mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Fix merge conflicts
This commit is contained in:
Tuan Dang
@@ -4,7 +4,22 @@ title: "Changelog"
|
||||
|
||||
The changelog below reflects new product developments and updates on a monthly basis.
|
||||
|
||||
## January 2024
|
||||
## Feb 2024
|
||||
- Added org-scoped authentication enforcement for SAML
|
||||
- Added support for [SCIM](https://infisical.com/docs/documentation/platform/scim/overview) along with instructions for setting it up with [Okta](https://infisical.com/docs/documentation/platform/scim/okta), [Azure](https://infisical.com/docs/documentation/platform/scim/azure), and [JumpCloud](https://infisical.com/docs/documentation/platform/scim/jumpcloud).
|
||||
- Pushed out project update for non-E2EE w/ new endpoints like for project creation and member invitation.
|
||||
- Added API Integration testing for new backend.
|
||||
- Added capability to create projects in Terraform.
|
||||
- Added slug-based capabilities to both organizations and projects to gradually make the API more developer-friendly moving forward.
|
||||
- Fixed + improved various analytics/telemetry-related items.
|
||||
- Fixed various issues associated with the Python SDK: build during installation on Mac OS, Rust dependency.
|
||||
- Updated self-hosting documentation to reflect [new backend](https://infisical.com/docs/self-hosting/overview).
|
||||
- Released [Postgres-based Infisical helm chart](https://cloudsmith.io/~infisical/repos/helm-charts/packages/detail/helm/infisical-standalone/).
|
||||
- Added checks to ensure that breaking API changes don't get released.
|
||||
- Automated API reference documentation to be inline with latest releases of Infisical.
|
||||
|
||||
## Jan 2024
|
||||
- Completed Postgres migration initiative with restructed Fastify-based backend.
|
||||
- Reduced size of Infisical Node.js SDK by ≈90%.
|
||||
- Added secret fallback support to all SDK's.
|
||||
- Added Machine Identity support to [Terraform Provider](https://github.com/Infisical/terraform-provider-infisical).
|
||||
@@ -12,21 +27,21 @@ The changelog below reflects new product developments and updates on a monthly b
|
||||
- Added symmetric encryption support to all SDK's.
|
||||
- Fixed secret reminders bug, where reminders were not being updated correctly.
|
||||
|
||||
## December 2023
|
||||
## Dec 2023
|
||||
|
||||
- Released [(machine) identities](https://infisical.com/docs/documentation/platform/identities/overview) and [universal auth](https://infisical.com/docs/documentation/platform/identities/universal-auth) features.
|
||||
- Created new cross-language SDKs for [Python](https://infisical.com/docs/sdks/languages/python), [Node](https://infisical.com/docs/sdks/languages/node), and [Java](https://infisical.com/docs/sdks/languages/java).
|
||||
- Released first version of the [Infisical Agent](https://infisical.com/docs/infisical-agent/overview)
|
||||
- Added ability to [manage folders via CLI](https://infisical.com/docs/cli/commands/secrets).
|
||||
|
||||
## November 2023
|
||||
## Nov 2023
|
||||
|
||||
- Replaced internal [Winston](https://github.com/winstonjs/winston) with [Pino](https://github.com/pinojs/pino) logging library with external logging to AWS CloudWatch
|
||||
- Added admin panel to self-hosting experience.
|
||||
- Released [secret rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview) feature with preliminary support for rotating [SendGrid](https://infisical.com/docs/documentation/platform/secret-rotation/sendgrid), [PostgreSQL/CockroachDB](https://infisical.com/docs/documentation/platform/secret-rotation/postgres), and [MySQL/MariaDB](https://infisical.com/docs/documentation/platform/secret-rotation/mysql) credentials.
|
||||
- Released secret reminders feature.
|
||||
|
||||
## October 2023
|
||||
## Oct 2023
|
||||
|
||||
- Added support for [GitLab SSO](https://infisical.com/docs/documentation/platform/sso/gitlab).
|
||||
- Became SOC 2 (Type II) certified.
|
||||
@@ -35,7 +50,7 @@ The changelog below reflects new product developments and updates on a monthly b
|
||||
- Added native [Hasura Cloud integration](https://infisical.com/docs/integrations/cloud/hasura-cloud).
|
||||
- Updated resource deletion logic for user, organization, and project deletion.
|
||||
|
||||
## September 2023
|
||||
## Sep 2023
|
||||
|
||||
- Released [secret approvals](https://infisical.com/docs/documentation/platform/pr-workflows) feature.
|
||||
- Released an update to access controls; every user role now clearly defines and enforces a certain set of conditions across Infisical.
|
||||
@@ -43,7 +58,7 @@ The changelog below reflects new product developments and updates on a monthly b
|
||||
- Added a native integration with [Qovery](https://infisical.com/docs/integrations/cloud/qovery).
|
||||
- Added service token generation capability for the CLI.
|
||||
|
||||
## August 2023
|
||||
## Aug 2023
|
||||
|
||||
- Release Audit Logs V2.
|
||||
- Add support for [GitHub SSO](https://infisical.com/docs/documentation/platform/sso/github).
|
||||
@@ -171,7 +186,7 @@ The changelog below reflects new product developments and updates on a monthly b
|
||||
- Added sorting capability to sort keys by name alphabetically in dashboard.
|
||||
- Added downloading secrets back as `.env` file capability.
|
||||
|
||||
## August 2022
|
||||
## Aug 2022
|
||||
|
||||
- Released first version of the Infisical platform with push/pull capability and end-to-end encryption.
|
||||
- Improved security handling of authentication tokens by storing refresh tokens in HttpOnly cookies.
|
||||
|
||||
@@ -16,49 +16,7 @@ git checkout -b MY_BRANCH_NAME
|
||||
## Set up environment variables
|
||||
|
||||
|
||||
Start by creating a .env file at the root of the Infisical directory then copy the contents of the file below into the .env file.
|
||||
|
||||
<Accordion title=".env file content">
|
||||
```env
|
||||
# Keys
|
||||
# Required key for platform encryption/decryption ops
|
||||
ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
|
||||
|
||||
# JWT
|
||||
# Required secrets to sign JWT tokens
|
||||
JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
|
||||
JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
|
||||
JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
|
||||
JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
|
||||
|
||||
# MongoDB
|
||||
# Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
|
||||
# to the MongoDB container instance or Mongo Cloud
|
||||
# Required
|
||||
MONGO_URL=mongodb://root:example@mongo:27017/?authSource=admin
|
||||
|
||||
# Optional credentials for MongoDB container instance and Mongo-Express
|
||||
MONGO_USERNAME=root
|
||||
MONGO_PASSWORD=example
|
||||
|
||||
# Website URL
|
||||
# Required
|
||||
SITE_URL=http://localhost:8080
|
||||
|
||||
# Mail/SMTP
|
||||
SMTP_HOST='smtp-server'
|
||||
SMTP_PORT='1025'
|
||||
SMTP_NAME='local'
|
||||
SMTP_USERNAME='team@infisical.com'
|
||||
SMTP_PASSWORD=
|
||||
```
|
||||
</Accordion>
|
||||
|
||||
<Warning>
|
||||
The pre-populated environment variable values above are meant to be used in development only. They should never be used in production.
|
||||
</Warning>
|
||||
|
||||
View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
|
||||
Start by creating a .env file at the root of the Infisical directory then copy the contents of the file linked [here](https://github.com/Infisical/infisical/blob/main/.env.example). View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
|
||||
|
||||
## Starting Infisical for development
|
||||
|
||||
@@ -72,10 +30,7 @@ docker-compose -f docker-compose.dev.yml up --build --force-recreate
|
||||
```
|
||||
#### Access local server
|
||||
|
||||
Once all the services have spun up, browse to http://localhost:8080. To sign in, you may use the default credentials listed below.
|
||||
|
||||
Email: `test@localhost.local`
|
||||
Password: `testInfisical1`
|
||||
Once all the services have spun up, browse to http://localhost:8080.
|
||||
|
||||
#### Shutdown local server
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
title: "Introduction"
|
||||
---
|
||||
|
||||
Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secret management platform for storing, managing, and syncing
|
||||
Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secrets management platform for storing, managing, and syncing
|
||||
application configuration and secrets like API keys, database credentials, and environment variables across applications and infrastructure.
|
||||
|
||||
Start syncing environment variables with [Infisical Cloud](https://app.infisical.com) or learn how to [host Infisical](/self-hosting/overview) yourself.
|
||||
|
||||
@@ -5,7 +5,6 @@ description: "Log in to Infisical with LDAP"
|
||||
|
||||
<Info>
|
||||
LDAP is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
@@ -15,11 +14,11 @@ You can configure your organization in Infisical to have members authenticate wi
|
||||
<Steps>
|
||||
<Step title="Prepare the LDAP configuration in Infisical">
|
||||
In Infisical, head to your Organization Settings > Authentication > LDAP Configuration and select **Set up LDAP**.
|
||||
|
||||
|
||||
Next, input your LDAP server settings.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Here's some guidance for each field:
|
||||
|
||||
- URL: The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.
|
||||
@@ -30,7 +29,6 @@ You can configure your organization in Infisical to have members authenticate wi
|
||||
</Step>
|
||||
<Step title="Enable LDAP in Infisical">
|
||||
Enabling LDAP allows members in your organization to log into Infisical via LDAP.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -5,7 +5,6 @@ description: "Configure JumpCloud LDAP for Logging into Infisical"
|
||||
|
||||
<Info>
|
||||
LDAP is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
@@ -14,24 +13,24 @@ description: "Configure JumpCloud LDAP for Logging into Infisical"
|
||||
<Step title="Prepare LDAP in JumpCloud">
|
||||
In JumpCloud, head to USER MANAGEMENT > Users and create a new user via the **Manual user entry** option. This user
|
||||
will be used as a privileged service account to facilitate Infisical's ability to bind/search the LDAP directory.
|
||||
|
||||
|
||||
When creating the user, input their **First Name**, **Last Name**, **Username** (required), **Company Email** (required), and **Description**.
|
||||
Also, create a password for the user.
|
||||
|
||||
|
||||
Next, under User Security Settings and Permissions > Permission Settings, check the box next to **Enable as LDAP Bind DN**.
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Prepare the LDAP configuration in Infisical">
|
||||
In Infisical, head to your Organization Settings > Authentication > LDAP Configuration and select **Set up LDAP**.
|
||||
|
||||
|
||||
Next, input your JumpCloud LDAP server settings.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Here's some guidance for each field:
|
||||
|
||||
|
||||
- URL: The LDAP server to connect to (`ldaps://ldap.jumpcloud.com:636`).
|
||||
- Bind DN: The distinguished name of object to bind when performing the user search (`uid=<ldap-user-username>,ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
|
||||
- Bind Pass: The password to use along with `Bind DN` when performing the user search.
|
||||
@@ -47,7 +46,6 @@ description: "Configure JumpCloud LDAP for Logging into Infisical"
|
||||
</Step>
|
||||
<Step title="Enable LDAP in Infisical">
|
||||
Enabling LDAP allows members in your organization to log into Infisical via LDAP.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
@@ -4,9 +4,9 @@ description: "Log in to Infisical with LDAP"
|
||||
---
|
||||
<Info>
|
||||
LDAP is a paid feature.
|
||||
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
then you should contact sales@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)
|
||||
@@ -20,4 +20,4 @@ LDAP providers:
|
||||
- AWS Directory Service
|
||||
- Foxpass
|
||||
|
||||
Check out the general instructions for configuring LDAP [here](/documentation/platform/ldap/general).
|
||||
Check out the general instructions for configuring LDAP [here](/documentation/platform/ldap/general).
|
||||
|
||||
20
docs/documentation/platform/project-upgrade.mdx
Normal file
20
docs/documentation/platform/project-upgrade.mdx
Normal file
@@ -0,0 +1,20 @@
|
||||
---
|
||||
title: "Enhancing Security and Usability: Project Upgrades"
|
||||
---
|
||||
|
||||
At Infisical, we're constantly striving to elevate the security and usability standards of our platform to better serve our users.
|
||||
With this commitment in mind, we're excited to introduce our latest addition, non-E2EE projects, aimed at addressing two significant issues while enhancing how clients interact with Infisical programmatically.
|
||||
|
||||
Previously, users encountered a challenge where projects risked becoming inaccessible if the project creator deleted their account.
|
||||
Additionally, our API lacked the capability to interact with projects without dealing with complex cryptographic operations.
|
||||
These obstacles made API driven automation and collaboration a painful experience for a majority of our users.
|
||||
|
||||
To overcome these limitations, our upgrade focuses on disabling end-to-end encryption (E2EE) for projects.
|
||||
While this may raise eyebrows, it's important to understand that this decision is a strategic move to make Infisical easier to use and interact with.
|
||||
|
||||
But what does this mean for our users? Essentially nothing, there are no changes required on your end.
|
||||
Rest assured, all sensitive data remains encrypted at rest according to the latest industry standards.
|
||||
Our commitment to security remains unwavering, and this upgrade is a testament to our dedication to delivering on our promises in both security and usability when it comes to secrets management.
|
||||
|
||||
To increase consistency with existing and future integrations, all projects created on Infisical from now on will have end-to-end encryption (E2EE) disabled by default.
|
||||
This will not only reduce confusion for end users, but will also make the Infisical API seamless to use.
|
||||
@@ -1,21 +1,17 @@
|
||||
---
|
||||
title: "PostgreSQL/CockroachDB"
|
||||
description: "Rotated database user password of a postgreSQL or cockroach db"
|
||||
description: "Rotated database user password of a PostgreSQL or Cockroach DB"
|
||||
---
|
||||
|
||||
Infisical will update periodically the provided database user's password.
|
||||
|
||||
<Warning>
|
||||
At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud.
|
||||
</Warning>
|
||||
|
||||
## Working
|
||||
|
||||
1. User's has to create the two user's for Infisical to rotate and provide them required database access
|
||||
2. Infisical will connect with your database with admin access
|
||||
3. If last rotated one was username1, then username2 is chosen to be rotated
|
||||
5. Update it's password with random value
|
||||
6. After testing it gets saved to the provided secret mapping
|
||||
1. User's has to create the two user's for Infisical to rotate and provide them required database access.
|
||||
2. Infisical will connect with your database with admin access.
|
||||
3. If last rotated one was username1, then username2 is chosen to be rotated.
|
||||
5. Update it's password with random value.
|
||||
6. After testing it gets saved to the provided secret mapping.
|
||||
|
||||
## Rotation Configuration
|
||||
|
||||
@@ -34,4 +30,4 @@ Infisical will update periodically the provided database user's password.
|
||||
- Finally select the secrets in your provided board to replace with new secret after each rotation
|
||||
- Your done and good to go.
|
||||
|
||||
Congrats. You have 10x your PostgreSQL/CockroachDB access security.
|
||||
Congratulations. You have improved your PostgreSQL/CockroachDB access security.
|
||||
|
||||
95
docs/documentation/platform/sso/google-saml.mdx
Normal file
95
docs/documentation/platform/sso/google-saml.mdx
Normal file
@@ -0,0 +1,95 @@
|
||||
---
|
||||
title: "Google SAML"
|
||||
description: "Configure Google SAML for Infisical SSO"
|
||||
---
|
||||
|
||||
<Info>
|
||||
Google SAML SSO feature is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact team@infisical.com to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
<Steps>
|
||||
<Step title="Prepare the SAML SSO configuration in Infisical">
|
||||
In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
|
||||
|
||||
Next, note the **ACS URL** and **SP Entity ID** to use when configuring the Google SAML application.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Create a SAML application in Google">
|
||||
2.1. In your [Google Admin console](https://support.google.com/a/answer/182076), head to Menu > Apps > Web and mobile apps and
|
||||
create a **custom SAML app**.
|
||||
|
||||
|
||||
|
||||
2.2. In the **App details** tab, give the application a unique name like Infisical.
|
||||
|
||||
|
||||
|
||||
2.3. In the **Google Identity Provider details** tab, copy the **SSO URL**, **Entity ID** and **Certificate**.
|
||||
|
||||
|
||||
|
||||
2.4. Back in Infisical, set **SSO URL**, **IdP Entity ID**, and **Certificate** to the corresponding items from step 2.3.
|
||||
|
||||
|
||||
|
||||
2.5. Back in the Google Admin console, in the **Service provider details** tab, set the **ACS URL** and **Entity ID** to the corresponding items from step 1.
|
||||
|
||||
Also, check the **Signed response** checkbox.
|
||||
|
||||
|
||||
|
||||
2.6. In the **Attribute mapping** tab, configure the following map:
|
||||
|
||||
- **First name** -> **firstName**
|
||||
- **Last name** -> **lastName**
|
||||
- **Primary email** -> **email**
|
||||
|
||||
|
||||
|
||||
Click **Finish**.
|
||||
</Step>
|
||||
<Step title="Assign users in Google Workspace to the application">
|
||||
Back in your [Google Admin console](https://support.google.com/a/answer/182076), head to Menu > Apps > Web and mobile apps > your SAML app
|
||||
and press on **User access**.
|
||||
|
||||
|
||||
|
||||
To assign everyone in your organization to the application, click **On for everyone** or **Off for everyone** and then click **Save**.
|
||||
|
||||
You can also assign an organizational unit or set of users to an application; you can learn more about that [here](https://support.google.com/a/answer/6087519?hl=en#add_custom_saml&turn_on&verify_sso&&zippy=%2Cstep-add-the-custom-saml-app%2Cstep-turn-on-your-saml-app%2Cstep-verify-that-sso-is-working-with-your-custom-app).
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enable SAML SSO in Infisical">
|
||||
Enabling SAML SSO allows members in your organization to log into Infisical via Google Workspace.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enforce SAML SSO in Infisical">
|
||||
Enforcing SAML SSO ensures that members in your organization can only access Infisical
|
||||
by logging into the organization via Google.
|
||||
|
||||
To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Google user with Infisical;
|
||||
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
|
||||
|
||||
<Warning>
|
||||
We recommend ensuring that your account is provisioned the application in Google
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Note>
|
||||
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
|
||||
set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
|
||||
|
||||
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
|
||||
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
|
||||
References:
|
||||
- Google's guide to [set up your own custom SAML app](https://support.google.com/a/answer/6087519?hl=en#add_custom_saml&turn_on&verify_sso&&zippy=%2Cstep-add-the-custom-saml-app%2Cstep-turn-on-your-saml-app%2Cstep-verify-that-sso-is-working-with-your-custom-app).
|
||||
@@ -22,3 +22,4 @@ your IdP cannot and will not have access to the decryption key needed to decrypt
|
||||
- [Okta SAML](/documentation/platform/sso/okta)
|
||||
- [Azure SAML](/documentation/platform/sso/azure)
|
||||
- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
|
||||
- [Google SAML](/documentation/platform/sso/google-saml)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB After Width: | Height: | Size: 332 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
BIN
docs/images/sso/google-saml/attribute-mapping.png
Normal file
BIN
docs/images/sso/google-saml/attribute-mapping.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 236 KiB |
BIN
docs/images/sso/google-saml/create-custom-saml-app.png
Normal file
BIN
docs/images/sso/google-saml/create-custom-saml-app.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 258 KiB |
BIN
docs/images/sso/google-saml/custom-saml-app-config-2.png
Normal file
BIN
docs/images/sso/google-saml/custom-saml-app-config-2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 221 KiB |
BIN
docs/images/sso/google-saml/custom-saml-app-config.png
Normal file
BIN
docs/images/sso/google-saml/custom-saml-app-config.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 279 KiB |
BIN
docs/images/sso/google-saml/enable-saml.png
Normal file
BIN
docs/images/sso/google-saml/enable-saml.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 584 KiB |
BIN
docs/images/sso/google-saml/infisical-config.png
Normal file
BIN
docs/images/sso/google-saml/infisical-config.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 605 KiB |
BIN
docs/images/sso/google-saml/init-config.png
Normal file
BIN
docs/images/sso/google-saml/init-config.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 524 KiB |
BIN
docs/images/sso/google-saml/name-custom-saml-app.png
Normal file
BIN
docs/images/sso/google-saml/name-custom-saml-app.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 205 KiB |
BIN
docs/images/sso/google-saml/user-access-assign.png
Normal file
BIN
docs/images/sso/google-saml/user-access-assign.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 324 KiB |
BIN
docs/images/sso/google-saml/user-access.png
Normal file
BIN
docs/images/sso/google-saml/user-access.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 371 KiB |
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Infisical Agent"
|
||||
title: "Overview"
|
||||
---
|
||||
|
||||
Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
|
||||
@@ -51,6 +51,9 @@ While specifying an authentication method is mandatory to start the agent, confi
|
||||
| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. |
|
||||
| `templates[].source-path` | The path to the template file that should be used to render secrets. |
|
||||
| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
|
||||
| `templates[].config.polling-interval` | How frequently to check for secret changes. Default: `60s` (optional) |
|
||||
| `templates[].config.execute.command` | The command to execute when secret change is detected (optional) |
|
||||
| `templates[].config.execute.timeout` | How long in seconds to wait for command to execute before timing out (optional) |
|
||||
|
||||
|
||||
## Quick start Infisical Agent
|
||||
@@ -76,6 +79,11 @@ sinks:
|
||||
templates:
|
||||
- source-path: my-dot-ev-secret-template
|
||||
destination-path: /some/path/.env
|
||||
config:
|
||||
polling-interval: 60s
|
||||
execute:
|
||||
timeout: 30
|
||||
command: ./reload-app.sh
|
||||
```
|
||||
|
||||
Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template.
|
||||
|
||||
@@ -1,25 +1,25 @@
|
||||
---
|
||||
title: "Docker"
|
||||
description: "Learn how to feed secrets from Infisical into your docker application"
|
||||
description: "Learn how to feed secrets from Infisical into your Docker application"
|
||||
---
|
||||
There are many methods to inject Infisical secrets to docker-based applications.
|
||||
Regardless of which method you choose, these methods will inject secrets from Infisical as environment variables into your Docker container.
|
||||
There are many methods to inject Infisical secrets into Docker-based applications.
|
||||
Regardless of the method you choose, they all inject secrets from Infisical as environment variables into your Docker container.
|
||||
|
||||
<Card title="Docker Entrypoint" color="#ea5a0c" href="./docker">
|
||||
Install and run your app start command with Infisical CLI
|
||||
</Card>
|
||||
<CardGroup cols={2}>
|
||||
<Card title="Docker run" color="#0285c7" href="./docker-pass-envs">
|
||||
Feed secrets via `--env-file` flag in docker run command
|
||||
Feed secrets with the `--env-file` flag when using the
|
||||
`docker run` command
|
||||
</Card>
|
||||
<Card title="Docker compose" color="#16a34a" href="./docker-compose">
|
||||
Inject secrets to multiple services using Docker Compose
|
||||
Inject secrets into multiple services using Docker Compose
|
||||
</Card>
|
||||
</CardGroup>
|
||||
|
||||
<Info>
|
||||
The main difference between the "Docker Entrypoint" and "Docker run" approach is where the Infisical CLI is installed.
|
||||
In most production settings, it's typically inconvenient to have the Infisical CLI installed and executed externally.
|
||||
As a result, we suggest using the "Docker Entrypoint" method for production purposes.
|
||||
In most production settings, it's typically less convenient to have the Infisical CLI installed and executed externally, so we suggest using the "Docker Entrypoint" method for production purposes.
|
||||
However, if this limitation doesn't apply to you, select the method that best fits your needs.
|
||||
</Info>
|
||||
@@ -9,9 +9,7 @@ The Infisical API (sometimes referred to as the **backend**) contains the core p
|
||||
|
||||
## Storage backend
|
||||
|
||||
Infisical relies on a storage backend to store data including users and secrets.
|
||||
|
||||
Currently, the only supported storage backend is [MongoDB](https://www.mongodb.com) but we plan to add support for other options including PostgreSQL in Q1 2024.
|
||||
Infisical relies on a storage backend to store data including users and secrets. Infisical's storage backend is Postgres.
|
||||
|
||||
## Redis
|
||||
|
||||
@@ -27,4 +25,4 @@ Clients are any application or infrastructure that connecting to the Infisical A
|
||||
- Public API: Making API requests directly to the Infisical API.
|
||||
- Client SDK: A platform-specific library with method abstractions for working with secrets. Currently, there are three official SDKs: [Node SDK](https://infisical.com/docs/sdks/languages/node), [Python SDK](https://infisical.com/docs/sdks/languages/python), and [Java SDK](https://infisical.com/docs/sdks/languages/java).
|
||||
- CLI: A terminal-based interface for interacting with the Infisical API.
|
||||
- Kubernetes Operator: This operator retrieves secrets from Infisical and securely store
|
||||
- Kubernetes Operator: This operator retrieves secrets from Infisical and securely store
|
||||
|
||||
@@ -146,10 +146,18 @@
|
||||
"documentation/platform/sso/gitlab",
|
||||
"documentation/platform/sso/okta",
|
||||
"documentation/platform/sso/azure",
|
||||
"documentation/platform/sso/jumpcloud"
|
||||
"documentation/platform/sso/jumpcloud",
|
||||
"documentation/platform/sso/google-saml"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "LDAP",
|
||||
"pages": [
|
||||
"documentation/platform/ldap/overview",
|
||||
"documentation/platform/ldap/jumpcloud",
|
||||
"documentation/platform/ldap/general"
|
||||
]
|
||||
},
|
||||
"documentation/platform/ldap",
|
||||
{
|
||||
"group": "LDAP",
|
||||
"pages": [
|
||||
@@ -174,7 +182,6 @@
|
||||
"pages": [
|
||||
"self-hosting/overview",
|
||||
"self-hosting/configuration/requirements",
|
||||
"self-hosting/configuration/schema-migrations",
|
||||
{
|
||||
"group": "Installation methods",
|
||||
"pages": [
|
||||
@@ -184,6 +191,13 @@
|
||||
]
|
||||
},
|
||||
"self-hosting/configuration/envars",
|
||||
{
|
||||
"group": "Guides",
|
||||
"pages": [
|
||||
"self-hosting/configuration/schema-migrations",
|
||||
"self-hosting/guides/mongo-to-postgres"
|
||||
]
|
||||
},
|
||||
"self-hosting/faq"
|
||||
]
|
||||
},
|
||||
|
||||
@@ -58,7 +58,7 @@ Redis requirements:
|
||||
|
||||
- Use Redis versions 6.x or 7.x. We advise upgrading to at least Redis 6.2.
|
||||
- Redis Cluster mode is currently not supported; use Redis Standalone, with or without High Availability (HA).
|
||||
- Redis storage needs are minimal: a setup with 1 vCPU, 1 GB RAM, and 1GB SSD will be sufficient for most deployments.
|
||||
- Redis storage needs are minimal: a setup with 1 vCPU, 1 GB RAM, and 1GB SSD will be sufficient for small deployments.
|
||||
|
||||
## Supported Web Browsers
|
||||
|
||||
@@ -68,4 +68,4 @@ Infisical supports a range of web browsers. However, features such as browser-ba
|
||||
- [Google Chrome](https://www.google.com/chrome/)
|
||||
- [Chromium](https://www.chromium.org/getting-involved/dev-channel/)
|
||||
- [Apple Safari](https://www.apple.com/safari/)
|
||||
- [Microsoft Edge](https://www.microsoft.com/en-us/edge?form=MA13FJ)
|
||||
- [Microsoft Edge](https://www.microsoft.com/en-us/edge?form=MA13FJ)
|
||||
|
||||
@@ -46,27 +46,34 @@ description: "Use Helm chart to install Infisical on your Kubernetes cluster"
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Proof of concept deployment">
|
||||
For test or proof-of-concept purposes, you may omit `DB_CONNECTION_URI` and `REDIS_URL` from `infisical-secrets`. This is because the Helm chart will automatically provision and connect to the in-cluster instances of Postgres and Redis by default.
|
||||
|
||||
For test or proof-of-concept purposes, you may omit `DB_CONNECTION_URI` and `REDIS_URL` from `infisical-secrets`. This is because the Helm chart will automatically provision and connect to the in-cluster instances of Postgres and Redis by default.
|
||||
```yaml simple-values-example.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: infisical-secrets
|
||||
type: Opaque
|
||||
stringData:
|
||||
AUTH_SECRET: <>
|
||||
ENCRYPTION_KEY: <>
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Production deployment">
|
||||
For production environments, we recommend using Cloud-based Platform as a Service (PaaS) solutions for PostgreSQL and Redis to ensure high availability. In on-premise setups, it's recommended to configure Redis and Postgres for high availability, either by using Bitnami charts or a custom configuration.
|
||||
|
||||
```yaml simple-values-example.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: infisical-secrets
|
||||
type: Opaque
|
||||
stringData:
|
||||
AUTH_SECRET: <>
|
||||
ENCRYPTION_KEY: <>
|
||||
REDIS_URL: <>
|
||||
DB_CONNECTION_URI: <>
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
```yaml simple-values-example.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: infisical-secrets
|
||||
type: Opaque
|
||||
stringData:
|
||||
AUTH_SECRET: <>
|
||||
ENCRYPTION_KEY: <>
|
||||
REDIS_URL: <>
|
||||
DB_CONNECTION_URI: <>
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Database schema migration ">
|
||||
|
||||
@@ -15,3 +15,7 @@ However, in the event you choose to use Infisical without SSL, you can do so by
|
||||
[Learn more about secure cookies](https://really-simple-ssl.com/definition/what-are-secure-cookies/)
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="How can I upgrade my Infisical instance to Postgres version?">
|
||||
Follow the step by step guide [here](self-hosting/guides/mongo-to-postgres) to learn how.
|
||||
</Accordion>
|
||||
|
||||
|
||||
201
docs/self-hosting/guides/mongo-to-postgres.mdx
Normal file
201
docs/self-hosting/guides/mongo-to-postgres.mdx
Normal file
@@ -0,0 +1,201 @@
|
||||
---
|
||||
title: "Migrate Mongo to Postgres"
|
||||
description: "How to migrate from MongoDB to PostgreSQL for Infisical"
|
||||
---
|
||||
|
||||
This guide will provide step by step instructions on migrating your Infisical instance running on MongoDB to the newly released PostgreSQL version of Infisical.
|
||||
The newly released Postgres version of Infisical is the only version of Infisical that will receive feature updates and patches going forward.
|
||||
|
||||
<Tip>
|
||||
If you have a small set of secrets, we recommend you to download the secrets and upload them to your new instance of Infisical instead of running the migration script.
|
||||
</Tip>
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before starting the migration, ensure you have the following command line tools installed:
|
||||
|
||||
- [git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
|
||||
- [pg_dump](https://www.postgresql.org/docs/current/app-pgrestore.html)
|
||||
- [pg_restore](https://www.postgresql.org/docs/current/app-pgdump.html)
|
||||
- [mongodump](https://www.mongodb.com/docs/database-tools/mongodump/)
|
||||
- [mongorestore](https://www.mongodb.com/docs/database-tools/mongorestore/)
|
||||
- [Docker](https://docs.docker.com/engine/install/)
|
||||
|
||||
## Prepare for migration
|
||||
|
||||
<Steps>
|
||||
<Step title="Backup Production MongoDB Data">
|
||||
While the migration script will not mutate any MongoDB production data, we recommend you to take a backup of your MongoDB instance if possible.
|
||||
</Step>
|
||||
<Step title="Set Migration Mode">
|
||||
To prevent new data entries during the migration, set your Infisical instance to migration mode by setting the environment variable `MIGRATION_MODE=true` and redeploying your instance.
|
||||
This mode will block all write operations, only allowing GET requests. It also disables user logins and sets up a migration page to prevent UI interactions.
|
||||
|
||||
</Step>
|
||||
<Step title="Start local instances of Mongo and Postgres databases">
|
||||
Start local instances of MongoDB and Postgres. This will be used in later steps to process and transform the data locally.
|
||||
|
||||
To start local instances of the two databases, create a file called `docker-compose.yaml` as shown below.
|
||||
|
||||
```yaml docker-compose.yaml
|
||||
version: '3.1'
|
||||
|
||||
services:
|
||||
mongodb:
|
||||
image: mongo
|
||||
restart: always
|
||||
environment:
|
||||
MONGO_INITDB_ROOT_USERNAME: root
|
||||
MONGO_INITDB_ROOT_PASSWORD: example
|
||||
ports:
|
||||
- "27017:27017"
|
||||
volumes:
|
||||
- mongodb_data:/data/db
|
||||
|
||||
postgres:
|
||||
image: postgres
|
||||
restart: always
|
||||
environment:
|
||||
POSTGRES_PASSWORD: example
|
||||
ports:
|
||||
- "5432:5432"
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
|
||||
volumes:
|
||||
mongodb_data:
|
||||
postgres_data:
|
||||
```
|
||||
|
||||
Next, run the command below in the same working directory where the `docker-compose.yaml` file resides to start both services.
|
||||
|
||||
```
|
||||
docker-compose up
|
||||
```
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Dump MongoDB
|
||||
To speed up the data transformation process, the first step involves transferring the production data from Infisical's MongoDB to a local machine.
|
||||
This is achieved by creating a dump of the production database and then uploading this dumped data into a local Mongo instance.
|
||||
By having a running local instance of the production database, we will significantly reduce the time it takes to run the migration script.
|
||||
|
||||
<Steps>
|
||||
<Step title="Dump MongoDB data to your local machine using">
|
||||
|
||||
```
|
||||
mongodump --uri=<your_mongo_prod_uri> --archive="mongodump-db" --db=<db name> --excludeCollection=auditlogs
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Restore this data to the local MongoDB instance">
|
||||
```
|
||||
mongorestore --uri=mongodb://root:example@localhost:27017/ --archive="mongodump-db"
|
||||
```
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Start the migration
|
||||
|
||||
Once started, the migration script will transform MongoDB data into an equivalent PostgreSQL format.
|
||||
|
||||
<Steps>
|
||||
<Step title="Clone Infisical Repository">
|
||||
Clone the Infisical MongoDB repository.
|
||||
```
|
||||
git clone -b infisical/v0.46.11-postgres https://github.com/Infisical/infisical.git
|
||||
```
|
||||
</Step>
|
||||
<Step title="Install dependencies for backend">
|
||||
```
|
||||
cd backend
|
||||
```
|
||||
|
||||
```
|
||||
npm install
|
||||
```
|
||||
</Step>
|
||||
<Step title="Install dependencies for script">
|
||||
```
|
||||
cd pg-migrator
|
||||
```
|
||||
|
||||
```
|
||||
npm install
|
||||
```
|
||||
</Step>
|
||||
<Step title="Execute Migration Script">
|
||||
```
|
||||
npm run migration
|
||||
```
|
||||
|
||||
When executing the above command, you'll be asked to provide the MongoDB connection string for the database containing your production Infisical data. Since our production Mongo data is transferred to a local Mongo instance, you should input the connection string for this local instance.
|
||||
|
||||
```
|
||||
mongodb://root:example@localhost:27017/<db-name>?authSource=admin
|
||||
```
|
||||
|
||||
<Tip>
|
||||
Remember to replace `<db-name>` with the name of the MongoDB database. If you are not sure the name, you can use [Compass](https://www.mongodb.com/products/tools/compass) to view the available databases.
|
||||
</Tip>
|
||||
|
||||
|
||||
Next, you will be asked to enter the Postgres connection string for the database where the transformed data should be stored.
|
||||
Input the connection string of the local Postgres instance that was set up earlier in the guide.
|
||||
|
||||
```
|
||||
postgres://infisical:infisical@localhost/infisical?sslmode=disable
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Store migration metadata">
|
||||
Once the script has completed, you will notice a new folder has been created called `db` in the `pg-migrator` folder.
|
||||
This folder contains meta data for schema mapping and can be helpful when debugging migration related issues.
|
||||
We highly recommend you to make a copy of this folder in case you need assistance from the Infisical team during your migration process.
|
||||
|
||||
<Info>
|
||||
The `db` folder does not contain any sensitive data
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Finalizing Migration
|
||||
At this stage, the data from the Mongo instance of Infisical should have been successfully converted into its Postgres equivalent.
|
||||
The remaining step involves transferring the local Postgres database, which now contains all the migrated data, to your chosen production Postgres environment.
|
||||
Rather than transferring the data row-by-row from your local machine to the production Postgres database, we will first create a dump file from the local Postgres and then upload this file to your production Postgres instance.
|
||||
|
||||
<Steps>
|
||||
<Step title="Dump from local PostgreSQL">
|
||||
```
|
||||
pg_dump -h localhost -U infisical -Fc -b -v -f dumpfilelocation.sql -d infisical
|
||||
```
|
||||
</Step>
|
||||
<Step title="Upload to production PostgreSQL">
|
||||
```
|
||||
pg_restore --clean -v -h <host> -U <db-user-name> -d <database-name> -j 2 dumpfilelocation.sql
|
||||
```
|
||||
|
||||
<Tip>
|
||||
Remember to replace `<host>`, `<db-user-name>`, `<database-name>` with the corresponding details of your production Postgres database.
|
||||
</Tip>
|
||||
</Step>
|
||||
<Step title="Verify Data Upload">
|
||||
Use a tool like Beekeeper Studio to confirm that the data has been successfully transferred to your production Postgres DB.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Post-Migration Steps
|
||||
|
||||
Once the data migration to PostgreSQL is complete, you're ready to deploy Infisical using the deployment method of your choice.
|
||||
For guidance on deployment options, please visit the [self-hosting documentation](/self-hosting/overview).
|
||||
Remember to transfer the necessary [environment variables](/self-hosting/configuration/envars) from the MongoDB version of Infisical to the new Postgres based Infisical; rest assured, they are fully compatible.
|
||||
|
||||
<Warning>
|
||||
The first deployment of Postgres based Infisical must be deployed with Docker image tag `v0.46.11-postgres`.
|
||||
After deploying this version, you can proceed to update to any subsequent versions.
|
||||
</Warning>
|
||||
|
||||
## Additional discussion
|
||||
- When you visit Infisical's [docker hub](https://hub.docker.com/r/infisical/infisical) page, you will notice that image tags end with `-postgres`.
|
||||
This is to indicate that this version of Infisical runs on the new Postgres backend. Any image tag that does not end in `postgres` runs on MongoDB.
|
||||
Reference in New Issue
Block a user