How to Self-Host Infisical on a VPS

Storing secrets in a SaaS vault means your most sensitive credentials transit through a third-party server. Self-hosting Infisical keeps every secret on your own infrastructure, under your own access controls and audit logs. It also cuts a recurring SaaS subscription: Infisical is MIT-licensed, free to self-host, and a direct replacement for paid tools like Doppler ($6/dev/month) or the complexity of HashiCorp Vault. With a single VPS and a domain name, your entire team and every CI pipeline can pull secrets programmatically — no more .env files committed by accident.

A VPS with at least 2 vCPU and 4 GB RAM running Ubuntu 22.04 — PostgreSQL and Node.js are memory-hungry under concurrent requests; below 4 GB, Infisical restarts under load. At least 20 GB of disk for long-term audit logs. Docker and Docker Compose installed (docker compose version should return v2.x). A domain name pointed at your VPS — Infisical requires a public URL for OAuth redirects, email invite links and the browser security model (SITE_URL is not optional). A DNS A or CNAME record already propagated before starting Caddy or nginx for Let's Encrypt certificate issuance.

Once the instance is running, three advanced features strengthen operational security.

RBAC (role-based access control): Infisical has four built-in roles — owner, admin, developer, viewer. Assign viewer to CI pipelines that only need to read, developer to developers and admin to project leads. Machine Identities let you bind a role directly to an application without a long-lived service token: they authenticate via AWS IAM, Azure AD or a Kubernetes token.

Secret policies: in Settings → Project → Secret Protection, enable change approvals before a production secret can be overwritten. A second admin must validate each change — useful for SOC 2 or ISO 27001 compliance.

Automatic rotation: Infisical ships native rotation templates for PostgreSQL, MySQL, AWS IAM and GitHub. In the Rotation tab of your project, create a rotation job with the desired frequency (e.g. every 30 days for a database password). Infisical generates the new value, pushes it to the vault and notifies applications via webhook — no manual intervention required.

GitHub Actions: add the official action to your workflow and pass a service token as a repository secret (INFISICAL_TOKEN). Secrets are injected as environment variables before each job.

- uses: Infisical/secrets-action@v1
  with:
    token: ${{ secrets.INFISICAL_TOKEN }}
    project-id: "<your-project-id>"
    environment: "prod"

GitLab CI: use the Infisical CLI in a before_script. Add INFISICAL_TOKEN in the repository CI/CD variables.

before_script:
  - infisical run --env prod -- env | grep MY_SECRET

Docker Compose (runtime): the Infisical CLI can generate a .env file on the fly before launching Compose, or inject directly via infisical run -- docker compose up -d. Avoid storing a generated .env inside an image — prefer runtime injection to never serialise a secret in a Docker layer.

Error: connect ECONNREFUSED 127.0.0.1:6379 (Redis) — Redis is not started or the infisical service starts before Redis is ready. Add depends_on: redis in your docker-compose.yml and check that the Redis container is healthy with docker compose ps. If Redis is running but the error persists, confirm that REDIS_URL is set to redis://redis:6379 (the Compose service name, not localhost).

Error: unable to verify the first certificate (TLS) — the Let's Encrypt certificate has not been issued yet (DNS propagation incomplete) or Caddy/nginx cannot reach the ACME challenge endpoint. Verify that port 80 is open in your firewall (ufw allow 80) — Caddy needs it for the HTTP-01 challenge on initial issuance. Then switch to a DNS-01 challenge if the IP is behind NAT.

docker compose up fails with Bind for 0.0.0.0:8080 failed: port is already allocated — another process is listening on port 8080. Change the port mapping in Compose (8081:8080) and update the reverse proxy config accordingly.

/admin/signup page inaccessible after first login — this is by design: the wizard only appears once. If you need to replay it (test instance), drop the Organization table and restart Infisical.

Secrets not injected in GitHub Actions — check that the environment passed to the action matches exactly the environment name created in Infisical (case-sensitive: prod ≠ Prod).

PostgreSQL backups: encrypted secrets live in PostgreSQL. Schedule a daily pg_dump with docker exec infisical_postgres pg_dump -U infisical infisical > backup-$(date +%Y%m%d).sql. Encrypt the backup before transferring it off-site — it contains secrets encrypted at rest, but a database leak combined with an ENCRYPTION_KEY leak exposes the entire vault.

Upgrading Infisical: the infisical/infisical:latest image updates with each new tag. For a controlled upgrade, pin the version (v0.91.1), review the GitHub changelog before each update (some versions include database migrations), then follow this order:
1. docker compose pull to download the new image.
2. docker compose up -d — Docker Compose only recreates containers whose image changed.
3. Verify the login page responds and logs show no migration errors.

Monitoring: expose Infisical's /healthcheck endpoint in your monitoring tool (Uptime Kuma, Gatus) to be alerted on outages. An inaccessible secrets vault blocks every deployment that depends on it.