mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge remote-tracking branch 'origin/main' into feat/addHerokuSecretSync
This commit is contained in:
carlosmonastyrski
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/flyio/available"
|
||||
---
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/flyio"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Fly.io Connections](/integrations/app-connections/flyio) to learn how to obtain the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/flyio/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/flyio/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/flyio/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/flyio"
|
||||
---
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/flyio/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Fly.io Connections](/integrations/app-connections/flyio) to learn how to obtain the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/render/available"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/render"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Render
|
||||
Connections](/integrations/app-connections/render) to learn how to obtain the
|
||||
required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/render/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/render/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/render/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/render"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/render/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Render
|
||||
Connections](/integrations/app-connections/render) to learn how to obtain the
|
||||
required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/flyio"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/flyio/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/flyio/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/flyio/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Import Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/import-secrets"
|
||||
---
|
||||
4
docs/api-reference/endpoints/secret-syncs/flyio/list.mdx
Normal file
4
docs/api-reference/endpoints/secret-syncs/flyio/list.mdx
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/flyio"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/flyio/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/render"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/render/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/render/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/render/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Import Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/render/{syncId}/import-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/render"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/render/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/render/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/render/{syncId}"
|
||||
---
|
||||
BIN
docs/images/app-connections/flyio/app-connection-created.png
Normal file
BIN
docs/images/app-connections/flyio/app-connection-created.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.0 MiB |
BIN
docs/images/app-connections/flyio/app-connection-modal.png
Normal file
BIN
docs/images/app-connections/flyio/app-connection-modal.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 794 KiB |
BIN
docs/images/app-connections/flyio/app-connection-option.png
Normal file
BIN
docs/images/app-connections/flyio/app-connection-option.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 796 KiB |
BIN
docs/images/app-connections/flyio/create-token-page.png
Normal file
BIN
docs/images/app-connections/flyio/create-token-page.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 537 KiB |
BIN
docs/images/app-connections/flyio/create-token.png
Normal file
BIN
docs/images/app-connections/flyio/create-token.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 502 KiB |
BIN
docs/images/app-connections/flyio/dashboard-page.png
Normal file
BIN
docs/images/app-connections/flyio/dashboard-page.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 642 KiB |
BIN
docs/images/app-connections/render/render-account-settings.png
Normal file
BIN
docs/images/app-connections/render/render-account-settings.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 473 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 969 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 534 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 703 KiB |
BIN
docs/images/app-connections/render/render-create-api-key.png
Normal file
BIN
docs/images/app-connections/render/render-create-api-key.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 338 KiB |
BIN
docs/images/app-connections/render/render-name-api-key.png
Normal file
BIN
docs/images/app-connections/render/render-name-api-key.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 341 KiB |
BIN
docs/images/secret-syncs/flyio/configure-destination.png
Normal file
BIN
docs/images/secret-syncs/flyio/configure-destination.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 628 KiB |
BIN
docs/images/secret-syncs/flyio/configure-details.png
Normal file
BIN
docs/images/secret-syncs/flyio/configure-details.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 632 KiB |
BIN
docs/images/secret-syncs/flyio/configure-source.png
Normal file
BIN
docs/images/secret-syncs/flyio/configure-source.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 615 KiB |
BIN
docs/images/secret-syncs/flyio/configure-sync-options.png
Normal file
BIN
docs/images/secret-syncs/flyio/configure-sync-options.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 680 KiB |
BIN
docs/images/secret-syncs/flyio/review-configuration.png
Normal file
BIN
docs/images/secret-syncs/flyio/review-configuration.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 651 KiB |
BIN
docs/images/secret-syncs/flyio/select-option.png
Normal file
BIN
docs/images/secret-syncs/flyio/select-option.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 710 KiB |
BIN
docs/images/secret-syncs/flyio/sync-created.png
Normal file
BIN
docs/images/secret-syncs/flyio/sync-created.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.0 MiB |
BIN
docs/images/secret-syncs/render/render-sync-created.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-created.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 994 KiB |
BIN
docs/images/secret-syncs/render/render-sync-destination.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-destination.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 627 KiB |
BIN
docs/images/secret-syncs/render/render-sync-details.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-details.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 622 KiB |
BIN
docs/images/secret-syncs/render/render-sync-options.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-options.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 661 KiB |
BIN
docs/images/secret-syncs/render/render-sync-review.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-review.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 648 KiB |
BIN
docs/images/secret-syncs/render/render-sync-source.png
Normal file
BIN
docs/images/secret-syncs/render/render-sync-source.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 612 KiB |
BIN
docs/images/secret-syncs/render/select-render-option.png
Normal file
BIN
docs/images/secret-syncs/render/select-render-option.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 704 KiB |
96
docs/integrations/app-connections/flyio.mdx
Normal file
96
docs/integrations/app-connections/flyio.mdx
Normal file
@@ -0,0 +1,96 @@
|
||||
---
|
||||
title: "Fly.io Connection"
|
||||
description: "Learn how to configure a Fly.io Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports the use of [Access Tokens](https://fly.io/docs/security/tokens/) to connect with Fly.io.
|
||||
|
||||
## Create Fly.io Access Token
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to 'Access Tokens'">
|
||||
|
||||
</Step>
|
||||
<Step title="Click 'Create Token'">
|
||||
|
||||
</Step>
|
||||
<Step title="Provide Token Information">
|
||||
Ensure that you give this token access to the correct app, then click 'Create Token'.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Save Token">
|
||||
After clicking 'Create Token', a modal containing your access token will appear. Save this token for later steps.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Create Fly.io Connection in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
In your Infisical dashboard, go to **Organization Settings** and select the [**App Connections**](https://app.infisical.com/organization/app-connections) tab.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Select Fly.io Connection">
|
||||
Click the **+ Add Connection** button and select the **Fly.io Connection** option from the available integrations.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Fill out the Fly.io Connection Modal">
|
||||
Complete the Fly.io Connection form by entering:
|
||||
- A descriptive name for the connection
|
||||
- An optional description for future reference
|
||||
- The Access Token from earlier steps
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
After clicking Create, your **Fly.io Connection** is established and ready to use with your Infisical projects.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create a Fly.io Connection, make an API request to the [Create Fly.io Connection](/api-reference/endpoints/app-connections/flyio/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/app-connections/flyio \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-flyio-connection",
|
||||
"method": "access-token",
|
||||
"credentials": {
|
||||
"accessToken": "[PRIVATE TOKEN]"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"appConnection": {
|
||||
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
|
||||
"name": "my-flyio-connection",
|
||||
"description": null,
|
||||
"version": 1,
|
||||
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
|
||||
"createdAt": "2025-04-23T19:46:34.831Z",
|
||||
"updatedAt": "2025-04-23T19:46:34.831Z",
|
||||
"isPlatformManagedCredentials": false,
|
||||
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
|
||||
"app": "flyio",
|
||||
"method": "access-token",
|
||||
"credentials": {}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
55
docs/integrations/app-connections/render.mdx
Normal file
55
docs/integrations/app-connections/render.mdx
Normal file
@@ -0,0 +1,55 @@
|
||||
---
|
||||
title: "Render Connection"
|
||||
description: "Learn how to configure a Render Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports connecting to Render using API keys for secure access to your Render services.
|
||||
|
||||
## Configure API Key for Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Access Account Settings">
|
||||
Navigate to your Render dashboard and click on **Account Settings** in the
|
||||
top right corner. 
|
||||
</Step>
|
||||
<Step title="Generate API Key">
|
||||
In the Account Settings page, scroll down to the **API Keys** section and
|
||||
click **Create API Key**. 
|
||||
</Step>
|
||||
<Step title="Name Your API Key">
|
||||
Enter a descriptive name for your API key (e.g., "production")
|
||||
and click **Create API Key**. 
|
||||
</Step>
|
||||
<Step title="Save Your API Key">
|
||||
After creation, you'll be shown your API key. Make sure to copy and securely
|
||||
store this key as it will not be shown again.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Setup Render Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
Navigate to the **App Connections** tab on the **Organization Settings**
|
||||
page. 
|
||||
</Step>
|
||||
<Step title="Add Connection">
|
||||
Select the **Render Connection** option from the connection options modal.
|
||||
|
||||
</Step>
|
||||
<Step title="Input API Key">
|
||||
Enter your Render API key in the provided field and click **Connect to
|
||||
Render** to establish the connection. 
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
Your **Render Connection** is now available for use in your Infisical
|
||||
projects. 
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -3,30 +3,7 @@ title: "Render"
|
||||
description: "How to sync secrets from Infisical to Render"
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Render">
|
||||
Obtain a Render API Key in your Render Account Settings > API Keys.
|
||||
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Render tile and input your Render API Key to grant Infisical access to your Render account.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which Render service and press create integration to start syncing secrets to Render.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
<Note>
|
||||
The Render Native Integration will be deprecated in 2026. Please migrate to
|
||||
our new [Render Sync](../secret-syncs/render).
|
||||
</Note>
|
||||
|
||||
155
docs/integrations/secret-syncs/flyio.mdx
Normal file
155
docs/integrations/secret-syncs/flyio.mdx
Normal file
@@ -0,0 +1,155 @@
|
||||
---
|
||||
title: "Fly.io Sync"
|
||||
description: "Learn how to configure a Fly.io Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
- Create a [Fly.io Connection](/integrations/app-connections/flyio)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Add Sync">
|
||||
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Select 'Fly.io'">
|
||||
|
||||
</Step>
|
||||
<Step title="Configure source">
|
||||
Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
</Step>
|
||||
<Step title="Configure destination">
|
||||
Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Fly.io Connection**: The Fly.io Connection to authenticate with.
|
||||
- **App**: The Fly.io app to sync secrets to.
|
||||
</Step>
|
||||
<Step title="Configure sync options">
|
||||
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
<Note>
|
||||
Fly.io does not support importing secrets.
|
||||
</Note>
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
|
||||
<Note>
|
||||
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
|
||||
</Note>
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
</Step>
|
||||
<Step title="Configure details">
|
||||
Configure the **Details** of your Fly.io Sync, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
</Step>
|
||||
<Step title="Review configuration">
|
||||
Review your Fly.io Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Sync created">
|
||||
If enabled, your Fly.io Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create a **Fly.io Sync**, make an API request to the [Create Fly.io Sync](/api-reference/endpoints/secret-syncs/flyio/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/flyio \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-flyio-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"appId": "..."
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-flyio-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "flyio",
|
||||
"name": "my-flyio-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "flyio",
|
||||
"destinationConfig": {
|
||||
"appId": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
135
docs/integrations/secret-syncs/render.mdx
Normal file
135
docs/integrations/secret-syncs/render.mdx
Normal file
@@ -0,0 +1,135 @@
|
||||
---
|
||||
title: "Render Sync"
|
||||
description: "Learn how to configure a Render Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [Render Connection](/integrations/app-connections/render)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **Render** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Render Connection**: The Render Connection to authenticate with.
|
||||
- **Scope**: Select **Service**.
|
||||
- **Service**: Choose the Render service you want to sync secrets to.
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the Render service before syncing, prioritizing values from Infisical over Render when keys conflict.
|
||||
- **Import Secrets (Prioritize Render)**: Imports secrets from the Render service before syncing, prioritizing values from Render over Infisical when keys conflict.
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
6. Configure the **Details** of your Render Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Render Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Render Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create a **Render Sync**, make an API request to the [Create Render Sync](/api-reference/endpoints/secret-syncs/render/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/render \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-render-sync",
|
||||
"projectId": "your-project-id",
|
||||
"description": "an example sync",
|
||||
"connectionId": "your-render-connection-id",
|
||||
"environment": "production",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"scope": "service",
|
||||
"serviceId": "your-render-service-id",
|
||||
"type": "env"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "your-sync-id",
|
||||
"name": "my-render-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "your-folder-id",
|
||||
"connectionId": "your-render-connection-id",
|
||||
"createdAt": "2024-05-01T12:00:00Z",
|
||||
"updatedAt": "2024-05-01T12:00:00Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2024-05-01T12:00:00Z",
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "your-project-id",
|
||||
"connection": {
|
||||
"app": "render",
|
||||
"name": "my-render-connection",
|
||||
"id": "your-render-connection-id"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "production",
|
||||
"name": "Production",
|
||||
"id": "your-env-id"
|
||||
},
|
||||
"folder": {
|
||||
"id": "your-folder-id",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "render",
|
||||
"destinationConfig": {
|
||||
"scope": "service",
|
||||
"serviceId": "your-render-service-id",
|
||||
"type": "env"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -12,7 +12,7 @@ Each permission consists of:
|
||||
- **Subject**: The resource the permission applies to (e.g., secrets, members, settings)
|
||||
- **Action**: The operation that can be performed (e.g., read, create, edit, delete)
|
||||
|
||||
Some project-level resources—specifically `secrets`, `secret-folders`, `secret-imports`, and `dynamic-secrets`—support conditional permissions and permission inversion for more granular access control. Conditions allow you to specify criteria (like environment, secret path, or tags) that must be met for the permission to apply.
|
||||
Some project-level resources—specifically `secrets`, `secret-folders`, `secret-imports`, `dynamic-secrets`, and `secret-syncs`, support conditional permissions and permission inversion for more granular access control. Conditions allow you to specify criteria (like environment, secret path, or tags) that must be met for the permission to apply.
|
||||
|
||||
## Available Project Permissions
|
||||
|
||||
@@ -208,6 +208,8 @@ Supports conditions and permission inversion
|
||||
|
||||
#### Subject: `secret-syncs`
|
||||
|
||||
Supports conditions and permission inversion.
|
||||
|
||||
| Action | Description |
|
||||
| ---------------- | -------------------------------------------------- |
|
||||
| `read` | View secret synchronization configurations |
|
||||
|
||||
@@ -396,7 +396,8 @@
|
||||
"pages": [
|
||||
"self-hosting/guides/mongo-to-postgres",
|
||||
"self-hosting/guides/custom-certificates",
|
||||
"self-hosting/guides/automated-bootstrapping"
|
||||
"self-hosting/guides/automated-bootstrapping",
|
||||
"self-hosting/guides/production-hardening"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -503,6 +504,7 @@
|
||||
"integrations/app-connections/azure-key-vault",
|
||||
"integrations/app-connections/camunda",
|
||||
"integrations/app-connections/databricks",
|
||||
"integrations/app-connections/flyio",
|
||||
"integrations/app-connections/gcp",
|
||||
"integrations/app-connections/github",
|
||||
"integrations/app-connections/github-radar",
|
||||
@@ -515,6 +517,7 @@
|
||||
"integrations/app-connections/oci",
|
||||
"integrations/app-connections/oracledb",
|
||||
"integrations/app-connections/postgres",
|
||||
"integrations/app-connections/render",
|
||||
"integrations/app-connections/teamcity",
|
||||
"integrations/app-connections/terraform-cloud",
|
||||
"integrations/app-connections/vercel",
|
||||
@@ -538,12 +541,14 @@
|
||||
"integrations/secret-syncs/azure-key-vault",
|
||||
"integrations/secret-syncs/camunda",
|
||||
"integrations/secret-syncs/databricks",
|
||||
"integrations/secret-syncs/flyio",
|
||||
"integrations/secret-syncs/gcp-secret-manager",
|
||||
"integrations/secret-syncs/github",
|
||||
"integrations/secret-syncs/hashicorp-vault",
|
||||
"integrations/secret-syncs/heroku",
|
||||
"integrations/secret-syncs/humanitec",
|
||||
"integrations/secret-syncs/oci-vault",
|
||||
"integrations/secret-syncs/render",
|
||||
"integrations/secret-syncs/teamcity",
|
||||
"integrations/secret-syncs/terraform-cloud",
|
||||
"integrations/secret-syncs/vercel",
|
||||
@@ -666,9 +671,9 @@
|
||||
"sdks/languages/node",
|
||||
"sdks/languages/python",
|
||||
"sdks/languages/java",
|
||||
"sdks/languages/csharp",
|
||||
"sdks/languages/go",
|
||||
"sdks/languages/ruby",
|
||||
"sdks/languages/csharp"
|
||||
"sdks/languages/ruby"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -1264,6 +1269,18 @@
|
||||
"api-reference/endpoints/app-connections/databricks/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Fly.io",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/flyio/list",
|
||||
"api-reference/endpoints/app-connections/flyio/available",
|
||||
"api-reference/endpoints/app-connections/flyio/get-by-id",
|
||||
"api-reference/endpoints/app-connections/flyio/get-by-name",
|
||||
"api-reference/endpoints/app-connections/flyio/create",
|
||||
"api-reference/endpoints/app-connections/flyio/update",
|
||||
"api-reference/endpoints/app-connections/flyio/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "GCP",
|
||||
"pages": [
|
||||
@@ -1408,6 +1425,18 @@
|
||||
"api-reference/endpoints/app-connections/postgres/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Render",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/render/list",
|
||||
"api-reference/endpoints/app-connections/render/available",
|
||||
"api-reference/endpoints/app-connections/render/get-by-id",
|
||||
"api-reference/endpoints/app-connections/render/get-by-name",
|
||||
"api-reference/endpoints/app-connections/render/create",
|
||||
"api-reference/endpoints/app-connections/render/update",
|
||||
"api-reference/endpoints/app-connections/render/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "TeamCity",
|
||||
"pages": [
|
||||
@@ -1573,6 +1602,19 @@
|
||||
"api-reference/endpoints/secret-syncs/databricks/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Fly.io",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/flyio/list",
|
||||
"api-reference/endpoints/secret-syncs/flyio/get-by-id",
|
||||
"api-reference/endpoints/secret-syncs/flyio/get-by-name",
|
||||
"api-reference/endpoints/secret-syncs/flyio/create",
|
||||
"api-reference/endpoints/secret-syncs/flyio/update",
|
||||
"api-reference/endpoints/secret-syncs/flyio/delete",
|
||||
"api-reference/endpoints/secret-syncs/flyio/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/flyio/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "GCP Secret Manager",
|
||||
"pages": [
|
||||
@@ -1654,6 +1696,20 @@
|
||||
"api-reference/endpoints/secret-syncs/oci-vault/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Render",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/render/list",
|
||||
"api-reference/endpoints/secret-syncs/render/get-by-id",
|
||||
"api-reference/endpoints/secret-syncs/render/get-by-name",
|
||||
"api-reference/endpoints/secret-syncs/render/create",
|
||||
"api-reference/endpoints/secret-syncs/render/update",
|
||||
"api-reference/endpoints/secret-syncs/render/delete",
|
||||
"api-reference/endpoints/secret-syncs/render/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/render/import-secrets",
|
||||
"api-reference/endpoints/secret-syncs/render/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "TeamCity",
|
||||
"pages": [
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
---
|
||||
title: "Infisical .NET SDK"
|
||||
sidebarTitle: ".NET"
|
||||
url: "https://github.com/Infisical/infisical-dotnet-sdk?tab=readme-ov-file#infisical-net-sdk"
|
||||
icon: "bars"
|
||||
---
|
||||
|
||||
{/*
|
||||
If you're working with C#, the official [Infisical C# SDK](https://github.com/Infisical/sdk/tree/main/languages/csharp) package is the easiest way to fetch and work with secrets for your application.
|
||||
|
||||
- [Nuget Package](https://www.nuget.org/packages/Infisical.Sdk)
|
||||
@@ -590,4 +591,4 @@ var decryptedPlaintext = infisical.DecryptSymmetric(decryptOptions);
|
||||
|
||||
#### Returns (string)
|
||||
`Plaintext` (string): The decrypted plaintext.
|
||||
|
||||
*/}
|
||||
|
||||
697
docs/self-hosting/guides/production-hardening.mdx
Normal file
697
docs/self-hosting/guides/production-hardening.mdx
Normal file
@@ -0,0 +1,697 @@
|
||||
---
|
||||
title: "Production Hardening"
|
||||
description: "Security hardening recommendations for production Infisical deployments"
|
||||
---
|
||||
|
||||
This document provides specific security hardening recommendations for production Infisical deployments. These recommendations follow Infisical's security model and focus on defense in depth.
|
||||
|
||||
Choose your deployment method below and follow the recommendations for your specific setup. Start with **Universal Security Fundamentals** that apply to all deployments, then follow your deployment-specific section.
|
||||
|
||||
## Universal Security Fundamentals
|
||||
|
||||
These security configurations apply to **all** Infisical deployments regardless of how you deploy.
|
||||
|
||||
### Cryptographic Security
|
||||
|
||||
#### Generate Secure Keys
|
||||
|
||||
Generate strong cryptographic keys for your deployment:
|
||||
|
||||
```bash
|
||||
# Required - Generate secure encryption key
|
||||
ENCRYPTION_KEY=$(openssl rand -hex 16)
|
||||
|
||||
# Required - Generate secure auth secret
|
||||
AUTH_SECRET=$(openssl rand -base64 32)
|
||||
```
|
||||
|
||||
#### Configure Token Lifetimes
|
||||
|
||||
Minimize exposure window for compromised tokens:
|
||||
|
||||
```bash
|
||||
# JWT token configuration (adjust based on security requirements)
|
||||
JWT_AUTH_LIFETIME=15m # Authentication tokens
|
||||
JWT_REFRESH_LIFETIME=24h # Refresh tokens
|
||||
JWT_SERVICE_LIFETIME=1h # Service tokens
|
||||
```
|
||||
|
||||
### Network Security
|
||||
|
||||
#### TLS Configuration
|
||||
|
||||
Configure HTTPS and secure database connections:
|
||||
|
||||
```bash
|
||||
# Enable HTTPS (recommended for production)
|
||||
HTTPS_ENABLED=true
|
||||
|
||||
# Secure PostgreSQL connection with SSL
|
||||
DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
|
||||
|
||||
# For base64-encoded SSL certificate
|
||||
DB_ROOT_CERT="<base64-encoded-certificate>"
|
||||
```
|
||||
|
||||
#### Redis Security
|
||||
|
||||
Use authentication and TLS for Redis:
|
||||
|
||||
```bash
|
||||
# Redis with TLS (if supported by your Redis deployment)
|
||||
REDIS_URL="rediss://user:password@redis:6380"
|
||||
|
||||
# Redis Sentinel configuration for high availability
|
||||
REDIS_SENTINEL_HOSTS="192.168.65.254:26379,192.168.65.254:26380"
|
||||
REDIS_SENTINEL_MASTER_NAME="mymaster"
|
||||
REDIS_SENTINEL_ENABLE_TLS=true
|
||||
REDIS_SENTINEL_USERNAME="sentinel_user"
|
||||
REDIS_SENTINEL_PASSWORD="sentinel_password"
|
||||
```
|
||||
|
||||
#### Network Access Controls
|
||||
|
||||
Configure network restrictions and firewall rules:
|
||||
|
||||
```bash
|
||||
# Limit CORS to specific domains
|
||||
CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
|
||||
|
||||
# Prevent connections to internal/private IP addresses
|
||||
# This blocks access to internal services like metadata endpoints,
|
||||
# internal APIs, databases, and other sensitive infrastructure
|
||||
ALLOW_INTERNAL_IP_CONNECTIONS=false
|
||||
```
|
||||
|
||||
**Implement network firewalls**. Restrict network access to only necessary services:
|
||||
|
||||
- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
|
||||
- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
|
||||
- **Principle**: Default deny incoming, allow only required traffic
|
||||
- **Implementation**: See your deployment-specific section below for exact configuration
|
||||
|
||||
### Application Security
|
||||
|
||||
#### Site Configuration
|
||||
|
||||
Set proper site URL for your Infisical instance:
|
||||
|
||||
```bash
|
||||
# Required - Must be absolute URL with protocol
|
||||
SITE_URL="https://app.infisical.com"
|
||||
```
|
||||
|
||||
#### SMTP Security
|
||||
|
||||
Use TLS for email communications:
|
||||
|
||||
```bash
|
||||
# SMTP with TLS
|
||||
SMTP_HOST="smtp.example.com"
|
||||
SMTP_PORT="587"
|
||||
SMTP_USERNAME="your-smtp-user"
|
||||
SMTP_PASSWORD="your-smtp-password"
|
||||
SMTP_REQUIRE_TLS=true
|
||||
SMTP_IGNORE_TLS=false
|
||||
SMTP_FROM_ADDRESS="noreply@example.com"
|
||||
SMTP_FROM_NAME="Infisical"
|
||||
```
|
||||
|
||||
#### Privacy Configuration
|
||||
|
||||
Control telemetry and data collection:
|
||||
|
||||
```bash
|
||||
# Optional - Disable telemetry (enabled by default)
|
||||
TELEMETRY_ENABLED=false
|
||||
```
|
||||
|
||||
### Database Security
|
||||
|
||||
#### High Availability Configuration
|
||||
|
||||
Configure database read replicas for high availability PostgreSQL setups:
|
||||
|
||||
```bash
|
||||
# Read replica configuration (JSON format)
|
||||
DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
|
||||
```
|
||||
|
||||
### Operational Security
|
||||
|
||||
#### User Access Management
|
||||
|
||||
**Establish user off-boarding procedures**. Remove access promptly when users leave:
|
||||
|
||||
1. Remove user from organization
|
||||
2. Revoke active service tokens
|
||||
3. Remove from external identity providers
|
||||
4. Audit access logs for the user's activity
|
||||
5. Rotate any shared secrets the user had access to
|
||||
|
||||
#### Maintenance and Updates
|
||||
|
||||
**Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.
|
||||
|
||||
## Deployment-Specific Hardening
|
||||
|
||||
### Docker Deployment
|
||||
|
||||
These recommendations are specific to Docker deployments of Infisical.
|
||||
|
||||
#### Container Security
|
||||
|
||||
**Use read-only root filesystems**. Prevent runtime modifications while allowing necessary temporary access:
|
||||
|
||||
```bash
|
||||
# Run with read-only filesystem but allow /tmp access
|
||||
docker run --read-only \
|
||||
--tmpfs /tmp:rw,exec,size=1G \
|
||||
infisical/infisical:latest
|
||||
```
|
||||
|
||||
**Note**: Infisical requires temporary directory access for:
|
||||
|
||||
- Secret scanning operations
|
||||
- SSH certificate generation and validation
|
||||
|
||||
The `--tmpfs` mounts provide secure, isolated temporary storage that is:
|
||||
|
||||
- Automatically cleaned up on container restart
|
||||
- Limited in size to prevent disk exhaustion
|
||||
- Isolated from the host system
|
||||
- Wiped on container removal
|
||||
|
||||
**Drop unnecessary capabilities**. Remove all Linux capabilities:
|
||||
|
||||
```bash
|
||||
# Drop all capabilities
|
||||
docker run --cap-drop=ALL infisical/infisical:latest
|
||||
```
|
||||
|
||||
**Use specific image tags**. Never use `latest` tags in production:
|
||||
|
||||
```bash
|
||||
# Use specific version tags
|
||||
docker run infisical/infisical:v0.93.1-postgres
|
||||
```
|
||||
|
||||
#### Resource Management
|
||||
|
||||
**Set resource limits**. Prevent resource exhaustion attacks:
|
||||
|
||||
```bash
|
||||
# Set memory and CPU limits
|
||||
docker run --memory=1g --cpus=0.5 infisical/infisical:latest
|
||||
```
|
||||
|
||||
#### Health Monitoring
|
||||
|
||||
**Configure health checks**. Set up Docker health checks:
|
||||
|
||||
```dockerfile
|
||||
# In Dockerfile or docker-compose.yml
|
||||
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
|
||||
CMD curl -f http://localhost:8080/api/status || exit 1
|
||||
```
|
||||
|
||||
#### Network Security
|
||||
|
||||
**Host firewall configuration**. Configure host-level firewall for Docker deployments:
|
||||
|
||||
```bash
|
||||
# Docker manages its own iptables rules, but configure host firewall
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
|
||||
# Allow Docker-mapped ports (adjust based on your port mapping)
|
||||
sudo ufw allow 8080/tcp # If mapping container 8080 to host 8080
|
||||
sudo ufw allow 443/tcp # If terminating HTTPS at host level
|
||||
|
||||
# Enable firewall
|
||||
sudo ufw --force enable
|
||||
|
||||
# Verify Docker iptables integration
|
||||
sudo iptables -L DOCKER
|
||||
```
|
||||
|
||||
#### Maintenance
|
||||
|
||||
**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.
|
||||
|
||||
### Kubernetes Deployment
|
||||
|
||||
These recommendations are specific to Kubernetes deployments of Infisical.
|
||||
|
||||
#### Pod Security
|
||||
|
||||
**Use Pod Security Standards**. Apply restricted security profile:
|
||||
|
||||
```yaml
|
||||
# Namespace-level Pod Security Standards
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: infisical
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: restricted
|
||||
pod-security.kubernetes.io/audit: restricted
|
||||
pod-security.kubernetes.io/warn: restricted
|
||||
```
|
||||
|
||||
**Configure security context**. Set comprehensive security context:
|
||||
|
||||
```yaml
|
||||
# Deployment security context
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: infisical
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
fsGroup: 1001
|
||||
containers:
|
||||
- name: infisical
|
||||
image: infisical/infisical:v0.93.1-postgres
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
limits:
|
||||
memory: 1000Mi
|
||||
cpu: 500m
|
||||
requests:
|
||||
cpu: 350m
|
||||
memory: 512Mi
|
||||
```
|
||||
|
||||
#### Network Security
|
||||
|
||||
**Configure network policies**. Restrict pod-to-pod communication:
|
||||
|
||||
```yaml
|
||||
# Example Kubernetes NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: infisical-netpol
|
||||
namespace: infisical
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: infisical
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: ingress-system
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: postgres
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6379
|
||||
```
|
||||
|
||||
**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement infrastructure-level security:
|
||||
|
||||
For cloud deployments (AWS Security Groups, Azure NSGs, or GCP Firewall Rules):
|
||||
|
||||
- Allow ingress from load balancer to NodePort/ClusterIP service
|
||||
- Allow egress to managed databases
|
||||
- Block all other traffic
|
||||
|
||||
For on-premises deployments, ensure node-level firewalls allow:
|
||||
|
||||
- Ingress traffic from ingress controllers
|
||||
- Egress traffic to external services (databases, SMTP)
|
||||
|
||||
#### Access Control
|
||||
|
||||
**Use dedicated service accounts**. Create service accounts with minimal permissions:
|
||||
|
||||
```yaml
|
||||
# Service account configuration
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: infisical
|
||||
namespace: infisical
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: infisical
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: infisical
|
||||
```
|
||||
|
||||
#### Ingress Security
|
||||
|
||||
**Configure ingress with TLS**. Set up secure ingress:
|
||||
|
||||
```yaml
|
||||
# Secure ingress configuration
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: infisical-ingress
|
||||
namespace: infisical
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- secretName: infisical-tls
|
||||
hosts:
|
||||
- app.example.com
|
||||
rules:
|
||||
- host: app.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: infisical
|
||||
port:
|
||||
number: 8080
|
||||
```
|
||||
|
||||
#### Secret Management
|
||||
|
||||
**Use Kubernetes secrets**. Store sensitive configuration securely:
|
||||
|
||||
```yaml
|
||||
# Kubernetes secret for environment variables
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: infisical-secrets
|
||||
namespace: infisical
|
||||
type: Opaque
|
||||
stringData:
|
||||
AUTH_SECRET: "<generate-with-openssl-rand-base64-32>"
|
||||
ENCRYPTION_KEY: "<generate-with-openssl-rand-hex-16>"
|
||||
DB_CONNECTION_URI: "<your-postgres-connection-string>"
|
||||
REDIS_URL: "<your-redis-connection-string>"
|
||||
SITE_URL: "<your-site-url>"
|
||||
```
|
||||
|
||||
**Note:** Kubernetes secrets are only base64-encoded by default and are not encrypted at rest unless you explicitly enable etcd encryption. For production environments, you should:
|
||||
|
||||
- Enable [etcd encryption at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) to protect secrets stored in the cluster
|
||||
- Limit access to etcd and Kubernetes API to only trusted administrators
|
||||
|
||||
#### Health Monitoring
|
||||
|
||||
**Set up health checks**. Configure readiness and liveness probes:
|
||||
|
||||
```yaml
|
||||
# Health check configuration
|
||||
containers:
|
||||
- name: infisical
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: 8080
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: 8080
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
```
|
||||
|
||||
#### Infrastructure Considerations
|
||||
|
||||
**Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.
|
||||
|
||||
#### Maintenance
|
||||
|
||||
**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.
|
||||
|
||||
### Linux Binary Deployment
|
||||
|
||||
These recommendations are specific to Linux binary deployments of Infisical.
|
||||
|
||||
#### System User Management
|
||||
|
||||
**Create dedicated user account**. Run Infisical under a dedicated service account:
|
||||
|
||||
```bash
|
||||
# Create dedicated user
|
||||
sudo useradd --system --shell /bin/false --home-dir /opt/infisical infisical
|
||||
|
||||
# Create application directory
|
||||
sudo mkdir -p /opt/infisical
|
||||
sudo chown infisical:infisical /opt/infisical
|
||||
```
|
||||
|
||||
#### Service Configuration
|
||||
|
||||
**Configure systemd service**. Create a secure systemd service:
|
||||
|
||||
```ini
|
||||
# /etc/systemd/system/infisical.service
|
||||
[Unit]
|
||||
Description=Infisical Secret Management
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
# IMPORTANT: Change from default 'root' user to dedicated service account
|
||||
User=infisical
|
||||
Group=infisical
|
||||
WorkingDirectory=/opt/infisical
|
||||
ExecStart=/opt/infisical/infisical-linux-amd64
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
# Security settings
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ReadWritePaths=/opt/infisical
|
||||
PrivateTmp=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LimitCORE=0
|
||||
MemorySwapMax=0
|
||||
|
||||
# Environment file
|
||||
EnvironmentFile=/etc/infisical/environment
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
#### Configuration Security
|
||||
|
||||
**Secure environment configuration**. Store environment variables securely:
|
||||
|
||||
```bash
|
||||
# Create secure config directory
|
||||
sudo mkdir -p /etc/infisical
|
||||
sudo chmod 750 /etc/infisical
|
||||
sudo chown root:infisical /etc/infisical
|
||||
|
||||
# Create environment file
|
||||
sudo touch /etc/infisical/environment
|
||||
sudo chmod 640 /etc/infisical/environment
|
||||
sudo chown root:infisical /etc/infisical/environment
|
||||
```
|
||||
|
||||
#### System Security
|
||||
|
||||
**Disable memory swapping**. Prevent sensitive data from being written to disk:
|
||||
|
||||
```bash
|
||||
# Disable swap immediately
|
||||
sudo swapoff -a
|
||||
|
||||
# Disable swap permanently (comment out swap entries)
|
||||
sudo sed -i '/swap/d' /etc/fstab
|
||||
```
|
||||
|
||||
**Disable core dumps**. Prevent potential exposure of encryption keys:
|
||||
|
||||
```bash
|
||||
# Set system-wide core dump limits
|
||||
echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
|
||||
|
||||
# Disable core dumps for current session
|
||||
ulimit -c 0
|
||||
```
|
||||
|
||||
#### File Permissions
|
||||
|
||||
**Secure file permissions**. Set proper permissions on application files:
|
||||
|
||||
```bash
|
||||
# Set binary permissions
|
||||
sudo chmod 755 /opt/infisical/infisical-linux-amd64
|
||||
sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
|
||||
|
||||
# Set config file permissions
|
||||
sudo chmod 640 /etc/infisical/environment
|
||||
sudo chown root:infisical /etc/infisical/environment
|
||||
```
|
||||
|
||||
#### Network Security
|
||||
|
||||
**Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:
|
||||
|
||||
```bash
|
||||
# Configure UFW firewall
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
|
||||
# Allow Infisical API access
|
||||
sudo ufw allow 8080/tcp
|
||||
|
||||
# Allow HTTPS (if terminating TLS at Infisical)
|
||||
sudo ufw allow 443/tcp
|
||||
|
||||
# If running PostgreSQL locally, restrict to localhost
|
||||
sudo ufw allow from 127.0.0.1 to any port 5432
|
||||
|
||||
# If running Redis locally, restrict to localhost
|
||||
sudo ufw allow from 127.0.0.1 to any port 6379
|
||||
|
||||
# Enable firewall
|
||||
sudo ufw --force enable
|
||||
```
|
||||
|
||||
#### System Maintenance
|
||||
|
||||
**Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:
|
||||
|
||||
```bash
|
||||
# Install and configure NTP
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y ntp
|
||||
sudo systemctl enable ntp
|
||||
sudo systemctl start ntp
|
||||
|
||||
# Verify time synchronization
|
||||
timedatectl status
|
||||
```
|
||||
|
||||
**Regular updates**. Monitor [Cloudsmith releases](https://cloudsmith.io/~infisical/repos/infisical-core/packages) for new binary versions and update your installation regularly.
|
||||
|
||||
## Enterprise Security Features
|
||||
|
||||
### Hardware Security Module (HSM) Integration
|
||||
|
||||
For the highest level of encryption security, integrate with Hardware Security Modules:
|
||||
|
||||
HSM integration provides hardware-protected encryption keys stored on tamper-proof devices, offering superior security for encryption operations:
|
||||
|
||||
- **Supported HSM Providers**: Thales Luna Cloud HSM, AWS CloudHSM, Fortanix HSM
|
||||
- **Root Key Protection**: HSM encrypts Infisical's root encryption keys using hardware-protected keys
|
||||
- **Enterprise Requirements**: Ideal for government, financial, and healthcare organizations
|
||||
|
||||
```bash
|
||||
# HSM Environment Variables (example for production)
|
||||
HSM_LIB_PATH="/path/to/hsm/library.so"
|
||||
HSM_PIN="your-hsm-pin"
|
||||
HSM_SLOT="0"
|
||||
HSM_KEY_LABEL="infisical-root-key"
|
||||
```
|
||||
|
||||
For complete HSM setup instructions, see the [HSM Integration Guide](/documentation/platform/kms/hsm-integration).
|
||||
|
||||
### External Key Management Service (KMS) Integration
|
||||
|
||||
Leverage cloud-native KMS providers for enhanced security and compliance:
|
||||
|
||||
Infisical can integrate with external KMS providers to encrypt project secrets, providing enterprise-grade key management:
|
||||
|
||||
- **Supported Providers**: AWS KMS, Google Cloud KMS, Azure Key Vault (coming soon)
|
||||
- **Workspace Key Protection**: Each project's encryption key is protected by your external KMS
|
||||
- **Envelope Encryption**: Infisical uses your cloud KMS to encrypt/decrypt project workspace keys, which in turn encrypt the actual secret data
|
||||
- **Compliance**: Leverage your cloud provider's compliance certifications (FedRAMP, SOC2, ISO 27001)
|
||||
|
||||
#### Benefits for Production Deployments
|
||||
|
||||
- **Separation of Concerns**: Keys managed in your cloud infrastructure, separate from Infisical
|
||||
- **Regulatory Compliance**: Use your existing compliance-certified KMS infrastructure
|
||||
- **Audit Integration**: KMS operations logged in your cloud provider's audit trails
|
||||
- **Disaster Recovery**: Keys backed by your cloud provider's HA and backup systems
|
||||
- **Access Controls**: Leverage your cloud IAM for KMS access management
|
||||
|
||||
#### Configuration Resources
|
||||
|
||||
For external KMS configuration, see:
|
||||
|
||||
- [AWS KMS Integration](/documentation/platform/kms-configuration/aws-kms)
|
||||
- [GCP KMS Integration](/documentation/platform/kms-configuration/gcp-kms)
|
||||
- [External KMS Overview](/documentation/platform/kms-configuration/overview)
|
||||
|
||||
## Advanced Security Configurations
|
||||
|
||||
### Backup Security
|
||||
|
||||
**Configure backup encryption**. Encrypt PostgreSQL backups:
|
||||
|
||||
```bash
|
||||
# PostgreSQL backup with encryption
|
||||
pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
|
||||
```
|
||||
|
||||
### Monitoring and Logging
|
||||
|
||||
**Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
|
||||
|
||||
### Security Updates
|
||||
|
||||
**Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.
|
||||
|
||||
## Compliance and Monitoring
|
||||
|
||||
### Enterprise Compliance Requirements
|
||||
|
||||
For enterprise deployments requiring compliance certifications:
|
||||
|
||||
- Implement audit log retention policies
|
||||
- Set up security event monitoring and alerting
|
||||
- Configure automated vulnerability scanning
|
||||
- Establish incident response procedures
|
||||
- Document security controls for compliance audits
|
||||
|
||||
### Standards Compliance
|
||||
|
||||
**FIPS 140-3 Compliance**. Infisical is actively working on FIPS 140-3 compliance to meet U.S. and Canadian government cryptographic standards. This will provide validated cryptographic modules for organizations requiring certified encryption implementations.
|
||||
Reference in New Issue
Block a user