mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
envars update + docker standalone
This commit is contained in:
Maidul Islam
@@ -154,10 +154,12 @@
|
||||
{
|
||||
"group": "Self-host Infisical",
|
||||
"pages": [
|
||||
"self-hosting/overview",
|
||||
"self-hosting/configuration/requirements",
|
||||
"self-hosting/configuration/schema-migrations",
|
||||
{
|
||||
"group": "Deployment options",
|
||||
"group": "Installation methods",
|
||||
"pages": [
|
||||
"self-hosting/overview",
|
||||
"self-hosting/deployment-options/standalone-infisical",
|
||||
"self-hosting/deployment-options/docker-compose",
|
||||
"self-hosting/deployment-options/kubernetes-helm",
|
||||
@@ -172,9 +174,6 @@
|
||||
]
|
||||
},
|
||||
"self-hosting/configuration/envars",
|
||||
"self-hosting/configuration/email",
|
||||
"self-hosting/configuration/redis",
|
||||
"self-hosting/configuration/sso",
|
||||
"self-hosting/faq"
|
||||
]
|
||||
},
|
||||
|
||||
@@ -1,242 +0,0 @@
|
||||
---
|
||||
title: "Configure email service"
|
||||
description: "How to configure your email when self-hosting Infisical."
|
||||
---
|
||||
|
||||
By default, the core functions of Infisical work without any email service configuration. Without email service, basic sign up/login and secret operations will function without any issue.
|
||||
However, the following functionality will be disabled.
|
||||
|
||||
- Multi-factor authentication
|
||||
- Sending invite links via email for projects to teammates
|
||||
- Sending alerts such as suspicious login attempts
|
||||
|
||||
## Configuration
|
||||
|
||||
If you choose to setup email service, you need to configure the following SMTP [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):
|
||||
|
||||
- `SMTP_HOST`: Hostname to connect to for establishing SMTP connections.
|
||||
- `SMTP_USERNAME`: Credential to connect to host (e.g. team@infisical.com)
|
||||
- `SMTP_PASSWORD`: Credential to connect to host.
|
||||
- `SMTP_PORT`: Port to connect to for establishing SMTP connections.
|
||||
- `SMTP_SECURE`: If `true`, the connection will use TLS when connecting to server with special configs for SendGrid and Mailgun. If `false` (the default) then TLS is used if server supports the STARTTLS extension.
|
||||
- `SMTP_FROM_ADDRESS`: Email address to be used for sending emails (e.g. team@infisical.com).
|
||||
- `SMTP_FROM_NAME`: Name label to be used in `From` field (e.g. Team).
|
||||
|
||||
Below you will find details on how to configure common email providers:
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Resend">
|
||||
1. Create an account on [Resend](https://resend.com).
|
||||
2. Add a [Domain](https://resend.com/domains).
|
||||
|
||||
|
||||
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
|
||||
|
||||
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
|
||||
|
||||
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Twilio SendGrid">
|
||||
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Mailgun">
|
||||
|
||||
1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
|
||||
2. Obtain your Mailgun credentials in Sending > Overview > SMTP
|
||||
|
||||
|
||||
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="AWS SES">
|
||||
|
||||
1. Create an account and [configure AWS SES](https://aws.amazon.com/premiumsupport/knowledge-center/ses-set-up-connect-smtp/) to send emails in the Amazon SES console.
|
||||
2. Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your AWS SES SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
|
||||
SMTP_USERNAME=xxx # your SMTP username
|
||||
SMTP_PASSWORD=xxx # your SMTP password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="SocketLabs">
|
||||
|
||||
1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
|
||||
2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gmail">
|
||||
|
||||
Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
|
||||
applications like Infisical to authenticate with Gmail via your username and password.
|
||||
|
||||
|
||||
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Warning>
|
||||
As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
|
||||
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
|
||||
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
|
||||
</Warning>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Office365">
|
||||
|
||||
1. Create an account and configure [Office365](https://www.office.com/) to send emails.
|
||||
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Zoho Mail">
|
||||
|
||||
1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
|
||||
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
</AccordionGroup>
|
||||
@@ -1,188 +1,426 @@
|
||||
---
|
||||
title: "All environment variables"
|
||||
description: "Configure your environment variables when self-hosting Infisical."
|
||||
title: "Environment variables"
|
||||
description: "Configure environment variables for self-hosted Infisical"
|
||||
---
|
||||
|
||||
## Environment variables
|
||||
|
||||
Depending on your chosen self hosted deployment method, you may need to configured at least the required environment variable listed below.
|
||||
Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case.
|
||||
Infisical accepts all configurations via environment variables. For a basic self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined.
|
||||
However, you can configure additional settings to activate more features as needed.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Required">
|
||||
<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
|
||||
</ParamField>
|
||||
## General platform
|
||||
Used to configure platform-specific security and operational settings
|
||||
|
||||
<ParamField query="AUTH_SECRET" type="string" default="none" required>
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="none" required>
|
||||
Postgres database connection string.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="REDIS_URL" type="string" default="none" required>
|
||||
Redis connection string
|
||||
</ParamField>
|
||||
</Tab>
|
||||
<Tab title="Email service">
|
||||
<Info>When email service is not configured, Infisical will have limited functionality</Info>
|
||||
|
||||
<ParamField query="SMTP_HOST" type="string" default="none" optional>
|
||||
Hostname to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
|
||||
Name label to be used in From field (e.g. Team)
|
||||
</ParamField>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Secret Integrations">
|
||||
To sync secret to third party services, provide value for the related services
|
||||
|
||||
<ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client ID for Heroku integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client secret for Heroku integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client ID for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
|
||||
OAuth2 client ID for Netlify integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
|
||||
OAuth2 client secret for Netlify integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitHub integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitHub integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 slug for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_ID_BITBUCKET" type="string" default="none" optional>
|
||||
OAuth2 client ID for BitBucket integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_BITBUCKET" type="string" default="none" optional>
|
||||
OAuth2 client secret for BitBucket integration
|
||||
</ParamField>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Auth Integrations">
|
||||
To integrate with external auth providers, provide value for the related keys
|
||||
<ParamField query="CLIENT_ID_GOOGLE_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for Google login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GOOGLE_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for Google login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_ID_GITHUB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitHub login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GITHUB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitHub login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_ID_GITLAB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitLab login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GITLAB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitLab login
|
||||
</ParamField>
|
||||
<ParamField query="URL_GITLAB_LOGIN" type="string" default="https://gitlab.com" optional>
|
||||
URL of your self-hosted instance of GitLab where the OAuth application is registered
|
||||
</ParamField>
|
||||
</Tab>
|
||||
<Tab title="Others">
|
||||
#### JWT
|
||||
<ParamField query="JWT_SIGNUP_LIFETIME" type="string" default="15m" optional>
|
||||
JWT token lifetime expressed in seconds or a string describing a time span
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="JWT_REFRESH_LIFETIME" type="string" default="90d" optional>
|
||||
JWT token lifetime expressed in seconds or a string describing a time span
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="JWT_AUTH_LIFETIME" type="string" default="10d" optional>
|
||||
JWT token lifetime expressed in seconds or a string describing a time span
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="JWT_MFA_LIFETIME" type="string" default="5m" optional>
|
||||
JWT token lifetime expressed in seconds or a string describing a time span
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="JWT_PROVIDER_AUTH_LIFETIME" type="string" default="5m" optional>
|
||||
JWT token lifetime expressed in seconds or a string describing a time span
|
||||
</ParamField>
|
||||
|
||||
#### Logging
|
||||
|
||||
Infisical uses Sentry to report error logs
|
||||
|
||||
<ParamField
|
||||
query="PINO_LOG_LEVEL"
|
||||
type="string"
|
||||
default="info"
|
||||
optional
|
||||
>
|
||||
The minimum log level for application logging; can be one of `trace`, `debug`, `info`, `warn`, `error`, or `fatal`.
|
||||
<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
|
||||
</ParamField>
|
||||
|
||||
<ParamField
|
||||
query="SENTRY_DSN"
|
||||
type="string"
|
||||
default="none"
|
||||
optional
|
||||
></ParamField>
|
||||
|
||||
#### Settings
|
||||
|
||||
{" "}
|
||||
|
||||
<ParamField query="INVITE_ONLY_SIGNUP" type="string" default="false" optional>
|
||||
Only allow users who are invited to sign up
|
||||
<ParamField query="AUTH_SECRET" type="string" default="none" required>
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SITE_URL" type="string" default="none" optional>
|
||||
Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
|
||||
<ParamField query="SITE_URL" type="string" default="none" optional>
|
||||
Must be an absolute URL including the protocol (e.g. https://app.infisical.com).
|
||||
</ParamField>
|
||||
|
||||
## Data Layer
|
||||
The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
|
||||
Postgres database connection string.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
|
||||
Use the command below to encode your certificate:
|
||||
`echo "<certificate>" | base64`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="REDIS_URL" type="string" default="none" required>
|
||||
Redis connection string
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
## Email service
|
||||
Without email configuration, Infisical's core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
|
||||
|
||||
<Accordion title="Generic Configuration">
|
||||
<ParamField query="SMTP_HOST" type="string" default="none" optional>
|
||||
Hostname to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
<ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
|
||||
Name label to be used in From field (e.g. Team)
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Twilio SendGrid">
|
||||
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Mailgun">
|
||||
1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
|
||||
2. Obtain your Mailgun credentials in Sending > Overview > SMTP
|
||||
|
||||
|
||||
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="AWS SES">
|
||||
1. Create an account and [configure AWS SES](https://aws.amazon.com/premiumsupport/knowledge-center/ses-set-up-connect-smtp/) to send emails in the Amazon SES console.
|
||||
2. Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your AWS SES SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
|
||||
SMTP_USERNAME=xxx # your SMTP username
|
||||
SMTP_PASSWORD=xxx # your SMTP password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="SocketLabs">
|
||||
1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
|
||||
2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Resend">
|
||||
1. Create an account on [Resend](https://resend.com).
|
||||
2. Add a [Domain](https://resend.com/domains).
|
||||
|
||||
|
||||
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
|
||||
|
||||
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
|
||||
|
||||
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gmail">
|
||||
Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
|
||||
applications like Infisical to authenticate with Gmail via your username and password.
|
||||
|
||||
|
||||
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Warning>
|
||||
As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
|
||||
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
|
||||
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
|
||||
</Warning>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Office365">
|
||||
1. Create an account and configure [Office365](https://www.office.com/) to send emails.
|
||||
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Zoho Mail">
|
||||
1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
|
||||
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## SSO based login
|
||||
By default, users can only login via email/password based login method.
|
||||
To login into Infisical with OAuth providers such as Google, configure the associated variables.
|
||||
|
||||
<Accordion title="Google">
|
||||
Follow detailed guide to configure [Google SSO](/documentation/platform/sso/google)
|
||||
|
||||
<ParamField query="CLIENT_ID_GOOGLE_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for Google login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GOOGLE_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for Google login
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Github">
|
||||
Follow detailed guide to configure [GitHub SSO](/documentation/platform/sso/github)
|
||||
|
||||
<ParamField query="CLIENT_ID_GITHUB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitHub login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GITHUB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitHub login
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gitlab">
|
||||
Follow detailed guide to configure [GitLab SSO](/documentation/platform/sso/gitlab)
|
||||
|
||||
<ParamField query="CLIENT_ID_GITLAB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitLab login
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_GITLAB_LOGIN" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitLab login
|
||||
</ParamField>
|
||||
<ParamField query="URL_GITLAB_LOGIN" type="string" default="https://gitlab.com" optional>
|
||||
URL of your self-hosted instance of GitLab where the OAuth application is registered
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Okta SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Azure SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="JumpCloud SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
</Accordion>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Native secret integrations
|
||||
To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
|
||||
|
||||
<Accordion title="Heroku">
|
||||
<ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client ID for Heroku integration
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client secret for Heroku integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Vercel">
|
||||
<ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client ID for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 slug for Vercel integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Netlify">
|
||||
<ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
|
||||
OAuth2 client ID for Netlify integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
|
||||
OAuth2 client secret for Netlify integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Github">
|
||||
<ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
|
||||
OAuth2 client ID for GitHub integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
|
||||
OAuth2 client secret for GitHub integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Bitbucket">
|
||||
<ParamField query="CLIENT_ID_BITBUCKET" type="string" default="none" optional>
|
||||
OAuth2 client ID for BitBucket integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_BITBUCKET" type="string" default="none" optional>
|
||||
OAuth2 client secret for BitBucket integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="GCP Secrets Manager">
|
||||
<ParamField query="CLIENT_ID_GCP_SECRET_MANAGER" type="string" default="none" optional>
|
||||
OAuth2 client id for GCP secrets manager integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_GCP_SECRET_MANAGER" type="string" default="none" optional>
|
||||
OAuth2 client secret for GCP secrets manager integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Azure">
|
||||
<ParamField query="CLIENT_ID_AZURE" type="string" default="none" optional>
|
||||
OAuth2 client id for Azure integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_AZURE" type="string" default="none" optional>
|
||||
OAuth2 client secret for Azure integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gitlab">
|
||||
<ParamField query="CLIENT_ID_GITLAB" type="string" default="none" optional>
|
||||
OAuth2 client id for Gitlab integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_GITLAB" type="string" default="none" optional>
|
||||
OAuth2 client secret for Gitlab integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
---
|
||||
title: "Configure Redis"
|
||||
description: "Learn to configure Redis with your self hosted Infisical"
|
||||
---
|
||||
|
||||
## Why Redis?
|
||||
As the features and use case of Infisical have grown, the need for a fast and reliable in-memory data storage has become clear.
|
||||
By adding Redis to Infisical, we can now support more complex workflows such as queuing system to run long running asynchronous tasks, cron jobs, and access reliable cache to speed up frequently used resources.
|
||||
|
||||
<Info>
|
||||
Starting with Infisical version v0.31.0, Redis will be required to fully use Infisical
|
||||
</Info>
|
||||
|
||||
### Adding Redis to your self hosted instance of Infisical
|
||||
To add Redis to your self hosted instance, follow the instructions for the deployment method you used.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Kubernetes Helm chart">
|
||||
### In cluster Redis
|
||||
By default, new versions of the Infisical Helm chart already comes with an in-cluster Redis instance. To deploy a in-cluster Redis instance along with your Infisical instance, update your Infisical chart then redeploy/upgrade your release.
|
||||
This will spin up a Redis instance and automatically configure it with your Infisical backend.
|
||||
|
||||
1. Update Infisical Helm chart
|
||||
```bash
|
||||
helm repo update
|
||||
```
|
||||
|
||||
2. Upgrade Infisical release
|
||||
```bash
|
||||
helm upgrade <infisical release name> infisical-helm-charts/infisical --values <path to your values file>
|
||||
```
|
||||
### External Redis
|
||||
If you want to use an external Redis instance, please add a Redis connection URL under the backend environments variables and then upgrade/redeploy your Infisical instance.
|
||||
|
||||
1. Update your helm values file
|
||||
```yaml your-values.yaml
|
||||
backendEnvironmentVariables:
|
||||
REDIS_URL=<your redis connection string>
|
||||
```
|
||||
|
||||
2. Upgrade Infisical release
|
||||
```bash
|
||||
helm upgrade <infisical release name> infisical-helm-charts/infisical --values <path to your values file>
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Docker compose">
|
||||
### Internal Redis service
|
||||
By default, new versions of the docker compose file already comes with a Redis service. To use the pre-configured Redis service, please update your docker compose file to the latest version.
|
||||
|
||||
1. Download the new docker compose file
|
||||
```
|
||||
wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
|
||||
```
|
||||
2. Add Redis environment variable to your .env file
|
||||
```.env .env
|
||||
REDIS_URL=redis://redis:6379
|
||||
```
|
||||
|
||||
3. Restart your docker compose services
|
||||
</Tab>
|
||||
<Tab title="Standalone Docker image">
|
||||
This standalone version of Infisical does not have an internal Redis service. To configure Redis with your Infisical instance, you must connect to a external Redis service by setting the connection string as an environment variable.
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
docker run -p 80:80 \
|
||||
-e ENCRYPTION_KEY=f40c9178624764ad85a6830b37ce239a \
|
||||
-e JWT_SIGNUP_SECRET=38ea90fb7998b92176080f457d890392 \
|
||||
-e JWT_REFRESH_SECRET=7764c7bbf3928ad501591a3e005eb364 \
|
||||
-e JWT_AUTH_SECRET=5239fea3a4720c0e524f814a540e14a2 \
|
||||
-e JWT_SERVICE_SECRET=8509fb8b90c9b53e9e61d1e35826dcb5 \
|
||||
-e REDIS_URL=<> \
|
||||
-e MONGO_URL="<>" \
|
||||
infisical/infisical:latest
|
||||
```
|
||||
|
||||
Redis environment variable name: `REDIS_URL`
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Support
|
||||
If you have questions or need support, please join our [slack channel](https://infisical-users.slack.com) and one of our teammates will be happy to guide you.
|
||||
65
docs/self-hosting/configuration/requirements.mdx
Normal file
65
docs/self-hosting/configuration/requirements.mdx
Normal file
@@ -0,0 +1,65 @@
|
||||
---
|
||||
title: "Installation Requirements"
|
||||
description: ""
|
||||
---
|
||||
|
||||
This page details the minimum requirements necessary for installing and using Infisical.
|
||||
The actual resource requirements will vary in direct proportion to the operations performed by Infisical and the level of utilization by the end users
|
||||
|
||||
## **Hardware Requirements**
|
||||
|
||||
**Small deployment** suitable for most initial production setups, as well as development and testing scenarios.
|
||||
|
||||
**Large deployment** suitable for high-demand production environments, characterized by either a high volume of transactions, large number of secrets, or both.
|
||||
|
||||
|
||||
### **Storage**
|
||||
|
||||
Infisical doesn’t require file storage as all persisted data is saved in the database.
|
||||
However, its logs and metrics are saved to disk for later viewing. As a result, we recommend provisioning 1-2 GB of storage.
|
||||
|
||||
### **CPU**
|
||||
|
||||
CPU requirements vary heavily on the volume of secret operations (reads and writes) you anticipate.
|
||||
Processing large volumes of secrets frequently and consistently will require higher CPU.
|
||||
|
||||
Recommended minimum CPU hardware for different sizes of deployments:
|
||||
|
||||
- **small:** 2-4 core is the **recommended** minimum
|
||||
- **large:** 4-8 cores are suitable for larger deployments
|
||||
|
||||
### **Memory Allocation**
|
||||
|
||||
Memory needs depend on expected workload, including factors like user activity, automation level, and the frequency of secret operations.
|
||||
|
||||
Recommended minimum memory hardware for different sizes of deployments:
|
||||
- **small:** 4-8 GB is the **recommended** minimum
|
||||
- **large:** 16-32 GB are suitable for larger deployments
|
||||
|
||||
## **Database**
|
||||
|
||||
PostgreSQL is the only database supported by Infisical. Infisical has been extensively tested with Postgres version 16. We recommend using versions 14 and up for optimal compatibility.
|
||||
|
||||
Recommended resource allocation based on deployment size:
|
||||
- **small:** 1 vCPU / 2 GB RAM / 10 GB Disk
|
||||
- **large:** 4vCPU / 16 GB RAM / 100 GB Disk
|
||||
|
||||
## **Redis**
|
||||
|
||||
Redis is utilized for session management and background tasks in Infisical.
|
||||
|
||||
Redis requirements:
|
||||
|
||||
- Use Redis versions 6.x or 7.x. We advise upgrading to at least Redis 6.2.
|
||||
- Redis Cluster mode is currently not supported; use Redis Standalone, with or without High Availability (HA).
|
||||
- Redis storage needs are minimal: a setup with 1 vCPU, 1 GB RAM, and 1GB SSD will be sufficient for most deployments.
|
||||
|
||||
## **Supported Web Browsers**
|
||||
|
||||
Infisical supports a range of web browsers. However, features such as browser-based CLI login only work on Google Chrome and Firefox at the moment.
|
||||
|
||||
- [Mozilla Firefox](https://www.mozilla.org/en-US/firefox/new/)
|
||||
- [Google Chrome](https://www.google.com/chrome/)
|
||||
- [Chromium](https://www.chromium.org/getting-involved/dev-channel/)
|
||||
- [Apple Safari](https://www.apple.com/safari/)
|
||||
- [Microsoft Edge](https://www.microsoft.com/en-us/edge?form=MA13FJ)
|
||||
60
docs/self-hosting/configuration/schema-migrations.mdx
Normal file
60
docs/self-hosting/configuration/schema-migrations.mdx
Normal file
@@ -0,0 +1,60 @@
|
||||
---
|
||||
title: "Schema migration"
|
||||
description: "Run Postgres schema migrations"
|
||||
---
|
||||
|
||||
Running schema migrations is a requirement before deploying Infisical.
|
||||
Each time you decide to upgrade your version of Infisical, it's necessary to run schema migrations for that specific version.
|
||||
The guide below outlines a step-by-step guide to help you through this process.
|
||||
|
||||
### Prerequisites
|
||||
- Docker installed on your machine
|
||||
- An active PostgreSQL database
|
||||
- Postgres database connection string
|
||||
|
||||
<Steps>
|
||||
<Step title="Pull the Infisical Docker Image">
|
||||
First, ensure you have the correct version of the Infisical Docker image. You can pull it from Docker Hub using the following command:
|
||||
```bash
|
||||
docker pull infisical/infisical:<version>
|
||||
```
|
||||
Replace `<version>` with the specific version number you intend to deploy.
|
||||
</Step>
|
||||
|
||||
<Step title="Set Up the Environment Variable">
|
||||
The Docker image requires a `DB_CONNECTION_URI` environment variable. This connection string should point to your PostgreSQL database. The format generally looks like this: `postgresql://username:password@host:port/database`.
|
||||
</Step>
|
||||
|
||||
<Step title="Run the Migration ">
|
||||
To run the schema migration for the version of Infisical you want to deploy, use the following Docker command:
|
||||
|
||||
```bash
|
||||
docker run --env DB_CONNECTION_URI=<your_connection_string> infisical/infisical:<version> npm run migration:latest
|
||||
```
|
||||
Replace `<your_connection_string>` with your actual PostgreSQL connection string, and `<version>` with the desired version number.
|
||||
</Step>
|
||||
|
||||
<Step title="Verify the Migration">
|
||||
After running the migration, it's good practice to check if the migration was successful. You can do this by checking the logs or accessing your database to ensure the schema has been updated accordingly.
|
||||
</Step>
|
||||
<Step title="Rollback If Needed">
|
||||
If you need to rollback a migration by one step, use the following command:
|
||||
|
||||
```bash
|
||||
docker run --env DB_CONNECTION_URI=<your_connection_string> infisical/infisical:<version> npm run migration:rollback
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Repeat for Each Version">
|
||||
It's important to run schema migrations for each version of the Infisical you deploy. For instance, if you're updating from `infisical/infisical:1` to `infisical/infisical:2`, ensure you run the schema migrations for `infisical/infisical:2` before deploying it.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Tip>
|
||||
In a production setting, we recommend a more structured approach to deploying migrations prior to upgrading Infisical. This can be accomplished via CI automation.
|
||||
</Tip>
|
||||
|
||||
### Additional discussion
|
||||
- Always back up your database before running migrations, especially in a production environment.
|
||||
- Test the migration process in a staging environment before applying it to production.
|
||||
- Keep track of the versions and their corresponding migrations to avoid any inconsistencies.
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
title: "Configure SSO"
|
||||
description: "How to configure SSO when self-hosting Infisical."
|
||||
---
|
||||
|
||||
<Warning>
|
||||
Infisical offers Google SSO and GitHub SSO for free.
|
||||
|
||||
Infisical also offers SAML SSO authentication but as paid features that can be unlocked via enterprise license; if this is of interest, please contact team@infisical.com.
|
||||
On this front, we currently support Okta, Azure AD, and JumpCloud and are expanding support for other IdPs in the coming months; stay tuned and feel free to request a IdP at this
|
||||
[issue](https://github.com/Infisical/infisical/issues/442).
|
||||
</Warning>
|
||||
|
||||
You can view specific documentation for how to set up each SSO authentication method below:
|
||||
|
||||
- [Google SSO](/documentation/platform/sso/google)
|
||||
- [GitHub SSO](/documentation/platform/sso/github)
|
||||
- [GitLab SSO](/documentation/platform/sso/gitlab)
|
||||
- [Okta SAML](/documentation/platform/sso/okta)
|
||||
- [Azure SAML](/documentation/platform/sso/azure)
|
||||
- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
|
||||
@@ -7,18 +7,32 @@ Prerequisites:
|
||||
- Basic knowledge of [Docker](https://www.docker.com/)
|
||||
- Have Docker installed on your system. If not, follow the installation guide [here](https://docs.docker.com/get-docker/).
|
||||
|
||||
Infisical is available as a single Docker image for effortless deployment.
|
||||
This Docker image solely includes the application code, meaning you must supply a connection to a Postgres database and a Redis instance.
|
||||
The following guide provides a detailed step-by-step walkthrough on how you can deploy Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Pull the Infisical Docker image">
|
||||
Run the following command in your terminal to pull the Infisical Docker image:
|
||||
Visit [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) and select a version of Infisical image you would like to deploy.
|
||||
Then run the following command in your terminal to pull the specific Infisical Docker image.
|
||||
|
||||
```
|
||||
docker pull infisical/infisical:latest
|
||||
docker pull infisical/infisical:<version>
|
||||
```
|
||||
|
||||
Remember to replace `<version>` with the docker image tag of your choice.
|
||||
</Step>
|
||||
<Step title="Run Postgres schema migration ">
|
||||
Before you can start the instance of Infisical, you need to run the database schema migrations.
|
||||
Follow the step by [step guide here](/self-hosting/configuration/schema-migrations) on running schema migrations.
|
||||
|
||||
```
|
||||
docker pull infisical/infisical:<version>
|
||||
```
|
||||
</Step>
|
||||
<Step title="Start Infisical">
|
||||
2.1. Running Infisical requires a few environment variables to be set.
|
||||
At minimum, Infisical requires that you set the variables `ENCRYPTION_KEY`, `AUTH_SECRET`, `MONGO_URL`, and `REDIS_URL`
|
||||
which you can read more about [here](/self-hosting/configuration/envars).
|
||||
For a minimal installation of Infisical, you need to configure `ENCRYPTION_KEY`, `AUTH_SECRET`, and `REDIS_URL`.
|
||||
View all available environment variables [here](/self-hosting/configuration/envars).
|
||||
|
||||
Once you have added the required environment variables to your docker run command, execute it in your terminal to get Infisical up and running.
|
||||
|
||||
@@ -28,15 +42,16 @@ Prerequisites:
|
||||
docker run -p 80:8080 \
|
||||
-e ENCRYPTION_KEY=f40c9178624764ad85a6830b37ce239a \
|
||||
-e AUTH_SECRET="q6LRi7c717a3DQ8JUxlWYkZpMhG4+RHLoFUVt3Bvo2U=" \
|
||||
-e MONGO_URL="<>" \
|
||||
infisical/infisical:latest
|
||||
-e DB_CONNECTION_URI="<>" \
|
||||
-e REDIS_URL="<>" \
|
||||
infisical/infisical:<version>
|
||||
```
|
||||
|
||||
<Warning>
|
||||
The above environment variable values are only to be used as an example and should not be used in production
|
||||
</Warning>
|
||||
|
||||
2.2. Once the container is running, verify the installation by opening your web browser and navigating to `http://localhost:80`.
|
||||
Once the container is running, verify the installation by opening your web browser and navigating to `http://localhost:80`.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
@@ -1,138 +0,0 @@
|
||||
---
|
||||
title: "Kubernetes"
|
||||
description: "How to deploy Infisical with Kubernetes"
|
||||
---
|
||||
|
||||
<Info>
|
||||
Self-host vs. Infisical Cloud
|
||||
|
||||
Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
|
||||
|
||||
If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
|
||||
|
||||
</Info>
|
||||
|
||||
**Prerequisites**
|
||||
- You have understanding of [Kubernetes](https://kubernetes.io/)
|
||||
- You have understanding of [Helm package manager](https://helm.sh/)
|
||||
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster
|
||||
|
||||
|
||||
#### 1. Fill our environment variables
|
||||
|
||||
Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file.
|
||||
Refer to the available [environment variables](../../self-hosting/configuration/envars) to learn more
|
||||
|
||||
<Accordion title="values.yaml">
|
||||
[View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical)
|
||||
```yaml
|
||||
frontend:
|
||||
enabled: true
|
||||
name: frontend
|
||||
podAnnotations: {}
|
||||
deploymentAnnotations: {}
|
||||
replicaCount: 2
|
||||
image:
|
||||
repository: infisical/frontend
|
||||
tag: "latest"
|
||||
pullPolicy: IfNotPresent
|
||||
kubeSecretRef: ""
|
||||
service:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
|
||||
frontendEnvironmentVariables:
|
||||
SITE_URL: infisical.local
|
||||
|
||||
backend:
|
||||
enabled: true
|
||||
name: backend
|
||||
podAnnotations: {}
|
||||
deploymentAnnotations: {}
|
||||
replicaCount: 2
|
||||
image:
|
||||
repository: infisical/backend
|
||||
tag: "latest"
|
||||
pullPolicy: IfNotPresent
|
||||
kubeSecretRef: ""
|
||||
service:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
|
||||
backendEnvironmentVariables:
|
||||
ENCRYPTION_KEY: MUST_REPLACE
|
||||
JWT_SIGNUP_SECRET: MUST_REPLACE
|
||||
JWT_REFRESH_SECRET: MUST_REPLACE
|
||||
JWT_AUTH_SECRET: MUST_REPLACE
|
||||
JWT_SERVICE_SECRET: MUST_REPLACE
|
||||
SMTP_HOST: MUST_REPLACE
|
||||
SMTP_PORT: 587
|
||||
SMTP_SECURE: false
|
||||
SMTP_FROM_NAME: Infisical
|
||||
SMTP_FROM_ADDRESS: MUST_REPLACE
|
||||
SMTP_USERNAME: MUST_REPLACE
|
||||
SMTP_PASSWORD: MUST_REPLACE
|
||||
SITE_URL: infisical.local
|
||||
|
||||
## Mongo DB persistence
|
||||
mongodb:
|
||||
enabled: true
|
||||
|
||||
## By default the backend will be connected to a Mongo instance within the cluster
|
||||
## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
|
||||
## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
|
||||
## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
|
||||
mongodbConnection:
|
||||
externalMongoDBConnectionString: ""
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
# cert-manager.io/issuer: letsencrypt-nginx
|
||||
hostName: infisical.local ## <- Replace with your own domain
|
||||
frontend:
|
||||
path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
path: /api
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - secretName: letsencrypt-nginx
|
||||
# hosts:
|
||||
# - infisical.local
|
||||
|
||||
mailhog:
|
||||
enabled: false
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
Once you have a local copy of the values file, fill our the required environment variables and save the file.
|
||||
|
||||
|
||||
#### 2. Install Infisical Helm repository
|
||||
|
||||
```bash
|
||||
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
|
||||
|
||||
helm repo update
|
||||
```
|
||||
|
||||
#### 3. Install the Helm chart
|
||||
|
||||
By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
|
||||
that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.
|
||||
|
||||
```bash
|
||||
## Installs to default namespace
|
||||
helm install infisical-helm-charts/infisical --generate-name --values <path to the values.yaml you downloaded/created in step 2>
|
||||
```
|
||||
|
||||
<Note>
|
||||
If you have not filled out all of the required environment variables, you will see an error message prompting you to
|
||||
do so.
|
||||
</Note>
|
||||
|
||||
#### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`.
|
||||
@@ -1,53 +0,0 @@
|
||||
---
|
||||
title: "Linux VM"
|
||||
description: "How to deploy Infisical with Docker-Compose"
|
||||
---
|
||||
|
||||
<Info>
|
||||
Self-host vs. Infisical Cloud
|
||||
|
||||
Self-hosting Infisical means managing the service yourself, taking care of upgrades, scaling, security, etc.
|
||||
|
||||
If you're less technical and looking for a hands-free experience with minimal overhead then we recommend Infisical Cloud.
|
||||
|
||||
</Info>
|
||||
|
||||
We provide a docker-compose deployment option for those who want to deploy Infisical onto a Linux VM easily.
|
||||
|
||||
1. Install Docker on your VM
|
||||
|
||||
```bash
|
||||
# Example in ubuntu
|
||||
apt-get update
|
||||
apt-get upgrade
|
||||
apt install docker-compose
|
||||
```
|
||||
|
||||
2. Download the required files
|
||||
|
||||
```bash
|
||||
# Download env file template
|
||||
wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
|
||||
|
||||
# Download docker compose template
|
||||
wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
|
||||
|
||||
# Download nginx config
|
||||
mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
|
||||
```
|
||||
|
||||
3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](../../self-hosting/configuration/envars)
|
||||
|
||||
```bash
|
||||
# update environment variables like mongo login
|
||||
nano .env
|
||||
```
|
||||
|
||||
4. Get the service up and running.
|
||||
|
||||
```bash
|
||||
# Start up services in detached mode
|
||||
docker-compose -f docker-compose.yml up -d
|
||||
```
|
||||
|
||||
5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures.
|
||||
Reference in New Issue
Block a user