# yaml-language-server: $schema=https://schema.zeabur.app/template.json apiVersion: zeabur.com/v1 kind: Template metadata: name: Infisical spec: description: Open-source secrets, PKI, SSH, and machine identity platform for teams and infrastructure. icon: https://api.ray.so/favicon?url=infisical.com&size=32 variables: - key: PUBLIC_DOMAIN type: DOMAIN name: Domain description: The domain to bind to your Infisical instance. tags: - Security - Secrets Management - DevOps - Infrastructure readme: |- # Infisical This template deploys a self-hosted **Infisical** stack on Zeabur with: - Infisical API + Web service - PostgreSQL (persistent) - Redis (persistent) ## What is Infisical? Infisical is the open source, all-in-one platform for secrets, certificates, and privileged access management. It provides modern security workflows, including secrets rotation, dynamic credentials, access approvals, and SSH certificate-based access, all within one platform designed for developers, infrastructure, and security teams. It can be used for: - Secrets Management - Secret Scanning - PKI / Certificates - SSH Secrets - KMS Encryption - Machine Identity / SPIFFE Official docs: https://infisical.com/docs/documentation/getting-started/overview services: - name: postgresql icon: https://raw.githubusercontent.com/zeabur/service-icons/main/marketplace/postgresql.svg template: PREBUILT spec: id: postgresql source: image: postgres:16 command: - docker-entrypoint.sh - -c - config_file=/etc/postgresql/postgresql.conf ports: - id: database port: 5432 type: TCP volumes: - id: data dir: /var/lib/postgresql/data env: PGDATA: default: /var/lib/postgresql/data/pgdata POSTGRES_CONNECTION_STRING: default: postgres://${POSTGRES_USERNAME}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE} expose: true POSTGRES_CONNECTION_URI: default: ${POSTGRES_CONNECTION_STRING} expose: true POSTGRES_DATABASE: default: ${POSTGRES_DB} expose: true POSTGRES_DB: default: infisical POSTGRES_HOST: default: ${CONTAINER_HOSTNAME} expose: true POSTGRES_PASSWORD: default: ${PASSWORD} expose: true POSTGRES_PORT: default: "5432" expose: true POSTGRES_URI: default: ${POSTGRES_CONNECTION_STRING} expose: true POSTGRES_USER: default: infisical POSTGRES_USERNAME: default: ${POSTGRES_USER} expose: true configs: - path: /etc/postgresql/postgresql.conf template: | listen_addresses = '*' max_connections = 100 shared_buffers = 128MB dynamic_shared_memory_type = posix max_wal_size = 1GB min_wal_size = 80MB log_timezone = 'Etc/UTC' datestyle = 'iso, mdy' timezone = 'Etc/UTC' lc_messages = 'en_US.utf8' lc_monetary = 'en_US.utf8' lc_numeric = 'en_US.utf8' lc_time = 'en_US.utf8' default_text_search_config = 'pg_catalog.english' permission: null envsubst: null healthCheck: type: TCP port: database - name: redis icon: https://raw.githubusercontent.com/zeabur/service-icons/main/marketplace/redis.svg template: PREBUILT spec: id: redis source: image: redis:7-alpine command: - /bin/sh args: - -c - redis-server --appendonly yes --requirepass "$REDIS_PASSWORD" ports: - id: database port: 6379 type: TCP volumes: - id: data dir: /data env: REDIS_ARGS: default: --requirepass ${REDIS_PASSWORD} REDIS_CONNECTION_URI: default: redis://:${REDIS_PASSWORD}@${REDIS_HOST}:${REDIS_PORT} expose: true REDIS_HOST: default: ${CONTAINER_HOSTNAME} expose: true REDIS_PASSWORD: default: ${PASSWORD} expose: true REDIS_PORT: default: ${DATABASE_PORT} expose: true healthCheck: type: TCP port: database - name: infisical icon: https://api.ray.so/favicon?url=infisical.com&size=32 dependencies: - postgresql - redis template: PREBUILT spec: id: infisical source: image: infisical/infisical:latest ports: - id: web port: 8080 type: HTTP env: AUTH_SECRET: default: ${PASSWORD} DB_CONNECTION_URI: default: ${POSTGRES_CONNECTION_URI} ENCRYPTION_KEY: default: ${PASSWORD} HOST: default: 0.0.0.0 NODE_ENV: default: production PORT: default: "8080" REDIS_URL: default: ${REDIS_CONNECTION_URI} SITE_URL: default: https://${PUBLIC_DOMAIN}.zeabur.app domainKey: PUBLIC_DOMAIN localization: en-US: description: Open-source platform for secrets, machine identity, PKI, and security workflows. variables: - key: PUBLIC_DOMAIN type: DOMAIN name: Domain description: The domain to bind to your Infisical instance. readme: |- # Infisical Deploy a self-hosted Infisical stack on Zeabur with Infisical, PostgreSQL, and Redis. ## What is Infisical? Infisical is the open source, all-in-one platform for secrets, certificates, and privileged access management. It provides modern security workflows, including secrets rotation, dynamic credentials, access approvals, and SSH certificate-based access, all within one platform designed for developers, infrastructure, and security teams. Official docs: https://infisical.com/docs/documentation/getting-started/overview zh-CN: description: 开源的机密管理与机器身份平台，支持 Secrets、PKI、SSH 与基础设施安全流程。 variables: - key: PUBLIC_DOMAIN type: DOMAIN name: 域名 description: 要绑定到 Infisical 的域名。 readme: |- # Infisical 本模板会在 Zeabur 部署一套自托管 Infisical。 ## 什么是 Infisical？ Infisical 是一个开源的一体化平台，提供 secrets、证书与特权访问管理能力。 它将现代化的安全工作流整合在同一平台中，包含 secrets 轮换、动态凭证、访问审批，以及基于 SSH 证书的访问方式，并为开发、基础设施与安全团队而设计。 官方文档：https://infisical.com/docs/documentation/getting-started/overview zh-TW: description: 開源的機密管理與機器身分平台，支援 Secrets、PKI、SSH 與基礎設施安全流程。 variables: - key: PUBLIC_DOMAIN type: DOMAIN name: 網域 description: 要綁定到 Infisical 的網域。 readme: |- # Infisical 這個模板會在 Zeabur 部署一套自架版 Infisical。 ## 什麼是 Infisical？ Infisical 是一個開源的一體化平台，提供 secrets、憑證與特權存取管理能力。 它將現代化的安全工作流程整合在同一平台中，包含 secrets 輪替、動態憑證、存取審批，以及基於 SSH 憑證的存取方式，並為開發、基礎設施與安全團隊而設計。 官方文件：https://infisical.com/docs/documentation/getting-started/overview