infisical-self-host

name	infisical-self-host
description	Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTION_KEY management, database setup, Redis configuration, production hardening, FIPS compliance, scaling, and high availability patterns.
triggers	["self-host infisical","deploy infisical","docker compose infisical","infisical docker","helm chart infisical","kubernetes infisical","ENCRYPTION_KEY","infisical environment variables","production deployment infisical","FIPS infisical","scale infisical","ha infisical"]

Infisical Self-Hosted Deployment

This skill guides you through deploying, configuring, and operating Infisical in self-hosted environments. Whether you are running Infisical on Docker, Docker Compose, or Kubernetes, this resource covers essential setup, security hardening, scaling, and maintenance patterns.

Guiding Principles

1. ENCRYPTION_KEY is Critical: This key encrypts all secrets at rest. It is 16 bytes (32 hex characters), generated with openssl rand -hex 16, and cannot be recovered if lost. Back it up and rotate it carefully following Infisical's rotation procedures.

2. AUTH_SECRET is Required: This key is used for session and JWT signing. It is 32 bytes (base64), generated with openssl rand -base64 32, and must be stable across restarts.

3. Database Requirements: PostgreSQL 14+ is required. Always backup your database before upgrading Infisical. Schema migrations run automatically on boot (since v0.111.0-postgres).

4. Redis Configuration: Redis 6.2+ is required. Cluster mode is NOT supported; use standalone or Redis Sentinel for high availability. Standalone mode is simplest for development; use Sentinel for production HA.

5. Stateless Architecture: Infisical is stateless. Scale horizontally by adding more replicas. All state lives in PostgreSQL and Redis.

6. FIPS Compliance: FIPS 140-2 mode is available via the infisical/infisical:latest-fips image. Enable with FIPS_ENABLED=true and appropriate Node.js options.

Quick Start

• Docker Standalone: Pull infisical/infisical:<version>, set environment variables, run on port 8080.
• Docker Compose: Use docker-compose.prod.yml from the repository with PostgreSQL and Redis services.
• Kubernetes: Deploy via Helm chart infisical-standalone-postgres from Cloudsmith registry with optional managed databases.

Reference Guides

Environment Variables

Complete reference for all configuration environment variables, including:

• Required keys (ENCRYPTION_KEY, AUTH_SECRET, database, Redis)
• Database and replication setup
• Redis with Sentinel support
• SMTP configuration
• OAuth/SSO providers
• FIPS and telemetry settings
• Security options

Docker Deployment

Docker and Docker Compose deployment patterns, including:

• Standalone container setup
• Docker Compose production stack
• Image variants (standard and FIPS)
• Production hardening with security capabilities and read-only filesystems
• Health checks

Kubernetes Deployment

Kubernetes and Helm deployment guide, including:

• Helm chart installation and configuration
• Secret creation and management
• Optional PostgreSQL and Redis (Bitnami charts)
• Pod security and RBAC
• Networking policies and Ingress/TLS

Scaling and High Availability

Production scaling patterns and HA architecture, including:

• Horizontal scaling (adding replicas)
• Sizing guidelines for Infisical, PostgreSQL, and Redis
• Database read replicas
• Redis Sentinel for HA
• Backup and upgrade procedures
• License server firewall rules