awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin' into ssh-non-interactive

Browse Source
This commit is contained in:
Tuan Dang
2025-04-25 09:31:39 -07:00
parent 1ea8e5a81e cd1e2af9bf
commit bb699ecb5f
272 changed files with 4533 additions and 773 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/api-reference/endpoints/app-connections/windmill/available.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Available"
openapi: "GET /api/v1/app-connections/windmill/available"
---

9
docs/api-reference/endpoints/app-connections/windmill/create.mdx Normal file
View File

@@ -0,0 +1,9 @@
---
title: "Create"
openapi: "POST /api/v1/app-connections/windmill"
---
<Note>
Check out the configuration docs for [Windmill Connections](/integrations/app-connections/windmill) to learn how to obtain
the required credentials.
</Note>

4
docs/api-reference/endpoints/app-connections/windmill/delete.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/app-connections/windmill/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/windmill/get-by-id.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by ID"
openapi: "GET /api/v1/app-connections/windmill/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/windmill/get-by-name.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by Name"
openapi: "GET /api/v1/app-connections/windmill/connection-name/{connectionName}"
---

4
docs/api-reference/endpoints/app-connections/windmill/list.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/app-connections/windmill"
---

9
docs/api-reference/endpoints/app-connections/windmill/update.mdx Normal file
View File

@@ -0,0 +1,9 @@
---
title: "Update"
openapi: "PATCH /api/v1/app-connections/windmill/{connectionId}"
---
<Note>
Check out the configuration docs for [Windmill Connections](/integrations/app-connections/windmill) to learn how to obtain
the required credentials.
</Note>

2
docs/api-reference/endpoints/project-groups/create.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Create Project Membership"
openapi: "POST /api/v2/workspace/{projectId}/groups/{groupId}"
openapi: "POST /api/v2/workspace/{projectId}/groups/{groupIdOrName}"
---

8
docs/api-reference/endpoints/project-roles/create.mdx
View File

@@ -1,8 +1,10 @@
---
title: "Create"
openapi: "POST /api/v1/workspace/{projectSlug}/roles"
openapi: "POST /api/v2/workspace/{projectId}/roles"
---
<Note>
You can read more about the permissions field in the [permissions documentation](/internals/permissions).
</Note>
You can read more about the permissions field in the [permissions
documentation](/internals/permissions).
</Note>

2
docs/api-reference/endpoints/project-roles/delete.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/workspace/{projectSlug}/roles/{roleId}"
openapi: "DELETE /api/v2/workspace/{projectId}/roles/{roleId}"
---

2
docs/api-reference/endpoints/project-roles/get-by-slug.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Get By Slug"
openapi: "GET /api/v1/workspace/{projectSlug}/roles/slug/{slug}"
openapi: "GET /api/v2/workspace/{projectId}/roles/slug/{roleSlug}"
---

2
docs/api-reference/endpoints/project-roles/list.mdx
View File

@@ -1,4 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/workspace/{projectSlug}/roles"
openapi: "GET /api/v2/workspace/{projectId}/roles"
---

2
docs/api-reference/endpoints/project-roles/update.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Update"
openapi: "PATCH /api/v1/workspace/{projectSlug}/roles/{roleId}"
openapi: "PATCH /api/v2/workspace/{projectId}/roles/{roleId}"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/create.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Create"
openapi: "POST /api/v1/secret-syncs/windmill"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/delete.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/secret-syncs/windmill/{syncId}"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/get-by-id.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by ID"
openapi: "GET /api/v1/secret-syncs/windmill/{syncId}"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/get-by-name.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by Name"
openapi: "GET /api/v1/secret-syncs/windmill/sync-name/{syncName}"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/import-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Import Secrets"
openapi: "POST /api/v1/secret-syncs/windmill/{syncId}/import-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/list.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/secret-syncs/windmill"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/remove-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Remove Secrets"
openapi: "POST /api/v1/secret-syncs/windmill/{syncId}/remove-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/sync-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Sync Secrets"
openapi: "POST /api/v1/secret-syncs/windmill/{syncId}/sync-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/windmill/update.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Update"
openapi: "PATCH /api/v1/secret-syncs/windmill/{syncId}"
---

40
docs/cli/commands/user.mdx
View File

@@ -8,22 +8,46 @@ infisical user
```
## Description
This command allows you to manage the current logged in users on the CLI
### Sub-commands
<Accordion title="infisical user switch" defaultOpen="true">
Use this command to switch between profiles that are currently logged into the CLI
### Sub-commands
<Accordion title="infisical user switch" defaultOpen="true">
Use this command to switch between profiles that are currently logged into the CLI
```bash
infisical user switch
```
```bash
infisical user switch
```
</Accordion>
<Accordion title="infisical user update domain">
With this command, you can modify the backend API that is utilized for all requests associated with a specific profile.
For instance, you have the option to point the profile to use either the Infisical Cloud or your own self-hosted Infisical instance.
```bash
infisical user update domain
```bash
infisical user update domain
```
</Accordion>
<Accordion title="infisical user get token">
Use this command to get your current Infisical access token and session information. This command requires you to be logged in.
The command will display:
- Your session ID
- Your full JWT access token
```bash
infisical user get token
```
Example output:
```bash
Session ID: abc123-xyz-456
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```
</Accordion>

33
docs/cli/overview.mdx
View File

@@ -28,21 +28,32 @@ You can use it across various environments, whether it's local development, CI/C
```
</Tab>
<Tab title="Windows">
Use [Scoop](https://scoop.sh/) package manager
```bash
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
```
<Accordion title="Scoop package manager">
Use [Scoop](https://scoop.sh/) package manager
```bash
scoop install infisical
```
```bash
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
```
### Updates
```bash
scoop install infisical
```
```bash
scoop update infisical
```
### Updates
```bash
scoop update infisical
```
</Accordion>
<Accordion title="Winget package manager">
Use [Winget](https://learn.microsoft.com/en-us/windows/package-manager/winget/) package manager
```bash
winget install infisical
```
</Accordion>
</Tab>
<Tab title="NPM">

35
docs/documentation/guides/organization-structure.mdx
View File

@@ -6,40 +6,55 @@ description: "Learn how to structure your projects, secrets, and other resources
Infisical is designed to provide comprehensive, centralized, and efficient management of secrets, certificates, and encryption keys within organizations. Below is an overview of Infisical's structured components, which developers and administrators can leverage for optimal project management and security posture.
### 1. Projects
### 0. Cluster/Instance
- **Best Practice**: In most cases, a single Infisical instance or cluster is sufficient. Multiple clusters are typically only necessary for large, globally distributed organizations.
- **Use Cases**:
- **Cloud-hosted** deployments typically use a single cluster. While technically possible, using multiple clusters is not a common practice and is generally unnecessary.
- **Self-hosted** deployments can be configured with multiple clusters if needed.
### 1. Organization
- **Definition**: An Infisical [organization](/documentation/platform/organization) is a set of projects that use the same billing.
- **Use Cases**:
- In **self-hosted** setups, you can create multiple organizations (e.g., one for each department or business unit).
- In **cloud-hosted deployments**, it's standard to use a single organization.
### 2. Projects
- **Definition and Role**: [Projects](/documentation/platform/project) are the highest-level construct within an [organization](/documentation/platform/organization) in Infisical. They serve as the primary container for all functionalities.
- **Correspondence to Code Repositories**: Projects typically align with specific code repositories.
- **Functional Capabilities**: Each project encompasses features for managing secrets, certificates, and encryption keys, serving as the central hub for these resources.
### 2. Environments
### 3. Environments
- **Purpose**: Environments are designed for organizing and compartmentalizing secrets within projects.
- **Customization Options**: Environments can be tailored to align with existing infrastructure setups of any project. Default options include **Development**, **Staging**, and **Production**.
- **Structure**: Each environment inherently has a root level for storing secrets, but additional sub-organizations can be created through [folders](/documentation/platform/folder) for better secret management.
### 3. Folders
### 4. Folders
- **Use Case**: Folders are available for more advanced organizational needs, allowing logical separation of secrets.
- **Typical Structure**: Folders can correspond to specific logical units, such as microservices or different layers of an application, providing refined control over secrets.
### 4. Imports
### 5. Imports
- **Purpose and Benefits**: To promote reusability and avoid redundancy, Infisical supports the use of imports. This allows secrets, folders, or entire environments to be referenced across multiple projects as needed.
- **Best Practice**: Utilizing [secret imports](/documentation/platform/secret-reference#secret-imports) or [references](/documentation/platform/secret-reference#secret-referencing) ensures consistency and minimizes manual overhead.
### 5. Approval Workflows
### 6. Approval Workflows
- **Importance**: Implementing approval workflows is recommended for organizations aiming to enhance efficiency and strengthen their security posture.
- **Types of Workflows**:
- **[Access Requests](/documentation/platform/pr-workflows)**: This workflow allows developers to request access to sensitive resources. Such access can be configured for temporary use, a practice known as "just-in-time" access.
- **[Change Requests](/documentation/platform/access-controls/access-requests)**: Facilitates reviews and approvals when changes are proposed for sensitive environments or specific folders, ensuring proper oversight.
### 6. Access Controls
### 7. Access Controls
Infisical’s access control framework is unified for both human users and machine identities, ensuring consistent management across the board.
### 6.1 Roles
### 7.1 Roles
- **2 Role Types**:
- **Organization-Level Roles**: Provide broad access across the organization (e.g., ability to manage billing, configure settings, etc.).
@@ -49,17 +64,17 @@ Infisical’s access control framework is unified for both human users and machi
<Note>Project access is defined not via an organization-level role, but rather through specific project memberships of both human and machine identities. Admin roles bypass this by default. </Note>
### 6.2 Additional Privileges
### 7.2 Additional Privileges
[Additional privileges](/documentation/platform/access-controls/additional-privileges) can be assigned to users and machines on an ad-hoc basis for specific scenarios where roles alone are insufficient. If you find yourself using additional privileges too much, it is recommended to create custom roles. Additional privileges can be temporary or permanent.
### 6.3 Attribute-Based Access Control (ABAC)
### 7.3 Attribute-Based Access Control (ABAC)
[Attribute-based Access Controls](/documentation/platform/access-controls/attribute-based-access-controls) allow restrictions based on tags or attributes linked to secrets. These can be integrated with SAML assertions and other security frameworks for dynamic access management.
### 6.4 User Groups
### 7.4 User Groups
- **Application**: Organizations should use users groups in situations when they have a lot of developers with the same level of access (e.g., separated by team, department, seniority, etc.).
- **Synchronization**: [User groups](/documentation/platform/groups) can be synced with an identity provider to maintain consistency and reduce manual management.

2
docs/documentation/platform/access-controls/role-based-access-controls.mdx
View File

@@ -25,7 +25,7 @@ By default, every user in a project is either a **viewer**, **developer**, or an
As such:
- **Admin**: This role enables identities to have access to all environments, folders, secrets, and actions within the project.
- **Developers**: This role restricts identities from performing project control actions, updating Approval Workflow policies, managing roles/members, and more.
- **Developers**: This role restricts identities from performing project control actions, updating Approval Workflow policies, managing roles, editing and removing project members, and more.
- **Viewer**: The most limiting bulit-in role on the project level – it forbids user and machine identities to perform any action and rather shows them in the read-only mode.
![Project member role](/images/platform/access-controls/rbac.png)

13
docs/documentation/platform/dynamic-secrets/overview.mdx
View File

@@ -41,3 +41,16 @@ Dynamic secrets are particularly useful in environments with stringent security
4. [Oracle](./oracle)
6. [Redis](./redis)
5. [AWS IAM](./aws-iam)
**FAQ**
<AccordionGroup>
<Accordion title="Why is my SQL dynamic secret failing when I generate a lease?">
This usually happens when the SQL statements defined for creating or revoking the secret are not compatible with your database provider.
Different SQL engines have different expectations for quoting identifiers and values. For example, some use backticks (`` `username` ``), others use single quotes (`'username'`), and some expect double quotes (`"username"`). A statement that works on one provider might fail on another.
**Recommendation:**
Make sure to adjust your SQL statements to follow the syntax required by your specific database provider. Always test them directly on your target database to ensure they execute without errors.
</Accordion>
</AccordionGroup>

2
docs/documentation/platform/kms-configuration/aws-kms.mdx
View File

@@ -19,7 +19,7 @@ Before you begin, you'll first need to choose a method of authentication with AW
![IAM Role Creation](/images/integrations/aws/integration-aws-iam-assume-role.png)
2. Select **AWS Account** as the **Trusted Entity Type**.
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If you are self-hosting, provide the AWS account number where Infisical is hosted.
3. Select **Another AWS Account** and provide the appropriate Infisical AWS Account ID: use **381492033652** for the **US region**, and **345594589636** for the **EU region**. This restricts the role to be assumed only by Infisical. If you are self-hosting, provide the AWS account number where Infisical is hosted.
4. Optionally, enable **Require external ID** and enter your Infisical **project ID** to further enhance security.
</Step>
<Step title="Add Required Permissions for the IAM Role">

BIN
docs/images/app-connections/windmill/create-windmill-access-token.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 752 KiB

BIN
docs/images/app-connections/windmill/select-windmill-connection.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 807 KiB

BIN
docs/images/app-connections/windmill/windmill-access-token-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.2 MiB

BIN
docs/images/app-connections/windmill/windmill-account-settings.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 322 KiB

BIN
docs/images/app-connections/windmill/windmill-copy-token.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 378 KiB

BIN
docs/images/app-connections/windmill/windmill-create-token.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 336 KiB

BIN
docs/images/app-connections/windmill/windmill-new-token.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 373 KiB

BIN
docs/images/secret-syncs/windmill/select-windmill-option.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 775 KiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.2 MiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-destination.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 752 KiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-details.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 741 KiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-options.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 758 KiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-review.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 764 KiB

BIN
docs/images/secret-syncs/windmill/windmill-sync-source.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 725 KiB

BIN
docs/images/self-hosting/reference-architectures/google-cloud-run/cloud-run-container-image.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 196 KiB

BIN
docs/images/self-hosting/reference-architectures/google-cloud-run/container-env-vars.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 203 KiB

BIN
docs/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 217 KiB

3
docs/integrations/app-connections/aws.mdx
View File

@@ -55,7 +55,7 @@ Infisical supports two methods for connecting to AWS.
![IAM Role Creation](/images/integrations/aws/integration-aws-iam-assume-role.png)
2. Select **AWS Account** as the **Trusted Entity Type**.
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
3. Select **Another AWS Account** and provide the appropriate Infisical AWS Account ID: use **381492033652** for the **US region**, and **345594589636** for the **EU region**. This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
4. (Recommended) <strong>Enable "Require external ID"</strong> and input your **Organization ID** to strengthen security and mitigate the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
<Warning type="warning" title="Security Best Practice: Use External ID to Prevent Confused Deputy Attacks">
@@ -362,4 +362,5 @@ Infisical supports two methods for connecting to AWS.
</Steps>
</Tab>
</Tabs>

112
docs/integrations/app-connections/windmill.mdx Normal file
View File

@@ -0,0 +1,112 @@
---
title: "Windmill Connection"
description: "Learn how to configure a Windmill Connection for Infisical."
---
Infisical supports connecting to Windmill using an **Access Token** to securely sync your secrets to Windmill.
## Get a Windmill Access Token
Ensure the user generating the access token has the required role and permissions based on your use-case:
<Tabs>
<Tab title="Secret Sync">
<Note>
The user generating the access token should be at least a `Developer` in the configured workspace and have `write` permissions for the workspace path secrets will be synced to.
</Note>
</Tab>
</Tabs>
<Steps>
<Step title="Navigate to Account Settings">
In Windmill, click on your user in the sidebar and select **Account Settings**.
![Windmill Account Settings](/images/app-connections/windmill/windmill-account-settings.png)
</Step>
<Step title="Access Token Section">
In the **Tokens** section on the drawer, click **Create token**.
![Windmill Create Token](/images/app-connections/windmill/windmill-create-token.png)
</Step>
<Step title="Create Access Token">
Give your token a name and click **New token**.
<Note>
If you configure an expiry date for your access token, you must manually rotate to a new token before the expiration date to prevent service interruption.
</Note>
![Windmill New Token](/images/app-connections/windmill/windmill-new-token.png)
</Step>
<Step title="Copy Access Token">
Copy your new access token and save it for the steps below.
![Windmill Copy Token](/images/app-connections/windmill/windmill-copy-token.png)
</Step>
</Steps>
## Setup Windmill Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Navigate to App Connections">
In your Infisical dashboard, go to **Organization Settings** and select the **App Connections** tab.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Add Connection">
Click the **+ Add Connection** button and select the **Windmill Connection** option.
![Select Windmill Connection](/images/app-connections/windmill/select-windmill-connection.png)
</Step>
<Step title="Configure Connection">
Configure your Windmill Connection using the access token generated in the steps above. Then click **Connect to Windmill**.
![Windmill Configure Connection](/images/app-connections/windmill/create-windmill-access-token.png)
- **Name**: The name of the connection to be created. Must be slug-friendly.
- **Description**: An optional description to provide details about this connection.
- **Instance URL**: The URL of your Windmill instance. If you are not self-hosting Windmill you can leave this field blank.
- **Access Token**: The access token generated in the steps above.
</Step>
<Step title="Connection Created">
Your Windmill Connection is now available for use.
![Windmill Connection Created](/images/app-connections/windmill/windmill-access-token-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a Windmill Connection, make an API request to the [Create Windmill
Connection](/api-reference/endpoints/app-connections/windmill/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/windmill \
--header 'Content-Type: application/json' \
--data '{
"name": "my-windmill-connection",
"method": "access-token",
"credentials": {
"token": "...",
"instanceUrl": "https://app.windmill.dev"
}
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-windmill-connection",
"version": 123,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "windmill",
"method": "access-token",
"credentials": {
"instanceUrl": "https://app.windmill.dev"
}
}
}
```
</Tab>
</Tabs>

147
docs/integrations/secret-syncs/windmill.mdx Normal file
View File

@@ -0,0 +1,147 @@
---
title: "Windmill Sync"
description: "Learn how to configure a Windmill Sync for Infisical."
---
**Prerequisites:**
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
- Create a [Windmill Connection](/integrations/app-connections/windmill) with the required **Secret Sync** permissions
<Tabs>
<Tab title="Infisical UI">
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
2. Select the **Windmill** option.
![Select Windmill](/images/secret-syncs/windmill/select-windmill-option.png)
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
![Configure Source](/images/secret-syncs/windmill/windmill-sync-source.png)
- **Environment**: The project environment to retrieve secrets from.
- **Secret Path**: The folder path to retrieve secrets from.
<Tip>
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
</Tip>
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
![Configure Destination](/images/secret-syncs/windmill/windmill-sync-destination.png)
- **Windmill Connection**: The Windmill Connection to authenticate with.
- **Workspace**: The Windmill workspace to sync secrets to.
- **Path**: The workspace path to sync secrets to.
<Note>
Workspace path must conform to Windmill's [owner path convention](https://www.windmill.dev/docs/core_concepts/roles_and_permissions#path).
</Note>
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
![Configure Options](/images/secret-syncs/windmill/windmill-sync-options.png)
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over Windmill when keys conflict.
- **Import Secrets (Prioritize Windmill)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Windmill over Infisical when keys conflict.
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
6. Configure the **Details** of your Windmill Sync, then click **Next**.
![Configure Details](/images/secret-syncs/windmill/windmill-sync-details.png)
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
7. Review your Windmill Sync configuration, then click **Create Sync**.
![Confirm Configuration](/images/secret-syncs/windmill/windmill-sync-review.png)
8. If enabled, your Windmill Sync will begin syncing your secrets to the destination endpoint.
![Sync Secrets](/images/secret-syncs/windmill/windmill-sync-created.png)
</Tab>
<Tab title="API">
To create an **Windmill Sync**, make an API request to the [Create Windmill Sync](/api-reference/endpoints/secret-syncs/windmill/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/secret-syncs/windmill \
--header 'Content-Type: application/json' \
--data '{
"name": "my-windmill-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/my-secrets",
"isEnabled": true,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination"
},
"destinationConfig": {
"workspace": "my-workspace",
"path": "f/folder/path/"
}
}'
```
<Note>
Workspace path must conform to Windmill's [owner path convention](https://www.windmill.dev/docs/core_concepts/roles_and_permissions#path).
</Note>
### Sample response
```bash Response
{
"secretSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-windmill-sync",
"description": "an example sync",
"isEnabled": true,
"version": 1,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"syncStatus": "succeeded",
"lastSyncJobId": "123",
"lastSyncMessage": null,
"lastSyncedAt": "2023-11-07T05:31:56Z",
"importStatus": null,
"lastImportJobId": null,
"lastImportMessage": null,
"lastImportedAt": null,
"removeStatus": null,
"lastRemoveJobId": null,
"lastRemoveMessage": null,
"lastRemovedAt": null,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connection": {
"app": "windmill",
"name": "my-windmill-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/my-secrets"
},
"destination": "windmill",
"destinationConfig": {
"workspace": "my-workspace",
"path": "f/folder/path/"
}
}
}
```
</Tab>
</Tabs>

46
docs/mint.json
View File

@@ -313,6 +313,13 @@
"self-hosting/deployment-options/kubernetes-helm"
]
},
{
"group": "Linux Package",
"pages": [
"self-hosting/deployment-options/native/linux-package/installation",
"self-hosting/deployment-options/native/linux-package/commands-configuration"
]
},
"self-hosting/guides/upgrading-infisical",
"self-hosting/configuration/envars",
"self-hosting/configuration/requirements",
@@ -329,7 +336,8 @@
"pages": [
"self-hosting/reference-architectures/aws-ecs",
"self-hosting/reference-architectures/linux-deployment-ha",
"self-hosting/reference-architectures/on-prem-k8s-ha"
"self-hosting/reference-architectures/on-prem-k8s-ha",
"self-hosting/reference-architectures/google-cloud-run"
]
},
"self-hosting/ee",
@@ -427,7 +435,8 @@
"integrations/app-connections/mssql",
"integrations/app-connections/postgres",
"integrations/app-connections/terraform-cloud",
"integrations/app-connections/vercel"
"integrations/app-connections/vercel",
"integrations/app-connections/windmill"
]
}
]
@@ -449,7 +458,8 @@
"integrations/secret-syncs/github",
"integrations/secret-syncs/humanitec",
"integrations/secret-syncs/terraform-cloud",
"integrations/secret-syncs/vercel"
"integrations/secret-syncs/vercel",
"integrations/secret-syncs/windmill"
]
}
]
@@ -1058,6 +1068,18 @@
"api-reference/endpoints/app-connections/vercel/update",
"api-reference/endpoints/app-connections/vercel/delete"
]
},
{
"group": "Windmill",
"pages": [
"api-reference/endpoints/app-connections/windmill/list",
"api-reference/endpoints/app-connections/windmill/available",
"api-reference/endpoints/app-connections/windmill/get-by-id",
"api-reference/endpoints/app-connections/windmill/get-by-name",
"api-reference/endpoints/app-connections/windmill/create",
"api-reference/endpoints/app-connections/windmill/update",
"api-reference/endpoints/app-connections/windmill/delete"
]
}
]
},
@@ -1211,8 +1233,22 @@
"api-reference/endpoints/secret-syncs/vercel/update",
"api-reference/endpoints/secret-syncs/vercel/delete",
"api-reference/endpoints/secret-syncs/vercel/sync-secrets",
"api-reference/endpoints/secret-syncs/vercel/remove-secrets",
"api-reference/endpoints/secret-syncs/vercel/import-secrets"
"api-reference/endpoints/secret-syncs/vercel/import-secrets",
"api-reference/endpoints/secret-syncs/vercel/remove-secrets"
]
},
{
"group": "Windmill",
"pages": [
"api-reference/endpoints/secret-syncs/windmill/list",
"api-reference/endpoints/secret-syncs/windmill/get-by-id",
"api-reference/endpoints/secret-syncs/windmill/get-by-name",
"api-reference/endpoints/secret-syncs/windmill/create",
"api-reference/endpoints/secret-syncs/windmill/update",
"api-reference/endpoints/secret-syncs/windmill/delete",
"api-reference/endpoints/secret-syncs/windmill/sync-secrets",
"api-reference/endpoints/secret-syncs/windmill/import-secrets",
"api-reference/endpoints/secret-syncs/windmill/remove-secrets"
]
}
]

2
docs/sdks/languages/go.mdx
View File

@@ -28,7 +28,7 @@ func main() {
AutoTokenRefresh: true, // Wether or not to let the SDK handle the access token lifecycle. Defaults to true if not specified.
})
_, err = client.Auth().UniversalAuthLogin("YOUR_CLIENT_ID", "YOUR_CLIENT_SECRET")
_, err := client.Auth().UniversalAuthLogin("YOUR_CLIENT_ID", "YOUR_CLIENT_SECRET")
if err != nil {
fmt.Printf("Authentication failed: %v", err)

38
docs/self-hosting/deployment-options/native/linux-package/commands-configuration.mdx Normal file
View File

@@ -0,0 +1,38 @@
---
title: "Configurations"
description: "Learn how to configure and manage the Infisical Linux package"
---
## Configuration Overview
All configuration for the Infisical Linux package is managed through a single file called `infisical.rb`, located in the `/etc/infisical` directory.
This file defines all necessary settings, including encryption keys, database connections, and environment-specific settings.
<Info> After making any changes to the `infisical.rb` file, always run `infisical-ctl reconfigure` to apply them. </Info>
### Example Configuration
```ruby infisical.rb
# Important: Replace these values with secure keys in production
infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218'
infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE='
# Database connection strings
infisical_core['DB_CONNECTION_URI'] = 'postgres://<username>:<password>@<host>:5432/<database>'
infisical_core['REDIS_URL'] = 'redis://<host>:6379'
```
For a full list of supported configuration variables, refer to the [configuration variables documentation](/self-hosting/configuration/envars).
## All `infisical-ctl` Commands
The Infisical Linux package includes the `infisical-ctl` command-line tool, which allows you to manage your deployment.
The available commands are listed below.
| Command | Description |
|-----------------------------|-----------------------------------------------------------------------------|
| `infisical-ctl reconfigure` | Applies changes from `infisical.rb` and restarts the Infisical services. |
| `infisical-ctl start` | Starts the Infisical services. |
| `infisical-ctl stop` | Stops all running Infisical services. |
| `infisical-ctl status` | Displays the current status of the Infisical services. |
| `infisical-ctl tail` | Streams real-time logs from the Infisical application. |

122
docs/self-hosting/deployment-options/native/linux-package/installation.mdx Normal file
View File

@@ -0,0 +1,122 @@
---
title: "Installation"
description: "Learn how to deploy Infisical using the Linux package"
---
Infisical can be deployed on Linux virtual machines without the need for containers using our standalone Linux packages.
These packages are available in both .deb (for Debian-based systems) and .rpm (for RHEL-based systems) formats.
The installation includes the Infisical service, along with a CLI tool (infisical-ctl) to help you manage configurations, startup, and application logging.
This approach is ideal for environments where containerization isn't desired, while still providing a lightweight deployment option.
## Prerequisites
This installation method only provides the Infisical application. You are responsible for configuring both PostgreSQL and Redis, either by using managed services (e.g., AWS RDS, Azure Database, GCP Cloud SQL/Memorystore) or by deploying them manually in your on-prem environment.
Please ensure you have the following before beginning installation of Infisical:
- A Linux server running a Debian/Ubuntu or RHEL-based distribution
- A running PostgreSQL database instance (version 14 and up)
- A running Redis database instance (versions 6.x or 7.x)
## Installation Steps
<Steps>
<Step title="Install the Infisical Package">
Select your Linux distribution to get started. Only AMD64-based systems are supported at this time, ARM support is coming soon.
<Tabs>
<Tab title="Debian/Ubuntu">
Add the Infisical repository:
```bash
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.deb.sh' | sudo -E bash
```
Install Infisical:
```bash
sudo apt-get update && sudo apt-get install -y infisical-core
```
> **Note**: For production use, we recommend locking to a specific version to ensure consistency. [View available versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/).
</Tab>
<Tab title="RedHat/CentOS/Amazon Linux">
Add the Infisical repository:
```bash
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-core/setup.rpm.sh' | sudo -E bash
```
Install Infisical:
```bash
sudo yum install infisical-core
```
> **Note**: For production use, we recommend locking to a specific version to ensure consistency. [View available versions](https://cloudsmith.io/~infisical/repos/infisical-core/packages/).
</Tab>
</Tabs>
Verify the installation:
```bash
infisical-ctl help
```
</Step>
<Step title="Create the Configuration File">
Create an `infisical.rb` file at `/etc/infisical`. This file contains your database connection strings and other runtime settings.
```ruby
# Important: Replace with secure values in production
infisical_core['ENCRYPTION_KEY'] = '6c1fe4e407b8911c104518103505b218'
infisical_core['AUTH_SECRET'] = '5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE='
# Example database connection strings
infisical_core['DB_CONNECTION_URI'] = 'postgres://<db-username>:<db-password>@<db-host>:<db-port>/<db-name>'
infisical_core['REDIS_URL'] = 'redis://<redis-host>:<redis-port>'
```
See the full list of options in our [configuration documentation](/self-hosting/configuration/envars).
</Step>
<Step title="Start Infisical">
1. Start the Infisical service:
```bash
infisical-ctl reconfigure
```
The server runs on port `8080` by default (customizable in `infisical.rb`).
2. Check the service status:
```bash
infisical-ctl status
```
View the service logs in real-time:
```bash
infisical-ctl tail
```
</Step>
</Steps>
## Platform Support
### Microsoft Windows
Infisical is built for Linux-based systems. It is not supported on Microsoft Windows, and we do not plan to support it in the near future. For Windows users, consider running Infisical in a virtual machine or WSL2 environment.
### Unsupported Linux Distributions and Unix-like Systems
Infisical is not tested or officially supported on the following:
- Arch Linux
- Fedora
- FreeBSD
- Gentoo
- macOS
We recommend sticking to officially supported distributions for the best experience.
## Linux vs Containerized Deployments
Infisical is a stateless application, which means it can be easily scaled and redeployed without maintaining internal state between instances.
If your use case requires rolling updates, self-healing, or auto-scaling, we recommend deploying Infisical in a containerized environment such as Kubernetes/OpenShift, or using managed container orchestration services like AWS ECS or Google Cloud Run.
These platforms offer built-in capabilities for high availability and help simplify operational overhead for your deployment.

21
docs/self-hosting/overview.mdx
View File

@@ -33,21 +33,10 @@ Choose from a number of deployment options listed below to get started.
Use our Helm chart to Install Infisical on your Kubernetes cluster.
</Card>
</CardGroup>
{/* <CardGroup cols={2}>
<Card
title="Native Deployment"
<Card
title="Linux package"
color="#000000"
icon="box"
href="deployment-options/native/standalone-binary"
href="deployment-options/native/linux-package/installation"
>
Install Infisical on your Debian-based system without containers using our standalone binary.
</Card>
<Card
title="Native Deployment, High Availability"
color="#000000"
icon="boxes-stacked"
href="deployment-options/native/high-availability"
>
Install Infisical on your Debian-based instances without containers using our standalone binary with high availability out of the box.
</Card>
</CardGroup> */}
Install Infisical on your system without containers using our Linux package.
</Card>

114
docs/self-hosting/reference-architectures/google-cloud-run.mdx Normal file
View File

@@ -0,0 +1,114 @@
---
title: "Google Cloud Run"
description: "Reference architecture for self-hosting Infisical on Google Cloud Run."
---
## Overview
This guide outlines a reference architecture for deploying Infisical in a self-hosted configuration using Google Cloud Run.
It is intended to provide a scalable, secure, and production-ready baseline for organizations choosing Google Cloud Platform (GCP) as their infrastructure provider.
## Core Components
- **Cloud Run:** Infisical service is containerized and deployed as fully managed Cloud Run services.
- **Cloud SQL:** Infisical uses Postgres as its persistence layer. As such, Cloud SQL for PostgreSQL is used.
- **MemoryStore for Redis:** To schedule jobs, process audit logs and cache performance, Infisical requires Redis.
## Securing Infisical's root credential
- **Secrets Manager:** To secure Infisical’s root credentials (database connection string, encryption key, etc.),
we highly recommend that you use Google Secrets Manager and only allow the tasks running Infisical to access them.
## High Availability and Scalability
This architecture leverages Google Cloud's managed services to achieve high availability and scalability out of the box:
**Cloud Run:**
- Automatically scales the number of container instances up or down based on incoming request volume.
- Supports rapid scaling during traffic spikes, ensuring low latency.
- Configurable minimum and maximum instances to handle baseline and peak loads.
**Cloud SQL:**
- Provides high availability configurations (regional instances with automatic failover) to ensure database uptime.
- Automated backups, point-in-time recovery, and maintenance.
**MemoryStore:**
- Offers highly available Redis configurations with replication.
- Fully managed with automatic scaling and patching.
**Cloud Load Balancer:**
- Distributes user traffic across available Cloud Run instances.
- Provides SSL termination, global load balancing, and health checks.
<Info>
**Note:** To further improve performance and availability, consider enabling multi-region deployment strategies,
regional VPC Connectors, and database replicas for read-heavy workloads.
</Info>
## Configuration
<Steps>
<Step title="Provision Core Infrastructure">
**Cloud SQL (PostgreSQL):**
- Create a Cloud SQL instance.
- Under `Zonal availability`, select the `Multiple zones` option to ensure High Availability.
- Configure private IP access.
**MemoryStore (Redis):**
- Deploy a Redis instance.
- Configure VPC access.
</Step>
<Step title="Get the Infisical Docker image">
Visit [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) and select a version of Infisical image you would like to deploy.
Then, within Cloud Run, paste the URL of the specific Infisical Docker image you would like to use within the `Container image URL` field.
![Cloud Run container image settings UI](/images/self-hosting/reference-architectures/google-cloud-run/cloud-run-container-image.png)
Remember to replace `<version>` with the docker image tag of your choice.
</Step>
<Step title="Set the environment variables">
For a minimal installation of Infisical, you must configure the following environment variables:
```bash
ENCRYPTION_KEY=<your_encryption_key>
AUTH_SECRET=<your_auth_secret>
DB_CONNECTION_URI="<your_db_connection_uri>"
SITE_URL="<your_site_url>"
REDIS_URL="<your_redis_url>"
```
[View all available configurations](/self-hosting/configuration/envars).
You will want to setup Postgres and Redis within Google Cloud Platform to connect to Infisical.
Once you have added the required environment variables to the `Environment Variables` section within Cloud Run,
create the container to get Infisical up and running.
![Cloud Run container environment variables settings UI](/images/self-hosting/reference-architectures/google-cloud-run/container-env-vars.png)
<Warning>
The above environment variable values are only to be used as an example and should not be used in production
</Warning>
</Step>
<Step title="Network Configuration">
Enable `Connect to a VPC for outbound traffic`: This enables the service to talk to private resources (e.g., a Cloud SQL database, Redis instance on a private IP) inside your Google Cloud VPC network.
Select `Send traffic directly to a VPC`: It gives lower latency and better performance, but uses more IPs from the subnet.
<Info>
Your Cloud Run revision must be in the same VPC network
</Info>
![Cloud Run container network settings UI](/images/self-hosting/reference-architectures/google-cloud-run/container-network-configuration.png)
Once the container is running, verify the installation by opening your web browser and navigating to the Site URL.
</Step>
</Steps>