awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-02 19:25:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: reorganized

Browse Source
This commit is contained in:
Sheen Capadngan
2025-06-17 03:45:35 +08:00
parent c9eab0af18
commit cab8fb0d8e
1 changed files with 192 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/self-hosting/guides/production-hardening.mdx
+192 -65
View File
@@ -11,7 +11,11 @@ Choose your deployment method below and follow the recommendations for your spec
These security configurations apply to **all** Infisical deployments regardless of how you deploy. These security configurations apply to **all** Infisical deployments regardless of how you deploy.
**Configure secure encryption keys**. Generate strong cryptographic keys: ### Cryptographic Security
#### Generate Secure Keys
Generate strong cryptographic keys for your deployment:
```bash ```bash
# Required - Generate secure encryption key # Required - Generate secure encryption key
@@ -21,7 +25,22 @@ ENCRYPTION_KEY=$(openssl rand -hex 16)
AUTH_SECRET=$(openssl rand -base64 32) AUTH_SECRET=$(openssl rand -base64 32)
``` ```
**Use end-to-end TLS**. Configure HTTPS and secure database connections: #### Configure Token Lifetimes
Minimize exposure window for compromised tokens:
```bash
# JWT token configuration (adjust based on security requirements)
JWT_AUTH_LIFETIME=15m # Authentication tokens
JWT_REFRESH_LIFETIME=24h # Refresh tokens
JWT_SERVICE_LIFETIME=1h # Service tokens
```
### Network Security
#### TLS Configuration
Configure HTTPS and secure database connections:
```bash ```bash
# Enable HTTPS (recommended for production) # Enable HTTPS (recommended for production)
@@ -34,7 +53,9 @@ DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
DB_ROOT_CERT="<base64-encoded-certificate>" DB_ROOT_CERT="<base64-encoded-certificate>"
``` ```
**Secure Redis configuration**. Use authentication and TLS for Redis: #### Redis Security
Use authentication and TLS for Redis:
```bash ```bash
# Redis with TLS (if supported by your Redis deployment) # Redis with TLS (if supported by your Redis deployment)
@@ -48,23 +69,41 @@ REDIS_SENTINEL_USERNAME="sentinel_user"
REDIS_SENTINEL_PASSWORD="sentinel_password" REDIS_SENTINEL_PASSWORD="sentinel_password"
``` ```
**Restrict CORS origins**. Configure specific allowed origins: #### Network Access Controls
Configure network restrictions and firewall rules:
```bash ```bash
# Limit CORS to specific domains # Limit CORS to specific domains
CORS_ALLOWED_ORIGINS=["https://your-app.example.com"] CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
```
**Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:
```bash
# Prevent connections to internal/private IP addresses # Prevent connections to internal/private IP addresses
# This blocks access to internal services like metadata endpoints, # This blocks access to internal services like metadata endpoints,
# internal APIs, databases, and other sensitive infrastructure # internal APIs, databases, and other sensitive infrastructure
ALLOW_INTERNAL_IP_CONNECTIONS=false ALLOW_INTERNAL_IP_CONNECTIONS=false
``` ```
**Configure SMTP securely**. Use TLS for email communications: **Implement network firewalls**. Restrict network access to only necessary services:
- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
- **Principle**: Default deny incoming, allow only required traffic
- **Implementation**: See your deployment-specific section below for exact configuration
### Application Security
#### Site Configuration
Set proper site URL for your Infisical instance:
```bash
# Required - Must be absolute URL with protocol
SITE_URL="https://app.infisical.com"
```
#### SMTP Security
Use TLS for email communications:
```bash ```bash
# SMTP with TLS # SMTP with TLS
@@ -78,35 +117,29 @@ SMTP_FROM_ADDRESS="[email protected]"
SMTP_FROM_NAME="Infisical" SMTP_FROM_NAME="Infisical"
``` ```
**Set proper site URL**. Configure the absolute URL for your Infisical instance: #### Privacy Configuration
Control telemetry and data collection:
```bash ```bash
# Required - Must be absolute URL with protocol # Optional - Disable telemetry (enabled by default)
SITE_URL="https://app.infisical.com" TELEMETRY_ENABLED=false
``` ```
**Configure database read replicas**. For high availability PostgreSQL setups: ### Database Security
#### High Availability Configuration
Configure database read replicas for high availability PostgreSQL setups:
```bash ```bash
# Read replica configuration (JSON format) # Read replica configuration (JSON format)
DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]' DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
``` ```
**Configure short token lifetimes**. Minimize exposure window for compromised tokens: ### Operational Security
```bash #### User Access Management
# JWT token configuration (adjust based on security requirements)
JWT_AUTH_LIFETIME=15m # Authentication tokens
JWT_REFRESH_LIFETIME=24h # Refresh tokens
JWT_SERVICE_LIFETIME=1h # Service tokens
```
**Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:
```bash
# Optional - Disable telemetry (enabled by default)
TELEMETRY_ENABLED=false
```
**Establish user off-boarding procedures**. Remove access promptly when users leave: **Establish user off-boarding procedures**. Remove access promptly when users leave:
@@ -116,19 +149,18 @@ TELEMETRY_ENABLED=false
4. Audit access logs for the user's activity 4. Audit access logs for the user's activity
5. Rotate any shared secrets the user had access to 5. Rotate any shared secrets the user had access to
**Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method: #### Maintenance and Updates
- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
- **Principle**: Default deny incoming, allow only required traffic
- **Implementation**: See your deployment-specific section below for exact configuration
**Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method. **Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.
## Docker Deployment Hardening ## Deployment-Specific Hardening
### Docker Deployment
These recommendations are specific to Docker deployments of Infisical. These recommendations are specific to Docker deployments of Infisical.
#### Container Security
**Use read-only root filesystems**. Prevent runtime modifications: **Use read-only root filesystems**. Prevent runtime modifications:
```bash ```bash
@@ -143,6 +175,15 @@ docker run --read-only --tmpfs /tmp infisical/infisical:latest
docker run --cap-drop=ALL infisical/infisical:latest docker run --cap-drop=ALL infisical/infisical:latest
``` ```
**Use specific image tags**. Never use `latest` tags in production:
```bash
# Use specific version tags
docker run infisical/infisical:v0.93.1-postgres
```
#### Resource Management
**Set resource limits**. Prevent resource exhaustion attacks: **Set resource limits**. Prevent resource exhaustion attacks:
```bash ```bash
@@ -150,12 +191,7 @@ docker run --cap-drop=ALL infisical/infisical:latest
docker run --memory=1g --cpus=0.5 infisical/infisical:latest docker run --memory=1g --cpus=0.5 infisical/infisical:latest
``` ```
**Use specific image tags**. Never use `latest` tags in production: #### Health Monitoring
```bash
# Use specific version tags
docker run infisical/infisical:v0.93.1-postgres
```
**Configure health checks**. Set up Docker health checks: **Configure health checks**. Set up Docker health checks:
@@ -165,6 +201,8 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
CMD curl -f http://localhost:8080/api/status || exit 1 CMD curl -f http://localhost:8080/api/status || exit 1
``` ```
#### Network Security
**Host firewall configuration**. Configure host-level firewall for Docker deployments: **Host firewall configuration**. Configure host-level firewall for Docker deployments:
```bash ```bash
@@ -183,12 +221,16 @@ sudo ufw --force enable
sudo iptables -L DOCKER sudo iptables -L DOCKER
``` ```
#### Maintenance
**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly. **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.
## Kubernetes Deployment Hardening ### Kubernetes Deployment
These recommendations are specific to Kubernetes deployments of Infisical. These recommendations are specific to Kubernetes deployments of Infisical.
#### Pod Security
**Use Pod Security Standards**. Apply restricted security profile: **Use Pod Security Standards**. Apply restricted security profile:
```yaml ```yaml
@@ -238,6 +280,8 @@ spec:
memory: 512Mi memory: 512Mi
``` ```
#### Network Security
**Configure network policies**. Restrict pod-to-pod communication: **Configure network policies**. Restrict pod-to-pod communication:
```yaml ```yaml
@@ -279,6 +323,21 @@ spec:
port: 6379 port: 6379
``` ```
**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
```bash
# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
# Allow ingress from load balancer to NodePort/ClusterIP service
# Allow egress to managed databases
# Block all other traffic
# For on-premises, ensure node-level firewalls allow:
# - Ingress traffic from ingress controllers
# - Egress traffic to external services (databases, SMTP)
```
#### Access Control
**Use dedicated service accounts**. Create service accounts with minimal permissions: **Use dedicated service accounts**. Create service accounts with minimal permissions:
```yaml ```yaml
@@ -300,6 +359,8 @@ spec:
serviceAccountName: infisical serviceAccountName: infisical
``` ```
#### Ingress Security
**Configure ingress with TLS**. Set up secure ingress: **Configure ingress with TLS**. Set up secure ingress:
```yaml ```yaml
@@ -331,6 +392,8 @@ spec:
number: 8080 number: 8080
``` ```
#### Secret Management
**Use Kubernetes secrets**. Store sensitive configuration securely: **Use Kubernetes secrets**. Store sensitive configuration securely:
```yaml ```yaml
@@ -349,6 +412,8 @@ stringData:
SITE_URL: "<your-site-url>" SITE_URL: "<your-site-url>"
``` ```
#### Health Monitoring
**Set up health checks**. Configure readiness and liveness probes: **Set up health checks**. Configure readiness and liveness probes:
```yaml ```yaml
@@ -369,27 +434,20 @@ containers:
periodSeconds: 10 periodSeconds: 10
``` ```
#### Infrastructure Considerations
**Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities. **Use managed databases (if possible)**. For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.
**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security: #### Maintenance
```bash
# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
# Allow ingress from load balancer to NodePort/ClusterIP service
# Allow egress to managed databases
# Block all other traffic
# For on-premises, ensure node-level firewalls allow:
# - Ingress traffic from ingress controllers
# - Egress traffic to external services (databases, SMTP)
```
**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly. **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.
## Linux Binary Deployment Hardening ### Linux Binary Deployment
These recommendations are specific to Linux binary deployments of Infisical. These recommendations are specific to Linux binary deployments of Infisical.
#### System User Management
**Create dedicated user account**. Run Infisical under a dedicated service account: **Create dedicated user account**. Run Infisical under a dedicated service account:
```bash ```bash
@@ -401,6 +459,8 @@ sudo mkdir -p /opt/infisical
sudo chown infisical:infisical /opt/infisical sudo chown infisical:infisical /opt/infisical
``` ```
#### Service Configuration
**Configure systemd service**. Create a secure systemd service: **Configure systemd service**. Create a secure systemd service:
```ini ```ini
@@ -439,6 +499,8 @@ EnvironmentFile=/etc/infisical/environment
WantedBy=multi-user.target WantedBy=multi-user.target
``` ```
#### Configuration Security
**Secure environment configuration**. Store environment variables securely: **Secure environment configuration**. Store environment variables securely:
```bash ```bash
@@ -453,6 +515,8 @@ sudo chmod 640 /etc/infisical/environment
sudo chown root:infisical /etc/infisical/environment sudo chown root:infisical /etc/infisical/environment
``` ```
#### System Security
**Disable memory swapping**. Prevent sensitive data from being written to disk: **Disable memory swapping**. Prevent sensitive data from being written to disk:
```bash ```bash
@@ -473,6 +537,22 @@ echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
ulimit -c 0 ulimit -c 0
``` ```
#### File Permissions
**Secure file permissions**. Set proper permissions on application files:
```bash
# Set binary permissions
sudo chmod 755 /opt/infisical/infisical-linux-amd64
sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
# Set config file permissions
sudo chmod 640 /etc/infisical/environment
sudo chown root:infisical /etc/infisical/environment
```
#### Network Security
**Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments: **Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:
```bash ```bash
@@ -496,6 +576,8 @@ sudo ufw allow from 127.0.0.1 to any port 6379
sudo ufw --force enable sudo ufw --force enable
``` ```
#### System Maintenance
**Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs: **Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:
```bash ```bash
@@ -509,22 +591,61 @@ sudo systemctl start ntp
timedatectl status timedatectl status
``` ```
**Secure file permissions**. Set proper permissions on application files: **Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly.
## Enterprise Security Features
### Hardware Security Module (HSM) Integration
For the highest level of encryption security, integrate with Hardware Security Modules:
HSM integration provides hardware-protected encryption keys stored on tamper-proof devices, offering superior security for encryption operations:
- **Supported HSM Providers**: Thales Luna Cloud HSM, AWS CloudHSM, Fortanix HSM
- **Root Key Protection**: HSM encrypts Infisical's root encryption keys using hardware-protected keys
- **Enterprise Requirements**: Ideal for government, financial, and healthcare organizations
```bash ```bash
# Set binary permissions # HSM Environment Variables (example for production)
sudo chmod 755 /opt/infisical/infisical-linux-amd64 HSM_LIB_PATH="/path/to/hsm/library.so"
sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64 HSM_PIN="your-hsm-pin"
HSM_SLOT="0"
# Set config file permissions HSM_KEY_LABEL="infisical-root-key"
sudo chmod 640 /etc/infisical/environment
sudo chown root:infisical /etc/infisical/environment
``` ```
**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly: For complete HSM setup instructions, see the [HSM Integration Guide](/documentation/platform/kms/hsm-integration).
### External Key Management Service (KMS) Integration
Leverage cloud-native KMS providers for enhanced security and compliance:
Infisical can integrate with external KMS providers to encrypt project secrets, providing enterprise-grade key management:
- **Supported Providers**: AWS KMS, Google Cloud KMS, Azure Key Vault (coming soon)
- **Workspace Key Protection**: Each project's encryption key is protected by your external KMS
- **Zero Trust**: Infisical never stores your KMS keys - all encryption/decryption operations happen via your cloud KMS
- **Compliance**: Leverage your cloud provider's compliance certifications (FedRAMP, SOC2, ISO 27001)
#### Benefits for Production Deployments
- **Separation of Concerns**: Keys managed in your cloud infrastructure, separate from Infisical
- **Regulatory Compliance**: Use your existing compliance-certified KMS infrastructure
- **Audit Integration**: KMS operations logged in your cloud provider's audit trails
- **Disaster Recovery**: Keys backed by your cloud provider's HA and backup systems
- **Access Controls**: Leverage your cloud IAM for KMS access management
#### Configuration Resources
For external KMS configuration, see:
- [AWS KMS Integration](/documentation/platform/kms-configuration/aws-kms)
- [GCP KMS Integration](/documentation/platform/kms-configuration/gcp-kms)
- [External KMS Overview](/documentation/platform/kms-configuration/overview)
## Advanced Security Configurations ## Advanced Security Configurations
### Backup Security
**Configure backup encryption**. Encrypt PostgreSQL backups: **Configure backup encryption**. Encrypt PostgreSQL backups:
```bash ```bash
@@ -532,12 +653,18 @@ sudo chown root:infisical /etc/infisical/environment
pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
``` ```
### Monitoring and Logging
**Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations. **Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
### Security Updates
**Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly. **Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.
## Compliance and Monitoring ## Compliance and Monitoring
### Enterprise Compliance Requirements
For enterprise deployments requiring compliance certifications: For enterprise deployments requiring compliance certifications:
- Implement audit log retention policies - Implement audit log retention policies
@@ -546,6 +673,6 @@ For enterprise deployments requiring compliance certifications:
- Establish incident response procedures - Establish incident response procedures
- Document security controls for compliance audits - Document security controls for compliance audits
These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements. ### Standards Compliance
For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars). **FIPS 140-3 Compliance**. Infisical is actively working on FIPS 140-3 compliance to meet U.S. and Canadian government cryptographic standards. This will provide validated cryptographic modules for organizations requiring certified encryption implementations.