From 4baff6195c2ba89ffcf925011590f53f7b56fe2c Mon Sep 17 00:00:00 2001 From: x032205 Date: Mon, 20 Oct 2025 17:32:47 -0400 Subject: [PATCH 1/3] docs: remove mention of --type flag from relay docs --- .../platform/gateways/relay-deployment.mdx | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/docs/documentation/platform/gateways/relay-deployment.mdx b/docs/documentation/platform/gateways/relay-deployment.mdx index adf5fdb9d..fb0a9ea8f 100644 --- a/docs/documentation/platform/gateways/relay-deployment.mdx +++ b/docs/documentation/platform/gateways/relay-deployment.mdx @@ -32,73 +32,73 @@ To successfully deploy an Infisical Relay for use, follow these steps in order. Simple and secure authentication using client ID and client secret. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=universal-auth` - `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=` - `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=` - + Direct authentication using a machine identity access token. - + **Environment Variables:** - `INFISICAL_TOKEN=` - + Authentication using Kubernetes service account tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=kubernetes` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using AWS IAM roles. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=aws-iam` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using GCP identity tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=gcp-id-token` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using GCP service account keys. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=gcp-iam` - `INFISICAL_MACHINE_IDENTITY_ID=` - `INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH=` - + Authentication using Azure managed identity. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=azure` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using OIDC identity tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=oidc-auth` - `INFISICAL_MACHINE_IDENTITY_ID=` - `INFISICAL_JWT=` - + Authentication using JWT tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=jwt-auth` - `INFISICAL_MACHINE_IDENTITY_ID=` @@ -168,7 +168,6 @@ To successfully deploy an Infisical Relay for use, follow these steps in order. ```bash infisical relay start \ - --type= \ --host= \ --name= \ --auth-method= From 430f81f1cb1a1007f9cb618c0e55718a934caae7 Mon Sep 17 00:00:00 2001 From: x032205 Date: Mon, 20 Oct 2025 17:44:11 -0400 Subject: [PATCH 2/3] docs: wrap all accordions in accordiongroups --- .../gateways-deprecated/networking.mdx | 16 ++++--- .../platform/gateways/gateway-deployment.mdx | 44 +++++++++---------- .../platform/gateways/relay-deployment.mdx | 2 + 3 files changed, 33 insertions(+), 29 deletions(-) diff --git a/docs/documentation/platform/gateways-deprecated/networking.mdx b/docs/documentation/platform/gateways-deprecated/networking.mdx index 6acdc1993..51a81ee42 100644 --- a/docs/documentation/platform/gateways-deprecated/networking.mdx +++ b/docs/documentation/platform/gateways-deprecated/networking.mdx @@ -3,7 +3,7 @@ title: "Networking" description: "Network configuration and firewall requirements for Infisical Gateway" --- -The Infisical Gateway requires outbound network connectivity to establish secure communication with Infisical's relay infrastructure. +The Infisical Gateway requires outbound network connectivity to establish secure communication with Infisical's relay infrastructure. This page outlines the required ports, protocols, and firewall configurations needed for optimal gateway usage. ## Network Architecture @@ -67,11 +67,11 @@ The gateway uses QUIC (Quick UDP Internet Connections) for primary communication ## Understanding Firewall Behavior with UDP Unlike TCP connections, UDP is a stateless protocol, and depending on your organization's firewall configuration, you may need to adjust network rules accordingly. -When the gateway sends UDP packets to a relay server, the return responses need to be allowed back through the firewall. -Modern firewalls handle this through "connection tracking" (also called "stateful inspection"), but the behavior can vary depending on your firewall configuration. +When the gateway sends UDP packets to a relay server, the return responses need to be allowed back through the firewall. +Modern firewalls handle this through "connection tracking" (also called "stateful inspection"), but the behavior can vary depending on your firewall configuration. -### Connection Tracking +### Connection Tracking Modern firewalls automatically track UDP connections and allow return responses. This is the preferred configuration as it: - Automatically handles return responses @@ -100,6 +100,7 @@ Configure security groups to allow: ## Frequently Asked Questions + The gateway is designed to handle network interruptions gracefully: @@ -139,7 +140,7 @@ This design maintains security by avoiding the need for inbound firewall rules t If your firewall has strict UDP restrictions: 1. **Work with your network team** to allow outbound UDP to the specific relay IP addresses -2. **Use explicit IP whitelisting** if connection tracking is disabled +2. **Use explicit IP whitelisting** if connection tracking is disabled 3. **Consider network policy exceptions** for the gateway host 4. **Monitor firewall logs** to identify which specific rules are blocking traffic @@ -161,8 +162,9 @@ No, relay servers cannot decrypt any traffic passing through them: - **End-to-end encryption**: All traffic between the gateway and Infisical Cloud is encrypted using mutual TLS with certificate pinning - **Relay acts as a tunnel**: The relay server only forwards encrypted packets - it has no access to encryption keys -- **No data storage**: Relay servers do not store any traffic or network-identifiable information +- **No data storage**: Relay servers do not store any traffic or network-identifiable information - **Certificate isolation**: Each organization has its own private PKI system, ensuring complete tenant isolation The relay infrastructure is designed as a secure forwarding mechanism, similar to a VPN tunnel, where the relay provider cannot see the contents of the traffic flowing through it. - \ No newline at end of file + + diff --git a/docs/documentation/platform/gateways/gateway-deployment.mdx b/docs/documentation/platform/gateways/gateway-deployment.mdx index cef258c41..9a5b7d816 100644 --- a/docs/documentation/platform/gateways/gateway-deployment.mdx +++ b/docs/documentation/platform/gateways/gateway-deployment.mdx @@ -3,7 +3,7 @@ title: "Gateway Deployment" description: "Complete guide to deploying Infisical Gateways including network configuration and firewall requirements" --- -Infisical Gateways enables secure communication between your private resources and the Infisical platform without exposing inbound ports in your network. +Infisical Gateways enables secure communication between your private resources and the Infisical platform without exposing inbound ports in your network. This guide covers everything you need to deploy and configure Infisical Gateways. ## Deployment Steps @@ -18,73 +18,73 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order Simple and secure authentication using client ID and client secret. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=universal-auth` - `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=` - `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=` - + Direct authentication using a machine identity access token. - + **Environment Variables:** - `INFISICAL_TOKEN=` - + Authentication using Kubernetes service account tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=kubernetes` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using AWS IAM roles. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=aws-iam` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using GCP identity tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=gcp-id-token` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using GCP service account keys. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=gcp-iam` - `INFISICAL_MACHINE_IDENTITY_ID=` - `INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH=` - + Authentication using Azure managed identity. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=azure` - `INFISICAL_MACHINE_IDENTITY_ID=` - + Authentication using OIDC identity tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=oidc-auth` - `INFISICAL_MACHINE_IDENTITY_ID=` - `INFISICAL_JWT=` - + Authentication using JWT tokens. - + **Environment Variables:** - `INFISICAL_AUTH_METHOD=jwt-auth` - `INFISICAL_MACHINE_IDENTITY_ID=` @@ -111,7 +111,7 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order | TCP | Infisical instance host (US/EU, other) | 443 | API communication and certificate requests | For managed relays, allow outbound traffic to the provided relay server IP/hostname. For self-hosted relays, allow outbound traffic to your own relay server address. - + If you are in a corporate environment with strict egress filtering, ensure outbound TCP 2222 to relay servers and outbound HTTPS 443 to Infisical API endpoints are allowed. @@ -185,10 +185,9 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order - - - ## Frequently Asked Questions + + No inbound ports need to be opened for gateways. The gateway only makes outbound connections: @@ -263,3 +262,4 @@ The gateway is designed to handle network interruptions gracefully: No manual intervention is typically required during network interruptions. + diff --git a/docs/documentation/platform/gateways/relay-deployment.mdx b/docs/documentation/platform/gateways/relay-deployment.mdx index fb0a9ea8f..767cf3732 100644 --- a/docs/documentation/platform/gateways/relay-deployment.mdx +++ b/docs/documentation/platform/gateways/relay-deployment.mdx @@ -184,6 +184,7 @@ To successfully deploy an Infisical Relay for use, follow these steps in order. ## Frequently Asked Questions + No, relay servers cannot decrypt any traffic passing through them due to end-to-end encryption: @@ -240,3 +241,4 @@ Relay server outages affect gateway connectivity: For production environments, consider deploying multiple relay servers to avoid single points of failure. + From 57fc8cdaecf5c16cb0e139970bdd72bf1e368469 Mon Sep 17 00:00:00 2001 From: x032205 Date: Mon, 20 Oct 2025 17:53:54 -0400 Subject: [PATCH 3/3] docs: wrap accordions in accordiongroup for CLI reference --- docs/cli/commands/gateway.mdx | 12 ++++++++++++ docs/cli/commands/relay.mdx | 10 +++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/docs/cli/commands/gateway.mdx b/docs/cli/commands/gateway.mdx index bddbf614c..59202e46e 100644 --- a/docs/cli/commands/gateway.mdx +++ b/docs/cli/commands/gateway.mdx @@ -31,6 +31,7 @@ If you are moving from Gateway v1 to Gateway v2, this is NOT a drop-in switch. G ## Subcommands & flags + Run the Infisical gateway component within your the network where your target resources are located. The gateway establishes an SSH reverse tunnel to the specified relay server and provides secure access to private resources within your network. @@ -245,6 +246,7 @@ The Relay supports multiple authentication methods. Below are the available auth ### Other Flags + The name of the relay that this gateway should connect to. The relay must be running and registered before starting the gateway. @@ -276,6 +278,7 @@ The Relay supports multiple authentication methods. Below are the available auth ``` + @@ -293,6 +296,7 @@ sudo infisical gateway systemd install --token= --domain= --name= ### Flags + The machine identity access token to authenticate with Infisical. @@ -334,6 +338,7 @@ sudo infisical gateway systemd install --token= --domain= --name= ``` + ### Service Details @@ -360,9 +365,11 @@ sudo systemctl disable infisical-gateway # Disable auto-start on boot ``` + ## Legacy Gateway Commands + **This command is deprecated and will be removed in a future release.** @@ -579,6 +586,7 @@ The Infisical CLI supports multiple authentication methods. Below are the availa ### Other Flags + Domain of your self-hosted Infisical instance. @@ -588,6 +596,7 @@ The Infisical CLI supports multiple authentication methods. Below are the availa ``` + @@ -614,6 +623,7 @@ sudo infisical gateway install --token= --domain= ### Flags + The machine identity access token to authenticate with Infisical. @@ -635,6 +645,7 @@ sudo infisical gateway install --token= --domain= ``` + ### Service Details @@ -659,3 +670,4 @@ sudo systemctl disable infisical-gateway # Disable auto-start on boot ``` + diff --git a/docs/cli/commands/relay.mdx b/docs/cli/commands/relay.mdx index b377b9ce2..92358ed8b 100644 --- a/docs/cli/commands/relay.mdx +++ b/docs/cli/commands/relay.mdx @@ -13,7 +13,7 @@ description: "Relay-related commands for Infisical" ```bash # Install systemd service sudo infisical relay systemd install --host= --name= --token= - + # Uninstall systemd service sudo infisical relay systemd uninstall ``` @@ -26,6 +26,7 @@ Relay-related commands for Infisical that provide identity-aware relay infrastru ## Subcommands & flags + Run the Infisical relay component. The relay handles network traffic routing between Infisical and your gateways. @@ -35,6 +36,7 @@ infisical relay start --host= --name= --auth-method= ### Flags + The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach. @@ -57,6 +59,7 @@ infisical relay start --host= --name= --auth-method= ``` + ### Authentication @@ -280,6 +283,7 @@ infisical relay systemd ### Subcommands + Install and enable systemd service for the relay. Must be run with sudo on Linux systems. @@ -289,6 +293,7 @@ sudo infisical relay systemd install --host= --name= --token= #### Flags + The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach. @@ -331,6 +336,7 @@ sudo infisical relay systemd install --domain=http://localhost:8080 --token= + #### Examples @@ -386,5 +392,7 @@ sudo infisical relay systemd uninstall - Cleans up the service configuration + +