devZero-Security / redStackPRO

# redStackPRO
> A web canvas where you build infrastructure as a topology, then export a
> complete, runnable working directory of Terraform and Ansible. You run it from
> your own machine. **redStackPRO never holds your cloud credentials.**
> [!IMPORTANT]
> **redStackPRO is in prerelease (beta).** Features are still moving before 1.0.
> GCP and AWS are tested end to end; Azure, Proxmox, and ESXi are on the roadmap.
> Expect rough edges, and pin to a released version if you need stability.
>
> **Hit a rough edge, or have feedback?** Open an issue at
> Issues. If it was a
> deploy, attach the scrubbed `logs/deploy-*.log` the run wrote (it records versions,
> provider, and where it stopped, with secrets removed) so it can be analyzed fast. Your
> reports shape the release.
redStackPRO puts attack infrastructure and target ranges on the same canvas. The two
canvas modes are **Offense** (attack infrastructure) and **Defense** (defensive AD ranges); the
export names its handoff `OFFENSE-BRIEFING.md` or `DEFENSE-BRIEFING.md` to match.
Split horizon C2, attack infrastructure: two front doors that do not share a fate,
Apache fronting Sliver and Nginx fronting Mythic, each redirector on its own peered
network, with the teamservers, collector, and operators behind a jumpbox.
**Multiple operators, one stack.** An attack-infrastructure jumpbox can name a
list of `operators` (handle plus role), and each gets a Guacamole portal login
on the shared lab password. Set the jumpbox's `access_mode` to `wireguard` or
`openvpn` (default is a public portal) and every operator also gets a personal
VPN credential generated on the jumpbox at apply: the keys never leave the box
or enter the export, only the client config file does. The portal logins today
share the one lab password, so per-operator isolation comes from each operator's
own VPN credential, not the portal login; individual portal passwords are on the
roadmap. On a VPN access mode the portal closes to the internet and moves behind
the tunnel, while SSH stays open so the admin can keep deploying and managing the
box. Add or remove a teammate on a running jumpbox with
`sudo rsp-operator add `. See the
wiki Deploying a Range.
Harbor, a target range: a small corporate forest, a root domain and a child over a
parent-child trust, with the ordinary path from a phished workstation to the forest.
GOAD, the full lab: three domains across two forests, five machines and their trusts,
the reference range the written solution follows.
> [!IMPORTANT]
> **The export is the boundary.** The canvas generates files; you run them under
> your own credentials. redStackPRO never deploys anything and never holds a secret.
> [!CAUTION]
> **Authorized use only.** redStackPRO builds offensive infrastructure and
> deliberately vulnerable ranges. Use it only in lab environments you own or are
> explicitly authorized to test, never against systems you do not have written
> permission for.
---
## 🧭 Status
Pre-release, with more to come befo