awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed comments

Browse Source
This commit is contained in:
Sheen Capadngan
2025-09-09 03:42:52 +08:00
parent b7dcc10731
commit 18398457e0
14 changed files with 99 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
docs/cli/commands/relay.mdx
View File

@@ -6,7 +6,7 @@ description: "Relay-related commands for Infisical including proxy components"
<Tabs>
<Tab title="Start relay">
```bash
infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-method>
infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
```
</Tab>
</Tabs>
@@ -25,7 +25,7 @@ The relay system uses SSH reverse tunnels over TCP, eliminating firewall complex
Run the Infisical relay component. The relay handles network traffic routing and can operate in different modes.
```bash
infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-method>
infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
```
### Flags
@@ -38,20 +38,23 @@ infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-
```bash
# Organization relay (customer-deployed)
infisical relay start --type=org --ip=192.168.1.100 --name=my-org-relay
infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay
# Instance relay (configured by instance admin)
INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay
INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
```
</Accordion>
<Accordion title="--ip">
The public IP address of the instance where the relay is deployed. This must be a static public IP that gateways can reach.
<Accordion title="--host">
The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach.
```bash
# Example
infisical relay start --ip=203.0.113.100 --type=org --name=my-relay
# Example with IP address
infisical relay start --host=203.0.113.100 --type=org --name=my-relay
# Example with hostname
infisical relay start --host=relay.example.com --type=org --name=my-relay
```
</Accordion>
@@ -61,7 +64,7 @@ infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-
```bash
# Example
infisical relay start --name=my-relay --type=org --ip=192.168.1.100
infisical relay start --name=my-relay --type=org --host=192.168.1.100
```
</Accordion>
@@ -76,10 +79,10 @@ Shared relay servers that serve all organizations on your Infisical instance. Fo
```bash
# Organization relay with Universal Auth (customer-deployed)
infisical relay start --type=org --ip=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
# Instance relay (configured by instance admin)
INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay
INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
```
### Authentication Methods
@@ -105,7 +108,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
</ParamField>
```bash
infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -129,7 +132,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
```bash
infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -150,7 +153,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
```bash
infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -171,7 +174,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
```bash
infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -193,7 +196,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
</ParamField>
```bash
infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -212,7 +215,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
</ParamField>
```bash
infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -234,7 +237,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
</ParamField>
```bash
infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -258,7 +261,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
```bash
infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
```
</Accordion>
@@ -274,7 +277,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
</ParamField>
```bash
infisical relay start --token=<token> --type=org --ip=<ip> --name=<name>
infisical relay start --token=<token> --type=org --host=<host> --name=<name>
```
</Accordion>

25
docs/documentation/platform/gateways/networking.mdx
View File

@@ -30,7 +30,7 @@ The gateway requires the following outbound connectivity:
**For Instance Relays (Infisical Cloud):** Your firewall must allow outbound connectivity to Infisical-managed relay servers.
**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses.
**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses or hostnames.
**For Self-hosted Instance Relays:** Your firewall must allow outbound connectivity to relay servers configured by your instance administrator.
@@ -42,15 +42,16 @@ The gateway requires the following outbound connectivity:
connections to the desired relay server IP on port 2222.
</Tab>
<Tab title="Organization Relays">
You control the relay server IP addresses when deploying your own
organization relays. **Firewall requirements:** Allow outbound TCP
connections to your relay server IP on port 2222. For example, if your relay
is at `203.0.113.100`, allow TCP to `203.0.113.100:2222`.
You control the relay server IP addresses or hostnames when deploying your
own organization relays. **Firewall requirements:** Allow outbound TCP
connections to your relay server IP or hostname on port 2222. For example,
if your relay is at `203.0.113.100` or `relay.example.com`, allow TCP to
`203.0.113.100:2222` or `relay.example.com:2222`.
</Tab>
<Tab title="Self-hosted Instance Relays">
Contact your instance administrator for the relay server IP addresses
configured for your deployment. **Firewall requirements:** Allow outbound
TCP connections to instance relay servers on port 2222.
Contact your instance administrator for the relay server IP addresses or
hostnames configured for your deployment. **Firewall requirements:** Allow
outbound TCP connections to instance relay servers on port 2222.
</Tab>
</Tabs>
@@ -81,7 +82,7 @@ SSH connections over TCP are stateful and handled seamlessly by all modern firew
Since SSH uses TCP, you only need simple outbound rules:
1. **Allow outbound TCP** to relay servers on port 2222
1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
2. **Allow outbound HTTPS** to Infisical API endpoints on port 443
3. **No inbound rules required** - all connections are outbound only
@@ -91,7 +92,7 @@ Since SSH uses TCP, you only need simple outbound rules:
For corporate environments with strict egress filtering:
1. **Allow outbound TCP** to relay servers on port 2222
1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
2. **Allow outbound HTTPS** to the Infisical API server on port 443
3. **No inbound rules required** - all connections are outbound only
4. **Standard TCP rules** - simple and straightforward configuration
@@ -100,7 +101,7 @@ For corporate environments with strict egress filtering:
Configure security groups to allow:
- **Outbound TCP** to relay servers on port 2222
- **Outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
- **Outbound HTTPS** to app.infisical.com/eu.infisical.com on port 443
- **No inbound rules required** - SSH reverse tunnels are outbound only
@@ -146,7 +147,7 @@ This design maintains security by avoiding the need for inbound firewall rules t
<Accordion title="What if my firewall blocks SSH connections?">
If your firewall has strict outbound restrictions:
1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers
1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers (IP addresses or hostnames)
2. **Allow standard SSH traffic** - most enterprises already have SSH policies in place
3. **Consider network policy exceptions** for the gateway host if needed
4. **Monitor firewall logs** to identify which specific rules are blocking traffic