doc: added guide for production hardening

2026-10-07 12:27:28 +00:00 · 2025-06-17 03:20:11 +08:00
parent 9b13619efa
commit d7dfc531fc
1 changed files with 551 additions and 0 deletions
@@ -0,0 +1,551 @@
 ---
 title: "Production Hardening"
 description: "Security hardening recommendations for production Infisical deployments"
 ---
 This document provides specific security hardening recommendations for production Infisical deployments. These recommendations follow Infisical's security model and focus on defense in depth.
 Choose your deployment method below and follow the recommendations for your specific setup. Start with **Universal Security Fundamentals** that apply to all deployments, then follow your deployment-specific section.
 ## Universal Security Fundamentals
 These security configurations apply to **all** Infisical deployments regardless of how you deploy.
 **Configure secure encryption keys**. Generate strong cryptographic keys:
 ```bash
 # Required - Generate secure encryption key
 ENCRYPTION_KEY=$(openssl rand -hex 16)
 # Required - Generate secure auth secret
 AUTH_SECRET=$(openssl rand -base64 32)
 ```
 **Use end-to-end TLS**. Configure HTTPS and secure database connections:
 ```bash
 # Enable HTTPS (recommended for production)
 HTTPS_ENABLED=true
 # Secure PostgreSQL connection with SSL
 DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
 # For base64-encoded SSL certificate
 DB_ROOT_CERT="<base64-encoded-certificate>"
 ```
 **Secure Redis configuration**. Use authentication and TLS for Redis:
 ```bash
 # Redis with TLS (if supported by your Redis deployment)
 REDIS_URL="rediss://user:password@redis:6380"
 # Redis Sentinel configuration for high availability
 REDIS_SENTINEL_HOSTS="192.168.65.254:26379,192.168.65.254:26380"
 REDIS_SENTINEL_MASTER_NAME="mymaster"
 REDIS_SENTINEL_ENABLE_TLS=true
 REDIS_SENTINEL_USERNAME="sentinel_user"
 REDIS_SENTINEL_PASSWORD="sentinel_password"
 ```
 **Restrict CORS origins**. Configure specific allowed origins:
 ```bash
 # Limit CORS to specific domains
 CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
 ```
 **Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:
 ```bash
 # Prevent connections to internal/private IP addresses
 # This blocks access to internal services like metadata endpoints,
 # internal APIs, databases, and other sensitive infrastructure
 ALLOW_INTERNAL_IP_CONNECTIONS=false
 ```
 **Configure SMTP securely**. Use TLS for email communications:
 ```bash
 # SMTP with TLS
 SMTP_HOST="smtp.example.com"
 SMTP_PORT="587"
 SMTP_USERNAME="your-smtp-user"
 SMTP_PASSWORD="your-smtp-password"
 SMTP_REQUIRE_TLS=true
 SMTP_IGNORE_TLS=false
 SMTP_FROM_ADDRESS="[email protected]"
 SMTP_FROM_NAME="Infisical"
 ```
 **Set proper site URL**. Configure the absolute URL for your Infisical instance:
 ```bash
 # Required - Must be absolute URL with protocol
 SITE_URL="https://app.infisical.com"
 ```
 **Configure database read replicas**. For high availability PostgreSQL setups:
 ```bash
 # Read replica configuration (JSON format)
 DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
 ```
 **Configure short token lifetimes**. Minimize exposure window for compromised tokens:
 ```bash
 # JWT token configuration (adjust based on security requirements)
 JWT_AUTH_LIFETIME=15m        # Authentication tokens
 JWT_REFRESH_LIFETIME=24h     # Refresh tokens
 JWT_SERVICE_LIFETIME=1h      # Service tokens
 ```
 **Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:
 ```bash
 # Optional - Disable telemetry (enabled by default)
 TELEMETRY_ENABLED=false
 ```
 **Establish user off-boarding procedures**. Remove access promptly when users leave:
 1. Remove user from organization
 2. Revoke active service tokens
 3. Remove from external identity providers
 4. Audit access logs for the user's activity
 5. Rotate any shared secrets the user had access to
 **Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method:
 - **Required ports**: Infisical API (8080) and HTTPS (if applicable)
 - **Database access**: Restrict PostgreSQL and Redis to authorized sources only
 - **Principle**: Default deny incoming, allow only required traffic
 - **Implementation**: See your deployment-specific section below for exact configuration
 **Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.
 ## Docker Deployment Hardening
 These recommendations are specific to Docker deployments of Infisical.
 **Use read-only root filesystems**. Prevent runtime modifications:
 ```bash
 # Run with read-only filesystem
 docker run --read-only --tmpfs /tmp infisical/infisical:latest
 ```
 **Drop unnecessary capabilities**. Remove all Linux capabilities:
 ```bash
 # Drop all capabilities
 docker run --cap-drop=ALL infisical/infisical:latest
 ```
 **Set resource limits**. Prevent resource exhaustion attacks:
 ```bash
 # Set memory and CPU limits
 docker run --memory=1g --cpus=0.5 infisical/infisical:latest
 ```
 **Use specific image tags**. Never use `latest` tags in production:
 ```bash
 # Use specific version tags
 docker run infisical/infisical:v0.93.1-postgres
 ```
 **Configure health checks**. Set up Docker health checks:
 ```dockerfile
 # In Dockerfile or docker-compose.yml
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:8080/api/status || exit 1
 ```
 **Host firewall configuration**. Configure host-level firewall for Docker deployments:
 ```bash
 # Docker manages its own iptables rules, but configure host firewall
 sudo ufw default deny incoming
 sudo ufw default allow outgoing
 # Allow Docker-mapped ports (adjust based on your port mapping)
 sudo ufw allow 8080/tcp  # If mapping container 8080 to host 8080
 sudo ufw allow 443/tcp   # If terminating HTTPS at host level
 # Enable firewall
 sudo ufw --force enable
 # Verify Docker iptables integration
 sudo iptables -L DOCKER
 ```
 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.
 ## Kubernetes Deployment Hardening
 These recommendations are specific to Kubernetes deployments of Infisical.
 **Use Pod Security Standards**. Apply restricted security profile:
 ```yaml
 # Namespace-level Pod Security Standards
 apiVersion: v1
 kind: Namespace
 metadata:
  name: infisical
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
 ```
 **Configure security context**. Set comprehensive security context:
 ```yaml
 # Deployment security context
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: infisical
 spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: infisical
          image: infisical/infisical:v0.93.1-postgres
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 1001
            capabilities:
              drop:
                - ALL
          resources:
            limits:
              memory: 1000Mi
              cpu: 500m
            requests:
              cpu: 350m
              memory: 512Mi
 ```
 **Configure network policies**. Restrict pod-to-pod communication:
 ```yaml
 # Example Kubernetes NetworkPolicy
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: infisical-netpol
  namespace: infisical
 spec:
  podSelector:
    matchLabels:
      app: infisical
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-system
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - podSelector:
            matchLabels:
              app: redis
      ports:
        - protocol: TCP
          port: 6379
 ```
 **Use dedicated service accounts**. Create service accounts with minimal permissions:
 ```yaml
 # Service account configuration
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: infisical
  namespace: infisical
 automountServiceAccountToken: false
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: infisical
 spec:
  template:
    spec:
      serviceAccountName: infisical
 ```
 **Configure ingress with TLS**. Set up secure ingress:
 ```yaml
 # Secure ingress configuration
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: infisical-ingress
  namespace: infisical
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
  ingressClassName: nginx
  tls:
    - secretName: infisical-tls
      hosts:
        - app.example.com
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: infisical
                port:
                  number: 8080
 ```
 **Use Kubernetes secrets**. Store sensitive configuration securely:
 ```yaml
 # Kubernetes secret for environment variables
 apiVersion: v1
 kind: Secret
 metadata:
  name: infisical-secrets
  namespace: infisical
 type: Opaque
 stringData:
  AUTH_SECRET: "<generate-with-openssl-rand-base64-32>"
  ENCRYPTION_KEY: "<generate-with-openssl-rand-hex-16>"
  DB_CONNECTION_URI: "<your-postgres-connection-string>"
  REDIS_URL: "<your-redis-connection-string>"
  SITE_URL: "<your-site-url>"
 ```
 **Set up health checks**. Configure readiness and liveness probes:
 ```yaml
 # Health check configuration
 containers:
  - name: infisical
    readinessProbe:
      httpGet:
        path: /api/status
        port: 8080
      initialDelaySeconds: 10
      periodSeconds: 5
    livenessProbe:
      httpGet:
        path: /api/status
        port: 8080
      initialDelaySeconds: 30
      periodSeconds: 10
 ```
 **Use managed databases**. For production deployments, use managed PostgreSQL and Redis services instead of in-cluster instances.
 **Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:
 ```bash
 # Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
 # Allow ingress from load balancer to NodePort/ClusterIP service
 # Allow egress to managed databases
 # Block all other traffic
 # For on-premises, ensure node-level firewalls allow:
 # - Ingress traffic from ingress controllers
 # - Egress traffic to external services (databases, SMTP)
 ```
 **Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.
 ## Linux Binary Deployment Hardening
 These recommendations are specific to Linux binary deployments of Infisical.
 **Create dedicated user account**. Run Infisical under a dedicated service account:
 ```bash
 # Create dedicated user
 sudo useradd --system --shell /bin/false --home-dir /opt/infisical infisical
 # Create application directory
 sudo mkdir -p /opt/infisical
 sudo chown infisical:infisical /opt/infisical
 ```
 **Configure systemd service**. Create a secure systemd service:
 ```ini
 # /etc/systemd/system/infisical.service
 [Unit]
 Description=Infisical Secret Management
 After=network.target
 [Service]
 Type=simple
 # IMPORTANT: Change from default 'root' user to dedicated service account
 User=infisical
 Group=infisical
 WorkingDirectory=/opt/infisical
 ExecStart=/opt/infisical/infisical-linux-amd64
 Restart=always
 RestartSec=10
 # Security settings
 NoNewPrivileges=true
 ProtectSystem=strict
 ProtectHome=true
 ReadWritePaths=/opt/infisical
 PrivateTmp=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
 LimitCORE=0
 MemorySwapMax=0
 # Environment file
 EnvironmentFile=/etc/infisical/environment
 [Install]
 WantedBy=multi-user.target
 ```
 **Secure environment configuration**. Store environment variables securely:
 ```bash
 # Create secure config directory
 sudo mkdir -p /etc/infisical
 sudo chmod 750 /etc/infisical
 sudo chown root:infisical /etc/infisical
 # Create environment file
 sudo touch /etc/infisical/environment
 sudo chmod 640 /etc/infisical/environment
 sudo chown root:infisical /etc/infisical/environment
 ```
 **Disable memory swapping**. Prevent sensitive data from being written to disk:
 ```bash
 # Disable swap immediately
 sudo swapoff -a
 # Disable swap permanently (comment out swap entries)
 sudo sed -i '/swap/d' /etc/fstab
 ```
 **Disable core dumps**. Prevent potential exposure of encryption keys:
 ```bash
 # Set system-wide core dump limits
 echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
 # Disable core dumps for current session
 ulimit -c 0
 ```
 **Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:
 ```bash
 # Configure UFW firewall
 sudo ufw default deny incoming
 sudo ufw default allow outgoing
 # Allow Infisical API access
 sudo ufw allow 8080/tcp
 # Allow HTTPS (if terminating TLS at Infisical)
 sudo ufw allow 443/tcp
 # If running PostgreSQL locally, restrict to localhost
 sudo ufw allow from 127.0.0.1 to any port 5432
 # If running Redis locally, restrict to localhost
 sudo ufw allow from 127.0.0.1 to any port 6379
 # Enable firewall
 sudo ufw --force enable
 ```
 **Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:
 ```bash
 # Install and configure NTP
 sudo apt-get update
 sudo apt-get install -y ntp
 sudo systemctl enable ntp
 sudo systemctl start ntp
 # Verify time synchronization
 timedatectl status
 ```
 **Secure file permissions**. Set proper permissions on application files:
 ```bash
 # Set binary permissions
 sudo chmod 755 /opt/infisical/infisical-linux-amd64
 sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64
 # Set config file permissions
 sudo chmod 640 /etc/infisical/environment
 sudo chown root:infisical /etc/infisical/environment
 ```
 **Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly:
 ## Advanced Security Configurations
 **Configure backup encryption**. Encrypt PostgreSQL backups:
 ```bash
 # PostgreSQL backup with encryption
 pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
 ```
 **Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
 **Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.
 ## Compliance and Monitoring
 For enterprise deployments requiring compliance certifications:
 - Implement audit log retention policies
 - Set up security event monitoring and alerting
 - Configure automated vulnerability scanning
 - Establish incident response procedures
 - Document security controls for compliance audits
 These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements.
 For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars).