From 18398457e06aae67d25851bbab5680fe06c32d94 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 9 Sep 2025 03:42:52 +0800 Subject: [PATCH] misc: addressed comments --- ...1627_add-gateway-v2-pki-and-ssh-configs.ts | 10 ++- backend/src/db/schemas/relays.ts | 2 +- backend/src/ee/routes/v1/relay-router.ts | 4 +- .../dynamic-secret/providers/kubernetes.ts | 2 +- .../dynamic-secret/providers/sql-database.ts | 2 +- .../services/gateway-v2/gateway-v2-service.ts | 15 ++-- backend/src/ee/services/relay/relay-fns.ts | 5 -- .../src/ee/services/relay/relay-service.ts | 74 ++++++++----------- backend/src/lib/gateway-v2/gateway-v2.ts | 21 +++--- .../github/github-connection-fns.ts | 2 +- .../shared/sql/sql-connection-fns.ts | 2 +- .../identity-kubernetes-auth-service.ts | 2 +- docs/cli/commands/relay.mdx | 43 ++++++----- .../platform/gateways/networking.mdx | 25 ++++--- 14 files changed, 99 insertions(+), 110 deletions(-) delete mode 100644 backend/src/ee/services/relay/relay-fns.ts diff --git a/backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts b/backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts index 3c825b08d..812c4f48f 100644 --- a/backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts +++ b/backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts @@ -98,8 +98,10 @@ export async function up(knex: Knex): Promise { t.uuid("identityId"); t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE"); - t.string("name").notNullable().unique(); - t.string("ip").notNullable(); + t.string("name").notNullable(); + t.string("host").notNullable(); + + t.unique(["orgId", "name"]); }); await createOnUpdateTrigger(knex, TableName.Relay); @@ -119,7 +121,9 @@ export async function up(knex: Knex): Promise { t.uuid("relayId"); t.foreign("relayId").references("id").inTable(TableName.Relay).onDelete("SET NULL"); - t.string("name").notNullable().unique(); + t.string("name").notNullable(); + + t.unique(["orgId", "name"]); t.dateTime("heartbeat"); }); diff --git a/backend/src/db/schemas/relays.ts b/backend/src/db/schemas/relays.ts index d29f2438f..4bb615e96 100644 --- a/backend/src/db/schemas/relays.ts +++ b/backend/src/db/schemas/relays.ts @@ -14,7 +14,7 @@ export const RelaysSchema = z.object({ orgId: z.string().uuid().nullable().optional(), identityId: z.string().uuid().nullable().optional(), name: z.string(), - ip: z.string() + host: z.string() }); export type TRelays = z.infer; diff --git a/backend/src/ee/routes/v1/relay-router.ts b/backend/src/ee/routes/v1/relay-router.ts index a04791797..4cfa2c160 100644 --- a/backend/src/ee/routes/v1/relay-router.ts +++ b/backend/src/ee/routes/v1/relay-router.ts @@ -18,7 +18,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => { }, schema: { body: z.object({ - ip: z.string(), + host: z.string(), name: z.string() }), response: { @@ -68,7 +68,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => { }, schema: { body: z.object({ - ip: z.string(), + host: z.string(), name: z.string() }), response: { diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts index a7b69d882..3c924458d 100644 --- a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts +++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts @@ -79,7 +79,7 @@ export const KubernetesProvider = ({ ); }, { - relayIp: gatewayV2ConnectionDetails.relayIp, + relayHost: gatewayV2ConnectionDetails.relayHost, gateway: gatewayV2ConnectionDetails.gateway, relay: gatewayV2ConnectionDetails.relay, protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp, diff --git a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts index 0ac4380fd..733def399 100644 --- a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts +++ b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts @@ -203,7 +203,7 @@ export const SqlDatabaseProvider = ({ await gatewayCallback("localhost", port); }, { - relayIp: gatewayV2ConnectionDetails.relayIp, + relayHost: gatewayV2ConnectionDetails.relayHost, gateway: gatewayV2ConnectionDetails.gateway, relay: gatewayV2ConnectionDetails.relay, protocol: GatewayProxyProtocol.Tcp diff --git a/backend/src/ee/services/gateway-v2/gateway-v2-service.ts b/backend/src/ee/services/gateway-v2/gateway-v2-service.ts index 6ec379854..64c325177 100644 --- a/backend/src/ee/services/gateway-v2/gateway-v2-service.ts +++ b/backend/src/ee/services/gateway-v2/gateway-v2-service.ts @@ -25,7 +25,6 @@ import { TLicenseServiceFactory } from "../license/license-service"; import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission"; import { TPermissionServiceFactory } from "../permission/permission-service-types"; import { TRelayDALFactory } from "../relay/relay-dal"; -import { isInstanceRelay } from "../relay/relay-fns"; import { TRelayServiceFactory } from "../relay/relay-service"; import { GATEWAY_ACTOR_OID, GATEWAY_ROUTING_INFO_OID } from "./gateway-v2-constants"; import { TGatewayV2DALFactory } from "./gateway-v2-dal"; @@ -399,7 +398,7 @@ export const gatewayV2ServiceFactory = ({ }); return { - relayIp: relayCredentials.relayIp, + relayHost: relayCredentials.relayHost, gateway: { clientCertificate: clientCert.toString("pem"), clientPrivateKey: gatewayClientCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(), @@ -429,11 +428,9 @@ export const gatewayV2ServiceFactory = ({ await $validateIdentityAccessToGateway(orgId, actorId, actorAuthMethod); const orgCAs = await $getOrgCAs(orgId); - let relay: TRelays; - if (isInstanceRelay(relayName)) { - relay = await relayDAL.findOne({ name: relayName }); - } else { - relay = await relayDAL.findOne({ orgId, name: relayName }); + let relay: TRelays = await relayDAL.findOne({ orgId, name: relayName }); + if (!relay) { + relay = await relayDAL.findOne({ name: relayName, orgId: null }); } if (!relay) { @@ -515,7 +512,7 @@ export const gatewayV2ServiceFactory = ({ return { gatewayId: gateway.id, - relayIp: relayCredentials.relayIp, + relayHost: relayCredentials.relayHost, pki: { serverCertificate: gatewayServerCertificate.toString("pem"), serverPrivateKey: gatewayServerCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(), @@ -613,7 +610,7 @@ export const gatewayV2ServiceFactory = ({ }, { protocol: GatewayProxyProtocol.Ping, - relayIp: gatewayV2ConnectionDetails.relayIp, + relayHost: gatewayV2ConnectionDetails.relayHost, gateway: gatewayV2ConnectionDetails.gateway, relay: gatewayV2ConnectionDetails.relay } diff --git a/backend/src/ee/services/relay/relay-fns.ts b/backend/src/ee/services/relay/relay-fns.ts deleted file mode 100644 index f33210798..000000000 --- a/backend/src/ee/services/relay/relay-fns.ts +++ /dev/null @@ -1,5 +0,0 @@ -export const INSTANCE_RELAY_PREFIX = "infisical-"; - -export const isInstanceRelay = (relayName: string) => { - return relayName.startsWith(INSTANCE_RELAY_PREFIX); -}; diff --git a/backend/src/ee/services/relay/relay-service.ts b/backend/src/ee/services/relay/relay-service.ts index 90e1e02ee..6bc938c77 100644 --- a/backend/src/ee/services/relay/relay-service.ts +++ b/backend/src/ee/services/relay/relay-service.ts @@ -19,7 +19,6 @@ import { SshCertKeyAlgorithm } from "../ssh-certificate/ssh-certificate-types"; import { TInstanceRelayConfigDALFactory } from "./instance-relay-config-dal"; import { TOrgRelayConfigDALFactory } from "./org-relay-config-dal"; import { TRelayDALFactory } from "./relay-dal"; -import { isInstanceRelay } from "./relay-fns"; export type TRelayServiceFactory = ReturnType; @@ -588,7 +587,7 @@ export const relayServiceFactory = ({ }; const $generateRelayServerCredentials = async ({ - ip, + host, orgId, relayPkiServerCaCertificate, relayPkiServerCaPrivateKey, @@ -597,7 +596,7 @@ export const relayServiceFactory = ({ relaySshClientCaPublicKey, relaySshServerCaPrivateKey }: { - ip: string; + host: string; relayPkiServerCaCertificate: Buffer; relayPkiServerCaPrivateKey: Buffer; relayPkiClientCaCertificateChain: Buffer; @@ -640,13 +639,13 @@ export const relayServiceFactory = ({ ), new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true), // san - new x509.SubjectAlternativeNameExtension([{ type: "ip", value: ip }], false) + new x509.SubjectAlternativeNameExtension([{ type: "ip", value: host }], false) ]; const relayServerSerialNumber = createSerialNumber(); const relayServerCertificate = await x509.X509CertificateGenerator.create({ serialNumber: relayServerSerialNumber, - subject: `CN=${ip},O=${orgId ?? "Infisical"},OU=Relay`, + subject: `CN=${host},O=${orgId ?? "Infisical"},OU=Relay`, issuer: relayServerCaCert.subject, notBefore: relayServerCertIssuedAt, notAfter: relayServerCertExpireAt, @@ -665,7 +664,7 @@ export const relayServiceFactory = ({ caPrivateKey: relaySshServerCaPrivateKey.toString("utf8"), clientPublicKey: relayServerSshPublicKey, keyId: "relay-server", - principals: [`${ip}:2222`], + principals: [`${host}:2222`], certType: SshCertType.HOST, requestedTtl: "30d" }); @@ -772,15 +771,15 @@ export const relayServiceFactory = ({ orgId: string; gatewayId: string; }) => { - let relay: TRelays | null; - if (isInstanceRelay(relayName)) { + let relay: TRelays | null = await relayDAL.findOne({ + orgId, + name: relayName + }); + + if (!relay) { relay = await relayDAL.findOne({ - name: relayName - }); - } else { - relay = await relayDAL.findOne({ - orgId, - name: relayName + name: relayName, + orgId: null }); } @@ -794,7 +793,7 @@ export const relayServiceFactory = ({ const { publicKey: relayClientSshPublicKey, privateKey: relayClientSshPrivateKey } = await createSshKeyPair(keyAlgorithm); - if (isInstanceRelay(relayName)) { + if (relay.orgId === null) { const instanceCAs = await $getInstanceCAs(); const relayClientSshCert = await createSshCert({ caPrivateKey: instanceCAs.instanceRelaySshClientCaPrivateKey.toString("utf8"), @@ -806,7 +805,7 @@ export const relayServiceFactory = ({ }); return { - relayIp: relay.ip, + relayHost: relay.host, clientSshCert: relayClientSshCert.signedPublicKey, clientSshPrivateKey: relayClientSshPrivateKey, serverCAPublicKey: instanceCAs.instanceRelaySshServerCaPublicKey.toString("utf8") @@ -824,7 +823,7 @@ export const relayServiceFactory = ({ }); return { - relayIp: relay.ip, + relayHost: relay.host, clientSshCert: relayClientSshCert.signedPublicKey, clientSshPrivateKey: relayClientSshPrivateKey, serverCAPublicKey: orgCAs.relaySshServerCaPublicKey.toString("utf8") @@ -850,7 +849,7 @@ export const relayServiceFactory = ({ }); } - if (isInstanceRelay(relay.name)) { + if (relay.orgId === null) { const instanceCAs = await $getInstanceCAs(); const relayCertificateCredentials = await $generateRelayClientCredentials({ gatewayId, @@ -863,7 +862,7 @@ export const relayServiceFactory = ({ return { ...relayCertificateCredentials, - relayIp: relay.ip + relayHost: relay.host }; } @@ -879,17 +878,17 @@ export const relayServiceFactory = ({ return { ...relayCertificateCredentials, - relayIp: relay.ip + relayHost: relay.host }; }; const registerRelay = async ({ - ip, + host, name, identityId, orgId }: { - ip: string; + host: string; name: string; identityId?: string; orgId?: string; @@ -898,12 +897,6 @@ export const relayServiceFactory = ({ const isOrgRelay = identityId && orgId; if (isOrgRelay) { - if (isInstanceRelay(name)) { - throw new BadRequestError({ - message: "Org relay name cannot start with 'infisical-'. This is reserved for internal use." - }); - } - relay = await relayDAL.transaction(async (tx) => { const existingRelay = await relayDAL.findOne( { @@ -913,7 +906,7 @@ export const relayServiceFactory = ({ tx ); - if (existingRelay && (existingRelay.ip !== ip || existingRelay.name !== name)) { + if (existingRelay && (existingRelay.host !== host || existingRelay.name !== name)) { throw new BadRequestError({ message: "Org relay with this machine identity already exists." }); @@ -922,7 +915,7 @@ export const relayServiceFactory = ({ if (!existingRelay) { return relayDAL.create( { - ip, + host, name, identityId, orgId @@ -934,30 +927,25 @@ export const relayServiceFactory = ({ return existingRelay; }); } else { - if (!isInstanceRelay(name)) { - throw new BadRequestError({ - message: "Instance relay name must start with 'infisical-'." - }); - } - relay = await relayDAL.transaction(async (tx) => { const existingRelay = await relayDAL.findOne( { - name + name, + orgId: null }, tx ); - if (existingRelay && existingRelay.ip !== ip) { + if (existingRelay && existingRelay.host !== host) { throw new BadRequestError({ - message: "Instance relay with this name already exists with a different IP address" + message: "Instance relay with this name already exists with a different host" }); } if (!existingRelay) { return relayDAL.create( { - ip, + host, name }, tx @@ -968,10 +956,10 @@ export const relayServiceFactory = ({ }); } - if (isInstanceRelay(name)) { + if (relay.orgId === null) { const instanceCAs = await $getInstanceCAs(); return $generateRelayServerCredentials({ - ip, + host, relayPkiServerCaCertificate: instanceCAs.instanceRelayPkiServerCaCertificate, relayPkiServerCaPrivateKey: instanceCAs.instanceRelayPkiServerCaPrivateKey, relayPkiClientCaCertificate: instanceCAs.instanceRelayPkiClientCaCertificate, @@ -984,7 +972,7 @@ export const relayServiceFactory = ({ if (relay.orgId) { const orgCAs = await $getOrgCAs(relay.orgId); return $generateRelayServerCredentials({ - ip, + host, orgId: relay.orgId, relayPkiServerCaCertificate: orgCAs.relayPkiServerCaCertificate, relayPkiServerCaPrivateKey: orgCAs.relayPkiServerCaPrivateKey, diff --git a/backend/src/lib/gateway-v2/gateway-v2.ts b/backend/src/lib/gateway-v2/gateway-v2.ts index e41560e86..a7f7db62e 100644 --- a/backend/src/lib/gateway-v2/gateway-v2.ts +++ b/backend/src/lib/gateway-v2/gateway-v2.ts @@ -19,23 +19,24 @@ interface IGatewayRelayServer { } const createRelayConnection = async ({ - relayIp, + relayHost, clientCertificate, clientPrivateKey, serverCertificateChain }: { - relayIp: string; + relayHost: string; clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string; }): Promise => { - const [targetHost] = await verifyHostInputValidity(relayIp); - const [, portStr] = relayIp.split(":"); + const [targetHost] = await verifyHostInputValidity(relayHost); + const [, portStr] = relayHost.split(":"); const port = parseInt(portStr, 10) || 8443; const serverCAs = splitPemChain(serverCertificateChain); const tlsOptions: tls.ConnectionOptions = { host: targetHost, + servername: relayHost, port, cert: clientCertificate, key: clientPrivateKey, @@ -121,13 +122,13 @@ const createGatewayConnection = async ( const setupRelayServer = async ({ protocol, - relayIp, + relayHost, gateway, relay, httpsAgent }: { protocol: GatewayProxyProtocol; - relayIp: string; + relayHost: string; gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string }; relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string }; httpsAgent?: https.Agent; @@ -145,7 +146,7 @@ const setupRelayServer = async ({ // Stage 1: Connect to relay with TLS const relayConn = await createRelayConnection({ - relayIp, + relayHost, clientCertificate: relay.clientCertificate, clientPrivateKey: relay.clientPrivateKey, serverCertificateChain: relay.serverCertificateChain @@ -244,17 +245,17 @@ export const withGatewayV2Proxy = async ( callback: (port: number) => Promise, options: { protocol: GatewayProxyProtocol; - relayIp: string; + relayHost: string; gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string }; relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string }; httpsAgent?: https.Agent; } ): Promise => { - const { protocol, relayIp, gateway, relay, httpsAgent } = options; + const { protocol, relayHost, gateway, relay, httpsAgent } = options; const { port, cleanup, getRelayError } = await setupRelayServer({ protocol, - relayIp, + relayHost, gateway, relay, httpsAgent diff --git a/backend/src/services/app-connection/github/github-connection-fns.ts b/backend/src/services/app-connection/github/github-connection-fns.ts index 8ed6afad0..5cbf5c60d 100644 --- a/backend/src/services/app-connection/github/github-connection-fns.ts +++ b/backend/src/services/app-connection/github/github-connection-fns.ts @@ -105,7 +105,7 @@ export const requestWithGitHubGateway = async ( }, { protocol: GatewayProxyProtocol.Tcp, - relayIp: gatewayConnectionDetails.relayIp, + relayHost: gatewayConnectionDetails.relayHost, gateway: gatewayConnectionDetails.gateway, relay: gatewayConnectionDetails.relay } diff --git a/backend/src/services/app-connection/shared/sql/sql-connection-fns.ts b/backend/src/services/app-connection/shared/sql/sql-connection-fns.ts index 8080b0708..ca50bae8a 100644 --- a/backend/src/services/app-connection/shared/sql/sql-connection-fns.ts +++ b/backend/src/services/app-connection/shared/sql/sql-connection-fns.ts @@ -142,7 +142,7 @@ export const executeWithPotentialGateway = async ( }, { protocol: GatewayProxyProtocol.Tcp, - relayIp: platformConnectionDetails.relayIp, + relayHost: platformConnectionDetails.relayHost, gateway: platformConnectionDetails.gateway, relay: platformConnectionDetails.relay } diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts index 97e86e8fd..bc231c6d6 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts @@ -114,7 +114,7 @@ export const identityKubernetesAuthServiceFactory = ({ }, { protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp, - relayIp: gatewayV2ConnectionDetails.relayIp, + relayHost: gatewayV2ConnectionDetails.relayHost, gateway: gatewayV2ConnectionDetails.gateway, relay: gatewayV2ConnectionDetails.relay, httpsAgent diff --git a/docs/cli/commands/relay.mdx b/docs/cli/commands/relay.mdx index f7843709c..7fadfa8d2 100644 --- a/docs/cli/commands/relay.mdx +++ b/docs/cli/commands/relay.mdx @@ -6,7 +6,7 @@ description: "Relay-related commands for Infisical including proxy components" ```bash - infisical relay start --type= --ip= --name= --auth-method= + infisical relay start --type= --host= --name= --auth-method= ``` @@ -25,7 +25,7 @@ The relay system uses SSH reverse tunnels over TCP, eliminating firewall complex Run the Infisical relay component. The relay handles network traffic routing and can operate in different modes. ```bash -infisical relay start --type= --ip= --name= --auth-method= +infisical relay start --type= --host= --name= --auth-method= ``` ### Flags @@ -38,20 +38,23 @@ infisical relay start --type= --ip= --name= --auth-method= infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay + INFISICAL_PROXY_AUTH_SECRET= infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay ``` - - The public IP address of the instance where the relay is deployed. This must be a static public IP that gateways can reach. + + The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach. ```bash - # Example - infisical relay start --ip=203.0.113.100 --type=org --name=my-relay + # Example with IP address + infisical relay start --host=203.0.113.100 --type=org --name=my-relay + + # Example with hostname + infisical relay start --host=relay.example.com --type=org --name=my-relay ``` @@ -61,7 +64,7 @@ infisical relay start --type= --ip= --name= --auth-method= @@ -76,10 +79,10 @@ Shared relay servers that serve all organizations on your Infisical instance. Fo ```bash # Organization relay with Universal Auth (customer-deployed) -infisical relay start --type=org --ip=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id= --client-secret= +infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id= --client-secret= # Instance relay (configured by instance admin) -INFISICAL_PROXY_AUTH_SECRET= infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay +INFISICAL_PROXY_AUTH_SECRET= infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay ``` ### Authentication Methods @@ -105,7 +108,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=universal-auth --client-id= --client-secret= --type=org --ip= --name= + infisical relay start --auth-method=universal-auth --client-id= --client-secret= --type=org --host= --name= ``` @@ -129,7 +132,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=kubernetes --machine-identity-id= --type=org --ip= --name= + infisical relay start --auth-method=kubernetes --machine-identity-id= --type=org --host= --name= ``` @@ -150,7 +153,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=azure --machine-identity-id= --type=org --ip= --name= + infisical relay start --auth-method=azure --machine-identity-id= --type=org --host= --name= ``` @@ -171,7 +174,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=gcp-id-token --machine-identity-id= --type=org --ip= --name= + infisical relay start --auth-method=gcp-id-token --machine-identity-id= --type=org --host= --name= ``` @@ -193,7 +196,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= --type=org --ip= --name= + infisical relay start --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= --type=org --host= --name= ``` @@ -212,7 +215,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=aws-iam --machine-identity-id= --type=org --ip= --name= + infisical relay start --auth-method=aws-iam --machine-identity-id= --type=org --host= --name= ``` @@ -234,7 +237,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=oidc-auth --machine-identity-id= --jwt= --type=org --ip= --name= + infisical relay start --auth-method=oidc-auth --machine-identity-id= --jwt= --type=org --host= --name= ``` @@ -258,7 +261,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --auth-method=jwt-auth --jwt= --machine-identity-id= --type=org --ip= --name= + infisical relay start --auth-method=jwt-auth --jwt= --machine-identity-id= --type=org --host= --name= ``` @@ -274,7 +277,7 @@ The Infisical CLI supports multiple authentication methods for organization rela ```bash - infisical relay start --token= --type=org --ip= --name= + infisical relay start --token= --type=org --host= --name= ``` diff --git a/docs/documentation/platform/gateways/networking.mdx b/docs/documentation/platform/gateways/networking.mdx index ca99a4e92..2b068a535 100644 --- a/docs/documentation/platform/gateways/networking.mdx +++ b/docs/documentation/platform/gateways/networking.mdx @@ -30,7 +30,7 @@ The gateway requires the following outbound connectivity: **For Instance Relays (Infisical Cloud):** Your firewall must allow outbound connectivity to Infisical-managed relay servers. -**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses. +**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses or hostnames. **For Self-hosted Instance Relays:** Your firewall must allow outbound connectivity to relay servers configured by your instance administrator. @@ -42,15 +42,16 @@ The gateway requires the following outbound connectivity: connections to the desired relay server IP on port 2222. - You control the relay server IP addresses when deploying your own - organization relays. **Firewall requirements:** Allow outbound TCP - connections to your relay server IP on port 2222. For example, if your relay - is at `203.0.113.100`, allow TCP to `203.0.113.100:2222`. + You control the relay server IP addresses or hostnames when deploying your + own organization relays. **Firewall requirements:** Allow outbound TCP + connections to your relay server IP or hostname on port 2222. For example, + if your relay is at `203.0.113.100` or `relay.example.com`, allow TCP to + `203.0.113.100:2222` or `relay.example.com:2222`. - Contact your instance administrator for the relay server IP addresses - configured for your deployment. **Firewall requirements:** Allow outbound - TCP connections to instance relay servers on port 2222. + Contact your instance administrator for the relay server IP addresses or + hostnames configured for your deployment. **Firewall requirements:** Allow + outbound TCP connections to instance relay servers on port 2222. @@ -81,7 +82,7 @@ SSH connections over TCP are stateful and handled seamlessly by all modern firew Since SSH uses TCP, you only need simple outbound rules: -1. **Allow outbound TCP** to relay servers on port 2222 +1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222 2. **Allow outbound HTTPS** to Infisical API endpoints on port 443 3. **No inbound rules required** - all connections are outbound only @@ -91,7 +92,7 @@ Since SSH uses TCP, you only need simple outbound rules: For corporate environments with strict egress filtering: -1. **Allow outbound TCP** to relay servers on port 2222 +1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222 2. **Allow outbound HTTPS** to the Infisical API server on port 443 3. **No inbound rules required** - all connections are outbound only 4. **Standard TCP rules** - simple and straightforward configuration @@ -100,7 +101,7 @@ For corporate environments with strict egress filtering: Configure security groups to allow: -- **Outbound TCP** to relay servers on port 2222 +- **Outbound TCP** to relay servers (IP addresses or hostnames) on port 2222 - **Outbound HTTPS** to app.infisical.com/eu.infisical.com on port 443 - **No inbound rules required** - SSH reverse tunnels are outbound only @@ -146,7 +147,7 @@ This design maintains security by avoiding the need for inbound firewall rules t If your firewall has strict outbound restrictions: -1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers +1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers (IP addresses or hostnames) 2. **Allow standard SSH traffic** - most enterprises already have SSH policies in place 3. **Consider network policy exceptions** for the gateway host if needed 4. **Monitor firewall logs** to identify which specific rules are blocking traffic