--- title: "infisical relay" description: "Relay-related commands for Infisical" --- ```bash infisical relay start --host= --name= --auth-method= ``` ```bash # Install systemd service sudo infisical relay systemd install --host= --name= --token= # Uninstall systemd service sudo infisical relay systemd uninstall ``` ## Description Relay-related commands for Infisical that provide identity-aware relay infrastructure for routing encrypted traffic. Relays are organization-deployed servers that route encrypted traffic between Infisical and your gateways. ## Subcommands & flags Run the Infisical relay component. The relay handles network traffic routing between Infisical and your gateways. ```bash infisical relay start --host= --name= --auth-method= ``` ### Flags The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach. ```bash # Example with IP address infisical relay start --host=203.0.113.100 --name=my-relay # Example with hostname infisical relay start --host=relay.example.com --name=my-relay ``` The name of the relay. This is an arbitrary identifier for your relay instance. ```bash # Example infisical relay start --name=my-relay --host=192.168.1.100 ``` ### Authentication Relays support all standard Infisical authentication methods. Choose the authentication method that best fits your environment and set the corresponding flags when starting the relay. ```bash # Example with Universal Auth infisical relay start --host=192.168.1.100 --name=my-relay --auth-method=universal-auth --client-id= --client-secret= ``` ### Available Authentication Methods The Infisical CLI supports multiple authentication methods for relays. Below are the available authentication methods, with their respective flags. The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical. Your machine identity client ID. Your machine identity client secret. The authentication method to use. Must be `universal-auth` when using Universal Auth. ```bash infisical relay start --auth-method=universal-auth --client-id= --client-secret= --host= --name= ``` The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical. Your machine identity ID. Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`. The authentication method to use. Must be `kubernetes` when using Native Kubernetes. ```bash infisical relay start --auth-method=kubernetes --machine-identity-id= --host= --name= ``` The Native Azure method is used to authenticate with Infisical when running in an Azure environment. Your machine identity ID. The authentication method to use. Must be `azure` when using Native Azure. ```bash infisical relay start --auth-method=azure --machine-identity-id= --host= --name= ``` The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. Your machine identity ID. The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token. ```bash infisical relay start --auth-method=gcp-id-token --machine-identity-id= --host= --name= ``` The GCP IAM method is used to authenticate with Infisical with a GCP service account key. Your machine identity ID. Path to your GCP service account key file _(Must be in JSON format!)_ The authentication method to use. Must be `gcp-iam` when using GCP IAM. ```bash infisical relay start --auth-method=gcp-iam --machine-identity-id= --service-account-key-file-path= --host= --name= ``` The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc. Your machine identity ID. The authentication method to use. Must be `aws-iam` when using Native AWS IAM. ```bash infisical relay start --auth-method=aws-iam --machine-identity-id= --host= --name= ``` The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC. Your machine identity ID. The OIDC JWT from the identity provider. The authentication method to use. Must be `oidc-auth` when using OIDC Auth. ```bash infisical relay start --auth-method=oidc-auth --machine-identity-id= --jwt= --host= --name= ``` The JWT Auth method is used to authenticate with Infisical via a JWT token. The JWT token to use for authentication. Your machine identity ID. The authentication method to use. Must be `jwt-auth` when using JWT Auth. ```bash infisical relay start --auth-method=jwt-auth --jwt= --machine-identity-id= --host= --name= ``` You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token. The machine identity access token to use for authentication. ```bash infisical relay start --token= --host= --name= ``` Manage systemd service for Infisical relay. This allows you to install and run the relay as a systemd service on Linux systems. ### Requirements - **Operating System**: Linux only (systemd is not supported on other operating systems) - **Privileges**: Root/sudo privileges required for both install and uninstall operations - **Systemd**: The system must be running systemd as the init system ```bash infisical relay systemd ``` ### Subcommands Install and enable systemd service for the relay. Must be run with sudo on Linux systems. ```bash sudo infisical relay systemd install --host= --name= --token= [flags] ``` #### Flags The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach. ```bash # Example with IP address sudo infisical relay systemd install --host=203.0.113.100 --name=my-relay --token= # Example with hostname sudo infisical relay systemd install --host=relay.example.com --name=my-relay --token= ``` The name of the relay. ```bash # Example sudo infisical relay systemd install --name=my-relay --host=192.168.1.100 --token= ``` Connect with Infisical using machine identity access token. ```bash # Example sudo infisical relay systemd install --token= --host= --name= ``` Domain of your self-hosted Infisical instance. Optional flag for specifying a custom domain. ```bash # Example sudo infisical relay systemd install --domain=http://localhost:8080 --token= --host= --name= ``` #### Examples ```bash # Install relay with token authentication sudo infisical relay systemd install --host=192.168.1.100 --name=my-relay --token= # Install with custom domain sudo infisical relay systemd install --domain=http://localhost:8080 --token= --host= --name= ``` #### Post-installation After successful installation, the service will be enabled but not started. To start the service: ```bash sudo systemctl start infisical-relay ``` To check the service status: ```bash sudo systemctl status infisical-relay ``` To view service logs: ```bash sudo journalctl -u infisical-relay -f ``` Uninstall and remove systemd service for the relay. Must be run with sudo on Linux systems. ```bash sudo infisical relay systemd uninstall ``` #### Examples ```bash # Uninstall the relay systemd service sudo infisical relay systemd uninstall ``` #### What it does - Stops the `infisical-relay` systemd service if it's running - Disables the service from starting on boot - Removes the systemd service file - Cleans up the service configuration