mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge remote-tracking branch 'origin' into aws-iam-auth
This commit is contained in:
Tuan Dang
82
docs/documentation/platform/audit-log-streams.mdx
Normal file
82
docs/documentation/platform/audit-log-streams.mdx
Normal file
@@ -0,0 +1,82 @@
|
||||
---
|
||||
title: "Audit Log Streams"
|
||||
description: "Learn how to stream Infisical Audit Logs to external logging providers."
|
||||
---
|
||||
|
||||
<Info>
|
||||
Audit log streams is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
Infisical Audit Log Streaming enables you to transmit your organization's Audit Logs to external logging providers for monitoring and analysis.
|
||||
|
||||
The logs are formatted in JSON, requiring your logging provider to support JSON-based log parsing.
|
||||
|
||||
|
||||
## Overview
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to Organization Settings in your sidebar." />
|
||||
<Step title="Select Audit Log Streams Tab.">
|
||||
|
||||
</Step>
|
||||
<Step title="Click on Create">
|
||||
|
||||
|
||||
Provide the following values
|
||||
<ParamField path="Endpoint URL" type="string" required>
|
||||
The HTTPS endpoint URL of the logging provider that collects the JSON stream.
|
||||
</ParamField>
|
||||
<ParamField path="Headers" type="string" >
|
||||
The HTTP headers for the logging provider for identification and authentication.
|
||||
</ParamField>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
Your Audit Logs are now ready to be streamed.
|
||||
|
||||
## Example Providers
|
||||
|
||||
### Better Stack
|
||||
|
||||
<Steps>
|
||||
<Step title="Select Connect Source">
|
||||
|
||||
</Step>
|
||||
<Step title="Provide a name and select platform"/>
|
||||
<Step title="Provide Audit Log Stream inputs">
|
||||
|
||||
|
||||
1. Copy the **endpoint** from Better Stack to the **Endpoint URL** field.
|
||||
3. Create a new header with key **Authorization** and set the value as **Bearer \<source token from betterstack\>**.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
### Datadog
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to API Keys section">
|
||||
|
||||
</Step>
|
||||
<Step title="Select New Key and provide a key name">
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Find your Datadog region specific logging endpoint.">
|
||||
|
||||
|
||||
1. Navigate to the [Datadog Send Logs API documentation](https://docs.datadoghq.com/api/latest/logs/?code-lang=curl&site=us5#send-logs).
|
||||
2. Pick your Datadog account region.
|
||||
3. Obtain your Datadog logging endpoint URL.
|
||||
</Step>
|
||||
<Step title="Provide audit log stream inputs">
|
||||
|
||||
|
||||
1. Copy the **logging endpoint** from Datadog to the **Endpoint URL** field.
|
||||
2. Copy the **API Key** from previous step
|
||||
3. Create a new header with key **DD-API-KEY** and set the value as **API Key**.
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -12,6 +12,10 @@ description: "Learn how to log in to Infisical with LDAP."
|
||||
|
||||
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- You must have an email address to use LDAP, regardless of whether or not you use that email address to sign in.
|
||||
|
||||
<Steps>
|
||||
<Step title="Prepare the LDAP configuration in Infisical">
|
||||
In Infisical, head to your Organization Settings > Security > LDAP and select **Manage**.
|
||||
|
||||
@@ -10,6 +10,10 @@ description: "Learn how to configure JumpCloud LDAP for authenticating into Infi
|
||||
it.
|
||||
</Info>
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- You must have an email address to use LDAP, regardless of whether or not you use that email address to sign in.
|
||||
|
||||
<Steps>
|
||||
<Step title="Prepare LDAP in JumpCloud">
|
||||
In JumpCloud, head to USER MANAGEMENT > Users and create a new user via the **Manual user entry** option. This user
|
||||
|
||||
@@ -3,11 +3,13 @@ title: "LDAP Overview"
|
||||
sidebarTitle: "Overview"
|
||||
description: "Learn how to authenticate into Infisical with LDAP."
|
||||
---
|
||||
|
||||
<Info>
|
||||
LDAP is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
||||
|
||||
</Info>
|
||||
|
||||
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol).
|
||||
@@ -25,3 +27,18 @@ Read the general instructions for configuring LDAP [here](/documentation/platfor
|
||||
|
||||
If the documentation for your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance.
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why does Infisical require additional email verification for users connected via LDAP?">
|
||||
By default, Infisical Cloud is configured to not trust emails from external
|
||||
identity providers to prevent any malicious account takeover attempts via
|
||||
email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
|
||||
through an external identity provider and requires an additional email
|
||||
verification step upon their first login.
|
||||
|
||||
If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
|
||||
you can configure this behavior in the admin panel.
|
||||
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -4,10 +4,10 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
---
|
||||
|
||||
<Info>
|
||||
Okta SAML SSO is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
||||
Okta SAML SSO is a paid feature. If you're using Infisical Cloud, then it is
|
||||
available under the **Pro Tier**. If you're self-hosting Infisical, then you
|
||||
should contact sales@infisical.com to purchase an enterprise license to use
|
||||
it.
|
||||
</Info>
|
||||
|
||||
<Steps>
|
||||
@@ -22,24 +22,24 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
button.
|
||||
|
||||
|
||||
|
||||
|
||||
In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
|
||||
|
||||
|
||||
|
||||
|
||||
On the General Settings screen, give the application a unique name like Infisical and select **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
|
||||
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
If you're self-hosting Infisical, then you will want to replace
|
||||
`https://app.infisical.com` with your own domain.
|
||||
</Note>
|
||||
|
||||
|
||||
Also on the Configure SAML screen, configure the **Attribute Statements** to map:
|
||||
|
||||
- `id -> user.id`,
|
||||
@@ -50,6 +50,7 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
|
||||
|
||||
Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
|
||||
|
||||
</Step>
|
||||
<Step title="Retrieve Identity Provider (IdP) Information from Okta">
|
||||
Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
|
||||
@@ -59,12 +60,14 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Finish configuring SAML in Infisical">
|
||||
Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
|
||||
and **Certificate** to **X.509 Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Assign users in Okta to the application">
|
||||
Back in Okta, navigate to the **Assignments** tab and select **Assign**. You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
|
||||
@@ -72,11 +75,13 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
|
||||
|
||||
At this point, you have configured everything you need within the context of the Okta Admin Portal.
|
||||
|
||||
</Step>
|
||||
<Step title="Enable SAML SSO in Infisical">
|
||||
Enabling SAML SSO allows members in your organization to log into Infisical via Okta.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enforce SAML SSO in Infisical">
|
||||
Enforcing SAML SSO ensures that members in your organization can only access Infisical
|
||||
@@ -89,13 +94,15 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
We recommend ensuring that your account is provisioned the application in Okta
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Note>
|
||||
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
|
||||
set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
|
||||
|
||||
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
|
||||
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
If you're configuring SAML SSO on a self-hosted instance of Infisical, make
|
||||
sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
|
||||
work: - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
|
||||
can be a random 32-byte base64 string generated with `openssl rand -base64
|
||||
32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should
|
||||
be an absolute URL including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
|
||||
@@ -5,11 +5,12 @@ description: "Learn how to log in to Infisical via SSO protocols."
|
||||
---
|
||||
|
||||
<Info>
|
||||
Infisical offers Google SSO and GitHub SSO for free across both Infisical Cloud and Infisical Self-hosted.
|
||||
|
||||
Infisical also offers SAML SSO authentication but as paid features that can be unlocked on Infisical Cloud's **Pro** tier
|
||||
or via enterprise license on self-hosted instances of Infisical. On this front, we support industry-leading providers including
|
||||
Okta, Azure AD, and JumpCloud; with any questions, please reach out to team@infisical.com.
|
||||
Infisical offers Google SSO and GitHub SSO for free across both Infisical
|
||||
Cloud and Infisical Self-hosted. Infisical also offers SAML SSO authentication
|
||||
but as paid features that can be unlocked on Infisical Cloud's **Pro** tier or
|
||||
via enterprise license on self-hosted instances of Infisical. On this front,
|
||||
we support industry-leading providers including Okta, Azure AD, and JumpCloud;
|
||||
with any questions, please reach out to team@infisical.com.
|
||||
</Info>
|
||||
|
||||
You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
|
||||
@@ -31,3 +32,19 @@ Infisical supports these and many other identity providers:
|
||||
- [Google SAML](/documentation/platform/sso/google-saml)
|
||||
|
||||
If your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance.
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
|
||||
By default, Infisical Cloud is configured to not trust emails from external
|
||||
identity providers to prevent any malicious account takeover attempts via
|
||||
email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
|
||||
through an external identity provider and requires an additional email
|
||||
verification step upon their first login.
|
||||
|
||||
If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
|
||||
you can configure this behavior in the admin panel.
|
||||
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 126 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 257 KiB |
BIN
docs/images/platform/audit-log-streams/data-create-api-key.png
Normal file
BIN
docs/images/platform/audit-log-streams/data-create-api-key.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
BIN
docs/images/platform/audit-log-streams/data-dog-api-key.png
Normal file
BIN
docs/images/platform/audit-log-streams/data-dog-api-key.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 61 KiB |
BIN
docs/images/platform/audit-log-streams/datadog-api-sidebar.png
Normal file
BIN
docs/images/platform/audit-log-streams/datadog-api-sidebar.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 119 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 74 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
BIN
docs/images/platform/audit-log-streams/stream-create.png
Normal file
BIN
docs/images/platform/audit-log-streams/stream-create.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 361 KiB |
BIN
docs/images/platform/audit-log-streams/stream-inputs.png
Normal file
BIN
docs/images/platform/audit-log-streams/stream-inputs.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
docs/images/platform/audit-log-streams/stream-list.png
Normal file
BIN
docs/images/platform/audit-log-streams/stream-list.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 112 KiB |
@@ -143,7 +143,8 @@
|
||||
"documentation/platform/dynamic-secrets/aws-iam"
|
||||
]
|
||||
},
|
||||
"documentation/platform/groups"
|
||||
"documentation/platform/groups",
|
||||
"documentation/platform/audit-log-streams"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -3,30 +3,34 @@ title: "Configurations"
|
||||
description: "Read how to configure environment variables for self-hosted Infisical."
|
||||
---
|
||||
|
||||
|
||||
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined.
|
||||
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined.
|
||||
However, you can configure additional settings to activate more features as needed.
|
||||
|
||||
## General platform
|
||||
## General platform
|
||||
|
||||
Used to configure platform-specific security and operational settings
|
||||
|
||||
<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
|
||||
Must be a random 16 byte hex string. Can be generated with `openssl rand -hex
|
||||
16`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="AUTH_SECRET" type="string" default="none" required>
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
|
||||
Must be a random 32 byte base64 string. Can be generated with `openssl rand
|
||||
-base64 32`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SITE_URL" type="string" default="none" optional>
|
||||
Must be an absolute URL including the protocol (e.g. https://app.infisical.com).
|
||||
Must be an absolute URL including the protocol (e.g.
|
||||
https://app.infisical.com).
|
||||
</ParamField>
|
||||
|
||||
## Data Layer
|
||||
## Data Layer
|
||||
|
||||
The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
|
||||
Postgres database connection string.
|
||||
Postgres database connection string.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
@@ -39,9 +43,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
Redis connection string.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
## Email service
|
||||
|
||||
Without email configuration, Infisical's core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
|
||||
|
||||
<Accordion title="Generic Configuration">
|
||||
@@ -49,25 +52,36 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
Hostname to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
<ParamField query="SMTP_USERNAME" type="string" default="none" optional>
|
||||
Credential to connect to host (e.g. team@infisical.com)
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
|
||||
</ParamField>
|
||||
<ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
|
||||
Credential to connect to host
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_PORT" type="string" default="587" optional>
|
||||
Port to connect to for establishing SMTP connections
|
||||
</ParamField>
|
||||
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_SECURE" type="string" default="none" optional>
|
||||
If true, use TLS when connecting to host. If false, TLS will be used if
|
||||
STARTTLS is supported
|
||||
</ParamField>
|
||||
|
||||
{" "}
|
||||
|
||||
<ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
|
||||
Email address to be used for sending emails
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
|
||||
Name label to be used in From field (e.g. Team)
|
||||
@@ -76,25 +90,25 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
|
||||
<Accordion title="Twilio SendGrid">
|
||||
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
|
||||
2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
|
||||
3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
4. With the API Key, you can now set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.sendgrid.net
|
||||
SMTP_USERNAME=apikey
|
||||
SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
@@ -105,19 +119,20 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
|
||||
2. Obtain your Mailgun credentials in Sending > Overview > SMTP
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
3. With your Mailgun credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.mailgun.org # obtained from credentials page
|
||||
SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
|
||||
SMTP_PASSWORD=password # obtained from credentials page
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="AWS SES">
|
||||
@@ -149,6 +164,7 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Step>
|
||||
|
||||
</Steps>
|
||||
|
||||
<Info>
|
||||
@@ -160,30 +176,32 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
|
||||
2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.socketlabs.com
|
||||
SMTP_USERNAME=username # obtained from your credentials
|
||||
SMTP_PASSWORD=password # obtained from your credentials
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
{" "}
|
||||
|
||||
|
||||
<Note>
|
||||
The `SMTP_FROM_ADDRESS` environment variable should be an email for an
|
||||
authenticated domain under Configuration > Domain Management in SocketLabs.
|
||||
For example, if you're using SocketLabs in sandbox mode, then you may use an
|
||||
email like `team@sandbox.socketlabs.dev`.
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
@@ -194,55 +212,57 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
1. Create an account on [Resend](https://resend.com).
|
||||
2. Add a [Domain](https://resend.com/domains).
|
||||
|
||||
|
||||
|
||||
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
3. Create an [API Key](https://resend.com/api-keys).
|
||||
|
||||
|
||||
|
||||
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
|
||||
|
||||
|
||||
|
||||
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
5. With the API Key, you can now set your SMTP environment variables variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.resend.com
|
||||
SMTP_USERNAME=resend
|
||||
SMTP_PASSWORD=YOUR_API_KEY
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Gmail">
|
||||
Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
|
||||
applications like Infisical to authenticate with Gmail via your username and password.
|
||||
|
||||
|
||||
|
||||
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
With your Gmail username and password, you can set your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.gmail.com
|
||||
SMTP_USERNAME=hey@gmail.com # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@gmail.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Warning>
|
||||
As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
|
||||
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
|
||||
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
|
||||
|
||||
</Warning>
|
||||
</Accordion>
|
||||
@@ -250,51 +270,51 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
<Accordion title="Office365">
|
||||
1. Create an account and configure [Office365](https://www.office.com/) to send emails.
|
||||
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
2. With your login credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.office365.com
|
||||
SMTP_USERNAME=username@yourdomain.com # your username
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=username@yourdomain.com
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Zoho Mail">
|
||||
1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
|
||||
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
2. With your email credentials, you can now set up your SMTP environment variables:
|
||||
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
```
|
||||
SMTP_HOST=smtp.zoho.com
|
||||
SMTP_USERNAME=username # your email
|
||||
SMTP_PASSWORD=password # your password
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=true
|
||||
SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
|
||||
SMTP_FROM_NAME=Infisical
|
||||
```
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
{" "}
|
||||
|
||||
<Note>
|
||||
You can use either your personal Zoho email address like `you@zohomail.com` or
|
||||
a domain-based email address like `you@yourdomain.com`. If using a
|
||||
domain-based email address, then please make sure that you've configured and
|
||||
verified it with Zoho Mail.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
Remember that you will need to restart Infisical for this to work properly.
|
||||
</Info>
|
||||
</Accordion>
|
||||
|
||||
## Authentication
|
||||
|
||||
|
||||
|
||||
|
||||
## SSO based login
|
||||
By default, users can only login via email/password based login method.
|
||||
To login into Infisical with OAuth providers such as Google, configure the associated variables.
|
||||
|
||||
@@ -335,33 +355,39 @@ To login into Infisical with OAuth providers such as Google, configure the assoc
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Okta SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Azure SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="JumpCloud SAML">
|
||||
Requires enterprise license. Please contact team@infisical.com to get more information.
|
||||
Requires enterprise license. Please contact team@infisical.com to get more
|
||||
information.
|
||||
</Accordion>
|
||||
|
||||
<ParamField query="NEXT_PUBLIC_SAML_ORG_SLUG" type="string">
|
||||
Configure SAML organization slug to automatically redirect all users of your Infisical instance to the identity provider.
|
||||
Configure SAML organization slug to automatically redirect all users of your
|
||||
Infisical instance to the identity provider.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Native secret integrations
|
||||
|
||||
To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
|
||||
|
||||
<Accordion title="Heroku">
|
||||
<ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
|
||||
OAuth2 client ID for Heroku integration
|
||||
</ParamField>
|
||||
<ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
|
||||
<ParamField
|
||||
query="CLIENT_SECRET_HEROKU"
|
||||
type="string"
|
||||
default="none"
|
||||
optional
|
||||
>
|
||||
OAuth2 client secret for Heroku integration
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
@@ -371,9 +397,11 @@ To help you sync secrets from Infisical to services such as Github and Gitlab, I
|
||||
OAuth2 client ID for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
{" "}
|
||||
|
||||
<ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 client secret for Vercel integration
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
|
||||
OAuth2 slug for Vercel integration
|
||||
|
||||
@@ -2,8 +2,7 @@
|
||||
title: "Docker Compose"
|
||||
description: "Read how to run Infisical with Docker Compose template."
|
||||
---
|
||||
Install Infisical using Docker compose. This self hosting method contains all of the required components needed
|
||||
to run a functional instance of Infisical.
|
||||
This self hosting guide will walk you though the steps to self host Infisical using Docker compose.
|
||||
|
||||
## Prerequisites
|
||||
- [Docker](https://docs.docker.com/engine/install/)
|
||||
@@ -80,4 +79,4 @@ docker-compose -f docker-compose.prod.yml up
|
||||
|
||||
Your Infisical instance should now be running on port `80`. To access your instance, visit `http://localhost:80`.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -84,7 +84,7 @@ The [Docker stack file](https://github.com/Infisical/infisical/tree/main/docker-
|
||||
<Steps>
|
||||
<Step title="Initialize Docker Swarm on one of the VMs by running the following command">
|
||||
```
|
||||
docker swarm init --advertise-addr <MANAGER_NODE_IP>
|
||||
docker swarm init
|
||||
```
|
||||
|
||||
Replace `<MANAGER_NODE_IP>` with the IP address of the VM that will serve as the manager node. Remember to copy the join token returned by the this init command.
|
||||
|
||||
Reference in New Issue
Block a user