Infisical is an open-source secrets management platform that helps you securely store, sync, and manage your application secrets across your entire development lifecycle. It provides a secure vault for API keys, database credentials, certificates, and other sensitive data with features like secret versioning, audit logs, and integrations with popular development tools.
We've been using this secrets manager at our company for a while and all I can say is: I am impressed! The product is rock solid and it's super simple to setup your own instance.
In this guide, I'll show you how to deploy your own Infisical instance in the cloud using Docker and Sliplane.
Overview
Our Infisical deployment will consist of three services:
- PostgreSQL - Main database for storing secrets and metadata
- Redis - Caching layer for improved performance
- Infisical - The main application server
Deploy in the Cloud
Step 1: Create a New Project
- Log in to Sliplane with your GitHub account
- In the Dashboard, click "Create Project" and name it "infisical"
Step 2: Deploy PostgreSQL Database
- Navigate to your new project and click "Deploy Service"
- Select a server or create a new one if you don't have one yet. To create a new server, click "Create Server", then choose the location and server type. The base server type should be enough to get started - you can scale up later if needed
- Choose Postgres from the presets
- In the settings:
- Disable the public toggle for additional security
- You can change the default database name, user, and password if desired, you'll need these credentials later for deploying Infisical
- Click "Deploy" and wait a few seconds for your database to deploy
Step 3: Deploy Redis
- In the same project, click "Deploy Service" again
- Select the same server where PostgreSQL is running
- Choose Redis from the presets
- In the settings:
- Disable the public toggle for additional security
- Like in PostgreSQL, you can change the default password if desired, which you will need later for deploying Infisical
- Click "Deploy" and wait a few seconds for Redis to come live
Step 4: Deploy Infisical
- In the infisical project, click "Deploy Service" again
- Select the same server where PostgreSQL and Redis are running
- Choose Registry as the deploy source
- In the "Image URL" field, enter:
docker.io/infisical/infisical:v0.137.0-postgres
- Add the following environment variables, but make sure to replace the placeholders with your actual Postgres and Redis connection details!
AUTH_SECRET="q6LRi7c717a3DQ8JUxlWYkZpMhG4+RHLoFUVt3Bvo2U=" DB_CONNECTION_URI="pg://postgres:s2H8ivfQidmNzfA4@postgres-wxzi.internal:5432/infiscal" ENCRYPTION_KEY="f40c9178624764ad85a6830b37ce239a" HOST="0.0.0.0" REDIS_URL="redis://:qclE92PDoGjNg3rP@redis-t9x2.internal:6379" SITE_URL="$SLIPLANE_DOMAIN"
Important: You need to update the following values:
- Replace
s2H8ivfQidmNzfA4
with your PostgreSQL password - Replace
postgres-wxzi.internal
with your PostgreSQL internal hostname - Replace
infiscal
with your database name (if you changed it) - Replace
qclE92PDoGjNg3rP
with your Redis password - Replace
redis-t9x2.internal
with your Redis internal hostname
To find these values:
- Navigate to your PostgreSQL service in a new tab - you'll see the internal hostname and connection details in the environment variables section
- Navigate to your Redis service in another tab - you'll see the internal hostname and password in the environment variables section
Click "Deploy" and wait for the deployment to complete. Once deployed, you can access Infisical at your ...sliplane.app
domain
Summary
Infisical provides a flexible, open-source alternative to commercial secrets management platforms like HashiCorp Vault or AWS Secrets Manager. Self-hosting gives you complete control over your sensitive data and the freedom to customize as needed.
This straightforward three-service setup with PostgreSQL and Redis containerized approach makes it simple to replicate across different environments or adapt to your specific requirements.
You now have a functional secrets management platform that you can easily extend or integrate with your existing tools. For deployment, we used Sliplane which simplified the Docker orchestration and inter-service networking.
Top comments (3)
I find it strange that the Docker image uses Redis. What if the caching time is set too high, then old keys could be accepted as valid when they are not.
I would go for a single source of truth.
According to their docs:
While I see no problem with the other Redis tasks. using caching for secrets does not sit well with me. It is the wrong optimization for me.
Use Postgres, when it becomes a bottleneck see if configuration can solve it.
If the Postgres options are not sufficient, use a database that can handle higher loads.
My guess is that checking the access to the secrets is the process that will take most of the time. And that should never be cached.
Don't get me wrong I'm not saying it is a bad solution. The people behind the project will be smart enough to think of the same problems I expressed here.