actions pinned to commit SHAs.

SEC 04 / DOCUMENTATION ARSENAL
OTHER MODULES
MODULE 01 — RANGE PLATFORMEngine

A modular, multi-tenant cyber range on bare-metal K3s.

 MODULE 03 — TERRAINNet

Built to survive 80 operators scanning it on purpose.

 MODULE 04 — THE OPERATIONEvent

A full-scale, self-hosted CTF experience — 80 operators, 59 challenges.

 MODULE 05 — LOADOUTAgent

A friendly CTF coaching AI that runs on your own laptop.