From 3430304a94daaab52459f0d9edfd390b9aa2c46f Mon Sep 17 00:00:00 2001 From: tupsonik <110323635+tupsonik@users.noreply.github.com> Date: Fri, 25 Sep 2026 04:22:04 +0200 Subject: [PATCH 1/4] feat: add secure VPS compose stack --- docker-compose.vps.yml | 73 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 docker-compose.vps.yml diff --git a/docker-compose.vps.yml b/docker-compose.vps.yml new file mode 100644 index 0000000..2a2e9af --- /dev/null +++ b/docker-compose.vps.yml @@ -0,0 +1,73 @@ +services: + metasploit-rpc: + image: metasploitframework/metasploit-framework:6.5.5 + restart: unless-stopped + environment: + MSF_RPC_USER: msf + MSF_RPC_PASS: ${MSF_PASSWORD:?Set MSF_PASSWORD in .env} + command: + - msfrpcd + - -a + - 0.0.0.0 + - -p + - "55553" + - -S + - -f + expose: + - "55553" + volumes: + - msf-data:/home/msf/.msf4 + healthcheck: + test: + - CMD-SHELL + - ruby -rsocket -e 's=TCPSocket.new("127.0.0.1",55553); s.close' + interval: 10s + timeout: 5s + retries: 12 + start_period: 20s + + metasploit-mcp: + build: + context: . + dockerfile: Dockerfile + restart: unless-stopped + environment: + MSF_PASSWORD: ${MSF_PASSWORD:?Set MSF_PASSWORD in .env} + MSF_SERVER: metasploit-rpc + MSF_PORT: "55553" + MSF_SSL: "false" + MCP_REQUIRE_AUTH: "true" + MCP_AUTH_TOKEN: ${MCP_AUTH_TOKEN:?Set MCP_AUTH_TOKEN in .env} + MCP_ALLOW_ACTIVE_ACTIONS: ${MCP_ALLOW_ACTIVE_ACTIONS:-false} + MCP_ALLOW_SESSION_CONTROL: ${MCP_ALLOW_SESSION_CONTROL:-false} + MCP_ALLOW_PAYLOAD_GENERATION: ${MCP_ALLOW_PAYLOAD_GENERATION:-false} + MCP_ALLOW_LISTENER_CONTROL: ${MCP_ALLOW_LISTENER_CONTROL:-false} + PAYLOAD_SAVE_DIR: /app/payloads + depends_on: + metasploit-rpc: + condition: service_healthy + expose: + - "8085" + volumes: + - payloads:/app/payloads + + caddy: + image: caddy:2-alpine + restart: unless-stopped + environment: + MCP_DOMAIN: ${MCP_DOMAIN:?Set MCP_DOMAIN in .env} + depends_on: + - metasploit-mcp + ports: + - "80:80" + - "443:443" + volumes: + - ./Caddyfile:/etc/caddy/Caddyfile:ro + - caddy-data:/data + - caddy-config:/config + +volumes: + msf-data: + payloads: + caddy-data: + caddy-config: From 16b2781487ae2fd062c363b9d4de90bf1b58442f Mon Sep 17 00:00:00 2001 From: tupsonik <110323635+tupsonik@users.noreply.github.com> Date: Fri, 25 Sep 2026 04:22:06 +0200 Subject: [PATCH 2/4] feat: add HTTPS reverse proxy for VPS deployment --- Caddyfile | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 Caddyfile diff --git a/Caddyfile b/Caddyfile new file mode 100644 index 0000000..465c82d --- /dev/null +++ b/Caddyfile @@ -0,0 +1,4 @@ +{$MCP_DOMAIN} { + encode zstd gzip + reverse_proxy metasploit-mcp:8085 +} From 23ce4917a93c339f65b38c3371531d00343b45ec Mon Sep 17 00:00:00 2001 From: tupsonik <110323635+tupsonik@users.noreply.github.com> Date: Fri, 25 Sep 2026 04:22:09 +0200 Subject: [PATCH 3/4] feat: add one-command VPS bootstrap script --- scripts/bootstrap-vps.sh | 61 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 scripts/bootstrap-vps.sh diff --git a/scripts/bootstrap-vps.sh b/scripts/bootstrap-vps.sh new file mode 100644 index 0000000..2ce2a41 --- /dev/null +++ b/scripts/bootstrap-vps.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +cd "$(dirname "$0")/.." + +if ! command -v docker >/dev/null 2>&1; then + echo "Docker is required. Install Docker Engine + Compose plugin first." + exit 1 +fi + +if ! docker compose version >/dev/null 2>&1; then + echo "Docker Compose v2 is required." + exit 1 +fi + +if [[ ! -f .env ]]; then + read -r -p "MCP domain (DNS A record must already point here): " MCP_DOMAIN + if [[ -z "$MCP_DOMAIN" ]]; then + echo "MCP_DOMAIN is required." + exit 1 + fi + + MSF_PASSWORD="$(openssl rand -base64 36 | tr -dc 'A-Za-z0-9' | head -c 32)" + MCP_AUTH_TOKEN="$(openssl rand -hex 32)" + + cat > .env <