> ## Documentation Index
> Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical

> Deploy Infisical on Control Plane using the Template Catalog. An open-source secrets-management platform — store, version, scope, and serve application secrets through a web UI and REST API — backed by PostgreSQL and HA Redis. Covers the prerequisite root-of-trust secret, admin bootstrap, SMTP, scaling, and access.

## Overview

Infisical is an open-source secrets-management platform: store, version, scope, and serve application secrets through a web UI and REST API, with projects, environments, and access controls. This template deploys a stateless Infisical server tier backed by PostgreSQL (the durable secret store) and HA Redis with Sentinel (cache and background-job queues).

### Architecture

* **Infisical server** — A stateless `standard` workload serving the web UI and API on port `8080` from the standalone image. Runs its database migrations automatically on boot; scale with `infisical.replicas` (a startup lock ensures migrations run exactly once even when multiple replicas boot concurrently).
* **PostgreSQL** ([postgres](/template-catalog/templates/postgres) subchart) — The durable store for all secrets, versions, projects, and users.
* **Redis + Sentinel** ([redis](/template-catalog/templates/redis) subchart) — Cache and background-job queues, deployed HA (3 Redis + 3 Sentinel replicas, master `mymaster`). The server connects Sentinel-aware, so Redis failover is transparent. **Required** — Infisical will not boot without Redis.

### What Gets Created

* **Standard Infisical Workload** — One or more stateless replicas serving the UI and API on port `8080`.
* **Stateful PostgreSQL Workload** — Single-replica Postgres with a persistent volume set for all Infisical data.
* **Redis Workloads** — A Redis master-replica set plus Redis Sentinel for cache and job queues.
* **DB-credentials Secret** — A template-created dictionary secret used to assemble the server's `DB_CONNECTION_URI`.
* **Identity & Policy** — An identity bound to the server with least-privilege `reveal` on exactly the secrets it mounts, including your prerequisite secret.

<Note>
  This template does not create a GVC. You must deploy it into an existing GVC.
</Note>

## Prerequisites

**You must create a dictionary secret before installing.** The server references it by name (`secrets.name`, default `my-infisical-secrets`) and the deployment wedges until the secret exists. Create it first as a **dictionary** secret holding Infisical's root-of-trust keys:

* `ENCRYPTION_KEY` — a 16-byte hex key (`openssl rand -hex 16`) that encrypts every secret stored in Infisical.
* `AUTH_SECRET` — a 32-byte base64 key (`openssl rand -base64 32`) that signs sessions and tokens.

<Warning>
  Both keys are **write-once — never rotate them**. Rotating `ENCRYPTION_KEY` corrupts every stored secret; rotating `AUTH_SECRET` invalidates all sessions.
</Warning>

Create the secret with the CLI:

```bash theme={null}
cpln secret create-dictionary --name my-infisical-secrets \
  --entry ENCRYPTION_KEY=$(openssl rand -hex 16) \
  --entry AUTH_SECRET=$(openssl rand -base64 32)
```

**Optional, only for authenticated SMTP:** a dictionary secret with `SMTP_USERNAME` and `SMTP_PASSWORD`, referenced via `smtp.auth.secretName`. Leave `smtp.auth.secretName` empty for unauthenticated relays and mail catchers.

```bash theme={null}
cpln secret create-dictionary --name my-infisical-smtp \
  --entry SMTP_USERNAME=apikey \
  --entry SMTP_PASSWORD=your-smtp-password
```

Install the template using your preferred method:

<CardGroup cols={2}>
  <Card title="UI" href="/template-catalog/install-manage/ui" icon="laptop">
    Browse, install, and manage templates visually
  </Card>

  <Card title="CLI" href="/template-catalog/install-manage/cli" icon="terminal">
    Manage templates from your terminal
  </Card>

  <Card title="Terraform" href="/template-catalog/install-manage/terraform" icon={<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><g fill-rule="evenodd"><path d="M77.941 44.5v36.836L46.324 62.918V26.082zm0 0" fill="#5c4ee5"/><path d="M81.41 81.336l31.633-18.418V26.082L81.41 44.5zm0 0" fill="#4040b2"/><path d="M11.242 42.36L42.86 60.776V23.941L11.242 5.523zm0 0M77.941 85.375L46.324 66.957v36.82l31.617 18.418zm0 0" fill="#5c4ee5"/></g></svg>}>
    Declare templates in your Terraform configurations
  </Card>

  <Card
    title="Pulumi"
    href="/template-catalog/install-manage/pulumi"
    icon={<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" id="Pulumi-Icon--Streamline-Svg-Logos" height="24" width="24">
    <desc>
        Pulumi Icon Streamline Icon: https://streamlinehq.com
    </desc>
    <path fill="#f26e7e" d="M4.683025 13.3318c0.869125 -0.5018 0.870575 -2.1264 0.003225 -3.62865s-2.27504 -2.313275 -3.1441725 -1.811475C0.672945 8.3935 0.6715 10.0181 1.53885 11.52035c0.86735 1.502275 2.27505 2.313275 3.144175 1.81145Zm0.0052 3.2167c0.86735 1.502275 0.865925 3.126875 -0.003225 3.628675 -0.86915 0.5018 -2.2768275 -0.309225 -3.144175 -1.81145 -0.8673525 -1.50225 -0.8659075 -3.126875 0.003225 -3.628675 0.8691325 -0.5018 2.276825 0.309225 3.144175 1.81145Zm5.922875 3.4243c0.86735 1.50225 0.8659 3.126775 -0.003225 3.62875 -0.869125 0.501775 -2.27685 -0.309325 -3.1442 -1.81155 -0.867325 -1.50225 -0.865875 -3.12685 0.00325 -3.628675 0.869125 -0.5018 2.276825 0.309225 3.144175 1.811475Zm-0.001925 -6.845275c0.86735 1.50225 0.8659 3.12685 -0.003225 3.628675 -0.869125 0.5018 -2.276825 -0.309225 -3.144175 -1.811475 -0.86735 -1.50225 -0.8659 -3.12685 0.003225 -3.62865 0.869125 -0.501825 2.276825 0.3092 3.144175 1.81145Z" stroke-width="0.25"></path>
    <path fill="#8a3391" d="M22.45775 11.524125c0.86725 -1.502225 0.865925 -3.12685 -0.003225 -3.62865 -0.869125 -0.501825 -2.276825 0.3092 -3.144175 1.811475 -0.86735 1.50225 -0.8659 3.126825 0.003225 3.62865 0.869125 0.501825 2.276825 -0.3092 3.144175 -1.811475Zm0.000175 3.2151c0.869075 0.5018 0.870625 2.1264 0.003225 3.62865 -0.86735 1.50225 -2.27505 2.313275 -3.144175 1.81145 -0.869125 -0.5018 -0.870575 -2.126425 -0.003225 -3.62865 0.86735 -1.50225 2.27505 -2.313275 3.144175 -1.81145ZM16.536225 18.157875c0.86915 0.501825 0.8706 2.126425 0.00325 3.628675 -0.86735 1.502125 -2.275075 2.313225 -3.1442 1.81145 -0.869125 -0.50175 -0.870575 -2.126425 -0.003225 -3.62865 0.867375 -1.502275 2.27505 -2.3133 3.144175 -1.811475Zm-0.003325 -6.843775c0.869125 0.5018 0.870575 2.126425 0.003225 3.628675s-2.27505 2.313275 -3.1442 1.811475c-0.869125 -0.501825 -0.870575 -2.126425 -0.003225 -3.628675 0.86735 -1.502275 2.27505 -2.313275 3.1442 -1.811475Z" stroke-width="0.25"></path>
    <path fill="#f7bf2a" d="M15.138225 2.06721c0 1.003615 -1.40625 1.817215 -3.14095 1.817215 -1.7347 0 -3.14095 -0.8136 -3.14095 -1.817215C8.856325 1.06359 10.262575 0.25 11.997275 0.25c1.7347 0 3.14095 0.81359 3.14095 1.81721ZM9.2166 5.482375c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172s1.40625 -1.817225 3.14095 -1.817225c1.7347 0 3.14095 0.8136 3.14095 1.817225Zm8.71005 1.8172c1.7347 0 3.14095 -0.813575 3.14095 -1.8172s-1.40625 -1.817225 -3.14095 -1.817225c-1.7347 0 -3.14095 0.8136 -3.14095 1.817225s1.40625 1.8172 3.14095 1.8172Zm-2.788425 1.605625c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172 0 -1.0036 1.40625 -1.8172 3.14095 -1.8172 1.7347 0 3.14095 0.8136 3.14095 1.8172Z" stroke-width="0.25"></path>
    </svg>}
  >
    Declare templates in your Pulumi programs
  </Card>
</CardGroup>

## Configuration

The default `values.yaml` for this template:

```yaml theme={null}
infisical:
  # Standalone image: bundles the API + web UI on :8080 and runs DB migrations on boot.
  image: infisical/infisical:v0.162.14
  replicas: 1                 # 1 = proven single-replica shape; 2+ = HA tier (stateless app over shared pg+redis)
  siteUrl: ""                 # empty = derive from the canonical *.cpln.app endpoint; set (with https://) for a custom domain
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 2Gi

# Prerequisite dictionary secret — MUST EXIST BEFORE INSTALL (see Prerequisites).
secrets:
  name: my-infisical-secrets  # holds ENCRYPTION_KEY + AUTH_SECRET (both write-once)

# SMTP / email (optional; off by default)
smtp:
  enabled: false              # true = enable email invites, verification, password reset
  host: smtp.example.com
  port: 587
  fromAddress: no-reply@example.com
  fromName: Infisical
  requireTls: true            # STARTTLS; set false for a plaintext mail catcher
  auth:
    secretName: ""            # optional dictionary secret with SMTP_USERNAME + SMTP_PASSWORD; empty = no auth

publicAccess:
  enabled: true               # HTTPS UI + API on the auto *.cpln.app endpoint; false = internal-only
internalAccess:
  type: same-gvc              # options: none, same-gvc, same-org, workload-list
  workloads: []               # used only with workload-list

# PostgreSQL — durable secret store
postgres:
  image: postgres:18
  config:
    username: infisical
    password: change-me-infisical-pg   # change before installing
    database: infisical
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 1Gi
  volumeset:
    capacity: 10              # initial capacity in GiB (minimum is 10)

# Redis + Sentinel (HA) — cache + job queues; REQUIRED
redis:
  redis:
    image: redis:7.4
    replicas: 3
    auth:
      password:
        enabled: false        # true = require AUTH; the password is wired into Infisical as REDIS_PASSWORD
        value: change-me-infisical-redis
  sentinel:
    image: redis:7.4
    replicas: 3
```

### Infisical server

* `infisical.image` — The standalone Infisical image (API + web UI in one container). Pin a concrete tag.
* `infisical.replicas` — Number of stateless server replicas. `1` is the proven single-replica shape; `2` or more gives an HA tier over the shared PostgreSQL and Redis, with zero-downtime rolling restarts. Boot migrations are serialized by a startup lock, so they run exactly once no matter how many replicas start at once.
* `infisical.siteUrl` — The public base URL Infisical advertises in links, cookies, and callbacks. Leave empty to derive it automatically from the canonical `*.cpln.app` endpoint; set it (including `https://`) only when you front the workload with a custom domain.
* `infisical.resources` — CPU and memory per replica. Keep `maxMemory` at `2Gi` — a cold multi-replica boot runs out of memory at `1Gi`.

### Prerequisite secret

* `secrets.name` — Name of the user-created dictionary secret holding `ENCRYPTION_KEY` and `AUTH_SECRET`. It must exist **before** install — see [Prerequisites](#prerequisites).

### SMTP / email

Off by default — the zero-config install works via the no-email admin-signup bootstrap. Enable it for email invites, address verification, and password reset:

* `smtp.enabled` — Turn email on. `smtp.host` and `smtp.fromAddress` are required when enabled.
* `smtp.requireTls` — STARTTLS is required by default; set `false` only for a plaintext mail catcher (e.g. Mailpit on port `1025`).
* `smtp.auth.secretName` — Name of an optional dictionary secret with `SMTP_USERNAME` and `SMTP_PASSWORD` for authenticated SMTP. Empty means no authentication; when set, the workload is granted `reveal` on exactly that secret.

### Access

* `publicAccess.enabled` — Serve the UI and API on the canonical `*.cpln.app` HTTPS endpoint (default). Set to `false` for an internal-only instance.
* `internalAccess.type` — Internal firewall scope of the server workload:

| Type            | Description                                                            |
| --------------- | ---------------------------------------------------------------------- |
| `none`          | No internal access.                                                    |
| `same-gvc`      | Allow access from all workloads in the same GVC (default).             |
| `same-org`      | Allow access from all workloads in the same organization.              |
| `workload-list` | Allow access only from workloads listed in `internalAccess.workloads`. |

### PostgreSQL

* `postgres.config.password` — The bundled database password. **Change it before installing.**
* `postgres.volumeset.capacity` — Initial volume size in GiB (minimum 10).

PostgreSQL stores everything: secrets, versions, projects, environments, and users.

### Redis

* `redis.redis.auth.password.enabled` — When `false` (default), Redis runs authless with the same-GVC firewall as the boundary. Set to `true` to require AUTH on the data nodes; the master password is then wired into Infisical as `REDIS_PASSWORD` (Sentinels stay authless). Both paths are tested end to end, including Sentinel monitoring the auth-protected master.
* `redis.redis.replicas` / `redis.sentinel.replicas` — Redis and Sentinel replica counts (3 + 3 by default).

Redis is required — Infisical will not boot without it, so the template hard-wires the dependency (no enable/disable toggle).

## Connecting

| Target              | Address                                            | Credentials                       |
| ------------------- | -------------------------------------------------- | --------------------------------- |
| Public UI + API     | `https://<canonical>.cpln.app`                     | first sign-up becomes super-admin |
| Internal (same GVC) | `http://{release}-infisical.{gvc}.cpln.local:8080` | account login / API token         |
| Health check        | `GET /api/status`                                  | none                              |

The canonical `*.cpln.app` hostname appears under `status.canonicalEndpoint` (`cpln workload get {release}-infisical -o yaml`).

<Warning>
  **The first account to sign up becomes the super-admin.** There are no admin bootstrap variables — with public access enabled, create your admin account immediately after install, then disable open sign-ups in the Admin panel.
</Warning>

## Important Notes

* **The prerequisite secret must exist before install** — `secrets.name` is a dictionary secret with `ENCRYPTION_KEY` and `AUTH_SECRET`. A missing secret wedges the deployment and makes it look broken.
* **`ENCRYPTION_KEY` and `AUTH_SECRET` are write-once — never rotate them.** `ENCRYPTION_KEY` encrypts every stored secret; `AUTH_SECRET` signs all sessions.
* **The first account to sign up becomes super-admin** — create it immediately after install, then disable open sign-ups in the Admin panel.
* **Redis is required, not optional** — Infisical will not boot without it (authless behind the same-GVC firewall by default).
* **Keep `infisical.resources.maxMemory` at `2Gi`** — a cold boot with `replicas` ≥ 2 runs out of memory at `1Gi`.
* **Stored secrets live in PostgreSQL and survive an app restart or reinstall** — to wipe all data you must also reinstall the PostgreSQL dependency (which deletes its volume set).
* **First boot takes roughly 2–5 minutes** — the server waits for PostgreSQL to finish initializing and runs its migrations, logging transient `Boot up migration failed` retries in the meantime. This self-heals; the workload becomes ready once migrations complete.
* **Set `smtp.requireTls: false` only for a plaintext mail catcher** — real providers on port `587` need it left `true`.

## External References

<CardGroup cols={2}>
  <Card title="Infisical Documentation" icon="book" href="https://infisical.com/docs/documentation/getting-started/introduction">
    Official Infisical documentation
  </Card>

  <Card title="Self-Hosting Configuration" icon="sliders" href="https://infisical.com/docs/self-hosting/configuration/envars">
    Environment variable reference for self-hosted Infisical
  </Card>

  <Card title="Standalone Deployment" icon="server" href="https://infisical.com/docs/self-hosting/deployment-options/standalone-infisical">
    The standalone image this template deploys
  </Card>

  <Card title="Email Service Setup" icon="envelope" href="https://infisical.com/docs/self-hosting/configuration/envars#email-service">
    SMTP setup for invites, verification, and password reset
  </Card>

  <Card title="Infisical Template" icon="github" href="https://github.com/controlplane-com/templates/tree/main/infisical">
    View the source files, default values, and chart definition
  </Card>
</CardGroup>