mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-03 14:26:02 +00:00
Update self hosting docs
This commit is contained in:
Maidul Islam
+184
-22
@@ -1,36 +1,198 @@
|
||||
---
|
||||
title: "Overview"
|
||||
description: "Infisical is an open-source end-to-end encrypted secrets manager that developers can set up within 15 minutes."
|
||||
title: "Deployment options"
|
||||
description: "Explore deployment options for self hosting Infisical"
|
||||
---
|
||||
|
||||
<Info>
|
||||
Self-host vs. Infisical Cloud
|
||||
To meet various compliance requirements, may want to self-host Infisical instead of using [Infisical Cloud](https://app.infisical.com/).
|
||||
Self-hosted Infisical allows you to maintain your sensitive information within your own infrastructure and network, ensuring complete control over your data.
|
||||
|
||||
Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
|
||||
<Tabs>
|
||||
<Tab title="Quick deploy AWS">
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/jR-gM7vIY2c" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
|
||||
This deployment option will use AWS Cloudformation to auto deploy an instance of Infisical on a single EC2 via Docker Compose.
|
||||
|
||||
If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
|
||||
**Resources that will be provisioned**
|
||||
- 1 EC2 instance
|
||||
- 1 DocumentDB cluster
|
||||
- 1 DocumentDB instance
|
||||
- Security groups
|
||||
|
||||
Infisical Cloud also comes with some extra features unavailable in the self-hosted edition. You can find more information about Infisical Cloud's offering on the pricing page.
|
||||
<a href="https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://ec2-instance-cloudformation.s3.amazonaws.com/cloudformation.template&stackName=infisical">
|
||||
<img width="200" src="../images/deploy-aws-button.png" />
|
||||
</a>
|
||||
|
||||
</Info>
|
||||
</Tab>
|
||||
<Tab title="Quick deploy Digital Ocean">
|
||||
<Note>This deployment option is highly available</Note>
|
||||
Coming soon
|
||||
</Tab>
|
||||
<Tab title="Helm Kubernetes">
|
||||
<Note>This deployment option is highly available</Note>
|
||||
|
||||
**Prerequisites**
|
||||
- You have understanding of [Kubernetes](https://kubernetes.io/)
|
||||
- You have understanding of [Helm package manager](https://helm.sh/)
|
||||
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
|
||||
|
||||
## Deployment options
|
||||
|
||||
Infisical can be deployed on a Linux VM with docker-compose and Kubernetes. We're rolling out more specific deployment options for DigitalOcean, AWS, GCP, and Azure soon.
|
||||
#### 1. Fill our environment variables
|
||||
|
||||
<CardGroup cols={2}>
|
||||
<Card title="Any Linux" icon="square-1" color="#ea5a0c" href="/self-hosting/deployments/linux">
|
||||
Deploy to any Linux with Docker
|
||||
</Card>
|
||||
<Card title="Kubernetes" icon="square-2" color="#0285c7" href="/self-hosting/deployments/kubernetes">
|
||||
Deploy to your Kubernetes cluster
|
||||
</Card>
|
||||
</CardGroup>
|
||||
Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file.
|
||||
Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more
|
||||
|
||||
## Telemetry
|
||||
<Accordion title="values.yaml">
|
||||
[View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical)
|
||||
```yaml
|
||||
frontend:
|
||||
enabled: true
|
||||
name: frontend
|
||||
podAnnotations: {}
|
||||
deploymentAnnotations: {}
|
||||
replicaCount: 2
|
||||
image:
|
||||
repository: infisical/frontend
|
||||
tag: "latest"
|
||||
pullPolicy: IfNotPresent
|
||||
kubeSecretRef: ""
|
||||
service:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
|
||||
Infisical collects telemetry data about general usage.
|
||||
frontendEnvironmentVariables:
|
||||
SITE_URL: infisical.local
|
||||
|
||||
The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software.
|
||||
backend:
|
||||
enabled: true
|
||||
name: backend
|
||||
podAnnotations: {}
|
||||
deploymentAnnotations: {}
|
||||
replicaCount: 2
|
||||
image:
|
||||
repository: infisical/backend
|
||||
tag: "latest"
|
||||
pullPolicy: IfNotPresent
|
||||
kubeSecretRef: ""
|
||||
service:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
|
||||
To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the [environment variables](./configuration/envars).
|
||||
backendEnvironmentVariables:
|
||||
ENCRYPTION_KEY: MUST_REPLACE
|
||||
JWT_SIGNUP_SECRET: MUST_REPLACE
|
||||
JWT_REFRESH_SECRET: MUST_REPLACE
|
||||
JWT_AUTH_SECRET: MUST_REPLACE
|
||||
JWT_SERVICE_SECRET: MUST_REPLACE
|
||||
SMTP_HOST: MUST_REPLACE
|
||||
SMTP_PORT: 587
|
||||
SMTP_SECURE: false
|
||||
SMTP_FROM_NAME: Infisical
|
||||
SMTP_FROM_ADDRESS: MUST_REPLACE
|
||||
SMTP_USERNAME: MUST_REPLACE
|
||||
SMTP_PASSWORD: MUST_REPLACE
|
||||
SITE_URL: infisical.local
|
||||
|
||||
## Mongo DB persistence
|
||||
mongodb:
|
||||
enabled: true
|
||||
|
||||
## By default the backend will be connected to a Mongo instance within the cluster
|
||||
## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
|
||||
## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
|
||||
## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
|
||||
mongodbConnection:
|
||||
externalMongoDBConnectionString: ""
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
# cert-manager.io/issuer: letsencrypt-nginx
|
||||
hostName: infisical.local ## <- Replace with your own domain
|
||||
frontend:
|
||||
path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
path: /api
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - secretName: letsencrypt-nginx
|
||||
# hosts:
|
||||
# - infisical.local
|
||||
|
||||
mailhog:
|
||||
enabled: false
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
Once you have a local copy of the values file, fill our the required environment variables and save the file.
|
||||
|
||||
|
||||
#### 2. Install Infisical Helm repository
|
||||
|
||||
```bash
|
||||
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
||||
|
||||
helm repo update
|
||||
```
|
||||
|
||||
#### 3. Install the Helm chart
|
||||
|
||||
By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
|
||||
that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.
|
||||
|
||||
```bash
|
||||
## Installs to default namespace
|
||||
helm install infisical-helm-charts/infisical --generate-name --values <path to the values.yaml you downloaded/created in step 2>
|
||||
```
|
||||
|
||||
<Note>
|
||||
If you have not filled out all of the required environment variables, you will see an error message prompting you to
|
||||
do so.
|
||||
</Note>
|
||||
|
||||
#### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`.
|
||||
|
||||
</Tab>
|
||||
<Tab title="Bare Docker Compose">
|
||||
1. Install Docker on your VM
|
||||
|
||||
```bash
|
||||
# Example in ubuntu
|
||||
apt-get update
|
||||
apt-get upgrade
|
||||
apt install docker-compose
|
||||
```
|
||||
|
||||
2. Download the required files
|
||||
|
||||
```bash
|
||||
# Download env file template
|
||||
wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
|
||||
|
||||
# Download docker compose template
|
||||
wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
|
||||
|
||||
# Download nginx config
|
||||
mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
|
||||
```
|
||||
|
||||
3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](../../self-hosting/configuration/envars)
|
||||
|
||||
```bash
|
||||
# update environment variables like mongo login
|
||||
nano .env
|
||||
```
|
||||
|
||||
4. Get the service up and running.
|
||||
|
||||
```bash
|
||||
# Start up services in detached mode
|
||||
docker-compose -f docker-compose.yml up -d
|
||||
```
|
||||
|
||||
5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures.
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
Reference in New Issue
Block a user