From 0b2e6a0d77ce931f0fca61dfb2093104281aa43a Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 18 Mar 2023 20:56:40 -0700 Subject: [PATCH] Update self hosting docs --- .../infisical-ec2-deployment.template | 176 +++++++++++++++ docs/images/deploy-aws-button.png | Bin 0 -> 20885 bytes docs/mint.json | 26 +-- docs/self-hosting/configuration/email.mdx | 2 +- docs/self-hosting/configuration/envars.mdx | 186 ++++++++++++---- docs/self-hosting/overview.mdx | 206 ++++++++++++++++-- 6 files changed, 516 insertions(+), 80 deletions(-) create mode 100644 cloudformation/ec2-deployment/infisical-ec2-deployment.template create mode 100644 docs/images/deploy-aws-button.png diff --git a/cloudformation/ec2-deployment/infisical-ec2-deployment.template b/cloudformation/ec2-deployment/infisical-ec2-deployment.template new file mode 100644 index 000000000..36f0d9dce --- /dev/null +++ b/cloudformation/ec2-deployment/infisical-ec2-deployment.template @@ -0,0 +1,176 @@ +AWSTemplateFormatVersion: 2010-09-09 +Description: >- + CloudFormation template to deploy Infisical on a EC2 instance with a + DocumentDB instance +Parameters: + KeyPairName: + Description: The name of the EC2 Key Pair to enable SSH access to the instance + Type: "AWS::EC2::KeyPair::KeyName" + VpcId: + Description: The ID of the VPC in which to launch the instance + Type: "AWS::EC2::VPC::Id" + DocumentDBUsername: + Description: The username for the DocumentDB instance + Type: String + MinLength: 5 + DocumentDBPassword: + Description: The password for the DocumentDB instance (minimum 8 characters) + Type: String + MinLength: 8 + NoEcho: true +Resources: + DocumentDBCluster: + Type: "AWS::DocDB::DBCluster" + Properties: + EngineVersion: 4.0.0 + StorageEncrypted: true + MasterUsername: !Ref DocumentDBUsername + MasterUserPassword: !Ref DocumentDBPassword + VpcSecurityGroupIds: + - !Ref DocumentDBClusterSecurityGroup + DBClusterParameterGroupName: !Ref DBClusterParameterGroup + Metadata: + "AWS::CloudFormation::Designer": + id: 73b974cf-eed3-4f7d-8657-6a6746bac169 + DependsOn: + - DBClusterParameterGroup + DBClusterParameterGroup: + Type: "AWS::DocDB::DBClusterParameterGroup" + Properties: + Description: "description" + Family: "docdb4.0" + Parameters: + tls: "disabled" + ttl_monitor: "disabled" + Tags: + - Key: "String" + Value: "String" + DocumentDBInstance: + Type: "AWS::DocDB::DBInstance" + Properties: + DBInstanceClass: db.t4g.medium + DBClusterIdentifier: !Ref DocumentDBCluster + Metadata: + "AWS::CloudFormation::Designer": + id: f04cee38-175e-4432-9ad7-62ca28bbf935 + DocumentDBClusterSecurityGroup: + Type: AWS::EC2::SecurityGroup + Properties: + GroupDescription: Allow inbound traffic for DocumentDB cluster + VpcId: !Ref VpcId + SecurityGroupIngress: + - IpProtocol: tcp + FromPort: 27017 + ToPort: 27017 + SourceSecurityGroupId: !Ref InstanceSecurityGroup + EC2Instance: + Type: "AWS::EC2::Instance" + Properties: + ImageId: ami-0557a15b87f6559cf + InstanceType: t2.medium + KeyName: !Ref KeyPairName + UserData: + Fn::Base64: !Sub | + #!/bin/bash + cd /home/ubuntu + curl -fsSL https://get.docker.com -o get-docker.sh + sh get-docker.sh + sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose + sudo chmod +x /usr/local/bin/docker-compose + git clone https://github.com/Infisical/infisical.git + cd infisical + + DOCUMENT_DB_CONNECTION_URL="mongodb://${DocumentDBUsername}:${DocumentDBPassword}@${DocumentDBCluster.Endpoint}:${DocumentDBCluster.Port}/infisical?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false" + + ENCRYPTION_KEY=$(openssl rand -hex 16) + JWT_SIGNUP_SECRET=$(openssl rand -hex 16) + JWT_REFRESH_SECRET=$(openssl rand -hex 16) + JWT_AUTH_SECRET=$(openssl rand -hex 16) + JWT_SERVICE_SECRET=$(openssl rand -hex 16) + + touch .env + + echo "ENCRYPTION_KEY=${!ENCRYPTION_KEY}" >> .env + echo "JWT_SIGNUP_SECRET=${!JWT_SIGNUP_SECRET}" >> .env + echo "JWT_REFRESH_SECRET=${!JWT_REFRESH_SECRET}" >> .env + echo "JWT_AUTH_SECRET=${!JWT_AUTH_SECRET}" >> .env + echo "JWT_SERVICE_SECRET=${!JWT_SERVICE_SECRET}" >> .env + echo "MONGO_URL=${!DOCUMENT_DB_CONNECTION_URL}" >> .env + + docker-compose up -d + + SecurityGroupIds: + - !Ref InstanceSecurityGroup + Tags: + - Key: Name + Value: infisical + Metadata: + "AWS::CloudFormation::Designer": + id: 2c0a771c-5002-4785-9848-0377e33cd0e9 + DependsOn: + - DocumentDBInstance + + InstanceSecurityGroup: + Type: "AWS::EC2::SecurityGroup" + Properties: + GroupDescription: Allow SSH and HTTP traffic + SecurityGroupIngress: + - IpProtocol: tcp + FromPort: 22 + ToPort: 22 + CidrIp: 0.0.0.0/0 + - IpProtocol: tcp + FromPort: 80 + ToPort: 80 + CidrIp: 0.0.0.0/0 + VpcId: !Ref VpcId + Metadata: + "AWS::CloudFormation::Designer": + id: 1fd6856a-11e5-4369-84fa-d18d4011b3de + +Outputs: + InstanceIP: + Value: !GetAtt EC2Instance.PublicIp +Metadata: + "AWS::CloudFormation::Designer": + 1fd6856a-11e5-4369-84fa-d18d4011b3de: + size: + width: 60 + height: 60 + position: + x: 60 + "y": 90 + z: 1 + embeds: [] + 2c0a771c-5002-4785-9848-0377e33cd0e9: + size: + width: 60 + height: 60 + position: + x: 180 + "y": 90 + z: 1 + embeds: [] + isassociatedwith: + - 1fd6856a-11e5-4369-84fa-d18d4011b3de + dependson: + - 2cabaada-fbdb-4945-bf95-a0406704dd5a + - f04cee38-175e-4432-9ad7-62ca28bbf935 + 73b974cf-eed3-4f7d-8657-6a6746bac169: + size: + width: 60 + height: 60 + position: + x: 390 + "y": 210 + z: 1 + embeds: [] + f04cee38-175e-4432-9ad7-62ca28bbf935: + size: + width: 60 + height: 60 + position: + x: 270 + "y": 90 + z: 1 + embeds: [] \ No newline at end of file diff --git a/docs/images/deploy-aws-button.png b/docs/images/deploy-aws-button.png new file mode 100644 index 0000000000000000000000000000000000000000..fd819989bca79eb6aa2f8eb9e98234c1f5b8300b GIT binary patch literal 20885 zcmeFXWkX!c5-5sG2u`rz?(R-Vbm-~YRz<*f}8~62iy-}U|@(+lA=mrU=X38_Bb32=(A(~dJ7EfL!E_) zh=P=e2$6!LovDSj2^g4USYk4)3i=_Y|9h$wO%{obL}TE^Y@$GH_e>IL~yOc-;5hAAhw= zWqr@!1yiW!B2lC${~(m4KokA(reKhgZ2IyQ44lRvECVd6H!(B?74;WbqSUL~qdS(6 z(NofxM!8?-yS`Y|V6r{9KZ%0eo>a3Y6`{yHY^5X}G+2q)=|Dt&F7uhFrbr}aXsvgo zGUY=rHf0QJFw+@2{?HdqEHH@FUeqE8p+=$88y#C3+z`C)wVAP$D7hISwd!hW9LT$B z3G@ntsKZ8=I75D6@lQ=DL*XfSa;1Tko;X;6*+L}4J3H^$G24F9YK7J;AvmqSEw*wb zRq|Yf?^$a_Fz95E5VDQI?NPRcQAy(v{5C7qqB?w zeS(%h`xoQFb*K$7oqlp}m9*DJV*lWeno#Rwl#GZ@-_a4aULccZ$^BC3t?{8v1GA(! zoAKjK=J4m71AghNWM63Oemx5<=h$4gag|qZVkeqHGCjr5G3Wb&yXbirSW-TpT0~P( zKlu5Y=JYTOMJb&m<}&WgtikoO%Irf)$gqS$C=o&O5rHlGBfTilgOkLcB^)>hx&H1BG-<2Zn3?OnyZ^xTTu$xb^UN~a1chV zeSrvuLA>+d8IkpGjGmwZv=Q)f_5b*|x8ps?$W<4KM;6u8mF1)!ujRzoXkhtUPfX{cq zZkRscc_RWKM>f?jP#{pqzXxNJaKJ$t5N}G7{0t0@E0Ba&ik=}tl>9s$u<~W+x77|S zOvo?81MJU{uoQ6UL7Rq-Ow!C&%!w&lGOT+Ldzgi=tf7z51>an1<}}>sK7Wpp?Puu0 zG#aV#s*zoYSm0d{IFZ0ZlITs{)^QMShSK4&Wwxcag{?$&!<>&g?nm6bbhl||UqdI1 z-rp#AFnr;70e``Hk@Y5gLl+MFCS*?pg@OkErRVDxZUezhwoQs(*-T$l$kWhP!!|_; zn6sO+nnM=E+vQG3qhn_z_sHax*r+q>1671AiFC>MDLT}ZlvtD;mDBRb6tpT;emP4X z)+)tJo7M6xhL4g=kdFL5{{8&hYzX=HIW@ZbVy8cN^j2k7^)rj~@&Vef?VgOEe&H%>sxY{GazVZ&X^@93GN|mHlbolT z>_a-!J)gX&nx1U=NfT`jvpDFIF6So#>4BvaMYev$-HXBS?~5 zkLR0B(;i?Q1O>MS3kS3G>IUlulZx+&GmFzk;YMX)$4BA}P!FU>El0u1ev~my$4Hw= z=VK#JW03*MG^M$wAf>0K_or5HSTTDURGN%)Ffvtf`dJItTr~c!DXwX@39B>KFx5D# zZa09|=GHFIRMpgN3a-#Cho0jtZ!`O5);xwXUYzPM5p3OCKh#jtbXZfc7`#+jZ&TyL z3N$v|8jWJ*HT7+BY8*wU)g4)K`{INN$nWDwktz&TVn<]qza1s`qMAOQ!Sl$=Mcz zi{REH3!Aw6WDy zC%ljon-e8`zu;-j&=$>)eS+Ig_V5Lcn~Wx(Wk<7EwV12khJ%mS{jP8^rdOu-y8-QHzJ+ihlA_`KMv{{TchjNA7`?u7{j z?UJ`Ls|h@@dzorkcUoO&Dj(JgVGGoYkj=iEos3|QMUGgHk{FYl;A52{uzts?y{)^h zZ4;ZzHH_mM`aM3;1ojYIgUnW|ycgwpUSYm0Y4Xj<0t>a|3E3{)+d@&g5p;sTy z94>46*$DC`v|nhono_Not52;=w01LT)=LLYTbJjp3D>%p9h{0L#)B<8j;4N+Sn|)QT`7Q{n@>$aW;36$hq*jS2@FITh2trv2J`+3QZK z$MmrJVs(GHv3+VoU?WRuEq}sm;a+=`uvc@a zcH9OpM>U>lt`^yOuJgH#oX-_3pDfRxeP2BUe0I8j>+rbWx%ar&=lkt_ac6MW8z(VB zXhfLIr|6^frgCpFW|!2-KCHV_u&Il6VopG_3+wk|J%#Ab?wXLDL1QitIqZN?n9Ahg}zB( zj3%K(u(W`MU+L@U!^$Q3ne_Yb+^UDFPwRA@4L-<^Z|-bX&MJMVP6HC)P`dVCKY*Rz zfeT52`G=3A)+0p6d)lAgaHyV~xIB#HxsXpy*?m{K7i7ndID&dBd51nIL3G#o^;HFw z#fF<`NSVsYg3*B5a9~j2xM0wr7C5K~fPenGEe=iv2KiS%1Q=L|1sK$SapXYtpDPwr z{?PoVhWr@}1`B#Z0~Plii2q?jgyum0uMIX18Uqtn7Lk$y)yhVWCMLE{=623l^E=X@ z4tRS>O(!rgO!7YkTuO=T0>ppLLPf(_Lso{z$j*krz}U{vgu&g${tq88K6f5a)5gTv zfXLm(+SZB3ouA|{3?5MXPd6h8(O)ReR{SIyvI;~Zc8(@Q91KhhOe6vyh=_>z9F0wR zltjh5I~!* z4eZY{@crMTOBk@>VqrGPh0x&0h|j?{<6^NSui(f6pp>MD^Ft&Ypn)>XWBw&DkR0D& z(UkL*ljWul*WLx&>P}57f74K|+6fR^*bR@5d%Kz5b-t&*TT{u(bp?RI`Tu?U%Mw9> zquPK&34#6Z?ve(B$W4av4f-1i3=R%1)EtTk4C3!w00ITYhid~I90lxux4(ZV$G%<@XbBhx&&=NG^Lp5niD`AV^i<;D6?-nTYb~mIQB6>${~ZiiwM| z7#D}`_hVNa0*Aa%M;uOwt#8X#hTpD9Np9bim56S_14=z;DleYTnq!>J7wJ*Pd$bd-jMZO^wByfe`eJVw*utLotEAyNp*F z8#!V$^&zw*2}|rfxbthb!gq5jd1drIRJ=)~Nn|FZZ+Kl?{tn;pA|Xv`aB>ZgibOTN zF`@c4NhX`lOsASG;MKTL6>d#~^Ypf%88&i(P`SD}AlP_Rq}vvH+=0%ueDdfeCyCM$ z5GxQi-j3f{`rQBR875R51+fJ2Tj(H)KAi~PaKKyWCEWJZ9RsmZ5~R2+LNhrQ%?I!} zL`6^icFZS|1KD4kKh`j|!3Mx1A+cd8ZnzZKkCkd&8GIp=n6Xeaofg{mERT=~ipc!r zW6vqK=n(^u!v`S+HhOU};zgc?K)`g1q<(GsHQ+7ijrHRzW$k*Cs7IU?+MtTi4tofH z8Dkz|rPt+vWKbNgn|=KNp*%<2LR6ThkFhGRFZ`?*A}Mb!b!D;ifZ=-~)bNi!KjJxcVs^bi_ z=-PDQ{v#m%H;ZGDYVZO(Uok5TdgZ;-2vK)voQpqf1UThpBLsY^Q(NP}D zsC8p}`YW4Ba=E(fq7pU?P(i};+Mq0QG)MjerJT)Zi64aDQzT#W_F}U!$L3YVWra?b z>vhQH-@Y`MOY~Pl%tTiM&&Nwcgng7n{ED@4d+TSk$;jf-Q9fE~Oh{-esYbq)mVKUyV<6(+*VB(n_f zQ!tr<>WlW0$2wH0LJ*N7|HUsu)R{jSREVscb zgsXTBm}fmtR*T_7Pe=BZZHPal>gy8ojgDVyZtK^ng^a-_#fqCDM(k#I)!J-Sj z3%yTD;b9Xp2}Dj@{$gVfE$!Tb`@hzovjf%FXp%2nuYWTu&^1iRN0M~|-il>-5g(5B zpQU;hVq+8?5dMMfHout(-85phXt6G;N?{e{(bBZ95P|C?U<7mM$RP6zfX@-k5v+zP z$6JD25;?37nVumk1w{W_D?%^*eAr^lFgEy zBYG~)8svHO(xYAd|A4Oo$u<~U=pvMP-#^)n&=4w>Frwk{v`0SCM-L3}daBR97dhj0 z)G(6-lOVA*e?Yr|1wn|?DKg@<^jLUmQA(n+GW3NuR99~rk1%LQe1kYZK0v0!p$fV4 zzf&+g{k2n=q8Vf!^-?-t<_7ry3O)gM-SS^{K@35lVrP%FUV?Iid=nG4DA=r4P$8`1 zgD3It{3k?c2tKqzS|iAuci-sOu)KsXu?o^yF#e{&`2I%fqBa|Cg2jOgEIHqo6fyTjdpRz8LWZBlzBZtpkM&G6?&kmH#-%uVsP>88C6sq67zY z64@xZn2fLj9_zY-TdDpdy+6}+1Rwm7mqL~aCk30?oB5aozIk^&Y}|!h@(3gp!c5_I zToC?aFG4~hIhXlp+Cjx^q2)BlaYvI=L_Np^<{%|nii2;1gIo+OHu6_*K7SZRQg+f} zIQZ`)Vw$&&9$41ZRl50yRVun%(_~+E74>g{hr-MYw~YGOeCXeWsOW|*8|T$1vH>Wi z#i*O51CiIjpjX4{=Z;8weW7Ro_rfbc68Y{?4&Jk8rb#40esY&D`AE0r)gYG-5CSK* zr4o{YviX5n>6K)*M)4zCC*6~vyRGP8Ad>^KB6lzlkwROnwX?38PAaEjiPKRm^y)s5YNTERM#Ui5w;#e(HVAa_V}Rp3T%X9Zf#vV&F02KsfcW%ckue z&vU~ri|KY{I$X3c%aWf@TW@i?eBkEgcfEY*!Oeu_NGydxo=d-3y#r14-Nt!%c*VV{ z-n}H_r!aB^oz6XV5Oc%ir$tpqDKsU zCke?(lZ(rF_<7*H_e|#Rx|`Vf72|_?_(7IFN+K_wZHG5Z6+0Kvg9%y7rd;u(Vgkcr8}y@9i=WksayX?tHbeJw4$=E_|Nw@I7QupO<($y)UIx z#$EWHvJL&&L@5|tLUbi?+i_ZzO;Rvi)qYkRZD`l53g_N+(KhV630%@ogH>K8w%u)% ziS_5d)*m`S7s7gq-XjQp@;T=-q>CxZXuYsEwn9U(8**6;+*Za<7kwVS_PIsU6I4;9 zv^3KvA2tGh7}t+wn!i3e7dwAyyV^p@bchZGg~q!AWw*=jHPflvoBQI`_9XSULf0_+ zT&n}lJXAeT2ogIdNX|33kLmvA^WN3_K2vWO>JrXJ7Ieg)q5EK^gigr7YeaQZ3W=@m zI#(zsQ|eW=p%pb(F%&_;pbj&+2#c4Xb0sCXNb2+6N_o_|t{<<(nqN`WcGp5XuV``k zF!n@`q~YNgBk$WaeNTARVz})Srs`###CzJ^{ zc?1b5A-+3I&TlEc+z`3MowZB&Vyl~+#&o32WSlV9KjU4|*6QfNi`T9ra>IZ02I4#D zx!}NuSs@6ZQ)0jd{6t65#vCKR5{}bZjr`VpMY{G^x=%Vm**a(@=Db8X`y+Vww-p9D zt)$f#WTp}5{BOAtAeEp~>drHNHIN$b$ zG}Up(2}SI#pV-;_I78rEP`u*WNR$8eyJxNzXx^bwRhTtL9W`V6rQMft0|u=s>`sEA zP@%t#hzZuHwH*_gA0xbANgu(`Kub(t5Nc#sZho|GTrx9f?})$>?q2f!HbE%}^G*&w-B*^8Uku6*uflID>j|`xgm&7q z&GxB09-s{Djyw@cp4lq{w~|j7kR968S_aDdS+%?$Hks&@N3&|L<@LJO9v?U%e^t8G zAMNW+y;~K}?}v2QBIafo-kGC>q;=Bly7P3t6{m}8zA}^^jDs9D5Vs|_iV%mQZy(6^ z%e13JS@>Dv{MawgqF?YSu;Z5XG7i}TjlqS1XIoIz_#Wt@2w*}t0{D7^CkrYwoqFvP zPd%QvDADbX8eThD(G-Bm^i;D=PVXGj&vd~~MBEKl*rlM`yxm7WWQ>NfYaUE`ycD^;re~vN%Ig+H zjjDd>Gb23)447{!ZD3yJX=~-;ivEcI%ucF;^k%qgFh`JY(S3_t{#i1j(1X~eIP#4o zD!1H~Qn6+%V7lt8`fQ>5IAhH(DVJjWHHJ~6{1fg{K8&I)vwX(W5~4rS-rI`(%tRza zu6|Ilmel2S$ZRM+&XwAP4DzRM$v@+Mqh|5F3Tg_S`MeV5 z#(ccWA4n=yS!)g{PIU>OvRatUUf8bF$oNWpb~|j;7V$*tyCt>zW_)Tph_3!s+5su* zD``nxai{@j+-pP>gr-*}vi$jN9N^-PYvpCDpitPF7%{geI&U^(05T*r!*C9}bFyD|J}EaqLtVQtxB4DFU{POr>Z$L!d#H77G<81#%QDW|!0M9a1lqjP zn5G%}Vh|R$S^L~WD})wb{a9pWk$yj;6|nJaCek}-dwhs*2zGX?)+|cONWU=w0>ICXU+F^nMVXRs@Al;=LDL5FwiMbS%#Scgck-$ z5dkv^7ayT49#2aE=VtSD^Wi(Z$h^B1i~D7{mctGJw&~t`$44CJ?)-C}sa1LODV*#P z8F^xQ=W`L~tV$h`&1mo7IX#43HAm%9dbdkl(dJ8WAxjj&ty$j%_8eG|k=#e_vR-ZX z8T>1Lqt-@PfT&$>dgLVyiB27T#XXN?f?WevMS9v7?Y)~&mE&VJ)mIV=;`yBhHynAt z!*Zr)i(zRS{%&nG(V|S^o(A4frc=(O+zJaA0r!AO*IK3L*W4qDYJxxNn|V!*1s1M}ao}QIj4%haz5#qE zFAbmG#^hmx#(Y~iR|bu}Z_BTTra80Xl8%3RTcx6ptDWif!cq2I8%Zy^*WzBubHs+? zzlQ{l@6*dI4cT|?Y#}61#uw3%ww|v_i0uR4j}i7??~ah$=CG2+fQ?rq)P3&28J|e{ zpMpn-KRZ1-0drpC&OOJbe%dMuod`USj`v+yLEQp=vkXpAT62|Hwz*!NE6D&9`9`nF z%jUFHDl!QtE!)mG-CJ#>A@&Hi;9bYrI)JezsTJB+`tu+xF6J8ax8jCKdD~Wb=ZdLL z$v*i#-#(J;br(KY?kF6_2gprYTL|aR+Xx|RoWXUDd5tiNA3`0+zUz87#>V?$5JjHV~)CrlKnpo0UXj4RW%&Zl1AgF3wi<=;Uj#X{Pd*yHh;ol(pZM>J1)uG&&>cNX`5LvW(;SU-%`7LR&KdoT zn_?o4QnM$xlB?o19K$;fG8v`!O%6ME5!=F^NN<70X`?0z%OZ5Y+bzVrt|_}qOslTN zcI6&xAMsCNC61446ByMW>-y(U?p+icfEkgN)xtuhw}?L4W>IZyYEq_iF=swO!lXks zmA3+|ghO4_3u(|`^!+8#5S~}OB>;|9kA2;K(H($*3t2`&1Dm1}l z*V^T3&NCA+MC94zAB~l+u1CaAz6)yVEeUC(5Lz@y<5p+Q+oAisdnRnXoXS(|`N{b{ zJ=lMbRQdR&Rj2iefL<4;@Oj;RYdtbefrBMZ8m>2fG?+sjaH41L8a?E(1FE)sTr8v!QDHc*S?;@_P9DJ$eadw88uxSAN@-O5mu%OO zR1Axw*CkqxaX5AP;on6uh19fed?ciNvw*3_(T2PSG1E<@E91MtaWlVzW5G|_V`wfR zS8D~HgAmpet(}t?hhNdaU~j_2iJa@%Lg{vDFAAJ~+`;=^Zrz6Rxn3kV3g~ATj`4Pq zg$!9{-p9`PSQBaEXk!97xbxigoik9>xB?!A3QC3Rp>3%HM!>@%9%SXEPC}aoZ1xnP zyz^nExcaTFP_CQ(m>a>!Ad_;OFfCxu1R2jNm-_7<3HauBlC_4C{Y0i-z?_$prGm_d zDYf07d$E?ETUs8Sc*jeGoo&l*^U8f|H`qN}5Bsg>-L?)85N(kCqS(|wQz4&8V2Hpf zb8B!JBSuud*GvMNH;`x{_aWwxxydDaVutnI0QXNKb3~0l{i*D<(>`juQgCqE;-rTF zz5=i9G;eP&hE#o(y?5_IaHBZf{U!qXJPqA>SH~s&i9Q81xoOE+ou51{3Lc>3R+XGk zx-Y5kFC}b@?jk2fJV?=1+fxuooD$V+(M`Gc=<@~K$)lm<=X{&*G@KT2rhl!C>HDcH zH6o!U$Nn~HBGZ%q{>9?aqDw$4IM&;Xn|WPwN=Mu>_Nw)$IPf%>r|+SiEwtC(r)6~% zydI#i-KyW3$~Nm3E%}P~=5bN7mR{K9cG)Rv@1QA?s_}Hm%(yPO^8V!^a_~4g1E%It zPAdo-n=wJqU1eK}N#_yuJbL{MGF|*T>c$9ed$F*P^&Wd@mV?0Z?eSrN3bTd&7*jgt zm|Gmt!BA0o+PwR!p}M5g*YO-S3-UvQ)yB1CJL4m73)PhC8$PuBR*q$5zl4Ro@j;4S z+`hSI_wdv?qSAe`c}_gcOZ0cc48U+6HVeFb8Rc1_i&54y(TEAgkmftioubT18bMGdXanXRvkallQSFshtWR1P)G^r39qFTf$s3cZO| z!H6?;DM)#pM<**6+<+g@wQ5UQ@KxPBLatf@~Umc z>94X+bJY!5Y@|jaV4V*ITJsTWQTGu$g`au{^cw^@lq}d}m`5UpU~H)}h@0)M<8!x% z&YzC-<4s--c&)bANo~Ay2(6`_m2QEz@-FyxZ=0oD4$b67JZWWIU3IL;(Cnk9qIx z^klP3T7!~UUEmv$c79x_Azzb|iXhd-BGKh?$})RR?3^+`z4Z^EQF~Gm&_x-xU#_jU zk0Hw+d*~7?k2c&4ajz!i49CpVA+dFmj3^PT_de~Fg@44;ttk1_{fxwc_gW`JGqQZy z*L2vOWMMyTe=|`q$KZ~}=(yj1_Jb=6w~V)srE)_y(Aa2+fBTZi3> z__30oJaAb(E^g`#2kUILI&_Zs?Q5`8+vKVAqWtk)zALvo2mh4OVBMx@;V(s|lJN;f z^4If95&=%BiX;ZvUj~bXDF|cI1^13>1`TA9bqbYE)}!0y9&_Z_n@m|+dlQIPXat$Z z-g{cO*#y&K#O1~ClQIcxJh;zaqSNBSK|fqR(S+gnMhKx^7iYzZ1-U2N^k+ysTHQU7 z(7WmvpEaMSH1E@)VWgR8^v~6ab{LE)bNVzjg+xkaa5C_aYI|mle>M*2WgtWdwT3fv z)SY;jxv5pHC=x(z>|5FYa!PGo{!`=4LjS4ohcQ>~;+%vfO5!KheRHr9;V<&J1539$EcPu8{hK^vs*6`ZHzDiiz}urmEJS;pK5bjMAJE z(Xkow{%cGEYx*-TWI~*zUc&S|EJ@F`9LAChCI5}bd`+95>0E6HPnlM*i}p~N`VB@| z)+aYgPQO?X_0~74QWFahm3dl=oD(8Jtu1%uw18K?)r`u%FZRDaxE%MyimFL|IMDMJ&Q;ZY;O4&mHx{7L@eCH<=nq9H3zi9N4s z^f}{8crd#jCTWZ}duYp95i{YJE^!(@{GQvY#eI_QbQD;8yW!=pf%%SW$Co6YdNPF0 z{8g{BkAcudF}RT`5AD8hrVQsMrfuF=`)zYQ!0jCs&v=-c#PSpmLebq)Ne$Cqn)?gp zh0lrF^{+vlnIkZWJVo`Ac!Rsl49Gd`7Gw49tIKPp=EHGCz(BbQBc)sA%O4N2xU^Ms zz;wb+Nfk2#pon$*VT;U3j4`N*+ek27O^f4b~D>0xqOFLx)Kt>}2iuc-O8X^c)sQcVH?%oU-WM-xAJ*=$j+;SJu7y?P$-OQ!klX_2aLjIl8;uhEom z5;s%M9gc_+>tw_1`reYZ?J>>z@BPR+=8rhb8$6rv)WHa9hv|6;SUIkD?w`~kctsyaJGw=OiE!KMC zDA2Z8^=aHSMVEW68*Ce}&>=B#LBGcxke`gKmG7QA`%yNuvGQ%23YZwX=y%L}DAiF2 zR_t@rR%MfwQ@DF_ES^c(043icLCt%fAn&HN9g*CXQ0c)<4?ebqnd0j`V z8eZ3FV0{2FjVMQY&%9ShgUGb22MOwl7WwWnGcW0K)XcP|>lk%j>X&7|;ddB`Osgd6 ztAsNQHG-N`?&eA9;dp_)vX$z2^z6`{0Pg#ml&+_?6CM%A}XK9VYj_ciLq1rCj$MP=i~Fi zaS?2MfAx9iK5rSw#nV%y`!Bq|IXNOaHeS0pw8JRN`FW9mUJIow#qOZE1%rH+!mxi4 zDskmERJ59q9{p^eRT_*}r)G@ajs^RCnUE3p^*VEs=m~b>@)9Pw(?6v{V6TDihGHD^ z?C!I>_a@0{aFxj6zS8HW?~NX@eWYfm?*EfqCg%dJ)cnhS*SGU4cKFumrH4xBJ8HG3;ZtN(7g&$E&!rzd(loUwfHUR7kR$6pvMWxFjDjw$ zO?+x8+JGEELGUSlLC(*B!1Oh*j+ccLkojE=O4|_Gz2~9kn0%dnI?~}d)$+R@sXu%w z$O4u>&0J&2H9i(ot~?FtZyF#P7V|khXFzEZAm7zE#1t@ZtwJ2J>oXemRw#%yj8eJ> zFf2*7x$##CtIAEN_gg*!gZC1b38)@e9olW>)zw@88JLvaOD;cj89@>q*H`j5#~Jn< zVK?Vv?S2*6=gDf<@--L=r!9Zc^3@z3p)*qA8uczwG1+EBZ>V~*Tjs6ZrLKRG)L(c7 z{cX}m<^JE~@2bI@JBTfg+ ztAslWBbwAU>D3x%b}5Nk)p2Aw&Q!-bbAf`g$J`Tal-OTCS`i%Xidl@SVit0wJ^D9{ z|IWZ|>`9l?`?6XrV`7DWSRnMF1y?vZssfMn^Sh?ATqxU3{O@pI2@8zwr2Ut}AsvQR zUY|s>i3w#EA3s}7nRRcu+udRD&)M2S-fCWYzXJB2iOn-FDgx)@_m15yv*(A9>O1M( zS0n))U&=g?_RK7h?B>R~it8uwXwcBNH5?(fLfkT_Lg2|IK&Md%1ls@pi#Zx5`v}Jj zXy~=HPJeI!e*ep+AB!&es!aI{-w&xY;Y^rd*pbHP3AeLO?`jKrFIC$|Ld^$jzzEC0 z#@#0qkw_ng-@p9{r^h0G!}%MwpDK{=Ts#CW*FTR)Ss6_~m0Zj0%CC4;vMDJZ$~@iz zq?QX}+1ZPf88j-7EQ+Rr?(sgI;sxC*fJ{~AYj!a2SI};kr)`|V9jnM^LUrw_AT%y$ zNvW{$VreeEDn|eF=5QJ1Wd4kIircqb(BOK}P626U3Y4-|@l5Qzx@P`jZTZn!>wtjv zZSkS>Mdj_X#TwCeZl&1y2Z5K~bK8NISA;Slz_z$nuW$dI|GfN(Ly+`gxp&ReL7>Ly z(8=ZoI@%j=eS5FJ=xMn7arVTeGW2R3GT<$R;Gp29@=pHp1Ht1`VdJ1f1#KrqCn5o# z{3ACa@9sT;$PIbw1H4}~8q`~p;GL`mR9;}mz6bX%I^npZpu3dB$Q5hDF0i3$)Kzv} z*ORZfG!Q_|}*9c6ONk6v-D_l$~Ha!!6Co~*}TciyS6uh(#K0aU zrAq}5#tGbLdJbq7S5d(+d;RA02y}IhbNf80sCH`T{2UTFYCnWBGIS*Fz+L`rU%b3; zt^C}G{6tPBV8Sz>oiOWj@aXcKby_9jDE`*m{ZYV2wKl5}y^6i2ltO>8W}c8E&yFvH zE;$NMHp)3IEPDUvm0I1PRN>oc_SI}fqU)NoVXaQAcVkt{VoL3Y^%fswpP@)MzD#R% zjh3t^Le}`8D$0=tJf{X~JNLROz~!lYDj?*YSd-yE;Pcugv~tHt9KeYZc8!Vuv*1x1 za);bVjr#L&dI>!1#g0kgX6(dswCv5x)Xkck-heBV!v{;d5yj;6tG%YDO6Hd>S4D#gA?w{h9^ly11L`z+mVu*U@SUxC4WR#8hqHdwmvMC4sDICT zEAd_hupDT7a}`JWWb>T5*ZWRi-J#r@S@;}X2eG{Dc%xd_?vUJd&E~X2UXwkMe`2Qa z9Q2?lx8ZS9nR2%*-@;!%aqU5r#0XonU8wrl®V4|R0+8e4+kfWkW$rpzu9t~!_6 zi2gR%H(UlO?Ye$z;E>Ts7Sn*|Q&3{Q#NT4)7unuA^^wn^WcAi=)&o6+Qn^&KafuBN zV}}TrxmG=W6U*)+Uq`MDA@EB5oxr{PdQVx_+mOq{dTL1<0)NQXVTA&=PdGzvEW~F} zg@LE*tgz7$IkPD%PR;Bn=Ow&f=J_bSFQ8azWDehF;g0`~5#T*$9v@<%xr(-4^Y9Qm zC2&>vw(cu|7xUb{=(J?Vee^*Yb%*F^q+9uYw~Te&+8fc{gstPABu`GRQt3QMKLIP! z3|ML>@Peki2(Z)AyNGUIDAzaIQr-si?#i~MsW~vzN{Mv7m*9AAYUxkarg2QIWN@Y@)awF%8z>bNA$MYn5?FniTD(KO+qy5+x;->MG_;*u|M=!Y)! zY|4YQO2=EWY(3|ryhs^~OjJ#4MDK@D<5(!Kw@Ep*;M#F2G`-&j4!61mXT7)Jc)oS6 zYQE@!K^bn9G-hiVBITkB>wsmdTQ=pybxy)<@q`hXN~+rVW{Vb$BSgX-S)i}_#Zswy z-jrVI>T{^_c21~Uc{|QHuU-WRQ7RA?e>#0mdDuw_i*ZgJdYjKbla20Wn|gMvtxPjP z6aMIcGOKvhx_e`+d5;`Lq{_zVWJc~=#@h6@Q~z?;&>bgE8F=7`!ah7}e}FYT-oT4X zfBJsQd1AZNc;+9IwzOMRxVxD7%gh(!XlL%sC%9z!98a6=nqvdNk{$bKejT^Y`H9}^ z;X~BRp)2bHub(r+A7#|x97R?wq8wb5@yS{H4J3^=N6ps5taWDPj~lE9VHIX(Q#QX$6sML4N zF*M|=r`&(#3u)+dd3TZD#&j=Bn5F74WXV9nY^M|n(Q|6;lIy&~`vidl5@jn#!K%K; z_F3U=3hnC;ax?Ga_tdqJ&I~oZJbRGIYezpt-52v{#rW`R0!(8r;BxisYtJXdmoc&v zLO1F&IPh+8l6tSZQ*lb4n+90fcRRr0_N4DsYnLL# zvVYk4zR2?`J?v|YK8@ni7~pAtIP*Fm7GlQ%&_c&^i?looy}IWS$}OxWQtW`Gco&fz zB8~zXlH#UdjUIfdtt73JPyG7kGOqQlPwuO{)OY)xU2T(P`s<76Sc9ckF@vCttmebk z)2iJH0Hvm1A+f0!ujK({n?9PEq0-)4dw+sz(}GBrjShi5A=dV@R;_OXUc?uY&@f_C zd^zb=yTV_z`-W(`lf-lt>Y1n22A=fG_XlEIT(9E31xHOuqgOUblEFM@tOaY&8 zjFL5vQ}cWGej_RjzFr$9v)z-#w)nosvyT}pu*%EJ)m!H>3)NZ5alNML*G?21uQ9%3 zk#D;-n(Ok%HG&^9C`++UTW@7p+2v(*p*D5=Y0T6^GhA$_IT{;(7HHBlDBKmn$($B&a1c7%N#ChkbCQ`rBW|5R2n%9 zPhWW$1&!>?vyBHQmH{cED80ccuj=W#a+aYyvxE*|6vy^n&HO2=>>1M}y}E9hMq9nQ z7B5!!e6urz4>jB>2ZCam6E*V$U(424JDqmVPm%9}Zp|varENo7L`XyPf1?&JGa4gp zA+3asbI%x5ROc%qNBN#eeicX7O&rA#cK(!kS%lvIG%E&hG*IlejUs9dPRT^S{Z)6A zhC^Bbh;U~aXyT_HSADQgpx0};K>@Zak(A;n>11Tdg*A?uIqoU_5WQcS$8o>z zTw2IiC#A!7>*ukm1Z+K`EcrNJHS{(%J`zA{HIU5%O=3+@#-MiCzB^jaqvfn6(pBwU z8_Q*c-&##0LQ`g&^lQqBH6d2=pzxRs?I}Leq;%a;V_j>c$@SCo3#7 zSzt5dEKku9)emve4k;|J1_CEl*YVnW<8#1`{y8MeyGriC+6>^Sb<%=+t(Nul{{1Ok zTz^0cm4xV=oE%@+dCl47vYroWrq}hZLpvG^I{Pu2h={)S`kAQK3@C)$N6)B-R8cx5ida)f@KoWXD<HY{O=F3OlJs!;;H;lCRXmr`@B#WXHkp-r_ zaY_F6OZA@4KlH&Gv40%x?QF#NEF2H|9Q%WM?Rm6*y?X1qmgTBhg*{6@vngzww)a8! zbX4VBW|tkeNU=pmDzCN!Ezw1P5H5X>yBY_Lqt)E3(DeuY{9{^xT$}jWTt(9Uv5FRN z?~%hk=Rx?|Zg+MTPVxlvt-!?(W3LhI&I+%ycDg3G$dA@)E+)#w@+6@~Xu=t^ zX5+M@*X~mm1st$(#Cz5^EeFE~FCs2zW{EqSCGqD)1J7f|=VdHr7aVya04J%ZmgoUD zosd~(24&yi8Jr}^TwHE?2KvCTm^NF5`ZN9kVvvFK7LuslFO_?s4Q%NN} zpN&B98w72V%l+S!^V}2QDzw{ zkD<$0RB9EQ<$Pwf&*OvhwV?X&gI4bInNz{LzSJkA$AW9F&&VA_7sXjsx1%&+I+o7L zF4U6aJ}zNvGB+KT!C9}D?Y^Gk`w$drn9r5Xy*N*@zjJ=++x62>BEtIcFn=Q2D45jM zBP|M&*QZA?KXWj9_T|L$&Y}zF?M@b)j}-9OoW^2QN`U(26P8+>-#$skyQ`aMpUl6vYZmc*&!8*l=AY>X_rKOvQ zdy)Ft1%=lRi_-n+CHyIKN12z_WcSoj6Y)`k_3nvO>HT{%ZZ>`xfh=|pRu8qq-}F!0t%P#l^|Vw&C$b;hf$7H>xgP#n6}^Ij7gcL z$j-PV#BUcD&avZOlBz-mNXFj#;_Bv6?YpEXNR`4w+sbbX9cO_83bwy4Bf z^Xx`KbCtyGKm+Tig^F+cG4wvGKU4uSe6qelub8#oMOb;l92g>-9*`THVybw|q$ z1R4nV8!eV5t6>H^|5HCzf!FbTv->`}43BYU`B{17ZJn;t!wVUfvUrQgx>lbC{AhyS zQkVZ>?u$`{ypwEcUXv9MB7j$EJ6E|=E+@6)yD`3=B0mNFV)?%YBN#2P7$#DBV4 zTsE-%peD_=V(v`I*vS1;%U*8F-JRjL;>ekT8_y``Rzxwywi*5|%eL9cb?}VSP{WD* zMmTiJp?0CoaSU0ibL2QKf8230gWEvSO)*c-xeHr9u}o_*KA!PF5|9m+6r@vaSqJrK zl@kfWibrmw<`yCM%rr;#>yUfCXpO{SC*B3!iQ}E;_m&ohJbTaeBa7Y3C)AhQB8vKD z#O?)ZMIYilh*Z^FaolqK4)QR0dmxOIAjz6L&}0d{;K00mv%%q=xxUELhc)W+E{eMp zb-O1bR>J4BkJY!Qxi?Gax2~#$#gENW$BS>fa%dFQ-1zH<6+we!w9Ft?DUXjy zLPs;Zoec*J#P@_3k7R)wd2%z=31ub7JoZ#yAt zW3C?lqc1l73fk=|J7kkkeGe3sWU4LzlYdJ|vScEDacV?)A&7sXGCZK?pI9S*{}5C% z&W)ylEacK4t7l1!K^AML>)i;Vd)>mibYo%=oYaXdy|L1mk{)%+A;|158kCz6UzTZA zVNwUP46b5NQ7JnmT~YnIl)?K@&V^HR*V1S$b}gF?`I01ta>Z1$$-Egtp^|Aj#5EK_ z#5incTKs7k(U|5xV9#3@4wjsk%(xv_Ia56>khh~O4Pq_rEj<_r5ybp2$;5uRj&8Xb zUB=KD%4Q^hw!gKyd(DrWdQb>~pTogNToAyJbWPdNWUclht-39DD>ZoXKux@cc(D)s zGI?4f1@Bw@g7a3k<7M|IKrW!U#sW|zb-y)Y)sP}(jV?)6h~93+zkC2o;y@DbpqY2c zE>7%b{s1X_TmJX_K$k~+jBHL*G>HyHNl7$ArkDg@6AS{_@hZpceNaE5qa)U+!i?y? zN4;kJLTHuIO;Pr?Pr~e)WXSy-+YkKFUiWu`Y*LsZJ z+553!9=^dLh_} z7KlrzjHPJHUj*}<6UR7XoI9-hl z649#nJ;wHuD;SSrz(iocE_-AxDl>KeQ@4_rXUxatv=@Q*t#-Un+&LV{sm;s}9j9M@6a4G0c2j{wmzIr4VAuJ z>Y?;^=Yl1-YRB3C*ul2+z3=Vsr>K4Y6EBSXL^PgHoVf=f zvHGRRzS6L3U;#MFi@0r#1sTc8kNE)wXWX1D)C$O9$k)H#HNCR~>!MU>Sg=Yn0IxuV zY^<1K-ipERDYKgCJWh3un~oMa}i6^Q8#HE~>@OHq0Uw zKok!m9ICHK46=*jADg_$-n(E^s!NZ195MOSzrRdxLw$_~UukwrrtIGhc$k>OfC1!U z_c1oHdzD0LMvG1_=QM4~FZ3oef~7~$<4xw@mdX^rQk-Ja|1JlTifchW4s;LRR#eUL zpR8a4j#ey%-MBiMGcPzdW!@WpzEm7+@>A7(>Y)sx&g-??V627xA5b!qZ=kGMZ;3{X z5z0jOo|g2Ksf6a|2kNH2%$5^8*w&5j-guR>ob{!8MSBRvD5r#fEvK6d1e@s{^F(EQ zCRKcoMNC~QF?H4#Zd(N*&`5od$#B#JfiJ6&lYM7EchQ-XKL}^B6r*Rr@7f=QB)bs( z75{N@+6sp~bM!fXX!?kYp0?&Dm{Z7aYDpgvF%6Bc6SsJ87_a)8bNjMzHsnVM0s&;C z7PV8=VvP+3M`jJ2oxI%!R?=)#%(gaNIMTI`-uKI$>%3{+E?-Vcymr#Jp_tXAtXj)D zgj2{X4=*C8%$XUyrBl ziWPA<*00r$jY!^kl@*56b@Z$?syq{?`0-&(b{cdYXvsHmGwBcqaeshnF>=?ICRPM8 zXm~a94MiXPY)!Cdcf%_B0{6W>W`C2=5-Gp6hSg0>k z+uLjU6uNlSRV?-OX5iFk=}pygRZpv1j&5fo>9V!>E3S!M9{-da%?Oa#N3YuLAYSh+GzoeRsn&C9kHR`(1lb@ssZi=D z_Mb!`>D$3djr6eX?f)%i)oyBBRzQ6>V!djrwjh`xN!d0O^A`<(_!mkIqDQg~W(eyK l9{*11-zxoISsGjcD;(65jK=Ev0&9w(12%`O3$46p{{f+4`h5TZ literal 0 HcmV?d00001 diff --git a/docs/mint.json b/docs/mint.json index e257ea0c5..48dc1805c 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -44,11 +44,6 @@ "icon": "shield-halved", "url": "security" }, - { - "name": "Self-hosting", - "icon": "server", - "url": "self-hosting" - }, { "name": "SDKs", "icon": "puzzle-piece", @@ -101,6 +96,14 @@ "getting-started/dashboard/token" ] }, + { + "group": "Self-hosting", + "pages": [ + "self-hosting/overview", + "self-hosting/configuration/envars", + "self-hosting/configuration/email" + ] + }, { "group": "Command line", "pages": [ @@ -171,12 +174,6 @@ "integrations/platforms/pm2" ] }, - { - "group": "Self-hosting", - "pages": [ - "self-hosting/overview" - ] - }, { "group": "Deployment options", "pages": [ @@ -184,13 +181,6 @@ "self-hosting/deployments/kubernetes" ] }, - { - "group": "Configuration", - "pages": [ - "self-hosting/configuration/envars", - "self-hosting/configuration/email" - ] - }, { "group": "Overview", "pages": [ diff --git a/docs/self-hosting/configuration/email.mdx b/docs/self-hosting/configuration/email.mdx index b35666776..a6b13fa0b 100644 --- a/docs/self-hosting/configuration/email.mdx +++ b/docs/self-hosting/configuration/email.mdx @@ -1,5 +1,5 @@ --- -title: "Email" +title: "Configure email service" description: "How to configure your email when self-hosting Infisical." --- diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index f674c1bcd..6786eef08 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -1,43 +1,151 @@ --- -title: "Environment Variables" -description: "How to configure your environment variables when self-hosting Infisical." +title: "All environment variables" +description: "Configure your environment variables when self-hosting Infisical." --- -Configuring Infisical requires setting some environment variables. There is a file called [`.env.example`](https://github.com/Infisical/infisical/blob/main/.env.example) at the root directory of our main repo that you can use to create a `.env` file before you start the server. +## Backend environment variables -| Variable | Description | Default Value | -| ----------------------- | ----------------------------------------------------------------------------------------------------------- | ------------- | -| `ENCRYPTION_KEY` | ❗️ Strong hex encryption key | `None` | -| `JWT_SIGNUP_SECRET` | ❗️ JWT token secret | `None` | -| `JWT_REFRESH_SECRET` | ❗️ JWT token secret | `None` | -| `JWT_AUTH_SECRET` | ❗️ JWT token secret | `None` | -| `JWT_MFA_SECRET` | ❗️ JWT token secret | `None` | -| `JWT_SERVICE_SECRET` | ❗️ JWT token secret | `None` | -| `JWT_SIGNUP_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `15m` | -| `JWT_REFRESH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `90d` | -| `JWT_AUTH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `10d` | -| `JWT_MFA_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `5m` | -| `MONGO_URL` | ❗️ MongoDB instance connection string either to container instance or MongoDB Cloud | `None` | -| `MONGO_USERNAME` | MongoDB username if using container | `None` | -| `MONGO_PASSWORD` | MongoDB password if using container | `None` | -| `SITE_URL` | ❗️ Site URL - should be an absolute URL including the protocol (e.g. `https://app.infisical.com`) | `None` | -| `SMTP_HOST` | ❗️ Hostname to connect to for establishing SMTP connections | `None` | -| `SMTP_USERNAME` | ❗️ Credential to connect to host (e.g. `team@infisical.com`) | `None` | -| `SMTP_PASSWORD` | ❗️ Credential to connect to host | `None` | -| `SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` | -| `SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` | -| `SMTP_FROM_ADDRESS` | ❗️ Email address to be used for sending emails (e.g. `team@infisical.com`) | `None` | -| `SMTP_FROM_NAME` | Name label to be used in From field (e.g. `Team`) | `Infisical` | -| `TELEMETRY_ENABLED` | `true` or `false`. [More](../overview). | `true` | -| `LICENSE_KEY` | License key if using Infisical Enterprise Edition | `true` | -| `CLIENT_ID_HEROKU` | OAuth2 client ID for Heroku integration | `None` | -| `CLIENT_ID_VERCEL` | OAuth2 client ID for Vercel integration | `None` | -| `CLIENT_ID_NETLIFY` | OAuth2 client ID for Netlify integration | `None` | -| `CLIENT_ID_GITHUB` | OAuth2 client ID for GitHub integration | `None` | -| `CLIENT_SECRET_HEROKU` | OAuth2 client secret for Heroku integration | `None` | -| `CLIENT_SECRET_VERCEL` | OAuth2 client secret for Vercel integration | `None` | -| `CLIENT_SECRET_NETLIFY` | OAuth2 client secret for Netlify integration | `None` | -| `CLIENT_SECRET_GITHUB` | OAuth2 client secret for GitHub integration | `None` | -| `CLIENT_SLUG_VERCEL` | OAuth2 slug for Netlify integration | `None` | -| `SENTRY_DSN` | DSN for error-monitoring with Sentry | `None` | -| `INVITE_ONLY_SIGNUP` | If true, users can only sign up if they are invited | `false` | +Depending on your choosen self hosted deployment method, you may need to configured at least the required environment variable listed below. +Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case. + + + + + Must be a random 32 character length hex string + + + + Must be a random 32 character length hex string + + + + Must be a random 32 character length hex string + + + + Must be a random 32 character length hex string + + + + Must be a random 32 character length hex string + + + + Must be a random 32 character length hex string + + + + *TLS based connection string is not yet supported + + + + When email service is not configured, Infisical will have limited functionality + + + Hostname to connect to for establishing SMTP connections + + + + Credential to connect to host (e.g. team@infisical.com) + + + + Credential to connect to host + + + + Port to connect to for establishing SMTP connections + + + + If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported + + + + Email address to be used for sending emails + + + + Name label to be used in From field (e.g. Team) + + + + To sync secret to third party services, provide value for the related services + + + OAuth2 client ID for Heroku integration + + + + OAuth2 client secret for Heroku integration + + + + OAuth2 client ID for Vercel integration + + + + OAuth2 client secret for Vercel integration + + + + OAuth2 client ID for Netlify integration + + + + OAuth2 client secret for Netlify integration + + + + OAuth2 client ID for GitHub integration + + + + OAuth2 client secret for GitHub integration + + + + OAuth2 slug for Netlify integration + + + + #### JWT + + JWT token lifetime expressed in seconds or a string describing a time span + + + + JWT token lifetime expressed in seconds or a string describing a time span + + + + JWT token lifetime expressed in seconds or a string describing a time span + + + + JWT token lifetime expressed in seconds or a string describing a time span + + + + + + + #### Error logging + Infisical uses Sentry to report error logs + + + #### Settings + + Only allow users who are invited to sign up + + + + Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com) + + + + + + +## Frontend environment variables + diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index 7f3bc30bf..85d533b42 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -1,36 +1,198 @@ --- -title: "Overview" -description: "Infisical is an open-source end-to-end encrypted secrets manager that developers can set up within 15 minutes." +title: "Deployment options" +description: "Explore deployment options for self hosting Infisical" --- - -Self-host vs. Infisical Cloud +To meet various compliance requirements, may want to self-host Infisical instead of using [Infisical Cloud](https://app.infisical.com/). +Self-hosted Infisical allows you to maintain your sensitive information within your own infrastructure and network, ensuring complete control over your data. -Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc. + + + + This deployment option will use AWS Cloudformation to auto deploy an instance of Infisical on a single EC2 via Docker Compose. -If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud. + **Resources that will be provisioned** + - 1 EC2 instance + - 1 DocumentDB cluster + - 1 DocumentDB instance + - Security groups -Infisical Cloud also comes with some extra features unavailable in the self-hosted edition. You can find more information about Infisical Cloud's offering on the pricing page. + + + - + + + This deployment option is highly available + Coming soon + + + This deployment option is highly available + + **Prerequisites** + - You have understanding of [Kubernetes](https://kubernetes.io/) + - You have understanding of [Helm package manager](https://helm.sh/) + - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster -## Deployment options -Infisical can be deployed on a Linux VM with docker-compose and Kubernetes. We're rolling out more specific deployment options for DigitalOcean, AWS, GCP, and Azure soon. + #### 1. Fill our environment variables - - - Deploy to any Linux with Docker - - - Deploy to your Kubernetes cluster - - + Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file. + Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more -## Telemetry + + [View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical) + ```yaml + frontend: + enabled: true + name: frontend + podAnnotations: {} + deploymentAnnotations: {} + replicaCount: 2 + image: + repository: infisical/frontend + tag: "latest" + pullPolicy: IfNotPresent + kubeSecretRef: "" + service: + annotations: {} + type: ClusterIP + nodePort: "" -Infisical collects telemetry data about general usage. + frontendEnvironmentVariables: + SITE_URL: infisical.local -The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software. + backend: + enabled: true + name: backend + podAnnotations: {} + deploymentAnnotations: {} + replicaCount: 2 + image: + repository: infisical/backend + tag: "latest" + pullPolicy: IfNotPresent + kubeSecretRef: "" + service: + annotations: {} + type: ClusterIP + nodePort: "" -To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the [environment variables](./configuration/envars). + backendEnvironmentVariables: + ENCRYPTION_KEY: MUST_REPLACE + JWT_SIGNUP_SECRET: MUST_REPLACE + JWT_REFRESH_SECRET: MUST_REPLACE + JWT_AUTH_SECRET: MUST_REPLACE + JWT_SERVICE_SECRET: MUST_REPLACE + SMTP_HOST: MUST_REPLACE + SMTP_PORT: 587 + SMTP_SECURE: false + SMTP_FROM_NAME: Infisical + SMTP_FROM_ADDRESS: MUST_REPLACE + SMTP_USERNAME: MUST_REPLACE + SMTP_PASSWORD: MUST_REPLACE + SITE_URL: infisical.local + + ## Mongo DB persistence + mongodb: + enabled: true + + ## By default the backend will be connected to a Mongo instance within the cluster + ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS) + ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/ + ## e.g. "mongodb://:@:/" + mongodbConnection: + externalMongoDBConnectionString: "" + + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: "nginx" + # cert-manager.io/issuer: letsencrypt-nginx + hostName: infisical.local ## <- Replace with your own domain + frontend: + path: / + pathType: Prefix + backend: + path: /api + pathType: Prefix + tls: [] + # - secretName: letsencrypt-nginx + # hosts: + # - infisical.local + + mailhog: + enabled: false + ``` + + + Once you have a local copy of the values file, fill our the required environment variables and save the file. + + + #### 2. Install Infisical Helm repository + + ```bash + helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' + + helm repo update + ``` + + #### 3. Install the Helm chart + + By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify + that by adding the `--namespace ` to your `helm install` command. + + ```bash + ## Installs to default namespace + helm install infisical-helm-charts/infisical --generate-name --values + ``` + + + If you have not filled out all of the required environment variables, you will see an error message prompting you to + do so. + + + #### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`. + + + + 1. Install Docker on your VM + + ```bash + # Example in ubuntu + apt-get update + apt-get upgrade + apt install docker-compose + ``` + + 2. Download the required files + + ```bash + # Download env file template + wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example + + # Download docker compose template + wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml + + # Download nginx config + mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf + ``` + + 3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](../../self-hosting/configuration/envars) + + ```bash + # update environment variables like mongo login + nano .env + ``` + + 4. Get the service up and running. + + ```bash + # Start up services in detached mode + docker-compose -f docker-compose.yml up -d + ``` + + 5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures. + + + \ No newline at end of file