cloudoasis/forestlen repository overview

⁠ForestLen AD

ForestLen AD is a self-hosted Active Directory discovery solution designed to help administrators discover, collect, and retain information about their AD environment.

⁠Default login and first-time setup

ForestLen ships with the following default login credentials:

• Username: admin
• Password: admin

During the first login, ForestLen will require you to change these credentials.

⁠Who ForestLen is for

ForestLen is designed for professionals who need to discover, assess, and report on Active Directory environments, including:

• Active Directory and systems administrators
• Internal IT and security teams
• Managed service providers (MSPs)
• Professional services and consulting companies
• Security and compliance auditors

⁠AD permissions and read-only operation

To discover the forest, collect AD and DNS information, and assess the health of the environment, ForestLen must run with credentials that have sufficient permissions. Use an account that is a member of Domain Admins or Enterprise Admins, or an account with equivalent delegated administrative rights.

ForestLen is read-only with respect to Active Directory and DNS. It does not create, modify, or delete any AD objects or DNS records. ForestLen runs standard Microsoft commands to query AD and DNS, then presents the collected information in clear, easy-to-read reports.

⁠Supported platforms

ForestLen is published as a multi-architecture image and supports:

• linux/amd64 — Intel and AMD 64-bit processors, including Intel-based Macs.
• linux/arm64 — ARM64 processors, including Apple Silicon Macs.

Docker automatically pulls the appropriate image variant for your supported platform.

⁠Where to run ForestLen

Choose a deployment model based on how frequently ForestLen will be used and the security requirements of the environment.

⁠Option 1: Administrator laptop or secured workstation

Running ForestLen on an administrator's managed laptop or secured workstation is suitable for on-demand assessments and customer engagements. This approach helps keep the application and collected discovery data under the direct control of the authorised administrator.

This option is particularly useful for MSPs, consultants, auditors, and service providers who work with multiple customer environments.

Keep in mind:

• The laptop must be powered on.
• It must be connected to the organisation's network or authorised VPN.
• The ForestLen container must be running while discovery is being performed.
• The device should be encrypted, secured, and accessible only to authorised users.
• Persistent storage must still be configured for the database and discovery data.

⁠Option 2: Company Docker or Kubernetes server

For continuous or scheduled discovery, ForestLen can be deployed on a company-managed Docker or Kubernetes server within the trusted organisational network.

This allows ForestLen to remain available and perform automatic Active Directory and service discovery according to a configured schedule.

For this deployment model:

• Restrict access to authorised administrators.
• Place the service within a trusted network.
• Configure persistent storage—in Kubernetes, use a suitable PersistentVolumeClaim.
• Protect and regularly back up the ForestLen data directory.
• Ensure the server can reach the required Active Directory and DNS services.

⁠Persistent storage is required

ForestLen saves its discovery data and application database in /app/data. Configure persistent storage so this information remains available when the container is restarted, upgraded, or replaced.

Example:

docker run -d \
  --name forestlen \
  -v /mnt/forestlen:/app/data \
  cloudoasis/forestlen:latest

In this example, /mnt/forestlen is the persistent directory on the host and /app/data is the data directory inside the container.

For production deployments:

• Ensure the host directory exists and is writable by the container.
• Restrict access to the directory because it contains your ForestLen database and discovery data.
• Include the persistent directory in your regular backup process.

⁠Optional but recommended: configure the time zone

Setting the container's time zone to match the user's or organisation's local time zone is optional but recommended. This helps ensure that discovery schedules, timestamps, reports, and logs use the expected local time.

Use the TZ environment variable with a valid IANA time-zone name. For example:

docker run -d \
  --name forestlen \
  -e TZ=Australia/Sydney \
  -v /mnt/forestlen:/app/data \
  cloudoasis/forestlen:latest

Replace Australia/Sydney with the appropriate time zone for your location.

⁠Licensing

ForestLen ships with a default 7-day trial license, allowing you to evaluate the product before purchasing a full license.

To purchase a full license key, contact https://cloudoasis.com.au/contact/⁠.

After activation, the license key is stored encrypted in the ForestLen database. Because the database is stored in /app/data, configuring and backing up persistent storage is essential.

⁠Deployment checklist

Before running ForestLen, confirm that:

• The default admin password will be changed during the first login.
• The discovery account has Domain Admins, Enterprise Admins, or equivalent delegated administrative rights.
• A suitable laptop, secured workstation, Docker server, or Kubernetes server has been selected.
• Persistent storage is mounted to /app/data.
• The mounted directory has the correct permissions.
• The data directory is protected and backed up.
• The TZ environment variable is configured when local scheduling and timestamps are important.
• A full license has been purchased before the 7-day trial expires if you intend to continue using ForestLen.