mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
133 lines
4.3 KiB
Plaintext
133 lines
4.3 KiB
Plaintext
---
|
|
title: "infisical bootstrap"
|
|
description: "Automate the initial setup of a new Infisical instance for headless deployment and infrastructure-as-code workflows"
|
|
---
|
|
|
|
```bash
|
|
infisical bootstrap --domain=<domain> --email=<email> --password=<password> --organization=<organization>
|
|
```
|
|
|
|
## Description
|
|
|
|
The `infisical bootstrap` command is used when deploying Infisical in automated environments where manual UI setup is not feasible. It's ideal for:
|
|
|
|
- Containerized deployments in Kubernetes or Docker environments
|
|
- Infrastructure-as-code pipelines with Terraform or similar tools
|
|
- Continuous deployment workflows
|
|
- DevOps automation scenarios
|
|
|
|
The command initializes a fresh Infisical instance by creating an admin user, organization, and instance admin machine identity, enabling subsequent programmatic configuration without human intervention.
|
|
|
|
<Warning>
|
|
This command creates an instance admin machine identity with the highest level
|
|
of privileges. The returned token should be treated with the utmost security,
|
|
similar to a root credential. Unauthorized access to this token could
|
|
compromise your entire Infisical instance.
|
|
</Warning>
|
|
|
|
## Flags
|
|
|
|
<Accordion title="--domain" defaultOpen="true">
|
|
The URL of your Infisical instance. This can be set using the `INFISICAL_API_URL` environment variable.
|
|
|
|
```bash
|
|
# Example
|
|
infisical bootstrap --domain=https://your-infisical-instance.com
|
|
```
|
|
|
|
This flag is required.
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--email">
|
|
Email address for the admin user account that will be created. This can be set using the `INFISICAL_ADMIN_EMAIL` environment variable.
|
|
|
|
```bash
|
|
# Example
|
|
infisical bootstrap --email=admin@example.com
|
|
```
|
|
|
|
This flag is required.
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--password">
|
|
Password for the admin user account. This can be set using the `INFISICAL_ADMIN_PASSWORD` environment variable.
|
|
|
|
```bash
|
|
# Example
|
|
infisical bootstrap --password=your-secure-password
|
|
```
|
|
|
|
This flag is required.
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--organization">
|
|
Name of the organization that will be created within the instance. This can be set using the `INFISICAL_ADMIN_ORGANIZATION` environment variable.
|
|
|
|
```bash
|
|
# Example
|
|
infisical bootstrap --organization=your-org-name
|
|
```
|
|
|
|
This flag is required.
|
|
|
|
</Accordion>
|
|
|
|
## Response
|
|
|
|
The command returns a JSON response with details about the created user, organization, and machine identity:
|
|
|
|
```json
|
|
{
|
|
"identity": {
|
|
"credentials": {
|
|
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eUlkIjoiZGIyMjQ3OTItZWQxOC00Mjc3LTlkYWUtNTdlNzUyMzE1ODU0IiwiaWRlbnRpdHlBY2Nlc3NUb2tlbklkIjoiZmVkZmZmMGEtYmU3Yy00NjViLWEwZWEtZjM5OTNjMTg4OGRlIiwiYXV0aFRva2VuVHlwZSI6ImlkZW50aXR5QWNjZXNzVG9rZW4iLCJpYXQiOjE3NDIzMjI0ODl9.mqcZZqIFqER1e9ubrQXp8FbzGYi8nqqZwfMvz09g-8Y"
|
|
},
|
|
"id": "db224792-ed18-4277-9dae-57e752315854",
|
|
"name": "Instance Admin Identity"
|
|
},
|
|
"message": "Successfully bootstrapped instance",
|
|
"organization": {
|
|
"id": "b56bece0-42f5-4262-b25e-be7bf5f84957",
|
|
"name": "dog",
|
|
"slug": "dog-v-e5l"
|
|
},
|
|
"user": {
|
|
"email": "admin@example.com",
|
|
"firstName": "Admin",
|
|
"id": "a418f355-c8da-453c-bbc8-6c07208eeb3c",
|
|
"lastName": "User",
|
|
"superAdmin": true,
|
|
"username": "admin@example.com"
|
|
}
|
|
}
|
|
```
|
|
|
|
## Usage with Automation
|
|
|
|
For automation purposes, you can extract just the machine identity token from the response:
|
|
|
|
```bash
|
|
infisical bootstrap --domain=https://your-infisical-instance.com --email=admin@example.com --password=your-secure-password --organization=your-org-name | jq ".identity.credentials.token"
|
|
```
|
|
|
|
This extracts only the token, which can be captured in a variable or piped to other commands.
|
|
|
|
## Example: Capture Token in a Variable
|
|
|
|
```bash
|
|
TOKEN=$(infisical bootstrap --domain=https://your-infisical-instance.com --email=admin@example.com --password=your-secure-password --organization=your-org-name | jq -r ".identity.credentials.token")
|
|
|
|
# Now use the token for further automation
|
|
echo "Token has been captured and can be used for authentication"
|
|
```
|
|
|
|
## Notes
|
|
|
|
- The bootstrap process can only be performed once on a fresh Infisical instance
|
|
- All flags are required for the bootstrap process to complete successfully
|
|
- Security controls prevent privilege escalation: instance admin identities cannot be managed by non-instance admin users and identities
|
|
- The generated admin user account can be used to log in via the UI if needed
|