Administration
Set up and run a ScanSuite Teams installation day to day, where it keeps its data and which network flows it needs.
Run a ScanSuite Teams installation: System Settings and teams, roles and members, single sign-on, the external services teams connect, the scansuite command and its .env file, backups, and the activity logs. Below the chapters: where an installation keeps its data and which network flows it needs.
System Settings
Teams and their limits, shared services (system AI, Nessus, Git service, interface language), system administrators, key rotation and health.
Teams and roles
What each of the four roles can do, and how a team admin sets up a team: targets, AI, scan credentials, reports and API tokens.
Members and accounts
Adding members and accounts, password links and resets, and My account: repository keys and interface language.
Single sign-on
Microsoft Entra ID, OpenID Connect and AD/LDAP through a broker, with roles from directory groups in every team.
API keys for external systems
A team's scanner engines, issue trackers, alerts and enrichment services, and where AI and repository access are set.
Setup parameters and services
Every scansuite subcommand, option and environment variable, the .env file, updates, services and the doctor checks.
Backup and restore
Save and restore the databases, the stored files and the secrets of a server with the scansuite command.
Security logs
The team and system activity logs: what they record and where to find them.
Where the data lives
| Where | What | Backup |
|---|---|---|
| /opt/scansuite/.env | Settings and generated passwords. | Back up with ./scansuite backup secrets |
| /opt/scansuite/key/ | The licence file, and the keys that decrypt the credentials stored in the database. | Back up with ./scansuite backup secrets |
| /opt/scansuite/backups/ | Where backups are written unless you name another place. | Copy off the host |
| /opt/scansuite/services/nginx/certs/ | The TLS certificate and key the console is served with. | Yours; kept by updates |
| Docker volume postgres_data | The database: products, scans, findings, settings. | Back up with ./scansuite backup db |
| Docker volume seaweedfs_data | Stored scan artefacts and reports. | Back up with ./scansuite backup db --with-files |
| Docker volume redis_data | The queue; nothing that cannot be rebuilt. | Not needed |
| /var/tmp | Scan work directories and the application log /var/tmp/scansuite.log. | Not needed; needs free space |
| /var/lib/docker | Images, volumes and container logs (capped at 60 MB per service). | Needs free space |
Backups are covered in Backup and restore. The database is a container of the installation; its connection is the PS_DATABASE_* settings in .env (see Setup parameters and services).
Network flows
| Direction | Peer | Port | For |
|---|---|---|---|
| In | Browsers, CI pipelines, AI agents | 443 (80 redirects to it) | The console and the API. |
| In | Browsers, and ScanSuite itself | 8443 (8080) | DefectDojo, when installed. |
| Out, install and update | scansuite.eu, github.com, raw.githubusercontent.com | 443 | The installer and the release files. |
| Out, install and update | Docker Hub (registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com, production.cloudfront.docker.com) | 443 | The images. Not needed for an offline installation. |
| Out, install | get.docker.com, download.docker.com, the OS package mirrors | 443 / 80 | Docker and git, when the host does not have them yet. |
| Out, scanning | Your AI provider endpoint | 443, or the port you configure | Every AI scan. |
| Out, scanning | Your git servers | 443 or 22 | Repository scans. |
| Out, scanning | The targets you scan | Any | Web, API, infrastructure scans and AI pentests. |
| Out, scanning | Nessus, OpenVAS, Acunetix, DefectDojo, and services you give API keys for | 443, or as configured | Only what you set up. |
The allow-list for a host with restricted internet access is in Technical Requirements.
Last reviewed 2026-10-19