Read how to configure environment variables for self-hosted Infisical.
Infisical accepts all configurations via environment variables. For a minimal self-hosted instance, at least ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI and REDIS_URL must be defined.
However, you can configure additional settings to activate more features as needed.
Specifies the network interface Infisical will bind to when accepting incoming connections.
By default, Infisical binds to localhost, which restricts access to connections from the same machine.
To make the application accessible externally (e.g., for self-hosted deployments), set this to 0.0.0.0, which tells the server to listen on all network interfaces.
Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain.
The following environment variables can be used to configure the Infisical Rest API to allow or restrict access to resources from different origins.
Please note that the database user you create must be granted all privileges
on the Infisical database. This includes the ability to create new schemas,
create, update, delete, modify tables and indexes, etc.
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
Use the following command to encode your certificate: echo "<certificate>" | base64
Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64.
Use the following command to encode your certificate: echo "<certificate>" | base64
If not provided it will use master SSL certificate.
Without email configuration, Infisical’s core functions like sign-up/login and secret operations work, but this disables multi-factor authentication, email invites for projects, alerts for suspicious logins, and all other email-dependent features.
If this is true and SMTP_PORT is not 465 then Infisical tries to use
STARTTLS even if the server does not advertise support for it. If the
connection can not be encrypted then message is not sent.
If this is true, Infisical will validate the server’s SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to false, the client will accept the server’s certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.
This variable must be a base64 encoded PEM certificate. Use the following command to encode your certificate: echo "<certificate>" | base64
Infisical highly encourages the following variables be used alongside this one for maximum security:
SMTP_REQUIRE_TLS=true
SMTP_TLS_REJECT_UNAUTHORIZED=true
Create an account and configure SendGrid to send emails.
Create a SendGrid API Key under Settings > API Keys
Set a name for your API Key, we recommend using “Infisical,” and select the “Restricted Key” option. You will need to enable the “Mail Send” permission as shown below:
With the API Key, you can now set your SMTP environment variables:
SMTP_HOST=smtp.sendgrid.netSMTP_USERNAME=apikeySMTP_PASSWORD=SG.rqFsfjxYPiqE1lqZTgD_lz7x8IVLx # your SendGrid API Key from step aboveSMTP_PORT=587[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and configure Mailgun to send emails.
Obtain your Mailgun credentials in Sending > Overview > SMTP
With your Mailgun credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.mailgun.org # obtained from credentials page[email protected] # obtained from credentials pageSMTP_PASSWORD=password # obtained from credentials pageSMTP_PORT=587[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
1
Create a verifed identity
This will be used to verify the email you are sending from.
If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
2
Create an account and configure AWS SES
Create an IAM user for SMTP authentication and obtain SMTP credentials in SMTP settings > Create SMTP credentials
3
Set up your SMTP environment variables
With your AWS SES SMTP credentials, you can now set up your SMTP environment variables for your Infisical instance.
SMTP_HOST=email-smtp.ap-northeast-1.amazonaws.com # SMTP endpoint obtained from SMTP settingsSMTP_USERNAME=xxx # your SMTP usernameSMTP_PASSWORD=xxx # your SMTP passwordSMTP_PORT=465[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and configure SocketLabs to send emails.
From the dashboard, navigate to SMTP Credentials > SMTP & APIs > SMTP Credentials to obtain your SocketLabs SMTP credentials.
With your SocketLabs SMTP credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.socketlabs.comSMTP_USERNAME=username # obtained from your credentialsSMTP_PASSWORD=password # obtained from your credentialsSMTP_PORT=587[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
The SMTP_FROM_ADDRESS environment variable should be an email for an
authenticated domain under Configuration > Domain Management in SocketLabs.
For example, if you’re using SocketLabs in sandbox mode, then you may use an
email like [email protected].
Remember that you will need to restart Infisical for this to work properly.
With the API Key, you can now set your SMTP environment variables variables:
SMTP_HOST=smtp.resend.comSMTP_USERNAME=resendSMTP_PASSWORD=YOUR_API_KEYSMTP_PORT=587[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Remember that you will need to restart Infisical for this to work properly.
Create an account and enable “less secure app access” in Gmail Account Settings > Security. This will allow
applications like Infisical to authenticate with Gmail via your username and password.
With your Gmail username and password, you can set your SMTP environment variables:
SMTP_HOST=smtp.gmail.com[email protected] # your emailSMTP_PASSWORD=password # your passwordSMTP_PORT=587[email protected]SMTP_FROM_NAME=Infisical
As per the notice by Google, you should note that using Gmail credentials for SMTP configuration
will only work for Google Workspace or Google Cloud Identity customers as of May 30, 2022.
Put differently, the SMTP configuration is only possible with business (not personal) Gmail credentials.
Create an account and configure Office365 to send emails.
With your login credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.office365.com[email protected] # your usernameSMTP_PASSWORD=password # your passwordSMTP_PORT=587[email protected]SMTP_FROM_NAME=Infisical
Create an account and configure Zoho Mail to send emails.
With your email credentials, you can now set up your SMTP environment variables:
SMTP_HOST=smtp.zoho.comSMTP_USERNAME=username # your emailSMTP_PASSWORD=password # your passwordSMTP_PORT=587[email protected] # your personal Zoho email or domain-based email linked to Zoho MailSMTP_FROM_NAME=Infisical
You can use either your personal Zoho email address like [email protected] or
a domain-based email address like [email protected]. If using a
domain-based email address, then please make sure that you’ve configured and
verified it with Zoho Mail.
Remember that you will need to restart Infisical for this to work properly.
Create an account and configure SMTP2Go to send emails.
Turn on SMTP authentication
SMTP_HOST=mail.smtp2go.comSMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587SMTP_USERNAME=username #Your SMTP2GO account's SMTP usernameSMTP_PASSWORD=password #Your SMTP2GO account's SMTP password[email protected] # your email address being used to send out emailsSMTP_FROM_NAME=Infisical
Optional (for TLS/SSL):
TLS: Available on the same ports (2525, 80, 25, 8025, or 587)
SSL: Available on ports 465, 8465, and 443
By default, users can only login via email/password based login method.
To login into Infisical with OAuth providers such as Google, configure the associated variables.
When set, all visits to the Infisical login page will automatically redirect users of your Infisical instance to the SAML identity provider associated with the specified organization slug.
