infisical-self-host

name	infisical-self-host
description	Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTION_KEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).
triggers	["self-host infisical","deploy infisical","docker compose infisical","infisical docker","helm chart infisical","kubernetes infisical","ENCRYPTION_KEY","infisical environment variables","production deployment infisical","FIPS infisical","scale infisical","ha infisical"]

Infisical Self-Hosted Deployment

This skill guides you through deploying, configuring, and operating Infisical in self-hosted environments. Whether you are running Infisical on Docker, Docker Compose, or Kubernetes, this resource covers essential setup, security hardening, scaling, and maintenance patterns.

Not this skill

If the user wants...	Use
To deploy the Kubernetes Operator (also a Helm chart, different thing)	infisical-kubernetes-operator
To reach a private resource from Infisical	infisical-gateway
To configure SSO or SCIM on their instance	infisical-sso
Roles, permissions, audit log streams	infisical-access-control
To use Infisical once it is running	infisical-setup
An external KMS or HSM backing the root key	infisical-kms

The Helm confusion is worth pre-empting: the secrets-operator chart installs the operator; this skill covers the chart that installs the platform. Both come from the same Cloudsmith repo.

Guiding Principles

1. ENCRYPTION_KEY is Critical: This key encrypts all secrets at rest and cannot be recovered if lost. Back it up and rotate it carefully following Infisical's rotation procedures.

   • Standard deployments: a random 16-byte hex string — openssl rand -hex 16
   • FIPS-enabled deployments: a 256-bit base64 key instead — openssl rand -base64 32

2. AUTH_SECRET is Required: This key is used for session and JWT signing. It is 32 bytes (base64), generated with openssl rand -base64 32, and must be stable across restarts.

3. Database Requirements: PostgreSQL is the only supported database. Use 14+ for compatibility; Infisical is extensively tested on 16. Always backup your database before upgrading Infisical. Schema migrations run automatically on boot (since v0.111.0-postgres).

4. Redis is a hard dependency, not just a cache: Beyond caching it holds the background job queue, distributed locks, cross-instance coordination state, and rate-limit counters. The instance will not start unless one of REDIS_URL, REDIS_SENTINEL_HOSTS, or REDIS_CLUSTER_HOSTS is set, and a running instance is degraded while Redis is unreachable.

   • Use Redis 6.x or 7.x; at least 6.2 is advised
   • All three topologies are supported: standalone, Sentinel, and Cluster
   • Active-passive is recommended. Active-active has not been tested and may behave in undocumented ways
   • Set the eviction policy to noeviction. This is required, not a tuning suggestion — evicting keys under memory pressure would silently drop queued work
   • Enable persistence (AOF, or at minimum RDB snapshots) and back Redis up. Pending secret rotations, syncs, and webhook deliveries live there; a Redis that comes back empty loses them
   • Give Redis the same availability target as the app instances — an unreplicated Redis is a single point of failure for the whole deployment

5. Stateless Architecture: Infisical is stateless. Scale horizontally by adding more replicas. All state lives in PostgreSQL and Redis. Each instance needs no more than 2–4 CPU cores and 4–8 GB memory; add containers rather than growing one.

6. FIPS Compliance: Infisical is compliant with FIPS 140-3. Deploy the separate infisical/infisical-fips Docker image (an Enterprise-only image, not a tag on the standard repo) and set . Remember the format changes to 256-bit base64 in FIPS mode.

Quick Start

• Docker Standalone: Pull infisical/infisical:<version>, set environment variables, run on port 8080.
• Docker Compose: Use docker-compose.prod.yml from the repository with PostgreSQL and Redis services.
• Kubernetes: Deploy via Helm chart infisical-standalone-postgres from Cloudsmith registry with optional managed databases.

Reference Guides

Environment Variables

Complete reference for all configuration environment variables, including:

• Required keys (ENCRYPTION_KEY, AUTH_SECRET, database, Redis)
• Database and replication setup
• Redis with Sentinel support
• SMTP configuration
• OAuth/SSO providers
• FIPS and telemetry settings
• Security options

Docker Deployment

Docker and Docker Compose deployment patterns, including:

• Standalone container setup
• Docker Compose production stack
• Image variants (standard and FIPS)
• Production hardening with security capabilities and read-only filesystems
• Health checks

Kubernetes Deployment

Kubernetes and Helm deployment guide, including:

• Helm chart installation and configuration
• Secret creation and management
• Optional PostgreSQL and Redis (Bitnami charts)
• Pod security and RBAC
• Networking policies and Ingress/TLS

Scaling and High Availability

Production scaling patterns and HA architecture, including:

• Horizontal scaling (adding replicas)
• Sizing guidelines for Infisical, PostgreSQL, and Redis
• Database read replicas
• Redis Sentinel for HA
• Backup and upgrade procedures
• License server firewall rules