awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Doc updates

Browse Source
This commit is contained in:
x032205
2025-05-23 13:02:04 -04:00
parent db44d958d3
commit db4db04ba6
1 changed files with 13 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
docs/self-hosting/configuration/envars.mdx
View File

@@ -96,8 +96,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
Use the command below to encode your certificate:
`echo "<certificate>" | base64`
Use the following command to encode your certificate: `echo "<certificate>" | base64`
</ParamField>
<ParamField query="DB_READ_REPLICAS" type="string" default="" optional>
@@ -111,10 +110,9 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]
</ParamField>
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64.
Use the command below to encode your certificate:
`echo "<certificate>" | base64`
Use the following command to encode your certificate: `echo "<certificate>" | base64`
If not provided it will use master SSL certificate.
If not provided it will use master SSL certificate.
</ParamField>
</Expandable>
@@ -169,6 +167,16 @@ Without email configuration, Infisical's core functions like sign-up/login and s
<ParamField query="SMTP_TLS_REJECT_UNAUTHORIZED" type="bool" default="true" optional>
If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
</ParamField>
<ParamField query="SMTP_CUSTOM_CA_CERT" type="string" default="none" optional>
If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.
This variable **must be a base64 encoded PEM certificate**. Use the following command to encode your certificate: `echo "<certificate>" | base64`
Infisical highly encourages the following variables be used alongside this one for maximum security:
- `SMTP_REQUIRE_TLS=true`
- `SMTP_TLS_REJECT_UNAUTHORIZED=true`
</ParamField>
</Accordion>
<Accordion title="Twilio SendGrid">
@@ -410,23 +418,6 @@ SSL: Available on ports 465, 8465, and 443
</Note>
</Accordion>
### Custom CA Certificate for Email Service TLS
If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables:
```
SMTP_PORT=465 # Or your SMTPS/STARTTLS port
SMTP_CUSTOM_CA_CERT='[BASE64 ENCODED CERTIFICATE PEM]'
# Always keep these as true for custom CA
SMTP_REQUIRE_TLS=true
SMTP_TLS_REJECT_UNAUTHORIZED=true
```
<Note>
The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format**. Use the command below to encode your certificate: `echo "<certificate>" | base64`
</Note>
## Authentication
By default, users can only login via email/password based login method.