Flowsint - OSINT Framework

What it is

Flowsint is a self-hosted OSINT graph tool distributed as pre-built images on GitHub Container Registry, run via Docker Compose. Registration is open by default — there are no seeded credentials or accounts; the first person to reach /register creates an account. This document covers the concrete deploy-and-harden steps the page gives, which the summary names but does not spell out.

Preconditions / Affected

The default configuration is single-user safe but network-unsafe: it ships with default secrets in .env and an nginx Host-header allowlist that accepts only localhost / 127.0.0.1 / [::1]. Only port 5173 is exposed; Postgres, Redis, Neo4j and the API bind to 127.0.0.1. Any deployment reachable beyond the local machine (http://<server-ip>:5173) must be hardened before exposure, because open registration means anyone who can reach the port can create an account.

What to do

Production install pulls prebuilt images (no local build):

git clone https://github.com/reconurge/flowsint.git
cd flowsint
cp .env.example .env
docker compose -f docker-compose.prod.yml up -d

Before exposing to a network, rotate three secrets in .env:

openssl rand -hex 32

for AUTH_SECRET (signs auth tokens);

python3 -c "import os, base64; print('base64:' + base64.b64encode(os.urandom(32)).decode())"

for MASTER_VAULT_KEY_V1 (encrypts stored API keys); and set NEO4J_PASSWORD.

Then add your server hostname/IP to the Host-header allowlist in flowsint-app/nginx.conf — find map $http_host $is_flowsint_host; two commented template lines show the format. LAN/public deploys must opt in their own hostname or DNS-rebinding protection blocks them.

For HTTPS beyond a trusted LAN, front port 5173 with a reverse proxy, e.g. Caddy:

flowsint.example.com {
    reverse_proxy 127.0.0.1:5173
}

When fronting with a proxy, also bind the app port to localhost in docker-compose.prod.yml ("127.0.0.1:5173:8080") so clients cannot bypass HTTPS.

To pin a version, set FLOWSINT_VERSION in .env (e.g. FLOWSINT_VERSION=1.2.10) instead of tracking latest.

Caveats

The page states Flowsint is "still in early development" and points to ETHICS.md for responsible-use guidelines. The default Host-header allowlist defends only single-user localhost installs against DNS rebinding; it does nothing for LAN/public deploys until you edit it. Windows setup differs — Make is not used, and you must manually copy .env.example into four locations (.env, flowsint-api\.env, flowsint-core\.env, flowsint-app\.env) before docker compose up.