mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Update self hosting docs
This commit is contained in:
Maidul Islam
176
cloudformation/ec2-deployment/infisical-ec2-deployment.template
Normal file
176
cloudformation/ec2-deployment/infisical-ec2-deployment.template
Normal file
@@ -0,0 +1,176 @@
|
|||||||
|
AWSTemplateFormatVersion: 2010-09-09
|
||||||
|
Description: >-
|
||||||
|
CloudFormation template to deploy Infisical on a EC2 instance with a
|
||||||
|
DocumentDB instance
|
||||||
|
Parameters:
|
||||||
|
KeyPairName:
|
||||||
|
Description: The name of the EC2 Key Pair to enable SSH access to the instance
|
||||||
|
Type: "AWS::EC2::KeyPair::KeyName"
|
||||||
|
VpcId:
|
||||||
|
Description: The ID of the VPC in which to launch the instance
|
||||||
|
Type: "AWS::EC2::VPC::Id"
|
||||||
|
DocumentDBUsername:
|
||||||
|
Description: The username for the DocumentDB instance
|
||||||
|
Type: String
|
||||||
|
MinLength: 5
|
||||||
|
DocumentDBPassword:
|
||||||
|
Description: The password for the DocumentDB instance (minimum 8 characters)
|
||||||
|
Type: String
|
||||||
|
MinLength: 8
|
||||||
|
NoEcho: true
|
||||||
|
Resources:
|
||||||
|
DocumentDBCluster:
|
||||||
|
Type: "AWS::DocDB::DBCluster"
|
||||||
|
Properties:
|
||||||
|
EngineVersion: 4.0.0
|
||||||
|
StorageEncrypted: true
|
||||||
|
MasterUsername: !Ref DocumentDBUsername
|
||||||
|
MasterUserPassword: !Ref DocumentDBPassword
|
||||||
|
VpcSecurityGroupIds:
|
||||||
|
- !Ref DocumentDBClusterSecurityGroup
|
||||||
|
DBClusterParameterGroupName: !Ref DBClusterParameterGroup
|
||||||
|
Metadata:
|
||||||
|
"AWS::CloudFormation::Designer":
|
||||||
|
id: 73b974cf-eed3-4f7d-8657-6a6746bac169
|
||||||
|
DependsOn:
|
||||||
|
- DBClusterParameterGroup
|
||||||
|
DBClusterParameterGroup:
|
||||||
|
Type: "AWS::DocDB::DBClusterParameterGroup"
|
||||||
|
Properties:
|
||||||
|
Description: "description"
|
||||||
|
Family: "docdb4.0"
|
||||||
|
Parameters:
|
||||||
|
tls: "disabled"
|
||||||
|
ttl_monitor: "disabled"
|
||||||
|
Tags:
|
||||||
|
- Key: "String"
|
||||||
|
Value: "String"
|
||||||
|
DocumentDBInstance:
|
||||||
|
Type: "AWS::DocDB::DBInstance"
|
||||||
|
Properties:
|
||||||
|
DBInstanceClass: db.t4g.medium
|
||||||
|
DBClusterIdentifier: !Ref DocumentDBCluster
|
||||||
|
Metadata:
|
||||||
|
"AWS::CloudFormation::Designer":
|
||||||
|
id: f04cee38-175e-4432-9ad7-62ca28bbf935
|
||||||
|
DocumentDBClusterSecurityGroup:
|
||||||
|
Type: AWS::EC2::SecurityGroup
|
||||||
|
Properties:
|
||||||
|
GroupDescription: Allow inbound traffic for DocumentDB cluster
|
||||||
|
VpcId: !Ref VpcId
|
||||||
|
SecurityGroupIngress:
|
||||||
|
- IpProtocol: tcp
|
||||||
|
FromPort: 27017
|
||||||
|
ToPort: 27017
|
||||||
|
SourceSecurityGroupId: !Ref InstanceSecurityGroup
|
||||||
|
EC2Instance:
|
||||||
|
Type: "AWS::EC2::Instance"
|
||||||
|
Properties:
|
||||||
|
ImageId: ami-0557a15b87f6559cf
|
||||||
|
InstanceType: t2.medium
|
||||||
|
KeyName: !Ref KeyPairName
|
||||||
|
UserData:
|
||||||
|
Fn::Base64: !Sub |
|
||||||
|
#!/bin/bash
|
||||||
|
cd /home/ubuntu
|
||||||
|
curl -fsSL https://get.docker.com -o get-docker.sh
|
||||||
|
sh get-docker.sh
|
||||||
|
sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||||||
|
sudo chmod +x /usr/local/bin/docker-compose
|
||||||
|
git clone https://github.com/Infisical/infisical.git
|
||||||
|
cd infisical
|
||||||
|
|
||||||
|
DOCUMENT_DB_CONNECTION_URL="mongodb://${DocumentDBUsername}:${DocumentDBPassword}@${DocumentDBCluster.Endpoint}:${DocumentDBCluster.Port}/infisical?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
|
||||||
|
|
||||||
|
ENCRYPTION_KEY=$(openssl rand -hex 16)
|
||||||
|
JWT_SIGNUP_SECRET=$(openssl rand -hex 16)
|
||||||
|
JWT_REFRESH_SECRET=$(openssl rand -hex 16)
|
||||||
|
JWT_AUTH_SECRET=$(openssl rand -hex 16)
|
||||||
|
JWT_SERVICE_SECRET=$(openssl rand -hex 16)
|
||||||
|
|
||||||
|
touch .env
|
||||||
|
|
||||||
|
echo "ENCRYPTION_KEY=${!ENCRYPTION_KEY}" >> .env
|
||||||
|
echo "JWT_SIGNUP_SECRET=${!JWT_SIGNUP_SECRET}" >> .env
|
||||||
|
echo "JWT_REFRESH_SECRET=${!JWT_REFRESH_SECRET}" >> .env
|
||||||
|
echo "JWT_AUTH_SECRET=${!JWT_AUTH_SECRET}" >> .env
|
||||||
|
echo "JWT_SERVICE_SECRET=${!JWT_SERVICE_SECRET}" >> .env
|
||||||
|
echo "MONGO_URL=${!DOCUMENT_DB_CONNECTION_URL}" >> .env
|
||||||
|
|
||||||
|
docker-compose up -d
|
||||||
|
|
||||||
|
SecurityGroupIds:
|
||||||
|
- !Ref InstanceSecurityGroup
|
||||||
|
Tags:
|
||||||
|
- Key: Name
|
||||||
|
Value: infisical
|
||||||
|
Metadata:
|
||||||
|
"AWS::CloudFormation::Designer":
|
||||||
|
id: 2c0a771c-5002-4785-9848-0377e33cd0e9
|
||||||
|
DependsOn:
|
||||||
|
- DocumentDBInstance
|
||||||
|
|
||||||
|
InstanceSecurityGroup:
|
||||||
|
Type: "AWS::EC2::SecurityGroup"
|
||||||
|
Properties:
|
||||||
|
GroupDescription: Allow SSH and HTTP traffic
|
||||||
|
SecurityGroupIngress:
|
||||||
|
- IpProtocol: tcp
|
||||||
|
FromPort: 22
|
||||||
|
ToPort: 22
|
||||||
|
CidrIp: 0.0.0.0/0
|
||||||
|
- IpProtocol: tcp
|
||||||
|
FromPort: 80
|
||||||
|
ToPort: 80
|
||||||
|
CidrIp: 0.0.0.0/0
|
||||||
|
VpcId: !Ref VpcId
|
||||||
|
Metadata:
|
||||||
|
"AWS::CloudFormation::Designer":
|
||||||
|
id: 1fd6856a-11e5-4369-84fa-d18d4011b3de
|
||||||
|
|
||||||
|
Outputs:
|
||||||
|
InstanceIP:
|
||||||
|
Value: !GetAtt EC2Instance.PublicIp
|
||||||
|
Metadata:
|
||||||
|
"AWS::CloudFormation::Designer":
|
||||||
|
1fd6856a-11e5-4369-84fa-d18d4011b3de:
|
||||||
|
size:
|
||||||
|
width: 60
|
||||||
|
height: 60
|
||||||
|
position:
|
||||||
|
x: 60
|
||||||
|
"y": 90
|
||||||
|
z: 1
|
||||||
|
embeds: []
|
||||||
|
2c0a771c-5002-4785-9848-0377e33cd0e9:
|
||||||
|
size:
|
||||||
|
width: 60
|
||||||
|
height: 60
|
||||||
|
position:
|
||||||
|
x: 180
|
||||||
|
"y": 90
|
||||||
|
z: 1
|
||||||
|
embeds: []
|
||||||
|
isassociatedwith:
|
||||||
|
- 1fd6856a-11e5-4369-84fa-d18d4011b3de
|
||||||
|
dependson:
|
||||||
|
- 2cabaada-fbdb-4945-bf95-a0406704dd5a
|
||||||
|
- f04cee38-175e-4432-9ad7-62ca28bbf935
|
||||||
|
73b974cf-eed3-4f7d-8657-6a6746bac169:
|
||||||
|
size:
|
||||||
|
width: 60
|
||||||
|
height: 60
|
||||||
|
position:
|
||||||
|
x: 390
|
||||||
|
"y": 210
|
||||||
|
z: 1
|
||||||
|
embeds: []
|
||||||
|
f04cee38-175e-4432-9ad7-62ca28bbf935:
|
||||||
|
size:
|
||||||
|
width: 60
|
||||||
|
height: 60
|
||||||
|
position:
|
||||||
|
x: 270
|
||||||
|
"y": 90
|
||||||
|
z: 1
|
||||||
|
embeds: []
|
||||||
BIN
docs/images/deploy-aws-button.png
Normal file
BIN
docs/images/deploy-aws-button.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
@@ -44,11 +44,6 @@
|
|||||||
"icon": "shield-halved",
|
"icon": "shield-halved",
|
||||||
"url": "security"
|
"url": "security"
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"name": "Self-hosting",
|
|
||||||
"icon": "server",
|
|
||||||
"url": "self-hosting"
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "SDKs",
|
"name": "SDKs",
|
||||||
"icon": "puzzle-piece",
|
"icon": "puzzle-piece",
|
||||||
@@ -101,6 +96,14 @@
|
|||||||
"getting-started/dashboard/token"
|
"getting-started/dashboard/token"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"group": "Self-hosting",
|
||||||
|
"pages": [
|
||||||
|
"self-hosting/overview",
|
||||||
|
"self-hosting/configuration/envars",
|
||||||
|
"self-hosting/configuration/email"
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"group": "Command line",
|
"group": "Command line",
|
||||||
"pages": [
|
"pages": [
|
||||||
@@ -171,12 +174,6 @@
|
|||||||
"integrations/platforms/pm2"
|
"integrations/platforms/pm2"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"group": "Self-hosting",
|
|
||||||
"pages": [
|
|
||||||
"self-hosting/overview"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"group": "Deployment options",
|
"group": "Deployment options",
|
||||||
"pages": [
|
"pages": [
|
||||||
@@ -184,13 +181,6 @@
|
|||||||
"self-hosting/deployments/kubernetes"
|
"self-hosting/deployments/kubernetes"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"group": "Configuration",
|
|
||||||
"pages": [
|
|
||||||
"self-hosting/configuration/envars",
|
|
||||||
"self-hosting/configuration/email"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"group": "Overview",
|
"group": "Overview",
|
||||||
"pages": [
|
"pages": [
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: "Email"
|
title: "Configure email service"
|
||||||
description: "How to configure your email when self-hosting Infisical."
|
description: "How to configure your email when self-hosting Infisical."
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@@ -1,43 +1,151 @@
|
|||||||
---
|
---
|
||||||
title: "Environment Variables"
|
title: "All environment variables"
|
||||||
description: "How to configure your environment variables when self-hosting Infisical."
|
description: "Configure your environment variables when self-hosting Infisical."
|
||||||
---
|
---
|
||||||
|
|
||||||
Configuring Infisical requires setting some environment variables. There is a file called [`.env.example`](https://github.com/Infisical/infisical/blob/main/.env.example) at the root directory of our main repo that you can use to create a `.env` file before you start the server.
|
## Backend environment variables
|
||||||
|
|
||||||
| Variable | Description | Default Value |
|
Depending on your choosen self hosted deployment method, you may need to configured at least the required environment variable listed below.
|
||||||
| ----------------------- | ----------------------------------------------------------------------------------------------------------- | ------------- |
|
Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case.
|
||||||
| `ENCRYPTION_KEY` | ❗️ Strong hex encryption key | `None` |
|
|
||||||
| `JWT_SIGNUP_SECRET` | ❗️ JWT token secret | `None` |
|
<Tabs>
|
||||||
| `JWT_REFRESH_SECRET` | ❗️ JWT token secret | `None` |
|
<Tab title="Required">
|
||||||
| `JWT_AUTH_SECRET` | ❗️ JWT token secret | `None` |
|
<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
|
||||||
| `JWT_MFA_SECRET` | ❗️ JWT token secret | `None` |
|
Must be a random 32 character length hex string
|
||||||
| `JWT_SERVICE_SECRET` | ❗️ JWT token secret | `None` |
|
</ParamField>
|
||||||
| `JWT_SIGNUP_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `15m` |
|
|
||||||
| `JWT_REFRESH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `90d` |
|
<ParamField query="JWT_SIGNUP_SECRET" type="string" default="none" required>
|
||||||
| `JWT_AUTH_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `10d` |
|
Must be a random 32 character length hex string
|
||||||
| `JWT_MFA_LIFETIME` | JWT token lifetime expressed in seconds or a string describing a time span (e.g. 60, "2 days", "10h", "7d") | `5m` |
|
</ParamField>
|
||||||
| `MONGO_URL` | ❗️ MongoDB instance connection string either to container instance or MongoDB Cloud | `None` |
|
|
||||||
| `MONGO_USERNAME` | MongoDB username if using container | `None` |
|
<ParamField query="JWT_REFRESH_SECRET" type="string" default="none" required>
|
||||||
| `MONGO_PASSWORD` | MongoDB password if using container | `None` |
|
Must be a random 32 character length hex string
|
||||||
| `SITE_URL` | ❗️ Site URL - should be an absolute URL including the protocol (e.g. `https://app.infisical.com`) | `None` |
|
</ParamField>
|
||||||
| `SMTP_HOST` | ❗️ Hostname to connect to for establishing SMTP connections | `None` |
|
|
||||||
| `SMTP_USERNAME` | ❗️ Credential to connect to host (e.g. `team@infisical.com`) | `None` |
|
<ParamField query="JWT_AUTH_SECRET" type="string" default="none" required>
|
||||||
| `SMTP_PASSWORD` | ❗️ Credential to connect to host | `None` |
|
Must be a random 32 character length hex string
|
||||||
| `SMTP_PORT` | Port to connect to for establishing SMTP connections | `587` |
|
</ParamField>
|
||||||
| `SMTP_SECURE` | If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported | `false` |
|
|
||||||
| `SMTP_FROM_ADDRESS` | ❗️ Email address to be used for sending emails (e.g. `team@infisical.com`) | `None` |
|
<ParamField query="JWT_MFA_SECRET" type="string" default="none" required>
|
||||||
| `SMTP_FROM_NAME` | Name label to be used in From field (e.g. `Team`) | `Infisical` |
|
Must be a random 32 character length hex string
|
||||||
| `TELEMETRY_ENABLED` | `true` or `false`. [More](../overview). | `true` |
|
</ParamField>
|
||||||
| `LICENSE_KEY` | License key if using Infisical Enterprise Edition | `true` |
|
|
||||||
| `CLIENT_ID_HEROKU` | OAuth2 client ID for Heroku integration | `None` |
|
<ParamField query="JWT_SERVICE_SECRET" type="string" default="none" required>
|
||||||
| `CLIENT_ID_VERCEL` | OAuth2 client ID for Vercel integration | `None` |
|
Must be a random 32 character length hex string
|
||||||
| `CLIENT_ID_NETLIFY` | OAuth2 client ID for Netlify integration | `None` |
|
</ParamField>
|
||||||
| `CLIENT_ID_GITHUB` | OAuth2 client ID for GitHub integration | `None` |
|
|
||||||
| `CLIENT_SECRET_HEROKU` | OAuth2 client secret for Heroku integration | `None` |
|
<ParamField query="MONGO_URL" type="string" default="none" required>
|
||||||
| `CLIENT_SECRET_VERCEL` | OAuth2 client secret for Vercel integration | `None` |
|
*TLS based connection string is not yet supported
|
||||||
| `CLIENT_SECRET_NETLIFY` | OAuth2 client secret for Netlify integration | `None` |
|
</ParamField>
|
||||||
| `CLIENT_SECRET_GITHUB` | OAuth2 client secret for GitHub integration | `None` |
|
</Tab>
|
||||||
| `CLIENT_SLUG_VERCEL` | OAuth2 slug for Netlify integration | `None` |
|
<Tab title="Email service">
|
||||||
| `SENTRY_DSN` | DSN for error-monitoring with Sentry | `None` |
|
<Info>When email service is not configured, Infisical will have limited functionality</Info>
|
||||||
| `INVITE_ONLY_SIGNUP` | If true, users can only sign up if they are invited | `false` |
|
|
||||||
|
<ParamField query="SMTP_HOST" type="string" default="none" optional>
|
||||||
|
Hostname to connect to for establishing SMTP connections
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||||
|
Credential to connect to host (e.g. team@infisical.com)
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_PASSWORD" type="string" default="587" optional>
|
||||||
|
Credential to connect to host
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||||
|
Port to connect to for establishing SMTP connections
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||||
|
If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||||
|
Email address to be used for sending emails
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
|
||||||
|
Name label to be used in From field (e.g. Team)
|
||||||
|
</ParamField>
|
||||||
|
</Tab>
|
||||||
|
<Tab title="Integrations">
|
||||||
|
To sync secret to third party services, provide value for the related services
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
|
||||||
|
OAuth2 client ID for Heroku integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
|
||||||
|
OAuth2 client secret for Heroku integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
|
||||||
|
OAuth2 client ID for Vercel integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||||
|
OAuth2 client secret for Vercel integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
|
||||||
|
OAuth2 client ID for Netlify integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
|
||||||
|
OAuth2 client secret for Netlify integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
|
||||||
|
OAuth2 client ID for GitHub integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
|
||||||
|
OAuth2 client secret for GitHub integration
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
|
||||||
|
OAuth2 slug for Netlify integration
|
||||||
|
</ParamField>
|
||||||
|
</Tab>
|
||||||
|
<Tab title="Others">
|
||||||
|
#### JWT
|
||||||
|
<ParamField query="JWT_SIGNUP_LIFETIME" type="string" default="15m" optional>
|
||||||
|
JWT token lifetime expressed in seconds or a string describing a time span
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="JWT_REFRESH_LIFETIME" type="string" default="90d" optional>
|
||||||
|
JWT token lifetime expressed in seconds or a string describing a time span
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="JWT_AUTH_LIFETIME" type="string" default="10d" optional>
|
||||||
|
JWT token lifetime expressed in seconds or a string describing a time span
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="JWT_MFA_LIFETIME" type="string" default="5m" optional>
|
||||||
|
JWT token lifetime expressed in seconds or a string describing a time span
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="MONGO_USERNAME" type="string" default="none" optional></ParamField>
|
||||||
|
|
||||||
|
<ParamField query="MONGO_PASSWORD" type="string" default="none" optional></ParamField>
|
||||||
|
|
||||||
|
#### Error logging
|
||||||
|
Infisical uses Sentry to report error logs
|
||||||
|
<ParamField query="SENTRY_DSN" type="string" default="none" optional></ParamField>
|
||||||
|
|
||||||
|
#### Settings
|
||||||
|
<ParamField query="INVITE_ONLY_SIGNUP" type="string" default="false" optional>
|
||||||
|
Only allow users who are invited to sign up
|
||||||
|
</ParamField>
|
||||||
|
|
||||||
|
<ParamField query="SITE_URL" type="string" default="none" optional>
|
||||||
|
Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
|
||||||
|
</ParamField>
|
||||||
|
<ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
|
||||||
|
</Tab>
|
||||||
|
</Tabs>
|
||||||
|
|
||||||
|
|
||||||
|
## Frontend environment variables
|
||||||
|
<ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
|
||||||
|
|||||||
@@ -1,36 +1,198 @@
|
|||||||
---
|
---
|
||||||
title: "Overview"
|
title: "Deployment options"
|
||||||
description: "Infisical is an open-source end-to-end encrypted secrets manager that developers can set up within 15 minutes."
|
description: "Explore deployment options for self hosting Infisical"
|
||||||
---
|
---
|
||||||
|
|
||||||
<Info>
|
To meet various compliance requirements, may want to self-host Infisical instead of using [Infisical Cloud](https://app.infisical.com/).
|
||||||
Self-host vs. Infisical Cloud
|
Self-hosted Infisical allows you to maintain your sensitive information within your own infrastructure and network, ensuring complete control over your data.
|
||||||
|
|
||||||
Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
|
<Tabs>
|
||||||
|
<Tab title="Quick deploy AWS">
|
||||||
|
<iframe width="560" height="315" src="https://www.youtube.com/embed/jR-gM7vIY2c" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
|
||||||
|
This deployment option will use AWS Cloudformation to auto deploy an instance of Infisical on a single EC2 via Docker Compose.
|
||||||
|
|
||||||
If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
|
**Resources that will be provisioned**
|
||||||
|
- 1 EC2 instance
|
||||||
|
- 1 DocumentDB cluster
|
||||||
|
- 1 DocumentDB instance
|
||||||
|
- Security groups
|
||||||
|
|
||||||
Infisical Cloud also comes with some extra features unavailable in the self-hosted edition. You can find more information about Infisical Cloud's offering on the pricing page.
|
<a href="https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://ec2-instance-cloudformation.s3.amazonaws.com/cloudformation.template&stackName=infisical">
|
||||||
|
<img width="200" src="../images/deploy-aws-button.png" />
|
||||||
|
</a>
|
||||||
|
|
||||||
</Info>
|
</Tab>
|
||||||
|
<Tab title="Quick deploy Digital Ocean">
|
||||||
|
<Note>This deployment option is highly available</Note>
|
||||||
|
Coming soon
|
||||||
|
</Tab>
|
||||||
|
<Tab title="Helm Kubernetes">
|
||||||
|
<Note>This deployment option is highly available</Note>
|
||||||
|
|
||||||
|
**Prerequisites**
|
||||||
|
- You have understanding of [Kubernetes](https://kubernetes.io/)
|
||||||
|
- You have understanding of [Helm package manager](https://helm.sh/)
|
||||||
|
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
|
||||||
|
|
||||||
## Deployment options
|
|
||||||
|
|
||||||
Infisical can be deployed on a Linux VM with docker-compose and Kubernetes. We're rolling out more specific deployment options for DigitalOcean, AWS, GCP, and Azure soon.
|
#### 1. Fill our environment variables
|
||||||
|
|
||||||
<CardGroup cols={2}>
|
Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file.
|
||||||
<Card title="Any Linux" icon="square-1" color="#ea5a0c" href="/self-hosting/deployments/linux">
|
Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more
|
||||||
Deploy to any Linux with Docker
|
|
||||||
</Card>
|
|
||||||
<Card title="Kubernetes" icon="square-2" color="#0285c7" href="/self-hosting/deployments/kubernetes">
|
|
||||||
Deploy to your Kubernetes cluster
|
|
||||||
</Card>
|
|
||||||
</CardGroup>
|
|
||||||
|
|
||||||
## Telemetry
|
<Accordion title="values.yaml">
|
||||||
|
[View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical)
|
||||||
|
```yaml
|
||||||
|
frontend:
|
||||||
|
enabled: true
|
||||||
|
name: frontend
|
||||||
|
podAnnotations: {}
|
||||||
|
deploymentAnnotations: {}
|
||||||
|
replicaCount: 2
|
||||||
|
image:
|
||||||
|
repository: infisical/frontend
|
||||||
|
tag: "latest"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
kubeSecretRef: ""
|
||||||
|
service:
|
||||||
|
annotations: {}
|
||||||
|
type: ClusterIP
|
||||||
|
nodePort: ""
|
||||||
|
|
||||||
Infisical collects telemetry data about general usage.
|
frontendEnvironmentVariables:
|
||||||
|
SITE_URL: infisical.local
|
||||||
|
|
||||||
The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software.
|
backend:
|
||||||
|
enabled: true
|
||||||
|
name: backend
|
||||||
|
podAnnotations: {}
|
||||||
|
deploymentAnnotations: {}
|
||||||
|
replicaCount: 2
|
||||||
|
image:
|
||||||
|
repository: infisical/backend
|
||||||
|
tag: "latest"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
kubeSecretRef: ""
|
||||||
|
service:
|
||||||
|
annotations: {}
|
||||||
|
type: ClusterIP
|
||||||
|
nodePort: ""
|
||||||
|
|
||||||
To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the [environment variables](./configuration/envars).
|
backendEnvironmentVariables:
|
||||||
|
ENCRYPTION_KEY: MUST_REPLACE
|
||||||
|
JWT_SIGNUP_SECRET: MUST_REPLACE
|
||||||
|
JWT_REFRESH_SECRET: MUST_REPLACE
|
||||||
|
JWT_AUTH_SECRET: MUST_REPLACE
|
||||||
|
JWT_SERVICE_SECRET: MUST_REPLACE
|
||||||
|
SMTP_HOST: MUST_REPLACE
|
||||||
|
SMTP_PORT: 587
|
||||||
|
SMTP_SECURE: false
|
||||||
|
SMTP_FROM_NAME: Infisical
|
||||||
|
SMTP_FROM_ADDRESS: MUST_REPLACE
|
||||||
|
SMTP_USERNAME: MUST_REPLACE
|
||||||
|
SMTP_PASSWORD: MUST_REPLACE
|
||||||
|
SITE_URL: infisical.local
|
||||||
|
|
||||||
|
## Mongo DB persistence
|
||||||
|
mongodb:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
## By default the backend will be connected to a Mongo instance within the cluster
|
||||||
|
## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
|
||||||
|
## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
|
||||||
|
## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
|
||||||
|
mongodbConnection:
|
||||||
|
externalMongoDBConnectionString: ""
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/ingress.class: "nginx"
|
||||||
|
# cert-manager.io/issuer: letsencrypt-nginx
|
||||||
|
hostName: infisical.local ## <- Replace with your own domain
|
||||||
|
frontend:
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
path: /api
|
||||||
|
pathType: Prefix
|
||||||
|
tls: []
|
||||||
|
# - secretName: letsencrypt-nginx
|
||||||
|
# hosts:
|
||||||
|
# - infisical.local
|
||||||
|
|
||||||
|
mailhog:
|
||||||
|
enabled: false
|
||||||
|
```
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
Once you have a local copy of the values file, fill our the required environment variables and save the file.
|
||||||
|
|
||||||
|
|
||||||
|
#### 2. Install Infisical Helm repository
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
||||||
|
|
||||||
|
helm repo update
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 3. Install the Helm chart
|
||||||
|
|
||||||
|
By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
|
||||||
|
that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
## Installs to default namespace
|
||||||
|
helm install infisical-helm-charts/infisical --generate-name --values <path to the values.yaml you downloaded/created in step 2>
|
||||||
|
```
|
||||||
|
|
||||||
|
<Note>
|
||||||
|
If you have not filled out all of the required environment variables, you will see an error message prompting you to
|
||||||
|
do so.
|
||||||
|
</Note>
|
||||||
|
|
||||||
|
#### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`.
|
||||||
|
|
||||||
|
</Tab>
|
||||||
|
<Tab title="Bare Docker Compose">
|
||||||
|
1. Install Docker on your VM
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Example in ubuntu
|
||||||
|
apt-get update
|
||||||
|
apt-get upgrade
|
||||||
|
apt install docker-compose
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Download the required files
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Download env file template
|
||||||
|
wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
|
||||||
|
|
||||||
|
# Download docker compose template
|
||||||
|
wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
|
||||||
|
|
||||||
|
# Download nginx config
|
||||||
|
mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](../../self-hosting/configuration/envars)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# update environment variables like mongo login
|
||||||
|
nano .env
|
||||||
|
```
|
||||||
|
|
||||||
|
4. Get the service up and running.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Start up services in detached mode
|
||||||
|
docker-compose -f docker-compose.yml up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures.
|
||||||
|
|
||||||
|
</Tab>
|
||||||
|
</Tabs>
|
||||||
Reference in New Issue
Block a user