# Administration

> Set up and run a ScanSuite Teams installation day to day, where it keeps its data and which network flows it needs.

Source: https://scansuite.eu/documentation/administration
Last reviewed: 2026-10-19

Run a ScanSuite Teams installation: System Settings and teams, roles and members, single sign-on, the external services teams connect, the `scansuite` command and its `.env` file, backups, and the activity logs. Below the chapters: where an installation keeps its data and which network flows it needs.

- [System Settings](https://scansuite.eu/documentation/administration/platform-administration): Teams and their limits, shared services (system AI, Nessus, Git service, interface language), system administrators, key rotation and health.
- [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles): What each of the four roles can do, and how a team admin sets up a team: targets, AI, scan credentials, reports and API tokens.
- [Members and accounts](https://scansuite.eu/documentation/administration/user-administration): Adding members and accounts, password links and resets, and My account: repository keys and interface language.
- [Single sign-on](https://scansuite.eu/documentation/administration/single-sign-on): Microsoft Entra ID, OpenID Connect and AD/LDAP through a broker, with roles from directory groups in every team.
- [API keys for external systems](https://scansuite.eu/documentation/administration/configuring-api-keys-for-external-systems): A team's scanner engines, issue trackers, alerts and enrichment services, and where AI and repository access are set.
- [Setup parameters and services](https://scansuite.eu/documentation/administration/setup-parameters-and-services): Every scansuite subcommand, option and environment variable, the .env file, updates, services and the doctor checks.
- [Backup and restore](https://scansuite.eu/documentation/administration/backup-and-restore): Save and restore the databases, the stored files and the secrets of a server with the scansuite command.
- [Security logs](https://scansuite.eu/documentation/administration/security-logs): The team and system activity logs: what they record and where to find them.

## Where the data lives

| Where | What | Backup |
|---|---|---|
| /opt/scansuite/.env | Settings and generated passwords. | Back up with ./scansuite backup secrets |
| /opt/scansuite/key/ | The licence file, and the keys that decrypt the credentials stored in the database. | Back up with ./scansuite backup secrets |
| /opt/scansuite/backups/ | Where backups are written unless you name another place. | Copy off the host |
| /opt/scansuite/services/nginx/certs/ | The TLS certificate and key the console is served with. | Yours; kept by updates |
| Docker volume postgres_data | The database: products, scans, findings, settings. | Back up with ./scansuite backup db |
| Docker volume seaweedfs_data | Stored scan artefacts and reports. | Back up with ./scansuite backup db --with-files |
| Docker volume redis_data | The queue; nothing that cannot be rebuilt. | Not needed |
| /var/tmp | Scan work directories and the application log /var/tmp/scansuite.log. | Not needed; needs free space |
| /var/lib/docker | Images, volumes and container logs (capped at 60 MB per service). | Needs free space |

Backups are covered in [Backup and restore](https://scansuite.eu/documentation/administration/backup-and-restore). The database is a container of the installation; its connection is the `PS_DATABASE_*` settings in `.env` (see [Setup parameters and services](https://scansuite.eu/documentation/administration/setup-parameters-and-services)).

## Network flows

| Direction | Peer | Port | For |
|---|---|---|---|
| In | Browsers, CI pipelines, AI agents | 443 (80 redirects to it) | The console and the API. |
| In | Browsers, and ScanSuite itself | 8443 (8080) | DefectDojo, when installed. |
| Out, install and update | scansuite.eu, github.com, raw.githubusercontent.com | 443 | The installer and the release files. |
| Out, install and update | Docker Hub (registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com, production.cloudfront.docker.com) | 443 | The images. Not needed for an offline installation. |
| Out, install | get.docker.com, download.docker.com, the OS package mirrors | 443 / 80 | Docker and git, when the host does not have them yet. |
| Out, scanning | Your AI provider endpoint | 443, or the port you configure | Every AI scan. |
| Out, scanning | Your git servers | 443 or 22 | Repository scans. |
| Out, scanning | The targets you scan | Any | Web, API, infrastructure scans and AI pentests. |
| Out, scanning | Nessus, OpenVAS, Acunetix, DefectDojo, and services you give API keys for | 443, or as configured | Only what you set up. |

The allow-list for a host with restricted internet access is in [Technical Requirements](https://scansuite.eu/documentation/installation/technical-requirements).