commit c475aacbc1b3962b8ad4443ad414fe29759af3ed Author: nkozobrod Date: Sun Sep 6 11:38:37 2026 +0300 Initial commit: Infisical (secrets.kzbrd.ru) — docker-compose + Traefik labels + IP-whitelist diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..b66bc32 --- /dev/null +++ b/.env.example @@ -0,0 +1,152 @@ +# Keys +# Required key for platform encryption/decryption ops +# THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NEVER BE USED FOR PRODUCTION +ENCRYPTION_KEY=f13dbc92aaaf86fa7cb0ed8ac3265f47 + +# JWT +# Required secrets to sign JWT tokens +# THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION +AUTH_SECRET=5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE= + +# Postgres creds +POSTGRES_PASSWORD=infisical +POSTGRES_USER=infisical +POSTGRES_DB=infisical + +# Required +DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB} + +# Redis +REDIS_URL=redis://redis:6379 + +# Website URL +# Required +SITE_URL=http://localhost:8080 + +# Mail/SMTP +SMTP_HOST= +SMTP_PORT= +SMTP_FROM_ADDRESS= +SMTP_FROM_NAME= +SMTP_USERNAME= +SMTP_PASSWORD= + +# CICD Integration +CLIENT_ID_GITHUB= +CLIENT_ID_GITHUB_APP= +CLIENT_SLUG_GITHUB_APP= +CLIENT_SECRET_GITHUB= +CLIENT_SECRET_GITHUB_APP= +CLIENT_ID_GITLAB= +CLIENT_SECRET_GITLAB= +CLIENT_PRIVATE_KEY_GITHUB_APP= +CLIENT_APP_ID_GITHUB_APP= + +# Sentry (optional) for monitoring errors +SENTRY_DSN= + +# Infisical Cloud-specific configs +# Ignore - Not applicable for self-hosted version +POSTHOG_HOST= +POSTHOG_PROJECT_API_KEY= + +# SSO-specific variables +CLIENT_ID_GOOGLE_LOGIN= +CLIENT_SECRET_GOOGLE_LOGIN= + +CLIENT_ID_GITHUB_LOGIN= +CLIENT_SECRET_GITHUB_LOGIN= + +CLIENT_ID_GITLAB_LOGIN= +CLIENT_SECRET_GITLAB_LOGIN= + +CAPTCHA_SECRET= + +NEXT_PUBLIC_CAPTCHA_SITE_KEY= + +OTEL_TELEMETRY_COLLECTION_ENABLED=false +OTEL_EXPORT_TYPE=prometheus +OTEL_EXPORT_OTLP_ENDPOINT= +OTEL_OTLP_PUSH_INTERVAL= + +OTEL_COLLECTOR_BASIC_AUTH_USERNAME= +OTEL_COLLECTOR_BASIC_AUTH_PASSWORD= +OTEL_DROP_HIGH_CARDINALITY_METERS=false + +PLAIN_API_KEY= +PLAIN_WISH_LABEL_IDS= + +SSL_CLIENT_CERTIFICATE_HEADER_KEY= + +ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT=true + +# App Connections + +# aws assume-role connection +INF_APP_CONNECTION_AWS_ACCESS_KEY_ID= +INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY= + +# github oauth connection +INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID= +INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET= + +#github app connection +INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID= +INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET= +INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY= +INF_APP_CONNECTION_GITHUB_APP_SLUG= +INF_APP_CONNECTION_GITHUB_APP_ID= + +#gitlab app connection +INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID= +INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET= + +#github radar app connection +INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_ID= +INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_SECRET= +INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY= +INF_APP_CONNECTION_GITHUB_RADAR_APP_SLUG= +INF_APP_CONNECTION_GITHUB_RADAR_APP_ID= +INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET= + +#gcp app connection +INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL= + +# azure app connections +INF_APP_CONNECTION_AZURE_APP_CONFIGURATION_CLIENT_ID= +INF_APP_CONNECTION_AZURE_APP_CONFIGURATION_CLIENT_SECRET= + +INF_APP_CONNECTION_AZURE_KEY_VAULT_CLIENT_ID= +INF_APP_CONNECTION_AZURE_KEY_VAULT_CLIENT_SECRET= + +INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_ID= +INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_SECRET= + +INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_ID= +INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_SECRET= + +# heroku app connection +INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID= +INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET= + +# datadog +SHOULD_USE_DATADOG_TRACER= +DATADOG_PROFILING_ENABLED= +DATADOG_ENV= +DATADOG_SERVICE= +DATADOG_HOSTNAME= + +# kubernetes +KUBERNETES_AUTO_FETCH_SERVICE_ACCOUNT_TOKEN=false + +# ClickHouse (optional) for audit log storage +# CLICKHOUSE_URL=http://infisical:infisical@clickhouse:8123/infisical + +# PingFederate dev container (only needed for `make up-dev-pingfed`). +# Register for free Ping DevOps credentials at https://devops.pingidentity.com/how-to/devopsRegistration/ +# Or leave both blank to run in Trial Product mode (uses bundled license, expires periodically). +PING_IDENTITY_DEVOPS_USER= +PING_IDENTITY_DEVOPS_KEY= + +# Local Active Directory dev container (only needed for `make up-dev-ad`). +SAMBA_ADMIN_PASSWORD=Passw0rd! diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..474fc89 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +.env +*.log +.DS_Store +Thumbs.db diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml new file mode 100644 index 0000000..623ed5d --- /dev/null +++ b/docker-compose.prod.yml @@ -0,0 +1,56 @@ +version: "3" + +services: + backend: + container_name: infisical-backend + restart: unless-stopped + depends_on: + db: + condition: service_healthy + redis: + condition: service_started + image: infisical/infisical:latest # PIN THIS TO A SPECIFIC TAG + pull_policy: always + env_file: .env + ports: + - 80:8080 + environment: + - NODE_ENV=production + networks: + - infisical + + redis: + image: redis + container_name: infisical-dev-redis + env_file: .env + restart: always + environment: + - ALLOW_EMPTY_PASSWORD=yes + networks: + - infisical + volumes: + - redis_data:/data + + db: + container_name: infisical-db + image: postgres:14-alpine + restart: always + env_file: .env + volumes: + - pg_data:/var/lib/postgresql/data + networks: + - infisical + healthcheck: + test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list" + interval: 5s + timeout: 10s + retries: 10 + +volumes: + pg_data: + driver: local + redis_data: + driver: local + +networks: + infisical: diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..943faa2 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,68 @@ +name: infisical + +services: + backend: + image: infisical/infisical:latest + container_name: infisical-backend + restart: unless-stopped + depends_on: + db: + condition: service_healthy + redis: + condition: service_started + env_file: .env + environment: + - NODE_ENV=production + networks: + - traefik_proxy + - infisical + labels: + - "traefik.enable=true" + - "traefik.docker.network=traefik_proxy" + - "traefik.http.routers.infisical.rule=Host(`secrets.kzbrd.ru`)" + - "traefik.http.routers.infisical.entrypoints=websecure" + - "traefik.http.routers.infisical.tls=true" + - "traefik.http.routers.infisical.tls.certresolver=myresolver" + - "traefik.http.routers.infisical.middlewares=local-ip-whitelist" + - "traefik.http.services.infisical.loadbalancer.server.port=8080" + # IP whitelist middleware — same Docker provider as router (no @file needed) + - "traefik.http.middlewares.local-ip-whitelist.ipwhitelist.sourcerange=192.168.1.0/24, 127.0.0.1/32, 172.19.0.0/16" + + redis: + image: redis:7-alpine + container_name: infisical-dev-redis + env_file: .env + restart: always + environment: + - ALLOW_EMPTY_PASSWORD=yes + networks: + - infisical + volumes: + - redis_data:/data + + db: + image: postgres:14-alpine + container_name: infisical-db + restart: always + env_file: .env + volumes: + - pg_data:/var/lib/postgresql/data + networks: + - infisical + healthcheck: + test: "pg_isready --username=infisical && psql --username=infisical --list" + interval: 5s + timeout: 10s + retries: 10 + +volumes: + pg_data: + driver: local + redis_data: + driver: local + +networks: + traefik_proxy: + external: true + infisical: + driver: bridge