docs/self-hosting/guides/production-hardening.mdx
This document provides specific security hardening recommendations for production Infisical deployments. These recommendations follow Infisical's security model and focus on defense in depth.
Choose your deployment method below and follow the recommendations for your specific setup. Start with Universal Security Fundamentals that apply to all deployments, then follow your deployment-specific section.
These security configurations apply to all Infisical deployments regardless of how you deploy.
Generate strong cryptographic keys for your deployment:
# Required - Generate secure encryption key
ENCRYPTION_KEY=$(openssl rand -hex 16)
# Required - Generate secure auth secret
AUTH_SECRET=$(openssl rand -base64 32)
Minimize exposure window for compromised tokens:
# JWT token configuration (adjust based on security requirements)
JWT_AUTH_LIFETIME=15m # Authentication tokens
JWT_REFRESH_LIFETIME=24h # Refresh tokens
JWT_SERVICE_LIFETIME=1h # Service tokens
Configure HTTPS and secure database connections:
# Enable HTTPS (recommended for production)
HTTPS_ENABLED=true
# Secure PostgreSQL connection with SSL
DB_CONNECTION_URI="postgresql://user:pass@host:5432/db?sslmode=require"
# For base64-encoded SSL certificate
DB_ROOT_CERT="<base64-encoded-certificate>"
Use authentication and TLS for Redis:
# Redis with TLS (if supported by your Redis deployment)
REDIS_URL="rediss://user:password@redis:6380"
# Redis Sentinel configuration for high availability
REDIS_SENTINEL_HOSTS="192.168.65.254:26379,192.168.65.254:26380"
REDIS_SENTINEL_MASTER_NAME="mymaster"
REDIS_SENTINEL_ENABLE_TLS=true
REDIS_SENTINEL_USERNAME="sentinel_user"
REDIS_SENTINEL_PASSWORD="sentinel_password"
Configure network restrictions and firewall rules:
# Limit CORS to specific domains
CORS_ALLOWED_ORIGINS=["https://your-app.example.com"]
# Prevent connections to internal/private IP addresses
# This blocks access to internal services like metadata endpoints,
# internal APIs, databases, and other sensitive infrastructure
ALLOW_INTERNAL_IP_CONNECTIONS=false
Implement network firewalls. Restrict network access to only necessary services:
Set proper site URL for your Infisical instance:
# Required - Must be absolute URL with protocol
SITE_URL="https://app.infisical.com"
Use TLS for email communications:
# SMTP with TLS
SMTP_HOST="smtp.example.com"
SMTP_PORT="587"
SMTP_USERNAME="your-smtp-user"
SMTP_PASSWORD="your-smtp-password"
SMTP_REQUIRE_TLS=true
SMTP_IGNORE_TLS=false
SMTP_FROM_ADDRESS="[email protected]"
SMTP_FROM_NAME="Infisical"
Control telemetry and data collection:
# Optional - Disable telemetry (enabled by default)
TELEMETRY_ENABLED=false
Configure database read replicas for high availability PostgreSQL setups:
# Read replica configuration (JSON format)
DB_READ_REPLICAS='[{"DB_CONNECTION_URI":"postgresql://user:pass@replica:5432/db?sslmode=require"}]'
Establish user off-boarding procedures. Remove access promptly when users leave:
Keep frequent upgrade cadence. Regularly update to the latest Infisical version for your deployment method.
These recommendations are specific to Docker deployments of Infisical.
Use read-only root filesystems. Prevent runtime modifications while allowing necessary temporary access:
# Run with read-only filesystem but allow /tmp access
docker run --read-only \
--tmpfs /tmp:rw,exec,size=1G \
infisical/infisical:latest
Note: Infisical requires temporary directory access for:
The --tmpfs mounts provide secure, isolated temporary storage that is:
Drop unnecessary capabilities. Remove all Linux capabilities:
# Drop all capabilities
docker run --cap-drop=ALL infisical/infisical:latest
Use specific image tags. Never use latest tags in production:
# Use specific version tags
docker run infisical/infisical:v0.93.1-postgres
Set resource limits. Prevent resource exhaustion attacks:
# Set memory and CPU limits
docker run --memory=1g --cpus=0.5 infisical/infisical:latest
Configure health checks. Set up Docker health checks:
# In Dockerfile or docker-compose.yml
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
CMD curl -f http://localhost:8080/api/status || exit 1
Host firewall configuration. Configure host-level firewall for Docker deployments:
# Docker manages its own iptables rules, but configure host firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow Docker-mapped ports (adjust based on your port mapping)
sudo ufw allow 8080/tcp # If mapping container 8080 to host 8080
sudo ufw allow 443/tcp # If terminating HTTPS at host level
# Enable firewall
sudo ufw --force enable
# Verify Docker iptables integration
sudo iptables -L DOCKER
Regular updates. Monitor Docker Hub for new releases and update your image tags regularly.
These recommendations are specific to Kubernetes deployments of Infisical.
Use Pod Security Standards. Apply restricted security profile:
# Namespace-level Pod Security Standards
apiVersion: v1
kind: Namespace
metadata:
name: infisical
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
Configure security context. Set comprehensive security context:
# Deployment security context
apiVersion: apps/v1
kind: Deployment
metadata:
name: infisical
spec:
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1001
fsGroup: 1001
containers:
- name: infisical
image: infisical/infisical:v0.93.1-postgres
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1001
capabilities:
drop:
- ALL
resources:
limits:
memory: 1000Mi
cpu: 500m
requests:
cpu: 350m
memory: 512Mi
Configure network policies. Restrict pod-to-pod communication:
# Example Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: infisical-netpol
namespace: infisical
spec:
podSelector:
matchLabels:
app: infisical
policyTypes:
- Ingress
- Egress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: ingress-system
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: postgres
ports:
- protocol: TCP
port: 5432
- to:
- podSelector:
matchLabels:
app: redis
ports:
- protocol: TCP
port: 6379
Infrastructure firewall considerations. In addition to the universal host firewalls, implement infrastructure-level security:
For cloud deployments (AWS Security Groups, Azure NSGs, or GCP Firewall Rules):
For on-premises deployments, ensure node-level firewalls allow:
Use dedicated service accounts. Create service accounts with minimal permissions:
# Service account configuration
apiVersion: v1
kind: ServiceAccount
metadata:
name: infisical
namespace: infisical
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: infisical
spec:
template:
spec:
serviceAccountName: infisical
Configure ingress with TLS. Set up secure ingress:
# Secure ingress configuration
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: infisical-ingress
namespace: infisical
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- secretName: infisical-tls
hosts:
- app.example.com
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: infisical
port:
number: 8080
Use Kubernetes secrets. Store sensitive configuration securely:
# Kubernetes secret for environment variables
apiVersion: v1
kind: Secret
metadata:
name: infisical-secrets
namespace: infisical
type: Opaque
stringData:
AUTH_SECRET: "<generate-with-openssl-rand-base64-32>"
ENCRYPTION_KEY: "<generate-with-openssl-rand-hex-16>"
DB_CONNECTION_URI: "<your-postgres-connection-string>"
REDIS_URL: "<your-redis-connection-string>"
SITE_URL: "<your-site-url>"
Note: Kubernetes secrets are only base64-encoded by default and are not encrypted at rest unless you explicitly enable etcd encryption. For production environments, you should:
Set up health checks. Configure readiness and liveness probes:
# Health check configuration
containers:
- name: infisical
readinessProbe:
httpGet:
path: /api/status
port: 8080
initialDelaySeconds: 10
periodSeconds: 5
livenessProbe:
httpGet:
path: /api/status
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
Use managed databases (if possible). For production deployments, consider using managed PostgreSQL and Redis services instead of in-cluster instances when feasible, as they typically provide better security, backup, and maintenance capabilities.
Regular updates. Monitor Docker Hub for new releases and update your deployment manifests with new image tags regularly.
These recommendations are specific to deployments using the Infisical Linux package, which is managed by the infisical-ctl CLI tool.
The Infisical Linux package (omnibus) includes several security measures out of the box:
chpst to automatically drop the running application process from root to the dedicated infisical user. You do not need to configure this manually.runsvdir, which provides automatic process supervision and restart./opt/infisical-core, /var/opt/infisical-core, /var/log/infisical-core).The infisical-core package ships a systemd unit (infisical-runsvdir.service) that starts the runsvdir process supervisor. You can apply additional hardening using a systemd drop-in override without modifying the original unit file:
# Create a systemd drop-in override
sudo systemctl edit infisical-runsvdir.service
Add the following content to the override file:
# /etc/systemd/system/infisical-runsvdir.service.d/override.conf
[Service]
RestartSec=10
# Prevent child processes from gaining new privileges
NoNewPrivileges=true
# Isolate /tmp from the rest of the system
PrivateTmp=true
# Protect /home, /root, and /run/user from access
ProtectHome=true
# Make the entire filesystem read-only except for explicitly allowed paths
ProtectSystem=strict
ReadWritePaths=/opt/infisical-core
ReadWritePaths=/var/opt/infisical-core
ReadWritePaths=/var/log/infisical-core
# Create and manage /run/infisical-core automatically at service start
RuntimeDirectory=infisical-core
# Prevent loading of kernel modules
ProtectKernelModules=true
# Protect cgroup hierarchy from modification
ProtectControlGroups=true
# Restrict creation of SUID/SGID files
RestrictSUIDSGID=true
# Disable core dumps to prevent sensitive data exposure
LimitCORE=0
# Limit swap usage to 0 for this service's cgroup (also disable system-wide swap in the System Security section below)
MemorySwapMax=0
After saving, reload systemd and restart the service:
sudo systemctl daemon-reload
sudo systemctl restart infisical-runsvdir.service
Secure the configuration file. The infisical.rb file contains sensitive credentials and should be properly protected:
# Restrict permissions on the configuration file
sudo chmod 600 /etc/infisical/infisical.rb
sudo chown root:root /etc/infisical/infisical.rb
Use secure values in configuration. Generate strong cryptographic keys:
# /etc/infisical/infisical.rb
# Generate with: openssl rand -hex 16
infisical_core['ENCRYPTION_KEY'] = '<secure-random-hex-key>'
# Generate with: openssl rand -base64 32
infisical_core['AUTH_SECRET'] = '<secure-random-base64-key>'
# Use SSL for database connections
infisical_core['DB_CONNECTION_URI'] = 'postgres://user:pass@host:5432/db?sslmode=require'
# Use TLS for Redis if supported
infisical_core['REDIS_URL'] = 'rediss://user:password@redis:6380'
After making configuration changes, apply them with:
infisical-ctl reconfigure
Verify directory permissions. Ensure proper ownership on application directories:
# Application directory
sudo chown -R root:root /opt/infisical-core
sudo chmod 755 /opt/infisical-core
# Data directory
sudo chown -R infisical:infisical /var/opt/infisical-core
sudo chmod 750 /var/opt/infisical-core
# Log directory
sudo chown -R infisical:infisical /var/log/infisical-core
sudo chmod 750 /var/log/infisical-core
Disable memory swapping. Prevent sensitive data from being written to disk:
# Disable swap immediately
sudo swapoff -a
# Disable swap permanently (comment out swap entries)
sudo sed -i '/swap/d' /etc/fstab
Disable core dumps. Prevent potential exposure of encryption keys:
# Set system-wide core dump limits
echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
# Disable core dumps for current session
ulimit -c 0
Synchronize system clocks. Ensure accurate time for JWT token validation and audit log timestamps:
# Verify time synchronization is active
# (systemd-timesyncd is enabled by default on most modern distributions;
# replace with chrony or ntp if preferred)
timedatectl status
sudo systemctl enable --now systemd-timesyncd
Host firewall configuration. Configure comprehensive firewall for Linux package deployments:
# Configure UFW firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow Infisical API access
sudo ufw allow 8080/tcp
# Allow HTTPS (if terminating TLS at Infisical)
sudo ufw allow 443/tcp
# If running PostgreSQL locally, restrict to localhost
sudo ufw allow from 127.0.0.1 to any port 5432
# If running Redis locally, restrict to localhost
sudo ufw allow from 127.0.0.1 to any port 6379
# Enable firewall
sudo ufw --force enable
Monitor service health. Use infisical-ctl to monitor the service:
# Check service status
infisical-ctl status
# Stream real-time logs for monitoring
infisical-ctl tail
Regular updates. Monitor Infisical releases for new package versions. Update using your package manager:
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade infisical-core
# RHEL/CentOS/Amazon Linux
sudo yum update infisical-core
After updating, apply the new version:
infisical-ctl reconfigure
For the highest level of encryption security, integrate with Hardware Security Modules:
HSM integration provides hardware-protected encryption keys stored on tamper-proof devices, offering superior security for encryption operations:
# HSM Environment Variables (example for production)
HSM_LIB_PATH="/path/to/hsm/library.so"
HSM_PIN="your-hsm-pin"
HSM_SLOT="0"
HSM_KEY_LABEL="infisical-root-key"
For complete HSM setup instructions, see the HSM Integration Guide.
Leverage cloud-native KMS providers for enhanced security and compliance:
Infisical can integrate with external KMS providers to encrypt project secrets, providing enterprise-grade key management:
For external KMS configuration, see:
Configure backup encryption. Encrypt PostgreSQL backups:
# PostgreSQL backup with encryption
pg_dump $DB_CONNECTION_URI | gpg --cipher-algo AES256 --compress-algo 1 --symmetric --output backup.sql.gpg
Implement log monitoring. Set up centralized logging for security analysis and audit trails. Configure your SIEM or logging platform to monitor Infisical operations.
Regular security updates. Monitor the Infisical repository for security updates and apply them promptly.
For enterprise deployments requiring compliance certifications:
Infisical is compliant with FIPS 140-3, meeting U.S. and Canadian government cryptographic standards through validated cryptographic modules. This certification is designed for organizations that require government-approved encryption implementations. To deploy a FIPS-compliant instance, use the infisical/infisical-fips Docker image, available to Enterprise customers. Our FIPS 140-3 attestation letter is available in the Infisical Trust Center.
Infisical is SOC 2 compliant, demonstrating adherence to rigorous security, availability, and confidentiality standards established by the American Institute of CPAs (AICPA). This certification validates our security controls and operational practices for organizations requiring third-party audited security assurance. Our SOC 2 report is available in the Infisical Trust Center.
Infisical is HIPAA compliant, meeting the security and privacy requirements of the Health Insurance Portability and Accountability Act. This compliance framework ensures appropriate safeguards for protected health information (PHI) for healthcare organizations and their business associates. Our HIPAA certification is available in the Infisical Trust Center.