awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restructure and add quickstart to docs

Browse Source
This commit is contained in:
Tuan Dang
2022-11-26 16:48:09 -05:00
parent b6e94ed9ec
commit dc3255adb7
26 changed files with 272 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
docs/getting-started/cli/cli-guide.mdx
View File

@@ -1,56 +0,0 @@
---
title: "Usage"
---
Prerequisite: [Install the CLI](../../getting-started/cli/installation)
## Login
Login in using the `login` command in your terminal. Logging in is a one-time, post-installation action that authenticates you with the platform — to change users, you can run the command again.
```bash
infisical login
```
## Initialization
In the root of your local project, initialize Infisical and follow steps to connect your project to the platform.
```bash
cd /path/to/project
# initialization
infisical init
```
## Injecting environment variables
To inject environment variables from the platform to your project, use the `run` command.
```bash
# command
infisical run -- [your application start command]
```
Options you can specify:
| Option | Description | Default value |
| ------------- | ----------------------------------------------------------------------------------------------------------- | ------------- |
| `--env` | Used to set the environment that secrets are pulled from. Accepted values: `dev`, `staging`, `test`, `prod` | `dev` |
| `--projectId` | Used to link a local project to the platform (required only if injecting via the service token method) | `None` |
Examples:
```bash
# example with node
infisical run -- node index.js
# example with node (nodemon)
infisical run -- nodemon index.js
# example with node (nodemon) pulling in secrets from test environment
infisical run --env=test -- nodemon index.js
# example with flask
infisical run -- flask run
```

95
docs/getting-started/cli/installation.mdx
View File

@@ -1,95 +0,0 @@
---
title: "Installation"
---
Prerequisite: [Setup an account](../../getting-started/dashboard/create-account) with Infisical Cloud or via self-hosted installation.
Follow the guide for your OS below to install the CLI.
<Tabs>
<Tab title="MacOS">
Use [brew](https://brew.sh/) package manager
```bash
# install
brew install infisical/get-cli/infisical
# check version
infisical --version
```
To update:
```bash
brew upgrade infisical
```
</Tab>
<Tab title="Windows">
Use [Scoop](https://scoop.sh/) package manager
```bash
# install
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
scoop install infisical
# check version
infisical --version
```
To update:
```bash
scoop update infisical
```
</Tab>
<Tab title="Alpine">
Install prerequisite
```bash
$ sudo apk add --no-cache bash sudo
```
Add Infisical repository
```bash
$ curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' \
| sudo -E bash
```
Then install CLI
```bash
$ sudo apk update && sudo apk add infisical
```
</Tab>
<Tab title="RedHat/CentOs/Amazon">
Add Infisical repository
```bash
$ curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' \
| sudo -E bash
```
Then install CLI
```bash
$ sudo yum install infisical
```
</Tab>
<Tab title="Debian/Ubuntu">
Add Infisical repository
```bash
$ curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' \
| sudo -E bash
```
Then install CLI
```bash
$ sudo apt-get update && sudo apt-get install -y infisical
```
</Tab>
</Tabs>

55
docs/getting-started/cli/reference.mdx
View File

@@ -1,55 +0,0 @@
---
title: "Reference"
---
## Commands
| Command | Description | Options |
| ------- | -------------------------------------------------------------------- | ---------------------- |
| `login` | Used to authenticate and set the logged in user. |
| `init` | Used to link a local project to the platform. |
| `run` | Used to inject envars from the platform into an application process. | `--projectId`, `--env` |
## Global options
| Option | Description |
| ----------------- | ---------------------------------- |
| `--help`, `-h` | List help for any command |
| `--debug`, `-d` | Enable verbose logging |
| `--domain` | Use to direct Infisical to |
| `--version`, `-v` | Print version information and quit |
### Login
Used to authenticate and set the logged in user.
Post-authentication credentials are saved securely in your system keyring. Since only one user can be logged in at a time, to change the logged in user, run the command again to overwrite the previous login.
```bash
infisical login
```
### Init
Used to link a local project to the platform (cloud or self-hosted)
Run this command at the root of your local project. You will have to run this command for each new project you create locally.
```bash
infisical init
```
### Run
Used to inject environment variables from the platform into an application process.
```bash
infisical run [options] -- [your application start command]
```
Options you can specify:
| Option | Description | Default value |
| ------------- | ----------------------------------------------------------------------------------------------------------- | ------------- |
| `--env` | Used to set the environment that secrets are pulled from. Accepted values: `dev`, `staging`, `test`, `prod` | `dev` |
| `--projectId` | Used to link a local project to the platform (required only if injecting via the service token method) | `None` |

21
docs/getting-started/cli/token.mdx
View File

@@ -1,21 +0,0 @@
---
title: "Infisical Token"
---
Prerequisite: [Infisical Token and How to Generate One](../../getting-started/dashboard/token).
It's possible to use the CLI to sync environment varialbes without manually entering login credentials by using a service token in the prerequisite link above.
## Feeding Infisical Token to the CLI
The CLI looks out for an environment variable called the `INFISICAL_TOKEN` which you can set depending on where you run the CLI. If `INFISICAL_TOKEN` is detected by the CLI, it will authenticate and retrieve the environment variables which the token is authorized for.
A common use-case is to use the Infisical Token to fetch environment variables with Docker. More specifically, a token can be passed to a container as an environment variable for the CLI to authenticate and pull its corresponding secrets. Check out the integration guides for that:
- [Docker](../../integrations/docker)
- [Docker Compose](../../integrations/docker-compose)
<Info>
Once the token is expired, the CLI using it will no longer be able to make
requests with it.
</Info>

2
docs/getting-started/dashboard/create-account.mdx
View File

@@ -4,7 +4,7 @@ title: "Sign up"
## Self-hosted
If you're using a self-hosted installation, follow the [setup](/self-hosting/overview) then open your website URL `{WEBSITE_URL}/login`.
If you're using a self-hosted installation, follow the [setup](/self-hosting/overview) then open your site URL `{SITE_URL}`.
## Infisical Cloud

6
docs/getting-started/dashboard/integrations.mdx
View File

@@ -8,6 +8,6 @@ We’re still early with integrations but you’ll be able to sync environment v
Check out integrations:
- Heroku
- Docker
- Docker Compose
- [Heroku](/integrations/heroku)
- [Docker](/integrations/docker)
- [Docker Compose](/integrations/docker-compose)

6
docs/getting-started/dashboard/token.mdx
View File

@@ -4,11 +4,11 @@ title: "Infisical Token"
An Infisical Token is needed to authenticate the CLI when there isn't an easy way to manually type in your login credentials to sync environment variables to your applications.
It grants read-only access to a particular environment and project for a specified amount of time; once the token expires, any CLI application that relies on it for authentication will be denied access to retrieve related secrets.
It grants read-only access to a particular environment and project for a specified amount of time.
This is useful in the following contexts:
- [Docker](../../integrations/docker)/[Docker-Compose](../../integrations/docker-compose) integration: An Infisical Token can be passed to a Docker container as an environment variable for the CLI to authenticate and pull its corresponding secrets.
- [Docker](/integrations/docker)/[Docker-Compose](/integrations/docker-compose) integration: An Infisical Token can be passed to a Docker container as an environment variable for the CLI to authenticate and pull its corresponding secrets.
## Generate an Infisical Token
@@ -19,5 +19,3 @@ It's possible to generate an Infisical token in the settings of a project.
![token name](../../images/project-token-name.png)
![token added](../../images/project-token-added.png)
To use the Infisical Token in the CLI, check out the docs for that [here](../../getting-started/cli/token).

54
docs/getting-started/features.mdx
View File

@@ -20,46 +20,24 @@ The CLI is used to inject environment variables into applications and infrastruc
- Inject environment variables.
- Inject environment variables into containers via service tokens for Docker.
## Integrations
We're still early with integrations but you'll be able to sync environment variables across your entire infrastructure from local development to CI/CD and production.
| Integration | Status |
| -------------- | ----------- |
| Docker | Available |
| Docker-Compose | Available |
| Kubernetes | Coming soon |
| Vercel | Coming soon |
| AWS | Coming soon |
| GCP | Coming soon |
| Azure | Coming soon |
| DigitalOcean | Coming soon |
| GitLab | Coming soon |
| CircleCI | Coming soon |
| TravisCI | Coming soon |
| GitHub Actions | Coming soon |
| Jenkins | Coming soon |
Missing an integration? Throw in a request.
## Roadmap
We're building the future of secret management, one that's comprehensive and accessible to all. Some high-level features we have in mind:
| Feature | Status |
| ------------------------------------- | --------------- |
| Integrations | Ongoing |
| More hosting options | Ongoing |
| 1-Click Deploys | Ongoing |
| Account recovery: Backup key | Ongoing |
| Account recovery: Member-assisted | Not yet started |
| Slack & MS teams integrations | Not yet started |
| Access logs | Not yet started |
| Version control for secrets | Not yet started |
| 2FA | Not yet started |
| Restricted IPs | Not yet started |
| Read/write access controls | Not yet started |
| Secret rotation | Not yet started |
| Comparing secrets across environments | Not yet started |
| Feature | Status |
| ------------------------------------- | ----------- |
| Integrations | Ongoing |
| More hosting options | Ongoing |
| 1-Click Deploys | Ongoing |
| Account recovery: Backup key | Ongoing |
| Account recovery: Member-assisted | Coming soon |
| Slack & MS teams integrations | Coming soon |
| Access logs | Coming soon |
| Version control for secrets | Coming soon |
| 2FA | Coming soon |
| Restricted IPs | Coming soon |
| Read/write access controls | Coming soon |
| Secret rotation | Coming soon |
| Comparing secrets across environments | Coming soon |
Interested in contributing? Check out the guide.
Interested in contributing? Check out the [guide](/contributing/overview).

46
docs/getting-started/introduction.mdx
View File

@@ -2,20 +2,36 @@
title: "Introduction"
---
<iframe
src="https://www.youtube.com/embed/JS3OKYU2078"
width="100%"
height="400"
></iframe>
Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secret manager that enables teams to easily manage and sync their environment variables.
Infisical is an [open-source](https://opensource.com/resources/what-open-source), end-to-end encrypted (E2EE) secret manager that enables teams to easily manage and sync their environment variables.
Start syncing environment variables with [Infisical Cloud](https://app.infisical.com) or learn how to [host Infisical](/self-hosting/overview) yourself.
It stops [secret sprawl](https://www.gitguardian.com/glossary/secret-sprawl-definition) by providing a single source-of-truth for environment variables. It offers a dashboard for teams to manage environment variables and a platform-agnostic CLI to inject them into apps and infrastructure.
Some problems we solve:
- Leaking .env files to version control.
- Debugging missing environment variables.
- Sending environment variables over email.
Infisical uses [end-to-end encryption](https://en.wikipedia.org/wiki/End-to-end_encryption) to ensure that only designated team members can read their environment variables; unless intended for specific integrations, environment variables are always encrypted before being sent to the server.
<CardGroup cols={2}>
<Card
title="Quickstart"
href="/getting-started/quickstart"
icon="timer"
color="#ea5a0c"
>
Tour Infisical in a few minutes.
</Card>
<Card href="/cli/overview" title="CLI" icon="square-terminal" color="#16a34a">
Install the CLI to inject secrets into apps and infra.
</Card>
<Card
href="/self-hosting/overview"
title="Self-hosting"
icon="server"
color="#0285c7"
>
Learn how to configure and deploy Infisical.
</Card>
<Card
href="/integrations/heroku"
title="Integrations"
icon="plug"
color="#dc2626"
>
Explore integrations for Docker, AWS, Heroku, etc.
</Card>
</CardGroup>

43
docs/getting-started/quickstart.mdx Normal file
View File

@@ -0,0 +1,43 @@
---
title: "Quickstart"
---
This example demonstrates how to store and inject environment variables from [Infisical Cloud](https://app.infisical.com) into your application.
Note that the Infisical CLI is platform-agnostic and can inject environment variables across many tech stacks and frameworks.
## Set up Infisical Cloud
1. Login or create an accout at `app.infisical.com`.
2. Create a new project.
3. Populate your environment variables as in the image below.
![project quickstart](../images/project-quickstart.png)
## Set up the CLI
1. Follow the instructions to [install the CLI](/cli/overview).
2. Initialize Infisical for your project.
```bash
# move to your project
cd /path/to/project
# initialize infisical
infisical init
```
## Start your app with environment variables injected
```bash
# inject environment variables into app
infisical run -- [your application start command]
```
<Info>
Check out our [integrations](/integrations/overview) for injecting environment
variables into frameworks and platforms like Docker.
</Info>
Your app should be running with the environment variables injected.

27
docs/getting-started/security/data-model.mdx
View File

@@ -1,27 +0,0 @@
---
title: "Data Model"
---
Infisical stores a range of data namely user, secrets, keys, organization, project, and membership data.
## Users
The `User` model includes the fields `email`, `firstName`, `lastName`, `publicKey`, `encryptedPrivateKey`, `iv`, `tag`, `salt`, `verifier`, and `refreshVersion`.
Infisical makes a usability-security tradeoff to give users convenient access to public-private key pairs across different devices upon login, solving key-storage and transfer challenges across device and browser mediums, in exchange for it storing `encryptedPrivateKey`. In any case, private keys are symmetrically encrypted locally by user passwords which are not sent to the server — this is done with SRP.
## Secrets
The `Secret` model includes the fields `workspace`, `type`, `user`, `environment`, `secretKeyCiphertext`, `secretKeyIV`, `secretKeyTag`, `secretKeyHash`, `secretValueCiphertext`, `secretValueIV`, `secretValueTag`, and `secretValueHash`.
Each secret is symmetrically encrypted by the key of the project that it belongs to; that key's encrypted copies are stored in a separate `Key` collection.
## Keys
The `Key` model includes the fields `encryptedKey`, `nonce`, `sender`, `receiver`, and `workspace`.
Infisical stores copies of project keys, one for each member of a project, encrypted under each member's public key.
## Organizations and Workspaces
The `Organization`, `Workspace`, `MembershipOrg`, and `Membership` models contain enrollment information for organizations and projects; they are used to check if users are authorized to retrieve select secrets.

24
docs/getting-started/security/mechanics.mdx
View File

@@ -1,24 +0,0 @@
---
title: "Mechanics"
---
## Signup
During account signup, a user confirms their email address via OTP, generates a public-private key pair to be stored locally (private keys are symmetrically encrypted by the user's newly-made password), and forwards SRP-related values and user identifier information to the server. This includes `email`, `firstName`, `lastName`, `publicKey`, `encryptedPrivateKey`, `iv`, `tag`, `salt`, `verifier`, and `organizationName`.
Once authenticated via SRP, a user is issued a JWT and refresh token. The JWT token is stored in browser memory under a write-only class `SecurityClient` that appends the token to all future outbound requests requiring authentication. The refresh token is stored in an `HttpOnly` cookie and included in future requests to `/api/token` for JWT token renewal. This design side-steps potential XSS attacks on local storage.
<Info>
Infisical authenticates users using the SRP protocol. With SRP, the server can
authenticate users without ever seeing their passwords.
</Info>
## Invitation
After signing up, a user can invite other users to their organization to partake in projects — An invitation here consists of an email verification link sent to the invitee to confirm their identity if they've not previously signed up to Infisical. Both organization and project invites authorize invitees for resources but project invites differ in that they also involve sharing project keys by encrypting them under the invitees' public keys.
## Pushing/Pulling Secrets
To push secrets, a sender randomly-generates a symmetric encryption key, uses that key to encrypt their secret keys and values separately, asymmetrically encrypts the key with the receivers’ public keys, and uploads the encrypted secrets and keys to the server.
To pull secrets, a receiver obtains encrypted secret keys and values and their encrypted copy of the project key to decrypt the secrets from the server — they asymmetrically decrypt the key using their private key and use the decrypted key to decrypt the secrets. This public-key mechanism prevents the server-side from reading any secrets.

20
docs/getting-started/security/overview.mdx
View File

@@ -1,20 +0,0 @@
---
title: "Overview"
---
## Summary
Infisical uses end-to-end encryption (E2EE) whenever possible to securely store and share secrets. It uses secure remote password (SRP) to handle authentication and public-key cryptography for secret sharing and syncing; secrets are symmetrically encrypted at rest by keys decryptable only by members of the project.
Infisical uses AES256-GCM for symmetric encryption and x2519-xsalsa20-poly1305 for asymmetric encryption operations mentioned in this brief; key generation and asymmetric algorithms are implemented with the [TweetNaCl.js](https://tweetnacl.js.org/#/) library which has been well-audited and recommended for use by cybersecurity firm Cure53. Lastly, the secure remote password (SRP) implementation uses [jsrp](https://github.com/alax/jsrp) package for user authentication. As part of our commitment to user privacy and security, we aim to conduct formal security and compliance audits in the following year.
## Scope
Infisical's security model spans sensitive data stored on the server-side and in transit between user devices; it makes no security guarantees for malicious events that can occur beyond its control such as user-device security exploits or key-logging arising from poor cybersecurity management on the users’ behalf.
## Lingo
In subsequent sections, we refer:
- To users uploading their secrets to Infisical as “senders” and those receiving secrets as “receivers". For instance, if Bob and Alice are both enrolled in a project and Bob adds new secrets to the project to be pulled by Alice, then Bob is considered to be the sender and Alice the receiver.
- To any activity involving uploading or modifying secrets to Infisical as "pushing" and fetching secrets from Infisical as "pulling."

11
docs/getting-started/security/statement.mdx
View File

@@ -1,11 +0,0 @@
---
title: "Statement"
---
As a secrets manager, we are deeply committed to enforcing the privacy and security of all users and data on the platform but acknowledge that it is virtually impossible to guarantee perfect security; unfortunately, even the most secure systems have vulnerabilities.
As part of our commitment, we do our best to maintain platform privacy and security, notify users if anything goes wrong, and rectify adverse situations immediately if anything happens. As Infisical grows, we will be adding more opt-in security measures to ensure better data protection and maintain trust within the growing community. With that, let’s make the most simple and secure secrets management system out there!
Best,
Infisical Team