migrate

Docker/infisical/files/.env

@@ -0,0 +1,33 @@
+# Infisical core configuration
+SITE_URL='<< infisical_site_url >>'
+ENCRYPTION_KEY='<< infisical_encryption_key >>'
+AUTH_SECRET='<< infisical_auth_secret >>'
+
+# Data stores
+<%- if database_external %>
+DB_CONNECTION_URI='<< database_connection_uri >>'
+<%- else %>
+POSTGRES_USER='<< database_user >>'
+POSTGRES_PASSWORD='<< database_password >>'
+POSTGRES_DB='<< database_name >>'
+DB_CONNECTION_URI='postgresql://<< database_user >>:<< database_password >>@<< service_name or 'infisical' >>_postgres:5432/<< database_name >>?sslmode=disable'
+<%- endif %>
+<%- if redis_external %>
+REDIS_URL='<< redis_url >>'
+<%- else %>
+REDIS_PASSWORD='<< redis_password >>'
+REDIS_URL='redis://:<< redis_password >>@<< service_name or 'infisical' >>_redis:6379'
+<%- endif %>
+
+<%- if email_enabled %>
+# SMTP configuration
+SMTP_HOST='<< email_host >>'
+SMTP_PORT='<< email_port >>'
+SMTP_FROM_ADDRESS='<< email_from_address >>'
+SMTP_FROM_NAME='<< email_from_name >>'
+SMTP_USERNAME='<< email_username >>'
+SMTP_PASSWORD='<< email_password >>'
+SMTP_SECURE='<< email_secure | lower >>'
+SMTP_REQUIRE_TLS='<< email_require_tls | lower >>'
+SMTP_IGNORE_TLS='<< email_ignore_tls | lower >>'
+<%- endif %>

Docker/infisical/files/compose.yaml

@@ -0,0 +1,138 @@
+---
+services:
+  << service_name or 'infisical' >>:
+    image: infisical/infisical:v0.158.0
+    restart: << restart_policy >>
+    <%- if container_name %>
+    container_name: << container_name >>
+    <%- endif %>
+    environment:
+      - NODE_ENV=production
+      - SITE_URL=${SITE_URL}
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - AUTH_SECRET=${AUTH_SECRET}
+      - DB_CONNECTION_URI=${DB_CONNECTION_URI}
+      - REDIS_URL=${REDIS_URL}
+      <%- if email_enabled %>
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
+      - SMTP_FROM_NAME=${SMTP_FROM_NAME}
+      - SMTP_USERNAME=${SMTP_USERNAME}
+      - SMTP_PASSWORD=${SMTP_PASSWORD}
+      - SMTP_SECURE=${SMTP_SECURE}
+      - SMTP_REQUIRE_TLS=${SMTP_REQUIRE_TLS}
+      - SMTP_IGNORE_TLS=${SMTP_IGNORE_TLS}
+      <%- endif %>
+    <%- if (not database_external) or (not redis_external) %>
+    depends_on:
+      <%- if not database_external %>
+      << service_name or 'infisical' >>_postgres:
+        condition: service_healthy
+      <%- endif %>
+      <%- if not redis_external %>
+      << service_name or 'infisical' >>_redis:
+        condition: service_started
+      <%- endif %>
+    <%- endif %>
+    networks:
+      - << service_name or 'infisical' >>_backend
+      <%- if traefik_enabled %>
+      - << traefik_network >>
+      <%- endif %>
+    <%- if not traefik_enabled %>
+    ports:
+      - "<< ports_http >>:8080"
+    <%- endif %>
+    <%- if traefik_enabled %>
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=<< traefik_network >>
+      - traefik.http.services.<< service_name or 'infisical' >>.loadBalancer.server.port=8080
+      - traefik.http.routers.<< service_name or 'infisical' >>_http.service=<< service_name or 'infisical' >>
+      - traefik.http.routers.<< service_name or 'infisical' >>_http.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
+      - traefik.http.routers.<< service_name or 'infisical' >>_http.entrypoints=<< traefik_entrypoint >>
+      <%- if traefik_tls_enabled %>
+      - traefik.http.routers.<< service_name or 'infisical' >>_https.service=<< service_name or 'infisical' >>
+      - traefik.http.routers.<< service_name or 'infisical' >>_https.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
+      - traefik.http.routers.<< service_name or 'infisical' >>_https.entrypoints=<< traefik_tls_entrypoint >>
+      - traefik.http.routers.<< service_name or 'infisical' >>_https.tls=true
+      - traefik.http.routers.<< service_name or 'infisical' >>_https.tls.certresolver=<< traefik_tls_certresolver >>
+      <%- endif %>
+    <%- endif %>
+
+  <%- if not database_external %>
+  << service_name or 'infisical' >>_postgres:
+    image: docker.io/library/postgres:14-alpine
+    restart: << restart_policy >>
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready --username=$${POSTGRES_USER} --dbname=$${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 10s
+      retries: 10
+    networks:
+      - << service_name or 'infisical' >>_backend
+    volumes:
+      <%- if volume_mode == 'mount' %>
+      - << volume_mount_path >>/postgres:/var/lib/postgresql/data
+      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
+      - << service_name or 'infisical' >>_postgres:/var/lib/postgresql/data
+      <%- endif %>
+  <%- endif %>
+
+  <%- if not redis_external %>
+  << service_name or 'infisical' >>_redis:
+    image: docker.io/library/redis:7-alpine
+    restart: << restart_policy >>
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
+    networks:
+      - << service_name or 'infisical' >>_backend
+    volumes:
+      <%- if volume_mode == 'mount' %>
+      - << volume_mount_path >>/redis:/data
+      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
+      - << service_name or 'infisical' >>_redis:/data
+      <%- endif %>
+  <%- endif %>
+
+networks:
+  << service_name or 'infisical' >>_backend:
+    driver: bridge
+  <%- if traefik_enabled %>
+  << traefik_network >>:
+    external: true
+  <%- endif %>
+
+<%- if volume_mode == 'local' and ((not database_external) or (not redis_external)) %>
+volumes:
+  <%- if not database_external %>
+  << service_name or 'infisical' >>_postgres:
+    driver: local
+  <%- endif %>
+  <%- if not redis_external %>
+  << service_name or 'infisical' >>_redis:
+    driver: local
+  <%- endif %>
+<%- elif volume_mode == 'nfs' and ((not database_external) or (not redis_external)) %>
+volumes:
+  <%- if not database_external %>
+  << service_name or 'infisical' >>_postgres:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
+      device: ":<< volume_nfs_path >>/postgres"
+  <%- endif %>
+  <%- if not redis_external %>
+  << service_name or 'infisical' >>_redis:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
+      device: ":<< volume_nfs_path >>/redis"
+  <%- endif %>
+<%- endif %>