Gabriel Brown
89761a7da3
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
79 lines
3.7 KiB
Markdown
79 lines
3.7 KiB
Markdown
---
|
|
name: infisical-self-host
|
|
description: Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTION_KEY management, database setup, Redis configuration, production hardening, FIPS compliance, scaling, and high availability patterns.
|
|
triggers:
|
|
- self-host infisical
|
|
- deploy infisical
|
|
- docker compose infisical
|
|
- infisical docker
|
|
- helm chart infisical
|
|
- kubernetes infisical
|
|
- ENCRYPTION_KEY
|
|
- infisical environment variables
|
|
- production deployment infisical
|
|
- FIPS infisical
|
|
- scale infisical
|
|
- ha infisical
|
|
---
|
|
|
|
# Infisical Self-Hosted Deployment
|
|
|
|
This skill guides you through deploying, configuring, and operating Infisical in self-hosted environments. Whether you are running Infisical on Docker, Docker Compose, or Kubernetes, this resource covers essential setup, security hardening, scaling, and maintenance patterns.
|
|
|
|
## Guiding Principles
|
|
|
|
1. **ENCRYPTION_KEY is Critical**: This key encrypts all secrets at rest. It is 16 bytes (32 hex characters), generated with `openssl rand -hex 16`, and **cannot be recovered if lost**. Back it up and rotate it carefully following Infisical's rotation procedures.
|
|
|
|
2. **AUTH_SECRET is Required**: This key is used for session and JWT signing. It is 32 bytes (base64), generated with `openssl rand -base64 32`, and must be stable across restarts.
|
|
|
|
3. **Database Requirements**: PostgreSQL 14+ is required. Always backup your database before upgrading Infisical. Schema migrations run automatically on boot (since v0.111.0-postgres).
|
|
|
|
4. **Redis Configuration**: Redis 6.2+ is required. Cluster mode is NOT supported; use standalone or Redis Sentinel for high availability. Standalone mode is simplest for development; use Sentinel for production HA.
|
|
|
|
5. **Stateless Architecture**: Infisical is stateless. Scale horizontally by adding more replicas. All state lives in PostgreSQL and Redis.
|
|
|
|
6. **FIPS Compliance**: FIPS 140-2 mode is available via the `infisical/infisical:latest-fips` image. Enable with `FIPS_ENABLED=true` and appropriate Node.js options.
|
|
|
|
## Quick Start
|
|
|
|
- **Docker Standalone**: Pull `infisical/infisical:<version>`, set environment variables, run on port 8080.
|
|
- **Docker Compose**: Use `docker-compose.prod.yml` from the repository with PostgreSQL and Redis services.
|
|
- **Kubernetes**: Deploy via Helm chart `infisical-standalone-postgres` from Cloudsmith registry with optional managed databases.
|
|
|
|
## Reference Guides
|
|
|
|
### [Environment Variables](./references/environment-variables.md)
|
|
Complete reference for all configuration environment variables, including:
|
|
- Required keys (ENCRYPTION_KEY, AUTH_SECRET, database, Redis)
|
|
- Database and replication setup
|
|
- Redis with Sentinel support
|
|
- SMTP configuration
|
|
- OAuth/SSO providers
|
|
- FIPS and telemetry settings
|
|
- Security options
|
|
|
|
### [Docker Deployment](./references/docker-deployment.md)
|
|
Docker and Docker Compose deployment patterns, including:
|
|
- Standalone container setup
|
|
- Docker Compose production stack
|
|
- Image variants (standard and FIPS)
|
|
- Production hardening with security capabilities and read-only filesystems
|
|
- Health checks
|
|
|
|
### [Kubernetes Deployment](./references/kubernetes-deployment.md)
|
|
Kubernetes and Helm deployment guide, including:
|
|
- Helm chart installation and configuration
|
|
- Secret creation and management
|
|
- Optional PostgreSQL and Redis (Bitnami charts)
|
|
- Pod security and RBAC
|
|
- Networking policies and Ingress/TLS
|
|
|
|
### [Scaling and High Availability](./references/scaling-and-ha.md)
|
|
Production scaling patterns and HA architecture, including:
|
|
- Horizontal scaling (adding replicas)
|
|
- Sizing guidelines for Infisical, PostgreSQL, and Redis
|
|
- Database read replicas
|
|
- Redis Sentinel for HA
|
|
- Backup and upgrade procedures
|
|
- License server firewall rules
|