Collaborating on a Capture-the-Flag (CTF) competition presents unique challenges, especially when your team operates remotely across different time zones. Managing files and assigning challenges can quickly become chaotic. In my quest for a solution, I discovered an open-source solution, "CTFNote", a collaborative tool designed to streamline the organization of work for CTF teams. Developed by The Flat Network Society, CTFNote aims to simplify the collaboration process and enhance team productivity.

, this blog post focuses on the updated CTFNote 

 (WOW). Notable changes include the integration of GraphQL and advanced PostgreSQL syntax. As the free tier of the Heroku PostgreSQL add-on does not support these features, we'll explore an alternative hosting solution for the PostgreSQL database, specifically using 

When it comes to hosting CTFNote, several options exist, including Heroku Standard Tier ($50/month) and Amazon RDS Free Tier (12 Months). However, for this guide's purpose of deploying CTFNote completely for free, we'll leverage 

Step 1: Setting Up Your Render.com Account

Before diving into the installation process, make sure you have a Render.com account. If not, sign up for a free account at 

Step 2: Deploying CTFNote using the render.yaml spec

 Log in to your Render.com account and navigate to your dashboard.

" to initiate the process of setting up your CTFNote instance using Render's Infrastructure as Code (IaC) to create multiple services at once, with automatic syncing of resources.

Scroll down to "Public Git repository and paste in the URL of my fork of CTFNote. Feel free to also fork my repository to modify the 

 Choose a name for your "Project" repository where you have the CTFNote code.

Step 3: Updating the Environment Variable for the "api" service

There are environment variable(s) which you need to configure for CTFNote to work. I have already configured most of the environment (env) variables for the services, however as 

 does not support variable interpolation, we will need to manually edit the 

 On the dashboard, click on the "api" web service, which will bring you to the page where you can manage the service.

 Click on the "Environment" tab and modify the 

 Don't forget to click on the "Save Changes" button after editing the env variables. 

Once the deployment is complete, you can access your CTFNote instance using the provided URL of the "front" web service. Create and account ASAP as the first account created will have administrative privileges.

While Render offers an excellent solution for hosting CTFNote, it's essential to be aware of certain limitations. For instance, you are only able to deploy a limited amount of their service type, which are the "Web services", "PostgreSQL databases" and "Redis instances". Other services such as Background Workers, Cron Jobs, Private Services are unavailable to the Free Tier user. In our case, CTFNote only needs Web services and PostgreSQL databases.

Additionally, users should be mindful that Render.com may delete a Free Tier account and associated customer data if the account remains inactive for a specified period. Currently set at 30 days, this is a precautionary measure to manage resources efficiently. Render also imposes a limit to their PostgreSQL databases on the Free instance type, where it will automatically expire 90 days after creation. Taking this into consideration, users who want to user CTFNote over a long period of time should use an alternative PostgreSQL database solution or implement a backup/restore solution.

When deploying CTFNote on Render.com's free tier, it's essential to be mindful of the these implications, particularly concerning the public exposure of your services. Render.com's free tier allows the creation of web services that are publicly accessible via a Render.com public URL. This means that both the API and HedgeDoc services will be exposed to the internet.

 The API service, which is crucial for CTFNote's functionality, will be accessible over the internet. While this provides convenient access for collaborators, it introduces potential security risks associated with public exposure.

 Similarly, the HedgeDoc service, responsible for collaborative note-taking, will also be publicly available. It's important to consider the sensitivity of the information being shared and take appropriate measures to secure access.

 Be cautious about storing highly sensitive information on public-facing services. Evaluate the nature of the data being shared and ensure that any confidential content is appropriately handled.

While using Render.com's free tier for CTFNote offers cost-effective hosting, carefully assess the security implications of public exposure.

If privacy and internal accessibility are paramount, exploring render 

 with options for their private service instances.

 for deploying CTFNote on Render. While the limitations on certain features persist, ongoing developments and enhancements are expected. If you are actively using CTFNote, consider exploring on render.com 

 or premium services like AWS/Azure for their Databases for a more robust and scalable solution. Happy collaborating!

. [online] Deploy for Free | Render Docs. Available at: 

TFNS (2024). GitHub - TFNS/CTFNote: CTFNote is a collaborative tool aiming to help CTF teams to organise their work. [online] GitHub. Available at: https://github.com/TFNS/CTFNote [Accessed 23 Aug. 2024].

In the world of CTF competitions, effective collaboration and organization are key to success. A powerful open-source tool that aims to do this is CTFNote. This Proof-of-Concept guide will walk you through the process of deploying CTFNote on Render.com, ensuring that your CTF team is well-equipped to tackle challenges with improved organization and communication.

A Guide on deploying CTFNote (v3) on Render.com