Fix merge conflicts

docs/api-reference/endpoints/folders/delete.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Delete"
-openapi: "DELETE /api/v1/folders/{folderId}"
+openapi: "DELETE /api/v1/folders/{folderIdOrName}"
 ---

docs/api-reference/endpoints/workspaces/create-workspace.mdx

@@ -0,0 +1,4 @@
+---
+title: "Create Project"
+openapi: "POST /api/v2/workspace"
+---

docs/api-reference/endpoints/workspaces/delete-workspace.mdx

@@ -0,0 +1,8 @@
+---
+title: "Delete Project"
+openapi: "DELETE /api/v1/workspace/{workspaceId}"
+---
+
+<Warning>
+    This operation is irreversible. All data associated with the project will be deleted. Please use with caution.
+</Warning>

docs/api-reference/endpoints/workspaces/get-workspace.mdx

@@ -0,0 +1,4 @@
+---
+title: "Get Project"
+openapi: "GET /api/v1/workspace/{workspaceId}"
+---

docs/api-reference/endpoints/workspaces/invite-member-to-workspace.mdx

@@ -0,0 +1,4 @@
+---
+title: "Invite Member"
+openapi: "POST /api/v2/workspace/{projectId}/memberships"
+---

docs/api-reference/endpoints/workspaces/remove-member-from-workspace.mdx

@@ -0,0 +1,4 @@
+---
+title: "Remove Member"
+openapi: "DELETE /api/v2/workspace/{projectId}/memberships"
+---

docs/api-reference/endpoints/workspaces/update-workspace.mdx

@@ -0,0 +1,4 @@
+---
+title: "Update Project"
+openapi: "PATCH /api/v1/workspace/{workspaceId}"
+---

docs/changelog/overview.mdx

@@ -4,7 +4,22 @@ title: "Changelog"
 
 The changelog below reflects new product developments and updates on a monthly basis.
 
-## January 2024
+## Feb 2024
+- Added org-scoped authentication enforcement for SAML
+- Added support for [SCIM](https://infisical.com/docs/documentation/platform/scim/overview) along with instructions for setting it up with [Okta](https://infisical.com/docs/documentation/platform/scim/okta), [Azure](https://infisical.com/docs/documentation/platform/scim/azure), and [JumpCloud](https://infisical.com/docs/documentation/platform/scim/jumpcloud).
+- Pushed out project update for non-E2EE w/ new endpoints like for project creation and member invitation.
+- Added API Integration testing for new backend.
+- Added capability to create projects in Terraform.
+- Added slug-based capabilities to both organizations and projects to gradually make the API more developer-friendly moving forward.
+- Fixed + improved various analytics/telemetry-related items.
+- Fixed various issues associated with the Python SDK: build during installation on Mac OS, Rust dependency.
+- Updated self-hosting documentation to reflect [new backend](https://infisical.com/docs/self-hosting/overview).
+- Released [Postgres-based Infisical helm chart](https://cloudsmith.io/~infisical/repos/helm-charts/packages/detail/helm/infisical-standalone/).
+- Added checks to ensure that breaking API changes don't get released.
+- Automated API reference documentation to be inline with latest releases of Infisical.
+
+## Jan 2024
+- Completed Postgres migration initiative with restructed Fastify-based backend.
 - Reduced size of Infisical Node.js SDK by ≈90%.
 - Added secret fallback support to all SDK's.
 - Added Machine Identity support to [Terraform Provider](https://github.com/Infisical/terraform-provider-infisical).
@@ -12,21 +27,21 @@ The changelog below reflects new product developments and updates on a monthly b
 - Added symmetric encryption support to all SDK's.
 - Fixed secret reminders bug, where reminders were not being updated correctly.
 
-## December 2023
+## Dec 2023
 
 - Released [(machine) identities](https://infisical.com/docs/documentation/platform/identities/overview) and [universal auth](https://infisical.com/docs/documentation/platform/identities/universal-auth) features.
 - Created new cross-language SDKs for [Python](https://infisical.com/docs/sdks/languages/python), [Node](https://infisical.com/docs/sdks/languages/node), and [Java](https://infisical.com/docs/sdks/languages/java). 
 - Released first version of the [Infisical Agent](https://infisical.com/docs/infisical-agent/overview)
 - Added ability to [manage folders via CLI](https://infisical.com/docs/cli/commands/secrets).  
 
-## November 2023
+## Nov 2023
 
 - Replaced internal [Winston](https://github.com/winstonjs/winston) with [Pino](https://github.com/pinojs/pino) logging library with external logging to AWS CloudWatch
 - Added admin panel to self-hosting experience.
 - Released [secret rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview) feature with preliminary support for rotating [SendGrid](https://infisical.com/docs/documentation/platform/secret-rotation/sendgrid), [PostgreSQL/CockroachDB](https://infisical.com/docs/documentation/platform/secret-rotation/postgres), and [MySQL/MariaDB](https://infisical.com/docs/documentation/platform/secret-rotation/mysql) credentials.
 - Released secret reminders feature.
 
-## October 2023
+## Oct 2023
 
 - Added support for [GitLab SSO](https://infisical.com/docs/documentation/platform/sso/gitlab).
 - Became SOC 2 (Type II) certified.
@@ -35,7 +50,7 @@ The changelog below reflects new product developments and updates on a monthly b
 - Added native [Hasura Cloud integration](https://infisical.com/docs/integrations/cloud/hasura-cloud).
 - Updated resource deletion logic for user, organization, and project deletion.
 
-## September 2023
+## Sep 2023
 
 - Released [secret approvals](https://infisical.com/docs/documentation/platform/pr-workflows) feature.
 - Released an update to access controls; every user role now clearly defines and enforces a certain set of conditions across Infisical.
@@ -43,7 +58,7 @@ The changelog below reflects new product developments and updates on a monthly b
 - Added a native integration with [Qovery](https://infisical.com/docs/integrations/cloud/qovery).
 - Added service token generation capability for the CLI.
 
-## August 2023
+## Aug 2023
 
 - Release Audit Logs V2.
 - Add support for [GitHub SSO](https://infisical.com/docs/documentation/platform/sso/github).
@@ -171,7 +186,7 @@ The changelog below reflects new product developments and updates on a monthly b
 - Added sorting capability to sort keys by name alphabetically in dashboard.
 - Added downloading secrets back as `.env` file capability.
 
-## August 2022
+## Aug 2022
 
 - Released first version of the Infisical platform with push/pull capability and end-to-end encryption.
 - Improved security handling of authentication tokens by storing refresh tokens in HttpOnly cookies.

docs/cli/commands/secrets.mdx

@@ -8,24 +8,28 @@ infisical secrets
 ```
 
 ## Description
+
 This command enables you to perform CRUD (create, read, update, delete) operations on secrets within your Infisical project. With it, you can view, create, update, and delete secrets in your environment.
 
-### Sub-commands 
+### Sub-commands
+
 <Accordion title="infisical secrets" defaultOpen="true">
   Use this command to print out all of the secrets in your project
 
-  ```bash
-  $ infisical secrets
-  ```
+```bash
+$ infisical secrets
+```
+
+### Environment variables
 
-  ### Environment variables
   <Accordion title="INFISICAL_TOKEN">
     Used to fetch secrets via a [service token](/documentation/platform/token) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
 
     ```bash
-    # Example 
+    # Example
     export INFISICAL_TOKEN=st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec
     ```
+
   </Accordion>
 
   <Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
@@ -34,22 +38,26 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
     To use, simply export this variable in the terminal before running this command.
 
     ```bash
-    # Example 
+    # Example
     export INFISICAL_DISABLE_UPDATE_CHECK=true
     ```
+
   </Accordion>
 
-  ### Flags 
+### Flags
+
   <Accordion title="--expand">
     Parse shell parameter expansions in your secrets
 
     Default value: `true`
+
   </Accordion>
 
   <Accordion title="--env">
     Used to select the environment name on which actions should be taken on
 
     Default value: `dev`
+
   </Accordion>
   <Accordion title="--path">
     The `--path` flag indicates which project folder secrets will be injected from.
@@ -58,6 +66,7 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
     # Example
     infisical secrets --path="/" --env=dev
     ```
+
   </Accordion>
 
 </Accordion>
@@ -65,38 +74,55 @@ This command enables you to perform CRUD (create, read, update, delete) operatio
 <Accordion title="infisical secrets get">
   This command allows you selectively print the requested secrets by name
 
-  ```bash 
-  $ infisical secrets get <secret-name-a> <secret-name-b> ...
+```bash
+$ infisical secrets get <secret-name-a> <secret-name-b> ...
 
-  # Example
-  $ infisical secrets get DOMAIN
+# Example
+$ infisical secrets get DOMAIN
 
-  ```
+```
+
+### Flags
 
-  ### Flags 
   <Accordion title="--env">
     Used to select the environment name on which actions should be taken on
 
     Default value: `dev`
+
+  </Accordion>
+
+  <Accordion title="--raw-value">
+    Used to print the plain value of a single requested secret without any table style.
+
+    Default value: `false`
+
+    Example: `infisical secrets get DOMAIN --raw-value`
+
+    <Tip>
+      When running in CI/CD environments or in a script, set `INFISICAL_DISABLE_UPDATE_CHECK` env to `true`. This will help hide any CLI update messages and only show the secret value.
+    </Tip>
+
   </Accordion>
 </Accordion>
 
 <Accordion title="infisical secrets set">
-This command allows you to set or update secrets in your environment. If the secret key provided already exists, its value will be updated with the new value. 
+This command allows you to set or update secrets in your environment. If the secret key provided already exists, its value will be updated with the new value.
 If the secret key does not exist, a new secret will be created using both the key and value provided.
 
 ```bash
 $ infisical secrets set <key1=value1> <key2=value2>...
 
-## Example 
+## Example
 $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jebhfbwe
 ```
 
-  ### Flags 
+### Flags
+
   <Accordion title="--env">
     Used to select the environment name on which actions should be taken on
 
     Default value: `dev`
+
   </Accordion>
   <Accordion title="--path">
     Used to select the project folder in which the secrets will be set. This is useful when creating new secrets under a particular path.
@@ -105,43 +131,48 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
     # Example
     infisical secrets set DOMAIN=example.com --path="common/backend"
     ```
+
   </Accordion>
 </Accordion>
 
 <Accordion title="infisical secrets delete">
   This command allows you to delete secrets by their name(s).
 
-  ```bash
-  $ infisical secrets delete <keyName1> <keyName2>...
+```bash
+$ infisical secrets delete <keyName1> <keyName2>...
 
-  ## Example 
-  $ infisical secrets delete STRIPE_API_KEY DOMAIN HASH
-  ```
+## Example
+$ infisical secrets delete STRIPE_API_KEY DOMAIN HASH
+```
+
+### Flags
 
-  ### Flags 
   <Accordion title="--env">
     Used to select the environment name on which actions should be taken on
 
     Default value: `dev`
+
   </Accordion>
   <Accordion title="--path">
-    The `--path` flag indicates which project folder secrets will be injected from. 
+    The `--path` flag indicates which project folder secrets will be injected from.
 
     ```bash
     # Example
     infisical secrets delete <keyName1> <keyName2>... --path="/"
     ```
+
   </Accordion>
 </Accordion>
 
 <Accordion title="infisical secrets folders">
   This command allows you to fetch, create and delete folders from within a path from a given project.
 
-  ```bash
-  $ infisical secrets folders
-  ```
+```bash
+$ infisical secrets folders
+```
+
+### sub commands
 
-  ### sub commands 
   <Accordion title="get">
     Used to fetch all folders within a path in a given project
     ```
@@ -179,6 +210,7 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
 
       Default value: ``
     </Accordion>
+
   </Accordion>
 
   <Accordion title="delete">
@@ -194,10 +226,11 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
     </Accordion>
 
     <Accordion title="--name">
-      Name of the folder to be deleted within selected `--path` 
+      Name of the folder to be deleted within selected `--path`
 
       Default value: ``
     </Accordion>
+
   </Accordion>  
 </Accordion>
 
@@ -210,14 +243,16 @@ To place default values in your example .env file, you can simply include the sy
 ```bash
 $ infisical secrets generate-example-env
 
-## Example 
+## Example
 $ infisical secrets generate-example-env > .example-env
 ```
 
-  ### Flags 
+### Flags
+
   <Accordion title="--env">
     Used to select the environment name on which actions should be taken on
 
     Default value: `dev`
+
   </Accordion>
 </Accordion>

docs/cli/scanning-overview.mdx

@@ -34,7 +34,7 @@ In addition to scanning for past leaks, this new addition also actively aids in
 	infisical scan git-changes
 
 	# Display the full secret findings
-	infisical git-changes --verbose
+	infisical scan git-changes --verbose
 	```
 
 	Scanning for secrets before you commit your changes is great way to prevent leaks. Infisical makes this easy with the sub command `git-changes`.

docs/cli/usage.mdx

@@ -135,3 +135,38 @@ Another option to point the CLI to your self hosted Infisical instance is to set
 infisical <any-command> --domain="https://your-self-hosted-infisical.com/api"
 ```
 </Accordion>
+
+## History
+
+Your terminal keeps a history with the commands you run. When you create Infisical secrets directly from your terminal, they'll stay there for a while.
+
+For security and privacy concerns, we recommend you to configure your terminal to ignore those specific Infisical commands.
+
+<Accordion title="Ignore commands">
+
+<Tabs>
+   <Tab title="Unix/Linux">
+      <Tip>
+        `$HOME/.profile` is pretty common but, you could place it under `$HOME/.profile.d/infisical.sh` or any profile file run at login 
+      </Tip>
+
+      ```bash
+      cat <<EOF >> $HOME/.profile && source $HOME/.profile
+
+      # Ignoring specific Infisical CLI commands
+      DEFAULT_HISTIGNORE=$HISTIGNORE
+      export HISTIGNORE="*infisical secrets set*:$DEFAULT_HISTIGNORE"
+      EOF
+      ```
+
+   </Tab>
+   <Tab title="Windows">
+      If you're on WSL, then you can use the Unix/Linux method.
+
+      <Tip>
+        Here's some [documentation](https://superuser.com/a/1658331) about how to clear the terminal history, in PowerShell and CMD
+      </Tip>
+
+   </Tab>
+</Tabs>
+</Accordion>

docs/contributing/platform/developing.mdx

@@ -16,49 +16,7 @@ git checkout -b MY_BRANCH_NAME
 ## Set up environment variables
 
 
-Start by creating a .env file at the root of the Infisical directory then copy the contents of the file below into the .env file.
-
-<Accordion title=".env file content">
-  ```env 
-    # Keys
-    # Required key for platform encryption/decryption ops
-    ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
-
-    # JWT
-    # Required secrets to sign JWT tokens
-    JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
-    JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
-    JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
-    JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
-
-    # MongoDB
-    # Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
-    # to the MongoDB container instance or Mongo Cloud
-    # Required
-    MONGO_URL=mongodb://root:example@mongo:27017/?authSource=admin
-
-    # Optional credentials for MongoDB container instance and Mongo-Express
-    MONGO_USERNAME=root
-    MONGO_PASSWORD=example
-
-    # Website URL
-    # Required
-    SITE_URL=http://localhost:8080
-
-    # Mail/SMTP
-    SMTP_HOST='smtp-server'
-    SMTP_PORT='1025'
-    SMTP_NAME='local'
-    SMTP_USERNAME='team@infisical.com'
-    SMTP_PASSWORD=
-  ```
-</Accordion>
-
-<Warning>
-    The pre-populated environment variable values above are meant to be used in development only. They should never be used in production.
-</Warning>
-
-View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
+Start by creating a .env file at the root of the Infisical directory then copy the contents of the file linked [here](https://github.com/Infisical/infisical/blob/main/.env.example). View all available [environment variables](https://infisical.com/docs/self-hosting/configuration/envars) and guidance for each.
 
 ## Starting Infisical for development
 
@@ -72,10 +30,7 @@ docker-compose -f docker-compose.dev.yml up --build --force-recreate
 ```
 #### Access local server 
 
-Once all the services have spun up, browse to http://localhost:8080. To sign in, you may use the default credentials listed below.
-
-Email: `test@localhost.local`
-Password: `testInfisical1`
+Once all the services have spun up, browse to http://localhost:8080.
 
 #### Shutdown local server 
 

docs/documentation/getting-started/introduction.mdx

@@ -2,7 +2,7 @@
 title: "Introduction"
 ---
 
-Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secret management platform for storing, managing, and syncing
+Infisical is an [open-source](https://opensource.com/resources/what-open-source), [end-to-end encrypted](https://en.wikipedia.org/wiki/End-to-end_encryption) secrets management platform for storing, managing, and syncing
 application configuration and secrets like API keys, database credentials, and environment variables across applications and infrastructure. 
 
 Start syncing environment variables with [Infisical Cloud](https://app.infisical.com) or learn how to [host Infisical](/self-hosting/overview) yourself.

docs/documentation/guides/node.mdx

@@ -75,7 +75,7 @@ app.get("/", async (req, res) => {
 app.listen(PORT, async () => {
     // initialize client
 
-    console.log(`App listening on port ${port}`);
+    console.log(`App listening on port ${PORT}`);
 });
 ```
 

docs/documentation/platform/ldap.mdx

@@ -0,0 +1,36 @@
+---
+title: "LDAP"
+description: "Log in to Infisical with LDAP"
+---
+
+<Info>
+    LDAP is a paid feature.
+   
+   If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+   then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol).
+
+<Steps>
+   <Step title="Prepare the LDAP configuration in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > LDAP Configuration and select **Set up LDAP**.
+        
+        Next, input your LDAP server settings.
+        
+        ![LDAP configuration](/images/platform/ldap/ldap-config.png)
+        
+        Here's some guidance for each field:
+
+        - URL: The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.
+        - Bind DN: The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`.
+        - Bind Pass: The password to use along with `Bind DN` when performing the user search.
+        - Search Base / User DN: Base DN under which to perform user search such as `ou=Users,dc=example,dc=com`
+        - CA Certificate: The CA certificate to use when verifying the LDAP server certificate.
+   </Step>
+   <Step title="Enable LDAP in Infisical">
+        Enabling LDAP allows members in your organization to log into Infisical via LDAP.
+        
+        ![LDAP toggle](/images/platform/ldap/ldap-toggle.png)
+   </Step>
+</Steps>

docs/documentation/platform/ldap/general.mdx

@@ -0,0 +1,34 @@
+---
+title: "General LDAP"
+description: "Log in to Infisical with LDAP"
+---
+
+<Info>
+    LDAP is a paid feature.
+   If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+   then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)
+
+<Steps>
+   <Step title="Prepare the LDAP configuration in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > LDAP Configuration and select **Set up LDAP**.
+
+        Next, input your LDAP server settings.
+
+        ![LDAP configuration](/images/platform/ldap/ldap-config.png)
+
+        Here's some guidance for each field:
+
+        - URL: The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.
+        - Bind DN: The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`.
+        - Bind Pass: The password to use along with `Bind DN` when performing the user search.
+        - Search Base / User DN: Base DN under which to perform user search such as `ou=Users,dc=example,dc=com`
+        - CA Certificate: The CA certificate to use when verifying the LDAP server certificate.
+   </Step>
+   <Step title="Enable LDAP in Infisical">
+        Enabling LDAP allows members in your organization to log into Infisical via LDAP.
+        ![LDAP toggle](/images/platform/ldap/ldap-toggle.png)
+   </Step>
+</Steps>

docs/documentation/platform/ldap/jumpcloud.mdx

@@ -0,0 +1,54 @@
+---
+title: "JumpCloud LDAP"
+description: "Configure JumpCloud LDAP for Logging into Infisical"
+---
+
+<Info>
+    LDAP is a paid feature.
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+<Steps>
+    <Step title="Prepare LDAP in JumpCloud">
+        In JumpCloud, head to USER MANAGEMENT > Users and create a new user via the **Manual user entry** option. This user
+        will be used as a privileged service account to facilitate Infisical's ability to bind/search the LDAP directory.
+
+        When creating the user, input their **First Name**, **Last Name**, **Username** (required), **Company Email** (required), and **Description**.
+        Also, create a password for the user.
+
+        Next, under User Security Settings and Permissions > Permission Settings, check the box next to **Enable as LDAP Bind DN**. 
+
+        ![LDAP JumpCloud](/images/platform/ldap/jumpcloud/ldap-jumpcloud-enable-bind-dn.png)
+
+    </Step>
+    <Step title="Prepare the LDAP configuration in Infisical">
+            In Infisical, head to your Organization Settings > Authentication > LDAP Configuration and select **Set up LDAP**.
+
+            Next, input your JumpCloud LDAP server settings.
+
+            ![LDAP configuration](/images/platform/ldap/ldap-config.png)
+
+            Here's some guidance for each field:
+
+            - URL: The LDAP server to connect to (`ldaps://ldap.jumpcloud.com:636`).
+            - Bind DN: The distinguished name of object to bind when performing the user search (`uid=<ldap-user-username>,ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
+            - Bind Pass: The password to use along with `Bind DN` when performing the user search.
+            - Search Base / User DN: Base DN under which to perform user search (`ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
+            - CA Certificate: The CA certificate to use when verifying the LDAP server certificate (instructions to obtain the certificate for JumpCloud [here](https://jumpcloud.com/support/connect-to-ldap-with-tls-ssl)).
+
+            <Tip>
+                When filling out the **Bind DN** and **Bind Pass** fields, refer to the username and password of the user created in Step 1.
+
+                Also, for the **Bind DN** and **Search Base / User DN** fields, you'll want to use the organization ID that appears 
+                in your LDAP instance **ORG DN**.
+            </Tip>
+    </Step>
+    <Step title="Enable LDAP in Infisical">
+            Enabling LDAP allows members in your organization to log into Infisical via LDAP.
+            ![LDAP toggle](/images/platform/ldap/ldap-toggle.png)
+    </Step>
+</Steps>
+
+Resources:
+- [JumpCloud Cloud LDAP Guide](https://jumpcloud.com/support/use-cloud-ldap)

docs/documentation/platform/ldap/overview.mdx

@@ -0,0 +1,23 @@
+---
+title: "LDAP Overview"
+description: "Log in to Infisical with LDAP"
+---
+<Info>
+    LDAP is a paid feature.
+
+   If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+   then you should contact sales@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+You can configure your organization in Infisical to have members authenticate with the platform via [LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)
+
+To note, configuring LDAP retains the end-to-end encrypted architecture of Infisical because we decouple the authentication and decryption steps; the LDAP server cannot and will not have access to the decryption key needed to decrypt your secrets.
+
+LDAP providers:
+
+- Active Directory
+- [JumpCloud LDAP](/documentation/platform/ldap/jumpcloud)
+- AWS Directory Service
+- Foxpass
+
+Check out the general instructions for configuring LDAP [here](/documentation/platform/ldap/general).

docs/documentation/platform/project-upgrade.mdx

@@ -0,0 +1,20 @@
+---
+title: "Enhancing Security and Usability: Project Upgrades"
+---
+
+At Infisical, we're constantly striving to elevate the security and usability standards of our platform to better serve our users.
+With this commitment in mind, we're excited to introduce our latest addition, non-E2EE projects, aimed at addressing two significant issues while enhancing how clients interact with Infisical programmatically.
+
+Previously, users encountered a challenge where projects risked becoming inaccessible if the project creator deleted their account.
+Additionally, our API lacked the capability to interact with projects without dealing with complex cryptographic operations.
+These obstacles made API driven automation and collaboration a painful experience for a majority of our users.
+
+To overcome these limitations, our upgrade focuses on disabling end-to-end encryption (E2EE) for projects.
+While this may raise eyebrows, it's important to understand that this decision is a strategic move to make Infisical easier to use and interact with.
+
+But what does this mean for our users? Essentially nothing, there are no changes required on your end.
+Rest assured, all sensitive data remains encrypted at rest according to the latest industry standards.
+Our commitment to security remains unwavering, and this upgrade is a testament to our dedication to delivering on our promises in both security and usability when it comes to secrets management.
+
+To increase consistency with existing and future integrations, all projects created on Infisical from now on will have end-to-end encryption (E2EE) disabled by default.
+This will not only reduce confusion for end users, but will also make the Infisical API seamless to use.

docs/documentation/platform/scim/azure.mdx

@@ -0,0 +1,74 @@
+---
+title: "Azure SCIM"
+description: "Configure SCIM provisioning with Azure for Infisical"
+---
+
+<Info>
+    Azure SCIM provisioning is a paid feature.
+    
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+Prerequisites:
+- [Configure Azure SAML for Infisical](/documentation/platform/sso/azure)
+
+<Steps>
+    <Step title="Create a SCIM token in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
+        press the **Enable SCIM provisioning** toggle to allow Azure to provision/deprovision users for your organization.
+        
+        ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
+        
+        Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for Azure.
+        
+        ![SCIM create token](/images/platform/scim/scim-create-token.png)
+        
+        Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in Azure.
+        
+        ![SCIM copy token](/images/platform/scim/scim-copy-token.png)
+    </Step>
+    <Step title="Configure SCIM in Azure">
+        In Azure, head to your Enterprise Application > Provisioning > Overview and press **Get started**.
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-get-started.png)
+
+        Next, set the following fields:
+        
+        - Provisioning Mode: Select **Automatic**.
+        - Tenant URL: Input **SCIM URL** from Step 1.
+        - Secret Token: Input the **New SCIM Token** from Step 1.
+        
+        Afterwards, press the **Test Connection** button to check that SCIM is configured properly.
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-config.png)
+        
+        After you hit **Save**, select **Provision Microsoft Entra ID Users** under the **Mappings** subsection.
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-select-user-mappings.png)
+        
+        Next, adjust the mappings so you have them configured as below:
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-user-mappings.png)
+
+        Finally, head to your Enterprise Application > Provisioning and set the **Provisioning Status** to **On**.
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-provisioning-status.png)
+        
+        Alternatively, you can go to **Overview** and press **Start provisioning** to have Azure start provisioning/deprovisioning users to Infisical.
+        
+        ![SCIM Azure](/images/platform/scim/azure/scim-azure-start-provisioning.png)
+        
+        Now Azure can provision/deprovision users to/from your organization in Infisical.
+    </Step>
+</Steps>
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
+    Infisical's SCIM implmentation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform. 
+    
+    For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/scim/jumpcloud.mdx

@@ -0,0 +1,64 @@
+---
+title: "JumpCloud SCIM"
+description: "Configure SCIM provisioning with JumpCloud for Infisical"
+---
+
+<Info>
+    JumpCloud SCIM provisioning is a paid feature.
+    
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+Prerequisites:
+- [Configure JumpCloud SAML for Infisical](/documentation/platform/sso/jumpcloud)
+
+<Steps>
+    <Step title="Create a SCIM token in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
+        press the **Enable SCIM provisioning** toggle to allow JumpCloud to provision/deprovision users for your organization.
+        
+        ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
+        
+        Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for JumpCloud.
+        
+        ![SCIM create token](/images/platform/scim/scim-create-token.png)
+        
+        Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in JumpCloud.
+        
+        ![SCIM copy token](/images/platform/scim/scim-copy-token.png)
+    </Step>
+    <Step title="Configure SCIM in JumpCloud">
+        In JumpCloud, head to your Application > Identity Management > Configuration settings and make sure that
+        **API Type** is set to **SCIM API** and **SCIM Version** is set to **SCIM 2.0**.
+        
+        ![SCIM JumpCloud](/images/platform/scim/jumpcloud/scim-jumpcloud-api-type.png)
+
+        Next, set the following SCIM connection fields:
+        
+        - Base URL: Input the **SCIM URL** from Step 1.
+        - Token Key: Input the **New SCIM Token** from Step 1.
+        - Test User Email: Input a test user email to be used by JumpCloud for testing the SCIM connection.
+
+        Alos, under HTTP Header > Authorization: Bearer, input the **New SCIM Token** from Step 1.
+        
+        ![SCIM JumpCloud](/images/platform/scim/jumpcloud/scim-jumpcloud-config.png)
+
+        Next, press **Test Connection** to check that SCIM is configured properly. Finally, press **Activate**
+        to have JumpCloud start provisioning/deprovisioning users to Infisical.
+        
+        ![SCIM JumpCloud](/images/platform/scim/jumpcloud/scim-jumpcloud-test-connection.png)
+        
+        Now JumpCloud can provision/deprovision users to/from your organization in Infisical.
+    </Step>
+</Steps>
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
+    Infisical's SCIM implmentation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform. 
+    
+    For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/scim/okta.mdx

@@ -0,0 +1,70 @@
+---
+title: "Okta SCIM"
+description: "Configure SCIM provisioning with Okta for Infisical"
+---
+
+<Info>
+    Okta SCIM provisioning is a paid feature.
+    
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+Prerequisites:
+- [Configure Okta SAML for Infisical](/documentation/platform/sso/okta)
+
+<Steps>
+    <Step title="Create a SCIM token in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
+        press the **Enable SCIM provisioning** toggle to allow Okta to provision/deprovision users for your organization.
+        
+        ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
+        
+        Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for Okta.
+        
+        ![SCIM create token](/images/platform/scim/scim-create-token.png)
+        
+        Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in Okta.
+        
+        ![SCIM copy token](/images/platform/scim/scim-copy-token.png)
+    </Step>
+    <Step title="Configure SCIM in Okta">
+        In Okta, head to your Application > General > App Settings. Next, select **Edit** and check the box
+        labled **Enable SCIM provisioning**.
+
+        ![SCIM Okta](/images/platform/scim/okta/scim-okta-enable-provisioning.png)
+
+        Next, head to Provisioning > Integration and set the following SCIM connection fields:
+        
+        - SCIM connector base URL: Input the **SCIM URL** from Step 1.
+        - Unique identifier field for users: Input `email`.
+        - Supported provisioning actions: Select **Push New Users** and **Push Profile Updates**.
+        - Authentication Mode: `HTTP Header`.
+        
+        ![SCIM Okta](/images/platform/scim/okta/scim-okta-config.png)
+
+        Under HTTP Header > Authorization: Bearer, input the **New SCIM Token** from Step 1.
+
+        ![SCIM Okta](/images/platform/scim/okta/scim-okta-auth.png)
+
+        Next, press **Test Connector Configuration** to check that SCIM is configured properly.
+        
+        ![SCIM Okta](/images/platform/scim/okta/scim-okta-test.png)
+        
+        Next, head to Provisioning > To App and check the boxes labeled **Enable** for **Create Users**, **Update User Attributes**, and **Deactivate Users**.
+        
+        ![SCIM Okta](/images/platform/scim/okta/scim-okta-app-settings.png)
+        
+        Now Okta can provision/deprovision users to/from your organization in Infisical.
+    </Step>
+</Steps>
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
+    Infisical's SCIM implmentation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform. 
+    
+    For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/scim/overview.mdx

@@ -0,0 +1,32 @@
+---
+title: "SCIM Overview"
+description: "Provision users for Infisical via SCIM"
+---
+
+<Info>
+    SCIM provisioning is a paid feature.
+    
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+You can configure your organization in Infisical to have members be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.
+
+- Provisioning: The SCIM provider pushes user information to Infisical. If the user exists in Infisical, Infisical sends an email invitation to add them to the relevant organization in Infisical; if not, Infisical initializes a new user and sends them an email invitation to finish setting up their account in the organization.
+- Deprovisioning: The SCIM provider instructs Infisical to remove user(s) from an organization in Infisical.
+
+SCIM providers:
+
+- [Okta SCIM](/documentation/platform/scim/okta)
+- [Azure SCIM](/documentation/platform/scim/azure)
+- [JumpCloud SCIM](/documentation/platform/scim/jumpcloud)
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
+    Infisical's SCIM implementation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform. 
+    
+    For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/secret-reference.mdx

@@ -10,7 +10,7 @@ This means that updating the value of a base secret propagates directly to other
 
 <Note>
     Currently, the secret referencing feature is only supported by the 
-    [Infisical CLI](/cli/overview) and [native integrations](/integrations/overview).
+    [Infisical CLI](/cli/overview), [native integrations](/integrations/overview) and [Infisical Agent](/infisical-agent/overview).
 
     We intend to add support for it to the [Node SDK](https://infisical.com/docs/sdks/languages/node), 
     [Python SDK](https://infisical.com/docs/sdks/languages/python), and [Java SDK](https://infisical.com/docs/sdks/languages/java) this quarter.

docs/documentation/platform/secret-rotation/aws-iam.mdx

@@ -0,0 +1,143 @@
+---
+title: "AWS IAM User"
+description: "Rotated access key id and secret key of AWS IAM Users"
+---
+
+Infisical's AWS IAM User secret rotation capability lets you update the **Access key** and **Secret access key** credentials of a target IAM user from within Infisical
+at a specified interval or on-demand.
+
+## Workflow
+
+The typical workflow for using the AWS IAM User rotation strategy consists of four steps:
+
+1. Creating the target IAM user whose credentials you wish to rotate.
+2. Creating the managing IAM user used by Infisical to rotate the credentials of the target IAM user.
+3. Configuring the rotation strategy in Infisical with the credentials of the managing IAM user.
+4. Pressing the **Rotate** button in the Infisical dashboard to trigger the rotation of the target IAM user's credentials. The strategy can also be configured to rotate the credentials automatically at a specified interval.
+
+In the following steps, we explore the end-to-end workflow for setting up this strategy in Infisical.
+
+<Steps>
+	<Step title="Create the target IAM user">
+		To begin, create an IAM user whose credentials you wish to rotate. If you already have an IAM user,
+		then you can skip this step.
+	</Step>
+	<Step title="Create the managing IAM user">
+		Next, create another IAM user to be used by Infisical to rotate the credentials of the IAM user in the previous step.
+
+		2.1. In your AWS console, head to IAM > Access management > Users and press **Create user**.
+		
+		![iam user secret rotation create user](../../../images/platform/secret-rotation/aws-iam/rotation-manager-create-user.png)
+		
+		2.2. Next, give the user a username like **infisical-rotation-manager** and press **Next**.
+
+		![iam user secret rotation username](../../../images/platform/secret-rotation/aws-iam/rotation-manager-username.png)
+		
+		2.3. Next, in the **Set permissions** step, select **Attach policies directly** and then press **Create policy**.
+		
+		![iam user secret rotation create policy](../../../images/platform/secret-rotation/aws-iam/rotation-manager-create-policy.png)
+		
+		2.4. Next, in the **Policy editor**, paste the following JSON and press **Next**:
+
+		```json
+		{
+			"Version": "2012-10-17",
+			"Statement": [
+				{
+					"Sid": "VisualEditor0",
+					"Effect": "Allow",
+					"Action": [
+					"iam:DeleteAccessKey",
+					"iam:GetAccessKeyLastUsed",
+					"iam:CreateAccessKey"
+					],
+					"Resource": "*"
+				}
+			]
+		}
+		```
+
+		<Note>
+			The IAM policy above uses the wildcard option in Resource: "*".
+			
+			You may want to restrict the policy to a specific path, and make any adjustments as necessary, to control access for the managing user in production.
+			
+			Read more about this [here](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/).
+		</Note>
+		
+		In the **Review and create** step, give the policy a name like **infisical-rotation-manager**, press **Create policy** to finish creating the policy.
+		
+		![iam user secret rotation policy review](../../../images/platform/secret-rotation/aws-iam/rotation-manager-policy-review.png)
+
+		2.5. Back in the **Set permissions** step from step 2.3, refresh the policy list and search for the policy you just created from step 2.4.
+		
+		Select the policy and press **Next**.
+		
+		![iam user secret rotation attach policy](../../../images/platform/secret-rotation/aws-iam/rotation-manager-attach-policy.png)
+		
+		In the **Review and create** step, press **Create user** to finish creating the IAM user.
+		
+		![iam user secret rotation manager user review](../../../images/platform/secret-rotation/aws-iam/rotation-manager-user-review.png)
+		
+		2.5. Having created the user, head to its Security credentials > Access keys and press **Create access key**.
+
+		Follow the subsequent steps to create the **access key** and **secret access key** credential pair for the user.
+
+		![iam user secret rotation manager create access key](../../../images/platform/secret-rotation/aws-iam/rotation-manager-create-access-key.png)
+		
+		At the end of the flow, copy the **Access key** and **Secret access key** to use when configuring the AWS IAM User rotation strategy back in Infisical next.
+	
+		![iam user secret rotation manager access keys](../../../images/platform/secret-rotation/aws-iam/rotation-manager-access-keys.png)
+	</Step>
+	<Step title="Configure the AWS IAM User secret rotation strategy in Infisical">
+		3.1. Back in Infisical, head to the Project > Secrets > Environment and path where you want the rotated AWS IAM credentials to appear and create two placeholder secrets.
+		
+		In this example, we'll create two secrets called `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`.
+		
+		![iam user secret rotation secrets](../../../images/platform/secret-rotation/aws-iam/rotation-config-secrets.png)
+		
+		3.2. Next, in the **Secret Rotation** tab, press on the **AWS IAM** tile to configure the AWS IAM User rotation strategy.
+		
+		![iam user secret rotation select aws iam user method](../../../images/platform/secret-rotation/aws-iam/rotations-select-aws-iam-user.png)
+		
+		3.3. Input the configuration details for the AWS IAM User rotation strategy obtained from steps 1 and 2:
+		
+		![iam user secret rotation config 1](../../../images/platform/secret-rotation/aws-iam/rotation-config-1.png)
+		
+		Here's some guidance on each field:
+		
+		- Manager User Access Key: The managing IAM user's access key from step 2.5.
+		- Manager User Secret Key: The managing IAM user's secret access key from step 2.5.
+		- Manager User AWS Region: The [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html) for Infisical to make requests to such as `us-east-1`.
+		- IAM Username: The IAM username of the user from step 1.
+		
+		Next, specify the output secret mappings configuration for the rotated AWS IAM credentials; this is the secrets whose values will be replaced with new credentials after each rotation.
+		Here, you can also specify a rotation interval for the credentials to be automatically rotated periodically.
+
+		In this example, we want to map the output of the rotated AWS IAM credentials to the secrets that we created in step 3.1 (i.e. `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`).
+		
+		![iam user secret rotation config 2](../../../images/platform/secret-rotation/aws-iam/rotation-config-2.png)
+		
+		Finally, press **Submit** to create the secret rotation strategy.
+	</Step>
+	<Step title="Rotate secrets in Infisical">
+		You should now see the AWS IAM User rotation strategy listed in the **Secret Rotation** tab.
+		
+		To manually trigger a rotation, you can press the **Rotate** button on the strategy.
+		Once triggered, the secrets in step 3.1 should be updated with new rotated credential values.
+		
+		![iam user secret rotations aws iam user](../../../images/platform/secret-rotation/aws-iam/rotations-aws-iam-user.png)
+	</Step>
+</Steps>
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why are my AWS IAM credentials not rotating?">
+  There are a few reasons for why this might happen:
+  
+  - The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target IAM username is incorrect, etc.).
+  - The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup [paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary permissions to rotate the credentials.
+  - The target IAM user already has 2 access keys configured in AWS; you should delete one of the access keys to allow for rotation.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/secret-rotation/postgres.mdx

@@ -1,21 +1,17 @@
 ---
 title: "PostgreSQL/CockroachDB"
-description: "Rotated database user password of a postgreSQL or cockroach db"
+description: "Rotated database user password of a PostgreSQL or Cockroach DB"
 ---
 
 Infisical will update periodically the provided database user's password.
 
-<Warning>
-	At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud.
-</Warning>
-
 ## Working
 
-1. User's has to create the two user's for Infisical to rotate and provide them required database access
-2. Infisical will connect with your database with admin access
-3. If last rotated one was username1, then username2 is chosen to be rotated
-5. Update it's password with random value
-6. After testing it gets saved to the provided secret mapping
+1. User's has to create the two user's for Infisical to rotate and provide them required database access.
+2. Infisical will connect with your database with admin access.
+3. If last rotated one was username1, then username2 is chosen to be rotated.
+5. Update it's password with random value.
+6. After testing it gets saved to the provided secret mapping.
 
 ## Rotation Configuration
 
@@ -34,4 +30,4 @@ Infisical will update periodically the provided database user's password.
 	- Finally select the secrets in your provided board to replace with new secret after each rotation
 	- Your done and good to go.
 
-Congrats. You have 10x your PostgreSQL/CockroachDB access security. 
+Congratulations. You have improved your PostgreSQL/CockroachDB access security. 

docs/documentation/platform/sso/azure.mdx

@@ -4,7 +4,7 @@ description: "Configure Azure SAML for Infisical SSO"
 ---
 
 <Info>
-   Azure SAML SSO feature is a paid feature.
+   Azure SAML SSO is a paid feature.
    
    If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
    then you should contact team@infisical.com to purchase an enterprise license to use it.
@@ -12,7 +12,7 @@ description: "Configure Azure SAML for Infisical SSO"
 
 <Steps>
    <Step title="Prepare the SAML SSO configuration in Infisical">
-      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+      In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
 
       Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
 
@@ -101,6 +101,11 @@ description: "Configure Azure SAML for Infisical SSO"
 
       To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Azure user with Infisical;
       Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
+
+      <Warning>
+         We recommend ensuring that your account is provisioned the application in Azure
+         prior to enforcing SAML SSO to prevent any unintended issues.
+      </Warning>
    </Step>
 </Steps>
 

docs/documentation/platform/sso/google-saml.mdx

@@ -0,0 +1,95 @@
+---
+title: "Google SAML"
+description: "Configure Google SAML for Infisical SSO"
+---
+
+<Info>
+    Google SAML SSO feature is a paid feature.
+   
+    If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+<Steps>
+   <Step title="Prepare the SAML SSO configuration in Infisical">
+        In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+
+        Next, note the **ACS URL** and **SP Entity ID** to use when configuring the Google SAML application.
+      
+        ![Google SAML initial configuration](../../../images/sso/google-saml/init-config.png)
+   </Step>
+   <Step title="Create a SAML application in Google">
+        2.1. In your [Google Admin console](https://support.google.com/a/answer/182076), head to Menu > Apps > Web and mobile apps and
+        create a **custom SAML app**.
+        
+        ![Google SAML app creation](../../../images/sso/google-saml/create-custom-saml-app.png)
+        
+        2.2. In the **App details** tab, give the application a unique name like Infisical.
+        
+        ![Google SAML app naming](../../../images/sso/google-saml/name-custom-saml-app.png)
+        
+        2.3. In the **Google Identity Provider details** tab, copy the **SSO URL**, **Entity ID** and **Certificate**.
+        
+        ![Google SAML custom app details](../../../images/sso/google-saml/custom-saml-app-config.png)
+        
+        2.4. Back in Infisical, set **SSO URL**, **IdP Entity ID**, and **Certificate** to the corresponding items from step 2.3.
+        
+        ![Google SAML Infisical config](../../../images/sso/google-saml/infisical-config.png)
+        
+        2.5. Back in the Google Admin console, in the **Service provider details** tab, set the **ACS URL** and **Entity ID** to the corresponding items from step 1.
+
+        Also, check the **Signed response** checkbox.
+
+        ![Google SAML app config 2](../../../images/sso/google-saml/custom-saml-app-config-2.png)
+        
+        2.6. In the **Attribute mapping** tab, configure the following map:
+
+        - **First name** -> **firstName**
+        - **Last name** -> **lastName**
+        - **Primary email** -> **email**
+
+        ![Google SAML attribute mapping](../../../images/sso/google-saml/attribute-mapping.png)
+        
+        Click **Finish**.
+    </Step>
+    <Step title="Assign users in Google Workspace to the application">
+        Back in your [Google Admin console](https://support.google.com/a/answer/182076), head to Menu > Apps > Web and mobile apps > your SAML app
+        and press on **User access**.
+
+        ![Google SAML user access](../../../images/sso/google-saml/user-access.png)
+        
+        To assign everyone in your organization to the application, click **On for everyone** or **Off for everyone** and then click **Save**.
+        
+        You can also assign an organizational unit or set of users to an application; you can learn more about that [here](https://support.google.com/a/answer/6087519?hl=en#add_custom_saml&turn_on&verify_sso&&zippy=%2Cstep-add-the-custom-saml-app%2Cstep-turn-on-your-saml-app%2Cstep-verify-that-sso-is-working-with-your-custom-app).
+        
+        ![Google SAML user access assignment](../../../images/sso/google-saml/user-access-assign.png)
+    </Step>
+    <Step title="Enable SAML SSO in Infisical">
+        Enabling SAML SSO allows members in your organization to log into Infisical via Google Workspace.
+
+        ![Google SAML enable](../../../images/sso/google-saml/enable-saml.png)
+    </Step>
+    <Step title="Enforce SAML SSO in Infisical">
+        Enforcing SAML SSO ensures that members in your organization can only access Infisical
+        by logging into the organization via Google.
+
+        To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Google user with Infisical;
+        Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
+        
+        <Warning>
+            We recommend ensuring that your account is provisioned the application in Google
+            prior to enforcing SAML SSO to prevent any unintended issues.
+        </Warning>
+    </Step>
+</Steps>
+
+<Note>
+   If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
+   set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+   
+   - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+   - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+</Note>
+
+References:
+- Google's guide to [set up your own custom SAML app](https://support.google.com/a/answer/6087519?hl=en#add_custom_saml&turn_on&verify_sso&&zippy=%2Cstep-add-the-custom-saml-app%2Cstep-turn-on-your-saml-app%2Cstep-verify-that-sso-is-working-with-your-custom-app).

docs/documentation/platform/sso/jumpcloud.mdx

@@ -4,7 +4,7 @@ description: "Configure JumpCloud SAML for Infisical SSO"
 ---
 
 <Info>
-   JumpCloud SAML SSO feature is a paid feature.
+   JumpCloud SAML SSO is a paid feature.
    
    If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
    then you should contact team@infisical.com to purchase an enterprise license to use it.
@@ -12,7 +12,7 @@ description: "Configure JumpCloud SAML for Infisical SSO"
 
 <Steps>
    <Step title="Prepare the SAML SSO configuration in Infisical">
-      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+      In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
 
       Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
 
@@ -81,6 +81,11 @@ description: "Configure JumpCloud SAML for Infisical SSO"
 
       To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one JumpCloud user with Infisical;
       Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
+      
+      <Warning>
+         We recommend ensuring that your account is provisioned the application in JumpCloud
+         prior to enforcing SAML SSO to prevent any unintended issues.
+      </Warning>
    </Step>
 </Steps>
 

docs/documentation/platform/sso/okta.mdx

@@ -4,7 +4,7 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
 ---
 
 <Info>
-   Okta SAML SSO feature is a paid feature.
+   Okta SAML SSO is a paid feature.
    
    If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
    then you should contact team@infisical.com to purchase an enterprise license to use it.
@@ -12,7 +12,7 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
 
 <Steps>
    <Step title="Prepare the SAML SSO configuration in Infisical">
-      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+      In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
       
       Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
       ![Okta SAML initial configuration](../../../images/sso/okta/init-config.png)
@@ -84,6 +84,11 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
 
       To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Okta user with Infisical;
       Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
+
+      <Warning>
+         We recommend ensuring that your account is provisioned the application in Okta
+         prior to enforcing SAML SSO to prevent any unintended issues.
+      </Warning>
    </Step>
 </Steps>
 

docs/documentation/platform/sso/overview.mdx

@@ -3,13 +3,13 @@ title: "SSO Overview"
 description: "Log in to Infisical via SSO protocols"
 ---
 
-<Warning>
+<Info>
   Infisical offers Google SSO and GitHub SSO for free across both Infisical Cloud and Infisical Self-hosted.
   
   Infisical also offers SAML SSO authentication but as paid features that can be unlocked on Infisical Cloud's **Pro** tier
   or via enterprise license on self-hosted instances of Infisical. On this front, we support industry-leading providers including 
-  Okta, Azure AD, and JumpCloud; with any questions, please reach out to [sales@infisical.com](mailto:sales@infisical.com).
-</Warning>
+  Okta, Azure AD, and JumpCloud; with any questions, please reach out to team@infisical.com.
+</Info>
 
 You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
 
@@ -22,3 +22,4 @@ your IdP cannot and will not have access to the decryption key needed to decrypt
 - [Okta SAML](/documentation/platform/sso/okta)
 - [Azure SAML](/documentation/platform/sso/azure)
 - [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
+- [Google SAML](/documentation/platform/sso/google-saml)

docs/infisical-agent/guides/docker-swarm-with-agent.mdx

@@ -0,0 +1,164 @@
+---
+title: 'Docker Swarm'
+description: "How to manage secrets in Docker Swarm services"
+---
+
+In this guide, we'll demonstrate how to use Infisical for managing secrets within Docker Swarm. 
+Specifically, we'll set up a sidecar container using the [Infisical Agent](/infisical-agent/overview), which authenticates with Infisical to retrieve secrets and access tokens. 
+These secrets are then stored in a shared volume accessible by other services in your Docker Swarm.
+
+## Prerequisites
+- Infisical account
+- Docker version 20.10.24 or newer
+- Basic knowledge of Docker Swarm
+- [Git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) installed on your system
+- Familiarity with the [Infisical Agent](/infisical-agent/overview)
+
+## Objective
+Our goal is to deploy an Nginx instance in your Docker Swarm cluster, configured to display Infisical secrets on its landing page. This will provide hands-on experience in fetching and utilizing secrets from Infisical within Docker Swarm. The principles demonstrated here are also applicable to Docker Compose deployments.
+
+<Steps>
+  <Step title="Cloning the Guide Assets Repository">
+    Start by cloning the [Infisical guide assets repository](https://github.com/Infisical/infisical-guides.git) from Github. This repository includes necessary assets for this and other Infisical guides. Focus on the `docker-swarm-with-agent` sub-directory, which we'll use as our working directory.
+  </Step>
+
+  <Step title="Setting Up Authentication with Infisical">
+    To allow the agent to fetch your Infisical secrets, choose an authentication method for the agent. For this guide, we will use [Universal Auth](/documentation/platform/identities/universal-auth) for authentication. Follow the instructions [here](/documentation/platform/identities/universal-auth) to generate a client ID and client secret.
+  </Step>
+
+  <Step title="Entering Universal Auth Credentials">
+    Copy the client ID and client secret obtained in the previous step into the `client-id` and `client-secret` text files, respectively.
+  </Step>
+
+  <Step title="Configuring the Infisical Agent">
+    The Infisical Agent will authenticate using Universal Auth and retrieve secrets for rendering as specified in the template(s). 
+    Adjust the `polling-interval` to control the frequency of secret updates. 
+
+    In the example template, the secrets are rendered as an HTML page, which will be set as Nginx's home page to demonstrate successful secret retrieval and utilization.
+
+    <Tip>
+      Remember to add your project id, environment slug and path of corresponding Infisical project to the secret template.
+    </Tip>
+    <Tabs>
+      <Tab title="Agent Configuration">
+        ```yaml infisical-agent-config
+        infisical:
+        address: "https://app.infisical.com"
+        auth:
+          type: "universal-auth"
+          config:
+            client-id: "/run/secrets/infisical-universal-auth-client-id"
+            client-secret: "/run/secrets/infisical-universal-auth-client-secret"
+            remove_client_secret_on_read: false
+        sinks:
+          - type: "file"
+            config:
+              path: "/infisical-secrets/access-token"
+        templates:
+          - source-path: /run/secrets/nginx-home-page-template
+            destination-path: /infisical-secrets/index.html
+            config:
+              polling-interval: 60s
+        ```
+        <Info>
+          Some paths contain `/run/secrets/` because the contents of those files reside in a [Docker secret](https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets).
+        </Info>
+      </Tab>
+      <Tab title="Secret Template for Agent">
+        ```html nginx-home-page-template
+        <!DOCTYPE html>
+        <html lang="en">
+        <body>
+            <h1>This file is rendered by Infisical agent template engine</h1>
+            <p>Here are the secrets that have been fetched from Infisical and stored in your volume mount</p>
+            <ol>
+              {{- with secret "7df67a5f-d26a-4988-a375-7153c08149da" "dev" "/" }}
+              {{- range . }}
+              <li>{{ .Key }}={{ .Value }}</li>
+              {{- end }}
+              {{- end }}
+            </ol>
+        </body>
+        </html>
+        ```
+      </Tab>
+    </Tabs>
+  </Step>
+
+  <Step title="Creating the Docker Compose File">
+    Define the `infisical-agent` and `nginx` services in your Docker Compose file. `infisical-agent` will handle secret retrieval and storage. These secrets are stored in a volume, accessible by other services like Nginx.
+
+    ```yaml docker-compose.yaml
+    version: "3.1"
+
+    services:
+      infisical-agent:
+        container_name: infisical-agnet
+        image: infisical/cli:0.18.0
+        command: agent --config=/run/secrets/infisical-agent-config
+        volumes:
+          - infisical-agent:/infisical-secrets
+        secrets:
+          - infisical-universal-auth-client-id
+          - infisical-universal-auth-client-secret
+          - infisical-agent-config
+          - nginx-home-page-template
+        networks:
+          - infisical_network
+
+      nginx:
+        image: nginx:latest
+        ports:
+          - "80:80"
+        volumes:
+          - infisical-agent:/usr/share/nginx/html
+        networks:
+          - infisical_network
+
+    volumes:
+      infisical-agent: 
+
+    secrets:
+      infisical-universal-auth-client-id:
+        file: ./client-id
+      infisical-universal-auth-client-secret:
+        file: ./client-secret
+      infisical-agent-config:
+        file: ./infisical-agent-config
+      nginx-home-page-template:
+        file: ./nginx-home-page-template
+        
+
+    networks:
+      infisical_network:
+    ```
+  </Step>
+
+  <Step title="Initializing Docker Swarm">
+    ```
+    docker swarm init
+    ```
+  </Step>
+
+  <Step title="Deploying the Docker Stack">
+    ```
+    docker stack deploy -c docker-compose.yaml agent-demo
+    ```
+  </Step>
+
+  <Step title="Verifying Secret Consumption">
+    To confirm that secrets are properly rendered and accessible, navigate to `http://localhost`. You should see the Infisical secrets displayed on the Nginx landing page.
+
+    ![Nginx displaying Infisical secrets](/images/docker-swarm-secrets-complete.png)
+  </Step>
+
+  <Step title="Clean up">
+    ```
+    docker stack rm agent-demo
+    ```
+  </Step>
+</Steps>
+
+## Considerations
+- Secret Updates: Applications that access secrets directly from the volume mount will receive updates in real-time, in accordance with the `polling-interval` set in agent config.
+- In-Memory Secrets: If your application loads secrets into memory, the new secrets will be available to the application on the next deployment.

docs/infisical-agent/overview.mdx

@@ -1,5 +1,6 @@
 ---
-title: "Infisical Agent"
+title: "Overview"
+description: "This page describes how to manage secrets using Infisical Agent."
 ---
 
 Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
@@ -51,6 +52,9 @@ While specifying an authentication method is mandatory to start the agent, confi
 | `sinks[].config.path`        | The file path where the access token should be stored for each sink in the list. |
 | `templates[].source-path`    | The path to the template file that should be used to render secrets. |
 | `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
+| `templates[].config.polling-interval` | How frequently to check for secret changes. Default: `60s` (optional)  |
+| `templates[].config.execute.command` | The command to execute when secret change is detected (optional) |
+| `templates[].config.execute.timeout` | How long in seconds to wait for command to execute before timing out (optional) |
 
 
 ## Quick start Infisical Agent
@@ -76,6 +80,11 @@ sinks:
 templates:
   - source-path: my-dot-ev-secret-template
     destination-path: /some/path/.env
+    config:
+      polling-interval: 60s
+      execute:
+        timeout: 30
+        command: ./reload-app.sh
 ```
 
 Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template. 

docs/integrations/cloud/heroku.mdx

@@ -30,6 +30,17 @@ description: "How to sync secrets from Infisical to Heroku"
         Select which Infisical environment secrets you want to sync to which Heroku app and press create integration to start syncing secrets to Heroku.
         
         ![integrations heroku](../../images/integrations/heroku/integrations-heroku-create.png)
+
+        Here's some guidance on each field:
+        
+        - Project Environment: The environment in the current Infisical project from which you want to sync secrets from.
+        - Secrets Path: The path in the current Infisical project from which you want to sync secrets from such as `/` (for secrets that do not reside in a folder) or `/foo/bar` (for secrets nested in a folder, in this case a folder called `bar` in another folder called `foo`).
+        - Heroku App: The application in Heroku that you want to sync secrets to.
+        - Initial Sync Behavior (default is **Import - Prefer values from Infisical**): The behavior of the first sync operation triggered after creating the integration.
+          - **No Import - Overwrite all values in Heroku**: Sync secrets and overwrite any existing secrets in Heroku.
+          - **Import - Prefer values from Infisical**: Import secrets from Heroku to Infisical; if a secret with the same name already exists in Infisical, do nothing. Afterwards, sync secrets to Heroku.
+          - **Import - Prefer values from Heroku**: Import secrets from Heroku to Infisical; if a secret with the same name already exists in Infisical, replace its value with the one from Heroku. Afterwards, sync secrets to Heroku.
+        
         ![integrations heroku](../../images/integrations/heroku/integrations-heroku.png)
       </Step>
     </Steps>

docs/integrations/platforms/ansible.mdx

@@ -5,6 +5,19 @@ description: "How to use Infisical for secret management in Ansible"
 
 The documentation for using Infisical to manage secrets in Ansible is currently available [here](https://galaxy.ansible.com/ui/repo/published/infisical/vault/).
 
-<Info>
-  Have any questions? Join Infisical's [community Slack](https://infisical.com/slack) for quick support.
-</Info>
+## Troubleshoot 
+
+<Accordion title="I'm getting a error related to objc[72832]: +[__NSCFConstantString initialize]">
+  If you get this Python error when you running the lookup plugin:-
+
+  ```
+  objc[72832]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.
+  Fatal Python error: Aborted
+  ```
+
+  You will need to add this to your shell environment or ansible wrapper script:-
+
+  ```
+  export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+  ```
+</Accordion>

docs/integrations/platforms/docker-intro.mdx

@@ -1,25 +1,25 @@
 ---
 title: "Docker"
-description: "Learn how to feed secrets from Infisical into your docker application"
+description: "Learn how to feed secrets from Infisical into your Docker application"
 ---
-There are many methods to inject Infisical secrets to docker-based applications. 
-Regardless of which method you choose, these methods will inject secrets from Infisical as environment variables into your Docker container.
+There are many methods to inject Infisical secrets into Docker-based applications. 
+Regardless of the method you choose, they all inject secrets from Infisical as environment variables into your Docker container.
 
 <Card title="Docker Entrypoint" color="#ea5a0c" href="./docker">
   Install and run your app start command with Infisical CLI
 </Card>
 <CardGroup cols={2}>
   <Card title="Docker run" color="#0285c7" href="./docker-pass-envs">
-    Feed secrets via `--env-file` flag in docker run command
+    Feed secrets with the `--env-file` flag when using the
+    `docker run` command
   </Card>
   <Card title="Docker compose" color="#16a34a" href="./docker-compose">
-    Inject secrets to multiple services using Docker Compose
+    Inject secrets into multiple services using Docker Compose
   </Card>
 </CardGroup>
 
 <Info>
 The main difference between the "Docker Entrypoint" and "Docker run" approach is where the Infisical CLI is installed. 
-In most production settings, it's typically inconvenient to have the Infisical CLI installed and executed externally.
-As a result, we suggest using the "Docker Entrypoint" method for production purposes. 
+In most production settings, it's typically less convenient to have the Infisical CLI installed and executed externally, so we suggest using the "Docker Entrypoint" method for production purposes. 
 However, if this limitation doesn't apply to you, select the method that best fits your needs.
 </Info>

docs/integrations/platforms/docker.mdx

@@ -51,7 +51,7 @@ CMD ["infisical", "run", "--", "npm", "run", "start"]
 CMD ["infisical", "run", "--command", "npm run start && ..."]
 ```
 
-## Generate an service token
+## Generate a service token
 
 Head to your project settings in the Infisical dashboard to generate an [service token](/documentation/platform/token). 
 This service token will allow you to authenticate and fetch secrets from Infisical. 

docs/internals/components.mdx

@@ -9,9 +9,7 @@ The Infisical API (sometimes referred to as the **backend**) contains the core p
 
 ## Storage backend
 
-Infisical relies on a storage backend to store data including users and secrets.
-
-Currently, the only supported storage backend is [MongoDB](https://www.mongodb.com) but we plan to add support for other options including PostgreSQL in Q1 2024.
+Infisical relies on a storage backend to store data including users and secrets. Infisical's storage backend is Postgres.
 
 ## Redis
 
@@ -27,4 +25,4 @@ Clients are any application or infrastructure that connecting to the Infisical A
 - Public API: Making API requests directly to the Infisical API.
 - Client SDK: A platform-specific library with method abstractions for working with secrets. Currently, there are three official SDKs: [Node SDK](https://infisical.com/docs/sdks/languages/node), [Python SDK](https://infisical.com/docs/sdks/languages/python), and [Java SDK](https://infisical.com/docs/sdks/languages/java).
 - CLI: A terminal-based interface for interacting with the Infisical API.
-- Kubernetes Operator: This operator retrieves secrets from Infisical and securely store
+- Kubernetes Operator: This operator retrieves secrets from Infisical and securely store

docs/mint.json

@@ -39,32 +39,32 @@
     "name": "Start for Free",
     "url": "https://app.infisical.com/signup"
   },
-  "anchors": [
+  "tabs": [
     {
-      "name": "Internals",
-      "icon": "sitemap",
-      "url": "internals"
-    },
-    {
-      "name": "SDKs",
-      "icon": "puzzle-piece",
-      "url": "sdks"
+      "name": "Changelog",
+      "url": "changelog"
     },
     {
       "name": "API Reference",
-      "icon": "cloud",
       "url": "api-reference"
     },
     {
-      "name": "Changelog",
-      "icon": "timer",
-      "url": "changelog"
+      "name": "SDKs",
+      "url": "sdks"
     },
+    {
+      "name": "Contributing",
+      "url": "contributing"
+    }
+  ],
+  "anchors": [
+   
     {
       "name": "Contributing",
       "icon": "code",
       "url": "contributing"
     },
+    
     {
       "name": "Blog",
       "icon": "newspaper",
@@ -79,6 +79,11 @@
       "name": "GitHub",
       "icon": "github",
       "url": "https://github.com/Infisical/infisical"
+    },
+    {
+      "name": "Internals",
+      "icon": "sitemap",
+      "url": "internals"
     }
   ],
   "navigation": [
@@ -134,7 +139,8 @@
             "documentation/platform/secret-rotation/overview",
             "documentation/platform/secret-rotation/sendgrid",
             "documentation/platform/secret-rotation/postgres",
-            "documentation/platform/secret-rotation/mysql"
+            "documentation/platform/secret-rotation/mysql",
+            "documentation/platform/secret-rotation/aws-iam"
           ]
         },
         {
@@ -146,7 +152,25 @@
             "documentation/platform/sso/gitlab",
             "documentation/platform/sso/okta",
             "documentation/platform/sso/azure",
-            "documentation/platform/sso/jumpcloud"
+            "documentation/platform/sso/jumpcloud",
+            "documentation/platform/sso/google-saml"
+          ]
+        },
+        {
+          "group": "LDAP",
+          "pages": [
+            "documentation/platform/ldap/overview",
+            "documentation/platform/ldap/jumpcloud",
+            "documentation/platform/ldap/general"
+          ]
+        },
+        {
+          "group": "SCIM",
+          "pages": [
+            "documentation/platform/scim/overview",
+            "documentation/platform/scim/okta",
+            "documentation/platform/scim/azure",
+            "documentation/platform/scim/jumpcloud"
           ]
         }
       ]
@@ -154,27 +178,25 @@
     {
       "group": "Self-host Infisical",
       "pages": [
+        "self-hosting/overview",
+        "self-hosting/configuration/requirements",
         {
-          "group": "Deployment options",
+          "group": "Installation methods",
           "pages": [
-            "self-hosting/overview",
             "self-hosting/deployment-options/standalone-infisical",
             "self-hosting/deployment-options/docker-compose",
-            "self-hosting/deployment-options/kubernetes-helm",
-            "self-hosting/deployment-options/aws-ec2",
-            "self-hosting/deployment-options/aws-lightsail",
-            "self-hosting/deployment-options/gcp-cloud-run",
-            "self-hosting/deployment-options/azure-app-services",
-            "self-hosting/deployment-options/azure-container-instances",
-            "self-hosting/deployment-options/digital-ocean-marketplace",
-            "self-hosting/deployment-options/fly.io",
-            "self-hosting/deployment-options/railway"
+            "self-hosting/deployment-options/kubernetes-helm"
           ]
         },
         "self-hosting/configuration/envars",
-        "self-hosting/configuration/email",
-        "self-hosting/configuration/redis",
-        "self-hosting/configuration/sso",
+        {
+          "group": "Guides",
+          "pages": [
+            "self-hosting/configuration/schema-migrations",
+            "self-hosting/guides/mongo-to-postgres"
+          ]
+        },
+        "self-hosting/ee",
         "self-hosting/faq"
       ]
     },
@@ -213,16 +235,27 @@
     {
       "group": "Agent",
       "pages": [
-        "infisical-agent/overview"
+        "infisical-agent/overview",
+        {
+          "group": "Use cases",
+          "pages": [
+            "infisical-agent/guides/docker-swarm-with-agent",
+            "integrations/platforms/ecs-with-agent"
+          ]
+        }
       ]
     },
-    {
-      "group": "Integrations",
-      "pages": ["integrations/overview"]
-    },
     {
       "group": "Infrastructure Integrations",
       "pages": [
+        {
+          "group": "Container orchestrators",
+          "pages": [
+            "integrations/platforms/kubernetes",
+            "infisical-agent/guides/docker-swarm-with-agent",
+            "integrations/platforms/ecs-with-agent"
+          ]
+        },
         {
           "group": "Docker",
           "pages": [
@@ -232,14 +265,12 @@
             "integrations/platforms/docker-compose"
           ]
         },
-        "integrations/platforms/kubernetes",
         "integrations/frameworks/terraform",
-        "integrations/platforms/ansible",
-        "integrations/platforms/ecs-with-agent"
+        "integrations/platforms/ansible"
       ]
     },
     {
-      "group": "3rd-party Integrations",
+      "group": "Native Integrations",
       "pages": [
         {
           "group": "AWS",
@@ -252,39 +283,49 @@
           "group": "Digital Ocean",
           "pages": ["integrations/cloud/digital-ocean-app-platform"]
         },
-        "integrations/cloud/heroku",
         "integrations/cloud/vercel",
-        "integrations/cloud/netlify",
-        "integrations/cloud/render",
-        "integrations/cloud/railway",
-        "integrations/cloud/flyio",
-        "integrations/cloud/laravel-forge",
-        "integrations/cloud/supabase",
-        "integrations/cloud/northflank",
-        "integrations/cloud/hasura-cloud",
-        "integrations/cloud/terraform-cloud",
-        "integrations/cloud/cloudflare-pages",
-        "integrations/cloud/cloudflare-workers",
-        "integrations/cloud/qovery",
-        "integrations/cloud/hashicorp-vault",
         "integrations/cloud/azure-key-vault",
         "integrations/cloud/gcp-secret-manager",
-        "integrations/cloud/cloud-66",
-        "integrations/cloud/windmill"
+        {
+          "group": "View more",
+          "pages": [
+            "integrations/cloud/heroku",
+            "integrations/cloud/netlify",
+            "integrations/cloud/render",
+            "integrations/cloud/railway",
+            "integrations/cloud/flyio",
+            "integrations/cloud/laravel-forge",
+            "integrations/cloud/supabase",
+            "integrations/cloud/northflank",
+            "integrations/cloud/hasura-cloud",
+            "integrations/cloud/terraform-cloud",
+            "integrations/cloud/cloudflare-pages",
+            "integrations/cloud/cloudflare-workers",
+            "integrations/cloud/qovery",
+            "integrations/cloud/hashicorp-vault",
+            "integrations/cloud/cloud-66",
+            "integrations/cloud/windmill"
+          ]
+        }
       ]
     },
     {
       "group": "CI/CD Integrations",
       "pages": [
         "integrations/cloud/teamcity",
-        "integrations/cloud/checkly",
         "integrations/cicd/githubactions",
         "integrations/cicd/gitlab",
-        "integrations/cicd/circleci",
-        "integrations/cicd/travisci",
-        "integrations/cicd/bitbucket",
-        "integrations/cicd/codefresh",
-        "integrations/cicd/jenkins"
+        {
+          "group": "View more",
+          "pages": [
+            "integrations/cicd/circleci",
+            "integrations/cicd/travisci",
+            "integrations/cicd/bitbucket",
+            "integrations/cicd/codefresh",
+            "integrations/cicd/jenkins",
+            "integrations/cloud/checkly"
+          ]
+        }
       ]
     },
     {
@@ -294,20 +335,25 @@
         "integrations/frameworks/react",
         "integrations/frameworks/vue",
         "integrations/frameworks/express",
-        "integrations/frameworks/nextjs",
-        "integrations/frameworks/nestjs",
-        "integrations/frameworks/sveltekit",
-        "integrations/frameworks/nuxt",
-        "integrations/frameworks/gatsby",
-        "integrations/frameworks/remix",
-        "integrations/frameworks/vite",
-        "integrations/frameworks/fiber",
-        "integrations/frameworks/django",
-        "integrations/frameworks/flask",
-        "integrations/frameworks/laravel",
-        "integrations/frameworks/rails",
-        "integrations/frameworks/dotnet",
-        "integrations/platforms/pm2"
+        {
+          "group": "View more",
+          "pages": [
+            "integrations/frameworks/nextjs",
+            "integrations/frameworks/nestjs",
+            "integrations/frameworks/sveltekit",
+            "integrations/frameworks/nuxt",
+            "integrations/frameworks/gatsby",
+            "integrations/frameworks/remix",
+            "integrations/frameworks/vite",
+            "integrations/frameworks/fiber",
+            "integrations/frameworks/django",
+            "integrations/frameworks/flask",
+            "integrations/frameworks/laravel",
+            "integrations/frameworks/rails",
+            "integrations/frameworks/dotnet",
+            "integrations/platforms/pm2"
+          ]
+        }
       ]
     },
     {
@@ -316,7 +362,18 @@
     },
     {
       "group": "Overview",
-      "pages": ["sdks/overview"]
+      "pages": [
+        "sdks/overview"
+      ]
+    }, 
+    {
+      "group": "SDK's",
+      "pages": [
+        "sdks/languages/node",
+        "sdks/languages/python",
+        "sdks/languages/java",
+        "sdks/languages/csharp"
+      ]
     },
     {
       "group": "Overview",
@@ -377,9 +434,14 @@
         {
           "group": "Projects",
           "pages": [
+            "api-reference/endpoints/workspaces/create-workspace",
+            "api-reference/endpoints/workspaces/delete-workspace",
+            "api-reference/endpoints/workspaces/get-workspace",
+            "api-reference/endpoints/workspaces/update-workspace",
+            "api-reference/endpoints/workspaces/invite-member-to-workspace",
+            "api-reference/endpoints/workspaces/remove-member-from-workspace",
             "api-reference/endpoints/workspaces/memberships",
             "api-reference/endpoints/workspaces/update-membership",
-            "api-reference/endpoints/workspaces/delete-membership",
             "api-reference/endpoints/workspaces/list-identity-memberships",
             "api-reference/endpoints/workspaces/update-identity-membership",
             "api-reference/endpoints/workspaces/delete-identity-membership",

docs/sdks/languages/csharp.mdx

@@ -1,6 +1,7 @@
 ---
 title: "Infisical .NET SDK"
-icon: "C#"
+sidebarTitle: ".NET"
+icon: "bars"
 ---
 
 If you're working with C#, the official [Infisical C# SDK](https://github.com/Infisical/sdk/tree/main/languages/csharp) package is the easiest way to fetch and work with secrets for your application.

docs/sdks/languages/java.mdx

@@ -1,5 +1,6 @@
 ---
 title: "Infisical Java SDK"
+sidebarTitle: "Java"
 icon: "java"
 ---
 

docs/sdks/languages/node.mdx

@@ -1,5 +1,6 @@
 ---
 title: "Infisical Node.js SDK"
+sidebarTitle: "Node.js"
 icon: "node"
 ---
 
@@ -42,7 +43,7 @@ app.get("/", async (req, res) => {
 app.listen(PORT, async () => {
     // initialize client
 
-    console.log(`App listening on port ${port}`);
+    console.log(`App listening on port ${PORT}`);
 });
 ```
 

docs/sdks/languages/python.mdx

@@ -1,5 +1,6 @@
 ---
 title: "Infisical Python SDK"
+sidebarTitle: "Python"
 icon: "python"
 ---
 

docs/self-hosting/configuration/email.mdx

@@ -1,242 +0,0 @@
----
-title: "Configure email service"
-description: "How to configure your email when self-hosting Infisical."
----
-
-By default, the core functions of Infisical work without any email service configuration. Without email service, basic sign up/login and secret operations will function without any issue.
-However, the following functionality will be disabled.
-
-- Multi-factor authentication
-- Sending invite links via email for projects to teammates
-- Sending alerts such as suspicious login attempts
-
-## Configuration
-
-If you choose to setup email service, you need to configure the following SMTP [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):
-
-- `SMTP_HOST`: Hostname to connect to for establishing SMTP connections.
-- `SMTP_USERNAME`: Credential to connect to host (e.g. team@infisical.com)
-- `SMTP_PASSWORD`: Credential to connect to host.
-- `SMTP_PORT`: Port to connect to for establishing SMTP connections.
-- `SMTP_SECURE`: If `true`, the connection will use TLS when connecting to server with special configs for SendGrid and Mailgun. If `false` (the default) then TLS is used if server supports the STARTTLS extension.
-- `SMTP_FROM_ADDRESS`: Email address to be used for sending emails (e.g. team@infisical.com).
-- `SMTP_FROM_NAME`: Name label to be used in `From` field (e.g. Team).
-
-Below you will find details on how to configure common email providers:
-
-<AccordionGroup>
-<Accordion title="Resend">
-1. Create an account on [Resend](https://resend.com).
-2. Add a [Domain](https://resend.com/domains).
-
-![adding resend domain](../../images/self-hosting/configuration/email/email-resend-create-domain.png)
-
-3. Create an [API Key](https://resend.com/api-keys).
-
-![creating resend api key](../../images/self-hosting/configuration/email/email-resend-create-key.png)
-
-4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
-
-![go to resend smtp settings](../../images/self-hosting/configuration/email/email-resend-smtp-settings.png)
-
-5. With the API Key, you can now set your SMTP environment variables variables:
-
-```
-SMTP_HOST=smtp.resend.com
-SMTP_USERNAME=resend
-SMTP_PASSWORD=YOUR_API_KEY
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
-SMTP_FROM_NAME=Infisical
-```
-  <Info>
-    Remember that you will need to restart Infisical for this to work properly.
-  </Info>
-</Accordion>
-
-<Accordion title="Twilio SendGrid">
-
-1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
-2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
-3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
-
-![creating sendgrid api key](../../images/self-hosting/configuration/email/email-sendgrid-create-key.png)
-
-![setting sendgrid api key restriction](../../images/self-hosting/configuration/email/email-sendgrid-restrictions.png)
-
-4. With the API Key, you can now set your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.sendgrid.net
-SMTP_USERNAME=apikey
-SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
-SMTP_FROM_NAME=Infisical
-```
-
-  <Info>
-    Remember that you will need to restart Infisical for this to work properly.
-  </Info>
-</Accordion>
-
-<Accordion title="Mailgun">
-
-1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
-2. Obtain your Mailgun credentials in Sending > Overview > SMTP
-
-![obtain mailhog api key estriction](../../images/self-hosting/configuration/email/email-mailhog-credentials.png)
-
-3. With your Mailgun credentials, you can now set up your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.mailgun.org # obtained from credentials page
-SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
-SMTP_PASSWORD=password # obtained from credentials page
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
-SMTP_FROM_NAME=Infisical
-```
-
-</Accordion>
-
-<Accordion title="AWS SES">
-
-1. Create an account and [configure AWS SES](https://aws.amazon.com/premiumsupport/knowledge-center/ses-set-up-connect-smtp/) to send emails in the Amazon SES console.
-2. Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
-
-![opening AWS SES console](../../images/self-hosting/configuration/email/email-aws-ses-console.png)
-
-![creating AWS IAM SES user](../../images/self-hosting/configuration/email/email-aws-ses-user.png)
-
-3. With your AWS SES SMTP credentials, you can now set up your SMTP environment variables:
-
-```
-SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
-SMTP_USERNAME=xxx # your SMTP username
-SMTP_PASSWORD=xxx # your SMTP password
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
-SMTP_FROM_NAME=Infisical
-```
-
-<Info>
-  Remember that you will need to restart Infisical for this to work properly.
-</Info>
-</Accordion>
-
-<Accordion title="SocketLabs">
-
-1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
-2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
-
-![opening SocketLabs dashboard](../../images/self-hosting/configuration/email/email-socketlabs-dashboard.png)
-
-![obtaining SocketLabs credentials](../../images/self-hosting/configuration/email/email-socketlabs-credentials.png)
-
-3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.socketlabs.com
-SMTP_USERNAME=username # obtained from your credentials
-SMTP_PASSWORD=password # obtained from your credentials
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
-SMTP_FROM_NAME=Infisical
-```
-
-<Note>
-  The `SMTP_FROM_ADDRESS` environment variable should be an email for an
-  authenticated domain under Configuration > Domain Management in SocketLabs.
-  For example, if you're using SocketLabs in sandbox mode, then you may use an
-  email like `team@sandbox.socketlabs.dev`.
-</Note>
-
-![SocketLabs domain management](../../images/self-hosting/configuration/email/email-socketlabs-domains.png)
-
-<Info>
-  Remember that you will need to restart Infisical for this to work properly.
-</Info>
-</Accordion>
-
-<Accordion title="Gmail">
-
-Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
-applications like Infisical to authenticate with Gmail via your username and password.
-
-![Gmail secure app access](../../images/self-hosting/configuration/email/email-gmail-app-access.png)
-
-With your Gmail username and password, you can set your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.gmail.com
-SMTP_USERNAME=hey@gmail.com # your email
-SMTP_PASSWORD=password # your password
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@gmail.com
-SMTP_FROM_NAME=Infisical
-```
-
-<Warning>
-  As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
-  will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
-
-Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
-
-</Warning>
-
-</Accordion>
-
-<Accordion title="Office365">
-
-1. Create an account and configure [Office365](https://www.office.com/) to send emails.
-
-2. With your login credentials, you can now set up your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.office365.com
-SMTP_USERNAME=username@yourdomain.com # your username
-SMTP_PASSWORD=password # your password
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=username@yourdomain.com
-SMTP_FROM_NAME=Infisical
-```
-
-</Accordion>
-
-<Accordion title="Zoho Mail">
-
-1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
-
-2. With your email credentials, you can now set up your SMTP environment variables:
-
-```
-SMTP_HOST=smtp.zoho.com
-SMTP_USERNAME=username # your email
-SMTP_PASSWORD=password # your password
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
-SMTP_FROM_NAME=Infisical
-```
-
-<Note>
-  You can use either your personal Zoho email address like `you@zohomail.com` or
-  a domain-based email address like `you@yourdomain.com`. If using a
-  domain-based email address, then please make sure that you've configured and
-  verified it with Zoho Mail.
-</Note>
-
-<Info>
-  Remember that you will need to restart Infisical for this to work properly.
-</Info>
-</Accordion>
-
-</AccordionGroup>

docs/self-hosting/configuration/envars.mdx

@@ -1,188 +1,426 @@
 ---
-title: "All environment variables"
-description: "Configure your environment variables when self-hosting Infisical."
+title: "Configurations"
+description: "Configure environment variables for self-hosted Infisical"
 ---
 
-## Environment variables
 
-Depending on your chosen self hosted deployment method, you may need to configured at least the required environment variable listed below.
-Other environment variables are listed below to increase the functionality of your self hosted instance based on your use case.
+Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least `ENCRYPTION_KEY`, `AUTH_SECRET`, `DB_CONNECTION_URI` and `REDIS_URL` must be defined. 
+However, you can configure additional settings to activate more features as needed.
 
-<Tabs>
-  <Tab title="Required">
-    <ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
-      Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
-    </ParamField>
+## General platform    
+Used to configure platform-specific security and operational settings
 
-    <ParamField query="AUTH_SECRET" type="string" default="none" required>
-      Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
-    </ParamField>
-
-    <ParamField query="MONGO_URL" type="string" default="none" required>
-      Mongo connection string. *TLS based connection string is not yet supported
-    </ParamField>
-
-    <ParamField query="REDIS_URL" type="string" default="none" required>
-      Redis connection string
-    </ParamField>
-  </Tab>
-  <Tab title="Email service">
-    <Info>When email service is not configured, Infisical will have limited functionality</Info>
-
-    <ParamField query="SMTP_HOST" type="string" default="none" optional>
-      Hostname to connect to for establishing SMTP connections
-    </ParamField>
-
-    <ParamField query="SMTP_USERNAME" type="string" default="none" optional>
-      Credential to connect to host (e.g. team@infisical.com)
-    </ParamField>
-
-    <ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
-      Credential to connect to host
-    </ParamField>
-
-    <ParamField query="SMTP_PORT" type="string" default="587" optional>
-        Port to connect to for establishing SMTP connections
-    </ParamField>
-
-    <ParamField query="SMTP_SECURE" type="string" default="none" optional>
-    If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
-    </ParamField>
-
-    <ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
-      Email address to be used for sending emails
-    </ParamField>
-
-    <ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
-      Name label to be used in From field (e.g. Team)
-    </ParamField>
-
-  </Tab>
-  <Tab title="Secret Integrations">
-    To sync secret to third party services, provide value for the related services
-
-    <ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
-      OAuth2 client ID for Heroku integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
-      OAuth2 client secret for Heroku integration
-    </ParamField>
-
-    <ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
-      OAuth2 client ID for Vercel integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
-      OAuth2 client secret for Vercel integration
-    </ParamField>
-
-    <ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
-      OAuth2 client ID for Netlify integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
-      OAuth2 client secret for Netlify integration
-    </ParamField>
-
-    <ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
-      OAuth2 client ID for GitHub integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
-      OAuth2 client secret for GitHub integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
-      OAuth2 slug for Vercel integration
-    </ParamField>
-
-    <ParamField query="CLIENT_ID_BITBUCKET" type="string" default="none" optional>
-      OAuth2 client ID for BitBucket integration
-    </ParamField>
-
-    <ParamField query="CLIENT_SECRET_BITBUCKET" type="string" default="none" optional>
-      OAuth2 client secret for BitBucket integration
-    </ParamField>
-
-  </Tab>
-  <Tab title="Auth Integrations">
-    To integrate with external auth providers, provide value for the related keys
-    <ParamField query="CLIENT_ID_GOOGLE_LOGIN" type="string" default="none" optional>
-      OAuth2 client ID for Google login
-    </ParamField>
-    <ParamField query="CLIENT_SECRET_GOOGLE_LOGIN" type="string" default="none" optional>
-      OAuth2 client secret for Google login
-    </ParamField>
-    <ParamField query="CLIENT_ID_GITHUB_LOGIN" type="string" default="none" optional>
-      OAuth2 client ID for GitHub login
-    </ParamField>
-    <ParamField query="CLIENT_SECRET_GITHUB_LOGIN" type="string" default="none" optional>
-      OAuth2 client secret for GitHub login
-    </ParamField>
-    <ParamField query="CLIENT_ID_GITLAB_LOGIN" type="string" default="none" optional>
-      OAuth2 client ID for GitLab login
-    </ParamField>
-    <ParamField query="CLIENT_SECRET_GITLAB_LOGIN" type="string" default="none" optional>
-      OAuth2 client secret for GitLab login
-    </ParamField>
-    <ParamField query="URL_GITLAB_LOGIN" type="string" default="https://gitlab.com" optional>
-      URL of your self-hosted instance of GitLab where the OAuth application is registered
-    </ParamField>
-  </Tab>
-  <Tab title="Others">
-    #### JWT
-    <ParamField query="JWT_SIGNUP_LIFETIME" type="string" default="15m" optional>
-      JWT token lifetime expressed in seconds or a string describing a time span
-    </ParamField>
-
-    <ParamField query="JWT_REFRESH_LIFETIME" type="string" default="90d" optional>
-      JWT token lifetime expressed in seconds or a string describing a time span
-    </ParamField>
-
-    <ParamField query="JWT_AUTH_LIFETIME" type="string" default="10d" optional>
-      JWT token lifetime expressed in seconds or a string describing a time span
-    </ParamField>
-
-    <ParamField query="JWT_MFA_LIFETIME" type="string" default="5m" optional>
-      JWT token lifetime expressed in seconds or a string describing a time span
-    </ParamField>
-
-    <ParamField query="JWT_PROVIDER_AUTH_LIFETIME" type="string" default="5m" optional>
-      JWT token lifetime expressed in seconds or a string describing a time span
-    </ParamField>
-
-#### Logging
-
-Infisical uses Sentry to report error logs
-
-<ParamField
-  query="PINO_LOG_LEVEL"
-  type="string"
-  default="info"
-  optional
->
-  The minimum log level for application logging; can be one of `trace`, `debug`, `info`, `warn`, `error`, or `fatal`.
+<ParamField query="ENCRYPTION_KEY" type="string" default="none" required>
+  Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
 </ParamField>
 
-<ParamField
-  query="SENTRY_DSN"
-  type="string"
-  default="none"
-  optional
-></ParamField>
-
-#### Settings
-
-{" "}
-
-<ParamField query="INVITE_ONLY_SIGNUP" type="string" default="false" optional>
-  Only allow users who are invited to sign up
+<ParamField query="AUTH_SECRET" type="string" default="none" required>
+  Must be a random 32 byte base64 string. Can be generated with `openssl rand -base64 32`
 </ParamField>
 
-  <ParamField query="SITE_URL" type="string" default="none" optional>
-    Site URL - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+<ParamField query="SITE_URL" type="string" default="none" optional>
+  Must be an absolute URL including the protocol (e.g. https://app.infisical.com).
+</ParamField>
+
+## Data Layer 
+The platform utilizes Postgres to persist all of its data and Redis for caching and backgroud tasks
+
+<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
+  Postgres database connection string. 
+</ParamField>
+
+<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
+  Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. 
+  Use the command below to encode your certificate:
+  `echo "<certificate>" | base64`
+</ParamField>
+
+<ParamField query="REDIS_URL" type="string" default="none" required>
+  Redis connection string.
+</ParamField>
+
+
+
+## Email service
+Without email configuration, Infisical's core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
+
+<Accordion title="Generic Configuration">
+  <ParamField query="SMTP_HOST" type="string" default="none" optional>
+    Hostname to connect to for establishing SMTP connections
   </ParamField>
-  <ParamField query="TELEMETRY_ENABLED" type="string" default="true" optional></ParamField>
-  </Tab>
-</Tabs>
+
+  <ParamField query="SMTP_USERNAME" type="string" default="none" optional>
+    Credential to connect to host (e.g. team@infisical.com)
+  </ParamField>
+
+  <ParamField query="SMTP_PASSWORD" type="string" default="none" optional>
+    Credential to connect to host
+  </ParamField>
+
+  <ParamField query="SMTP_PORT" type="string" default="587" optional>
+      Port to connect to for establishing SMTP connections
+  </ParamField>
+
+  <ParamField query="SMTP_SECURE" type="string" default="none" optional>
+  If true, use TLS when connecting to host. If false, TLS will be used if STARTTLS is supported
+  </ParamField>
+
+  <ParamField query="SMTP_FROM_ADDRESS" type="string" default="none" optional>
+    Email address to be used for sending emails
+  </ParamField>
+
+  <ParamField query="SMTP_FROM_NAME" type="string" default="none" optional>
+    Name label to be used in From field (e.g. Team)
+  </ParamField>
+</Accordion>
+
+<Accordion title="Twilio SendGrid">
+
+  1. Create an account and configure [SendGrid](https://sendgrid.com) to send emails.
+  2. Create a SendGrid API Key under Settings > [API Keys](https://app.sendgrid.com/settings/api_keys)
+  3. Set a name for your API Key, we recommend using "Infisical," and select the "Restricted Key" option. You will need to enable the "Mail Send" permission as shown below:
+
+  ![creating sendgrid api key](../../images/self-hosting/configuration/email/email-sendgrid-create-key.png)
+
+  ![setting sendgrid api key restriction](../../images/self-hosting/configuration/email/email-sendgrid-restrictions.png)
+
+  4. With the API Key, you can now set your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.sendgrid.net
+  SMTP_USERNAME=apikey
+  SMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step above
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
+  SMTP_FROM_NAME=Infisical
+  ```
+
+  <Info>
+    Remember that you will need to restart Infisical for this to work properly.
+  </Info>
+</Accordion>
+
+<Accordion title="Mailgun">
+  1. Create an account and configure [Mailgun](https://www.mailgun.com) to send emails.
+  2. Obtain your Mailgun credentials in Sending > Overview > SMTP
+
+  ![obtain mailhog api key estriction](../../images/self-hosting/configuration/email/email-mailhog-credentials.png)
+
+  3. With your Mailgun credentials, you can now set up your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.mailgun.org # obtained from credentials page
+  SMTP_USERNAME=postmaster@example.mailgun.org # obtained from credentials page
+  SMTP_PASSWORD=password # obtained from credentials page
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
+  SMTP_FROM_NAME=Infisical
+  ```
+</Accordion>
+
+<Accordion title="AWS SES">
+  1. Create an account and [configure AWS SES](https://aws.amazon.com/premiumsupport/knowledge-center/ses-set-up-connect-smtp/) to send emails in the Amazon SES console.
+  2. Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
+
+  ![opening AWS SES console](../../images/self-hosting/configuration/email/email-aws-ses-console.png)
+
+  ![creating AWS IAM SES user](../../images/self-hosting/configuration/email/email-aws-ses-user.png)
+
+  3. With your AWS SES SMTP credentials, you can now set up your SMTP environment variables:
+
+  ```
+  SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settings
+  SMTP_USERNAME=xxx # your SMTP username
+  SMTP_PASSWORD=xxx # your SMTP password
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
+  SMTP_FROM_NAME=Infisical
+  ```
+
+  <Info>
+    Remember that you will need to restart Infisical for this to work properly.
+  </Info>
+</Accordion>
+
+<Accordion title="SocketLabs">
+  1. Create an account and configure [SocketLabs](https://www.socketlabs.com/) to send emails.
+  2. From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
+
+  ![opening SocketLabs dashboard](../../images/self-hosting/configuration/email/email-socketlabs-dashboard.png)
+
+  ![obtaining SocketLabs credentials](../../images/self-hosting/configuration/email/email-socketlabs-credentials.png)
+
+  3. With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.socketlabs.com
+  SMTP_USERNAME=username # obtained from your credentials
+  SMTP_PASSWORD=password # obtained from your credentials
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
+  SMTP_FROM_NAME=Infisical
+  ```
+
+  <Note>
+    The `SMTP_FROM_ADDRESS` environment variable should be an email for an
+    authenticated domain under Configuration > Domain Management in SocketLabs.
+    For example, if you're using SocketLabs in sandbox mode, then you may use an
+    email like `team@sandbox.socketlabs.dev`.
+  </Note>
+
+  ![SocketLabs domain management](../../images/self-hosting/configuration/email/email-socketlabs-domains.png)
+
+  <Info>
+    Remember that you will need to restart Infisical for this to work properly.
+  </Info>
+</Accordion>
+
+<Accordion title="Resend">
+  1. Create an account on [Resend](https://resend.com).
+  2. Add a [Domain](https://resend.com/domains).
+
+  ![adding resend domain](../../images/self-hosting/configuration/email/email-resend-create-domain.png)
+
+  3. Create an [API Key](https://resend.com/api-keys).
+
+  ![creating resend api key](../../images/self-hosting/configuration/email/email-resend-create-key.png)
+
+  4. Go to the [SMTP page](https://resend.com/settings/smtp) and copy the values.
+
+  ![go to resend smtp settings](../../images/self-hosting/configuration/email/email-resend-smtp-settings.png)
+
+  5. With the API Key, you can now set your SMTP environment variables variables:
+
+  ```
+  SMTP_HOST=smtp.resend.com
+  SMTP_USERNAME=resend
+  SMTP_PASSWORD=YOUR_API_KEY
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your email address being used to send out emails
+  SMTP_FROM_NAME=Infisical
+  ```
+    <Info>
+      Remember that you will need to restart Infisical for this to work properly.
+    </Info>
+</Accordion>
+
+<Accordion title="Gmail">
+  Create an account and enable "less secure app access" in Gmail Account Settings > Security. This will allow
+  applications like Infisical to authenticate with Gmail via your username and password.
+
+  ![Gmail secure app access](../../images/self-hosting/configuration/email/email-gmail-app-access.png)
+
+  With your Gmail username and password, you can set your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.gmail.com
+  SMTP_USERNAME=hey@gmail.com # your email
+  SMTP_PASSWORD=password # your password
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@gmail.com
+  SMTP_FROM_NAME=Infisical
+  ```
+
+  <Warning>
+    As per the [notice](https://support.google.com/accounts/answer/6010255?hl=en) by Google, you should note that using Gmail credentials for SMTP configuration
+    will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
+
+  Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
+
+  </Warning>
+</Accordion>
+
+<Accordion title="Office365">
+  1. Create an account and configure [Office365](https://www.office.com/) to send emails.
+
+  2. With your login credentials, you can now set up your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.office365.com
+  SMTP_USERNAME=username@yourdomain.com # your username
+  SMTP_PASSWORD=password # your password
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=username@yourdomain.com
+  SMTP_FROM_NAME=Infisical
+  ```
+</Accordion>
+
+<Accordion title="Zoho Mail">
+  1. Create an account and configure [Zoho Mail](https://www.zoho.com/mail/) to send emails.
+
+  2. With your email credentials, you can now set up your SMTP environment variables:
+
+  ```
+  SMTP_HOST=smtp.zoho.com
+  SMTP_USERNAME=username # your email
+  SMTP_PASSWORD=password # your password
+  SMTP_PORT=587
+  SMTP_SECURE=true
+  SMTP_FROM_ADDRESS=hey@example.com # your personal Zoho email or domain-based email linked to Zoho Mail
+  SMTP_FROM_NAME=Infisical
+  ```
+
+  <Note>
+    You can use either your personal Zoho email address like `you@zohomail.com` or
+    a domain-based email address like `you@yourdomain.com`. If using a
+    domain-based email address, then please make sure that you've configured and
+    verified it with Zoho Mail.
+  </Note>
+
+  <Info>
+    Remember that you will need to restart Infisical for this to work properly.
+  </Info>
+</Accordion>
+
+
+
+
+
+## SSO based login
+By default, users can only login via email/password based login method.
+To login into Infisical with OAuth providers such as Google, configure the associated variables.
+
+<Accordion title="Google">
+  Follow detailed guide to configure [Google SSO](/documentation/platform/sso/google)
+
+  <ParamField query="CLIENT_ID_GOOGLE_LOGIN" type="string" default="none" optional>
+  OAuth2 client ID for Google login
+  </ParamField>
+  <ParamField query="CLIENT_SECRET_GOOGLE_LOGIN" type="string" default="none" optional>
+    OAuth2 client secret for Google login
+  </ParamField>
+</Accordion>
+
+<Accordion title="Github">
+  Follow detailed guide to configure [GitHub SSO](/documentation/platform/sso/github)
+
+  <ParamField query="CLIENT_ID_GITHUB_LOGIN" type="string" default="none" optional>
+    OAuth2 client ID for GitHub login
+  </ParamField>
+  <ParamField query="CLIENT_SECRET_GITHUB_LOGIN" type="string" default="none" optional>
+    OAuth2 client secret for GitHub login
+  </ParamField>
+</Accordion>
+
+<Accordion title="Gitlab">
+  Follow detailed guide to configure [GitLab SSO](/documentation/platform/sso/gitlab)
+
+  <ParamField query="CLIENT_ID_GITLAB_LOGIN" type="string" default="none" optional>
+    OAuth2 client ID for GitLab login
+  </ParamField>
+  <ParamField query="CLIENT_SECRET_GITLAB_LOGIN" type="string" default="none" optional>
+    OAuth2 client secret for GitLab login
+  </ParamField>
+  <ParamField query="URL_GITLAB_LOGIN" type="string" default="https://gitlab.com" optional>
+    URL of your self-hosted instance of GitLab where the OAuth application is registered
+  </ParamField>
+</Accordion>
+
+<Accordion title="Okta SAML">
+  Requires enterprise license. Please contact team@infisical.com to get more information.
+</Accordion>
+
+<Accordion title="Azure SAML">
+  Requires enterprise license. Please contact team@infisical.com to get more information.
+</Accordion>
+
+<Accordion title="JumpCloud SAML">
+  Requires enterprise license. Please contact team@infisical.com to get more information.
+</Accordion>
+
+
+
+
+
+## Native secret integrations
+To help you sync secrets from Infisical to services such as Github and Gitlab, Infisical provides native integrations out of the box.
+
+<Accordion title="Heroku">
+  <ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
+    OAuth2 client ID for Heroku integration
+  </ParamField>
+  <ParamField query="CLIENT_SECRET_HEROKU" type="string" default="none" optional>
+    OAuth2 client secret for Heroku integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Vercel">
+  <ParamField query="CLIENT_ID_VERCEL" type="string" default="none" optional>
+    OAuth2 client ID for Vercel integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_VERCEL" type="string" default="none" optional>
+    OAuth2 client secret for Vercel integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SLUG_VERCEL" type="string" default="none" optional>
+    OAuth2 slug for Vercel integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Netlify">
+  <ParamField query="CLIENT_ID_NETLIFY" type="string" default="none" optional>
+    OAuth2 client ID for Netlify integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_NETLIFY" type="string" default="none" optional>
+    OAuth2 client secret for Netlify integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Github">
+  <ParamField query="CLIENT_ID_GITHUB" type="string" default="none" optional>
+    OAuth2 client ID for GitHub integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_GITHUB" type="string" default="none" optional>
+    OAuth2 client secret for GitHub integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Bitbucket">
+  <ParamField query="CLIENT_ID_BITBUCKET" type="string" default="none" optional>
+    OAuth2 client ID for BitBucket integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_BITBUCKET" type="string" default="none" optional>
+    OAuth2 client secret for BitBucket integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="GCP Secrets Manager">
+  <ParamField query="CLIENT_ID_GCP_SECRET_MANAGER" type="string" default="none" optional>
+    OAuth2 client id for GCP secrets manager integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_GCP_SECRET_MANAGER" type="string" default="none" optional>
+    OAuth2 client secret for GCP secrets manager integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Azure">
+  <ParamField query="CLIENT_ID_AZURE" type="string" default="none" optional>
+    OAuth2 client id for Azure integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_AZURE" type="string" default="none" optional>
+    OAuth2 client secret for Azure integration
+  </ParamField>
+</Accordion>
+
+<Accordion title="Gitlab">
+  <ParamField query="CLIENT_ID_GITLAB" type="string" default="none" optional>
+    OAuth2 client id for Gitlab integration
+  </ParamField>
+
+  <ParamField query="CLIENT_SECRET_GITLAB" type="string" default="none" optional>
+    OAuth2 client secret for Gitlab integration
+  </ParamField>
+</Accordion>

docs/self-hosting/configuration/redis.mdx

@@ -1,83 +0,0 @@
----
-title: "Configure Redis"
-description: "Learn to configure Redis with your self hosted Infisical"
----
-
-## Why Redis?
-As the features and use case of Infisical have grown, the need for a fast and reliable in-memory data storage has become clear. 
-By adding Redis to Infisical, we can now support more complex workflows such as queuing system to run long running asynchronous tasks, cron jobs, and access reliable cache to speed up frequently used resources. 
-
-<Info>
-  Starting with Infisical version v0.31.0, Redis will be required to fully use Infisical
-</Info>
-
-### Adding Redis to your self hosted instance of Infisical
-To add Redis to your self hosted instance, follow the instructions for the deployment method you used.
-
-<Tabs>
-  <Tab title="Kubernetes Helm chart">
-    ### In cluster Redis
-    By default, new versions of the Infisical Helm chart already comes with an in-cluster Redis instance. To deploy a in-cluster Redis instance along with your Infisical instance, update your Infisical chart then redeploy/upgrade your release. 
-    This will spin up a Redis instance and automatically configure it with your Infisical backend. 
-
-    1. Update Infisical Helm chart 
-    ```bash
-    helm repo update
-    ```
-
-    2. Upgrade Infisical release
-    ```bash
-    helm upgrade <infisical release name> infisical-helm-charts/infisical  --values <path to your values file>
-    ```
-    ### External Redis 
-    If you want to use an external Redis instance, please add a Redis connection URL under the backend environments variables and then upgrade/redeploy your Infisical instance.
-
-    1. Update your helm values file 
-    ```yaml your-values.yaml
-    backendEnvironmentVariables:
-      REDIS_URL=<your redis connection string>
-    ```
-
-    2. Upgrade Infisical release
-    ```bash
-    helm upgrade <infisical release name> infisical-helm-charts/infisical  --values <path to your values file>
-    ``` 
-  </Tab>
-  <Tab title="Docker compose">
-    ### Internal Redis service
-    By default, new versions of the docker compose file already comes with a Redis service. To use the pre-configured Redis service, please update your docker compose file to the latest version.
-
-    1. Download the new docker compose file
-    ```
-    wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
-    ```
-    2. Add Redis environment variable to your .env file
-    ```.env .env
-      REDIS_URL=redis://redis:6379
-    ```
-
-    3. Restart your docker compose services 
-  </Tab>
-  <Tab title="Standalone Docker image">
-    This standalone version of Infisical does not have an internal Redis service. To configure Redis with your Infisical instance, you must connect to a external Redis service by setting the connection string as an environment variable.
-
-    Example: 
-
-    ```bash 
-    docker run -p 80:80  \
-    -e ENCRYPTION_KEY=f40c9178624764ad85a6830b37ce239a \
-    -e JWT_SIGNUP_SECRET=38ea90fb7998b92176080f457d890392 \
-    -e JWT_REFRESH_SECRET=7764c7bbf3928ad501591a3e005eb364 \
-    -e JWT_AUTH_SECRET=5239fea3a4720c0e524f814a540e14a2 \
-    -e JWT_SERVICE_SECRET=8509fb8b90c9b53e9e61d1e35826dcb5  \
-    -e REDIS_URL=<> \
-    -e MONGO_URL="<>" \
-    infisical/infisical:latest
-    ```
-
-    Redis environment variable name: `REDIS_URL`
-  </Tab>
-</Tabs>
-
-## Support 
-If you have questions or need support, please join our [slack channel](https://infisical-users.slack.com) and one of our teammates will be happy to guide you.

docs/self-hosting/configuration/requirements.mdx

@@ -0,0 +1,71 @@
+---
+title: "Requirements"
+description: ""
+---
+
+This page details the minimum requirements necessary for installing and using Infisical. 
+The actual resource requirements will vary in direct proportion to the operations performed by Infisical and the level of utilization by the end users.
+
+
+
+## Deployment Sizes
+
+**Small** suitable for most initial production setups, as well as development and testing scenarios.
+
+**Large** suitable for high-demand production environments, characterized by either a high volume of transactions, large number of secrets, or both.
+
+
+## Hardware Requirements
+
+### Storage
+
+Infisical doesn’t require file storage as all persisted data is saved in the database. 
+However, its logs and metrics are saved to disk for later viewing. As a result, we recommend provisioning 1-2 GB of storage.
+
+### CPU
+
+CPU requirements vary heavily on the volume of secret operations (reads and writes) you anticipate. 
+Processing large volumes of secrets frequently and consistently will require higher CPU.
+
+Recommended minimum CPU hardware for different sizes of deployments:
+
+- **small:** 2-4 core is the **recommended** minimum
+- **large:** 4-8 cores are suitable for larger deployments
+
+### Memory Allocation
+
+Memory needs depend on expected workload, including factors like user activity, automation level, and the frequency of secret operations.
+
+Recommended minimum memory hardware for different sizes of deployments:
+- **small:** 4-8 GB is the **recommended** minimum
+- **large:** 16-32 GB are suitable for larger deployments
+
+## Database & caching layer
+
+### Postgres
+
+PostgreSQL is the only database supported by Infisical. Infisical has been extensively tested with Postgres version 16. We recommend using versions 14 and up for optimal compatibility.
+
+Recommended resource allocation based on deployment size:
+- **small:** 1 vCPU / 2 GB RAM / 10 GB Disk
+- **large:** 4vCPU / 16 GB RAM / 100 GB Disk
+
+### Redis
+
+Redis is utilized for session management and background tasks in Infisical.
+
+Redis requirements:
+
+- Use Redis versions 6.x or 7.x. We advise upgrading to at least Redis 6.2.
+- Redis Cluster mode is currently not supported; use Redis Standalone, with or without High Availability (HA).
+- Redis storage needs are minimal: a setup with 1 vCPU, 1 GB RAM, and 1GB SSD will be sufficient for small deployments.
+
+## Supported Web Browsers
+
+Infisical supports a range of web browsers. However, features such as browser-based CLI login only work on Google Chrome and Firefox at the moment.
+
+- [Mozilla Firefox](https://www.mozilla.org/en-US/firefox/new/)
+- [Google Chrome](https://www.google.com/chrome/) 
+- [Chromium](https://www.chromium.org/getting-involved/dev-channel/)
+- [Apple Safari](https://www.apple.com/safari/)
+- [Microsoft Edge](https://www.microsoft.com/en-us/edge?form=MA13FJ)

docs/self-hosting/configuration/schema-migrations.mdx

@@ -0,0 +1,60 @@
+---
+title: "Schema migration"
+description: "Run Postgres schema migrations"
+---
+
+Running schema migrations is a requirement before deploying Infisical. 
+Each time you decide to upgrade your version of Infisical, it's necessary to run schema migrations for that specific version. 
+The guide below outlines a step-by-step guide to help you through this process.
+
+### Prerequisites
+- Docker installed on your machine
+- An active PostgreSQL database
+- Postgres database connection string
+
+<Steps>
+  <Step title="Pull the Infisical Docker Image">
+    First, ensure you have the correct version of the Infisical Docker image. You can pull it from Docker Hub using the following command:
+    ```bash
+    docker pull infisical/infisical:<version>
+    ```
+    Replace `<version>` with the specific version number you intend to deploy. View available versions [here](https://hub.docker.com/r/infisical/infisical/tags)
+  </Step>
+
+  <Step title="Set Up the Environment Variable">
+    The Docker image requires a `DB_CONNECTION_URI` environment variable. This connection string should point to your PostgreSQL database. The format generally looks like this: `postgresql://username:password@host:port/database`.
+  </Step>
+
+  <Step title="Run the Migration ">
+    To run the schema migration for the version of Infisical you want to deploy, use the following Docker command:
+
+    ```bash
+    docker run --env DB_CONNECTION_URI=<your_connection_string> infisical/infisical:<version> npm run migration:latest
+    ```
+    Replace `<your_connection_string>` with your actual PostgreSQL connection string, and `<version>` with the desired version number.
+  </Step>
+
+  <Step title="Verify the Migration">
+    After running the migration, it's good practice to check if the migration was successful. You can do this by checking the logs or accessing your database to ensure the schema has been updated accordingly.
+  </Step>
+  <Step title="Rollback If Needed">
+    If you need to rollback a migration by one step, use the following command:
+
+    ```bash
+    docker run --env DB_CONNECTION_URI=<your_connection_string> infisical/infisical:<version> npm run migration:rollback
+    ```
+  </Step>
+
+  <Step title="Repeat for Each Version">
+    It's important to run schema migrations for each version of the Infisical you deploy. For instance, if you're updating from `infisical/infisical:1` to `infisical/infisical:2`, ensure you run the schema migrations for `infisical/infisical:2` before deploying it.
+  </Step>
+</Steps>
+
+<Tip>
+  In a production setting, we recommend a more structured approach to deploying migrations prior to upgrading Infisical. This can be accomplished via CI automation.
+</Tip>
+
+### Additional discussion 
+- Always back up your database before running migrations, especially in a production environment.
+- Test the migration process in a staging environment before applying it to production.
+- Keep track of the versions and their corresponding migrations to avoid any inconsistencies.

docs/self-hosting/configuration/sso.mdx

@@ -1,21 +0,0 @@
----
-title: "Configure SSO"
-description: "How to configure SSO when self-hosting Infisical."
----
-
-<Warning>
-  Infisical offers Google SSO and GitHub SSO for free.
-  
-  Infisical also offers SAML SSO authentication but as paid features that can be unlocked via enterprise license; if this is of interest, please contact team@infisical.com.
-  On this front, we currently support Okta, Azure AD, and JumpCloud and are expanding support for other IdPs in the coming months; stay tuned and feel free to request a IdP at this
-  [issue](https://github.com/Infisical/infisical/issues/442).
-</Warning>
-
-You can view specific documentation for how to set up each SSO authentication method below:
-
-- [Google SSO](/documentation/platform/sso/google)
-- [GitHub SSO](/documentation/platform/sso/github)
-- [GitLab SSO](/documentation/platform/sso/gitlab)
-- [Okta SAML](/documentation/platform/sso/okta)
-- [Azure SAML](/documentation/platform/sso/azure)
-- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)

docs/self-hosting/deployment-options/docker-compose.mdx

@@ -2,53 +2,82 @@
 title: "Docker Compose"
 description: "Run Infisical with Docker Compose template"
 ---
+Install Infisical using Docker compose. This self hosting method contains all of the required components needed 
+to run a functional instance of Infisical.
 
-<Steps>
-  <Step title="Install Docker on your VM">
-    ```bash
-    # Example in ubuntu
-    apt-get update
-    apt-get upgrade
-    apt install docker-compose
-    ```
-  </Step>
-  <Step title="Download required files">
-    2.1. Run the command below to download the `.env` file template.
-    
-    ```bash
-    wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
-    ```
-    
-    2.2. Run the command below to download the docker compose template.
-    
-    ```bash
-    wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml
-    ```
-    
-    2.3. Run the command below to download the `nginx` config file.
-    
-    ```bash
-    mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
-    ```
-  
-  </Step>
-  <Step title="Update the .env file">
-    Running Infisical requires a few environment variables to be set.
-    At minimum, Infisical requires that you set the variables `ENCRYPTION_KEY`, `AUTH_SECRET`, `MONGO_URL`, and `REDIS_URL` which you can read more about [here](/self-hosting/configuration/envars).
+## Prerequisites
+- [Docker](https://docs.docker.com/engine/install/)
+- [Docker compose](https://docs.docker.com/compose/install/)
 
-    Tweak the `.env` accordingly.
+<Warning>
+This Docker Compose configuration is not designed for high-availability production scenarios. 
+It includes just the essential components needed to set up an Infisical proof of concept (POC). 
+Additional configuration is required to enhance data redundancy and ensure higher availability for production environments.
+</Warning>
 
-    ```bash
-    nano .env
-    ```
-  </Step>
-  <Step title="Start Infisical">
-    Finally, run the command below to get Infisical up and running (in detached mode).
+## Verify prerequisites
+    To verify that Docker compose and Docker are installed on the machine where you plan to install Infisical, run the following commands.
 
+    Check for docker installation
     ```bash
-    docker-compose -f docker-compose.yml up -d
+    docker
     ```
 
-    Your Infisical installation is complete and should be running on port `80` or `http://localhost:80`.
-  </Step>
-</Steps>
+    Check for docker compose installation
+    ```bash
+    docker-compose 
+    ```
+
+## Download docker compose file
+You can obtain the Infisical docker compose file by using a command-line downloader such as `wget` or `curl`.
+If your system doesn't have either of these, you can use a equivalent command that works with your machine.
+
+<Tabs>
+  <Tab title="curl">
+    ```bash
+    curl -o docker-compose.prod.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.prod.yml
+    ```
+  </Tab>
+  <Tab title="wget">
+    ```bash 
+    wget -O docker-compose.prod.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.prod.yml
+    ```
+  </Tab>
+</Tabs>
+
+## Configure instance credentials
+Infisical requires a set of credentials used for connecting to dependent services such as Postgres, Redis, etc.
+The default credentials can be downloaded using the one of the commands listed below. 
+
+<Tabs>
+  <Tab title="curl">
+    ```bash
+      curl -o .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
+    ```
+  </Tab>
+  <Tab title="wget">
+    ```bash 
+      wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example
+    ```
+  </Tab>
+</Tabs>
+
+Once downloaded, the credentials file will be saved to your working directly as `.env` file.
+View all available configurations [here](/self-hosting/configuration/envars).
+
+<Warning>
+  The default .env file contains credentials that are intended solely for testing purposes.
+  Please generate a new `ENCRYPTION_KEY` and `AUTH_SECRET` for use outside of testing. 
+  Instructions to do so, can be found [here](/self-hosting/configuration/envars).
+</Warning>
+
+## Start Infisical
+Run the command below to start Infisical and all related services. 
+
+```bash
+docker-compose -f docker-compose.prod.yml up
+```
+
+Your Infisical instance should now be running on port `80`. To access your instance, visit `http://localhost:80`.
+
+![self host sign up](images/self-hosting/applicable-to-all/selfhost-signup.png)