[{"data":1,"prerenderedAt":119},["ShallowReactive",2],{"seo-verification":3,"blog-how-to-self-host-infisical-on-a-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":77,"ctaBody":78,"ctaButton":79,"ctaUrl":80,"relatedPosts":81},160,"how-to-self-host-infisical-on-a-vps",{"fr":10,"en":8,"ar":11},"self-host-infisical-vps","كيفية-استضافة-infisical-ذاتيا-على-خادم-vps","How to Self-Host Infisical on a VPS","Deploy Infisical on your VPS: an open-source secrets manager centralising API keys, env vars and certificates in a self-hosted vault, with SDK hooks and audit logs.",4,0,false,"2026-07-02T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-infisical-vps-poster.svg",{"categorySlug":30,"appSlug":31},"cybersecurity-bastion","infisical","Hardcoding secrets in .env files and rotating them manually across environments is a security incident waiting to happen. Infisical is an open-source secrets manager (MIT, 27.6k stars) that centralises every API key, database password and certificate in a single self-hosted vault — synced automatically to your apps, CI pipelines and team. Here is how to deploy it on a VPS in under 20 minutes.",[34,38,48,51,73],{"type":35,"title":36,"body":37},"h2","Why self-host your secrets manager","Storing secrets in a SaaS vault means your most sensitive credentials transit through a third-party server. Self-hosting Infisical keeps every secret on your own infrastructure, under your own access controls and audit logs. It also cuts a recurring SaaS subscription: Infisical is MIT-licensed, free to self-host, and a direct replacement for paid tools like Doppler ($6\u002Fdev\u002Fmonth) or the complexity of HashiCorp Vault. With a single VPS and a domain name, your entire team and every CI pipeline can pull secrets programmatically — no more .env files committed by accident.",{"type":39,"title":40,"items":41},"ul","What self-hosted Infisical gives you",[42,43,44,45,46,47],"Centralised vault for every environment (dev, staging, prod) with per-environment access policies.","Native SDKs for Node.js, Python, Go, Java, Ruby and more — inject secrets at runtime, not via .env files.","GitHub Actions, GitLab CI, CircleCI and Jenkins integrations: secrets synced automatically to your pipelines.","Role-based access control, service tokens and machine identities — no shared root credentials.","Full audit log: every read, write and rotation is recorded with user, IP and timestamp.","Secret rotation and versioning — roll back a secret in one click if a credential is compromised.",{"type":35,"title":49,"body":50},"Requirements","A VPS with at least 2 vCPU and 4 GB RAM running Ubuntu 22.04 (PostgreSQL and Node.js are memory-hungry under concurrent requests). Docker and Docker Compose installed. A domain name pointed at your VPS — Infisical requires a public URL for OAuth redirects, email invite links and the browser security model (SITE_URL is not optional).",{"type":52,"title":53,"steps":54},"steps","Deploy Infisical with Docker Compose",[55,58,61,64,67,70],{"title":56,"body":57},"Generate secrets","Infisical needs two independent secrets: an `ENCRYPTION_KEY` (16-byte hex: `openssl rand -hex 16`) for encrypting vault data at rest, and an `AUTH_SECRET` (random string: `openssl rand -base64 32`) for signing JWT tokens. Store both in a `.env` file alongside your Compose file — never commit this file to version control.",{"title":59,"body":60},"Write the Compose file","The stack has three services: `postgres:14-alpine` (the secrets store), `redis:alpine` (background jobs and session cache) and `infisical\u002Finfisical:latest` (the app, port 8080). Set `DB_CONNECTION_URI`, `REDIS_URL`, `SITE_URL` (your domain, `https:\u002F\u002Fsecrets.yourdomain.com`) and the two secrets. Bring the stack up with `docker compose up -d`.",{"title":62,"body":63},"Configure a reverse proxy","Infisical requires HTTPS — without a valid TLS certificate the browser blocks OAuth flows. Point Caddy at port 8080: `secrets.yourdomain.com { reverse_proxy localhost:8080 }`. Caddy provisions a Let's Encrypt certificate automatically. Restart Caddy and verify `https:\u002F\u002Fsecrets.yourdomain.com` loads the signup page.",{"title":65,"body":66},"Create the first admin account","Open your domain in a browser and register the first user — this account automatically gets admin privileges. Then create your first project (a logical namespace for related secrets), add environments (`dev`, `staging`, `prod`) and invite your team members.",{"title":68,"body":69},"Integrate with your apps and CI","Install the Infisical CLI (`npm install -g @infisical\u002Fcli`) or an SDK in your project. Run `infisical run -- node server.js` to inject secrets at runtime — your app reads `process.env.MY_SECRET` as if from a local .env, but the value comes from the vault. For GitHub Actions, install the official Infisical action and add a service token as a repository secret.",{"title":71,"body":72},"Logging in for the first time","Open the \u002Fadmin\u002Fsignup address of your instance right away: it is the one-time wizard that creates the Super Admin account and then your organisation. The first person to reach that screen becomes the administrator of the instance.",{"type":74,"title":75,"body":76},"tip","Lock down your Infisical instance immediately after setup","Before inviting your team, disable the public sign-up page in Settings → Authentication → Allow signups. Infisical then only accepts users invited by an admin. Also enable email verification and, if your team uses GitHub or Google OAuth, configure those providers in Settings → SSO — they are more secure than password-only login.","Deploy Infisical on your VPS in one click","Stop leaking secrets via .env files and Slack messages. ServOrbit provisions a ready-to-use Infisical instance on a VPS — PostgreSQL, Redis and HTTPS included.","Deploy Infisical","\u002Fvps-cloud?template=infisical",[82,103],{"id":83,"slug":84,"slugs":85,"title":88,"excerpt":89,"readTime":90,"views":15,"isPinned":16,"publishedAt":91,"category":92,"categories":98,"featuredImage":26,"bgImage":27,"posterImage":100,"relatedSolution":101},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":86,"en":84,"ar":87},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.",5,"2026-06-24T00:00:00+00:00",{"id":93,"name":94,"slug":95,"color":96,"icon":97},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[99],{"id":93,"name":94,"slug":95,"color":96,"icon":97},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":97,"appSlug":102},"vaultwarden",{"id":104,"slug":105,"slugs":106,"title":109,"excerpt":110,"readTime":14,"views":15,"isPinned":16,"publishedAt":111,"category":112,"categories":113,"featuredImage":26,"bgImage":27,"posterImage":115,"relatedSolution":116},74,"host-gitea-on-your-own-vps",{"fr":107,"en":105,"ar":108},"heberger-gitea","استضافة-gitea-على-خادم-vps-الخاص-بك","Host Gitea on your own VPS","Deploy Gitea on a VPS with Docker, reverse proxy and SSL. A lightweight, fast Git forge, 100% under your control.","2026-04-07T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[114],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fheberger-gitea-poster.svg",{"categorySlug":117,"appSlug":118},"development","gitea",1787581005793]