Infisical
gunkanmaki.infisical
A Docker Compose file for Infisical alone, generated from the catalog and checked by the safety inspector. No account needed.
Secrets and configuration platform with per-environment scoping, versioning, access control and injection into running processes, plus scanning for credentials committed to source control.
Infisical organises secrets into projects broken down by environment and path, so the same key resolves to a different value in development and production without the application knowing which it is running in. Values are versioned with an audit trail, access is granted per identity through role-based rules, and secrets reach workloads through an agent, a CLI wrapper or SDKs rather than being written into images. Beyond storage it covers dynamic credentials with rotation, certificate issuance and pre-commit scanning for leaked keys. A first deployment creates a project, populates one environment and injects those values into a process through the CLI.
You know it worked when
- The interface loads and an administrator account can sign in.
- A project with at least two environments holds distinct values for the same key.
- The CLI authenticates with a machine identity and retrieves those secrets.
- An application launched through the CLI receives them as environment variables.
- A changed secret is recorded as a new version with the previous value still visible.
Known sharp edges
- PostgreSQL, Redis and an encryption key must be supplied before first start, and losing the encryption key makes every stored secret permanently unrecoverable.
- The instance concentrates every secret in one place, so its own authentication and backup regime matter more than those of any service consuming it.
- Machine identities need explicit scoping; a token issued at project level can read every environment, production included.
- Values injected at process start are not refreshed, so rotation requires restarting the consuming service unless the agent is used.