Anvil
Self-hosted B2R/AD-CTF platform with VM and container support, featuring WireGuard VPN, Nginx reverse proxy, PostgreSQL database, and configurable game engine.
Ficha actualizada 22 sept 2026, 18:41 · upstream 22 sept 2026, 18:39 · release sin release detectada
Qué es Anvil
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
Anvil is a self-hosted competitive programming (B2R) and algorithmic challenge (AD-CTF) platform designed for teams to compete in real-time. It provides a secure, isolated environment where players can submit code solutions that are evaluated against reference implementations. The platform supports both VM-based execution and Docker containerized environments, offering flexibility for different team sizes and infrastructure needs.
The architecture is built around a WireGuard VPN tunnel that encapsulates all internal traffic between the host server and challenge containers running on private subnets (172.20.0.0/16). This ensures that players' submissions are routed through a secure, encrypted channel before reaching the evaluation backend. The platform uses Nginx as an API reverse proxy to expose the application while maintaining strict access control at the network level.
Data persistence is handled by PostgreSQL 16, which stores user accounts, challenge metadata, and game state. The database schema includes tables for users, challenges, submissions, and game tick records that track the progression of competitive matches. Game logic runs in a separate container with its own clock mechanism to ensure fair and deterministic evaluation across multiple players.
The platform is designed to be extensible through YAML configuration files that allow administrators to tune performance parameters such as rate limits, scoring weights, and resource allocation for both VMs and containers. This modular design enables teams to customize the platform without modifying core source code.
- Teams compete in real-time B2R/AD-CTF challenges hosted on a private network
- Players submit C/C++ solutions that are evaluated by reference implementations
- The platform supports both VM-based and Docker containerized execution environments
- WireGuard VPN secures all traffic between the host server and challenge containers
- Nginx reverse proxy exposes the API at 8080 while maintaining strict access control
- Game engine (Attack-Defense + KotH) runs in a separate container with its own tick clock
- WireGuard VPN encapsulates all traffic between host and containers, providing encrypted communication
- Nginx reverse proxy exposes the API at port 8080 while maintaining strict access control via iptables rules
- Game engine runs in a separate container with its own tick clock for fair competitive evaluation
- VM-based execution requires additional hypervisor resources and may be slower than containers
- WireGuard VPN adds complexity to network configuration, especially on hosts without iptables-nft support
- The platform does not include a built-in code editor or IDE for local development
- No automated testing framework is provided; manual unit tests must be written separately
- Scoring weights are configurable but require manual tuning by administrators
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Deploy Anvil using Docker Compose with the 'production' build target. Configure environment variables in .env for secrets, endpoints, and passwords. Bind PostgreSQL to localhost on port 5432 and API container to port 8080. For WireGuard setup, install wg-tools on the host, create a private key, and configure /etc/wireguard/wg0.conf with proper PostUp/PostDown rules for both bridge networks (172.20.0.0/16) and VMs (10.100.0.0/16). Enable iptables-nft if available to avoid the raw table rule needed for Docker bridge traffic. Start with `docker compose up -d --build` then enable WireGuard services via systemd. For large-scale deployments, consider using a load balancer in front of Nginx or implementing per-user IP-based access control instead of relying solely on iptables rules.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.