diff --git a/cloudformation/ec2-deployment/infisical-ec2-deployment.template b/cloudformation/ec2-deployment/infisical-ec2-deployment.template
new file mode 100644
index 000000000..36f0d9dce
--- /dev/null
+++ b/cloudformation/ec2-deployment/infisical-ec2-deployment.template
@@ -0,0 +1,176 @@
+AWSTemplateFormatVersion: 2010-09-09
+Description: >-
+ CloudFormation template to deploy Infisical on a EC2 instance with a
+ DocumentDB instance
+Parameters:
+ KeyPairName:
+ Description: The name of the EC2 Key Pair to enable SSH access to the instance
+ Type: "AWS::EC2::KeyPair::KeyName"
+ VpcId:
+ Description: The ID of the VPC in which to launch the instance
+ Type: "AWS::EC2::VPC::Id"
+ DocumentDBUsername:
+ Description: The username for the DocumentDB instance
+ Type: String
+ MinLength: 5
+ DocumentDBPassword:
+ Description: The password for the DocumentDB instance (minimum 8 characters)
+ Type: String
+ MinLength: 8
+ NoEcho: true
+Resources:
+ DocumentDBCluster:
+ Type: "AWS::DocDB::DBCluster"
+ Properties:
+ EngineVersion: 4.0.0
+ StorageEncrypted: true
+ MasterUsername: !Ref DocumentDBUsername
+ MasterUserPassword: !Ref DocumentDBPassword
+ VpcSecurityGroupIds:
+ - !Ref DocumentDBClusterSecurityGroup
+ DBClusterParameterGroupName: !Ref DBClusterParameterGroup
+ Metadata:
+ "AWS::CloudFormation::Designer":
+ id: 73b974cf-eed3-4f7d-8657-6a6746bac169
+ DependsOn:
+ - DBClusterParameterGroup
+ DBClusterParameterGroup:
+ Type: "AWS::DocDB::DBClusterParameterGroup"
+ Properties:
+ Description: "description"
+ Family: "docdb4.0"
+ Parameters:
+ tls: "disabled"
+ ttl_monitor: "disabled"
+ Tags:
+ - Key: "String"
+ Value: "String"
+ DocumentDBInstance:
+ Type: "AWS::DocDB::DBInstance"
+ Properties:
+ DBInstanceClass: db.t4g.medium
+ DBClusterIdentifier: !Ref DocumentDBCluster
+ Metadata:
+ "AWS::CloudFormation::Designer":
+ id: f04cee38-175e-4432-9ad7-62ca28bbf935
+ DocumentDBClusterSecurityGroup:
+ Type: AWS::EC2::SecurityGroup
+ Properties:
+ GroupDescription: Allow inbound traffic for DocumentDB cluster
+ VpcId: !Ref VpcId
+ SecurityGroupIngress:
+ - IpProtocol: tcp
+ FromPort: 27017
+ ToPort: 27017
+ SourceSecurityGroupId: !Ref InstanceSecurityGroup
+ EC2Instance:
+ Type: "AWS::EC2::Instance"
+ Properties:
+ ImageId: ami-0557a15b87f6559cf
+ InstanceType: t2.medium
+ KeyName: !Ref KeyPairName
+ UserData:
+ Fn::Base64: !Sub |
+ #!/bin/bash
+ cd /home/ubuntu
+ curl -fsSL https://get.docker.com -o get-docker.sh
+ sh get-docker.sh
+ sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+ sudo chmod +x /usr/local/bin/docker-compose
+ git clone https://github.com/Infisical/infisical.git
+ cd infisical
+
+ DOCUMENT_DB_CONNECTION_URL="mongodb://${DocumentDBUsername}:${DocumentDBPassword}@${DocumentDBCluster.Endpoint}:${DocumentDBCluster.Port}/infisical?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
+
+ ENCRYPTION_KEY=$(openssl rand -hex 16)
+ JWT_SIGNUP_SECRET=$(openssl rand -hex 16)
+ JWT_REFRESH_SECRET=$(openssl rand -hex 16)
+ JWT_AUTH_SECRET=$(openssl rand -hex 16)
+ JWT_SERVICE_SECRET=$(openssl rand -hex 16)
+
+ touch .env
+
+ echo "ENCRYPTION_KEY=${!ENCRYPTION_KEY}" >> .env
+ echo "JWT_SIGNUP_SECRET=${!JWT_SIGNUP_SECRET}" >> .env
+ echo "JWT_REFRESH_SECRET=${!JWT_REFRESH_SECRET}" >> .env
+ echo "JWT_AUTH_SECRET=${!JWT_AUTH_SECRET}" >> .env
+ echo "JWT_SERVICE_SECRET=${!JWT_SERVICE_SECRET}" >> .env
+ echo "MONGO_URL=${!DOCUMENT_DB_CONNECTION_URL}" >> .env
+
+ docker-compose up -d
+
+ SecurityGroupIds:
+ - !Ref InstanceSecurityGroup
+ Tags:
+ - Key: Name
+ Value: infisical
+ Metadata:
+ "AWS::CloudFormation::Designer":
+ id: 2c0a771c-5002-4785-9848-0377e33cd0e9
+ DependsOn:
+ - DocumentDBInstance
+
+ InstanceSecurityGroup:
+ Type: "AWS::EC2::SecurityGroup"
+ Properties:
+ GroupDescription: Allow SSH and HTTP traffic
+ SecurityGroupIngress:
+ - IpProtocol: tcp
+ FromPort: 22
+ ToPort: 22
+ CidrIp: 0.0.0.0/0
+ - IpProtocol: tcp
+ FromPort: 80
+ ToPort: 80
+ CidrIp: 0.0.0.0/0
+ VpcId: !Ref VpcId
+ Metadata:
+ "AWS::CloudFormation::Designer":
+ id: 1fd6856a-11e5-4369-84fa-d18d4011b3de
+
+Outputs:
+ InstanceIP:
+ Value: !GetAtt EC2Instance.PublicIp
+Metadata:
+ "AWS::CloudFormation::Designer":
+ 1fd6856a-11e5-4369-84fa-d18d4011b3de:
+ size:
+ width: 60
+ height: 60
+ position:
+ x: 60
+ "y": 90
+ z: 1
+ embeds: []
+ 2c0a771c-5002-4785-9848-0377e33cd0e9:
+ size:
+ width: 60
+ height: 60
+ position:
+ x: 180
+ "y": 90
+ z: 1
+ embeds: []
+ isassociatedwith:
+ - 1fd6856a-11e5-4369-84fa-d18d4011b3de
+ dependson:
+ - 2cabaada-fbdb-4945-bf95-a0406704dd5a
+ - f04cee38-175e-4432-9ad7-62ca28bbf935
+ 73b974cf-eed3-4f7d-8657-6a6746bac169:
+ size:
+ width: 60
+ height: 60
+ position:
+ x: 390
+ "y": 210
+ z: 1
+ embeds: []
+ f04cee38-175e-4432-9ad7-62ca28bbf935:
+ size:
+ width: 60
+ height: 60
+ position:
+ x: 270
+ "y": 90
+ z: 1
+ embeds: []
\ No newline at end of file
diff --git a/docs/images/deploy-aws-button.png b/docs/images/deploy-aws-button.png
new file mode 100644
index 000000000..fd819989b
Binary files /dev/null and b/docs/images/deploy-aws-button.png differ
diff --git a/docs/mint.json b/docs/mint.json
index e257ea0c5..48dc1805c 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -44,11 +44,6 @@
"icon": "shield-halved",
"url": "security"
},
- {
- "name": "Self-hosting",
- "icon": "server",
- "url": "self-hosting"
- },
{
"name": "SDKs",
"icon": "puzzle-piece",
@@ -101,6 +96,14 @@
"getting-started/dashboard/token"
]
},
+ {
+ "group": "Self-hosting",
+ "pages": [
+ "self-hosting/overview",
+ "self-hosting/configuration/envars",
+ "self-hosting/configuration/email"
+ ]
+ },
{
"group": "Command line",
"pages": [
@@ -171,12 +174,6 @@
"integrations/platforms/pm2"
]
},
- {
- "group": "Self-hosting",
- "pages": [
- "self-hosting/overview"
- ]
- },
{
"group": "Deployment options",
"pages": [
@@ -184,13 +181,6 @@
"self-hosting/deployments/kubernetes"
]
},
- {
- "group": "Configuration",
- "pages": [
- "self-hosting/configuration/envars",
- "self-hosting/configuration/email"
- ]
- },
{
"group": "Overview",
"pages": [
diff --git a/docs/self-hosting/configuration/email.mdx b/docs/self-hosting/configuration/email.mdx
index b35666776..a6b13fa0b 100644
--- a/docs/self-hosting/configuration/email.mdx
+++ b/docs/self-hosting/configuration/email.mdx
@@ -1,5 +1,5 @@
---
-title: "Email"
+title: "Configure email service"
description: "How to configure your email when self-hosting Infisical."
---
diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx
index f674c1bcd..6786eef08 100644
--- a/docs/self-hosting/configuration/envars.mdx
+++ b/docs/self-hosting/configuration/envars.mdx
@@ -1,43 +1,151 @@
---
-title: "Environment Variables"
-description: "How to configure your environment variables when self-hosting Infisical."
+title: "All environment variables"
+description: "Configure your environment variables when self-hosting Infisical."
---
-Configuring Infisical requires setting some environment variables. There is a file called [`.env.example`](https://github.com/Infisical/infisical/blob/main/.env.example) at the root directory of our main repo that you can use to create a `.env` file before you start the server.
+## Backend environment variables
-| Variable | Description | Default Value |
-| ----------------------- | ----------------------------------------------------------------------------------------------------------- | ------------- |
-| `ENCRYPTION_KEY` | ❗️ Strong hex encryption key | `None` |
-| `JWT_SIGNUP_SECRET` | ❗️ JWT token secret | `None` |
-| `JWT_REFRESH_SECRET` | ❗️ JWT token secret | `None` |
-| `JWT_AUTH_SECRET` | ❗️ JWT token secret | `None` |
-| `JWT_MFA_SECRET` | ❗️ JWT token secret | `None` |
-| `JWT_SERVICE_SECRET` | ❗️ JWT token secret | `None` |
-| `JWT_SIGNUP_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `15m` |
-| `JWT_REFRESH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `90d` |
-| `JWT_AUTH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `10d` |
-| `JWT_MFA_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `5m` |
-| `MONGO_URL` | ❗️ MongoDB instance connection string either to container instance or MongoDB Cloud | `None` |
-| `MONGO_USERNAME` | MongoDB username if using container | `None` |
-| `MONGO_PASSWORD` | MongoDB password if using container | `None` |
-| `SITE_URL` | ❗️ Site URL - should be an absolute URL including the protocol (e.g. `https://app.infisical.com`) | `None` |
-| `SMTP_HOST` | ❗️ Hostname to connect to for establishing SMTP connections | `None` |
-| `SMTP_USERNAME` | ❗️ Credential to connect to host (e.g. `team@infisical.com`) | `None` |
-| `SMTP_PASSWORD` | ❗️ Credential to connect to host | `None` |
-| `SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` |
-| `SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` |
-| `SMTP_FROM_ADDRESS` | ❗️ Email address to be used for sending emails (e.g. `team@infisical.com`) | `None` |
-| `SMTP_FROM_NAME` | Name label to be used in From field (e.g. `Team`) | `Infisical` |
-| `TELEMETRY_ENABLED` | `true` or `false`. [More](../overview). | `true` |
-| `LICENSE_KEY` | License key if using Infisical Enterprise Edition | `true` |
-| `CLIENT_ID_HEROKU` | OAuth2 client ID for Heroku integration | `None` |
-| `CLIENT_ID_VERCEL` | OAuth2 client ID for Vercel integration | `None` |
-| `CLIENT_ID_NETLIFY` | OAuth2 client ID for Netlify integration | `None` |
-| `CLIENT_ID_GITHUB` | OAuth2 client ID for GitHub integration | `None` |
-| `CLIENT_SECRET_HEROKU` | OAuth2 client secret for Heroku integration | `None` |
-| `CLIENT_SECRET_VERCEL` | OAuth2 client secret for Vercel integration | `None` |
-| `CLIENT_SECRET_NETLIFY` | OAuth2 client secret for Netlify integration | `None` |
-| `CLIENT_SECRET_GITHUB` | OAuth2 client secret for GitHub integration | `None` |
-| `CLIENT_SLUG_VERCEL` | OAuth2 slug for Netlify integration | `None` |
-| `SENTRY_DSN` | DSN for error-monitoring with Sentry | `None` |
-| `INVITE_ONLY_SIGNUP` | If true, users can only sign up if they are invited | `false` |
+Depending on your choosen self hosted deployment method, you may need to configured at least the required environment variable listed below.
+Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case.
+
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ Must be a random 32 character length hex string
+
+
+
+ *TLS based connection string is not yet supported
+
+
+
+ When email service is not configured, Infisical will have limited functionality
+
+
+ Hostname to connect to for establishing SMTP connections
+
+
+
+ Credential to connect to host (e.g. team@infisical.com)
+
+
+
+ Credential to connect to host
+
+
+
+ Port to connect to for establishing SMTP connections
+
+
+
+ If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
+
+
+
+ Email address to be used for sending emails
+
+
+
+ Name label to be used in From field (e.g. Team)
+
+
+
+ To sync secret to third party services, provide value for the related services
+
+
+ OAuth2 client ID for Heroku integration
+
+
+
+ OAuth2 client secret for Heroku integration
+
+
+
+ OAuth2 client ID for Vercel integration
+
+
+
+ OAuth2 client secret for Vercel integration
+
+
+
+ OAuth2 client ID for Netlify integration
+
+
+
+ OAuth2 client secret for Netlify integration
+
+
+
+ OAuth2 client ID for GitHub integration
+
+
+
+ OAuth2 client secret for GitHub integration
+
+
+
+ OAuth2 slug for Netlify integration
+
+
+
+ #### JWT
+
+ JWT token lifetime expressed in seconds or a string describing a time span
+
+
+
+ JWT token lifetime expressed in seconds or a string describing a time span
+
+
+
+ JWT token lifetime expressed in seconds or a string describing a time span
+
+
+
+ JWT token lifetime expressed in seconds or a string describing a time span
+
+
+
+
+
+
+ #### Error logging
+ Infisical uses Sentry to report error logs
+
+
+ #### Settings
+
+ Only allow users who are invited to sign up
+
+
+
+ Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+
+
+
+
+
+
+## Frontend environment variables
+
diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx
index 7f3bc30bf..85d533b42 100644
--- a/docs/self-hosting/overview.mdx
+++ b/docs/self-hosting/overview.mdx
@@ -1,36 +1,198 @@
---
-title: "Overview"
-description: "Infisical is an open-source end-to-end encrypted secrets manager that developers can set up within 15 minutes."
+title: "Deployment options"
+description: "Explore deployment options for self hosting Infisical"
---
-
-Self-host vs. Infisical Cloud
+To meet various compliance requirements, may want to self-host Infisical instead of using [Infisical Cloud](https://app.infisical.com/).
+Self-hosted Infisical allows you to maintain your sensitive information within your own infrastructure and network, ensuring complete control over your data.
-Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
+
+
+
+ This deployment option will use AWS Cloudformation to auto deploy an instance of Infisical on a single EC2 via Docker Compose.
-If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
+ **Resources that will be provisioned**
+ - 1 EC2 instance
+ - 1 DocumentDB cluster
+ - 1 DocumentDB instance
+ - Security groups
-Infisical Cloud also comes with some extra features unavailable in the self-hosted edition. You can find more information about Infisical Cloud's offering on the pricing page.
+
+
+
-
+
+
+ This deployment option is highly available
+ Coming soon
+
+
+ This deployment option is highly available
+
+ **Prerequisites**
+ - You have understanding of [Kubernetes](https://kubernetes.io/)
+ - You have understanding of [Helm package manager](https://helm.sh/)
+ - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
-## Deployment options
-Infisical can be deployed on a Linux VM with docker-compose and Kubernetes. We're rolling out more specific deployment options for DigitalOcean, AWS, GCP, and Azure soon.
+ #### 1. Fill our environment variables
-
-
- Deploy to any Linux with Docker
-
-
- Deploy to your Kubernetes cluster
-
-
+ Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file.
+ Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more
-## Telemetry
+
+ [View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical)
+ ```yaml
+ frontend:
+ enabled: true
+ name: frontend
+ podAnnotations: {}
+ deploymentAnnotations: {}
+ replicaCount: 2
+ image:
+ repository: infisical/frontend
+ tag: "latest"
+ pullPolicy: IfNotPresent
+ kubeSecretRef: ""
+ service:
+ annotations: {}
+ type: ClusterIP
+ nodePort: ""
-Infisical collects telemetry data about general usage.
+ frontendEnvironmentVariables:
+ SITE_URL: infisical.local
-The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software.
+ backend:
+ enabled: true
+ name: backend
+ podAnnotations: {}
+ deploymentAnnotations: {}
+ replicaCount: 2
+ image:
+ repository: infisical/backend
+ tag: "latest"
+ pullPolicy: IfNotPresent
+ kubeSecretRef: ""
+ service:
+ annotations: {}
+ type: ClusterIP
+ nodePort: ""
-To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the [environment variables](./configuration/envars).
+ backendEnvironmentVariables:
+ ENCRYPTION_KEY: MUST_REPLACE
+ JWT_SIGNUP_SECRET: MUST_REPLACE
+ JWT_REFRESH_SECRET: MUST_REPLACE
+ JWT_AUTH_SECRET: MUST_REPLACE
+ JWT_SERVICE_SECRET: MUST_REPLACE
+ SMTP_HOST: MUST_REPLACE
+ SMTP_PORT: 587
+ SMTP_SECURE: false
+ SMTP_FROM_NAME: Infisical
+ SMTP_FROM_ADDRESS: MUST_REPLACE
+ SMTP_USERNAME: MUST_REPLACE
+ SMTP_PASSWORD: MUST_REPLACE
+ SITE_URL: infisical.local
+
+ ## Mongo DB persistence
+ mongodb:
+ enabled: true
+
+ ## By default the backend will be connected to a Mongo instance within the cluster
+ ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
+ ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
+ ## e.g. "mongodb://:@:/"
+ mongodbConnection:
+ externalMongoDBConnectionString: ""
+
+ ingress:
+ enabled: true
+ annotations:
+ kubernetes.io/ingress.class: "nginx"
+ # cert-manager.io/issuer: letsencrypt-nginx
+ hostName: infisical.local ## <- Replace with your own domain
+ frontend:
+ path: /
+ pathType: Prefix
+ backend:
+ path: /api
+ pathType: Prefix
+ tls: []
+ # - secretName: letsencrypt-nginx
+ # hosts:
+ # - infisical.local
+
+ mailhog:
+ enabled: false
+ ```
+
+
+ Once you have a local copy of the values file, fill our the required environment variables and save the file.
+
+
+ #### 2. Install Infisical Helm repository
+
+ ```bash
+ helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
+
+ helm repo update
+ ```
+
+ #### 3. Install the Helm chart
+
+ By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
+ that by adding the `--namespace ` to your `helm install` command.
+
+ ```bash
+ ## Installs to default namespace
+ helm install infisical-helm-charts/infisical --generate-name --values
+ ```
+
+
+ If you have not filled out all of the required environment variables, you will see an error message prompting you to
+ do so.
+
+
+ #### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`.
+
+
+
+ 1. Install Docker on your VM
+
+ ```bash
+ # Example in ubuntu
+ apt-get update
+ apt-get upgrade
+ apt install docker-compose
+ ```
+
+ 2. Download the required files
+
+ ```bash
+ # Download env file template
+ wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
+
+ # Download docker compose template
+ wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
+
+ # Download nginx config
+ mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
+ ```
+
+ 3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](../../self-hosting/configuration/envars)
+
+ ```bash
+ # update environment variables like mongo login
+ nano .env
+ ```
+
+ 4. Get the service up and running.
+
+ ```bash
+ # Start up services in detached mode
+ docker-compose -f docker-compose.yml up -d
+ ```
+
+ 5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures.
+
+
+
\ No newline at end of file
+
-