Infisical

​

Overview

​

Architecture

• Infisical server — A stateless standard workload serving the web UI and API on port 8080 from the standalone image. Runs its database migrations automatically on boot; scale with infisical.replicas (a startup lock ensures migrations run exactly once even when multiple replicas boot concurrently).
• PostgreSQL (postgres subchart) — The durable store for all secrets, versions, projects, and users.
• Redis + Sentinel (redis subchart) — Cache and background-job queues, deployed HA (3 Redis + 3 Sentinel replicas, master mymaster). The server connects Sentinel-aware, so Redis failover is transparent. Required — Infisical will not boot without Redis.

​

What Gets Created

• Standard Infisical Workload — One or more stateless replicas serving the UI and API on port 8080.
• Stateful PostgreSQL Workload — Single-replica Postgres with a persistent volume set for all Infisical data.
• Redis Workloads — A Redis master-replica set plus Redis Sentinel for cache and job queues.
• DB-credentials Secret — A template-created dictionary secret used to assemble the server’s DB_CONNECTION_URI.
• Identity & Policy — An identity bound to the server with least-privilege reveal on exactly the secrets it mounts, including your prerequisite secret.

​

Prerequisites

• ENCRYPTION_KEY — a 16-byte hex key (openssl rand -hex 16) that encrypts every secret stored in Infisical.
• AUTH_SECRET — a 32-byte base64 key (openssl rand -base64 32) that signs sessions and tokens.

cpln secret create-dictionary --name my-infisical-secrets \
  --entry ENCRYPTION_KEY=$(openssl rand -hex 16) \
  --entry AUTH_SECRET=$(openssl rand -base64 32)

cpln secret create-dictionary --name my-infisical-smtp \
  --entry SMTP_USERNAME=apikey \
  --entry SMTP_PASSWORD=your-smtp-password

​

Configuration

infisical:
  # Standalone image: bundles the API + web UI on :8080 and runs DB migrations on boot.
  image: infisical/infisical:v0.162.14
  replicas: 1                 # 1 = proven single-replica shape; 2+ = HA tier (stateless app over shared pg+redis)
  siteUrl: ""                 # empty = derive from the canonical *.cpln.app endpoint; set (with https://) for a custom domain
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 2Gi

# Prerequisite dictionary secret — MUST EXIST BEFORE INSTALL (see Prerequisites).
secrets:
  name: my-infisical-secrets  # holds ENCRYPTION_KEY + AUTH_SECRET (both write-once)

# SMTP / email (optional; off by default)
smtp:
  enabled: false              # true = enable email invites, verification, password reset
  host: smtp.example.com
  port: 587
  fromAddress: no-reply@example.com
  fromName: Infisical
  requireTls: true            # STARTTLS; set false for a plaintext mail catcher
  auth:
    secretName: ""            # optional dictionary secret with SMTP_USERNAME + SMTP_PASSWORD; empty = no auth

publicAccess:
  enabled: true               # HTTPS UI + API on the auto *.cpln.app endpoint; false = internal-only
internalAccess:
  type: same-gvc              # options: none, same-gvc, same-org, workload-list
  workloads: []               # used only with workload-list

# PostgreSQL — durable secret store
postgres:
  image: postgres:18
  config:
    username: infisical
    password: change-me-infisical-pg   # change before installing
    database: infisical
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 1Gi
  volumeset:
    capacity: 10              # initial capacity in GiB (minimum is 10)

# Redis + Sentinel (HA) — cache + job queues; REQUIRED
redis:
  redis:
    image: redis:7.4
    replicas: 3
    auth:
      password:
        enabled: false        # true = require AUTH; the password is wired into Infisical as REDIS_PASSWORD
        value: change-me-infisical-redis
  sentinel:
    image: redis:7.4
    replicas: 3

​

Infisical server

• infisical.image — The standalone Infisical image (API + web UI in one container). Pin a concrete tag.
• infisical.replicas — Number of stateless server replicas. 1 is the proven single-replica shape; 2 or more gives an HA tier over the shared PostgreSQL and Redis, with zero-downtime rolling restarts. Boot migrations are serialized by a startup lock, so they run exactly once no matter how many replicas start at once.
• infisical.siteUrl — The public base URL Infisical advertises in links, cookies, and callbacks. Leave empty to derive it automatically from the canonical *.cpln.app endpoint; set it (including https://) only when you front the workload with a custom domain.
• infisical.resources — CPU and memory per replica. Keep maxMemory at 2Gi — a cold multi-replica boot runs out of memory at 1Gi.

​

Prerequisite secret

• secrets.name — Name of the user-created dictionary secret holding ENCRYPTION_KEY and AUTH_SECRET. It must exist before install — see Prerequisites.

​

SMTP / email

• smtp.enabled — Turn email on. smtp.host and smtp.fromAddress are required when enabled.
• smtp.requireTls — STARTTLS is required by default; set false only for a plaintext mail catcher (e.g. Mailpit on port 1025).
• smtp.auth.secretName — Name of an optional dictionary secret with SMTP_USERNAME and SMTP_PASSWORD for authenticated SMTP. Empty means no authentication; when set, the workload is granted reveal on exactly that secret.

​

Access

• publicAccess.enabled — Serve the UI and API on the canonical *.cpln.app HTTPS endpoint (default). Set to false for an internal-only instance.
• internalAccess.type — Internal firewall scope of the server workload:

​

PostgreSQL

• postgres.config.password — The bundled database password. Change it before installing.
• postgres.volumeset.capacity — Initial volume size in GiB (minimum 10).

​

Redis

• redis.redis.auth.password.enabled — When false (default), Redis runs authless with the same-GVC firewall as the boundary. Set to true to require AUTH on the data nodes; the master password is then wired into Infisical as REDIS_PASSWORD (Sentinels stay authless). Both paths are tested end to end, including Sentinel monitoring the auth-protected master.
• redis.redis.replicas / redis.sentinel.replicas — Redis and Sentinel replica counts (3 + 3 by default).

​

Connecting

​

Important Notes

• The prerequisite secret must exist before install — secrets.name is a dictionary secret with ENCRYPTION_KEY and AUTH_SECRET. A missing secret wedges the deployment and makes it look broken.
• ENCRYPTION_KEY and AUTH_SECRET are write-once — never rotate them. ENCRYPTION_KEY encrypts every stored secret; AUTH_SECRET signs all sessions.
• The first account to sign up becomes super-admin — create it immediately after install, then disable open sign-ups in the Admin panel.
• Redis is required, not optional — Infisical will not boot without it (authless behind the same-GVC firewall by default).
• Keep infisical.resources.maxMemory at 2Gi — a cold boot with replicas ≥ 2 runs out of memory at 1Gi.
• Stored secrets live in PostgreSQL and survive an app restart or reinstall — to wipe all data you must also reinstall the PostgreSQL dependency (which deletes its volume set).
• First boot takes roughly 2–5 minutes — the server waits for PostgreSQL to finish initializing and runs its migrations, logging transient Boot up migration failed retries in the meantime. This self-heals; the workload becomes ready once migrations complete.
• Set smtp.requireTls: false only for a plaintext mail catcher — real providers on port 587 need it left true.

​

External References