mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-08 00:27:35 +00:00
Merge branch 'main' into feat/zabbixSyncIntegration
This commit is contained in:
Carlos Monastyrski
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Attach"
|
||||
openapi: "POST /api/v1/auth/tls-cert-auth/identities/{identityId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Login"
|
||||
openapi: "POST /api/v1/auth/tls-cert-auth/login"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Retrieve"
|
||||
openapi: "GET /api/v1/auth/tls-cert-auth/identities/{identityId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Revoke"
|
||||
openapi: "DELETE /api/v1/auth/tls-cert-auth/identities/{identityId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/auth/tls-cert-auth/identities/{identityId}"
|
||||
---
|
||||
+32
-11
@@ -35,19 +35,40 @@ infisical user update domain
|
||||
<Accordion title="infisical user get token">
|
||||
Use this command to get your current Infisical access token and session information. This command requires you to be logged in.
|
||||
|
||||
The command will display:
|
||||
The command will display:
|
||||
|
||||
- Your session ID
|
||||
- Your full JWT access token
|
||||
- Your session ID
|
||||
- Your full JWT access token
|
||||
|
||||
```bash
|
||||
infisical user get token
|
||||
```
|
||||
```bash
|
||||
infisical user get token
|
||||
```
|
||||
|
||||
Example output:
|
||||
Example output:
|
||||
|
||||
```bash
|
||||
Session ID: abc123-xyz-456
|
||||
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
|
||||
```
|
||||
|
||||
### Flags
|
||||
|
||||
<Accordion title="--plain">
|
||||
Output only the JWT token without formatting (no session ID)
|
||||
|
||||
Default value: `false`
|
||||
|
||||
```bash
|
||||
# Example
|
||||
infisical user get token --plain
|
||||
```
|
||||
|
||||
Example output:
|
||||
|
||||
```bash
|
||||
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
```bash
|
||||
Session ID: abc123-xyz-456
|
||||
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
@@ -288,6 +288,7 @@
|
||||
"documentation/platform/identities/kubernetes-auth",
|
||||
"documentation/platform/identities/oci-auth",
|
||||
"documentation/platform/identities/token-auth",
|
||||
"documentation/platform/identities/tls-cert-auth",
|
||||
"documentation/platform/identities/universal-auth",
|
||||
{
|
||||
"group": "OIDC Auth",
|
||||
@@ -754,6 +755,16 @@
|
||||
"api-reference/endpoints/alicloud-auth/revoke"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "TLS Certificate Auth",
|
||||
"pages": [
|
||||
"api-reference/endpoints/tls-cert-auth/login",
|
||||
"api-reference/endpoints/tls-cert-auth/attach",
|
||||
"api-reference/endpoints/tls-cert-auth/retrieve",
|
||||
"api-reference/endpoints/tls-cert-auth/update",
|
||||
"api-reference/endpoints/tls-cert-auth/revoke"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "AWS Auth",
|
||||
"pages": [
|
||||
|
||||
@@ -0,0 +1,176 @@
|
||||
---
|
||||
title: TLS Certificate Auth
|
||||
description: "Learn how to authenticate with Infisical using TLS Certificate."
|
||||
---
|
||||
|
||||
**TLS Certificate Auth** is an authentication method that verifies a user's TLS Client certificate using the provided CA Certificate, allowing secure access to Infisical resources.
|
||||
|
||||
## Diagram
|
||||
|
||||
The following sequence diagram illustrates the TLS Certificate Auth workflow for authenticating users with Infisical.
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant Client
|
||||
participant Infisical
|
||||
|
||||
Note over Client,Client: Step 1: Setup your TLS request with the client certificate
|
||||
|
||||
Note over Client,Infisical: Step 2: Login Operation
|
||||
Client->>Infisical: Send request to /api/v1/auth/tls-cert-auth/login
|
||||
|
||||
Note over Infisical: Step 3: Request verification using CA Certificate
|
||||
|
||||
Infisical->>Client: Return short-lived access token
|
||||
|
||||
Note over Client,Infisical: Step 5: Access Infisical API with token
|
||||
Client->>Infisical: Make authenticated requests using the short-lived access token
|
||||
```
|
||||
|
||||
## Concept
|
||||
|
||||
At a high level, Infisical authenticates the client's TLS Certificate by verifying its identity and checking that it meets specific requirements (e.g., it is bound to the allowed common names) at the `/api/v1/auth/tls-cert-auth/login` endpoint. If successful, Infisical returns a short-lived access token that can be used to make authenticated requests to the Infisical API.
|
||||
|
||||
To be more specific:
|
||||
|
||||
1. The client sends a TLS request with the client certificate to Infisical at the `/api/v1/auth/tls-cert-auth/login` endpoint.
|
||||
2. Infisical verifies the incoming request using the provided CA certificate.
|
||||
3. Infisical checks the user's properties against set criteria such as Allowed Common Names.
|
||||
4. If all checks pass, Infisical returns a short-lived access token that the client can use to make authenticated requests to the Infisical API.
|
||||
|
||||
<Accordion title="TLS with Load Balancer/Proxy">
|
||||
Most of the time, the Infisical server will be behind a load balancer or
|
||||
proxy. To propagate the TLS certificate from the load balancer to the
|
||||
instance, you can configure the TLS to send the client certificate as a header
|
||||
that is set as an [environment
|
||||
variable](/self-hosting/configuration/envars#param-identity-tls-cert-auth-client-certificate-header-key).
|
||||
</Accordion>
|
||||
|
||||
## Guide
|
||||
|
||||
In the following steps, we explore how to create and use identities for your workloads and applications on TLS Certificate to
|
||||
access the Infisical API using request signing.
|
||||
|
||||
<Warning>
|
||||
**Self-Hosted Users:** Before using TLS Certificate Auth, please review the
|
||||
[Security Requirements for Self-Hosted
|
||||
Deployments](#security-requirements-for-self-hosted-deployments) section below
|
||||
to ensure proper configuration and avoid security vulnerabilities.
|
||||
</Warning>
|
||||
|
||||
### Creating an identity
|
||||
|
||||
To create an identity, head to your Organization Settings > Access Control > [Identities](https://app.infisical.com/organization/access-management?selectedTab=identities) and press **Create identity**.
|
||||
|
||||
|
||||
|
||||
When creating an identity, you specify an organization-level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
|
||||
|
||||
|
||||
|
||||
Input some details for your new identity:
|
||||
|
||||
- **Name (required):** A friendly name for the identity.
|
||||
- **Role (required):** A role from the [**Organization Roles**](https://app.infisical.com/organization/access-management?selectedTab=roles) tab for the identity to assume. The organization role assigned will determine what organization-level resources this identity can have access to.
|
||||
|
||||
Once you've created an identity, you'll be redirected to a page where you can manage the identity.
|
||||
|
||||
|
||||
|
||||
Since the identity has been configured with [Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth) by default, you should reconfigure it to use TLS Certificate Auth instead. To do this, click the cog next to **Universal Auth** and then select **Delete** in the options dropdown.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Now create a new TLS Certificate Auth Method.
|
||||
|
||||
|
||||
|
||||
Here's some information about each field:
|
||||
|
||||
- **CA Certificate:** A PEM encoded CA Certificate used to validate incoming TLS request client certificate.
|
||||
- **Allowed Common Names:** A comma separated list of client certificate common names allowed.
|
||||
- **Access Token TTL (default is `2592000` equivalent to 30 days):** The lifetime for an access token in seconds. This value will be referenced at renewal time.
|
||||
- **Access Token Max TTL (default is `2592000` equivalent to 30 days):** The maximum lifetime for an access token in seconds. This value will be referenced at renewal time.
|
||||
- **Access Token Max Number of Uses (default is `0`):** The maximum number of times that an access token can be used; a value of `0` implies an infinite number of uses.
|
||||
- **Access Token Trusted IPs:** The IPs or CIDR ranges that access tokens can be used from. By default, each token is given the `0.0.0.0/0`, allowing usage from any network address.
|
||||
|
||||
### Adding an identity to a project
|
||||
|
||||
In order to allow an identity to access project-level resources such as secrets, you must add it to the relevant projects.
|
||||
|
||||
To do this, head over to the project you want to add the identity to and navigate to Project Settings > Access Control > Machine Identities and press **Add Identity**.
|
||||
|
||||
|
||||
|
||||
Select the identity you want to add to the project and the project-level role you want it to assume. The project role given to the identity will determine what project-level resources this identity can access.
|
||||
|
||||
|
||||
|
||||
### Accessing the Infisical API with the identity
|
||||
|
||||
To access the Infisical API as the identity, you need to send a TLS request to `/api/v1/auth/tls-cert-auth/login` endpoint.
|
||||
|
||||
Below is an example of how you can authenticate with Infisical using NodeJS.
|
||||
|
||||
```javascript
|
||||
const fs = require("fs");
|
||||
const https = require("https");
|
||||
const axios = require("axios");
|
||||
|
||||
try {
|
||||
const clientCertificate = fs.readFileSync("client-cert.pem", "utf8");
|
||||
const clientKeyCertificate = fs.readFileSync("client-key.pem", "utf8");
|
||||
|
||||
const infisicalUrl = "https://app.infisical.com"; // or your self-hosted Infisical URL
|
||||
const identityId = "<your-identity-id>";
|
||||
|
||||
// Create HTTPS agent with client certificate and key
|
||||
const httpsAgent = new https.Agent({
|
||||
cert: clientCertificate,
|
||||
key: clientKeyCertificate,
|
||||
});
|
||||
|
||||
const { data } = await axios.post(
|
||||
`${infisicalUrl}/api/v1/auth/tls-cert-auth/login`,
|
||||
{
|
||||
identityId,
|
||||
},
|
||||
{
|
||||
httpsAgent: httpsAgent, // Pass the HTTPS agent with client cert
|
||||
}
|
||||
);
|
||||
|
||||
console.log("result data: ", data); // access token here
|
||||
} catch (err) {
|
||||
console.error(err);
|
||||
}
|
||||
```
|
||||
|
||||
<Note>
|
||||
Each identity access token has a time-to-live (TTL) which you can infer from the response of the login operation; the default TTL is `7200` seconds, which can be adjusted.
|
||||
|
||||
If an identity access token expires, it can no longer access the Infisical API. A new access token should be obtained by performing another login operation.
|
||||
|
||||
</Note>
|
||||
|
||||
## Security Requirements for Self-Hosted Deployments
|
||||
|
||||
ALL TLS cert [login](/api-reference/endpoints/tls-cert-auth/login) requests **MUST** go through a load balancer/proxy that verifies certificate ownership:
|
||||
|
||||
- **REQUIRED:** Configure your load balancer/proxy to **require a proper TLS handshake with client certificate presentation**
|
||||
- **REQUIRED:** Ensure the load balancer **verifies the client possesses the private key** corresponding to the certificate (standard TLS behavior)
|
||||
- **NEVER** allow direct connections to Infisical for TLS cert auth - this enables header injection attacks
|
||||
- **NEVER** forward certificate headers without requiring proper TLS certificate presentation
|
||||
|
||||
### Load Balancer Configuration Examples
|
||||
|
||||
- **AWS ALB:** Use mTLS listeners which require client certificate presentation during the TLS handshake
|
||||
- **NGINX/HAProxy:** Configure SSL client certificate requirement with proper TLS handshake verification
|
||||
|
||||
<Note>
|
||||
Infisical will handle the actual certificate validation against the configured
|
||||
CA certificate and determine authentication permissions. The load balancer's
|
||||
role is to ensure certificate ownership, not certificate trust validation.
|
||||
</Note>
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.9 KiB After Width: | Height: | Size: 6.2 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 467 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 715 KiB After Width: | Height: | Size: 641 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 327 KiB |
@@ -44,8 +44,11 @@ Currently, the Infisical CSI provider only supports static secrets.
|
||||
|
||||
### Install Secrets Store CSI Driver
|
||||
|
||||
In order to use the Infisical CSI provider, you will first have to install the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation) to your cluster. It is important that you define
|
||||
the audience value for token requests as demonstrated below. The Infisical CSI provider will **NOT WORK** if this is not set.
|
||||
In order to use the Infisical CSI provider, you will first have to install the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation) to your cluster.
|
||||
|
||||
#### Standard Installation
|
||||
|
||||
For most Kubernetes clusters, use the following installation:
|
||||
|
||||
```bash
|
||||
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
|
||||
@@ -62,7 +65,7 @@ helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
|
||||
|
||||
The flags configure the following:
|
||||
|
||||
- `tokenRequests[0].audience=infisical`: Sets the audience value for service account token authentication (required)
|
||||
- `tokenRequests[0].audience=infisical`: Sets the audience value for service account token authentication (recommended for environments that support custom audiences)
|
||||
- `enableSecretRotation=true`: Enables automatic secret updates from Infisical
|
||||
- `rotationPollInterval=2m`: Checks for secret updates every 2 minutes
|
||||
- `syncSecret.enabled=true`: Enables syncing secrets to Kubernetes secrets
|
||||
@@ -76,6 +79,25 @@ The flags configure the following:
|
||||
for the CSI driver.
|
||||
</Info>
|
||||
|
||||
#### Installation for Environments Without Custom Audience Support
|
||||
|
||||
Some Kubernetes environments (such as AWS EKS) don't support custom audiences and will reject tokens with non-default audiences. For these environments, use this installation instead:
|
||||
|
||||
```bash
|
||||
helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
|
||||
--namespace=kube-system \
|
||||
--set enableSecretRotation=true \
|
||||
--set rotationPollInterval=2m \
|
||||
--set "syncSecret.enabled=true" \
|
||||
```
|
||||
|
||||
<Warning>
|
||||
**Environments without custom audience support**: Do not set a custom audience
|
||||
when installing the CSI driver in environments that reject custom audiences.
|
||||
Instead, use the installation above and set `useDefaultAudience: "true"` in
|
||||
your SecretProviderClass configuration.
|
||||
</Warning>
|
||||
|
||||
### Install Infisical CSI Provider
|
||||
|
||||
You would then have to install the Infisical CSI provider to your cluster.
|
||||
@@ -107,9 +129,12 @@ a machine identity with [Kubernetes authentication](https://infisical.com/docs/d
|
||||
You can refer to the documentation for setting it up [here](https://infisical.com/docs/documentation/platform/identities/kubernetes-auth#guide).
|
||||
|
||||
<Warning>
|
||||
The allowed audience field of the Kubernetes authentication settings should
|
||||
match the audience specified for the Secrets Store CSI driver during
|
||||
installation.
|
||||
**Important**: The "Allowed Audience" field in your machine identity's
|
||||
Kubernetes authentication settings must match your CSI driver installation. If
|
||||
you used the standard installation with `tokenRequests[0].audience=infisical`,
|
||||
set the "Allowed Audience" field to `infisical`. If you used the installation
|
||||
for environments without custom audience support, leave the "Allowed Audience"
|
||||
field empty.
|
||||
</Warning>
|
||||
|
||||
### Creating Secret Provider Class
|
||||
@@ -117,6 +142,8 @@ You can refer to the documentation for setting it up [here](https://infisical.co
|
||||
With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes [SecretProviderClass](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#secretproviderclass) resource to establish
|
||||
the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as many Secret Provider Classes as needed for your cluster.
|
||||
|
||||
#### Standard Configuration
|
||||
|
||||
```yaml
|
||||
apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
kind: SecretProviderClass
|
||||
@@ -139,6 +166,41 @@ spec:
|
||||
secretKey: "APP_SECRET"
|
||||
```
|
||||
|
||||
#### Configuration for Environments Without Custom Audience Support
|
||||
|
||||
For environments that don't support custom audiences (such as AWS EKS), use this configuration instead:
|
||||
|
||||
```yaml
|
||||
apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
kind: SecretProviderClass
|
||||
metadata:
|
||||
name: my-infisical-app-csi-provider
|
||||
spec:
|
||||
provider: infisical
|
||||
parameters:
|
||||
infisicalUrl: "https://app.infisical.com"
|
||||
authMethod: "kubernetes"
|
||||
useDefaultAudience: "true"
|
||||
identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
|
||||
projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
|
||||
envSlug: "prod"
|
||||
secrets: |
|
||||
- secretPath: "/"
|
||||
fileName: "dbPassword"
|
||||
secretKey: "DB_PASSWORD"
|
||||
- secretPath: "/app"
|
||||
fileName: "appSecret"
|
||||
secretKey: "APP_SECRET"
|
||||
```
|
||||
|
||||
<Note>
|
||||
**Key difference**: The only change from the standard configuration is the
|
||||
addition of `useDefaultAudience: "true"`. This parameter tells the CSI
|
||||
provider to use the default Kubernetes audience instead of a custom
|
||||
"infisical" audience, which is required for environments that reject custom
|
||||
audiences.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
The SecretProviderClass should be provisioned in the same namespace as the pod
|
||||
you intend to mount secrets to.
|
||||
@@ -189,6 +251,19 @@ spec:
|
||||
`infisical`.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="useDefaultAudience">
|
||||
When set to `"true"`, the Infisical CSI provider will use the default
|
||||
Kubernetes audience instead of a custom audience. This is required for
|
||||
environments that don't support custom audiences (such as AWS EKS), which
|
||||
reject tokens with non-default audiences. When using this option, do not set a
|
||||
custom audience in the CSI driver installation. This defaults to `false`.
|
||||
<Note>
|
||||
When enabled, the CSI provider will dynamically create service account
|
||||
tokens on-demand using the default Kubernetes audience, rather than using
|
||||
pre-existing tokens from the CSI driver.
|
||||
</Note>
|
||||
</Accordion>
|
||||
|
||||
### Using Secret Provider Class
|
||||
|
||||
A pod can use the Secret Provider Class by mounting it as a CSI volume:
|
||||
@@ -252,6 +327,11 @@ kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system
|
||||
- Invalid machine identity configuration
|
||||
- Incorrect secret paths or keys
|
||||
|
||||
**Issues in environments without custom audience support:**
|
||||
|
||||
- **Token authentication failed with custom audience**: If you're seeing authentication errors in environments that don't support custom audiences (such as AWS EKS), ensure you're using the installation without custom audience and have set `useDefaultAudience: "true"` in your SecretProviderClass
|
||||
- **Audience not allowed errors**: Make sure the "Allowed Audience" field is left empty in your machine identity's Kubernetes authentication configuration when using environments that don't support custom audiences
|
||||
|
||||
## Best Practices
|
||||
|
||||
For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation [here](https://secrets-store-csi-driver.sigs.k8s.io/topics/best-practices).
|
||||
|
||||
@@ -36,6 +36,7 @@ description: "Learn how to configure a 1Password Sync for Infisical."
|
||||
|
||||
- **1Password Connection**: The 1Password Connection to authenticate with.
|
||||
- **Vault**: The 1Password vault to sync secrets to.
|
||||
- **Value Label**: The label of the 1Password item field that will hold your secret value.
|
||||
</Step>
|
||||
<Step title="Configure sync options">
|
||||
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
@@ -94,7 +95,8 @@ description: "Learn how to configure a 1Password Sync for Infisical."
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"vaultId": "..."
|
||||
"vaultId": "...",
|
||||
"valueLabel": "value"
|
||||
}
|
||||
}'
|
||||
```
|
||||
@@ -145,7 +147,8 @@ description: "Learn how to configure a 1Password Sync for Infisical."
|
||||
},
|
||||
"destination": "1password",
|
||||
"destinationConfig": {
|
||||
"vaultId": "..."
|
||||
"vaultId": "...",
|
||||
"valueLabel": "value"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -160,4 +163,7 @@ description: "Learn how to configure a 1Password Sync for Infisical."
|
||||
Infisical can only perform CRUD operations on the following item types:
|
||||
- API Credentials
|
||||
</Accordion>
|
||||
<Accordion title="What is a 'Value Label'?">
|
||||
It's the label of the 1Password item field which will hold your secret value. For example, if you were to sync Infisical secret 'foo: bar', the 1Password item equivalent would have an item title of 'foo', and a field on that item 'value: bar'. The field label 'value' is what gets changed by this option.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -7,9 +7,10 @@ description: "Learn how to configure a GCP Secret Manager Sync for Infisical."
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [GCP Connection](/integrations/app-connections/gcp) with the required **Secret Sync** permissions
|
||||
- Enable **Cloud Resource Manager API** and **Secret Manager API** on your GCP project
|
||||
- Enable **Cloud Resource Manager API**, **Secret Manager API**, and **Service Usage API** on your GCP project
|
||||
|
||||
|
||||
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
|
||||
+2
-4
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 6.8 KiB After Width: | Height: | Size: 4.3 KiB |
+2
-4
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 6.8 KiB After Width: | Height: | Size: 4.3 KiB |
-2269
File diff suppressed because it is too large
Load Diff
@@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings
|
||||
<ParamField query="HOST" type="string" default="localhost" optional>
|
||||
Specifies the network interface Infisical will bind to when accepting incoming connections.
|
||||
|
||||
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
|
||||
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
|
||||
|
||||
To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
|
||||
|
||||
@@ -122,6 +122,7 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]
|
||||
</ParamField>
|
||||
|
||||
### Redis
|
||||
|
||||
Redis is used for caching and background tasks. You can use either a standalone Redis instance or a Redis Sentinel setup.
|
||||
|
||||
<Tabs>
|
||||
@@ -199,8 +200,17 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
connection can not be encrypted then message is not sent.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_TLS_REJECT_UNAUTHORIZED" type="bool" default="true" optional>
|
||||
If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
|
||||
<ParamField
|
||||
query="SMTP_TLS_REJECT_UNAUTHORIZED"
|
||||
type="bool"
|
||||
default="true"
|
||||
optional
|
||||
>
|
||||
If this is `true`, Infisical will validate the server's SSL/TLS certificate
|
||||
and reject the connection if the certificate is invalid or not trusted. If set
|
||||
to `false`, the client will accept the server's certificate regardless of its
|
||||
validity, which can be useful in development or testing environments but is
|
||||
not recommended for production use.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_CUSTOM_CA_CERT" type="string" default="none" optional>
|
||||
@@ -211,6 +221,7 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
Infisical highly encourages the following variables be used alongside this one for maximum security:
|
||||
- `SMTP_REQUIRE_TLS=true`
|
||||
- `SMTP_TLS_REJECT_UNAUTHORIZED=true`
|
||||
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
@@ -577,6 +588,7 @@ You can configure third-party app connections for re-use across Infisical Projec
|
||||
<ParamField query="INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET" type="string" default="none" optional>
|
||||
The webhook secret configured for payload verification in the GitHub Radar App
|
||||
</ParamField>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="GitHub OAuth Connection">
|
||||
@@ -771,3 +783,14 @@ If export type is set to `otlp`, you will have to configure a value for `OTEL_EX
|
||||
<ParamField query="OTEL_COLLECTOR_BASIC_AUTH_PASSWORD" type="string">
|
||||
The password for authenticating with the telemetry collector.
|
||||
</ParamField>
|
||||
|
||||
## Identity Auth Method
|
||||
|
||||
<ParamField
|
||||
query="IDENTITY_TLS_CERT_AUTH_CLIENT_CERTIFICATE_HEADER_KEY"
|
||||
type="string"
|
||||
default="x-identity-tls-cert-auth-client-cert"
|
||||
>
|
||||
The TLS header used to propagate the client certificate from the load balancer
|
||||
to the server.
|
||||
</ParamField>
|
||||
|
||||
Reference in New Issue
Block a user