mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Add TRUST_SAML_EMAILS and TRUST_LDAP_EMAILS opts
This commit is contained in:
Tuan Dang
@@ -3,30 +3,34 @@ title: "Configurations"
|
||||
description: "Read how to configure environment variables for self-hosted Infisical."
|
||||
---
|
||||
|
||||
|
||||
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined.
|
||||
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined.
|
||||
However, you can configure additional settings to activate more features as needed.
|
||||
|
||||
## General platform
|
||||
## General platform
|
||||
|
||||
Used to configure platform-specific security and operational settings
|
||||
|
||||
<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex
|
||||
16`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="AUTH_SECRET" type="string" default="none" required>
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand
|
||||
-base64 32`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SITE_URL" type="string" default="none" optional>
|
||||
Must be an absolute URL including the protocol (e.g. https://app.infisical.com).
|
||||
Must be an absolute URL including the protocol (e.g.
|
||||
https://app.infisical.com).
|
||||
</ParamField>
|
||||
|
||||
## Data Layer
|
||||
## Data Layer
|
||||
|
||||
The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
|
||||
Postgres database connection string.
|
||||
Postgres database connection string.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
@@ -39,9 +43,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
Redis connection string.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
## Email service
|
||||
|
||||
Without email configuration, Infisical's core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
|
||||
|
||||
<Accordion title="Generic Configuration">
|
||||
@@ -49,25 +52,36 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
Hostname to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
|
||||
</ParamField>
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if
|
||||
STARTTLS is supported
|
||||
</ParamField>
|
||||
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
|
||||
Name label to be used in From field (e.g. Team)
|
||||
@@ -76,25 +90,25 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
|
||||
<Accordion title="Twilio SendGrid">
|
||||
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
@@ -105,19 +119,20 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
|
||||
2. Obtain your Mailgun credentials in Sending > Overview > SMTP
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="AWS SES">
|
||||
@@ -149,6 +164,7 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Step>
|
||||
|
||||
</Steps>
|
||||
|
||||
<Info>
|
||||
@@ -160,30 +176,32 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
|
||||
2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
{" "}
|
||||
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
@@ -194,55 +212,57 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account on [Resend](https://resend.com).
|
||||
2. Add a [Domain](https://resend.com/domains).
|
||||
|
||||
|
||||
|
||||
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
|
||||
|
||||
|
||||
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
|
||||
|
||||
|
||||
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gmail">
|
||||
Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
|
||||
applications like Infisical to authenticate with Gmail via your username and password.
|
||||
|
||||
|
||||
|
||||
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Warning>
|
||||
As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
|
||||
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
|
||||
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
|
||||
</Warning>
|
||||
</Accordion>
|
||||
@@ -250,51 +270,51 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
<Accordion title="Office365">
|
||||
1. Create an account and configure [Office365](https://www.office.com/) to send emails.
|
||||
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Zoho Mail">
|
||||
1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
|
||||
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
{" "}
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
## Authentication
|
||||
|
||||
|
||||
|
||||
|
||||
## SSO based login
|
||||
By default, users can only login via email/password based login method.
|
||||
To login into Infisical with OAuth providers such as Google, configure the associated variables.
|
||||
|
||||
@@ -335,33 +355,49 @@ To login into Infisical with OAuth providers such as Google, configure the assoc
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Okta SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Azure SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="JumpCloud SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<ParamField query="NEXT_PUBLIC_SAML_ORG_SLUG" type="string">
|
||||
Configure SAML organization slug to automatically redirect all users of your Infisical instance to the identity provider.
|
||||
<ParamField query="TRUST_SAML_EMAILS" type="boolean" default="false" optional>
|
||||
Whether or not to trust emails from external SAML identity providers. If set
|
||||
to `false` then users will be prompted to verify their email address upon
|
||||
first login.
|
||||
</ParamField>
|
||||
<ParamField query="TRUST_LDAP_EMAILS" type="string" default="false" optional>
|
||||
Whether or not to trust emails from external LDAP servers. If set to `false`
|
||||
then users will be prompted to verify their email address upon first login.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
|
||||
<ParamField query="NEXT_PUBLIC_SAML_ORG_SLUG" type="string">
|
||||
Configure SAML organization slug to automatically redirect all users of your
|
||||
Infisical instance to the identity provider.
|
||||
</ParamField>
|
||||
|
||||
## Native secret integrations
|
||||
|
||||
To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
|
||||
|
||||
<Accordion title="Heroku">
|
||||
<ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client ID for Heroku integration
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
|
||||
<ParamField
|
||||
query="CLIENT_SECRET_HEROKU"
|
||||
type="string"
|
||||
default="none"
|
||||
optional
|
||||
>
|
||||
OAuth2 client secret for Heroku integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
@@ -371,9 +407,11 @@ To help you sync secrets from Infisical to services such as Github and Gitlab, I
|
||||
OAuth2 client ID for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 slug for Vercel integration
|
||||
|
||||
Reference in New Issue
Block a user