All configuration for a redStack deployment is controlled through Terraform input variables. Set them in a terraform.tfvars file before running terraform apply.
Variables marked Required have no defaults. Terraform will error immediately if they are not set.
Required variables
These three variables must be set in every deployment. There are no defaults.
Your local public IP address in CIDR notation. Used to restrict SSH and management access at the security group level. Terraform validates this value — it will reject non-CIDR strings.Find your public IP with curl ifconfig.me, then append /32.localPub_ip = "108.51.27.140/32"
Name of an existing AWS EC2 key pair. Terraform does not create this — it must already exist in your account before you run terraform apply.The key pair is used for SSH access to Linux instances and to decrypt the Windows Administrator password.ssh_key_name = "rs-rsa-key"
Create a key pair via AWS CLI:aws ec2 create-key-pair --key-name rs-rsa-key \
--query 'KeyMaterial' --output text > ./rs-rsa-key.pem
chmod 400 ./rs-rsa-key.pem
Path to the .pem private key file on the machine running Terraform. Used by Terraform to call rsadecrypt() and automatically decrypt the Windows Administrator password so it appears in terraform output.ssh_private_key_path = "./rs-rsa-key.pem"
The path is relative to the directory where you run terraform apply. An absolute path also works.
AWS configuration
aws_region
string
default:"us-east-1"
AWS region where all resources are created. All instances, VPCs, security groups, and Elastic IPs are deployed in this region. Prefix applied to every resource name and Project tag. Use distinct values when running multiple simultaneous deployments so you can isolate them in the AWS Console and billing reports.project_name = "redStack"
For a second parallel deployment (e.g., with external VPN), use "redStack-extVPN" and a matching CostCenter tag.
Instance types
Each lab component runs on its own EC2 instance. Adjust these to balance cost and performance.
Estimated monthly cost at defaults with all instances running 24/7: ~$135/month plus data transfer. Stop instances when not in use to reduce costs.
mythic_instance_type
string
default:"t3.medium"
EC2 instance type for the Mythic C2 team server. The default t3.medium (2 vCPU, 4 GB RAM) is the recommended minimum — Mythic’s Docker stack is memory-intensive.mythic_instance_type = "t3.medium"
EC2 instance type for the Apache Guacamole server. Guacamole is the browser-based access portal for all internal lab instances.guacamole_instance_type = "t3.small"
windows_instance_type
string
default:"t3.medium"
EC2 instance type for the Windows operator workstation. Accessed via RDP through Guacamole.windows_instance_type = "t3.medium"
EC2 instance type for the Apache redirector. The redirector handles only HTTP/HTTPS proxying and header validation — a t3.micro is sufficient for most lab workloads.redirector_instance_type = "t3.micro"
If you enable external VPN (enable_external_vpn = true), consider upgrading to t3.small. The redirector will also route VPN traffic and run WireGuard.
EC2 instance type for the Sliver C2 server.sliver_instance_type = "t3.small"
havoc_instance_type
string
default:"t3.medium"
EC2 instance type for the Havoc C2 server. Havoc runs a Qt-based teamserver and a graphical desktop — the t3.medium default is recommended.havoc_instance_type = "t3.medium"
Network configuration
When false (recommended), Terraform creates a dedicated VPC for the team server infrastructure using the CIDR specified in vpc_cidr. When true, all team server instances are placed in your account’s AWS default VPC.Using the default VPC is not recommended for production labs. A dedicated VPC provides network isolation and avoids conflicts with other resources in your account.
vpc_cidr
string
default:"10.50.0.0/16"
CIDR block for the dedicated team server VPC. Only used when use_default_vpc = false.vpc_cidr = "10.50.0.0/16"
redirector_vpc_cidr
string
default:"10.60.0.0/16"
CIDR block for the redirector VPC. The redirector always runs in its own VPC, peered to the team server VPC.When running two deployments simultaneously, change one of them to avoid CIDR conflicts — for example, use 10.61.0.0/16 for the second deployment.redirector_vpc_cidr = "10.60.0.0/16"
Redirector and domain
Custom domain for the Apache redirector. When set, the redirector uses this domain for TLS certificate provisioning.When left empty, the redirector operates in closed environment mode — it uses the public IP with a self-signed certificate. This is the correct setting for HTB, VL, and PG labs where no public domain is needed.# Open environment (public lab with custom domain)
redirector_domain = "c2.yourdomain.com"
# Closed environment (HTB/VL/PG — leave empty)
redirector_domain = ""
After deployment, point your domain’s A record to the Redirector Elastic IP shown in terraform output deployment_info.
enable_redirector_htaccess_filtering
When true, the redirector loads redirect.rules with Apache mod_rewrite rules that block known scanner user-agents and AV/sandbox IP ranges, redirecting them to a decoy page.Set to false for HTB, VL, and PG environments where scanner blocking is unnecessary and may interfere with lab traffic.enable_redirector_htaccess_filtering = true # Open environment
enable_redirector_htaccess_filtering = false # HTB/VL/PG
C2 URI prefixes
These URI prefixes are baked into agent payloads at deploy time. The redirector uses them to route incoming C2 callbacks to the correct team server. Set these before running terraform apply — changing them after deployment requires redeploying payloads.
URI prefixes are embedded in compiled payloads. Changing them after deploying agents requires generating and re-deploying new payloads.
mythic_uri_prefix
string
default:"/cdn/media/stream"
URI prefix routed to the Mythic C2 team server. Designed to blend with CDN traffic patterns.mythic_uri_prefix = "/cdn/media/stream"
sliver_uri_prefix
string
default:"/cloud/storage/objects"
URI prefix routed to the Sliver C2 server. Designed to blend with cloud storage traffic patterns.sliver_uri_prefix = "/cloud/storage/objects"
havoc_uri_prefix
string
default:"/edge/cache/assets"
URI prefix routed to the Havoc C2 server. Designed to blend with edge/CDN cache traffic patterns.havoc_uri_prefix = "/edge/cache/assets"
The redirector requires a specific HTTP header to be present on all C2 callbacks. Requests without the correct header are served a decoy CloudEdge CDN maintenance page.
The HTTP header name the redirector checks on every incoming request.c2_header_name = "X-Request-ID"
The token value the redirector expects in the header. Leave empty to have Terraform auto-generate a random token at deploy time (recommended). The generated value is shown in terraform output deployment_info and terraform output network_architecture.# Auto-generate (recommended)
c2_header_value = ""
# Or set a specific value
c2_header_value = "my-secret-token"
Auto-generation is recommended. The token appears in all output sections so you can reference it when building payloads.
Autostart
When true, Mythic starts automatically on instance boot via a systemd service. When false, you must SSH in and start Mythic manually after each boot.enable_mythic_autostart = true
External VPN (HTB / VL / PG)
These variables enable routing lab traffic through an external OpenVPN connection — required for HTB, VulnLab, and Proving Grounds targets.
When true, Terraform configures an OpenVPN client on the redirector and a WireGuard tunnel between the redirector and Guacamole. Internal lab machines can then reach CTF targets through the VPN.enable_external_vpn = false # Default — open environment
enable_external_vpn = true # HTB/VL/PG mode
Enabling this also disables the default gateway redirect on the OpenVPN client to preserve VPC peering and C2 connectivity.
external_vpn_cidrs
list(string)
default:"[\"10.10.0.0/16\"]"
List of CIDR blocks that should be routed through the redirector’s VPN tunnel. These are added as static routes on the WireGuard interface on the Guacamole server.The default covers most HTB and VulnLab target ranges. Add additional ranges as needed for your platform.external_vpn_cidrs = ["10.10.0.0/16"]
# Multiple ranges
external_vpn_cidrs = ["10.10.0.0/16", "10.13.0.0/16"]
Tagging
A map of additional key-value tags applied to every AWS resource in the deployment. Useful for cost tracking, filtering resources in the AWS Console, and billing reports.Every resource also receives an automatic Project tag set to the value of project_name.tags = {
Owner = "Operator"
CostCenter = "redStack"
Purpose = "Boot-to-Breach Training Environment"
}
The following example shows all key variables with comments. Copy this to terraform.tfvars and fill in your values.
# ============================================================================
# REQUIRED — must be set before terraform apply
# ============================================================================
# Your public IP for SSH access (curl ifconfig.me)
# Must be in CIDR format with /32 suffix
localPub_ip = "108.51.27.140/32"
# Name of your existing AWS EC2 key pair
# Must already exist in AWS EC2 Console > Key Pairs
ssh_key_name = "rs-rsa-key"
# Path to your SSH private key file (.pem)
# Used to auto-decrypt the Windows Administrator password
ssh_private_key_path = "./rs-rsa-key.pem"
# ============================================================================
# AWS CONFIGURATION
# ============================================================================
aws_region = "us-east-1"
project_name = "redStack"
# ============================================================================
# INSTANCE TYPES
# ============================================================================
mythic_instance_type = "t3.medium" # 2 vCPU, 4 GB RAM
guacamole_instance_type = "t3.small" # 2 vCPU, 2 GB RAM
windows_instance_type = "t3.medium" # 2 vCPU, 4 GB RAM
sliver_instance_type = "t3.small" # 2 vCPU, 2 GB RAM
havoc_instance_type = "t3.medium" # 2 vCPU, 4 GB RAM
redirector_instance_type = "t3.micro" # 2 vCPU, 1 GB RAM
# ============================================================================
# NETWORK
# ============================================================================
use_default_vpc = false # Recommended: create a dedicated VPC
vpc_cidr = "10.50.0.0/16" # TeamServer VPC CIDR
redirector_vpc_cidr = "10.60.0.0/16" # Redirector VPC CIDR
# Change to 10.61.0.0/16 for a second parallel deployment
# ============================================================================
# REDIRECTOR AND DOMAIN
# ============================================================================
# Apex or subdomain pointing to the Redirector Elastic IP
# Leave empty for closed environments (HTB/VL/PG)
redirector_domain = "c2.yourdomain.com"
# Set false for HTB/VL/PG — scanner/AV blocking not needed in lab environments
enable_redirector_htaccess_filtering = true
# ============================================================================
# C2 URI PREFIXES
# These are baked into payloads at deploy time. Set before terraform apply.
# ============================================================================
mythic_uri_prefix = "/cdn/media/stream"
sliver_uri_prefix = "/cloud/storage/objects"
havoc_uri_prefix = "/edge/cache/assets"
# ============================================================================
# C2 HEADER VALIDATION
# ============================================================================
# c2_header_name = "X-Request-ID" # Default — override if needed
# c2_header_value = "" # Leave empty to auto-generate (recommended)
# ============================================================================
# MYTHIC
# ============================================================================
enable_mythic_autostart = true
# ============================================================================
# EXTERNAL VPN (HTB / VL / PG)
# ============================================================================
# Set true for HTB/VL/PG — enables OpenVPN client + WireGuard routing
enable_external_vpn = false
# CIDR blocks reachable through the VPN tunnel
# external_vpn_cidrs = ["10.10.0.0/16"]
# ============================================================================
# TAGGING
# ============================================================================
tags = {
Owner = "Operator"
CostCenter = "redStack" # Match to project_name for per-deployment billing isolation
Purpose = "Boot-to-Breach Training Environment"
}
