Merge pull request #4847 from Infisical/chore/contributing-docs-update

Chore: contributing docs update and broken links fixes

.env.example

@@ -1,7 +1,7 @@
 # Keys
 # Required key for platform encryption/decryption ops
 # THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NEVER BE USED FOR PRODUCTION
-ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
+ENCRYPTION_KEY=VVHnGZ0w98WLgISK4XSJcagezuG6EWRFTk48KE4Y5Mw=
 
 # JWT
 # Required secrets to sign JWT tokens

.env.migration.example

@@ -1,2 +1,2 @@
-DB_CONNECTION_URI=
+DB_CONNECTION_URI=postgres://infisical:infisical@localhost:5432/infisical
 AUDIT_LOGS_DB_CONNECTION_URI=

.github/pull_request_template.md

@@ -20,6 +20,4 @@
 
 ---
 
-- [ ] I have read the [contributing guide](https://infisical.com/docs/contributing/getting-started/overview), agreed and acknowledged the [code of conduct](https://infisical.com/docs/contributing/getting-started/code-of-conduct). 📝
+- [ ] I have read the [contributing guide](https://infisical.com/docs/contributing/getting-started/overview), agreed and acknowledged the [code of conduct](https://infisical.com/docs/contributing/getting-started/code-of-conduct). 📝
-
-<!-- If you have any questions regarding contribution, here's the FAQ : https://infisical.com/docs/contributing/getting-started/faq -->

README.md

@@ -87,7 +87,7 @@ We're on a mission to make security tooling more accessible to everyone, not jus
 
 ## Getting started
 
-Check out the [Quickstart Guides](https://infisical.com/docs/getting-started/introduction)
+Check out the [Quickstart Guides](https://infisical.com/docs/documentation/getting-started/overview)
 
 | Use Infisical Cloud                                                                                                                                     | Deploy Infisical on premise                                                          |
 | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |

docs/api-reference/overview/usage.mdx

@@ -1,18 +0,0 @@
----
-title: "Usage"
----
-
-Prerequisites:
-
-- Set up and add envars to [Infisical Cloud](https://app.infisical.com) or your self-hosted instance.
-- Obtain an API Key in your user settings to be included in requests to the Infisical API.
-
-Using Infisical's API to manage secrets requires a basic understanding of the system and its underlying cryptography detailed [here](/security/overview).
-
-## Concepts
-
-- Each user has a public/private key pair that is stored with the platform; private keys are encrypted locally by the user's password before being sent off to the server during the account signup process.
-- Each (encrypted) secret belongs to a project and environment.
-- Each project has an (encrypted) project key used to encrypt the secrets within that project; Infisical stores copies of the project key, for each member of that project, encrypted under each member's public key.
-- Secrets are encrypted symmetrically by your copy of the project key belonging to the project containing.
-- Infisical uses AES256-GCM and [TweetNaCl.js](https://tweetnacl.js.org/#/) for symmetric and asymmetric encryption/decryption operations.

docs/contributing/getting-started/faq.mdx

@@ -1,93 +0,0 @@
----
-title: "FAQ"
-description: "Frequently Asked Questions about contributing to Infisical"
----
-
-Frequently asked questions about contributing to Infisical can be found on this page. 
-If you can't find the answer you are looking for, please create an issue on our GitHub repository or join our Slack channel for additional support.
-
-<Accordion title="Error building Infisical platform backend (Alpine Linux CDN temporary error)">
-The Alpine Linux CDN may be unavailable/down in your region infrequently (eg. there is an unplanned outage). One possible fix is to add a retry mechanism and a fallback mirrors array to the Dockerfile. You can also use this as an opportunity to pin the Alpine Linux version for Docker to use in case there are issues with the latest version. Ensure to use https for the mirrors.
-
-#### Make the following changes to the backend Dockerfile
-```bash
-# Pin Alpine version from list: https://dl-cdn.alpinelinux.org/alpine/
-ARG ALPINE_VERSION=3.17
-ARG ALPINE_APPEND=v3.17/main
-
-# Specify number of retries for each mirror
-ARG MAX_RETRIES=3
-
-# Define base Alpine mirror URLs in attempt order from list: https://dl-cdn.alpinelinux.org/alpine/MIRRORS.txt
-ARG BASE_ALPINE_MIRRORS="https://dl-cdn.alpinelinux.org/alpine https://ftp.halifax.rwth-aachen.de/alpine https://uk.alpinelinux.org/alpine"
-
-# Build stage
-# Add the Alpine version arg
-FROM node:16-alpine$ALPINE_VERSION AS build
-
-WORKDIR /app
-
-COPY package*.json ./
-RUN npm ci --only-production
-
-COPY . .
-RUN npm run build
-
-# Production stage
-# Add the Alpine version arg
-FROM node:16-alpine$ALPINE_VERSION
-
-WORKDIR /app
-
-ENV npm_config_cache /home/node/.npm
-
-COPY package*.json ./
-RUN npm ci --only-production
-
-COPY --from=build /app .
-
-# Add retry mechanism and loop through the specified mirrors
-RUN retries_left=$MAX_RETRIES; \
-    for mirror in $ALPINE_MIRRORS; do \
-        full_mirror="$mirror/$ALPINE_APPEND"; \
-        echo "Trying mirror: $full_mirror"; \
-        echo >>/etc/apk/repositories "$full_mirror"; \
-        for i in $(seq $retries_left); do \
-            echo "Retrying... Attempt $i (Retries Left: $((retries_left - i)))"; \
-            if apk add --no-cache bash curl git && \
-               curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash && \
-               apk add --no-cache infisical=0.8.1; then \
-                break; \
-            fi; \
-            sleep 10; \
-        done; \
-        if [ $? -eq 0 ]; then \
-            break; \
-        fi; \
-    done
-
-HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \  
-  CMD node healthcheck.js
-
-EXPOSE 4000
-
-CMD ["npm", "run", "start"]
-  ```
-
-<Info>
-  [Alpine Linux (mirrors) - official site](https://dl-cdn.alpinelinux.org/alpine/MIRRORS.txt)
-</Info>
-
-<Info>
-  [Alpine Linux (mirrors) - archived site](https://web.archive.org/web/20230914123159/https://dl-cdn.alpinelinux.org/alpine/MIRRORS.txt)
-</Info>
-
-<Info>
-  [Alpine Linux (versions) - official site](https://dl-cdn.alpinelinux.org/alpine/)
-</Info>
-
-<Info>
-  [Alpine Linux (versions) - archived site](https://web.archive.org/web/20230914123455/https://dl-cdn.alpinelinux.org/alpine/)
-</Info>
-
-</Accordion>

docs/contributing/getting-started/overview.mdx

@@ -20,7 +20,6 @@ Infisical has two major code-bases. One for the platform code, and one for SDKs.
   - [C++ SDK](https://github.com/Infisical/infisical-cpp-sdk)
   - [PHP SDK](https://github.com/Infisical/php-sdk)
   - [Rust SDK](https://github.com/Infisical/rust-sdk)
-  - [Ruby SDK](https://github.com/infisical/sdk)
 
 ## Community
 

docs/contributing/getting-started/pull-requests.mdx

@@ -29,13 +29,7 @@ Feel free to add a short video or screenshots of what your PR achieves.
 
 ## Getting your PR reviewed
 
-Once your PR is reviewed, one or two relevant members of the Infisical team should review and approve the PR before it is merged. You should coordinate and ping the team member closest to the submitted functionality via our [Slack](https://infisical.com/slack) to review your PR.
+One or two relevant members of the Infisical team should review and approve the PR before it is merged. You can ping someone from the team in our [Slack](https://infisical.com/slack) to review your PR.
-
-- Vlad: Frontend, Web UI
-- Tony: Backend, SDKs, Security
-- Maidul: Backend, CI/CD, CLI, Kubernetes Operator
-- Daniel: Frontend, UI/UX, Backend, SDKs
-
 
 The team member(s) will start by enabling baseline checks to ensure that there are no leaked secrets, new dependencies are clear, and the frontend/backend services start up. Afterward, they will review your PR thoroughly by testing the code and leave any feedback or work in with you to revise the PR up to standard.
 

docs/contributing/platform/backend/folder-structure.mdx

@@ -5,28 +5,47 @@ title: 'Backend folder structure'
 ```
 ├── scripts
 ├── e2e-test
+├── bdd
 └── src/
     ├── @types/
     │   ├── knex.d.ts
-    │   └── fastify.d.ts
+    │   ├── fastify.d.ts
+    │   ├── ...
     ├── db/
     │   ├── migrations
     │   ├── schemas
-    │   └── seed
+    │   └── seeds
+    ├── keystore/
     ├── lib/
+    │   ├── api-docs
+    │   ├── aws
+    │   ├── axios
+    │   ├── base64
+    │   ├── casl
+    │   ├── certificates
+    │   ├── config
+    │   ├── crypto
+    │   ├── dates
+    │   ├── delay
+    │   ├── error-codes
+    │   ├── errors
+    │   ├── files
     │   ├── fn
-    │   ├── date
+    │   ├── ...
-    │   └── config
     ├── queue
     ├── server/
     │   ├── routes/
     │   │   ├── v1
-    │   │   └── v2
+    │   │   ├── v2
+    │   │   ├── v3
+    │   │   └── v4
     │   ├── plugins
-    │   └── config
+    │   ├── config
+    │   └── lib
     ├── services/
     │   ├── auth
     │   ├── org
+    │   ├── ...
     │   └── project/
     │       ├── project-service.ts
     │       ├── project-types.ts
@@ -42,19 +61,23 @@ Contains reusable scripts for backend automation, like running migrations and ge
 ### `backend/e2e-test` 
 Integration tests for the APIs.
 
+### `backend/bdd`
+Behavior-Driven Development (BDD) tests using Python and Gherkin feature files.
+
 ### `backend/src`
 The source code of the backend.
 
-- `@types`: Type definitions for libraries like Fastify and Knex.
+- `@types`: Type definitions for libraries like Fastify, Knex, and other third-party dependencies.
-- `db`: Knex.js configuration for the database, including migration, seed files, and SQL type schemas.
+- `db`: Knex.js configuration for the database, including migrations, seed files, and SQL type schemas.
-- `lib`: Stateless, reusable functions used across the codebase.
+- `keystore`: Key-value store abstraction layer supporting Redis and PostgreSQL for application caching, distributed locking, and coordination.
+- `lib`: Stateless, reusable functions used across the codebase, organized by functionality (crypto, config, dates, etc.).
 - `queue`: Infisical's queue system based on BullMQ.
 
 ### `src/server`
 
 - Scope anything related to Fastify/service here.
-- Includes routes, Fastify plugins, and server configurations.
+- Includes routes, Fastify plugins, server configurations, and server-specific utilities.
-- The routes folder contains various versions of routes separated into v1, v2, etc.
+- The routes folder contains various versions of routes separated into v1, v2, v3, v4, etc.
 
 ### `src/services`
 

docs/contributing/platform/backend/how-to-create-a-feature.mdx

@@ -8,7 +8,7 @@ Suppose you're interested in implementing a new feature in Infisical's backend,
 If your feature involves a change in the database, you need to first address this by generating the necessary database schemas.
 
 1. If you're adding a new table, update the `TableName` enum in `/src/db/schemas/models.ts` to include the new table name.
-2. Create a new migration file by running `npm run migration:new` and give it a relevant name, such as `feature-x`.
+2. Create a new migration file by going to the `/backend` folder and running `npm run migration:new` and give it a relevant name, such as `feature-x`.
 3. Navigate to `/src/db/migrations/<timestamp>_<feature-x>.ts`.
 4. Modify both the `up` and `down` functions to create or alter Postgres fields on migration up and to revert these changes on migration down, ensuring idempotency as outlined [here](https://github.com/graphile/migrate/blob/main/docs/idempotent-examples.md).
 
@@ -16,10 +16,11 @@ If your feature involves a change in the database, you need to first address thi
 
 While typically you would need to manually write TS types for Knex type-sense, we have automated this process:
 
-1. Start the server.
+1. If you haven't done it yet, create a new `.env.migration` file at the root of the Infisical directory then copy the contents of the file linked [here](https://github.com/Infisical/infisical/blob/main/.env.migration.example)
-2. Run `npm run migration:latest` to apply all database changes.
+2. Start the server.
-3. Execute `npm run generate:schema` to automatically generate types and schemas using [zod](https://github.com/colinhacks/zod) in the `/src/db/schemas` folder.
+3. Go to the `/backend` folder and run `npm run migration:latest-dev` to apply all database changes.
-4. Update the barrel export in `schema/index` and include the new tables in `/src/@types/knex.d.ts` to enable type-sensing in Knex.js.
+4. Execute `npm run generate:schema` to automatically generate types and schemas using [zod](https://github.com/colinhacks/zod) in the `/src/db/schemas` folder.
+5. Update the barrel export in `schema/index` and include the new tables in `/src/@types/knex.d.ts` to enable type-sensing in Knex.js.
 
 ## Business Logic
 
@@ -38,10 +39,10 @@ Use the custom Infisical function `ormify` in `src/lib/knex` for simple database
 
 ## Connecting the Service Layer to the Server Layer
 
-Server-related logic is handled in `/src/server`. To connect the service layer to the server layer, we use Fastify plugins for dependency injection:
+Server-related logic is handled in `/src/server`. To connect the service layer to the server layer, we use Fastify's dependency injection pattern:
 
-1. Add the service type in the `fastify.d.ts` file under the `service` namespace of a FastifyServerInstance type.
+1. Add the service type in `/src/@types/fastify.d.ts` under the `services` namespace of the `FastifyInstance` interface.
-2. In `/src/server/routes/index.ts`, instantiate the required dependencies for `feature-x`, such as the DAL and service layers, and then pass them to `fastify.register("service,{...dependencies})`.
+2. In `/src/server/routes/index.ts`, instantiate the required dependencies for `feature-x` (such as the DAL and service layers), and then add the service instance to the `server.decorate()` call, where all services are registered for dependency injection.
 3. This makes the service layer accessible within all routes under the Fastify service instance, accessed via `server.services.<registered service name>.<function>`.
 
 ## Writing API Routes

docs/contributing/platform/developing.mdx

@@ -15,7 +15,7 @@ git checkout -b MY_BRANCH_NAME
 
 ## Set up environment variables
 
-Start by creating a .env file at the root of the Infisical directory then copy the contents of the file linked [here](https://github.com/Infisical/infisical/blob/main/.env.example). View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
+Start by creating a `.env` file at the root of the Infisical directory then copy the contents of the file linked [here](https://github.com/Infisical/infisical/blob/main/.env.example). View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
 
 ## Starting Infisical for development
 

docs/docs.json

@@ -377,8 +377,7 @@
                 "pages": [
                   "contributing/getting-started/overview",
                   "contributing/getting-started/code-of-conduct",
-                  "contributing/getting-started/pull-requests",
+                  "contributing/getting-started/pull-requests"
-                  "contributing/getting-started/faq"
                 ]
               },
               {

docs/documentation/getting-started/api.mdx

@@ -1,128 +0,0 @@
----
-title: "REST API"
----
-
-Infisical's REST API is the most flexible way to read/write secrets for your application.
-
-In this brief, we'll explore how to fetch a secret back from a project on [Infisical Cloud](https://app.infisical.com) via the REST API.
-
-<Steps>
-    <Step title="Create a project with a secret">
-        To create a project, head to your Organization Overview and press **Add New Project**; we'll call the project **Demo App**.
-        ![create project](../../images/getting-started/api/org-create-project-1.png)
-
-        ![create project](../../images/getting-started/api/org-create-project-2.png)
-
-        Next, let's head to the **Development** environment of the project and add a secret `FOO=BAR` to it.
-
-        ![explore project env](../../images/getting-started/api/project-explore-env.png)
-
-        ![create secret](../../images/getting-started/api/project-create-secret.png)
-
-        ![project dashboard](../../images/getting-started/api/project-dashboard.png)
-
-        <Note>
-            For this brief, you'll need to disable end-to-end encryption in your Project Settings
-        </Note>
-    </Step>
-    <Step title="Create an identity">
-        Next, we need to create an identity to represent your application. To create one, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
-
-        ![identities organization](../../images/platform/identities/identities-org.png)
-
-        When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
-
-        ![identities organization create](../../images/platform/identities/identities-org-create.png)
-
-        Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
-
-        ![identities organization create auth method](../../images/platform/identities/identities-org-create-auth-method.png)
-
-    </Step>
-    <Step title="Create a Client Secret">
-        In order to use the identity, you'll need the non-sensitive **Client ID**
-        of the identity and a **Client Secret** for it; you can think of these credentials akin to a username
-        and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
-        for it.
-
-        ![identities client secret create](../../images/platform/identities/identities-org-client-secret.png)
-        ![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-1.png)
-        ![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-2.png)
-    </Step>
-    <Step title="Add the identity to the project">
-        To enable the identity to access your project, we need to add it to the project. To do this, head over to the **Demo App** Project Settings > Access Control > Machine Identities and press **Add identity**.
-
-        Next, select the identity you want to add to the project and the role you want to assign it.
-
-        ![identities project](../../images/platform/identities/identities-project.png)
-
-        ![identities project create](../../images/platform/identities/identities-project-create.png)
-    </Step>
-    <Step title="Get an access token for the Infisical API">
-        To access the Infisical API as the identity, you should first perform a login operation
-        that is to exchange the **Client ID** and **Client Secret** of the identity for an access token
-        by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
-
-        #### Sample request
-
-        ```
-        curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' \
-        --header 'Content-Type: application/x-www-form-urlencoded' \
-        --data-urlencode 'clientSecret=<client_secret>' \
-        --data-urlencode 'clientId=<client_id>'
-        ```
-
-        #### Sample response
-
-        ```
-        {
-        "accessToken": "...",
-        "expiresIn": 7200,
-        "tokenType": "Bearer"
-        }
-        ```
-
-        Next, we can use the access token to authenticate with the [Infisical API](/api-reference/overview/introduction) to read/write secrets
-
-        <Note>
-        Each identity access token has a time-to-live (TTL) which you can infer from the response of the login operation;
-        the default TTL is `7200` seconds which can be adjusted.
-
-        If an identity access token expires, it can no longer authenticate with the Infisical API. In this case,
-        a new access token should be obtained from the aforementioned login operation.
-        </Note>
-    </Step>
-    <Step title="Fetch back secret">
-        Finally, you can fetch the secret `FOO=BAR` back from **Step 1** by including the access token in the previous step in another request to the `/api/v3/secrets/raw/{secretName}` endpoint.
-
-        ### Sample request
-
-        ```
-        curl --location --request GET 'http://localhost:8080/api/v3/secrets/raw/FOO?workspaceId=657830d579cfc8415d06ce5b&environment=dev' \
-            --header 'Authorization: Bearer <access_token>'
-        ```
-
-        ### Sample response
-
-        ```
-        {
-            "secret": {
-                "_id": "6564234b934d634e1fcd6cdf",
-                "version": 1,
-                "workspace": "6564173e934d634e1fcd6950",
-                "type": "shared",
-                "environment": "dev",
-                "secretKey": "FOO2",
-                "secretValue": "BAR2",
-                "secretComment": ""
-            }
-        }
-        ```
-
-        Note that you can fetch a list of secrets back by making a request to the `/api/v3/secrets/raw` endpoint.
-    </Step>
-</Steps>
-
-See also:
-
-- [API Reference](/api-reference/overview/introduction)

docs/documentation/getting-started/overview.mdx

@@ -46,12 +46,11 @@ description: "The open source platform for managing secrets, certificates, and s
   >
     Manage access to resources like databases, servers, and accounts with policy-based controls and approvals.
   </Card>
-</Columns>
+  <Card
-
+    title="Infisical KMS"
-<Columns cols="1">
+    href="/documentation/platform/kms/overview"
-  <Card title="Infisical KMS" href="/documentation/platform/kms/overview">
+  >
-    Encrypt and decrypt sensitive data using a centralized key management
+    Encrypt and decrypt sensitive data using a centralized key management system.
-    system.
   </Card>
 </Columns>
 

docs/documentation/getting-started/platform.mdx

@@ -1,65 +0,0 @@
----
-title: "Platform"
----
-
-This quickstart provides an overview of functionalities offered by Infisical.
-
-## Managing your Organization
-
-When you first make an account with Infisical, you also create a new **organization** where you are assigned the `admin` role by default.
-From there, you can invite external members to the organization and start creating **projects** to house secrets.
-
-### Projects
-
-The **Projects** page shows you all the projects that you have access to within your organization.
-Here, you can also create a new project.
-
-![organization overview](../../images/organization-overview.png)
-
-### Members
-
-The **Members** page lets you add or remove external members to your organization.
-Note that you can configure your organization in Infisical to have members authenticate with the platform via protocols like SAML 2.0 and OpenID Connect.
-
-![organization members](../../images/organization/platform/organization-members.png)
-
-## Managing your Projects
-
-As mentioned before, projects house secrets which are further organized into environments such as development, testing and production.
-A project can be anything from a single application to a collection of micro-services that you wish to manage secrets for.
-
-### Secrets Overview
-
-The **Secrets Overview** screen provides a bird's-eye view of all the secrets in a project and is useful for comparing secrets and identifying missing ones across environments.
-
-![dashboard secrets overview](../../images/dashboard-secrets-overview.png)
-
-In the above image, you can already see that:
-
-- `STRIPE_API_KEY` is missing from the **Staging** environment.
-- `JWT_SECRET` is missing from the **Production** environment.
-- `BAR` is `EMPTY` in the **Production** environment.
-
-### Dashboard
-
-The secrets dashboard lets you manage secrets for a specific environment in a project.
-Here, developers can override secrets, version secrets, rollback projects to any point in time and much more.
-
-![dashboard](../../images/dashboard.png)
-
-### Integrations
-
-The integrations page provides native integrations to sync secrets from a project environment to a [host of ever-expanding integrations](/integrations/overview).
-
-![integrations](../../images/integrations.png)
-
-### Members
-
-The members page lets you add/remove members to/from a project and provision them access to environments via roles. By default, Infisical provides the `admin`, `developer`, and `viewer` roles
-which you can assign to members.
-
-![project members](../../images/project-members.png)
-
-That's it for the platform quickstart! — We encourage you to continue exploring the documentation to gain a deeper understanding of the extensive features and functionalities that Infisical has to offer.
-
-Next, head back to [Getting Started > Introduction](/documentation/getting-started/overview) to explore ways to fetch secrets from Infisical to your apps and infrastructure.

docs/documentation/guides/nextjs-vercel.mdx

@@ -199,7 +199,7 @@ Next, navigate to your project's integrations tab in Infisical and press on the
     Opting in for the Infisical-Vercel integration will break end-to-end encryption since Infisical will be able to read
     your secrets. This is, however, necessary for Infisical to sync the secrets to Vercel.
 
-    Your secrets remain encrypted at rest following our [security guide mechanics](/security/mechanics).
+    Your secrets remain encrypted at rest following our [security guide mechanics](/internals/security).
 </Note>
 
 Now select **Production** for (the source) **Environment** and sync it to the **Production Environment** of the (target) application in Vercel.
@@ -238,7 +238,7 @@ At this stage, you know how to use the Infisical-Vercel integration to sync prod
     <Accordion title="Is opting out of end-to-end encryption for the Infisical-Vercel integration safe?">
         Yes. Your secrets are still encrypted at rest. To note, most secret managers actually don't support end-to-end encryption.
 
-        Check out the [security guide](/security/overview).
+        Check out the [security guide](/internals/security).
     </Accordion>
 </AccordionGroup>
 

docs/documentation/guides/organization-structure.mdx

@@ -75,7 +75,7 @@ Infisical’s access control framework is unified for both human users and machi
 
 ### 7.3 Attribute-Based Access Control (ABAC)
 
-[Attribute-based Access Controls](/documentation/platform/access-controls/attribute-based-access-controls) allow restrictions based on tags or attributes linked to secrets. These can be integrated with SAML assertions and other security frameworks for dynamic access management.
+[Attribute-based Access Controls](/documentation/platform/access-controls/abac/overview) allow restrictions based on tags or attributes linked to secrets. These can be integrated with SAML assertions and other security frameworks for dynamic access management.
 
 ### 7.4 User Groups
 

docs/documentation/platform/groups.mdx

@@ -31,7 +31,7 @@ In the following steps, we explore how to create and use user groups to provisio
         
         ![groups org](/images/platform/groups/groups-org.png)
 
-        When creating a group, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+        When creating a group, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
         
         ![groups org create](/images/platform/groups/groups-org-create.png)
         

docs/documentation/platform/identities/alicloud-auth.mdx

@@ -88,7 +88,7 @@ To create an identity, head to your Organization Settings > Access Control > [Id
 
 ![identities organization](/images/platform/identities/identities-org.png)
 
-When creating an identity, you specify an organization-level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
+When creating an identity, you specify an organization-level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
 
 ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/aws-auth.mdx

@@ -66,7 +66,7 @@ access the Infisical API using the AWS Auth authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/azure-auth.mdx

@@ -66,7 +66,7 @@ access the Infisical API using the Azure Auth authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/gcp-auth.mdx

@@ -72,7 +72,7 @@ access the Infisical API using the GCP ID Token authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 
@@ -241,7 +241,7 @@ access the Infisical API using the GCP IAM authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/jwt-auth.mdx

@@ -61,7 +61,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/kubernetes-auth.mdx

@@ -218,7 +218,7 @@ In the following steps, we explore how to create and use identities for your app
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oci-auth.mdx

@@ -102,7 +102,7 @@ To create an identity, head to your Organization Settings > Access Control > [Id
 
 ![identities organization](/images/platform/identities/identities-org.png)
 
-When creating an identity, you specify an organization-level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
+When creating an identity, you specify an organization-level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
 
 ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/azure.mdx

@@ -59,7 +59,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/circleci.mdx

@@ -56,7 +56,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/general.mdx

@@ -60,7 +60,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/github.mdx

@@ -59,7 +59,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/gitlab.mdx

@@ -59,7 +59,7 @@ In the following steps, we explore how to create and use identities to access th
         
         ![identities organization](/images/platform/identities/identities-org.png)
         
-        When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+        When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
         ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/oidc-auth/spire.mdx

@@ -94,7 +94,7 @@ In the following steps, we explore how to create and use identities to access th
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/tls-cert-auth.mdx

@@ -68,7 +68,7 @@ To create an identity, head to your Organization Settings > Access Control > [Id
 
 ![identities organization](/images/platform/identities/identities-org.png)
 
-When creating an identity, you specify an organization-level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
+When creating an identity, you specify an organization-level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > [Organization Roles](https://app.infisical.com/organization/access-management?selectedTab=roles).
 
 ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/token-auth.mdx

@@ -42,7 +42,7 @@ using the Token Auth authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/universal-auth.mdx

@@ -47,7 +47,7 @@ using the Universal Auth authentication method.
 
     ![identities organization](/images/platform/identities/identities-org.png)
 
-    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
     ![identities organization create](/images/platform/identities/identities-org-create.png)
 

docs/documentation/platform/identities/user-identities.mdx

@@ -7,7 +7,7 @@ description: "Read more about the concept of user identities in Infisical."
 
 A **user identity** (also known as **user**) represents a developer, admin, or any other human entity interacting with resources in Infisical.
 
-Users can be added manually (through Web UI) or programmatically (e.g., API) to [organizations](../organization) and [projects](../projects).
+Users can be added manually (through Web UI) or programmatically (e.g., API) to [organizations](../organization) and [projects](../project).
 
 Upon being added to an organization and projects, users assume a certain set of roles and permissions that represents their identity.
 

docs/documentation/platform/kms/overview.mdx

@@ -10,7 +10,7 @@ Infisical can be used as a Key Management System (KMS), referred to as Infisical
 
 By default your Infisical data such as projects and the data within them are encrypted at rest using Infisical's own KMS. This ensures that your data is secure and protected from unauthorized access.
 
-If you are on-premise, your KMS root key will be created at random with the `ROOT_ENCRYPTION_KEY` environment variable. You can also use a Hardware Security Module (HSM), to create the root key. Read more about [HSM](/docs/documentation/platform/kms/encryption-strategies). 
+If you are on-premise, your KMS root key will be created at random with the `ROOT_ENCRYPTION_KEY` environment variable. You can also use a Hardware Security Module (HSM), to create the root key. Read more about [HSM](/documentation/platform/kms/hsm-integration). 
 
 <Note>
   Keys managed in KMS are not extractable from the platform. Additionally, data
@@ -109,7 +109,7 @@ In the following steps, we explore how to generate a key and use it to encrypt d
             </Step>
             <Step title="Encrypting data with the KMS key">
                 To encrypt data, make an API request to the [Encrypt
-                Data](/api-reference/endpoints/kms/keys/encrypt) API endpoint,
+                Data](/api-reference/endpoints/kms/encryption/encrypt) API endpoint,
                 specifying the key to use.
 
                 <Note>
@@ -168,7 +168,7 @@ In the following steps, we explore how to use decrypt data using an existing key
         <Steps>
             <Step title="Decrypting data">
                 To decrypt data, make an API request to the [Decrypt
-                Data](/api-reference/endpoints/kms/keys/decrypt) API endpoint,
+                Data](/api-reference/endpoints/kms/encryption/decrypt) API endpoint,
                 specifying the key to use.
 
                 ### Sample request

docs/documentation/platform/pki/ca/acme-ca.mdx

@@ -255,7 +255,7 @@ In the following steps, we explore how to set up ACME Certificate Authority inte
         The issued certificate and private key are now available through Infisical and can be:
 
         - Downloaded directly from the Infisical UI
-        - Retrieved via the Infisical API for programmatic access using the [latest certificate bundle endpoint](/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle)
+        - Retrieved via the Infisical API for programmatic access using the [latest certificate bundle endpoint](/api-reference/endpoints/certificate-profiles/get-latest-active-bundle)
     </Step>
 
 </Steps>

docs/documentation/platform/pki/certificates.mdx

@@ -109,49 +109,126 @@ In the following steps, we explore how to issue a X.509 certificate under a CA.
 
     With certificate templates, you can specify, for example, that issued certificates must have a common name (CN) adhering to a specific format like .*.acme.com or perhaps that the max TTL cannot be more than 1 year.
 
-    To create a certificate template, make an API request to the [Create Certificate Template](/api-reference/endpoints/certificate-templates/create) API endpoint, specifying the issuing CA.
+    To create a certificate template, make an API request to the [Create Certificate Template](/api-reference/endpoints/certificate-templates-v2/create) API endpoint, specifying the issuing CA.
 
     ### Sample request
 
     ```bash Request
-    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \
+    curl --request POST \
+      --url https://us.infisical.com/api/v2/certificate-templates \
       --header 'Content-Type: application/json' \
-      --data-raw '{
+      --data '{
-          "caId": "<ca-id>",
+      "projectId": "<string>",
-          "name": "My Certificate Template",
+      "name": "<string>",
-          "commonName": ".*.acme.com",
+      "description": "<string>",
-          "subjectAlternativeName": ".*.acme.com",
+      "subject": [
-          "ttl": "1y",
+        {
-      }'
+          "type": "common_name",
+          "allowed": [
+            "*.infisical.com"
+          ]
+        }
+      ],
+      "sans": [
+        {
+          "type": "dns_name",
+          "allowed": [
+            "*.sample.com"
+          ]
+        }
+      ],
+      "keyUsages": {
+        "allowed": [
+          "digital_signature"
+        ]
+      },
+      "extendedKeyUsages": {
+        "allowed": [
+          "client_auth"
+        ]
+      },
+      "algorithms": {
+        "signature": [
+          "SHA256-RSA"
+        ],
+        "keyAlgorithm": [
+          "RSA-2048"
+        ]
+      },
+      "validity": {
+        "max": "365d"
+      }
+    }'
     ```
 
     ### Sample response
 
     ```bash Response
     {
-      id: "...",
+      "certificateTemplate": {
-      caId: "...",
+        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-      name: "...",
+        "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-      commonName: "...",
+        "name": "<string>",
-      subjectAlternativeName: "...",
+        "description": "<string>",
-      ttl: "...",
+          "subject": [
+            {
+              "type": "common_name",
+              "allowed": [
+                "*.infisical.com"
+              ]
+            }
+          ],
+        "sans": [
+          {
+            "type": "dns_name",
+            "allowed": [
+              "*.sample.com"
+            ]
+          }
+        ],
+        "keyUsages": {
+          "allowed": [
+            "digital_signature"
+          ]
+        },
+        "extendedKeyUsages": {
+          "allowed": [
+            "client_auth"
+          ]
+        },
+        "algorithms": {
+          "signature": [
+            "SHA256-RSA"
+          ],
+          "keyAlgorithm": [
+            "RSA-2048"
+          ]
+        },
+        "validity": {
+          "max": "365d"
+        },
+        "createdAt": "2023-11-07T05:31:56Z",
+        "updatedAt": "2023-11-07T05:31:56Z"
+      }
     }
     ```
 
   </Step>
   <Step title="Creating a certificate">
-    To create a certificate under the certificate template, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
+    To create a certificate under the certificate template, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-certificate) API endpoint,
     specifying the issuing CA.
     
     ### Sample request
 
     ```bash Request
-    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/issue-certificate' \
+    curl --location --request POST 'https://app.infisical.com/api/v3/pki/certificates/issue-certificate' \
       --header 'Content-Type: application/json' \
       --data-raw '{
-          "certificateTemplateId": "<certificate-template-id>",
+          "profileId": "<profile-id>",
           "commonName": "service.acme.com",
           "ttl": "1y",
+          "signatureAlgorithm": "RSA-SHA256",
+          "keyAlgorithm": "RSA_2048"
       }'
     ```
 
@@ -221,16 +298,16 @@ In the following steps, we explore how to revoke a X.509 certificate under a CA
     selecting the **Revoke Certificate** option for it and specifying the reason
     for revocation.
 
-    ![pki revoke certificate](/images/platform/pki/cert-revoke.png)
+    ![pki revoke certificate](/images/platform/pki/certificate/cert-revoke.png)
 
-    ![pki revoke certificate modal](/images/platform/pki/cert-revoke-modal.png)
+    ![pki revoke certificate modal](/images/platform/pki/certificate/cert-revoke-modal.png)
 
   </Step>
   <Step title="Obtaining a CRL">
     In order to check the revocation status of a certificate, you can check it
     against the CRL of a CA by heading to its Issuing CA and downloading the CRL.
 
-    ![pki view crl](/images/platform/pki/ca-crl.png)
+    ![pki view crl](/images/platform/pki/ca/ca-crl.png)
 
     To verify a certificate against the
     downloaded CRL with OpenSSL, you can use the following command:
@@ -254,7 +331,7 @@ openssl verify -verbose -crl_check -crl_download -CAfile chain.pem cert.pem
   <Tab title="API">
     <Steps>
       <Step title="Revoking a certificate">
-        Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificate-authorities/revoke) API endpoint,
+        Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificates/revoke) API endpoint,
         specifying the serial number of the certificate and the reason for revocation.
         
         ### Sample request
@@ -280,7 +357,7 @@ openssl verify -verbose -crl_check -crl_download -CAfile chain.pem cert.pem
       </Step>
       <Step title="Obtaining a CRL">
         In order to check the revocation status of a certificate, you can check it against the CRL of the issuing CA.
-        To obtain the CRLs of the CA, make an API request to the [List CRLs](/api-reference/endpoints/certificate-authorities/crls) API endpoint.
+        To obtain the CRLs of the CA, make an API request to the [List CRLs](/api-reference/endpoints/certificate-authorities/crl) API endpoint.
 
         ### Sample request
 

docs/documentation/platform/pki/certificates/certificates.mdx

@@ -206,7 +206,7 @@ openssl verify -verbose -crl_check -crl_download -CAfile chain.pem cert.pem
   <Tab title="API">
     <Steps>
       <Step title="Revoking a certificate">
-        Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificate-authorities/revoke) API endpoint,
+        Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificates/revoke) API endpoint,
         specifying the serial number of the certificate and the reason for revocation.
         
         ### Sample request
@@ -232,7 +232,7 @@ openssl verify -verbose -crl_check -crl_download -CAfile chain.pem cert.pem
       </Step>
       <Step title="Obtaining a CRL">
         In order to check the revocation status of a certificate, you can check it against the CRL of the issuing CA.
-        To obtain the CRLs of the CA, make an API request to the [List CRLs](/api-reference/endpoints/certificate-authorities/crls) API endpoint.
+        To obtain the CRLs of the CA, make an API request to the [List CRLs](/api-reference/endpoints/certificate-authorities/crl) API endpoint.
 
         ### Sample request
 

docs/documentation/platform/pki/certificates/overview.mdx

@@ -12,4 +12,4 @@ There are three components to understand:
 
 - [Certificate Template](/documentation/platform/pki/certificates/templates): A policy structure specifying the permitted attributes for requested certificates including subject naming conventions, SAN fields, key usages, and extended key usages.
 
-- [Certificate](/documentation/platform/pki/certificates/certificate): The actual X.509 certificate issued for a profile. Once issued, a certificate kept track of in the certificate inventory.
+- [Certificate](/documentation/platform/pki/certificates/certificates): The actual X.509 certificate issued for a profile. Once issued, a certificate kept track of in the certificate inventory.

docs/documentation/platform/pki/enrollment-methods/api.mdx

@@ -56,7 +56,7 @@ Here, select the certificate profile from step 1 that will be used to issue the
 <Steps>
   <Step title="Create a certificate profile">
 
-    To create a certificate [profile](/documentation/platform/pki/certificates/profiles), make an API request to the [Create Certificate Profile](/docs/api-reference/endpoints/certificate-profiles/create) API endpoint.
+    To create a certificate [profile](/documentation/platform/pki/certificates/profiles), make an API request to the [Create Certificate Profile](/api-reference/endpoints/certificate-profiles/create) API endpoint.
 
     ### Sample request
 

docs/documentation/platform/pki/est.mdx

@@ -1,59 +0,0 @@
----
-title: "Enrollment over Secure Transport (EST)"
-sidebarTitle: "Enrollment over Secure Transport (EST)"
-description: "Learn how to manage certificate enrollment of clients using EST"
----
-
-## Concept
-
-Enrollment over Secure Transport (EST) is a protocol used to automate the secure provisioning of digital certificates for devices and applications over a secure HTTPS connection. It is primarily used when a client device needs to obtain or renew a certificate from a Certificate Authority (CA) on Infisical in a secure and standardized manner. EST is commonly employed in environments requiring strong authentication and encrypted communication, such as in IoT, enterprise networks, and secure web services.
-
-Infisical's EST service is based on [RFC 7030](https://datatracker.ietf.org/doc/html/rfc7030) and implements the following endpoints:
-
-- **cacerts** - provides the necessary CA chain for the client to validate certificates issued by the CA.
-- **simpleenroll** - allows an EST client to request a new certificate from Infisical's EST server
-- **simplereenroll** - similar to the /simpleenroll endpoint but is used for renewing an existing certificate.
-
-These endpoints are exposed on port 8443 under the .well-known/est path e.g.
-`https://app.infisical.com:8443/.well-known/est/estLabel/cacerts`
-
-## Prerequisites
-
-- You need to have an existing [CA hierarchy](/documentation/platform/pki/private-ca).
-- The client devices need to have a bootstrap/pre-installed certificate.
-- The client devices must trust the server certificates used by Infisical's EST server. If the devices are new or lack existing trust configurations, you need to manually establish trust for the appropriate certificates.
-  - For Infisical Cloud users, the devices must be configured to trust the [Amazon root CA certificates](https://www.amazontrust.com/repository).
-
-## Guide to configuring EST
-
-1. Set up a certificate template with your selected issuing CA. This template will define the policies and parameters for certificates issued through EST. For detailed instructions on configuring a certificate template, refer to the certificate templates [documentation](/documentation/platform/pki/certificates#guide-to-issuing-certificates).
-
-2. Proceed to the certificate template's enrollment settings
-   ![est enrollment dashboard](/images/platform/pki/est/template-enroll-hover.png)
-
-3. Select **EST** as the client enrollment method and fill up the remaining fields.
-
-   ![est enrollment modal create](/images/platform/pki/est/template-enrollment-modal.png)
-
-   - **Disable Bootstrap Certificate Validation** - Enable this if your devices are not configured with a bootstrap certificate.
-   - **Certificate Authority Chain** - This is the certificate chain used to validate your devices' manufacturing/pre-installed certificates. This will be used to authenticate your devices with Infisical's EST server.
-   - **Passphrase** - This is also used to authenticate your devices with Infisical's EST server. When configuring the clients, use the value defined here as the EST password.
-
-   For security reasons, Infisical authenticates EST clients using both client certificate and passphrase.
-
-4. Once the configuration of enrollment options is completed, a new **EST Label** field appears in the enrollment settings. This is the value to use as label in the URL when configuring the connection of EST clients to Infisical.
-   ![est enrollment modal create](/images/platform/pki/est/template-enrollment-est-label.png)
-
-   The complete URL of the supported EST endpoints will look like the following:
-
-   - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/cacerts
-   - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simpleenroll
-   - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simplereenroll
-
-## Setting up EST clients
-
-- To use the EST passphrase in your clients, configure it as the EST password. The EST username can be set to any arbitrary value.
-- Use the appropriate client certificates for invoking the EST endpoints.
-  - For `simpleenroll`, use the bootstrapped/manufacturer client certificate.
-  - For `simplereenroll`, use a valid EST-issued client certificate.
-- When configuring the PKCS#12 objects for the client certificates, only include the leaf certificate and the private key.

docs/documentation/platform/project-templates.mdx

@@ -106,13 +106,14 @@ In the following steps, we'll explore how to use a project template when creatin
         Your project will be provisioned with the configured template roles and environments.
     </Tab>
     <Tab title="API">
-        To use a project template, make an API request to the [Create Project](/api-reference/endpoints/workspaces/create-workspace) API endpoint with the specified template name included.
+        To use a project template, make an API request to the [Create Project](/api-reference/endpoints/projects/create-project) API endpoint with the specified template name included.
 
         ### Sample request
 
         ```bash Request
         curl --request POST \
-        --url https://app.infisical.com/api/v2/workspace \
+        --url https://app.infisical.com/api/v1/projects \
+        --header 'Authorization: Bearer <token>' \
         --header 'Content-Type: application/json' \
         --data '{
             "projectName": "My Project",

docs/documentation/platform/secret-rotation/overview.mdx

@@ -98,8 +98,8 @@ Using a __30-Day__ rotation interval as an example, here's how the process unfol
 
 ## Infisical Secret Rotation Strategies
 
-- [PostgreSQL Credentials](./postgres)
+- [PostgreSQL Credentials](./postgres-credentials)
-- [Microsoft SQL Server Credentials](./mssql)
+- [Microsoft SQL Server Credentials](./mssql-credentials)
 
 ## FAQ
 

docs/documentation/platform/secrets-mgmt/project.mdx

@@ -16,7 +16,7 @@ customized depending on the intended use case.
 
 ## Secrets Overview
 
-The **Secrets Overview** page captures a birds-eye-view of secrets and [folders](./folder) across environments.
+The **Secrets Overview** page captures a birds-eye-view of secrets and [folders](/documentation/platform/folder) across environments.
 This is useful for comparing secrets, identifying if anything is missing, and making quick changes.
 
 ![project secrets overview](/images/platform/project/project-secrets-overview-open.png)

docs/documentation/platform/ssh/concepts/ssh-certificates.mdx

@@ -21,6 +21,6 @@ Because certificates are time-bound and centrally managed, they’re easier to a
 
 Infisical SSH gives you a secure, scalable way to manage infrastructure access using SSH certificates — without the overhead of running your own certificate authority, wiring trust across hosts, or building issuance workflows from scratch.
 
-It replaces long-lived SSH keys with short-lived, identity-bound certificates and handles all the moving parts for you: operating CAs, configuring trust between users and hosts, and issuing certificates on demand. With Infisical SSH, you can register a host with [`infisical ssh add-host`](/docs/cli/commands/ssh#infisical-ssh-add-host), then connect with [`infisical ssh connect`](/docs/cli/commands/ssh#infisical-ssh-connect) — that’s all it takes.
+It replaces long-lived SSH keys with short-lived, identity-bound certificates and handles all the moving parts for you: operating CAs, configuring trust between users and hosts, and issuing certificates on demand. With Infisical SSH, you can register a host with [`infisical ssh add-host`](/cli/commands/ssh#infisical-ssh-add-host), then connect with [`infisical ssh connect`](/cli/commands/ssh#infisical-ssh-connect) — that’s all it takes.
 
 The result is centralized, auditable SSH access that’s easy to use and built to scale with your infrastructure.

docs/documentation/platform/sso/general-oidc/overview.mdx

@@ -77,7 +77,7 @@ Prerequisites:
   </Steps>
 
 <Tip>
-    If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login.
+    If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](/documentation/platform/admin-panel/server-admin#default-organization) to expedite OIDC login.
 </Tip>
 
 

docs/documentation/platform/sso/keycloak-oidc/overview.mdx

@@ -103,7 +103,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO."
 </Steps>
 
 <Tip>
-    If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login.
+    If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](/documentation/platform/admin-panel/server-admin#default-organization) to expedite OIDC login.
 </Tip>
 
 <Note>

docs/integrations/platforms/docker-swarm-with-agent.mdx

@@ -4,7 +4,7 @@ description: "Learn how to manage secrets in Docker Swarm services."
 ---
 
 In this guide, we'll demonstrate how to use Infisical for managing secrets within Docker Swarm. 
-Specifically, we'll set up a sidecar container using the [Infisical Agent](/infisical-agent/overview), which authenticates with Infisical to retrieve secrets and access tokens. 
+Specifically, we'll set up a sidecar container using the [Infisical Agent](/integrations/platforms/infisical-agent), which authenticates with Infisical to retrieve secrets and access tokens. 
 These secrets are then stored in a shared volume accessible by other services in your Docker Swarm.
 
 ## Prerequisites
@@ -12,7 +12,7 @@ These secrets are then stored in a shared volume accessible by other services in
 - Docker version 20.10.24 or newer
 - Basic knowledge of Docker Swarm
 - [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) installed on your system
-- Familiarity with the [Infisical Agent](/infisical-agent/overview)
+- Familiarity with the [Infisical Agent](/integrations/platforms/infisical-agent)
 
 ## Objective
 Our goal is to deploy an Nginx instance in your Docker Swarm cluster, configured to display Infisical secrets on its landing page. This will provide hands-on experience in fetching and utilizing secrets from Infisical within Docker Swarm. The principles demonstrated here are also applicable to Docker Compose deployments.

docs/integrations/platforms/ecs-with-agent.mdx

@@ -7,7 +7,7 @@ description: "Learn how to deliver secrets to Amazon Elastic Container Service."
 
 This guide will go over the steps needed to access secrets stored in Infisical from Amazon Elastic Container Service (ECS).
 
-At a high level, the steps involve setting up an ECS task with an [Infisical Agent](/infisical-agent/overview) as a sidecar container. This sidecar container uses [AWS Auth](/documentation/platform/identities/aws-auth) to authenticate with Infisical to fetch secrets/access tokens.
+At a high level, the steps involve setting up an ECS task with an [Infisical Agent](/integrations/platforms/infisical-agent) as a sidecar container. This sidecar container uses [AWS Auth](/documentation/platform/identities/aws-auth) to authenticate with Infisical to fetch secrets/access tokens.
 Once the secrets/access tokens are retrieved, they are then stored in a shared [Amazon Elastic File System](https://aws.amazon.com/efs/) (EFS) volume. This volume is then made accessible to your application and all of its replicas.
 
 This guide primarily focuses on integrating Infisical Cloud with Amazon ECS on AWS Fargate and Amazon EFS.
@@ -21,7 +21,7 @@ This guide requires the following prerequisites:
 - Git installed
 - Terraform v1.0 or later installed
 - Access to AWS credentials
-- Understanding of [Infisical Agent](/infisical-agent/overview)
+- Understanding of [Infisical Agent](/integrations/platforms/infisical-agent)
 
 ## What we will deploy
 

docs/integrations/platforms/kubernetes/infisical-dynamic-secret-crd.mdx

@@ -19,7 +19,7 @@ This CRD offers the following features:
 ### Prerequisites
 
 - A project within Infisical.
-- A [machine identity](/docs/documentation/platform/identities/overview) ready for use in Infisical that has permissions to create dynamic secret leases in the project.
+- A [machine identity](/documentation/platform/identities/machine-identities) ready for use in Infisical that has permissions to create dynamic secret leases in the project.
 - You have already configured a dynamic secret in Infisical.
 - The operator is installed on to your Kubernetes cluster.
 

docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx

@@ -17,7 +17,7 @@ This CRD offers the following features:
 ### Prerequisites
 
 - A project within Infisical.
-- A [machine identity](/docs/documentation/platform/identities/overview) ready for use in Infisical that has permissions to create secrets in your project.
+- A [machine identity](/documentation/platform/identities/machine-identities) ready for use in Infisical that has permissions to create secrets in your project.
 - The operator is installed on to your Kubernetes cluster.
 
 ## Example usage

docs/integrations/platforms/kubernetes/infisical-secret-crd.mdx

@@ -256,7 +256,7 @@ spec:
 
           ![identities organization](/images/platform/identities/identities-org.png)
 
-          When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+          When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
           ![identities organization create](/images/platform/identities/identities-org-create.png)
 
@@ -432,7 +432,7 @@ spec:
 
           ![identities organization](/images/platform/identities/identities-org.png)
 
-          When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+          When creating an identity, you specify an organization level [role](/documentation/platform/access-controls/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
 
           ![identities organization create](/images/platform/identities/identities-org-create.png)
 
@@ -803,7 +803,7 @@ Follow the instructions below to create and store the service token in a Kuberne
 
 #### 1. Generate service token
 
-You can generate a [service token](../../documentation/platform/token) for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
+You can generate a [service token](/documentation/platform/token) for an Infisical project by heading over to the Infisical dashboard then to Project Settings.
 
 #### 2. Create Kubernetes secret containing service token
 

docs/integrations/secret-syncs/digital-ocean-app-platform.mdx

@@ -77,7 +77,7 @@ description: "Learn how to configure a DigitalOcean App Platform Sync for Infisi
     </Tab>
     
     <Tab title="API">
-        To create a **DigitalOcean App Platform Sync**, make an API request to the [Create DigitalOcean Sync](/api-reference/endpoints/secret-syncs/digital-ocean/create) API endpoint.
+        To create a **DigitalOcean App Platform Sync**, make an API request to the [Create DigitalOcean Sync](/api-reference/endpoints/secret-syncs/digital-ocean-app-platform/create) API endpoint.
 
         ### Sample request
 

docs/internals/overview.mdx

@@ -15,7 +15,7 @@ This section covers the internals of Infisical including its technical underpinn
 
 <CardGroup cols={2}>
   <Card
-    href="./components"
+    href="./architecture/components"
     title="Components"
     icon="boxes-stacked"
     color="#000000"

docs/internals/permissions/overview.mdx

@@ -85,5 +85,5 @@ The following operators are available for conditions:
 | `$in`    | Matches any value in array         | `{ environment: { $in: ["staging", "production"] } }` |
 | `$glob`  | Pattern matching using glob syntax | `{ secretPath: { $glob: "/app/\*" } }`                |
 
-These details are especially useful if you're using the API to [create new project roles](../api-reference/endpoints/project-roles/create).
+These details are especially useful if you're using the API to [create new project roles](/api-reference/endpoints/project-roles/create).
 The rules outlined on this page, also apply when using our Terraform Provider to manage your Infisical project roles, or any other of our clients that manage project roles.

docs/sdks/languages/go.mdx

@@ -56,7 +56,7 @@ This example demonstrates how to use the Infisical Go SDK in a simple Go applica
 
 <Warning>
   We do not recommend hardcoding your [Machine Identity
-  Tokens](/platform/identities/overview). Setting it as an environment variable
+  Tokens](/documentation/platform/identities/machine-identities). Setting it as an environment variable
   would be best.
 </Warning>
 

docs/sdks/languages/ruby.mdx

@@ -36,7 +36,7 @@ puts "Secret: #{single_test_secret}"
 This example demonstrates how to use the Infisical Ruby SDK in a simple Ruby application. The application retrieves a secret named `API_KEY` from the `dev` environment of the `YOUR_PROJECT_ID` project.
 
 <Warning>
-    We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
+    We do not recommend hardcoding your [Machine Identity Tokens](/documentation/platform/identities/machine-identities). Setting it as an environment variable would be best.
 </Warning>
 
 # Installation

docs/self-hosting/deployment-options/native/standalone-binary.mdx

@@ -1,202 +0,0 @@
----
-title: "Standalone"
-description: "Learn how to deploy Infisical in a standalone environment."
----
-
-# Self-Hosting Infisical with Standalone Infisical
-
-Deploying Infisical in a standalone environment is a great way to get started with Infisical without having to use containers. This guide will walk you through the process of deploying Infisical in a standalone environment.
-This is one of the easiest ways to deploy Infisical. It is a single executable, currently only supported on Debian-based systems.
-
-The standalone deployment implements the "bring your own database" (BYOD) approach. This means that you will need to provide your own databases (specifically Postgres and Redis) for the Infisical services to use. The standalone deployment does not include any databases.
-
-If you wish to streamline the deployment process, we recommend using the Ansible role for Infisical. The Ansible role automates the end to end deployment process, and will take care of everything like databases, redis deployment, web serving, and availability.
-- [Automated Deployment with high availability (HA)](/self-hosting/deployment-options/native/high-availability)
-
-
-## Prerequisites
-- A server running a Debian-based operating system (e.g., Ubuntu, Debian)
-- A Postgres database
-- A Redis database
-
-## Installing Infisical
-Installing Infisical is as simple as running a single command. You can install Infisical by running the following command:
-
-```bash
-  $ curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-core/cfg/setup/bash.deb.sh' | sudo bash && sudo apt-get install -y infisical-core
-```
-
-## Running Infisical
-Running Infisical and serving it to the web has a few steps. Below are the steps to get you started with running Infisical in a standalone environment.
-  * Setup environment variables
-  * Running Postgres migrations
-  * Create system daemon
-  * Exposing Infisical to the internet
-
-
-<Steps>
-  <Step title="Setup environment variables">
-    To use Infisical you'll need to configure the environment variables beforehand. You can acheive this by creating an environment file to be used by Infisical.
-
-
-    #### Create environment file
-    ```bash
-      $ mkdir -p /etc/infisical && touch /etc/infisical/environment
-    ```
-
-    After creating the environment file, you'll need to fill it out with your environment variables.
-
-    #### Edit environment file
-    ```bash
-      $ nano /etc/infisical/environment
-    ```
-
-    ```bash
-      DB_CONNECTION_URI=postgres://user:password@localhost:5432/infisical # Replace with your Postgres database connection URI
-      REDIS_URL=redis://localhost:6379 # Replace with your Redis connection URI
-      ENCRYPTION_KEY=your_encryption_key # Replace with your encryption key (can be generated with: openssl rand -hex 16)
-      AUTH_SECRET=your_auth_secret # Replace with your auth secret (can be generated with: openssl rand -base64 32)
-    ```
-
-    <Info>
-    The minimum required environment variables are `DB_CONNECTION_URI`, `REDIS_URL`, `ENCRYPTION_KEY`, and `AUTH_SECRET`. We recommend You take a look at our [list of all available environment variables](/docs/self-hosting/configuration/envars#general-platform), and configure the ones you need.
-    </Info>
-  </Step>
-  <Step title="Running Postgres migrations">
-
-    Assuming you're starting with a fresh Postgres database, you'll need to run the Postgres migrations to syncronize the database schema.
-    The migration command will use the environment variables you configured in the previous step.
-
-
-    ```bash
-      $ eval $(cat /etc/infisical/environment) infisical-core migration:latest
-    ```
-
-    <Info>
-      This step will need to be repeated if you update Infisical in the future.
-    </Info>
-
-  </Step>
-
-  <Step title="Create service file">
-    ```bash
-      $ nano /etc/systemd/system/infisical.service
-    ```
-  </Step>
-  <Step title="Create Infisical service">
-
-    Create a systemd service file for Infisical. Creating a systemd service file will allow Infisical to start automatically when the system boots or in case of a crash.
-
-    ```bash
-      $ nano /etc/systemd/system/infisical.service
-    ```
-
-    ```ini
-      [Unit]
-      Description=Infisical Service
-      After=network.target
-
-      [Service]
-      # The path to the environment file we created in the previous step
-      EnvironmentFile=/etc/infisical/environment
-      Type=simple
-      # Change the user to the user you want to run Infisical as
-      User=root
-      ExecStart=/usr/local/bin/infisical-core
-      Restart=always
-      RestartSec=30
-
-      [Install]
-      WantedBy=multi-user.target
-    ```
-
-    Now we need to reload the systemd daemon and start the Infisical service.
-
-    ```bash
-      $ systemctl daemon-reload
-      $ systemctl start infisical
-      $ systemctl enable infisical
-    ```
-
-    <Info>
-      You can check the status of the Infisical service by running `systemctl status infisical`.
-      It is also a good idea to check the logs for any errors by running `journalctl --no-pager -u infisical`.
-    </Info>
-  </Step>
-  <Step title="Exposing Infisical to the internet">
-    Exposing Infisical to the internet requires setting up a reverse proxy. You can use any reverse proxy of your choice, but we recommend using HAProxy or Nginx. Below is an example of how to set up a reverse proxy using HAProxy.
-
-    #### Install HAProxy
-    ```bash
-      $ apt-get install -y haproxy
-    ```
-
-    #### Edit HAProxy configuration
-    ```bash
-      $ nano /etc/haproxy/haproxy.cfg
-    ```
-
-    ```ini
-      global
-          log /dev/log local0
-          log /dev/log local1 notice
-          chroot /var/lib/haproxy
-          stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
-          stats timeout 30s
-          user haproxy
-          group haproxy
-          daemon
-
-      defaults
-          log global
-          mode http
-          option httplog
-          option dontlognull
-          timeout connect 5000
-          timeout client  50000
-          timeout server  50000
-
-      frontend http-in
-          bind *:80
-          default_backend infisical
-
-      backend infisical
-          server infisicalapp 127.0.0.1:8080 check
-    ```
-
-    <Warning>
-      If you decide to use Nginx, then please be aware that the configuration will be different. **Infisical listens on port 8080**.
-    </Warning>
-
-    #### Restart HAProxy
-    ```bash
-      $ systemctl restart haproxy
-    ```
-
-  </Step>
-</Steps>
-
-And that's it! You have successfully deployed Infisical in a standalone environment. You can now access Infisical by visiting `http://your-server-ip`.
-
-<Note>
-  Please take note that the Infisical team cannot provide infrastructure support for **free self-hosted** deployments.<br/>If you need help with infrastructure, we recommend upgrading to a [paid plan](https://infisical.com/pricing) which includes infrastructure support.
-
-  You can also join our community [Slack](https://infisical.com/slack) for help and support from the community. 
-</Note>
-
-## Troubleshooting
-
-<Accordion title="I'm getting a error related to the HAProxy (Missing LF on last line, file might have been truncated at position X)">
-  This is a common issue related to the HAProxy configuration file. The error is caused by the missing newline character at the end of the file. You can fix this by adding a newline character at the end of the file.
-
-  ```bash
-    $ echo "" >> /etc/haproxy/haproxy.cfg
-  ```
-</Accordion>
-<Accordion title="I'm unable to connect to access the Infisical instance on the web">
-  This issue can be caused by a number of reasons, mostly realted to  the network configuration. Here are a few things you can check:
-  1. Ensure that the firewall is not blocking the connection. You can check this by running `ufw status`. Ensure that port 80 is open.
-  2. If you're using a cloud provider like AWS or GCP, ensure that the security group allows traffic on port 80.
-  3. Ensure that the HAProxy service is running. You can check this by running `systemctl status haproxy`.
-  4. Ensure that the Infisical service is running. You can check this by running `systemctl status infisical`.
-</Accordion>

docs/self-hosting/overview.mdx

@@ -11,7 +11,7 @@ Choose from a number of deployment options listed below to get started.
   title="Docker"
   color="#000000"
   icon="docker"
-  href="deployment-options/standalone-infisical"
+  href="./deployment-options/standalone-infisical"
 >
   Use the fully packaged docker image to deploy Infisical anywhere.
 </Card>
@@ -20,7 +20,7 @@ Choose from a number of deployment options listed below to get started.
     title="Docker Compose"
     color="#000000"
     icon="docker"
-    href="deployment-options/docker-compose"
+    href="./deployment-options/docker-compose"
   >
     Install Infisical using our Docker Compose template.
   </Card>
@@ -28,7 +28,7 @@ Choose from a number of deployment options listed below to get started.
     title="Kubernetes"
     color="#000000"
     icon="gear-complex-code"
-    href="deployment-options/kubernetes-helm"
+    href="./deployment-options/kubernetes-helm"
   >
   Use our Helm chart to Install Infisical on your Kubernetes cluster.
   </Card>
@@ -36,7 +36,7 @@ Choose from a number of deployment options listed below to get started.
 <Card
     title="Linux package"
     color="#000000"
-    href="deployment-options/native/linux-package/installation"
+    href="./deployment-options/native/linux-package/installation"
   >
     Install Infisical on your system without containers using our Linux package.
 </Card>