[{"data":1,"prerenderedAt":175},["ShallowReactive",2],{"seo-verification":3,"blog-how-to-self-host-infisical-on-a-vps-ma-en":6,"promo-bar-likely":174},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-how-to-self-host-infisical-on-a-vps-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":126,"ctaBody":127,"ctaButton":128,"ctaUrl":129,"relatedPosts":130},160,"how-to-self-host-infisical-on-a-vps",{"fr":12,"en":10,"ar":13,"es":14},"self-host-infisical-vps","كيفية-استضافة-infisical-ذاتيا-على-خادم-vps","como-autoalojar-infisical-en-un-vps","How to Self-Host Infisical on a VPS","Deploy Infisical on your VPS in under 20 min: RBAC, automatic rotation, GitHub Actions and GitLab CI integration, plus Redis and TLS troubleshooting.",9,1,false,"2026-07-02T00:00:00+00:00","2026-10-16T01:57:38+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-infisical-vps-poster.svg",{"categorySlug":34,"appSlug":35},"cybersecurity-bastion","infisical","Hardcoding secrets in .env files and rotating them manually across environments is a security incident waiting to happen. Infisical is an open-source secrets manager (MIT licence, 27,600 GitHub stars as of October 2026) that centralises every API key, database password and certificate in a single self-hosted vault — synced automatically to your apps, CI pipelines and team. Here is how to deploy it on a VPS in under 20 minutes, complete with RBAC, automatic rotation and CI\u002FCD integrations.",[38,42,52,85,88,110,113,116,119,122],{"type":39,"title":40,"body":41},"h2","Why self-host your secrets manager","Storing secrets in a SaaS vault means your most sensitive credentials transit through a third-party server. Self-hosting Infisical keeps every secret on your own infrastructure, under your own access controls and audit logs. It also cuts a recurring SaaS subscription: Infisical is MIT-licensed, free to self-host, and a direct replacement for paid tools like Doppler ($6\u002Fdev\u002Fmonth) or the complexity of HashiCorp Vault. With a single VPS and a domain name, your entire team and every CI pipeline can pull secrets programmatically — no more .env files committed by accident.",{"type":43,"title":44,"items":45},"ul","What self-hosted Infisical gives you",[46,47,48,49,50,51],"Centralised vault for every environment (dev, staging, prod) with per-environment access policies.","Native SDKs for Node.js, Python, Go, Java, Ruby and more — inject secrets at runtime, not via .env files.","GitHub Actions, GitLab CI, CircleCI and Jenkins integrations: secrets synced automatically to your pipelines.","Role-based access control, service tokens and machine identities — no shared root credentials.","Full audit log: every read, write and rotation is recorded with user, IP and timestamp.","Secret rotation and versioning — roll back a secret in one click if a credential is compromised.",{"type":53,"title":54,"headers":55,"rows":61},"comparison","Infisical vs Vault vs Doppler vs Bitwarden Secrets",[56,57,58,59,60],"Tool","Model","Self-hosted","Indicative price","Standout feature",[62,68,74,80],[63,64,65,66,67],"**Infisical**","Open source (MIT)","Yes — Docker Compose, 4 GB RAM","Free (self-hosted)","Native RBAC, auto-rotation, multi-language SDKs",[69,70,71,72,73],"HashiCorp Vault","BSL (source available)","Yes — complex to operate","Free (community)","Advanced secret engines, PKI, transit encryption",[75,76,77,78,79],"Doppler","Proprietary SaaS","No","$6\u002Fdev\u002Fmonth","Polished UX, CI\u002FCD sync without a server",[81,82,83,66,84],"Bitwarden Secrets","Open source (AGPL)","Yes — Bitwarden server","Integrated with the Bitwarden password vault",{"type":39,"title":86,"body":87},"Requirements","A VPS with at least **2 vCPU and 4 GB RAM** running Ubuntu 22.04 — PostgreSQL and Node.js are memory-hungry under concurrent requests; below 4 GB, Infisical restarts under load. At least 20 GB of disk for long-term audit logs. Docker and Docker Compose installed (`docker compose version` should return v2.x). A domain name pointed at your VPS — Infisical requires a public URL for OAuth redirects, email invite links and the browser security model (`SITE_URL` is not optional). A DNS A or CNAME record already propagated before starting Caddy or nginx for Let's Encrypt certificate issuance.",{"type":89,"title":90,"steps":91},"steps","Deploy Infisical with Docker Compose",[92,95,98,101,104,107],{"title":93,"body":94},"Generate secrets","Infisical needs two independent secrets: an `ENCRYPTION_KEY` (16-byte hex: `openssl rand -hex 16`) for encrypting vault data at rest, and an `AUTH_SECRET` (random string: `openssl rand -base64 32`) for signing JWT tokens. Store both in a `.env` file alongside your Compose file — never commit this file to version control.",{"title":96,"body":97},"Write the Compose file","The stack has three services: `postgres:14-alpine` (the secrets store), `redis:alpine` (background jobs and session cache) and `infisical\u002Finfisical:latest` (the app, port 8080). Set `DB_CONNECTION_URI`, `REDIS_URL`, `SITE_URL` (your domain, `https:\u002F\u002Fsecrets.yourdomain.com`) and the two secrets. Bring the stack up with `docker compose up -d`.\n\nTo pin a stable release instead of `latest`, check the GitHub releases page and use `infisical\u002Finfisical:v0.91.1` (current version as of October 2026).",{"title":99,"body":100},"Configure the reverse proxy with nginx or Caddy","Infisical requires HTTPS — without a valid TLS certificate the browser blocks OAuth flows.\n\n**Caddy (recommended):** create `\u002Fetc\u002Fcaddy\u002FCaddyfile` with `secrets.yourdomain.com { reverse_proxy localhost:8080 }`. Caddy provisions a Let's Encrypt certificate automatically. Reload with `systemctl reload caddy`.\n\n**nginx:** create a vhost with `proxy_pass http:\u002F\u002F127.0.0.1:8080;`, then issue the certificate via Certbot (`certbot --nginx -d secrets.yourdomain.com`). Add `proxy_set_header Host $host;` and `proxy_set_header X-Real-IP $remote_addr;` so audit logs record the real client IP, not `127.0.0.1`.",{"title":102,"body":103},"Create the first admin account","Open your domain in a browser and go to `\u002Fadmin\u002Fsignup` — this is the one-time wizard that creates the Super Admin account and your organisation. The first person to reach that screen becomes the instance administrator. Then create your first project (a logical namespace for related secrets), add environments (`dev`, `staging`, `prod`) and invite your team members.",{"title":105,"body":106},"Integrate with your apps and CI","Install the Infisical CLI (`npm install -g @infisical\u002Fcli`) or an SDK in your project. Run `infisical run -- node server.js` to inject secrets at runtime — your app reads `process.env.MY_SECRET` as if from a local .env, but the value comes from the vault. For GitHub Actions, install the official Infisical action and add a service token as a repository secret.",{"title":108,"body":109},"Logging in for the first time","Open the `\u002Fadmin\u002Fsignup` address of your instance right away: it is the one-time wizard that creates the Super Admin account and then your organisation. The first person to reach that screen becomes the administrator of the instance.",{"type":39,"title":111,"body":112},"Advanced configuration: RBAC, secret policies and automatic rotation","Once the instance is running, three advanced features strengthen operational security.\n\n**RBAC (role-based access control):** Infisical has four built-in roles — `owner`, `admin`, `developer`, `viewer`. Assign `viewer` to CI pipelines that only need to read, `developer` to developers and `admin` to project leads. Machine Identities let you bind a role directly to an application without a long-lived service token: they authenticate via AWS IAM, Azure AD or a Kubernetes token.\n\n**Secret policies:** in Settings → Project → Secret Protection, enable change approvals before a production secret can be overwritten. A second admin must validate each change — useful for SOC 2 or ISO 27001 compliance.\n\n**Automatic rotation:** Infisical ships native rotation templates for PostgreSQL, MySQL, AWS IAM and GitHub. In the Rotation tab of your project, create a rotation job with the desired frequency (e.g. every 30 days for a database password). Infisical generates the new value, pushes it to the vault and notifies applications via webhook — no manual intervention required.",{"type":39,"title":114,"body":115},"CI\u002FCD integration: GitHub Actions, GitLab CI, Docker Compose","**GitHub Actions:** add the official action to your workflow and pass a service token as a repository secret (`INFISICAL_TOKEN`). Secrets are injected as environment variables before each job.\n\n```yaml\n- uses: Infisical\u002Fsecrets-action@v1\n  with:\n    token: ${{ secrets.INFISICAL_TOKEN }}\n    project-id: \"\u003Cyour-project-id>\"\n    environment: \"prod\"\n```\n\n**GitLab CI:** use the Infisical CLI in a `before_script`. Add `INFISICAL_TOKEN` in the repository CI\u002FCD variables.\n\n```yaml\nbefore_script:\n  - infisical run --env prod -- env | grep MY_SECRET\n```\n\n**Docker Compose (runtime):** the Infisical CLI can generate a `.env` file on the fly before launching Compose, or inject directly via `infisical run -- docker compose up -d`. Avoid storing a generated `.env` inside an image — prefer runtime injection to never serialise a secret in a Docker layer.",{"type":39,"title":117,"body":118},"Troubleshooting: common errors","**`Error: connect ECONNREFUSED 127.0.0.1:6379` (Redis)** — Redis is not started or the `infisical` service starts before Redis is ready. Add `depends_on: redis` in your `docker-compose.yml` and check that the Redis container is `healthy` with `docker compose ps`. If Redis is running but the error persists, confirm that `REDIS_URL` is set to `redis:\u002F\u002Fredis:6379` (the Compose service name, not `localhost`).\n\n**`Error: unable to verify the first certificate` (TLS)** — the Let's Encrypt certificate has not been issued yet (DNS propagation incomplete) or Caddy\u002Fnginx cannot reach the ACME challenge endpoint. Verify that port 80 is open in your firewall (`ufw allow 80`) — Caddy needs it for the HTTP-01 challenge on initial issuance. Then switch to a DNS-01 challenge if the IP is behind NAT.\n\n**`docker compose up` fails with `Bind for 0.0.0.0:8080 failed: port is already allocated`** — another process is listening on port 8080. Change the port mapping in Compose (`8081:8080`) and update the reverse proxy config accordingly.\n\n**`\u002Fadmin\u002Fsignup` page inaccessible after first login** — this is by design: the wizard only appears once. If you need to replay it (test instance), drop the `Organization` table and restart Infisical.\n\n**Secrets not injected in GitHub Actions** — check that the `environment` passed to the action matches exactly the environment name created in Infisical (case-sensitive: `prod` ≠ `Prod`).",{"type":39,"title":120,"body":121},"Backups and updates","**PostgreSQL backups:** encrypted secrets live in PostgreSQL. Schedule a daily `pg_dump` with `docker exec infisical_postgres pg_dump -U infisical infisical > backup-$(date +%Y%m%d).sql`. Encrypt the backup before transferring it off-site — it contains secrets encrypted at rest, but a database leak combined with an `ENCRYPTION_KEY` leak exposes the entire vault.\n\n**Upgrading Infisical:** the `infisical\u002Finfisical:latest` image updates with each new tag. For a controlled upgrade, pin the version (`v0.91.1`), review the GitHub changelog before each update (some versions include database migrations), then follow this order:\n1. `docker compose pull` to download the new image.\n2. `docker compose up -d` — Docker Compose only recreates containers whose image changed.\n3. Verify the login page responds and logs show no migration errors.\n\n**Monitoring:** expose Infisical's `\u002Fhealthcheck` endpoint in your monitoring tool (Uptime Kuma, Gatus) to be alerted on outages. An inaccessible secrets vault blocks every deployment that depends on it.",{"type":123,"title":124,"body":125},"tip","Lock down your Infisical instance immediately after setup","Before inviting your team, disable the public sign-up page in Settings → Authentication → Allow signups. Infisical then only accepts users invited by an admin. Also enable email verification and, if your team uses GitHub or Google OAuth, configure those providers in Settings → SSO — they are more secure than password-only login.","Deploy Infisical on your VPS in one click","Stop leaking secrets via .env files and Slack messages. ServOrbit provisions a ready-to-use Infisical instance on a VPS — PostgreSQL, Redis and HTTPS included.","Deploy Infisical","\u002Fvps-cloud?template=infisical",[131,155],{"id":132,"slug":133,"slugs":134,"title":138,"excerpt":139,"readTime":140,"views":141,"isPinned":19,"noindex":19,"publishedAt":142,"updatedAt":143,"category":144,"categories":150,"featuredImage":30,"bgImage":31,"posterImage":152,"relatedSolution":153},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":135,"en":133,"ar":136,"es":137},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","desplegar-vaultwarden-en-un-vps","Deploy Vaultwarden on a VPS: self-hosted password manager","Self-host Vaultwarden on a VPS: password management, Bitwarden compatibility, team vaults and TOTP, at a fixed monthly cost and under 50 MB of RAM.",15,3,"2026-06-24T00:00:00+00:00","2026-11-04T16:30:25+00:00",{"id":145,"name":146,"slug":147,"color":148,"icon":149},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[151],{"id":145,"name":146,"slug":147,"color":148,"icon":149},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":149,"appSlug":154},"vaultwarden",{"id":156,"slug":157,"slugs":158,"title":162,"excerpt":163,"readTime":164,"views":18,"isPinned":19,"noindex":19,"publishedAt":165,"updatedAt":166,"category":167,"categories":168,"featuredImage":30,"bgImage":31,"posterImage":170,"relatedSolution":171},74,"host-gitea-on-your-own-vps",{"fr":159,"en":157,"ar":160,"es":161},"heberger-gitea","استضافة-gitea-على-خادم-vps-الخاص-بك","alojar-gitea-en-un-vps","Host Gitea on your own VPS in 2026","Deploy Gitea 1.25 on a VPS with Docker and SSL. Full guide: Gitea Actions CI\u002FCD, Gitea vs Forgejo v16 comparison, daily administration, SSH and HTTPS troubleshooting.",13,"2026-04-07T00:00:00+00:00","2026-11-08T16:32:50+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[169],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fheberger-gitea-poster.svg",{"categorySlug":172,"appSlug":173},"development","gitea",true,1794270430978]