---
title: "Production Hardening"
description: "Security hardening recommendations for production Infisical deployments"
---

This document provides specific security hardening recommendations for production Infisical deployments. These recommendations follow Infisical's security model and focus on defense in depth.

Choose your deployment method below and follow the recommendations for your specific setup. Start with **Universal Security Fundamentals** that apply to all deployments, then follow your deployment-specific section.

## Universal Security Fundamentals

These security configurations apply to **all** Infisical deployments regardless of how you deploy.

**Configure secure encryption keys**. Generate strong cryptographic keys:

```bash
# Required - Generate secure encryption key
ENCRYPTION_KEY=$(openssl rand -hex 16)

# Required - Generate secure auth secret
AUTH_SECRET=$(openssl rand -base64 32)
```

**Use end-to-end TLS**. Configure HTTPS and secure database connections:

```bash
# Enable HTTPS (recommended for production)
HTTPS_ENABLED=true

# Secure PostgreSQL connection with SSL
DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"

# For base64-encoded SSL certificate
DB_ROOT_CERT="<base64-encoded-certificate>"
```

**Secure Redis configuration**. Use authentication and TLS for Redis:

```bash
# Redis with TLS (if supported by your Redis deployment)
REDIS_URL="rediss://user:password@redis:6380"

# Redis Sentinel configuration for high availability
REDIS_SENTINEL_HOSTS="192.168.65.254:26379,192.168.65.254:26380"
REDIS_SENTINEL_MASTER_NAME="mymaster"
REDIS_SENTINEL_ENABLE_TLS=true
REDIS_SENTINEL_USERNAME="sentinel_user"
REDIS_SENTINEL_PASSWORD="sentinel_password"
```

**Restrict CORS origins**. Configure specific allowed origins:

```bash
# Limit CORS to specific domains
CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
```

**Disable internal IP connections**. Prevent Server-Side Request Forgery (SSRF) attacks:

```bash
# Prevent connections to internal/private IP addresses
# This blocks access to internal services like metadata endpoints,
# internal APIs, databases, and other sensitive infrastructure
ALLOW_INTERNAL_IP_CONNECTIONS=false
```

**Configure SMTP securely**. Use TLS for email communications:

```bash
# SMTP with TLS
SMTP_HOST="smtp.example.com"
SMTP_PORT="587"
SMTP_USERNAME="your-smtp-user"
SMTP_PASSWORD="your-smtp-password"
SMTP_REQUIRE_TLS=true
SMTP_IGNORE_TLS=false
SMTP_FROM_ADDRESS="noreply@example.com"
SMTP_FROM_NAME="Infisical"
```

**Set proper site URL**. Configure the absolute URL for your Infisical instance:

```bash
# Required - Must be absolute URL with protocol
SITE_URL="https://app.infisical.com"
```

**Configure database read replicas**. For high availability PostgreSQL setups:

```bash
# Read replica configuration (JSON format)
DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
```

**Configure short token lifetimes**. Minimize exposure window for compromised tokens:

```bash
# JWT token configuration (adjust based on security requirements)
JWT_AUTH_LIFETIME=15m        # Authentication tokens
JWT_REFRESH_LIFETIME=24h     # Refresh tokens
JWT_SERVICE_LIFETIME=1h      # Service tokens
```

**Disable telemetry** (optional). Telemetry is enabled by default but can be disabled:

```bash
# Optional - Disable telemetry (enabled by default)
TELEMETRY_ENABLED=false
```

**Establish user off-boarding procedures**. Remove access promptly when users leave:

1. Remove user from organization
2. Revoke active service tokens
3. Remove from external identity providers
4. Audit access logs for the user's activity
5. Rotate any shared secrets the user had access to

**Implement network firewalls**. Restrict network access to only necessary services. The specific implementation varies by deployment method:

- **Required ports**: Infisical API (8080) and HTTPS (if applicable)
- **Database access**: Restrict PostgreSQL and Redis to authorized sources only
- **Principle**: Default deny incoming, allow only required traffic
- **Implementation**: See your deployment-specific section below for exact configuration

**Keep frequent upgrade cadence**. Regularly update to the latest Infisical version for your deployment method.

## Docker Deployment Hardening

These recommendations are specific to Docker deployments of Infisical.

**Use read-only root filesystems**. Prevent runtime modifications:

```bash
# Run with read-only filesystem
docker run --read-only --tmpfs /tmp infisical/infisical:latest
```

**Drop unnecessary capabilities**. Remove all Linux capabilities:

```bash
# Drop all capabilities
docker run --cap-drop=ALL infisical/infisical:latest
```

**Set resource limits**. Prevent resource exhaustion attacks:

```bash
# Set memory and CPU limits
docker run --memory=1g --cpus=0.5 infisical/infisical:latest
```

**Use specific image tags**. Never use `latest` tags in production:

```bash
# Use specific version tags
docker run infisical/infisical:v0.93.1-postgres
```

**Configure health checks**. Set up Docker health checks:

```dockerfile
# In Dockerfile or docker-compose.yml
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:8080/api/status || exit 1
```

**Host firewall configuration**. Configure host-level firewall for Docker deployments:

```bash
# Docker manages its own iptables rules, but configure host firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow Docker-mapped ports (adjust based on your port mapping)
sudo ufw allow 8080/tcp  # If mapping container 8080 to host 8080
sudo ufw allow 443/tcp   # If terminating HTTPS at host level

# Enable firewall
sudo ufw --force enable

# Verify Docker iptables integration
sudo iptables -L DOCKER
```

**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your image tags regularly.

## Kubernetes Deployment Hardening

These recommendations are specific to Kubernetes deployments of Infisical.

**Use Pod Security Standards**. Apply restricted security profile:

```yaml
# Namespace-level Pod Security Standards
apiVersion: v1
kind: Namespace
metadata:
  name: infisical
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
```

**Configure security context**. Set comprehensive security context:

```yaml
# Deployment security context
apiVersion: apps/v1
kind: Deployment
metadata:
  name: infisical
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: infisical
          image: infisical/infisical:v0.93.1-postgres
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 1001
            capabilities:
              drop:
                - ALL
          resources:
            limits:
              memory: 1000Mi
              cpu: 500m
            requests:
              cpu: 350m
              memory: 512Mi
```

**Configure network policies**. Restrict pod-to-pod communication:

```yaml
# Example Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: infisical-netpol
  namespace: infisical
spec:
  podSelector:
    matchLabels:
      app: infisical
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-system
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - podSelector:
            matchLabels:
              app: redis
      ports:
        - protocol: TCP
          port: 6379
```

**Use dedicated service accounts**. Create service accounts with minimal permissions:

```yaml
# Service account configuration
apiVersion: v1
kind: ServiceAccount
metadata:
  name: infisical
  namespace: infisical
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: infisical
spec:
  template:
    spec:
      serviceAccountName: infisical
```

**Configure ingress with TLS**. Set up secure ingress:

```yaml
# Secure ingress configuration
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: infisical-ingress
  namespace: infisical
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - secretName: infisical-tls
      hosts:
        - app.example.com
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: infisical
                port:
                  number: 8080
```

**Use Kubernetes secrets**. Store sensitive configuration securely:

```yaml
# Kubernetes secret for environment variables
apiVersion: v1
kind: Secret
metadata:
  name: infisical-secrets
  namespace: infisical
type: Opaque
stringData:
  AUTH_SECRET: "<generate-with-openssl-rand-base64-32>"
  ENCRYPTION_KEY: "<generate-with-openssl-rand-hex-16>"
  DB_CONNECTION_URI: "<your-postgres-connection-string>"
  REDIS_URL: "<your-redis-connection-string>"
  SITE_URL: "<your-site-url>"
```

**Set up health checks**. Configure readiness and liveness probes:

```yaml
# Health check configuration
containers:
  - name: infisical
    readinessProbe:
      httpGet:
        path: /api/status
        port: 8080
      initialDelaySeconds: 10
      periodSeconds: 5
    livenessProbe:
      httpGet:
        path: /api/status
        port: 8080
      initialDelaySeconds: 30
      periodSeconds: 10
```

**Use managed databases**. For production deployments, use managed PostgreSQL and Redis services instead of in-cluster instances.

**Infrastructure firewall considerations**. In addition to the universal host firewalls, implement cloud-level security:

```bash
# Example: AWS Security Groups, Azure NSGs, or GCP Firewall Rules
# Allow ingress from load balancer to NodePort/ClusterIP service
# Allow egress to managed databases
# Block all other traffic

# For on-premises, ensure node-level firewalls allow:
# - Ingress traffic from ingress controllers
# - Egress traffic to external services (databases, SMTP)
```

**Regular updates**. Monitor [Docker Hub](https://hub.docker.com/r/infisical/infisical/tags) for new releases and update your deployment manifests with new image tags regularly.

## Linux Binary Deployment Hardening

These recommendations are specific to Linux binary deployments of Infisical.

**Create dedicated user account**. Run Infisical under a dedicated service account:

```bash
# Create dedicated user
sudo useradd --system --shell /bin/false --home-dir /opt/infisical infisical

# Create application directory
sudo mkdir -p /opt/infisical
sudo chown infisical:infisical /opt/infisical
```

**Configure systemd service**. Create a secure systemd service:

```ini
# /etc/systemd/system/infisical.service
[Unit]
Description=Infisical Secret Management
After=network.target

[Service]
Type=simple
# IMPORTANT: Change from default 'root' user to dedicated service account
User=infisical
Group=infisical
WorkingDirectory=/opt/infisical
ExecStart=/opt/infisical/infisical-linux-amd64
Restart=always
RestartSec=10

# Security settings
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/infisical
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LimitCORE=0
MemorySwapMax=0

# Environment file
EnvironmentFile=/etc/infisical/environment

[Install]
WantedBy=multi-user.target
```

**Secure environment configuration**. Store environment variables securely:

```bash
# Create secure config directory
sudo mkdir -p /etc/infisical
sudo chmod 750 /etc/infisical
sudo chown root:infisical /etc/infisical

# Create environment file
sudo touch /etc/infisical/environment
sudo chmod 640 /etc/infisical/environment
sudo chown root:infisical /etc/infisical/environment
```

**Disable memory swapping**. Prevent sensitive data from being written to disk:

```bash
# Disable swap immediately
sudo swapoff -a

# Disable swap permanently (comment out swap entries)
sudo sed -i '/swap/d' /etc/fstab
```

**Disable core dumps**. Prevent potential exposure of encryption keys:

```bash
# Set system-wide core dump limits
echo "* hard core 0" | sudo tee -a /etc/security/limits.conf

# Disable core dumps for current session
ulimit -c 0
```

**Host firewall configuration**. Configure comprehensive firewall for Linux binary deployments:

```bash
# Configure UFW firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow Infisical API access
sudo ufw allow 8080/tcp

# Allow HTTPS (if terminating TLS at Infisical)
sudo ufw allow 443/tcp

# If running PostgreSQL locally, restrict to localhost
sudo ufw allow from 127.0.0.1 to any port 5432

# If running Redis locally, restrict to localhost
sudo ufw allow from 127.0.0.1 to any port 6379

# Enable firewall
sudo ufw --force enable
```

**Synchronize system clocks**. Ensure accurate time for JWT tokens and audit logs:

```bash
# Install and configure NTP
sudo apt-get update
sudo apt-get install -y ntp
sudo systemctl enable ntp
sudo systemctl start ntp

# Verify time synchronization
timedatectl status
```

**Secure file permissions**. Set proper permissions on application files:

```bash
# Set binary permissions
sudo chmod 755 /opt/infisical/infisical-linux-amd64
sudo chown infisical:infisical /opt/infisical/infisical-linux-amd64

# Set config file permissions
sudo chmod 640 /etc/infisical/environment
sudo chown root:infisical /etc/infisical/environment
```

**Regular updates**. Monitor [GitHub releases](https://github.com/Infisical/infisical/releases) for new binary versions and update your installation regularly:

## Advanced Security Configurations

**Configure backup encryption**. Encrypt PostgreSQL backups:

```bash
# PostgreSQL backup with encryption
pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
```

**Implement log monitoring**. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.

**Regular security updates**. Monitor the [Infisical repository](https://github.com/Infisical/infisical) for security updates and apply them promptly.

## Compliance and Monitoring

For enterprise deployments requiring compliance certifications:

- Implement audit log retention policies
- Set up security event monitoring and alerting
- Configure automated vulnerability scanning
- Establish incident response procedures
- Document security controls for compliance audits

These hardening recommendations use only documented Infisical configuration options and deployment methods. Prioritize the universal recommendations and your deployment-specific section first, then implement advanced configurations based on your security requirements.

For complete environment variable documentation, refer to the [Infisical environment variables guide](/self-hosting/configuration/envars).