mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge remote-tracking branch 'origin/main' into ENG-3639
This commit is contained in:
Carlos Monastyrski
@@ -9,7 +9,7 @@ description: "Run the Infisical gateway or manage its systemd service"
|
||||
infisical gateway start --name=<name> --relay=<relay-name> --auth-method=<auth-method>
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Install gateway service">
|
||||
<Tab title="Start gateway as background daemon (Linux only)">
|
||||
```bash
|
||||
sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=<name> --relay=<relay-name>
|
||||
```
|
||||
@@ -25,29 +25,29 @@ The gateway system uses SSH reverse tunnels over TCP, eliminating firewall compl
|
||||
<Warning>
|
||||
**Deprecation and Migration Notice:** The legacy `infisical gateway` command (v1) will be removed in a future release. Please migrate to `infisical gateway start` (Gateway v2).
|
||||
|
||||
If you are moving from Gateway v1 to Gateway v2, this is NOT a drop-in switch. Gateway v2 creates new gateway instances with new gateway IDs. You must update any existing resources that reference gateway IDs (for example: dynamic secret configs, app connections, or other gateway-bound resources) to point to the new Gateway v2 gateway ID. Until you update those references, traffic will continue to target the old v1 gateway.
|
||||
If you are moving from Gateway v1 to Gateway v2, this is NOT a drop-in switch. Gateway v2 creates new gateway instances with new gateway IDs. You must update any existing resources that reference gateway IDs (for example: dynamic secret configs, app connections, or other gateway-bound resources) to point to the new Gateway v2 gateway resource. Until you update those references, traffic will continue to target the old v1 gateway.
|
||||
|
||||
</Warning>
|
||||
|
||||
## Subcommands & flags
|
||||
|
||||
<Accordion title="infisical gateway start" defaultOpen="true">
|
||||
Run the Infisical gateway component within your VPC. The gateway establishes an SSH reverse tunnel to the specified relay server and provides secure access to private resources.
|
||||
Run the Infisical gateway component within your the network where your target resources are located. The gateway establishes an SSH reverse tunnel to the specified relay server and provides secure access to private resources within your network.
|
||||
|
||||
```bash
|
||||
infisical gateway start --relay=<relay-name> --name=<name> --auth-method=<auth-method>
|
||||
```
|
||||
|
||||
The gateway component:
|
||||
Once started, the gateway component will:
|
||||
|
||||
- Establishes outbound SSH reverse tunnels to relay servers (no inbound firewall rules needed)
|
||||
- Authenticates using SSH certificates issued by Infisical
|
||||
- Automatically reconnects if the connection is lost
|
||||
- Provides access to private resources within your network
|
||||
- Establish outbound SSH reverse tunnels to relay servers (no inbound firewall rules needed)
|
||||
- Authenticate using SSH certificates issued by Infisical
|
||||
- Automatically reconnect if the connection is lost
|
||||
- Provide access to private resources within your network
|
||||
|
||||
### Authentication
|
||||
|
||||
The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
|
||||
The Relay supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Universal Auth">
|
||||
@@ -361,12 +361,12 @@ sudo systemctl disable infisical-gateway # Disable auto-start on boot
|
||||
|
||||
</Accordion>
|
||||
|
||||
## Legacy Gateway Commands (Deprecated)
|
||||
## Legacy Gateway Commands
|
||||
|
||||
<Accordion title="infisical gateway (deprecated)">
|
||||
<Warning>
|
||||
**This command is deprecated and will be removed in a future release.**
|
||||
|
||||
|
||||
Please migrate to `infisical gateway start` for the new TCP-based SSH tunnel architecture.
|
||||
|
||||
**Migration required:** If you are currently using Gateway v1 (via `infisical gateway`), moving to Gateway v2 is not in-place. Gateway v2 provisions new gateway instances with new gateway IDs. Update any resources that reference a gateway ID (for example: dynamic secret configs, app connections, or other gateway-bound resources) to use the new Gateway v2 gateway ID. Until you update those references, traffic will continue to target the old v1 gateway.
|
||||
@@ -593,7 +593,7 @@ The Infisical CLI supports multiple authentication methods. Below are the availa
|
||||
<Accordion title="infisical gateway install (deprecated)">
|
||||
<Warning>
|
||||
**This command is deprecated and will be removed in a future release.**
|
||||
|
||||
|
||||
Please migrate to `infisical gateway systemd install` for the new TCP-based SSH tunnel architecture with enhanced security and better performance.
|
||||
|
||||
**Migration required:** If you previously installed Gateway v1 via `infisical gateway install`, moving to Gateway v2 is not in-place. Gateway v2 provisions new gateway instances with new gateway IDs. Update any resources that reference a gateway ID (for example: dynamic secret configs, app connections, or other gateway-bound resources) to use the new Gateway v2 gateway ID. Until you update those references, traffic will continue to target the old v1 gateway.
|
||||
|
||||
@@ -6,88 +6,70 @@ description: "Relay-related commands for Infisical"
|
||||
<Tabs>
|
||||
<Tab title="Start relay">
|
||||
```bash
|
||||
infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
|
||||
infisical relay start --host=<host> --name=<name> --auth-method=<auth-method>
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Start relay as background daemon (Linux only)">
|
||||
```bash
|
||||
# Install systemd service
|
||||
sudo infisical relay systemd install --host=<host> --name=<name> --token=<token>
|
||||
|
||||
# Uninstall systemd service
|
||||
sudo infisical relay systemd uninstall
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Description
|
||||
|
||||
Relay-related commands for Infisical that provide identity-aware relay infrastructure for routing encrypted traffic:
|
||||
|
||||
- **Relay**: Identity-aware server that routes encrypted traffic (can be instance-wide or organization-specific)
|
||||
|
||||
The relay system uses SSH reverse tunnels over TCP, eliminating firewall complexity and providing excellent performance for enterprise environments.
|
||||
Relay-related commands for Infisical that provide identity-aware relay infrastructure for routing encrypted traffic. Relays are organization-deployed servers that route encrypted traffic between Infisical and your gateways.
|
||||
|
||||
## Subcommands & flags
|
||||
|
||||
<Accordion title="infisical relay start" defaultOpen="true">
|
||||
Run the Infisical relay component. The relay handles network traffic routing and can operate in different modes.
|
||||
Run the Infisical relay component. The relay handles network traffic routing between Infisical and your gateways.
|
||||
|
||||
```bash
|
||||
infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
|
||||
infisical relay start --host=<host> --name=<name> --auth-method=<auth-method>
|
||||
```
|
||||
|
||||
### Flags
|
||||
|
||||
<Accordion title="--type">
|
||||
The type of relay to run. Must be either 'instance' or 'org'.
|
||||
|
||||
- **`instance`**: Shared relay server that can be used by all organizations on your Infisical instance. Set up by the instance administrator. Uses `INFISICAL_RELAY_AUTH_SECRET` environment variable for authentication, which must be configured by the instance admin.
|
||||
- **`org`**: Dedicated relay server that individual organizations deploy and manage in their own infrastructure. Provides enhanced security, custom geographic placement, and compliance benefits. Uses standard Infisical authentication methods.
|
||||
|
||||
```bash
|
||||
# Organization relay (customer-deployed)
|
||||
infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay
|
||||
|
||||
# Instance relay (configured by instance admin)
|
||||
INFISICAL_RELAY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--host">
|
||||
The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach.
|
||||
|
||||
```bash
|
||||
# Example with IP address
|
||||
infisical relay start --host=203.0.113.100 --type=org --name=my-relay
|
||||
infisical relay start --host=203.0.113.100 --name=my-relay
|
||||
|
||||
# Example with hostname
|
||||
infisical relay start --host=relay.example.com --type=org --name=my-relay
|
||||
infisical relay start --host=relay.example.com --name=my-relay
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--name">
|
||||
The name of the relay.
|
||||
The name of the relay. This is an arbitrary identifier for your relay instance.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
infisical relay start --name=my-relay --type=org --host=192.168.1.100
|
||||
infisical relay start --name=my-relay --host=192.168.1.100
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
### Authentication
|
||||
|
||||
**Organization Relays (`--type=org`):**
|
||||
Deploy your own relay server in your infrastructure for enhanced security and reduced latency. Supports all standard Infisical authentication methods documented below.
|
||||
|
||||
**Instance Relays (`--type=instance`):**
|
||||
Shared relay servers that serve all organizations on your Infisical instance. For Infisical Cloud, these are already running and ready to use. For self-hosted deployments, they're set up by the instance administrator. Authentication is handled via the `INFISICAL_RELAY_AUTH_SECRET` environment variable.
|
||||
Relays support all standard Infisical authentication methods. Choose the authentication method that best fits your environment and set the corresponding flags when starting the relay.
|
||||
|
||||
```bash
|
||||
# Organization relay with Universal Auth (customer-deployed)
|
||||
infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
|
||||
|
||||
# Instance relay (configured by instance admin)
|
||||
INFISICAL_RELAY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
|
||||
# Example with Universal Auth
|
||||
infisical relay start --host=192.168.1.100 --name=my-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
|
||||
```
|
||||
|
||||
### Authentication Methods
|
||||
### Available Authentication Methods
|
||||
|
||||
The Infisical CLI supports multiple authentication methods for organization relays. Below are the available authentication methods, with their respective flags.
|
||||
The Infisical CLI supports multiple authentication methods for relays. Below are the available authentication methods, with their respective flags.
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Universal Auth">
|
||||
@@ -108,7 +90,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
</ParamField>
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -132,7 +114,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -153,7 +135,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -174,7 +156,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -196,7 +178,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
</ParamField>
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -215,7 +197,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
</ParamField>
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -237,7 +219,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
</ParamField>
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -261,7 +243,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
|
||||
|
||||
```bash
|
||||
infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
@@ -277,30 +259,132 @@ The Infisical CLI supports multiple authentication methods for organization rela
|
||||
</ParamField>
|
||||
|
||||
```bash
|
||||
infisical relay start --token=<token> --type=org --host=<host> --name=<name>
|
||||
infisical relay start --token=<token> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
### Deployment Considerations
|
||||
</Accordion>
|
||||
|
||||
**When to use Instance Relays (`--type=instance`):**
|
||||
<Accordion title="infisical relay systemd" defaultOpen="false">
|
||||
Manage systemd service for Infisical relay. This allows you to install and run the relay as a systemd service on Linux systems.
|
||||
### Requirements
|
||||
- **Operating System**: Linux only (systemd is not supported on other operating systems)
|
||||
- **Privileges**: Root/sudo privileges required for both install and uninstall operations
|
||||
- **Systemd**: The system must be running systemd as the init system
|
||||
|
||||
- You want to get started quickly without setting up your own relay infrastructure
|
||||
- You're using Infisical Cloud and want to leverage the existing relay infrastructure
|
||||
- You're on a self-hosted instance where the admin has already set up shared relays
|
||||
- You don't need custom geographic placement of relay servers
|
||||
- You don't have specific compliance requirements that require dedicated infrastructure
|
||||
- You want to minimize operational overhead by using shared infrastructure
|
||||
```bash
|
||||
infisical relay systemd <subcommand>
|
||||
```
|
||||
|
||||
**When to use Organization Relays (`--type=org`):**
|
||||
### Subcommands
|
||||
|
||||
- You need lower latency by deploying relay servers closer to your resources
|
||||
- You have security requirements that mandate running infrastructure in your own environment
|
||||
- You have compliance requirements such as data sovereignty or air-gapped environments
|
||||
- You need custom network policies or specific networking configurations
|
||||
- You have high-scale performance requirements that shared infrastructure can't meet
|
||||
- You want full control over your relay infrastructure and its configuration
|
||||
<Accordion title="install">
|
||||
Install and enable systemd service for the relay. Must be run with sudo on Linux systems.
|
||||
|
||||
```bash
|
||||
sudo infisical relay systemd install --host=<host> --name=<name> --token=<token> [flags]
|
||||
```
|
||||
|
||||
#### Flags
|
||||
|
||||
<Accordion title="--host">
|
||||
The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach.
|
||||
|
||||
```bash
|
||||
# Example with IP address
|
||||
sudo infisical relay systemd install --host=203.0.113.100 --name=my-relay --token=<token>
|
||||
|
||||
# Example with hostname
|
||||
sudo infisical relay systemd install --host=relay.example.com --name=my-relay --token=<token>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--name">
|
||||
The name of the relay.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
sudo infisical relay systemd install --name=my-relay --host=192.168.1.100 --token=<token>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--token">
|
||||
Connect with Infisical using machine identity access token.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
sudo infisical relay systemd install --token=<machine-identity-token> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--domain">
|
||||
Domain of your self-hosted Infisical instance. Optional flag for specifying a custom domain.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
sudo infisical relay systemd install --domain=http://localhost:8080 --token=<token> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
#### Examples
|
||||
|
||||
```bash
|
||||
# Install relay with token authentication
|
||||
sudo infisical relay systemd install --host=192.168.1.100 --name=my-relay --token=<machine-identity-token>
|
||||
|
||||
# Install with custom domain
|
||||
sudo infisical relay systemd install --domain=http://localhost:8080 --token=<token> --host=<host> --name=<name>
|
||||
```
|
||||
|
||||
#### Post-installation
|
||||
|
||||
After successful installation, the service will be enabled but not started. To start the service:
|
||||
|
||||
```bash
|
||||
sudo systemctl start infisical-relay
|
||||
```
|
||||
|
||||
To check the service status:
|
||||
|
||||
```bash
|
||||
sudo systemctl status infisical-relay
|
||||
```
|
||||
|
||||
To view service logs:
|
||||
|
||||
```bash
|
||||
sudo journalctl -u infisical-relay -f
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="uninstall">
|
||||
Uninstall and remove systemd service for the relay. Must be run with sudo on Linux systems.
|
||||
|
||||
```bash
|
||||
sudo infisical relay systemd uninstall
|
||||
```
|
||||
|
||||
#### Examples
|
||||
|
||||
```bash
|
||||
# Uninstall the relay systemd service
|
||||
sudo infisical relay systemd uninstall
|
||||
```
|
||||
|
||||
#### What it does
|
||||
|
||||
- Stops the `infisical-relay` systemd service if it's running
|
||||
- Disables the service from starting on boot
|
||||
- Removes the systemd service file
|
||||
- Cleans up the service configuration
|
||||
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
Reference in New Issue
Block a user