From c1570930a9be4fa4bccc4b372a7f53dd017a83f3 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 11 Nov 2024 19:23:31 +0530 Subject: [PATCH 01/16] docs: added new docs for infisical package installation instructions --- docs/mint.json | 8 ++ .../linux-package/commands-configuration.mdx | 38 +++++++ .../native/linux-package/installation.mdx | 102 ++++++++++++++++++ .../native/linux-package/migration.mdx | 30 ++++++ docs/self-hosting/overview.mdx | 18 +--- 5 files changed, 182 insertions(+), 14 deletions(-) create mode 100644 docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx create mode 100644 docs/self-hosting/deployment-options/native/linux-package/installation.mdx create mode 100644 docs/self-hosting/deployment-options/native/linux-package/migration.mdx diff --git a/docs/mint.json b/docs/mint.json index 3ac96f0e3..b4fcb34c5 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -279,6 +279,14 @@ "self-hosting/deployment-options/kubernetes-helm" ] }, + { + "group": "Linux Package", + "pages": [ + "self-hosting/deployment-options/native/linux-package/installation", + "self-hosting/deployment-options/native/linux-package/migration", + "self-hosting/deployment-options/native/linux-package/commands-configuration" + ] + }, "self-hosting/configuration/envars", "self-hosting/configuration/requirements", { diff --git a/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx new file mode 100644 index 000000000..9746bce13 --- /dev/null +++ b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx @@ -0,0 +1,38 @@ +--- +title: "Commands and Configuration" +description: "Learn all the available commands and configuration of the linux package." +--- + +## Configuration + +All Infisical configuration is managed from a central file called `infisical.rb` located in the `/etc/infisical` directory. + + After updating the `infisical.rb` file, remember to run `infisical-ctl reconfigure` to apply the changes. + +### Example Configuration + +```ruby +# Important: Replace these values with secure keys in production +infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' +infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' + +# Database connection strings +infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:infisical@localhost:5432/infisical' +infisical_core['REDIS_URL'] = 'redis://localhost:6379' +``` + +For a complete list of configuration options, visit our [configuration variables documentation](/self-hosting/configuration/envars). + +## Available Commands + +The `infisical-ctl` command provides several options to manage your Infisical deployment: + +| Command | Description | +| --- | --- | +| `infisical-ctl reconfigure` | Restarts the Infisical services and applies any configuration changes | +| `infisical-ctl tail` | Shows the logs of the Infisical application | +| `infisical-ctl status` | Displays the current running status of the Infisical services | +| `infisical-ctl stop` | Stops the Infisical services | +| `infisical-ctl start` | Starts the Infisical services | + +For database migration-related commands, refer to the [Migrations Guide](/self-hosting/native/linux-package/migration). diff --git a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx new file mode 100644 index 000000000..91a171adf --- /dev/null +++ b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx @@ -0,0 +1,102 @@ +--- +title: "Installation" +description: "Learn how to deploy Infisical using linux package." +--- + +Infisical can be deployed on Linux virtual machines without containers using our Linux packages. Currently, we support Linux systems running on AMD64 architecture (ARM coming soon). + +This standalone deployment uses a "Bring Your Own Database" (BYOD) approach, meaning you'll need to provide your own PostgreSQL and Redis databases for Infisical services. These databases are not included in the package. + +## Prerequisites + +Before beginning the installation, ensure you have: + +- A server running a linux-based operating system (Ubuntu, Debian) or RHEL-based system +- A PostgreSQL database instance +- A Redis database instance + +## Installation Steps + + + +Choose your operating system below to install Infisical: + + + + First, add the Infisical repository: + ```bash + curl -1sLf \ + 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.deb.sh' \ + | sudo -E bash + ``` + + Then install Infisical: + ```bash + sudo apt-get update && sudo apt-get install -y infisical-core + ``` + + > **Note**: For production environments, we strongly recommend installing a specific version of the package to maintain consistency across reinstalls. View available versions at [Infisical Package Versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). + + + + + First, add the Infisical repository: + ```bash + curl -1sLf \ + 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.rpm.sh' \ + | sudo -E bash + ``` + + Then install Infisical: + ```bash + sudo yum install infisical-core + ``` + + > **Note**: For production environments, we strongly recommend installing a specific version of the package to maintain consistency across reinstalls. View available versions at [Infisical Package Versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). + + + + +To verify the installation, run: + +```bash +infisical-ctl help +``` + + + +Create an `infisical.rb` file in the `/etc/infisical` directory. This file will contain your database connections and other configuration settings. + + +```ruby +# Important: Replace these values with secure keys in production +infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' +infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' + +# Database connection strings +infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:infisical@localhost:5432/infisical' +infisical_core['REDIS_URL'] = 'redis://localhost:6379' +``` + + +For a complete list of configuration options, visit our [configuration variables documentation](/self-hosting/configuration/envars). + + + +1. Run the following command to start the Infisical server: + ```bash + infisical-ctl reconfigure + ``` + By default, the server will run on port `8080`. You can modify this in the `infisical.rb` configuration file. + +2. Monitor your deployment: + - Check the application status: + ```bash + infisical-ctl status + ``` + - View real-time logs: + ```bash + infisical-ctl tail + ``` + + diff --git a/docs/self-hosting/deployment-options/native/linux-package/migration.mdx b/docs/self-hosting/deployment-options/native/linux-package/migration.mdx new file mode 100644 index 000000000..50dca04af --- /dev/null +++ b/docs/self-hosting/deployment-options/native/linux-package/migration.mdx @@ -0,0 +1,30 @@ +--- +title: "Migration" +description: "Learn how to run migration using Infisical linux package." +--- + +By default, migrations automatically run each time you execute `infisical-ctl reconfigure`. This behavior may not be desirable when deploying with horizontal scaling. + +## Disable Auto Migration + +To disable automatic migrations, add the following configuration to your `infisical.rb` file: + +```ruby +infisical_core['auto_migration'] = false +``` + +## Migration Commands + +`infisical-ctl` provides several commands to manage database migrations. You can run these commands in two ways: + +- Provide the PostgreSQL database connection as an environment variable, or +- Let the system load the connection details from the Infisical application after reconfiguration + +| Command | Description | +| ---------------------------------- | --------------------------------------------------------------------------- | +| `infisical-ctl migration up` | Runs the next migration that hasn't been applied yet | +| `infisical-ctl migration down` | Reverts the most recent migration, undoing its changes | +| `infisical-ctl migration list` | Lists all available migration files without applying them | +| `infisical-ctl migration status` | Displays the status of each migration, showing which have been applied | +| `infisical-ctl migration latest` | Applies all pending migrations to bring the database up to date | +| `infisical-ctl migration rollback` | Reverts all applied migrations, returning the database to its initial state | diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index a7ea50e39..f1bbfe236 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -33,21 +33,11 @@ Choose from a number of deployment options listed below to get started. Use our Helm chart to Install Infisical on your Kubernetes cluster. -{/* - - Install Infisical on your Debian-based system without containers using our standalone binary. - - - Install Infisical on your Debian-based instances without containers using our standalone binary with high availability out of the box. - - */} + Install Infisical on your system without containers using our linux package. + From b330fdbc58196137fe2696318be8e01307f89ac2 Mon Sep 17 00:00:00 2001 From: x Date: Tue, 22 Apr 2025 14:36:31 -0400 Subject: [PATCH 02/16] Admin SSO bypass (breakglass login) sends out email to all org admins + creates audit log --- .../ee/services/audit-log/audit-log-types.ts | 7 +++ .../src/ee/services/license/license-fns.ts | 6 +- backend/src/server/routes/index.ts | 9 ++- .../src/services/auth/auth-login-service.ts | 61 ++++++++++++++++++- backend/src/services/org/org-dal.ts | 39 ++++++++++++ backend/src/services/smtp/smtp-service.ts | 1 + .../orgAdminBreakglassAccess.handlebars | 20 ++++++ frontend/src/hooks/api/auditLogs/enums.tsx | 1 + frontend/src/hooks/api/auditLogs/types.tsx | 6 ++ 9 files changed, 144 insertions(+), 6 deletions(-) create mode 100644 backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 91464bc0b..a31200a1b 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -234,6 +234,7 @@ export enum EventType { GET_PROJECT_KMS_BACKUP = "get-project-kms-backup", LOAD_PROJECT_KMS_BACKUP = "load-project-kms-backup", ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project", + ORG_ADMIN_BYPASS_SSO = "org-admin-bypassed-sso", CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template", UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template", DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template", @@ -1907,6 +1908,11 @@ interface OrgAdminAccessProjectEvent { }; // no metadata yet } +interface OrgAdminBypassSSOEvent { + type: EventType.ORG_ADMIN_BYPASS_SSO; + metadata: Record; // no metadata yet +} + interface CreateCertificateTemplateEstConfig { type: EventType.CREATE_CERTIFICATE_TEMPLATE_EST_CONFIG; metadata: { @@ -2656,6 +2662,7 @@ export type Event = | GetProjectKmsBackupEvent | LoadProjectKmsBackupEvent | OrgAdminAccessProjectEvent + | OrgAdminBypassSSOEvent | CreateCertificateTemplate | UpdateCertificateTemplate | GetCertificateTemplate diff --git a/backend/src/ee/services/license/license-fns.ts b/backend/src/ee/services/license/license-fns.ts index 3f4af174b..f6d0d0410 100644 --- a/backend/src/ee/services/license/license-fns.ts +++ b/backend/src/ee/services/license/license-fns.ts @@ -25,11 +25,11 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({ customRateLimits: false, customAlerts: false, secretAccessInsights: false, - auditLogs: false, - auditLogsRetentionDays: 0, + auditLogs: true, + auditLogsRetentionDays: 3, auditLogStreams: false, auditLogStreamLimit: 3, - samlSSO: false, + samlSSO: true, hsm: false, oidcSSO: false, scim: false, diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index c9f2811b5..3b23c7303 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -596,7 +596,14 @@ export const registerRoutes = async ( kmsService }); - const loginService = authLoginServiceFactory({ userDAL, smtpService, tokenService, orgDAL, totpService }); + const loginService = authLoginServiceFactory({ + userDAL, + smtpService, + tokenService, + orgDAL, + totpService, + auditLogService + }); const passwordService = authPaswordServiceFactory({ tokenService, smtpService, diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 0e0f999dd..6af512773 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -3,6 +3,8 @@ import jwt from "jsonwebtoken"; import { Knex } from "knex"; import { OrgMembershipRole, TUsers, UserDeviceSchema } from "@app/db/schemas"; +import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns"; import { getConfig } from "@app/lib/config/env"; import { request } from "@app/lib/config/request"; @@ -11,6 +13,7 @@ import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { getUserPrivateKey } from "@app/lib/crypto/srp"; import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; +import { getUserAgentType } from "@app/server/plugins/audit-log"; import { getServerCfg } from "@app/services/super-admin/super-admin-service"; import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service"; @@ -28,7 +31,14 @@ import { TOauthTokenExchangeDTO, TVerifyMfaTokenDTO } from "./auth-login-type"; -import { AuthMethod, AuthModeJwtTokenPayload, AuthModeMfaJwtTokenPayload, AuthTokenType, MfaMethod } from "./auth-type"; +import { + ActorType, + AuthMethod, + AuthModeJwtTokenPayload, + AuthModeMfaJwtTokenPayload, + AuthTokenType, + MfaMethod +} from "./auth-type"; type TAuthLoginServiceFactoryDep = { userDAL: TUserDALFactory; @@ -36,6 +46,7 @@ type TAuthLoginServiceFactoryDep = { tokenService: TAuthTokenServiceFactory; smtpService: TSmtpService; totpService: Pick; + auditLogService: Pick; }; export type TAuthLoginFactory = ReturnType; @@ -44,7 +55,8 @@ export const authLoginServiceFactory = ({ tokenService, smtpService, orgDAL, - totpService + totpService, + auditLogService }: TAuthLoginServiceFactoryDep) => { /* * Private @@ -412,6 +424,51 @@ export const authLoginServiceFactory = ({ mfaMethod: decodedToken.mfaMethod }); + // In the event of this being a break-glass request (non-saml / non-oidc, when either is enforced) + if ( + selectedOrg.authEnforced && + selectedOrg.bypassOrgAuthEnabled && + !isAuthMethodSaml(decodedToken.authMethod) && + decodedToken.authMethod !== AuthMethod.OIDC + ) { + await auditLogService.createAuditLog({ + orgId: organizationId, + ipAddress, + userAgent, + userAgentType: getUserAgentType(userAgent), + actor: { + type: ActorType.USER, + metadata: { + email: user.email, + userId: user.id, + username: user.username + } + }, + event: { + type: EventType.ORG_ADMIN_BYPASS_SSO, + metadata: {} + } + }); + + // Notify all admins via email + const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin); + const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[]; + + if (adminEmails.length > 0) { + await smtpService.sendMail({ + recipients: adminEmails, + subjectLine: "Security Alert: Admin SSO Bypass", + substitutions: { + email: user.email, + timestamp: new Date().toISOString(), + ip: ipAddress, + userAgent + }, + template: SmtpTemplates.OrgAdminBreakglassAccess + }); + } + } + return { ...tokens, isMfaEnabled: false diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts index 02bf58321..8aedddbdd 100644 --- a/backend/src/services/org/org-dal.ts +++ b/backend/src/services/org/org-dal.ts @@ -2,6 +2,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { + OrgMembershipRole, TableName, TOrganizations, TOrganizationsInsert, @@ -251,6 +252,43 @@ export const orgDALFactory = (db: TDbClient) => { } }; + const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => { + try { + const conn = tx || db; + const members = await conn(TableName.OrgMembership) + .where(`${TableName.OrgMembership}.orgId`, orgId) + .where(`${TableName.OrgMembership}.role`, role) + .join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`) + .leftJoin( + TableName.UserEncryptionKey, + `${TableName.UserEncryptionKey}.userId`, + `${TableName.Users}.id` + ) + .select( + conn.ref("id").withSchema(TableName.OrgMembership), + conn.ref("inviteEmail").withSchema(TableName.OrgMembership), + conn.ref("orgId").withSchema(TableName.OrgMembership), + conn.ref("role").withSchema(TableName.OrgMembership), + conn.ref("roleId").withSchema(TableName.OrgMembership), + conn.ref("status").withSchema(TableName.OrgMembership), + conn.ref("username").withSchema(TableName.Users), + conn.ref("email").withSchema(TableName.Users), + conn.ref("firstName").withSchema(TableName.Users), + conn.ref("lastName").withSchema(TableName.Users), + conn.ref("id").withSchema(TableName.Users).as("userId"), + conn.ref("publicKey").withSchema(TableName.UserEncryptionKey) + ) + .where({ isGhost: false }); + + return members.map(({ username, email, firstName, lastName, userId, publicKey, ...data }) => ({ + ...data, + user: { username, email, firstName, lastName, id: userId, publicKey } + })); + } catch (error) { + throw new DatabaseError({ error, name: "Find org members by role" }); + } + }; + const findOrgGhostUser = async (orgId: string) => { try { const member = await db @@ -472,6 +510,7 @@ export const orgDALFactory = (db: TDbClient) => { findAllOrgsByUserId, ghostUserExists, findOrgMembersByUsername, + findOrgMembersByRole, findOrgGhostUser, create, updateById, diff --git a/backend/src/services/smtp/smtp-service.ts b/backend/src/services/smtp/smtp-service.ts index 25f5f3949..0e028968d 100644 --- a/backend/src/services/smtp/smtp-service.ts +++ b/backend/src/services/smtp/smtp-service.ts @@ -44,6 +44,7 @@ export enum SmtpTemplates { SecretRotationFailed = "secretRotationFailed.handlebars", ProjectAccessRequest = "projectAccess.handlebars", OrgAdminProjectDirectAccess = "orgAdminProjectGrantAccess.handlebars", + OrgAdminBreakglassAccess = "OrgAdminBreakglassAccess.handlebars", ServiceTokenExpired = "serviceTokenExpired.handlebars" } diff --git a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars new file mode 100644 index 000000000..c15eb6896 --- /dev/null +++ b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars @@ -0,0 +1,20 @@ + + + + + + Organization admin has bypassed SSO + + + +

Infisical

+

The organization admin {{email}} has just bypassed enforced SSO login.

+

Timestamp: {{timestamp}}

+

IP address: {{ip}}

+

User agent: {{userAgent}}

+

If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.

+ + {{emailFooter}} + + + diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index 15adb0272..d465fb820 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -90,6 +90,7 @@ export enum EventType { ADD_PKI_COLLECTION_ITEM = "add-pki-collection-item", DELETE_PKI_COLLECTION_ITEM = "delete-pki-collection-item", ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project", + ORG_ADMIN_BYPASS_SSO = "org-admin-bypassed-sso", CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template", UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template", DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template", diff --git a/frontend/src/hooks/api/auditLogs/types.tsx b/frontend/src/hooks/api/auditLogs/types.tsx index a18974f2e..2524f84f4 100644 --- a/frontend/src/hooks/api/auditLogs/types.tsx +++ b/frontend/src/hooks/api/auditLogs/types.tsx @@ -718,6 +718,11 @@ interface OrgAdminAccessProjectEvent { }; // no metadata yet } +interface OrgAdminBypassSSOEvent { + type: EventType.ORG_ADMIN_BYPASS_SSO; + metadata: Record; // no metadata yet +} + interface CreateCertificateTemplate { type: EventType.CREATE_CERTIFICATE_TEMPLATE; metadata: { @@ -885,6 +890,7 @@ export type Event = | AddPkiCollectionItem | DeletePkiCollectionItem | OrgAdminAccessProjectEvent + | OrgAdminBypassSSOEvent | CreateCertificateTemplate | UpdateCertificateTemplate | GetCertificateTemplate From a838f84601d51fc4d3ad63b0fa8d3f0d9b6a90b6 Mon Sep 17 00:00:00 2001 From: x Date: Tue, 22 Apr 2025 14:58:17 -0400 Subject: [PATCH 03/16] Revert license overwrites, fix type errors, add error handling to email function --- .../src/ee/services/license/license-fns.ts | 6 ++-- .../src/services/auth/auth-login-service.ts | 28 +++++++++++-------- .../identity-aws-auth-service.ts | 13 ++++----- backend/src/services/smtp/smtp-service.ts | 2 +- .../src/hooks/api/auditLogs/constants.tsx | 1 + 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/backend/src/ee/services/license/license-fns.ts b/backend/src/ee/services/license/license-fns.ts index f6d0d0410..3f4af174b 100644 --- a/backend/src/ee/services/license/license-fns.ts +++ b/backend/src/ee/services/license/license-fns.ts @@ -25,11 +25,11 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({ customRateLimits: false, customAlerts: false, secretAccessInsights: false, - auditLogs: true, - auditLogsRetentionDays: 3, + auditLogs: false, + auditLogsRetentionDays: 0, auditLogStreams: false, auditLogStreamLimit: 3, - samlSSO: true, + samlSSO: false, hsm: false, oidcSSO: false, scim: false, diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 6af512773..e0d964017 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -454,18 +454,22 @@ export const authLoginServiceFactory = ({ const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin); const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[]; - if (adminEmails.length > 0) { - await smtpService.sendMail({ - recipients: adminEmails, - subjectLine: "Security Alert: Admin SSO Bypass", - substitutions: { - email: user.email, - timestamp: new Date().toISOString(), - ip: ipAddress, - userAgent - }, - template: SmtpTemplates.OrgAdminBreakglassAccess - }); + try { + if (adminEmails.length > 0) { + await smtpService.sendMail({ + recipients: adminEmails, + subjectLine: "Security Alert: Admin SSO Bypass", + substitutions: { + email: user.email, + timestamp: new Date().toISOString(), + ip: ipAddress, + userAgent + }, + template: SmtpTemplates.OrgAdminBreakglassAccess + }); + } + } catch (error) { + logger.error(error, `Failed to send SSO bypass notification emails for user ${user.email}`); } } diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts index 0849a7523..fe7b24783 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts @@ -68,18 +68,15 @@ const awsRegionFromHeader = (authorizationHeader: string): string | null => { return null; }; - - -function isValidAwsRegion(region: (string | null)): boolean { - const validRegionPattern = new RE2('^[a-z0-9-]+$'); - if (typeof region !== 'string' || region.length === 0 || region.length > 20) { +function isValidAwsRegion(region: string | null): boolean { + const validRegionPattern = new RE2("^[a-z0-9-]+$"); + if (typeof region !== "string" || region.length === 0 || region.length > 20) { return false; } - + return validRegionPattern.test(region); } - export const identityAwsAuthServiceFactory = ({ identityAccessTokenDAL, identityAwsAuthDAL, @@ -100,7 +97,7 @@ export const identityAwsAuthServiceFactory = ({ const region = headers.Authorization ? awsRegionFromHeader(headers.Authorization) : null; if (!isValidAwsRegion(region)) { - throw new BadRequestError({message: "Invalid AWS region"}); + throw new BadRequestError({ message: "Invalid AWS region" }); } const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint; diff --git a/backend/src/services/smtp/smtp-service.ts b/backend/src/services/smtp/smtp-service.ts index 0e028968d..550e1bb07 100644 --- a/backend/src/services/smtp/smtp-service.ts +++ b/backend/src/services/smtp/smtp-service.ts @@ -44,7 +44,7 @@ export enum SmtpTemplates { SecretRotationFailed = "secretRotationFailed.handlebars", ProjectAccessRequest = "projectAccess.handlebars", OrgAdminProjectDirectAccess = "orgAdminProjectGrantAccess.handlebars", - OrgAdminBreakglassAccess = "OrgAdminBreakglassAccess.handlebars", + OrgAdminBreakglassAccess = "orgAdminBreakglassAccess.handlebars", ServiceTokenExpired = "serviceTokenExpired.handlebars" } diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 159e840ec..229f822da 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -84,6 +84,7 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.ADD_PKI_COLLECTION_ITEM]: "Add PKI collection item", [EventType.DELETE_PKI_COLLECTION_ITEM]: "Delete PKI collection item", [EventType.ORG_ADMIN_ACCESS_PROJECT]: "Org admin accessed project", + [EventType.ORG_ADMIN_BYPASS_SSO]: "Org admin bypassed SSO enforcement", [EventType.CREATE_CERTIFICATE_TEMPLATE]: "Create certificate template", [EventType.UPDATE_CERTIFICATE_TEMPLATE]: "Update certificate template", [EventType.DELETE_CERTIFICATE_TEMPLATE]: "Delete certificate template", From 8bd21ffa63e2871d32cc60e1d3f5f2c7aa7febad Mon Sep 17 00:00:00 2001 From: x Date: Wed, 23 Apr 2025 19:46:25 -0400 Subject: [PATCH 04/16] Attached settings URL to email, actor no longer a recipient, removed error handling for email send, used read replica node for findOrgMembersByRole --- .../src/services/auth/auth-login-service.ts | 35 +++++++++---------- backend/src/services/org/org-dal.ts | 2 +- .../orgAdminBreakglassAccess.handlebars | 4 +-- 3 files changed, 20 insertions(+), 21 deletions(-) diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index e0d964017..03281baca 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -450,26 +450,25 @@ export const authLoginServiceFactory = ({ } }); - // Notify all admins via email + // Notify all admins via email (besides the actor) const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin); - const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[]; + const adminEmails = orgAdmins + .filter((admin) => admin.user.id !== user.id) + .map((admin) => admin.user.email) + .filter(Boolean) as string[]; - try { - if (adminEmails.length > 0) { - await smtpService.sendMail({ - recipients: adminEmails, - subjectLine: "Security Alert: Admin SSO Bypass", - substitutions: { - email: user.email, - timestamp: new Date().toISOString(), - ip: ipAddress, - userAgent - }, - template: SmtpTemplates.OrgAdminBreakglassAccess - }); - } - } catch (error) { - logger.error(error, `Failed to send SSO bypass notification emails for user ${user.email}`); + if (adminEmails.length > 0) { + await smtpService.sendMail({ + recipients: adminEmails, + subjectLine: "Security Alert: Admin SSO Bypass", + substitutions: { + email: user.email, + timestamp: new Date().toISOString(), + ip: ipAddress, + userAgent + }, + template: SmtpTemplates.OrgAdminBreakglassAccess + }); } } diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts index 8aedddbdd..3f4215a6b 100644 --- a/backend/src/services/org/org-dal.ts +++ b/backend/src/services/org/org-dal.ts @@ -254,7 +254,7 @@ export const orgDALFactory = (db: TDbClient) => { const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => { try { - const conn = tx || db; + const conn = tx || db.replicaNode(); const members = await conn(TableName.OrgMembership) .where(`${TableName.OrgMembership}.orgId`, orgId) .where(`${TableName.OrgMembership}.role`, role) diff --git a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars index c15eb6896..0ad3bf2b5 100644 --- a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars +++ b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars @@ -8,11 +8,11 @@

Infisical

-

The organization admin {{email}} has just bypassed enforced SSO login.

+

The organization admin {{email}} has bypassed enforced SSO login.

Timestamp: {{timestamp}}

IP address: {{ip}}

User agent: {{userAgent}}

-

If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.

+

If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.

{{emailFooter}} From d019011822e25a30c37621c18629ebc9af50be8e Mon Sep 17 00:00:00 2001 From: x Date: Wed, 23 Apr 2025 19:53:14 -0400 Subject: [PATCH 05/16] Made findOrgMembersByUsername use replicaNode to stay consistent --- backend/src/services/org/org-dal.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts index 3f4215a6b..54b0e1b0f 100644 --- a/backend/src/services/org/org-dal.ts +++ b/backend/src/services/org/org-dal.ts @@ -217,9 +217,8 @@ export const orgDALFactory = (db: TDbClient) => { const findOrgMembersByUsername = async (orgId: string, usernames: string[], tx?: Knex) => { try { - const conn = tx || db; + const conn = tx || db.replicaNode(); const members = await conn(TableName.OrgMembership) - // .replicaNode()(TableName.OrgMembership) .where(`${TableName.OrgMembership}.orgId`, orgId) .join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`) .leftJoin( From c64e6310a63e6028d99042ae952c2d72963f3843 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Thu, 24 Apr 2025 10:26:54 -0300 Subject: [PATCH 06/16] fix(delete-project): Add tooltip for delete project button when it has protection enabled --- .../DeleteProjectSection.tsx | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/DeleteProjectSection/DeleteProjectSection.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/DeleteProjectSection/DeleteProjectSection.tsx index 2f11523c4..ffb9e93fc 100644 --- a/frontend/src/pages/secret-manager/SettingsPage/components/DeleteProjectSection/DeleteProjectSection.tsx +++ b/frontend/src/pages/secret-manager/SettingsPage/components/DeleteProjectSection/DeleteProjectSection.tsx @@ -3,7 +3,7 @@ import { useNavigate } from "@tanstack/react-router"; import { createNotification } from "@app/components/notifications"; import { ProjectPermissionCan } from "@app/components/permissions"; -import { Button, DeleteActionModal } from "@app/components/v2"; +import { Button, DeleteActionModal, Tooltip } from "@app/components/v2"; import { LeaveProjectModal } from "@app/components/v2/LeaveProjectModal"; import { ProjectPermissionActions, @@ -142,16 +142,22 @@ export const DeleteProjectSection = () => {
{(isAllowed) => ( - + + )} {!isOnlyAdminMember && ( From e25c1199bc673f82b247cd307bcdae91bfc4d27c Mon Sep 17 00:00:00 2001 From: x Date: Thu, 24 Apr 2025 10:24:42 -0400 Subject: [PATCH 07/16] Made email URL use SITE_URL --- backend/src/services/auth/auth-login-service.ts | 4 +++- .../smtp/templates/orgAdminBreakglassAccess.handlebars | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 03281baca..e576d6768 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -39,6 +39,7 @@ import { AuthTokenType, MfaMethod } from "./auth-type"; +import { removeTrailingSlash } from "@app/lib/fn"; type TAuthLoginServiceFactoryDep = { userDAL: TUserDALFactory; @@ -465,7 +466,8 @@ export const authLoginServiceFactory = ({ email: user.email, timestamp: new Date().toISOString(), ip: ipAddress, - userAgent + userAgent, + siteUrl: removeTrailingSlash(cfg.SITE_URL || "https://app.infisical.com") }, template: SmtpTemplates.OrgAdminBreakglassAccess }); diff --git a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars index 0ad3bf2b5..cc97ff201 100644 --- a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars +++ b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars @@ -12,7 +12,7 @@

Timestamp: {{timestamp}}

IP address: {{ip}}

User agent: {{userAgent}}

-

If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.

+

If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.

{{emailFooter}} From c97a3f07a7d58bc504d3fe0a0ad98adc3818afee Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:10:21 -0700 Subject: [PATCH 08/16] update linux docs --- docs/mint.json | 1 - .../linux-package/commands-configuration.mdx | 40 ++--- .../native/linux-package/installation.mdx | 164 ++++++++++-------- .../native/linux-package/migration.mdx | 30 ---- docs/self-hosting/overview.mdx | 3 +- 5 files changed, 114 insertions(+), 124 deletions(-) delete mode 100644 docs/self-hosting/deployment-options/native/linux-package/migration.mdx diff --git a/docs/mint.json b/docs/mint.json index b4fcb34c5..5c0b4a493 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -283,7 +283,6 @@ "group": "Linux Package", "pages": [ "self-hosting/deployment-options/native/linux-package/installation", - "self-hosting/deployment-options/native/linux-package/migration", "self-hosting/deployment-options/native/linux-package/commands-configuration" ] }, diff --git a/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx index 9746bce13..7aec6867a 100644 --- a/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx +++ b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx @@ -1,38 +1,38 @@ --- -title: "Commands and Configuration" -description: "Learn all the available commands and configuration of the linux package." +title: "Configurations" +description: "Learn how to configure and manage the Infisical Linux package" --- -## Configuration +## Configuration Overview -All Infisical configuration is managed from a central file called `infisical.rb` located in the `/etc/infisical` directory. +All configuration for the Infisical Linux package is managed through a single file called `infisical.rb`, located in the `/etc/infisical` directory. +This file defines all necessary settings, including encryption keys, database connections, and environment-specific settings. - After updating the `infisical.rb` file, remember to run `infisical-ctl reconfigure` to apply the changes. + After making any changes to the `infisical.rb` file, always run `infisical-ctl reconfigure` to apply them. ### Example Configuration -```ruby +```ruby infisical.rb # Important: Replace these values with secure keys in production infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' # Database connection strings -infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:infisical@localhost:5432/infisical' -infisical_core['REDIS_URL'] = 'redis://localhost:6379' +infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:some-password@some-host:5432/infisical' +infisical_core['REDIS_URL'] = 'redis://some-host:6379' ``` -For a complete list of configuration options, visit our [configuration variables documentation](/self-hosting/configuration/envars). +For a full list of supported configuration variables, refer to the [configuration variables documentation](/self-hosting/configuration/envars). -## Available Commands +## All `infisical-ctl` Commands -The `infisical-ctl` command provides several options to manage your Infisical deployment: +The Infisical Linux package includes the `infisical-ctl` command-line tool, which allows you to manage your deployment. +The available commands are listed below. -| Command | Description | -| --- | --- | -| `infisical-ctl reconfigure` | Restarts the Infisical services and applies any configuration changes | -| `infisical-ctl tail` | Shows the logs of the Infisical application | -| `infisical-ctl status` | Displays the current running status of the Infisical services | -| `infisical-ctl stop` | Stops the Infisical services | -| `infisical-ctl start` | Starts the Infisical services | - -For database migration-related commands, refer to the [Migrations Guide](/self-hosting/native/linux-package/migration). +| Command | Description | +|-----------------------------|-----------------------------------------------------------------------------| +| `infisical-ctl reconfigure` | Applies changes from `infisical.rb` and restarts the Infisical services. | +| `infisical-ctl start` | Starts the Infisical services. | +| `infisical-ctl stop` | Stops all running Infisical services. | +| `infisical-ctl status` | Displays the current status of the Infisical services. | +| `infisical-ctl tail` | Streams real-time logs from the Infisical application. | \ No newline at end of file diff --git a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx index 91a171adf..e9aa5b19d 100644 --- a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx +++ b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx @@ -1,102 +1,124 @@ --- title: "Installation" -description: "Learn how to deploy Infisical using linux package." +description: "Learn how to deploy Infisical using the Linux package" --- -Infisical can be deployed on Linux virtual machines without containers using our Linux packages. Currently, we support Linux systems running on AMD64 architecture (ARM coming soon). - -This standalone deployment uses a "Bring Your Own Database" (BYOD) approach, meaning you'll need to provide your own PostgreSQL and Redis databases for Infisical services. These databases are not included in the package. +Infisical can be deployed on Linux virtual machines without the need for containers using our standalone Linux packages. +These packages are available in both .deb (for Debian-based systems) and .rpm (for RHEL-based systems) formats. +The installation includes the Infisical service, along with a CLI tool (infisical-ctl) to help you manage configurations, startup, and application logging. +This approach is ideal for environments where containerization isn't desired, while still providing a lightweight deployment option. ## Prerequisites -Before beginning the installation, ensure you have: +This installation method only provides the Infisical application. You are responsible for configuring both PostgreSQL and Redis, either by using managed services (e.g., AWS RDS, Azure Database, GCP Cloud SQL/Memorystore) or by deploying them manually in your on-prem environment. +Please ensure you have the following before beginning installation of Infisical: -- A server running a linux-based operating system (Ubuntu, Debian) or RHEL-based system -- A PostgreSQL database instance -- A Redis database instance +- A Linux server running a Debian/Ubuntu or RHEL-based distribution +- A running PostgreSQL database instance +- A running Redis database instance ## Installation Steps - -Choose your operating system below to install Infisical: - + + Select your Linux distribution to get started. Only AMD64-based systems are supported at this time, ARM support is coming soon. + + + - First, add the Infisical repository: - ```bash - curl -1sLf \ - 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.deb.sh' \ - | sudo -E bash - ``` + Add the Infisical repository: + ```bash + curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.deb.sh' | sudo -E bash + ``` - Then install Infisical: - ```bash - sudo apt-get update && sudo apt-get install -y infisical-core - ``` - - > **Note**: For production environments, we strongly recommend installing a specific version of the package to maintain consistency across reinstalls. View available versions at [Infisical Package Versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). + Install Infisical: + ```bash + sudo apt-get update && sudo apt-get install -y infisical-core + ``` + > **Note**: For production use, we recommend locking to a specific version to ensure consistency. [View available versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). - First, add the Infisical repository: - ```bash - curl -1sLf \ - 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.rpm.sh' \ - | sudo -E bash - ``` + Add the Infisical repository: + ```bash + curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.rpm.sh' | sudo -E bash + ``` - Then install Infisical: - ```bash - sudo yum install infisical-core - ``` - - > **Note**: For production environments, we strongly recommend installing a specific version of the package to maintain consistency across reinstalls. View available versions at [Infisical Package Versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). + Install Infisical: + ```bash + sudo yum install infisical-core + ``` + > **Note**: For production use, we recommend locking to a specific version to ensure consistency. [View available versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/). - -To verify the installation, run: + -```bash -infisical-ctl help -``` + Verify the installation: + ```bash + infisical-ctl help + ``` + - - -Create an `infisical.rb` file in the `/etc/infisical` directory. This file will contain your database connections and other configuration settings. + + Create an `infisical.rb` file at `/etc/infisical`. This file contains your database connection strings and other runtime settings. - -```ruby -# Important: Replace these values with secure keys in production -infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' -infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' + ```ruby + # Important: Replace with secure values in production + infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' + infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' -# Database connection strings -infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:infisical@localhost:5432/infisical' -infisical_core['REDIS_URL'] = 'redis://localhost:6379' -``` - + # Example database connection strings + infisical_core['DB_CONNECTION_URI'] = 'postgres://:@:/' + infisical_core['REDIS_URL'] = 'redis://:' + ``` -For a complete list of configuration options, visit our [configuration variables documentation](/self-hosting/configuration/envars). + See the full list of options in our [configuration documentation](/self-hosting/configuration/envars). + - - -1. Run the following command to start the Infisical server: - ```bash - infisical-ctl reconfigure - ``` - By default, the server will run on port `8080`. You can modify this in the `infisical.rb` configuration file. + + 1. Start the Infisical service: + ```bash + infisical-ctl reconfigure + ``` + The server runs on port `8080` by default (customizable in `infisical.rb`). + + 2. Check the service status: + + Check the service status: + ```bash + infisical-ctl status + ``` + + View the service logs in real-time: + ```bash + infisical-ctl tail + ``` + -2. Monitor your deployment: - - Check the application status: - ```bash - infisical-ctl status - ``` - - View real-time logs: - ```bash - infisical-ctl tail - ``` - + +## Platform Support + +### Microsoft Windows +Infisical is built for Linux-based systems. It is not supported on Microsoft Windows, and we do not plan to support it in the near future. For Windows users, consider running Infisical in a virtual machine or WSL2 environment. + +### Unsupported Linux Distributions and Unix-like Systems +Infisical is not tested or officially supported on the following: + +- Arch Linux +- Fedora +- FreeBSD +- Gentoo +- macOS + +We recommend sticking to officially supported distributions for the best experience. + +## Linux vs Containerized Deployments + +Infisical is a stateless application, which means it can be easily scaled and redeployed without maintaining internal state between instances. + +If your use case requires rolling updates, self-healing, or auto-scaling, we recommend deploying Infisical in a containerized environment such as Kubernetes/OpenShift, or using managed container orchestration services like AWS ECS or Google Cloud Run. +These platforms offer built-in capabilities for high availability and help simplify operational overhead for your deployment. \ No newline at end of file diff --git a/docs/self-hosting/deployment-options/native/linux-package/migration.mdx b/docs/self-hosting/deployment-options/native/linux-package/migration.mdx deleted file mode 100644 index 50dca04af..000000000 --- a/docs/self-hosting/deployment-options/native/linux-package/migration.mdx +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: "Migration" -description: "Learn how to run migration using Infisical linux package." ---- - -By default, migrations automatically run each time you execute `infisical-ctl reconfigure`. This behavior may not be desirable when deploying with horizontal scaling. - -## Disable Auto Migration - -To disable automatic migrations, add the following configuration to your `infisical.rb` file: - -```ruby -infisical_core['auto_migration'] = false -``` - -## Migration Commands - -`infisical-ctl` provides several commands to manage database migrations. You can run these commands in two ways: - -- Provide the PostgreSQL database connection as an environment variable, or -- Let the system load the connection details from the Infisical application after reconfiguration - -| Command | Description | -| ---------------------------------- | --------------------------------------------------------------------------- | -| `infisical-ctl migration up` | Runs the next migration that hasn't been applied yet | -| `infisical-ctl migration down` | Reverts the most recent migration, undoing its changes | -| `infisical-ctl migration list` | Lists all available migration files without applying them | -| `infisical-ctl migration status` | Displays the status of each migration, showing which have been applied | -| `infisical-ctl migration latest` | Applies all pending migrations to bring the database up to date | -| `infisical-ctl migration rollback` | Reverts all applied migrations, returning the database to its initial state | diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index f1bbfe236..51122758d 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -34,9 +34,8 @@ Choose from a number of deployment options listed below to get started. Install Infisical on your system without containers using our linux package. From b92bc2183a976998b7fc01f5cc1e472012c1055b Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:12:27 -0700 Subject: [PATCH 09/16] Update docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- .../native/linux-package/commands-configuration.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx index 7aec6867a..61be021b6 100644 --- a/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx +++ b/docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx @@ -18,8 +18,8 @@ infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218' infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=' # Database connection strings -infisical_core['DB_CONNECTION_URI'] = 'postgres://infisical:some-password@some-host:5432/infisical' -infisical_core['REDIS_URL'] = 'redis://some-host:6379' +infisical_core['DB_CONNECTION_URI'] = 'postgres://:@:5432/' +infisical_core['REDIS_URL'] = 'redis://:6379' ``` For a full list of supported configuration variables, refer to the [configuration variables documentation](/self-hosting/configuration/envars). From fcb59a1482c10637aa9ef4d736e909693d07e2eb Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:12:45 -0700 Subject: [PATCH 10/16] Update docs/self-hosting/overview.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- docs/self-hosting/overview.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index 51122758d..3cb570db6 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -34,7 +34,7 @@ Choose from a number of deployment options listed below to get started. From 68bbff455f77d6dc77f5d4c2f15b2e6fbbe246e1 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:12:59 -0700 Subject: [PATCH 11/16] Update docs/self-hosting/overview.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- docs/self-hosting/overview.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index 3cb570db6..acb692711 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -38,5 +38,5 @@ Choose from a number of deployment options listed below to get started. color="#000000" href="deployment-options/native/linux-package/installation" > - Install Infisical on your system without containers using our linux package. + Install Infisical on your system without containers using our Linux package. From dccada8a12bcc138fcc273fc9421118bee462857 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:13:59 -0700 Subject: [PATCH 12/16] Update docs/self-hosting/deployment-options/native/linux-package/installation.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- .../deployment-options/native/linux-package/installation.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx index e9aa5b19d..4c392587f 100644 --- a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx +++ b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx @@ -86,8 +86,6 @@ Please ensure you have the following before beginning installation of Infisical: The server runs on port `8080` by default (customizable in `infisical.rb`). 2. Check the service status: - - Check the service status: ```bash infisical-ctl status ``` From a19e5ff9056b1d161ea14e8b83ab1d88ce621b6f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 24 Apr 2025 14:16:41 -0700 Subject: [PATCH 13/16] add min version --- .../deployment-options/native/linux-package/installation.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx index 4c392587f..30ef83242 100644 --- a/docs/self-hosting/deployment-options/native/linux-package/installation.mdx +++ b/docs/self-hosting/deployment-options/native/linux-package/installation.mdx @@ -14,8 +14,8 @@ This installation method only provides the Infisical application. You are respon Please ensure you have the following before beginning installation of Infisical: - A Linux server running a Debian/Ubuntu or RHEL-based distribution -- A running PostgreSQL database instance -- A running Redis database instance +- A running PostgreSQL database instance (version 14 and up) +- A running Redis database instance (versions 6.x or 7.x) ## Installation Steps From 2d4adfc6518e74b1bd901c0db34d34a97c1c7341 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Fri, 25 Apr 2025 03:54:59 +0400 Subject: [PATCH 14/16] fix(kms): better error logs --- backend/src/services/kms/kms-service.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 07ed90bef..5d17c2c80 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -787,13 +787,16 @@ export const kmsServiceFactory = ({ return projectDataKey; } } + } catch (error) { + logger.error(error, "Failed to get project data key"); + throw error; } finally { await lock?.release(); } } if (!project.kmsSecretManagerEncryptedDataKey) { - throw new Error("Missing project data key"); + throw new BadRequestError({ message: "Missing project data key" }); } const kmsDecryptor = await decryptWithKmsKey({ From 795ce110622ba57d38bb996c3857d29d1860abd9 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Fri, 25 Apr 2025 04:00:14 +0400 Subject: [PATCH 15/16] Update kms-service.ts --- backend/src/services/kms/kms-service.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 5d17c2c80..efa771b56 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -788,7 +788,7 @@ export const kmsServiceFactory = ({ } } } catch (error) { - logger.error(error, "Failed to get project data key"); + logger.error(error, `Failed to get project data key for [projectId=${projectId}]`); throw error; } finally { await lock?.release(); From 90fdba0b77e250fde4e0b99c2d5f958e7f546cf1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Fri, 25 Apr 2025 04:04:26 +0400 Subject: [PATCH 16/16] Update kms-service.ts --- backend/src/services/kms/kms-service.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index efa771b56..8bfa50b64 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -788,7 +788,10 @@ export const kmsServiceFactory = ({ } } } catch (error) { - logger.error(error, `Failed to get project data key for [projectId=${projectId}]`); + logger.error( + error, + `getProjectSecretManagerKmsDataKey: Failed to get project data key for [projectId=${projectId}]` + ); throw error; } finally { await lock?.release();