Deployment

Setup parameters and services

Environment variables, services and the settings available in the console.

The .env file

ScanSuite components, such as the database or the message queue, can run on different hosts. In that case, connection strings and credentials are passed through the .env file located in the ~/apps/scansuite folder:

ScanSuite environment file — The .env file in ~/apps/scansuite

Parameter	Purpose
LOG_FILE	The ScanSuite log file. It must be reachable from inside the container — by default only /var/tmp is mounted, so adjust docker-compose.yml to mount another folder for alternative log storage.
CELERY_HOST, REDIS_PASSWORD	Redis connection parameters.
PS_DATABASE_*	PostgreSQL database connection parameters.
NESSUS_*	Nessus connection parameters.

Administrative commands

Several binaries are provided to help with typical administrative activity.

install [6_chars_license_id]

Installs and updates ScanSuite and DefectDojo. Run it periodically to fetch updates, or set up a cron job to fetch them automatically:

Shell

sudo ./install 6efa34

install also accepts nodojo as a second parameter to skip the DefectDojo installation or update, and nostatic / nodynamic as second or third parameters to bypass the static or dynamic scanner downloads — for example, when ScanSuite is not used for both scan types. Possible usages:

bash

sudo ./install 6efa34 nodojo
sudo ./install 6efa34 nostatic
sudo ./install 6efa34 nodynamic

Below is an example cron job (run sudo cron -e to set one) for weekly automatic updates:

crontab

0 3 * * 4 cd /home/USER/apps/scansuite && ./install 6efa34 > /home/USER/scansuite-update.log

start-scansuite [number_workers]

Starts or restarts ScanSuite with a given number of workers for parallel scanning. The default is 2.

defectdojo/dojo-password

Retrieves the DefectDojo password from the default DefectDojo location, and changes it if required.

The password is removed after a DefectDojo restart, so write it down and save it in a secure location.

defectdojo/reset-dojo

Wipes and recreates the DefectDojo database in the default location. This also triggers generation of a new admin user. Wait a few minutes and run dojo-password.

Do not forget to fetch the new DefectDojo API key afterwards and update the ScanSuite settings accordingly, or result uploads will start failing.

services/reset-scansuite

Wipes the ScanSuite database in the default location. This also triggers generation of a new admin user, which becomes visible when running start-scansuite.

Files worth knowing about

Path	Contents
services/nginx/certs	Your custom SSL private key and certificate in .pem format for the ScanSuite web server.
defectdojo/certs	Your custom SSL private key and certificate in .pem format for the DefectDojo web server.
services/nginx/default.conf.template	The nginx configuration file. Adjust as required, including for a non-default certificate location — for example when certificates are managed by certbot.
services/nginx/scan-dojo.example	An example nginx config that reverse-proxies both ScanSuite and DefectDojo through a single ScanSuite nginx instance.

Certificate handling is covered end to end in SSL/TLS Setup.

Last reviewed 2026-08-15