🩸 BloodHound CE — Automated Installer

One-command installer for BloodHound Community Edition on Linux. Deploys via Docker Compose and installs a global bloodhound-ce management command for easy on/off control.

---

⚡ Quick Start

# Clone or download this script, then:
chmod +x install-bloodhound-ce.sh

# Basic install (port 8080)
sudo ./install-bloodhound-ce.sh

# Custom port + password
sudo ./install-bloodhound-ce.sh -p 8585 -P 'Bloodhound@123'

After installation, open http://127.0.0.1:8585 and log in.

---

🚀 Post-Installation — What Gets Deployed

The installer automatically deploys the following:

Deployed Services (Docker Containers)

Service	Container Name	Port	Purpose
BloodHound CE	bloodhound-ce-bloodhound-1	127.0.0.1:<PORT>	Web UI + API
PostgreSQL	bloodhound-ce-app-db-1	Internal only	Application database
Neo4j	bloodhound-ce-graph-db-1	127.0.0.1:7474	Graph database

Deployed Commands

The installer places a global management command at /usr/local/bin/bloodhound-ce:

# Verify deployment
which bloodhound-ce          # Should print: /usr/local/bin/bloodhound-ce
bloodhound-ce status         # Should show: BloodHound CE is RUNNING

Deployed Files

Path	Description
/usr/local/bin/bloodhound-ce	Global management command (symlink-safe)
<install-dir>/docker-compose.yml	Docker Compose configuration
Docker volume: bloodhound-ce_postgres-data	PostgreSQL data (persistent)
Docker volume: bloodhound-ce_neo4j-data	Neo4j graph data (persistent)

First-Use Checklist

After the installer finishes, run through this:

# 1. Verify command is deployed
bloodhound-ce status

# 2. Open the Web UI
xdg-open http://127.0.0.1:8585    # or open in your browser manually

# 3. Log in
#    Username: admin
#    Password: (shown at end of installer output)

# 4. Test stop/start cycle
bloodhound-ce stop
bloodhound-ce start

# 5. Verify no duplicate containers
docker ps --filter "label=com.docker.compose.project=bloodhound-ce" -q | wc -l
# Should output: 3

---

📋 Prerequisites

The installer checks for all of these automatically:

Requirement	Minimum	Install Command
Docker	20.x+	sudo apt install -y docker.io
Docker Compose v2	2.x+	sudo apt install -y docker-compose-v2
curl	any	sudo apt install -y curl
python3	3.x+	sudo apt install -y python3
sudo / root	—	Script must be run with sudo

---

🔧 Installation Options

Usage:  sudo ./install-bloodhound-ce.sh [OPTIONS]

Options:
  -p, --port PORT        Web UI port (default: 8080)
  -d, --dir  DIR         Install directory (default: ~/bloodhound-ce)
  -P, --password PASS    Set admin password on install
  -h, --help             Show help

Password Requirements

If using -P to set a password, it must meet:

• At least 12 characters
• At least 1 uppercase letter
• At least 1 lowercase letter
• At least 1 number
• At least 1 special character (@, #, !, etc.)

Examples

# Default install (port 8080, auto-generated password)
sudo ./install-bloodhound-ce.sh

# Custom port
sudo ./install-bloodhound-ce.sh -p 8585

# Custom port + password
sudo ./install-bloodhound-ce.sh -p 8585 -P 'MyP@ssw0rd123'

# Custom everything
sudo ./install-bloodhound-ce.sh -p 9090 -d /opt/bloodhound -P 'Str0ng@Pass!!'

---

🎮 Management Command

After installation, the bloodhound-ce command is available globally:

bloodhound-ce start      # Start BloodHound (safe to run multiple times)
bloodhound-ce stop       # Stop BloodHound
bloodhound-ce restart    # Clean restart
bloodhound-ce status     # Show running status
bloodhound-ce logs       # Follow live logs (Ctrl+C to exit)
bloodhound-ce nuke       # Remove ALL data (asks for confirmation)

Duplicate Prevention

The management command is designed to be idempotent:

• start when already running → skips, no duplicate containers
• stop when already stopped → skips, no errors
• start always runs down --remove-orphans first to clean up stale containers
• Fixed Docker Compose project name (bloodhound-ce) ensures commands always target the same containers

---

🏗️ What the Installer Does

The script executes 6 steps:

Step 1/6 — Checking Prerequisites
              Validates Docker, Docker Compose, curl, python3, root access,
              and checks if the target port is available.

Step 2/6 — Creating Configuration
              Generates docker-compose.yml with your chosen port.
              Validates the compose file syntax.

Step 3/6 — Pulling Docker Images
              Downloads PostgreSQL 18, Neo4j 4.4, and BloodHound CE (latest).

Step 4/6 — Starting BloodHound CE
              Starts all 3 containers with health checks.
              Waits up to 90s for HTTP readiness with progress updates.

Step 5/6 — Configuring Admin Credentials
              Extracts the auto-generated initial password from logs.
              If -P was provided, changes it via the BloodHound API.

Step 6/6 — Installing Management Command
              Installs 'bloodhound-ce' to /usr/local/bin.

---

📦 Architecture

┌─────────────────────────────────────────────────┐
│                  Docker Network                  │
│                                                  │
│  ┌──────────┐  ┌──────────┐  ┌───────────────┐  │
│  │ PostgreSQL│  │  Neo4j   │  │  BloodHound   │  │
│  │   :5432   │  │  :7687   │  │    :8080      │──┼──► 127.0.0.1:<PORT>
│  │ (app-db)  │  │(graph-db)│  │ (bloodhound)  │  │
│  └──────────┘  └──────────┘  └───────────────┘  │
│       │              │              │            │
│       ▼              ▼              │            │
│  [postgres-data] [neo4j-data]       │            │
│   (volume)        (volume)          │            │
└─────────────────────────────────────────────────┘

Container	Image	Purpose
app-db	postgres:18	Application database
graph-db	neo4j:4.4.42	Graph database for AD data
bloodhound	specterops/bloodhound:latest	Web UI + API server

---

🗑️ Uninstall

Keep images, remove data:

bloodhound-ce nuke

Full removal:

# Stop and remove containers + volumes
bloodhound-ce nuke

# Remove Docker images
docker rmi $(docker images -q specterops/bloodhound) 2>/dev/null
docker rmi $(docker images -q postgres) 2>/dev/null
docker rmi $(docker images -q neo4j) 2>/dev/null

# Remove the management command
sudo rm /usr/local/bin/bloodhound-ce

# Remove install directory
rm -rf ~/bloodhound-ce  # or your custom --dir path

---

❓ Troubleshooting

Port already in use

# Check what's using the port
ss -tlnp | grep :8585

# Use a different port
sudo ./install-bloodhound-ce.sh -p 9090

Containers won't start

# Check container logs
bloodhound-ce logs

# Check all container statuses
docker compose -p bloodhound-ce ps -a

# Full restart
bloodhound-ce restart

Docker daemon not running

sudo systemctl start docker
sudo systemctl enable docker  # auto-start on boot

Forgot password

# Nuke and reinstall with a new password
bloodhound-ce nuke
sudo ./install-bloodhound-ce.sh -p 8585 -P 'NewP@ssw0rd123'

Containers start but UI is not accessible

# Check if BloodHound is healthy
docker inspect bloodhound-ce-bloodhound-1 --format='{{.State.Health.Status}}'

# Check bound ports
ss -tlnp | grep 8585

# Verify the container is mapping ports correctly
docker port bloodhound-ce-bloodhound-1

---

🔒 Security Notes

• All services bind to 127.0.0.1 (localhost only) — not exposed to the network
• Default database passwords are used internally (safe behind Docker network isolation)
• Change the admin password on first login or via the -P flag
• Neo4j browser is accessible at http://127.0.0.1:7474 (localhost only)

---

📁 File Structure

<install-dir>/
├── docker-compose.yml        # Docker Compose configuration
└── (Docker volumes)          # Managed by Docker, not stored here
    ├── postgres-data          # PostgreSQL application data
    └── neo4j-data             # Neo4j graph database

/usr/local/bin/
└── bloodhound-ce             # Global management command

---

📄 License

This installer script is provided as-is for convenience. BloodHound CE is licensed under the Apache License 2.0 by SpecterOps.