Install ScanSuite Teams

Install ScanSuite Teams on a Linux server, create the first account and connect an AI provider. One script does the installation into /opt/scansuite; most of its time goes into downloading images.

Install ScanSuite Teams on this server by following https://scansuite.eu/documentation/installation/install-scansuite-server. Do the work yourself: check the prerequisites, ask me where the licence file is and copy it into place, and start the installer in a terminal I can type into, so that I only type the registry password when the installer asks for it. Never ask me to paste a secret into the chat.

With an AI agent that has a shell on the server, you do three things on this page: say where the licence file is, type the registry password when the installer asks for it, and create the first account in your browser. The agent does the rest, including copying the licence file and starting the installer.

Before you start

The values this page uses:

1. Put the licence file on the server

The installer reads the licence from the folder it is started in. Put the licence file sent with your order into an empty folder of the installing account:

mkdir -p ~/scansuite-licence
cp <LICENCE_FILE> ~/scansuite-licence/

If the file is on your computer instead, copy it over with scp <LICENCE_FILE> <ACCOUNT>@<YOUR_HOST>:~/scansuite-licence/. Use the ScanSuite Teams licence: a licence for the other edition does not install Teams, even when the file name looks the same.

Check, in that folder:

ls *.lic

Expected: exactly one file, <name>_<LICENCE_CODE>.lic. The installer uses the first .lic it finds, so remove any other.

2. Run the installer

The installer asks once for the registry password (step 3), so it runs in a terminal a person can type into. In the folder with the licence file:

cd ~/scansuite-licence
bash -c "$(curl -sSL https://scansuite.eu/install-teams)"

It installs git if it is missing, creates /opt/scansuite (with sudo, then hands it to your account), fetches the installation files into it, copies the licence into /opt/scansuite/key/, installs Docker if needed, checks the host, downloads the images and starts everything. Running it again is safe: it repairs an installation rather than duplicating it.

An AI agent starts the installer in a terminal you can see and type into: the terminal panel of its app, or a tmux session on the server that you attach to from your own SSH session. The agent follows the output and carries on when the installer finishes:

command -v tmux || sudo apt-get install -y tmux
tmux new-session -d -s scansuite 'cd ~/scansuite-licence && bash -c "$(curl -sSL https://scansuite.eu/install-teams)"; exec bash'
tmux capture-pane -p -t scansuite | tail -20

You attach with tmux attach -t scansuite, type the password when asked, and detach with Ctrl+B then D. An agent with neither a terminal panel nor tmux gives you the two commands above to run yourself, and continues with step 4 once they finish.

zoom_inEnlarge

The host checks warn but do not stop: too little free disk space, or another program on ports 80 and 443, is reported and the installation goes on. Only a missing Docker that the installer cannot install stops it. On WSL, Docker's own install script prints a Docker Desktop hint and waits 20 seconds (You may press Ctrl+C now to abort): let it continue. When it installs Docker it prints Docker installed. Run 'newgrp docker' (or log out and back in) to use docker without sudo. — do that after the installer finishes.

By default the installer brings up the application and DefectDojo, without the classic scanner containers. To choose differently on the first run, install by hand instead of the one-liner:

sudo mkdir -p /opt/scansuite && sudo chown "$USER": /opt/scansuite
git clone https://github.com/cepxeo/scansuite /opt/scansuite
cp ~/scansuite-licence/*.lic /opt/scansuite/key/
cd /opt/scansuite && ./scansuite install <LICENCE_CODE> --all-scanners

Every option is in Installer options below; you can also add scanners later with ./scansuite update --all-scanners.

3. Sign in to the image registry

On a host that has not signed in yet, the installer stops at:

[*] Signing in to the image registry as <REGISTRY_USER>
Password:

zoom_inEnlarge

Expected: Login Succeeded, then the image downloads. The host stays signed in, so later runs and updates do not ask again. Docker keeps the token in /root/.docker/config.json, readable by root only, and warns that it is stored unencrypted; sudo docker logout removes it, and the next update then asks again. If the installer was started without a terminal to type in, Docker prints cannot perform an interactive login from a non-TTY device and the installer ends with Registry sign-in failed. Check the credentials sent with your licence. and Installation failed. That is not a fault for doctor: start the installer again in a terminal as step 2 describes; running it again is safe.

Wait until the images are downloaded. The installer starts the services and waits until every one reports healthy. A successful run ends with:

[+] All services healthy
[*] Open https://<this host>/setup in a browser to create the first account.
[+] ScanSuite Teams is installed in /opt/scansuite

zoom_inEnlarge

If it ends with Start failed. Run ./scansuite doctor for the reason. or Installation failed (and the lines above it are not the registry sign-in), go to step 4 and then Troubleshooting.

4. Check the installation

cd /opt/scansuite
./scansuite doctor
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/setup

Expected: doctor ends with [+] No problems found, and the curl line prints 200 — the setup page is waiting for the first account. Anything else: Troubleshooting maps each doctor message to its fix.

5. Create the first account

A fresh installation has no accounts, so it serves a setup page. Open https://<YOUR_HOST>/setup in a browser right away: whoever opens it first creates the account that administers the installation. The console is served with a self-signed certificate until you replace it (SSL/TLS Setup), so the browser warns the first time.

Expected: the sign-in page. Sign in with the new account. The setup page is gone for good: the curl check from step 4 now prints 302. That account is the administrator of its team and of the installation; adding people and teams is in Members and accounts and System Settings.

6. Connect an AI provider

The scan forms start with the AI scanners selected, and an AI scan cannot start until a model answers. Until then Task routing says No model answers the default route yet: AI scans cannot start until one does. Set up one model for the whole installation:

1. Open the user menu (top right) → System Settings → Shared services.
2. On AI connections, click Add connection. Enter a Name, choose the Kind — OpenAI-compatible (OpenAI, Azure OpenAI, vLLM, Ollama and similar: API URL and API key) or Vertex AI (Claude) (Google Cloud project ID, Vertex AI region and a service account key) — and click Save.
3. On AI models, click Add model. Enter a Name, pick the Connection, enter the Model ID as the provider knows it (for Azure OpenAI, the deployment name) and click Save.
4. On Task routing, click Change on the Default row, pick the model as First model and click Save.
5. On System AI, click Test connection.

Expected: Answered in N s: … next to Test connection, and the warning on Task routing is gone. Every field, the per-task routing and the costs are in AI providers and cost.

7. Next steps

• Your first scan: Quick start continues from here — create the first account, connect AI, create a product, scan, read the report.
• Your own certificate: SSL/TLS Setup.
• DefectDojo, for the classic scanners' full results: Set up DefectDojo.
• Protect browser sessions: cross-site request forgery checks are off until you turn them on. Do it for any installation a browser reaches: add CSRF_PROTECTION=true to /opt/scansuite/.env and run ./scansuite restart. API tokens are not affected.
• Backups: Backup and restore.

Or let your coding agent take it from here:

Set up ScanSuite for me: fetch and follow https://scansuite.eu/documentation/agent-setup.md

Day to day, everything is one command in /opt/scansuite:

./scansuite status              # what is running
./scansuite logs web            # recent log lines for one service
./scansuite doctor              # check the host and the installation
./scansuite update              # fetch the current release and apply it

An update keeps .env, key/, your changes to the configuration files and your TLS certificate and key, and services that crash restart by themselves. Every command and .env setting is in Setup parameters and services.

Installer options

./scansuite install <LICENCE_CODE> and ./scansuite update take these options. The scanner and DefectDojo choice is saved in .env (SCANSUITE_SCANNERS, SCANSUITE_DOJO), so later updates and starts keep to it until you give another.

The options combine, for example --static-only --no-dojo. A scan that needs a scanner container you have not installed is not available until you add it, for example with ./scansuite update --all-scanners.

Without access to the image registry

A server that cannot reach the registry or git is installed from files carried over on disk. You need a second host with registry access and the same licence.

1. On the connected host, in an installation of the same licence with the scanner choice you want, save the images:
   ShellCopy

   cd /opt/scansuite && ./scansuite offline save /tmp/scansuite-images

   Expected: [+] N images written to /tmp/scansuite-images. The set follows that installation's scanner and DefectDojo choice.
2. Copy that directory and the installation files to the target server — the whole /opt/scansuite directory without .env and backups/, or a git clone https://github.com/cepxeo/scansuite made on the connected host — and put the files in /opt/scansuite, owned by the installing account, with your licence in key/.
3. On the target, install Docker and its Compose plugin yourself (the installer cannot download them), then load the images:
   ShellCopy

   cd /opt/scansuite && ./scansuite offline load /tmp/scansuite-images

   Expected: [+] Bundle checksums verified and [+] Images loaded.
4. Install without the registry, with the same scanner option as the source:
   ShellCopy

   ./scansuite install <LICENCE_CODE> --offline

   Then continue with step 4 above.

A later release goes the same way: save it on the connected host after its update, copy the images and the updated installation files over, load, then ./scansuite update --offline.

Behind a web server the host already runs

If the host already serves ports 80 and 443, the installer starts everything except ScanSuite's nginx and says which program holds the ports. Let that web server proxy to ScanSuite instead: SSL/TLS Setup.