misc: reorganized

2026-09-22 13:39:35 +00:00 · 2025-06-17 03:45:35 +08:00
parent c9eab0af18
commit cab8fb0d8e
1 changed files with 192 additions and 65 deletions
--- a/docs/self-hosting/guides/production-hardening.mdx
+++ b/docs/self-hosting/guides/production-hardening.mdx
@@ -11,7 +11,11 @@ Choose your deployment method below and follow the recommendations for your spec

 These security configurations apply to **all** Infisical deployments regardless of how you deploy.

-**Configure secure encryption keys**. Generate strong cryptographic keys:
+### Cryptographic Security
+
+#### Generate Secure Keys
+
+Generate strong cryptographic keys for your deployment:

 ```bash
 # Required - Generate secure encryption key
@@ -21,7 +25,22 @@ ENCRYPTION_KEY=$(openssl rand -hex 16)
 AUTH_SECRET=$(openssl rand -base64 32)
 ```

-**Use end-to-end TLS**. Configure HTTPS and secure database connections:
+#### Configure Token Lifetimes
+
+Minimize exposure window for compromised tokens:
+
+```bash
+# JWT token configuration (adjust based on security requirements)
+JWT_AUTH_LIFETIME=15m        # Authentication tokens
+JWT_REFRESH_LIFETIME=24h     # Refresh tokens
+JWT_SERVICE_LIFETIME=1h      # Service tokens
+```
+
+### Network Security
+
+#### TLS Configuration
+
+Configure HTTPS and secure database connections:

 ```bash
 # Enable HTTPS (recommended for production)
@@ -34,7 +53,9 @@ DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
 DB_ROOT_CERT="<base64-encoded-certificate>"
 ```

-**Secure Redis configuration**. Use authentication and TLS for Redis:
+#### Redis Security
+
+Use authentication and TLS for Redis:

 ```bash
 # Redis with TLS (if supported by your Redis deployment)
@@ -48,23 +69,41 @@ REDIS_SENTINEL_USERNAME="sentinel_user"
 REDIS_SENTINEL_PASSWORD="sentinel_password"
 ```

-**Restrict CORS origins**. Configure specific allowed origins:
+#### Network Access Controls
+
+Configure network restrictions and firewall rules:

 ```bash
 # Limit CORS to specific domains
 CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
-```

-**Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:
-
-```bash
 # Prevent connections to internal/private IP addresses
 # This blocks access to internal services like metadata endpoints,
 # internal APIs, databases, and other sensitive infrastructure
 ALLOW_INTERNAL_IP_CONNECTIONS=false
 ```

-**Configure SMTP securely**. Use TLS for email communications:
+**Implement network firewalls**. Restrict network access to only necessary services:
+
+- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
+- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
+- **Principle**: Default deny incoming, allow only required traffic
+- **Implementation**: See your deployment-specific section below for exact configuration
+
+### Application Security
+
+#### Site Configuration
+
+Set proper site URL for your Infisical instance:
+
+```bash
+# Required - Must be absolute URL with protocol
+SITE_URL="https://app.infisical.com"
+```
+
+#### SMTP Security
+
+Use TLS for email communications:

 ```bash
 # SMTP with TLS
@@ -78,35 +117,29 @@ SMTP_FROM_ADDRESS="noreply@example.com"
 SMTP_FROM_NAME="Infisical"
 ```

-**Set proper site URL**. Configure the absolute URL for your Infisical instance:
+#### Privacy Configuration
+
+Control telemetry and data collection:

 ```bash
-# Required - Must be absolute URL with protocol
-SITE_URL="https://app.infisical.com"
+# Optional - Disable telemetry (enabled by default)
+TELEMETRY_ENABLED=false
 ```

-**Configure database read replicas**. For high availability PostgreSQL setups:
+### Database Security
+
+#### High Availability Configuration
+
+Configure database read replicas for high availability PostgreSQL setups:

 ```bash
 # Read replica configuration (JSON format)
 DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
 ```

-**Configure short token lifetimes**. Minimize exposure window for compromised tokens:
+### Operational Security

-```bash
-# JWT token configuration (adjust based on security requirements)
-JWT_AUTH_LIFETIME=15m        # Authentication tokens
-JWT_REFRESH_LIFETIME=24h     # Refresh tokens
-JWT_SERVICE_LIFETIME=1h      # Service tokens
-```
-
-**Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:
-
-```bash
-# Optional - Disable telemetry (enabled by default)
-TELEMETRY_ENABLED=false
-```
+#### User Access Management

 **Establish user off-boarding procedures**. Remove access promptly when users leave:

@@ -116,19 +149,18 @@ TELEMETRY_ENABLED=false
 4. Audit access logs for the user's activity
 5. Rotate any shared secrets the user had access to

-**Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method:
-
- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
- **Principle**: Default deny incoming, allow only required traffic
- **Implementation**: See your deployment-specific section below for exact configuration
+#### Maintenance and Updates

 **Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.

-## Docker Deployment Hardening
+## Deployment-Specific Hardening
+
+### Docker Deployment

 These recommendations are specific to Docker deployments of Infisical.

+#### Container Security
+
 **Use read-only root filesystems**. Prevent runtime modifications:

 ```bash
@@ -143,6 +175,15 @@ docker run --read-only --tmpfs /tmp infisical/infisical:latest
 docker run --cap-drop=ALL infisical/infisical:latest
 ```

+**Use specific image tags**. Never use `latest` tags in production:
+
+```bash
+# Use specific version tags
+docker run infisical/infisical:v0.93.1-postgres
+```
+
+#### Resource Management
+
 **Set resource limits**. Prevent resource exhaustion attacks:

 ```bash
@@ -150,12 +191,7 @@ docker run --cap-drop=ALL infisical/infisical:latest
 docker run --memory=1g --cpus=0.5 infisical/infisical:latest
 ```

-**Use specific image tags**. Never use `latest` tags in production:
-
-```bash
-# Use specific version tags
-docker run infisical/infisical:v0.93.1-postgres
-```
+#### Health Monitoring

 **Configure health checks**. Set up Docker health checks:

@@ -165,6 +201,8 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:8080/api/status || exit 1
 ```

+#### Network Security
+
 **Host firewall configuration**. Configure host-level firewall for Docker deployments:

 ```bash
@@ -183,12 +221,16 @@ sudo ufw --force enable
 sudo iptables -L DOCKER
 ```

+#### Maintenance
+
 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.

-## Kubernetes Deployment Hardening
+### Kubernetes Deployment

 These recommendations are specific to Kubernetes deployments of Infisical.

+#### Pod Security
+
 **Use Pod Security Standards**. Apply restricted security profile:

 ```yaml
@@ -238,6 +280,8 @@ spec:
              memory: 512Mi
 ```

+#### Network Security
+
 **Configure network policies**. Restrict pod-to-pod communication:

 ```yaml
@@ -279,6 +323,21 @@ spec:
          port: 6379
 ```

+**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
+
+```bash
+# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
+# Allow ingress from load balancer to NodePort/ClusterIP service
+# Allow egress to managed databases
+# Block all other traffic
+
+# For on-premises, ensure node-level firewalls allow:
+# - Ingress traffic from ingress controllers
+# - Egress traffic to external services (databases, SMTP)
+```
+
+#### Access Control
+
 **Use dedicated service accounts**. Create service accounts with minimal permissions:

 ```yaml
@@ -300,6 +359,8 @@ spec:
      serviceAccountName: infisical
 ```

+#### Ingress Security
+
 **Configure ingress with TLS**. Set up secure ingress:

 ```yaml
@@ -331,6 +392,8 @@ spec:
                  number: 8080
 ```

+#### Secret Management
+
 **Use Kubernetes secrets**. Store sensitive configuration securely:

 ```yaml
@@ -349,6 +412,8 @@ stringData:
  SITE_URL: "<your-site-url>"
 ```

+#### Health Monitoring
+
 **Set up health checks**. Configure readiness and liveness probes:

 ```yaml
@@ -369,27 +434,20 @@ containers:
      periodSeconds: 10
 ```

+#### Infrastructure Considerations
+
 **Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.

-**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
-
-```bash
-# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
-# Allow ingress from load balancer to NodePort/ClusterIP service
-# Allow egress to managed databases
-# Block all other traffic
-
-# For on-premises, ensure node-level firewalls allow:
-# - Ingress traffic from ingress controllers
-# - Egress traffic to external services (databases, SMTP)
-```
+#### Maintenance

 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.

-## Linux Binary Deployment Hardening
+### Linux Binary Deployment

 These recommendations are specific to Linux binary deployments of Infisical.

+#### System User Management
+
 **Create dedicated user account**. Run Infisical under a dedicated service account:

 ```bash
@@ -401,6 +459,8 @@ sudo mkdir -p /opt/infisical
 sudo chown infisical:infisical /opt/infisical
 ```

+#### Service Configuration
+
 **Configure systemd service**. Create a secure systemd service:

 ```ini
@@ -439,6 +499,8 @@ EnvironmentFile=/etc/infisical/environment
 WantedBy=multi-user.target
 ```

+#### Configuration Security
+
 **Secure environment configuration**. Store environment variables securely:

 ```bash
@@ -453,6 +515,8 @@ sudo chmod 640 /etc/infisical/environment
 sudo chown root:infisical /etc/infisical/environment
 ```

+#### System Security
+
 **Disable memory swapping**. Prevent sensitive data from being written to disk:

 ```bash
@@ -473,6 +537,22 @@ echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
 ulimit -c 0
 ```

+#### File Permissions
+
+**Secure file permissions**. Set proper permissions on application files:
+
+```bash
+# Set binary permissions
+sudo chmod 755 /opt/infisical/infisical-linux-amd64
+sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
+
+# Set config file permissions
+sudo chmod 640 /etc/infisical/environment
+sudo chown root:infisical /etc/infisical/environment
+```
+
+#### Network Security
+
 **Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:

 ```bash
@@ -496,6 +576,8 @@ sudo ufw allow from 127.0.0.1 to any port 6379
 sudo ufw --force enable
 ```

+#### System Maintenance
+
 **Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:

 ```bash
@@ -509,22 +591,61 @@ sudo systemctl start ntp
 timedatectl status
 ```

-**Secure file permissions**. Set proper permissions on application files:
+**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly.
+
+## Enterprise Security Features
+
+### Hardware Security Module (HSM) Integration
+
+For the highest level of encryption security, integrate with Hardware Security Modules:
+
+HSM integration provides hardware-protected encryption keys stored on tamper-proof devices, offering superior security for encryption operations:
+
+- **Supported HSM Providers**: Thales Luna Cloud HSM, AWS CloudHSM, Fortanix HSM
+- **Root Key Protection**: HSM encrypts Infisical's root encryption keys using hardware-protected keys
+- **Enterprise Requirements**: Ideal for government, financial, and healthcare organizations

 ```bash
-# Set binary permissions
-sudo chmod 755 /opt/infisical/infisical-linux-amd64
-sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
-
-# Set config file permissions
-sudo chmod 640 /etc/infisical/environment
-sudo chown root:infisical /etc/infisical/environment
+# HSM Environment Variables (example for production)
+HSM_LIB_PATH="/path/to/hsm/library.so"
+HSM_PIN="your-hsm-pin"
+HSM_SLOT="0"
+HSM_KEY_LABEL="infisical-root-key"
 ```

-**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly:
+For complete HSM setup instructions, see the [HSM Integration Guide](/documentation/platform/kms/hsm-integration).
+
+### External Key Management Service (KMS) Integration
+
+Leverage cloud-native KMS providers for enhanced security and compliance:
+
+Infisical can integrate with external KMS providers to encrypt project secrets, providing enterprise-grade key management:
+
+- **Supported Providers**: AWS KMS, Google Cloud KMS, Azure Key Vault (coming soon)
+- **Workspace Key Protection**: Each project's encryption key is protected by your external KMS
+- **Zero Trust**: Infisical never stores your KMS keys - all encryption/decryption operations happen via your cloud KMS
+- **Compliance**: Leverage your cloud provider's compliance certifications (FedRAMP, SOC2, ISO 27001)
+
+#### Benefits for Production Deployments
+
+- **Separation of Concerns**: Keys managed in your cloud infrastructure, separate from Infisical
+- **Regulatory Compliance**: Use your existing compliance-certified KMS infrastructure
+- **Audit Integration**: KMS operations logged in your cloud provider's audit trails
+- **Disaster Recovery**: Keys backed by your cloud provider's HA and backup systems
+- **Access Controls**: Leverage your cloud IAM for KMS access management
+
+#### Configuration Resources
+
+For external KMS configuration, see:
+
+- [AWS KMS Integration](/documentation/platform/kms-configuration/aws-kms)
+- [GCP KMS Integration](/documentation/platform/kms-configuration/gcp-kms)
+- [External KMS Overview](/documentation/platform/kms-configuration/overview)

 ## Advanced Security Configurations

+### Backup Security
+
 **Configure backup encryption**. Encrypt PostgreSQL backups:

 ```bash
@@ -532,12 +653,18 @@ sudo chown root:infisical /etc/infisical/environment
 pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
 ```

+### Monitoring and Logging
+
 **Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.

+### Security Updates
+
 **Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.

 ## Compliance and Monitoring

+### Enterprise Compliance Requirements
+
 For enterprise deployments requiring compliance certifications:

 - Implement audit log retention policies
@@ -546,6 +673,6 @@ For enterprise deployments requiring compliance certifications:
 - Establish incident response procedures
 - Document security controls for compliance audits

-These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements.
+### Standards Compliance

-For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars).
+**FIPS 140-3 Compliance**. Infisical is actively working on FIPS 140-3 compliance to meet U.S. and Canadian government cryptographic standards. This will provide validated cryptographic modules for organizations requiring certified encryption implementations.