T-Pot Community Edition (tpotce) is an all-in-one honeypot platform that orchestrates 20+ honeypots (e.g., cowrie, dionaea, conpot, heralding) alongside network security monitoring tools (p0f, Suricata, fatt) and the Elastic Stack (Elasticsearch, Logstash, Kibana) for centralized log storage, analysis, and real-time attack visualization. The system is deployed via Docker Compose with an Ansible-based installer supporting multiple Linux distributions. It offers several deployment flavors (standard, sensor, mini, LLM, tarpit, mobile) and supports a distributed Hive/Sensor architecture where remote sensors forward encrypted logs to a central Hive over HTTPS. Architecturally, each honeypot runs in an isolated container with read-only filesystems, non-root user, and dedicated networks. The ELK stack processes all telemetry: Logstash ingests JSON logs from persistent volumes, Elasticsearch indexes them, and Kibana provides dashboards and an attack map. A custom p0f (passive OS fingerprinting) fork is bundled and compiled from C source, demonstrating deep network-level analysis. The update and backup system (`update.sh`) is a robust, self-contained script that handles version pinning, configuration backups, Elasticsearch state exports, and image rollouts. The codebase includes a reusable test harness (`docker/_tests/lib/common.sh`) for validating individual honeypot containers with protocol-specific probes.
The provided repository contains only the documentation website for the HFish honeypot platform (a Go-based B/S architecture application). No actual application source code (Go, JavaScript, etc.) is present in the file tree. The documentation is extensive, covering deployment, usage, and advanced features, but the core application logic cannot be evaluated. The repo appears to be actively maintained with a large community, but the absence of code prevents any assessment of architecture, data flows, or reusable components.