Manage your
DigitalOcean
infrastructure.

Overview

do-manager is built directly on godo, the official DigitalOcean Go client. Two interfaces, one codebase: a CLI you run at the terminal and a library you import into any Go program.

It covers the full DO surface: Droplets, DNS, SSH keys, firewalls, VPCs, reserved IPs, snapshots. On top of that it adds higher-level ops: campaign orchestration (deploy an entire stack in one command, rotate IPs when they get burned, rebuild a node, destroy everything cleanly), opinionated firewall presets, a security audit scanner, and cloud-init templates for common tools — Havoc, Sliver, GoPhish, evilginx2, nginx redirectors, WireGuard.

Use it as a CLI for day-to-day infra work. Use it as a library when you want to provision Droplets or manage firewalls from Go code without shelling out to doctl. Use it for Red Team campaigns where infrastructure lifecycle matters.

Why do-manager?

Three approaches are common for managing DO infra from a Red Team perspective. Here is where each one breaks down and where do-manager fills the gap.

Installation

Requires Go 1.23+.

Configuration

The API token is resolved in this priority order — first match wins:

CLI Reference

Global flags available on every command:

Droplets

List

Aliases: d ls   droplets list

Get

Create

Create flags

Delete

Power actions

SSH Keys

Regions

Sizes

Images

JSON Output

Every command supports -o json (or --output json). The flag is global — attach it anywhere in the command line.

Shell Completion

do-manager completion <shell> generates an autocompletion script. Supported shells: bash, zsh, fish, powershell.

Version

Version, commit, and build date are injected at build time via -ldflags. Release binaries carry the correct Git tag automatically via GoReleaser.

DNS

Manage domains and DNS records directly from the CLI. Supports A, AAAA, CNAME, MX, TXT, NS, SRV, CAA.

Domain commands

Record commands

Firewalls

Create and manage Cloud Firewalls. Rules use the format proto:ports:addresses.

Firewall Presets

Apply a named opinionated ruleset for common Red Team roles. Use --operator-ip to restrict SSH to your IP only.

Reserved IPs

Reserved IPs are static addresses that persist even when a Droplet is deleted or rebuilt. Use them for DNS stability - point your domain to the reserved IP, swap the underlying Droplet freely.

Snapshots

Create, list, and delete Droplet snapshots. Snapshots are the foundation for repeatable campaign deployments. The workflow: provision one Droplet, install and configure your tooling (GoPhish, Havoc C2, evilginx2, nginx redirector config, WireGuard), take a snapshot, delete the source Droplet. On engagement day, campaign deploy --snapshot <slug> restores that exact state across N nodes in parallel. No reinstalling, no drift between nodes.

VPC

A VPC (Virtual Private Cloud) is an isolated Layer-2 private network scoped to a region. Every Droplet inside gets a private IP in addition to its public one. Traffic between VPC members stays on the DO fabric - it never leaves the datacenter.

What VPC is and is not. VPC gives you private network reachability between Droplets in the same region. It is not the channel you use to proxy C2 traffic - that is handled at the application layer (SSH tunnel, WireGuard, socat, nginx). VPC is the network isolation layer: your C2 node has no public firewall rule for the C2 port, so the only path to it is via the private IP, which only nodes inside the same VPC can reach.

Redirector-to-C2 connection options

Three common approaches to route traffic from redirector to C2. All are compatible with VPC:

VPC architecture

Commands

Campaign

Deploy and destroy a complete infrastructure campaign with a single command. A campaign groups Droplets, a Firewall, and Reserved IPs under a tag (campaign:<name>). All resources are created in the correct order and torn down atomically.

The campaign abstraction exists because Red Team infra has a lifecycle: spin up fast before the engagement, rotate IPs when they get burned, rebuild a single compromised node without touching the rest, tear everything down cleanly at the end. Doing this with doctl one command at a time is possible but tedious and error-prone under pressure. campaign deploy and campaign destroy are atomic - either the whole stack is up, or you know exactly which slot failed.

Full workflow

Key flags for campaign deploy

Multi-role campaign

Deploy multiple distinct node types in a single command using --role. Each role gets its own Droplets, its own firewall (preset or custom), and optional reserved IPs. All roles share the campaign tag for unified status / destroy.

Rebuild a burned node

When a single node is compromised, rebuild it without touching the rest of the campaign. The reserved IP stays assigned.

Templates

Built-in cloud-init bash scripts embedded directly in the binary. Each script installs and configures a specific tool (C2, redirector, VPN, phishing) and is ready to run at Droplet first boot via DigitalOcean's cloud-init mechanism.

Variable substitution uses Go's text/template ({{.VarName}} syntax). Every variable has a declared default in the script header — unset variables silently fall back to their defaults. Use --template-var KEY=VALUE to override.

Available templates

Commands

Deploy a single node with a template

Full campaign with templates per role

Audit

Scan your account for security misconfigurations and hygiene issues. Exits with code 1 on any CRITICAL or HIGH finding - integrates cleanly into CI/CD pipelines and monitoring scripts.

What it checks

Library Usage

The pkg/ packages are designed to be imported in other Go projects. Each package is stateless and accepts a context.Context on every call.