awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): fips inside, AWS patch-up and docker improvements

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-07 21:56:07 +04:00
parent ce88b0cbb1
commit 30e901c00c
17 changed files with 1048 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
Dockerfile.fips.standalone-infisical
View File

@@ -73,6 +73,17 @@ RUN apt-get update && apt-get install -y \
# Configure ODBC
RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsS.so\nFileUsage = 1\n" > /etc/odbcinst.ini
# Build and install FIPS validated OpenSSL
WORKDIR /openssl-build
RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
&& tar -xf openssl-3.1.2.tar.gz \
&& cd openssl-3.1.2 \
&& ./Configure enable-fips \
&& make \
&& make install_fips
COPY backend/package*.json ./
RUN npm ci --only-production
@@ -103,6 +114,15 @@ RUN apt-get update && apt-get install -y \
# Configure ODBC
RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsS.so\nFileUsage = 1\n" > /etc/odbcinst.ini
# Build and install FIPS validated OpenSSL
WORKDIR /openssl-build
RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
&& tar -xf openssl-3.1.2.tar.gz \
&& cd openssl-3.1.2 \
&& ./Configure enable-fips \
&& make \
&& make install_fips
COPY backend/package*.json ./
RUN npm ci --only-production
@@ -173,6 +193,12 @@ ENV STANDALONE_MODE true
ENV ChrystokiConfigurationPath=/usr/safenet/lunaclient/
ENV NODE_OPTIONS="--max-old-space-size=1024"
# FIPS mode of operation:
ENV OPENSSL_CONF=/backend/nodejs.fips.cnf
ENV OPENSSL_MODULES=/usr/local/lib/ossl-modules
ENV NODE_OPTIONS=--force-fips
ENV FIPS_ENABLED=true
WORKDIR /backend
ENV TELEMETRY_ENABLED true