Panama/user/agents/skills/infisical-self-host/references/environment-variables.md

Environment Variables Reference

This guide covers all environment variables used to configure Infisical self-hosted deployments.

Essential Security Keys

ENCRYPTION_KEY

Required – Master encryption key for all secrets at rest.

• Format: 16 bytes as hex (32 hex characters)
• Example: a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8
• Generation: openssl rand -hex 16
• Critical Notes:
  • Cannot be recovered if lost
  • Must be stable across deployments and upgrades
  • Rotate using Infisical's key rotation procedures (enterprise feature)
  • Back up securely in a separate location

AUTH_SECRET

Required – Secret key for signing session tokens and JWTs.

• Format: 32 bytes as base64
• Example: VUJrQV9FbmNyeXB0aW9uS2V5XzMyQnl0ZXNfQmFzZTY0RW5jb2RlZA==
• Generation: openssl rand -base64 32
• Notes:
  • Used for all authentication tokens
  • Must be stable and unique per deployment

Database Configuration

DB_CONNECTION_URI

Required – PostgreSQL connection string.

• Format: postgresql://user:password@host:port/database
• Example: postgresql://infisical:[email protected]:5432/infisical
• Requirements:
  • PostgreSQL 14 or newer
  • uuid-ossp extension enabled: CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
  • pgcrypto extension enabled: CREATE EXTENSION IF NOT EXISTS pgcrypto;

DB_ROOT_CERT

Optional – Base64-encoded PEM certificate for SSL/TLS verification of PostgreSQL.

• Format: Base64-encoded SSL certificate
• Usage: For databases with self-signed or custom CA certificates
• Example:

  cat /path/to/ca.pem | base64 -w 0
  

• Notes: Verify SSL/TLS connections for managed database services (RDS, Cloud SQL, Azure Database)

DB_READ_REPLICAS

Optional – JSON array of read-only database replicas.

• Format: JSON array of connection objects
• Example:

  [
    {"connectionString": "postgresql://user:pass@replica1:5432/infisical"},
    {"connectionString": "postgresql://user:pass@replica2:5432/infisical"}
  ]
  

• Use Case: Distribute read-heavy workloads across multiple database replicas
• Requirements: Read replicas must be in sync with primary

Redis Configuration

REDIS_URL

Required – Redis connection string.

• Format: redis://[:password@]host:port[/db] or rediss://... for TLS
• Examples:
  • Standard: redis://redis.example.com:6379
  • With auth: redis://:[email protected]:6379
  • TLS: rediss://redis.example.com:6380
• Requirements: Redis 6.2 or newer
• Important: Redis Cluster mode is NOT supported; use standalone or Sentinel

Redis Sentinel (High Availability)

Use these variables to configure Redis Sentinel for HA without Cluster mode.

REDIS_SENTINEL_HOSTS

Comma-separated list of Sentinel node addresses.

• Format: host1:port1,host2:port2,host3:port3
• Example: sentinel1.example.com:26379,sentinel2.example.com:26379,sentinel3.example.com:26379

REDIS_SENTINEL_MASTER_NAME

Name of the Redis master monitored by Sentinel.

• Example: mymaster
• Default: mymaster (if not specified)

REDIS_SENTINEL_ENABLE_TLS

Enable TLS for Sentinel connections.

• Format: true or false
• Default: false

REDIS_SENTINEL_USERNAME

Username for Sentinel authentication (if required).

REDIS_SENTINEL_PASSWORD

Password for Sentinel authentication.

SMTP Configuration

SMTP is required for email-based features. Without SMTP configured, the following features are disabled:

• Multi-factor authentication (MFA) via email
• Email invitations
• Suspicious login alerts
• Password reset emails

SMTP_HOST

Required if SMTP enabled – SMTP server hostname.

• Example: smtp.gmail.com

SMTP_PORT

SMTP server port.

• Default: 587 (STARTTLS)
• Common Values:
  • 587 — STARTTLS (recommended)
  • 465 — SMTPS (implicit TLS)
  • 25 — Unencrypted (not recommended for production)

SMTP_USERNAME

Username for SMTP authentication.

SMTP_PASSWORD

Password for SMTP authentication.

SMTP_FROM_ADDRESS

Required if SMTP enabled – Email address from which emails are sent.

• Example: [email protected]

SMTP_FROM_NAME

Display name for the sender.

• Example: Infisical
• Default: Infisical

SMTP_REQUIRE_TLS

Require TLS connection (STARTTLS).

• Format: true or false
• Default: true

SMTP_IGNORE_TLS

Ignore TLS certificate errors (useful for self-signed certificates in development).

• Format: true or false
• Default: false
• Warning: Do not use in production

OAuth/SSO Configuration

Google Login

To enable Google OAuth login, register an OAuth 2.0 application in Google Cloud Console.

CLIENT_ID_GOOGLE_LOGIN

Google OAuth client ID.

CLIENT_SECRET_GOOGLE_LOGIN

Google OAuth client secret.

GitHub Login

Register an OAuth application at https://github.com/settings/developers.

CLIENT_ID_GITHUB_LOGIN

GitHub OAuth client ID.

CLIENT_SECRET_GITHUB_LOGIN

GitHub OAuth client secret.

GitLab Login

Register an OAuth application in your GitLab instance (or gitlab.com).

CLIENT_ID_GITLAB_LOGIN

GitLab OAuth client ID.

CLIENT_SECRET_GITLAB_LOGIN

GitLab OAuth client secret.

Authentication Timeouts

JWT_AUTH_LIFETIME

Lifetime of access tokens.

• Default: 15m (15 minutes)
• Format: Valid Node.js duration string (e.g., 30m, 1h)

JWT_REFRESH_LIFETIME

Lifetime of refresh tokens.

• Default: 24h (24 hours)
• Format: Valid Node.js duration string

Enterprise and Licensing

LICENSE_KEY

License key for Infisical Enterprise features.

• Format: Provided by Infisical upon enterprise subscription
• Features Enabled: SAML, RBAC advanced features, audit logs, IP allowlisting, etc.

FIPS 140-2 Compliance

FIPS mode is enabled using the infisical/infisical:latest-fips image with additional Node.js configuration.

FIPS_ENABLED

Enable FIPS 140-2 mode.

• Format: true or false
• Default: false
• Requirement: Must use infisical/infisical:latest-fips image

NODE_OPTIONS

Node.js runtime options for FIPS compliance.

• For FIPS Mode:

  NODE_OPTIONS="--max-old-space-size=8192 --force-fips"
  

• Notes:
  • --force-fips enables FIPS mode
  • --max-old-space-size allocates memory for the Node.js heap (adjust based on load)

Telemetry

TELEMETRY_ENABLED

Enable or disable telemetry collection.

• Format: true or false
• Default: true

OTEL_EXPORT_TYPE

Export destination for OpenTelemetry metrics.

• Options: prometheus, otlp
• Example: prometheus exports metrics on /metrics endpoint for Prometheus scraping

Web and Security

SITE_URL

Required – Public URL of the Infisical instance.

• Format: Full URL (e.g., https://secrets.example.com)
• Usage: Used for email links, OAuth redirects, and frontend configuration

CORS_ALLOWED_ORIGINS

Comma-separated list of allowed CORS origins.

• Format: Full URLs (e.g., https://app.example.com,https://admin.example.com)
• Default: Allows same origin
• Notes: Whitelist specific origins in production; avoid wildcards (*)

ALLOW_INTERNAL_IP_CONNECTIONS

Allow connections to internal IP addresses (useful for Kubernetes).

• Format: true or false
• Default: false
• Use Case: Kubernetes nodes using internal IPs, local Redis/PostgreSQL on private networks

Summary: Minimal Configuration

For a minimal production deployment, these environment variables are required:

# Security
ENCRYPTION_KEY="<16-byte-hex>"
AUTH_SECRET="<base64-32-byte>"

# Database
DB_CONNECTION_URI="postgresql://user:pass@host:5432/infisical"

# Redis
REDIS_URL="redis://host:6379"

# Web
SITE_URL="https://secrets.example.com"

# SMTP (required for email features)
SMTP_HOST="smtp.example.com"
SMTP_PORT="587"
SMTP_USERNAME="[email protected]"
SMTP_PASSWORD="password"
SMTP_FROM_ADDRESS="[email protected]"

For additional features (OAuth, FIPS, Sentinel, etc.), add the relevant variables from the sections above.