Automate certificates with Infisical Agent

# macOS
brew install infisical/get-cli/infisical

# Linux (Debian/Ubuntu)
curl -1sLf 'https://artifacts.infisical.com/setup.deb.sh' | sudo -E bash
sudo apt-get install infisical

version: v2

infisical:
  address: "https://app.infisical.com"

auth:
  type: "universal-auth"
  config:
    client-id: "/etc/infisical/client-id" # Path to a file containing the client ID
    client-secret: "/etc/infisical/client-secret" # Path to a file containing the client secret

certificates:
  - application-name: "my-first-app"
    profile-name: "web-servers"
    attributes:
      common-name: "api.example.com"
      ttl: "90d"
    lifecycle:
      renew-before-expiry: "14d"
    file-output:
      private-key:
        path: "/etc/ssl/private/api.key"
        permission: "0600"
      certificate:
        path: "/etc/ssl/certs/api.crt"
        permission: "0644"
    post-hooks:
      on-renewal:
        command: "systemctl reload nginx"

infisical cert-manager agent --config /etc/infisical/agent-config.yaml