### Install and Start Gateway (Token Auth, Linux Production) Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment Use this command to install and start an Infisical Gateway on Linux using token authentication for production environments. Ensure the Infisical CLI is installed and the systemd service is started. ```bash sudo infisical gateway systemd install \ --enroll-method=token \ --token= \ --domain= sudo systemctl start ``` -------------------------------- ### Install and Start KMIP Server (Token Auth, Linux Production) Source: https://infisical.com/docs/documentation/platform/kms/kmip Installs the Infisical KMIP server as a systemd service and starts it using token-based authentication. Ensure you have root/sudo privileges. ```bash sudo infisical kmip systemd install \ --enroll-method=token \ --token= \ --listen-address="0.0.0.0:5696" \ --domain= sudo systemctl start infisical-kmip ``` -------------------------------- ### Install and Start KMIP Server (AWS Auth, Linux Production) Source: https://infisical.com/docs/documentation/platform/kms/kmip Installs the Infisical KMIP server as a systemd service and starts it using AWS authentication. The host must have valid AWS credentials configured. ```bash sudo infisical kmip systemd install \ --enroll-method=aws \ --kmip-server-id= \ --listen-address="0.0.0.0:5696" \ --domain= sudo systemctl start infisical-kmip ``` -------------------------------- ### Install and Start Relay (Token Auth - Linux Production) Source: https://infisical.com/docs/documentation/platform/gateways/relay-deployment/overview Installs the Infisical Relay as a systemd service and starts it using token-based authentication. Ensure you have root/sudo privileges. The enrollment token expires after 1 hour. ```bash sudo infisical relay systemd install \ --name= \ --enroll-method=token \ --token= \ --domain= sudo systemctl start infisical-relay ``` -------------------------------- ### Install and Start Relay with AWS Authentication (Linux Production) Source: https://infisical.com/docs/documentation/platform/gateways/relay-deployment Use this command to install the Infisical Relay as a systemd service and start it using AWS authentication on Linux production environments. The host must have AWS credentials configured, and the relay-id must be provided. ```bash sudo infisical relay systemd install \ --name= \ --enroll-method=aws \ --relay-id= \ --domain= sudo systemctl start infisical-relay ``` ```bash infisical relay start \ --name= \ --enroll-method=aws \ --relay-id= \ --domain= ``` -------------------------------- ### Install and Start Relay with Token Authentication (Linux Production) Source: https://infisical.com/docs/documentation/platform/gateways/relay-deployment Use this command to install the Infisical Relay as a systemd service and start it using token-based authentication on Linux production environments. Ensure you have a valid enrollment token and your Infisical domain. ```bash sudo infisical relay systemd install \ --name= \ --enroll-method=token \ --token= \ --domain= sudo systemctl start infisical-relay ``` ```bash infisical relay start \ --name= \ --enroll-method=token \ --token= \ --domain= ``` -------------------------------- ### Install and Start Relay (AWS Auth - Linux Production) Source: https://infisical.com/docs/documentation/platform/gateways/relay-deployment/overview Installs the Infisical Relay as a systemd service and starts it using AWS authentication. The host must have AWS credentials configured, and the principal must match the allowlist in Infisical. ```bash sudo infisical relay systemd install \ --name= \ --enroll-method=aws \ --relay-id= \ --domain= sudo systemctl start infisical-relay ``` -------------------------------- ### Install Dependencies Source: https://infisical.com/docs/documentation/guides/node Install the express framework and the Infisical Node.js SDK. ```console npm install express @infisical/sdk ``` -------------------------------- ### Start GCP Service Account Session Source: https://infisical.com/docs/documentation/platform/pam/accounts/gcp-service-account Use this command to initiate a session with a GCP service account. Ensure the `gcloud` CLI is installed locally. ```bash infisical pam access my-folder/prod-deployer ``` -------------------------------- ### Setup Delegated Rotation User for MySQL Source: https://infisical.com/docs/documentation/platform/pam/product-reference/credential-rotation/mysql Example SQL commands to create a dedicated user for Infisical to perform password rotations and grant necessary privileges. Also shows how to create the application user whose password will be rotated. ```sql -- the user Infisical connects as to perform rotations CREATE USER 'infisical_rotator'@'%' IDENTIFIED BY 'temporary_password'; GRANT CREATE USER ON *.* TO 'infisical_rotator'@'%'; -- the account whose password gets rotated CREATE USER 'app_user'@'%' IDENTIFIED BY 'temporary_password'; ``` -------------------------------- ### Install Infisical Gateway via Systemd on Linux Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment Installs and starts the Infisical Gateway as a systemd service on Linux. Requires root/sudo privileges and uses AWS credentials for enrollment. ```bash sudo infisical gateway systemd install \ --enroll-method=aws \ --gateway-id= \ --domain= sudo systemctl start ``` -------------------------------- ### Example ClickHouse URL Configuration Source: https://infisical.com/docs/documentation/platform/audit-logs-clickhouse-setup An example of how to set the CLICKHOUSE_URL environment variable with specific credentials and host information. ```bash CLICKHOUSE_URL=http://infisical:mypassword@clickhouse.internal:8123/audit_logs ``` -------------------------------- ### Start Gateway (Token Auth, Foreground) Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment Run this command to start an Infisical Gateway in the foreground using token authentication. This is useful for testing or development environments. ```bash infisical gateway start \ --enroll-method=token \ --token= \ --domain= ``` -------------------------------- ### Start Agent Proxy with Live Logs Source: https://infisical.com/docs/documentation/platform/agent-proxy/activity-logs Starts the agent proxy with default live, readable logs. Use this for real-time monitoring. ```bash infisical secrets agent-proxy start ``` -------------------------------- ### Start KMIP Server (Token Auth, Foreground) Source: https://infisical.com/docs/documentation/platform/kms/kmip Starts the Infisical KMIP server in the foreground using token-based authentication. This is suitable for testing or non-production environments. ```bash infisical kmip start \ --enroll-method=token \ --token= \ --listen-address="0.0.0.0:5696" \ --domain= ``` -------------------------------- ### Automated SSH CA Setup Command Source: https://infisical.com/docs/documentation/platform/dynamic-secrets/ssh Run this command on target hosts for automated setup of Infisical's SSH CA. It installs the CA certificate, configures sshd, and restarts the SSH service. ```bash curl -H "Authorization: Bearer " "https:///api/v1/dynamic-secrets/ssh-ca-setup/" | sudo bash ``` -------------------------------- ### Example RDP Client Connection Source: https://infisical.com/docs/documentation/platform/pam/accounts/windows-ad After starting the Infisical CLI proxy, connect your RDP client to localhost on the dynamically assigned or specified port. ```bash # Example using xfreerdp xfreerdp /v:localhost:53306 ``` -------------------------------- ### Create Virtual Environment and Activate Source: https://infisical.com/docs/documentation/guides/python Set up a virtual environment for your Python project and activate it. ```console python3 -m venv env source env/bin/activate ``` -------------------------------- ### Initialize Node.js Project Source: https://infisical.com/docs/documentation/guides/node Initialize a new Node.js project with a default package.json file. ```console npm init -y ``` -------------------------------- ### Setup Delegated PostgreSQL Rotation Role Source: https://infisical.com/docs/documentation/platform/pam/product-reference/credential-rotation/postgresql Example SQL to create a dedicated role for Infisical to use for rotating other PostgreSQL accounts. This role requires the CREATEROLE privilege to alter other roles. ```sql -- the role Infisical connects as to perform rotations CREATE ROLE infisical_rotator WITH LOGIN PASSWORD 'temporary_password' CREATEROLE; -- the account whose password gets rotated CREATE ROLE app_user WITH LOGIN PASSWORD 'temporary_password'; ``` -------------------------------- ### Verify Certificate Installation Directory Source: https://infisical.com/docs/documentation/platform/pki/guides/applications/apache-certbot Check the contents of the Let's Encrypt live directory to confirm that the certificate files (cert.pem, chain.pem, fullchain.pem, privkey.pem) have been created. ```bash sudo ls -la /etc/letsencrypt/live/example.infisical.com/ ``` -------------------------------- ### Start Infisical PAM Access Session for Azure Source: https://infisical.com/docs/documentation/platform/pam/accounts/azure-cli Initiates an isolated, authenticated shell session for Azure CLI access. This command requires the Azure CLI to be installed locally and does not interfere with your existing `az` login. ```bash infisical pam access my-folder/prod-reader ``` -------------------------------- ### Start Infisical Gateway with Fortanix PKCS#11 Module (Foreground) Source: https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors-fortanix-dsm Start the Infisical Gateway in the foreground, attaching the Fortanix PKCS#11 module. This is useful for testing or development environments. ```bash infisical gateway start \ --enroll-method=token \ --token= \ --domain= \ --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so ``` -------------------------------- ### Setup Delegated SQL Server Rotation Login Source: https://infisical.com/docs/documentation/platform/pam/product-reference/credential-rotation/mssql Example SQL script to create a dedicated login for Infisical PAM to use for rotating other SQL Server logins. It grants the necessary 'ALTER ANY LOGIN' permission and creates a sample application login whose password will be rotated. ```sql -- the login Infisical connects as to perform rotations CREATE LOGIN infisical_rotator WITH PASSWORD = 'temporary_password'; GRANT ALTER ANY LOGIN TO infisical_rotator; -- the account whose password gets rotated CREATE LOGIN app_login WITH PASSWORD = 'temporary_password'; ``` -------------------------------- ### Install Infisical CLI on Alpine Linux Source: https://infisical.com/docs/documentation/guides/nextjs-vercel Install the Infisical CLI on Alpine Linux. This involves installing prerequisites, adding the Infisical repository, and then installing the CLI. ```bash $ apk add --no-cache bash sudo wget ``` ```bash $ wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh ``` ```bash $ apk update && sudo apk add infisical ``` -------------------------------- ### PyKMIP Client Configuration Example Source: https://infisical.com/docs/documentation/platform/kms/kmip This configuration is for the PyKMIP client. Ensure the paths to your certificate files are correct. ```ini [client] host=my-kmip-server.com port=5696 certfile=/path/to/client-cert.pem keyfile=/path/to/client-key.pem ca_certs=/path/to/cert-chain.pem ``` -------------------------------- ### Install Cosign with PKCS#11 Support Source: https://infisical.com/docs/documentation/platform/pki/guides/code-signing/cosign Install cosign from source with the `pkcs11key` build tag enabled to ensure PKCS#11 support. This is recommended over pre-built binaries. ```bash CGO_ENABLED=1 go install -tags pkcs11key github.com/sigstore/cosign/v2/cmd/cosign@latest ``` -------------------------------- ### Install Infisical Operator with Helm Source: https://infisical.com/docs/documentation/guides/kubernetes-operator Installs the Infisical Operator and its associated CRDs into your Kubernetes cluster using Helm. Ensure you have Helm installed and configured. ```bash helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' helm repo update helm install infisical-operator infisical-helm-charts/secrets-operator ``` -------------------------------- ### Install Infisical CLI on Debian/Ubuntu Source: https://infisical.com/docs/documentation/guides/nextjs-vercel Install the Infisical CLI on Debian-based systems. This involves adding the Infisical repository using curl and then installing the CLI with apt-get. ```bash curl -1sLf \ 'https://artifacts-cli.infisical.com/setup.deb.sh' \ | sudo -E bash ``` ```bash $ sudo apt-get update && sudo apt-get install -y infisical ``` -------------------------------- ### Install Infisical CLI on Windows Source: https://infisical.com/docs/documentation/guides/nextjs-vercel Use the Scoop package manager to install the Infisical CLI on Windows. First, add the Infisical repository, then install the CLI. ```bash $ scoop bucket add org https://github.com/Infisical/scoop-infisical.git ``` ```bash $ scoop install infisical ``` -------------------------------- ### Install Infisical CLI on RedHat/CentOs/Amazon Linux Source: https://infisical.com/docs/documentation/guides/nextjs-vercel Install the Infisical CLI on RedHat-based systems. This involves adding the Infisical repository using curl and then installing the CLI with yum. ```bash curl -1sLf \ 'https://artifacts-cli.infisical.com/setup.rpm.sh' \ | sudo -E bash ``` ```bash $ sudo yum install infisical ``` -------------------------------- ### Connect Agent to Proxy Source: https://infisical.com/docs/documentation/platform/agent-proxy/quickstart Authenticate with the agent identity and launch the agent through the connect wrapper. Everything after -- is the agent's own start command. Ensure to replace placeholders like , , and environment/path details. ```bash export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= ``` ```bash infisical secrets agent-proxy connect --proxy=:17322 \ --projectId= --env=prod --path=/ai-agents -- claude ``` ```bash infisical secrets agent-proxy connect --proxy=:17322 \ --projectId= --env=prod --path=/ai-agents -- codex ``` -------------------------------- ### Verify Certbot Installation Source: https://infisical.com/docs/documentation/platform/pki/guides/applications/apache-certbot Check if Certbot has been installed correctly on your server. ```bash certbot --version ``` -------------------------------- ### Start KMIP Server (AWS Auth, Foreground) Source: https://infisical.com/docs/documentation/platform/kms/kmip Starts the Infisical KMIP server in the foreground using AWS authentication. The host must have valid AWS credentials configured. ```bash infisical kmip start \ --enroll-method=aws \ --kmip-server-id= \ --listen-address="0.0.0.0:5696" \ --domain= ```