Why self-host your secrets manager
Storing secrets in a SaaS vault means your most sensitive credentials transit through a third-party server. Self-hosting Infisical keeps every secret on your own infrastructure, under your own access controls and audit logs. It also cuts a recurring SaaS subscription: Infisical is MIT-licensed, free to self-host, and a direct replacement for paid tools like Doppler ($6/dev/month) or the complexity of HashiCorp Vault. With a single VPS and a domain name, your entire team and every CI pipeline can pull secrets programmatically — no more .env files committed by accident.
What self-hosted Infisical gives you
- Centralised vault for every environment (dev, staging, prod) with per-environment access policies.
- Native SDKs for Node.js, Python, Go, Java, Ruby and more — inject secrets at runtime, not via .env files.
- GitHub Actions, GitLab CI, CircleCI and Jenkins integrations: secrets synced automatically to your pipelines.
- Role-based access control, service tokens and machine identities — no shared root credentials.
- Full audit log: every read, write and rotation is recorded with user, IP and timestamp.
- Secret rotation and versioning — roll back a secret in one click if a credential is compromised.
Requirements
A VPS with at least 2 vCPU and 4 GB RAM running Ubuntu 22.04 (PostgreSQL and Node.js are memory-hungry under concurrent requests). Docker and Docker Compose installed. A domain name pointed at your VPS — Infisical requires a public URL for OAuth redirects, email invite links and the browser security model (SITE_URL is not optional).
Deploy Infisical with Docker Compose
Generate secrets
Infisical needs two independent secrets: an ENCRYPTION_KEY (16-byte hex: openssl rand -hex 16) for encrypting vault data at rest, and an AUTH_SECRET (random string: openssl rand -base64 32) for signing JWT tokens. Store both in a .env file alongside your Compose file — never commit this file to version control.
Write the Compose file
The stack has three services: postgres:14-alpine (the secrets store), redis:alpine (background jobs and session cache) and infisical/infisical:latest (the app, port 8080). Set DB_CONNECTION_URI, REDIS_URL, SITE_URL (your domain, https://secrets.yourdomain.com) and the two secrets. Bring the stack up with docker compose up -d.
Configure a reverse proxy
Infisical requires HTTPS — without a valid TLS certificate the browser blocks OAuth flows. Point Caddy at port 8080: secrets.yourdomain.com { reverse_proxy localhost:8080 }. Caddy provisions a Let's Encrypt certificate automatically. Restart Caddy and verify https://secrets.yourdomain.com loads the signup page.
Create the first admin account
Open your domain in a browser and register the first user — this account automatically gets admin privileges. Then create your first project (a logical namespace for related secrets), add environments (dev, staging, prod) and invite your team members.
Integrate with your apps and CI
Install the Infisical CLI (npm install -g @infisical/cli) or an SDK in your project. Run infisical run -- node server.js to inject secrets at runtime — your app reads process.env.MY_SECRET as if from a local .env, but the value comes from the vault. For GitHub Actions, install the official Infisical action and add a service token as a repository secret.
Logging in for the first time
Open the /admin/signup address of your instance right away: it is the one-time wizard that creates the Super Admin account and then your organisation. The first person to reach that screen becomes the administrator of the instance.
Lock down your Infisical instance immediately after setup
Before inviting your team, disable the public sign-up page in Settings → Authentication → Allow signups. Infisical then only accepts users invited by an admin. Also enable email verification and, if your team uses GitHub or Google OAuth, configure those providers in Settings → SSO — they are more secure than password-only login.
