From d7dfc531fccb327df6181103f70d762244bfdc96 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 03:20:11 +0800
Subject: [PATCH 1/7] doc: added guide for production hardening

---
 .../guides/production-hardening.mdx           | 551 ++++++++++++++++++
 1 file changed, 551 insertions(+)
 create mode 100644 docs/self-hosting/guides/production-hardening.mdx

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
new file mode 100644
index 000000000..17562cd64
--- /dev/null
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -0,0 +1,551 @@
+---
+title: "Production Hardening"
+description: "Security hardening recommendations for production Infisical deployments"
+---
+
+This document provides specific security hardening recommendations for production Infisical deployments. These recommendations follow Infisical's security model and focus on defense in depth.
+
+Choose your deployment method below and follow the recommendations for your specific setup. Start with **Universal Security Fundamentals** that apply to all deployments, then follow your deployment-specific section.
+
+## Universal Security Fundamentals
+
+These security configurations apply to **all** Infisical deployments regardless of how you deploy.
+
+**Configure secure encryption keys**. Generate strong cryptographic keys:
+
+```bash
+# Required - Generate secure encryption key
+ENCRYPTION_KEY=$(openssl rand -hex 16)
+
+# Required - Generate secure auth secret
+AUTH_SECRET=$(openssl rand -base64 32)
+```
+
+**Use end-to-end TLS**. Configure HTTPS and secure database connections:
+
+```bash
+# Enable HTTPS (recommended for production)
+HTTPS_ENABLED=true
+
+# Secure PostgreSQL connection with SSL
+DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
+
+# For base64-encoded SSL certificate
+DB_ROOT_CERT="<base64-encoded-certificate>"
+```
+
+**Secure Redis configuration**. Use authentication and TLS for Redis:
+
+```bash
+# Redis with TLS (if supported by your Redis deployment)
+REDIS_URL="rediss://user:password@redis:6380"
+
+# Redis Sentinel configuration for high availability
+REDIS_SENTINEL_HOSTS="192.168.65.254:26379,192.168.65.254:26380"
+REDIS_SENTINEL_MASTER_NAME="mymaster"
+REDIS_SENTINEL_ENABLE_TLS=true
+REDIS_SENTINEL_USERNAME="sentinel_user"
+REDIS_SENTINEL_PASSWORD="sentinel_password"
+```
+
+**Restrict CORS origins**. Configure specific allowed origins:
+
+```bash
+# Limit CORS to specific domains
+CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
+```
+
+**Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:
+
+```bash
+# Prevent connections to internal/private IP addresses
+# This blocks access to internal services like metadata endpoints,
+# internal APIs, databases, and other sensitive infrastructure
+ALLOW_INTERNAL_IP_CONNECTIONS=false
+```
+
+**Configure SMTP securely**. Use TLS for email communications:
+
+```bash
+# SMTP with TLS
+SMTP_HOST="smtp.example.com"
+SMTP_PORT="587"
+SMTP_USERNAME="your-smtp-user"
+SMTP_PASSWORD="your-smtp-password"
+SMTP_REQUIRE_TLS=true
+SMTP_IGNORE_TLS=false
+SMTP_FROM_ADDRESS="noreply@example.com"
+SMTP_FROM_NAME="Infisical"
+```
+
+**Set proper site URL**. Configure the absolute URL for your Infisical instance:
+
+```bash
+# Required - Must be absolute URL with protocol
+SITE_URL="https://app.infisical.com"
+```
+
+**Configure database read replicas**. For high availability PostgreSQL setups:
+
+```bash
+# Read replica configuration (JSON format)
+DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
+```
+
+**Configure short token lifetimes**. Minimize exposure window for compromised tokens:
+
+```bash
+# JWT token configuration (adjust based on security requirements)
+JWT_AUTH_LIFETIME=15m        # Authentication tokens
+JWT_REFRESH_LIFETIME=24h     # Refresh tokens
+JWT_SERVICE_LIFETIME=1h      # Service tokens
+```
+
+**Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:
+
+```bash
+# Optional - Disable telemetry (enabled by default)
+TELEMETRY_ENABLED=false
+```
+
+**Establish user off-boarding procedures**. Remove access promptly when users leave:
+
+1. Remove user from organization
+2. Revoke active service tokens
+3. Remove from external identity providers
+4. Audit access logs for the user's activity
+5. Rotate any shared secrets the user had access to
+
+**Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method:
+
+- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
+- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
+- **Principle**: Default deny incoming, allow only required traffic
+- **Implementation**: See your deployment-specific section below for exact configuration
+
+**Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.
+
+## Docker Deployment Hardening
+
+These recommendations are specific to Docker deployments of Infisical.
+
+**Use read-only root filesystems**. Prevent runtime modifications:
+
+```bash
+# Run with read-only filesystem
+docker run --read-only --tmpfs /tmp infisical/infisical:latest
+```
+
+**Drop unnecessary capabilities**. Remove all Linux capabilities:
+
+```bash
+# Drop all capabilities
+docker run --cap-drop=ALL infisical/infisical:latest
+```
+
+**Set resource limits**. Prevent resource exhaustion attacks:
+
+```bash
+# Set memory and CPU limits
+docker run --memory=1g --cpus=0.5 infisical/infisical:latest
+```
+
+**Use specific image tags**. Never use `latest` tags in production:
+
+```bash
+# Use specific version tags
+docker run infisical/infisical:v0.93.1-postgres
+```
+
+**Configure health checks**. Set up Docker health checks:
+
+```dockerfile
+# In Dockerfile or docker-compose.yml
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:8080/api/status || exit 1
+```
+
+**Host firewall configuration**. Configure host-level firewall for Docker deployments:
+
+```bash
+# Docker manages its own iptables rules, but configure host firewall
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Allow Docker-mapped ports (adjust based on your port mapping)
+sudo ufw allow 8080/tcp  # If mapping container 8080 to host 8080
+sudo ufw allow 443/tcp   # If terminating HTTPS at host level
+
+# Enable firewall
+sudo ufw --force enable
+
+# Verify Docker iptables integration
+sudo iptables -L DOCKER
+```
+
+**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.
+
+## Kubernetes Deployment Hardening
+
+These recommendations are specific to Kubernetes deployments of Infisical.
+
+**Use Pod Security Standards**. Apply restricted security profile:
+
+```yaml
+# Namespace-level Pod Security Standards
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infisical
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+```
+
+**Configure security context**. Set comprehensive security context:
+
+```yaml
+# Deployment security context
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: infisical
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+      containers:
+        - name: infisical
+          image: infisical/infisical:v0.93.1-postgres
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1001
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              memory: 1000Mi
+              cpu: 500m
+            requests:
+              cpu: 350m
+              memory: 512Mi
+```
+
+**Configure network policies**. Restrict pod-to-pod communication:
+
+```yaml
+# Example Kubernetes NetworkPolicy
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: infisical-netpol
+  namespace: infisical
+spec:
+  podSelector:
+    matchLabels:
+      app: infisical
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: ingress-system
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - podSelector:
+            matchLabels:
+              app: redis
+      ports:
+        - protocol: TCP
+          port: 6379
+```
+
+**Use dedicated service accounts**. Create service accounts with minimal permissions:
+
+```yaml
+# Service account configuration
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical
+  namespace: infisical
+automountServiceAccountToken: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: infisical
+spec:
+  template:
+    spec:
+      serviceAccountName: infisical
+```
+
+**Configure ingress with TLS**. Set up secure ingress:
+
+```yaml
+# Secure ingress configuration
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: infisical-ingress
+  namespace: infisical
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - secretName: infisical-tls
+      hosts:
+        - app.example.com
+  rules:
+    - host: app.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: infisical
+                port:
+                  number: 8080
+```
+
+**Use Kubernetes secrets**. Store sensitive configuration securely:
+
+```yaml
+# Kubernetes secret for environment variables
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-secrets
+  namespace: infisical
+type: Opaque
+stringData:
+  AUTH_SECRET: "<generate-with-openssl-rand-base64-32>"
+  ENCRYPTION_KEY: "<generate-with-openssl-rand-hex-16>"
+  DB_CONNECTION_URI: "<your-postgres-connection-string>"
+  REDIS_URL: "<your-redis-connection-string>"
+  SITE_URL: "<your-site-url>"
+```
+
+**Set up health checks**. Configure readiness and liveness probes:
+
+```yaml
+# Health check configuration
+containers:
+  - name: infisical
+    readinessProbe:
+      httpGet:
+        path: /api/status
+        port: 8080
+      initialDelaySeconds: 10
+      periodSeconds: 5
+    livenessProbe:
+      httpGet:
+        path: /api/status
+        port: 8080
+      initialDelaySeconds: 30
+      periodSeconds: 10
+```
+
+**Use managed databases**. For production deployments, use managed PostgreSQL and Redis services instead of in-cluster instances.
+
+**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
+
+```bash
+# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
+# Allow ingress from load balancer to NodePort/ClusterIP service
+# Allow egress to managed databases
+# Block all other traffic
+
+# For on-premises, ensure node-level firewalls allow:
+# - Ingress traffic from ingress controllers
+# - Egress traffic to external services (databases, SMTP)
+```
+
+**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.
+
+## Linux Binary Deployment Hardening
+
+These recommendations are specific to Linux binary deployments of Infisical.
+
+**Create dedicated user account**. Run Infisical under a dedicated service account:
+
+```bash
+# Create dedicated user
+sudo useradd --system --shell /bin/false --home-dir /opt/infisical infisical
+
+# Create application directory
+sudo mkdir -p /opt/infisical
+sudo chown infisical:infisical /opt/infisical
+```
+
+**Configure systemd service**. Create a secure systemd service:
+
+```ini
+# /etc/systemd/system/infisical.service
+[Unit]
+Description=Infisical Secret Management
+After=network.target
+
+[Service]
+Type=simple
+# IMPORTANT: Change from default 'root' user to dedicated service account
+User=infisical
+Group=infisical
+WorkingDirectory=/opt/infisical
+ExecStart=/opt/infisical/infisical-linux-amd64
+Restart=always
+RestartSec=10
+
+# Security settings
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/infisical
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LimitCORE=0
+MemorySwapMax=0
+
+# Environment file
+EnvironmentFile=/etc/infisical/environment
+
+[Install]
+WantedBy=multi-user.target
+```
+
+**Secure environment configuration**. Store environment variables securely:
+
+```bash
+# Create secure config directory
+sudo mkdir -p /etc/infisical
+sudo chmod 750 /etc/infisical
+sudo chown root:infisical /etc/infisical
+
+# Create environment file
+sudo touch /etc/infisical/environment
+sudo chmod 640 /etc/infisical/environment
+sudo chown root:infisical /etc/infisical/environment
+```
+
+**Disable memory swapping**. Prevent sensitive data from being written to disk:
+
+```bash
+# Disable swap immediately
+sudo swapoff -a
+
+# Disable swap permanently (comment out swap entries)
+sudo sed -i '/swap/d' /etc/fstab
+```
+
+**Disable core dumps**. Prevent potential exposure of encryption keys:
+
+```bash
+# Set system-wide core dump limits
+echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
+
+# Disable core dumps for current session
+ulimit -c 0
+```
+
+**Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:
+
+```bash
+# Configure UFW firewall
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Allow Infisical API access
+sudo ufw allow 8080/tcp
+
+# Allow HTTPS (if terminating TLS at Infisical)
+sudo ufw allow 443/tcp
+
+# If running PostgreSQL locally, restrict to localhost
+sudo ufw allow from 127.0.0.1 to any port 5432
+
+# If running Redis locally, restrict to localhost
+sudo ufw allow from 127.0.0.1 to any port 6379
+
+# Enable firewall
+sudo ufw --force enable
+```
+
+**Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:
+
+```bash
+# Install and configure NTP
+sudo apt-get update
+sudo apt-get install -y ntp
+sudo systemctl enable ntp
+sudo systemctl start ntp
+
+# Verify time synchronization
+timedatectl status
+```
+
+**Secure file permissions**. Set proper permissions on application files:
+
+```bash
+# Set binary permissions
+sudo chmod 755 /opt/infisical/infisical-linux-amd64
+sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
+
+# Set config file permissions
+sudo chmod 640 /etc/infisical/environment
+sudo chown root:infisical /etc/infisical/environment
+```
+
+**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly:
+
+## Advanced Security Configurations
+
+**Configure backup encryption**. Encrypt PostgreSQL backups:
+
+```bash
+# PostgreSQL backup with encryption
+pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
+```
+
+**Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
+
+**Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.
+
+## Compliance and Monitoring
+
+For enterprise deployments requiring compliance certifications:
+
+- Implement audit log retention policies
+- Set up security event monitoring and alerting
+- Configure automated vulnerability scanning
+- Establish incident response procedures
+- Document security controls for compliance audits
+
+These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements.
+
+For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars).

From c9eab0af18ca7629e69385f34eed61ef59982f8b Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 03:21:26 +0800
Subject: [PATCH 2/7] misc: updated section on db

---
 docs/self-hosting/guides/production-hardening.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
index 17562cd64..0be3826b2 100644
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -369,7 +369,7 @@ containers:
       periodSeconds: 10
 ```
 
-**Use managed databases**. For production deployments, use managed PostgreSQL and Redis services instead of in-cluster instances.
+**Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.
 
 **Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
 

From 8bfd728ce4a2f80ff9cd5264478db8951dd63c5c Mon Sep 17 00:00:00 2001
From: Sheen <65645666+sheensantoscapadngan@users.noreply.github.com>
Date: Mon, 16 Jun 2025 19:22:35 +0000
Subject: [PATCH 3/7] misc: added mint json

---
 docs/mint.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/mint.json b/docs/mint.json
index 1af808fea..28281a0ef 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -396,7 +396,8 @@
           "pages": [
             "self-hosting/guides/mongo-to-postgres",
             "self-hosting/guides/custom-certificates",
-            "self-hosting/guides/automated-bootstrapping"
+            "self-hosting/guides/automated-bootstrapping",
+            "self-hosting/guides/production-hardening"
           ]
         },
         {

From cab8fb0d8e0e8dfab75be45bd05deb9e1e8ae9d8 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 03:45:35 +0800
Subject: [PATCH 4/7] misc: reorganized

---
 .../guides/production-hardening.mdx           | 257 +++++++++++++-----
 1 file changed, 192 insertions(+), 65 deletions(-)

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
index 0be3826b2..e17765ac5 100644
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -11,7 +11,11 @@ Choose your deployment method below and follow the recommendations for your spec
 
 These security configurations apply to **all** Infisical deployments regardless of how you deploy.
 
-**Configure secure encryption keys**. Generate strong cryptographic keys:
+### Cryptographic Security
+
+#### Generate Secure Keys
+
+Generate strong cryptographic keys for your deployment:
 
 ```bash
 # Required - Generate secure encryption key
@@ -21,7 +25,22 @@ ENCRYPTION_KEY=$(openssl rand -hex 16)
 AUTH_SECRET=$(openssl rand -base64 32)
 ```
 
-**Use end-to-end TLS**. Configure HTTPS and secure database connections:
+#### Configure Token Lifetimes
+
+Minimize exposure window for compromised tokens:
+
+```bash
+# JWT token configuration (adjust based on security requirements)
+JWT_AUTH_LIFETIME=15m        # Authentication tokens
+JWT_REFRESH_LIFETIME=24h     # Refresh tokens
+JWT_SERVICE_LIFETIME=1h      # Service tokens
+```
+
+### Network Security
+
+#### TLS Configuration
+
+Configure HTTPS and secure database connections:
 
 ```bash
 # Enable HTTPS (recommended for production)
@@ -34,7 +53,9 @@ DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
 DB_ROOT_CERT="<base64-encoded-certificate>"
 ```
 
-**Secure Redis configuration**. Use authentication and TLS for Redis:
+#### Redis Security
+
+Use authentication and TLS for Redis:
 
 ```bash
 # Redis with TLS (if supported by your Redis deployment)
@@ -48,23 +69,41 @@ REDIS_SENTINEL_USERNAME="sentinel_user"
 REDIS_SENTINEL_PASSWORD="sentinel_password"
 ```
 
-**Restrict CORS origins**. Configure specific allowed origins:
+#### Network Access Controls
+
+Configure network restrictions and firewall rules:
 
 ```bash
 # Limit CORS to specific domains
 CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
-```
 
-**Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:
-
-```bash
 # Prevent connections to internal/private IP addresses
 # This blocks access to internal services like metadata endpoints,
 # internal APIs, databases, and other sensitive infrastructure
 ALLOW_INTERNAL_IP_CONNECTIONS=false
 ```
 
-**Configure SMTP securely**. Use TLS for email communications:
+**Implement network firewalls**. Restrict network access to only necessary services:
+
+- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
+- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
+- **Principle**: Default deny incoming, allow only required traffic
+- **Implementation**: See your deployment-specific section below for exact configuration
+
+### Application Security
+
+#### Site Configuration
+
+Set proper site URL for your Infisical instance:
+
+```bash
+# Required - Must be absolute URL with protocol
+SITE_URL="https://app.infisical.com"
+```
+
+#### SMTP Security
+
+Use TLS for email communications:
 
 ```bash
 # SMTP with TLS
@@ -78,35 +117,29 @@ SMTP_FROM_ADDRESS="noreply@example.com"
 SMTP_FROM_NAME="Infisical"
 ```
 
-**Set proper site URL**. Configure the absolute URL for your Infisical instance:
+#### Privacy Configuration
+
+Control telemetry and data collection:
 
 ```bash
-# Required - Must be absolute URL with protocol
-SITE_URL="https://app.infisical.com"
+# Optional - Disable telemetry (enabled by default)
+TELEMETRY_ENABLED=false
 ```
 
-**Configure database read replicas**. For high availability PostgreSQL setups:
+### Database Security
+
+#### High Availability Configuration
+
+Configure database read replicas for high availability PostgreSQL setups:
 
 ```bash
 # Read replica configuration (JSON format)
 DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
 ```
 
-**Configure short token lifetimes**. Minimize exposure window for compromised tokens:
+### Operational Security
 
-```bash
-# JWT token configuration (adjust based on security requirements)
-JWT_AUTH_LIFETIME=15m        # Authentication tokens
-JWT_REFRESH_LIFETIME=24h     # Refresh tokens
-JWT_SERVICE_LIFETIME=1h      # Service tokens
-```
-
-**Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:
-
-```bash
-# Optional - Disable telemetry (enabled by default)
-TELEMETRY_ENABLED=false
-```
+#### User Access Management
 
 **Establish user off-boarding procedures**. Remove access promptly when users leave:
 
@@ -116,19 +149,18 @@ TELEMETRY_ENABLED=false
 4. Audit access logs for the user's activity
 5. Rotate any shared secrets the user had access to
 
-**Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method:
-
-- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
-- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
-- **Principle**: Default deny incoming, allow only required traffic
-- **Implementation**: See your deployment-specific section below for exact configuration
+#### Maintenance and Updates
 
 **Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.
 
-## Docker Deployment Hardening
+## Deployment-Specific Hardening
+
+### Docker Deployment
 
 These recommendations are specific to Docker deployments of Infisical.
 
+#### Container Security
+
 **Use read-only root filesystems**. Prevent runtime modifications:
 
 ```bash
@@ -143,6 +175,15 @@ docker run --read-only --tmpfs /tmp infisical/infisical:latest
 docker run --cap-drop=ALL infisical/infisical:latest
 ```
 
+**Use specific image tags**. Never use `latest` tags in production:
+
+```bash
+# Use specific version tags
+docker run infisical/infisical:v0.93.1-postgres
+```
+
+#### Resource Management
+
 **Set resource limits**. Prevent resource exhaustion attacks:
 
 ```bash
@@ -150,12 +191,7 @@ docker run --cap-drop=ALL infisical/infisical:latest
 docker run --memory=1g --cpus=0.5 infisical/infisical:latest
 ```
 
-**Use specific image tags**. Never use `latest` tags in production:
-
-```bash
-# Use specific version tags
-docker run infisical/infisical:v0.93.1-postgres
-```
+#### Health Monitoring
 
 **Configure health checks**. Set up Docker health checks:
 
@@ -165,6 +201,8 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
   CMD curl -f http://localhost:8080/api/status || exit 1
 ```
 
+#### Network Security
+
 **Host firewall configuration**. Configure host-level firewall for Docker deployments:
 
 ```bash
@@ -183,12 +221,16 @@ sudo ufw --force enable
 sudo iptables -L DOCKER
 ```
 
+#### Maintenance
+
 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.
 
-## Kubernetes Deployment Hardening
+### Kubernetes Deployment
 
 These recommendations are specific to Kubernetes deployments of Infisical.
 
+#### Pod Security
+
 **Use Pod Security Standards**. Apply restricted security profile:
 
 ```yaml
@@ -238,6 +280,8 @@ spec:
               memory: 512Mi
 ```
 
+#### Network Security
+
 **Configure network policies**. Restrict pod-to-pod communication:
 
 ```yaml
@@ -279,6 +323,21 @@ spec:
           port: 6379
 ```
 
+**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
+
+```bash
+# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
+# Allow ingress from load balancer to NodePort/ClusterIP service
+# Allow egress to managed databases
+# Block all other traffic
+
+# For on-premises, ensure node-level firewalls allow:
+# - Ingress traffic from ingress controllers
+# - Egress traffic to external services (databases, SMTP)
+```
+
+#### Access Control
+
 **Use dedicated service accounts**. Create service accounts with minimal permissions:
 
 ```yaml
@@ -300,6 +359,8 @@ spec:
       serviceAccountName: infisical
 ```
 
+#### Ingress Security
+
 **Configure ingress with TLS**. Set up secure ingress:
 
 ```yaml
@@ -331,6 +392,8 @@ spec:
                   number: 8080
 ```
 
+#### Secret Management
+
 **Use Kubernetes secrets**. Store sensitive configuration securely:
 
 ```yaml
@@ -349,6 +412,8 @@ stringData:
   SITE_URL: "<your-site-url>"
 ```
 
+#### Health Monitoring
+
 **Set up health checks**. Configure readiness and liveness probes:
 
 ```yaml
@@ -369,27 +434,20 @@ containers:
       periodSeconds: 10
 ```
 
+#### Infrastructure Considerations
+
 **Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.
 
-**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
-
-```bash
-# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
-# Allow ingress from load balancer to NodePort/ClusterIP service
-# Allow egress to managed databases
-# Block all other traffic
-
-# For on-premises, ensure node-level firewalls allow:
-# - Ingress traffic from ingress controllers
-# - Egress traffic to external services (databases, SMTP)
-```
+#### Maintenance
 
 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.
 
-## Linux Binary Deployment Hardening
+### Linux Binary Deployment
 
 These recommendations are specific to Linux binary deployments of Infisical.
 
+#### System User Management
+
 **Create dedicated user account**. Run Infisical under a dedicated service account:
 
 ```bash
@@ -401,6 +459,8 @@ sudo mkdir -p /opt/infisical
 sudo chown infisical:infisical /opt/infisical
 ```
 
+#### Service Configuration
+
 **Configure systemd service**. Create a secure systemd service:
 
 ```ini
@@ -439,6 +499,8 @@ EnvironmentFile=/etc/infisical/environment
 WantedBy=multi-user.target
 ```
 
+#### Configuration Security
+
 **Secure environment configuration**. Store environment variables securely:
 
 ```bash
@@ -453,6 +515,8 @@ sudo chmod 640 /etc/infisical/environment
 sudo chown root:infisical /etc/infisical/environment
 ```
 
+#### System Security
+
 **Disable memory swapping**. Prevent sensitive data from being written to disk:
 
 ```bash
@@ -473,6 +537,22 @@ echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
 ulimit -c 0
 ```
 
+#### File Permissions
+
+**Secure file permissions**. Set proper permissions on application files:
+
+```bash
+# Set binary permissions
+sudo chmod 755 /opt/infisical/infisical-linux-amd64
+sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
+
+# Set config file permissions
+sudo chmod 640 /etc/infisical/environment
+sudo chown root:infisical /etc/infisical/environment
+```
+
+#### Network Security
+
 **Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:
 
 ```bash
@@ -496,6 +576,8 @@ sudo ufw allow from 127.0.0.1 to any port 6379
 sudo ufw --force enable
 ```
 
+#### System Maintenance
+
 **Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:
 
 ```bash
@@ -509,22 +591,61 @@ sudo systemctl start ntp
 timedatectl status
 ```
 
-**Secure file permissions**. Set proper permissions on application files:
+**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly.
+
+## Enterprise Security Features
+
+### Hardware Security Module (HSM) Integration
+
+For the highest level of encryption security, integrate with Hardware Security Modules:
+
+HSM integration provides hardware-protected encryption keys stored on tamper-proof devices, offering superior security for encryption operations:
+
+- **Supported HSM Providers**: Thales Luna Cloud HSM, AWS CloudHSM, Fortanix HSM
+- **Root Key Protection**: HSM encrypts Infisical's root encryption keys using hardware-protected keys
+- **Enterprise Requirements**: Ideal for government, financial, and healthcare organizations
 
 ```bash
-# Set binary permissions
-sudo chmod 755 /opt/infisical/infisical-linux-amd64
-sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
-
-# Set config file permissions
-sudo chmod 640 /etc/infisical/environment
-sudo chown root:infisical /etc/infisical/environment
+# HSM Environment Variables (example for production)
+HSM_LIB_PATH="/path/to/hsm/library.so"
+HSM_PIN="your-hsm-pin"
+HSM_SLOT="0"
+HSM_KEY_LABEL="infisical-root-key"
 ```
 
-**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly:
+For complete HSM setup instructions, see the [HSM Integration Guide](/documentation/platform/kms/hsm-integration).
+
+### External Key Management Service (KMS) Integration
+
+Leverage cloud-native KMS providers for enhanced security and compliance:
+
+Infisical can integrate with external KMS providers to encrypt project secrets, providing enterprise-grade key management:
+
+- **Supported Providers**: AWS KMS, Google Cloud KMS, Azure Key Vault (coming soon)
+- **Workspace Key Protection**: Each project's encryption key is protected by your external KMS
+- **Zero Trust**: Infisical never stores your KMS keys - all encryption/decryption operations happen via your cloud KMS
+- **Compliance**: Leverage your cloud provider's compliance certifications (FedRAMP, SOC2, ISO 27001)
+
+#### Benefits for Production Deployments
+
+- **Separation of Concerns**: Keys managed in your cloud infrastructure, separate from Infisical
+- **Regulatory Compliance**: Use your existing compliance-certified KMS infrastructure
+- **Audit Integration**: KMS operations logged in your cloud provider's audit trails
+- **Disaster Recovery**: Keys backed by your cloud provider's HA and backup systems
+- **Access Controls**: Leverage your cloud IAM for KMS access management
+
+#### Configuration Resources
+
+For external KMS configuration, see:
+
+- [AWS KMS Integration](/documentation/platform/kms-configuration/aws-kms)
+- [GCP KMS Integration](/documentation/platform/kms-configuration/gcp-kms)
+- [External KMS Overview](/documentation/platform/kms-configuration/overview)
 
 ## Advanced Security Configurations
 
+### Backup Security
+
 **Configure backup encryption**. Encrypt PostgreSQL backups:
 
 ```bash
@@ -532,12 +653,18 @@ sudo chown root:infisical /etc/infisical/environment
 pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
 ```
 
+### Monitoring and Logging
+
 **Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
 
+### Security Updates
+
 **Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.
 
 ## Compliance and Monitoring
 
+### Enterprise Compliance Requirements
+
 For enterprise deployments requiring compliance certifications:
 
 - Implement audit log retention policies
@@ -546,6 +673,6 @@ For enterprise deployments requiring compliance certifications:
 - Establish incident response procedures
 - Document security controls for compliance audits
 
-These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements.
+### Standards Compliance
 
-For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars).
+**FIPS 140-3 Compliance**. Infisical is actively working on FIPS 140-3 compliance to meet U.S. and Canadian government cryptographic standards. This will provide validated cryptographic modules for organizations requiring certified encryption implementations.

From 23aa97feff8214d2ca1757a2f4e24af4f560fbf0 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 20:17:17 +0800
Subject: [PATCH 5/7] misc: addressed comments

---
 .../guides/production-hardening.mdx           | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
index e17765ac5..d91ff1214 100644
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -161,13 +161,27 @@ These recommendations are specific to Docker deployments of Infisical.
 
 #### Container Security
 
-**Use read-only root filesystems**. Prevent runtime modifications:
+**Use read-only root filesystems**. Prevent runtime modifications while allowing necessary temporary access:
 
 ```bash
-# Run with read-only filesystem
-docker run --read-only --tmpfs /tmp infisical/infisical:latest
+# Run with read-only filesystem but allow /tmp access
+docker run --read-only \
+  --tmpfs /tmp:rw,exec,size=1G \
+  infisical/infisical:latest
 ```
 
+**Note**: Infisical requires temporary directory access for:
+
+- Secret scanning operations
+- SSH certificate generation and validation
+
+The `--tmpfs` mounts provide secure, isolated temporary storage that is:
+
+- Automatically cleaned up on container restart
+- Limited in size to prevent disk exhaustion
+- Isolated from the host system
+- Wiped on container removal
+
 **Drop unnecessary capabilities**. Remove all Linux capabilities:
 
 ```bash
@@ -412,6 +426,11 @@ stringData:
   SITE_URL: "<your-site-url>"
 ```
 
+**Note:** Kubernetes secrets are only base64-encoded by default and are not encrypted at rest unless you explicitly enable etcd encryption. For production environments, you should:
+
+- Enable [etcd encryption at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) to protect secrets stored in the cluster
+- Limit access to etcd and Kubernetes API to only trusted administrators
+
 #### Health Monitoring
 
 **Set up health checks**. Configure readiness and liveness probes:
@@ -591,7 +610,7 @@ sudo systemctl start ntp
 timedatectl status
 ```
 
-**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly.
+**Regular updates**. Monitor [Cloudsmith releases](https://cloudsmith.io/~infisical/repos/infisical-core/packages) for new binary versions and update your installation regularly.
 
 ## Enterprise Security Features
 

From 3d76ae3399d7a5334e414e92b0a0c92b92bbbf4f Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 20:25:38 +0800
Subject: [PATCH 6/7] misc: some more updates in examples

---
 .../guides/production-hardening.mdx           | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
index d91ff1214..1ec08a0a4 100644
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -337,18 +337,18 @@ spec:
           port: 6379
 ```
 
-**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
+**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement infrastructure-level security:
 
-```bash
-# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
-# Allow ingress from load balancer to NodePort/ClusterIP service
-# Allow egress to managed databases
-# Block all other traffic
+For cloud deployments (AWS Security Groups, Azure NSGs, or GCP Firewall Rules):
 
-# For on-premises, ensure node-level firewalls allow:
-# - Ingress traffic from ingress controllers
-# - Egress traffic to external services (databases, SMTP)
-```
+- Allow ingress from load balancer to NodePort/ClusterIP service
+- Allow egress to managed databases
+- Block all other traffic
+
+For on-premises deployments, ensure node-level firewalls allow:
+
+- Ingress traffic from ingress controllers
+- Egress traffic to external services (databases, SMTP)
 
 #### Access Control
 

From 092b89c59e56e6f118f6e691b1c3e1d6923e78d7 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 17 Jun 2025 20:28:28 +0800
Subject: [PATCH 7/7] misc: corrected kms section

---
 docs/self-hosting/guides/production-hardening.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/self-hosting/guides/production-hardening.mdx b/docs/self-hosting/guides/production-hardening.mdx
index 1ec08a0a4..dfd7b575f 100644
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -642,7 +642,7 @@ Infisical can integrate with external KMS providers to encrypt project secrets,
 
 - **Supported Providers**: AWS KMS, Google Cloud KMS, Azure Key Vault (coming soon)
 - **Workspace Key Protection**: Each project's encryption key is protected by your external KMS
-- **Zero Trust**: Infisical never stores your KMS keys - all encryption/decryption operations happen via your cloud KMS
+- **Envelope Encryption**: Infisical uses your cloud KMS to encrypt/decrypt project workspace keys, which in turn encrypt the actual secret data
 - **Compliance**: Leverage your cloud provider's compliance certifications (FedRAMP, SOC2, ISO 27001)
 
 #### Benefits for Production Deployments