Deploy Infisical with the infisical-secrets template

Stand up Infisical, an open-source secrets-management platform, on a single Quake AI instance using the validated OpenTofu template infisical-secrets. You apply the template, point a domain at the host and serve it over HTTPS, set the public URL and start the app, sign up the first admin account, create a project and a secret, and pull it with the Infisical CLI.

Infisical keeps your team's secrets on infrastructure you own. You run it yourself; this is a self-hosted tool you operate, not a managed service.

Prerequisites#

You need:

• OpenTofu 1.6.0 or later (or Terraform 1.6.0 or later) installed locally.
• Your OpenStack credentials sourced into the shell (source openrc.sh). See the OpenStack CLI guide.
• An SSH keypair that already exists in your project. Record its name for the key_name variable.
• A copy of the infisical-secrets template directory from the template reference page.
• A domain you can point at the instance. Infisical needs a stable public URL for auth callbacks and CLI/SDK access.
• The Infisical CLI installed locally, to pull the secret you create in this walkthrough.

Step 1: Apply the template#

Copy the template's example variables file and set key_name:

cp terraform.tfvars.example terraform.tfvars

key_name = "YOUR_KEY_NAME"

Initialize, preview, and apply:

tofu init
tofu plan
tofu apply

OpenTofu provisions a private network, a router, a security group, a block volume mounted at /var/lib/docker, an instance, and a floating IP. On first boot, cloud-init installs Docker Engine, generates ENCRYPTION_KEY, AUTH_SECRET, and the database password into /opt/infisical/.env, and starts PostgreSQL and Redis. Infisical itself starts after you finish configuration in the next steps.

Read the outputs and record floating_ip and app_url:

tofu output

Step 2: Point a domain at the host and serve HTTPS with Caddy#

Infisical builds absolute links and auth callbacks from its public URL, so it needs a domain with TLS before you sign up your first account.

1. Create a DNS A record for your domain (for example secrets.example.com) pointing at YOUR_FLOATING_IP. Follow How to point a domain at a Quake AI resource. Wait until it resolves:

dig +short secrets.example.com

1. SSH to the instance and create /opt/infisical/Caddyfile:

secrets.example.com {
  reverse_proxy 127.0.0.1:8080
}

1. Add Caddy to /opt/infisical/docker-compose.yml:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/infisical/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
volumes:
  caddy_data:

For background on certificates, see How to issue and auto-renew a TLS certificate with Let's Encrypt.

Step 3: Set SITE_URL and start Infisical#

Edit /opt/infisical/.env on the instance and set the public URL:

SITE_URL=https://secrets.example.com

Start the app:

cd /opt/infisical
sudo docker compose up -d
sudo docker compose ps

The infisical container joins the running PostgreSQL and Redis. Confirm it reports healthy.

Step 4: Sign up and create your first project#

1. Open https://secrets.example.com. Infisical has built-in email-and-password login, so you sign up directly: no external identity provider to configure first. The first account to sign up becomes the organization admin.
2. Create a project (for example payments-service). Infisical scaffolds dev, staging, and prod environments for the project.
3. Inside the dev environment, select Add secret, set the key to STRIPE_API_KEY, and give it a placeholder value. Infisical encrypts the value before it reaches PostgreSQL.

Step 5: Pull the secret with the Infisical CLI#

From your workstation, point the CLI at your self-hosted instance and authenticate:

export INFISICAL_DOMAIN="https://secrets.example.com"
infisical login

Initialize the project link in a local working directory, then list the secret you created:

infisical init
infisical secrets --env=dev

Run a local command with the secret injected as an environment variable, without ever writing it to a file:

infisical run --env=dev -- printenv STRIPE_API_KEY

Step 6: Invite a teammate#

1. Go to Organization Settings > Members > Invite member.
2. Enter a teammate's email. Infisical sends an invite they accept with their own email and password (or you configure SSO later, separately from the steps above).
3. Add them to the payments-service project with a role scoped to the environments they need.

What you built#

• Applied the infisical-secrets template to provision a network, security group, data volume, instance, and floating IP, with PostgreSQL and Redis started by cloud-init
• Served Infisical over HTTPS by pointing a domain at the floating IP and routing it through a Caddy reverse proxy
• Signed up the first admin account using Infisical's built-in login
• Created a project, an environment, and a secret, then pulled it with the Infisical CLI
• Backed up ENCRYPTION_KEY before storing any real secrets
• Invited a teammate

Scope of this deployment#

This template runs a single-VM Infisical host, not a managed secrets cloud. The instance is CPU-only and runs in one region, and it bundles PostgreSQL and Redis as containers on the same host. You operate the instance, Docker, Infisical, the database, Redis, and the data volume yourself: back them up (ENCRYPTION_KEY especially), patch them, and snapshot the volume before you resize or rebuild. For a larger team, move PostgreSQL and Redis onto their own instances and size the app host up.

Next steps#

• Infisical secrets-management template: the template reference, parameters, and resource map
• Self-managed PostgreSQL template: the database to point at when you outgrow the bundled one
• quake.yaml reference: Secrets: the manifest field this template's secrets feed
• How to store application secrets and inject them at runtime: the broader pattern this deployment specializes
• Security hardening checklist: tighten SSH access and exposure before you store real secrets

Clean up#

When you no longer need the deployment, destroy everything the template created:

tofu destroy

Then remove the DNS A record you created in step 2. Because Infisical, its database, and Redis all live on the instance and its attached volume, tofu destroy removes them along with the infrastructure. Export the secrets you want to keep first; the Infisical CLI's infisical export command writes a project's secrets to a local file in dotenv or YAML format.