{ "slug": "infisical-helm", "kind": "helm", "metadata": { "name": "Infisical", "description": "Helm values and Kubernetes secret manifests for deploying the Infisical standalone chart with external PostgreSQL, Redis, Traefik ingress, and homelab-friendly defaults.", "tags": [ "secrets", "kubernetes", "helm", "postgresql", "redis", "traefik" ], "icon": { "provider": "selfhst", "id": "infisical", "color": "amber" }, "draft": false, "version": { "name": "v0.158.0", "source_dep_name": "infisical/infisical", "source_dep_version": "v0.158.0" } }, "variables": [ { "name": "general", "title": "General", "items": [ { "name": "release_name", "type": "str", "title": "Release Name", "required": true, "default": "infisical", "description": "Helm release name.", "config": { "placeholder": "infisical" } }, { "name": "namespace", "type": "str", "title": "Namespace", "required": true, "default": "infisical", "description": "Kubernetes namespace for Infisical resources.", "config": { "placeholder": "infisical" } }, { "name": "replica_count", "type": "int", "title": "Replicas", "required": true, "default": 1, "description": "Number of Infisical application replicas. Keep one replica for initial bootstrap, then scale out after testing.", "config": { "placeholder": "1" } } ] }, { "name": "infisical", "title": "Infisical", "items": [ { "name": "infisical_site_url", "type": "str", "title": "Site URL", "required": true, "default": "https://infisical.home.arpa", "config": { "placeholder": "https://infisical.home.arpa" } }, { "name": "infisical_secret_name", "type": "str", "title": "Kubernetes Secret Name", "required": true, "default": "infisical-secrets", "description": "Kubernetes Secret referenced by infisical.kubeSecretRef.", "config": { "placeholder": "infisical-secrets" } }, { "name": "infisical_encryption_key", "type": "secret", "title": "Encryption Key", "required": true, "description": "Infisical ENCRYPTION_KEY. Back this up securely; losing it makes stored secrets unrecoverable.", "config": { "autogenerated": { "length": 32, "characters": [ "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "a", "b", "c", "d", "e", "f" ] } } }, { "name": "infisical_auth_secret", "type": "secret", "title": "Auth Secret", "required": true, "config": { "autogenerated": { "kind": "base64", "bytes": 32 } } } ] }, { "name": "networking", "title": "Networking", "items": [ { "name": "service_type", "type": "enum", "title": "Service Type", "required": true, "default": "ClusterIP", "description": "Kubernetes Service type for the Infisical application.", "config": { "options": [ "ClusterIP", "NodePort", "LoadBalancer" ] } }, { "name": "ingress_enabled", "type": "bool", "title": "Ingress", "required": false, "default": true }, { "name": "ingress_host", "type": "str", "title": "Ingress Host", "required": true, "default": "infisical.home.arpa", "description": "FQDN for Infisical ingress.", "needs": [ "ingress_enabled=true" ], "config": { "placeholder": "infisical.home.arpa" } }, { "name": "ingress_class_name", "type": "str", "title": "Ingress Class", "required": true, "default": "traefik", "description": "Ingress class name.", "needs": [ "ingress_enabled=true" ], "config": { "placeholder": "traefik" } }, { "name": "ingress_nginx_enabled", "type": "bool", "title": "Bundled NGINX Ingress", "required": false, "default": false, "description": "Enable the chart's bundled ingress-nginx controller. Disable this when using an existing Traefik ingress controller.", "needs": [ "ingress_enabled=true" ] }, { "name": "traefik_entrypoint", "type": "str", "title": "Traefik Entrypoint", "required": false, "default": "websecure", "description": "Traefik router entrypoint annotation. Leave empty for non-Traefik ingress controllers.", "needs": [ "ingress_enabled=true" ], "config": { "placeholder": "websecure" } }, { "name": "ingress_tls_enabled", "type": "bool", "title": "TLS", "required": false, "default": true, "needs": [ "ingress_enabled=true" ] }, { "name": "ingress_tls_secret", "type": "str", "title": "TLS Secret", "required": true, "default": "infisical-tls", "description": "Kubernetes TLS secret name.", "needs": [ "ingress_enabled=true", "ingress_tls_enabled=true" ], "config": { "placeholder": "infisical-tls" } }, { "name": "ingress_certmanager_enabled", "type": "bool", "title": "Cert Manager Annotation", "required": false, "default": false, "description": "Add cert-manager cluster issuer annotation to the Ingress.", "needs": [ "ingress_enabled=true", "ingress_tls_enabled=true" ] }, { "name": "certmanager_issuer", "type": "str", "title": "ClusterIssuer", "required": true, "default": "letsencrypt-prod", "description": "cert-manager ClusterIssuer name.", "needs": [ "ingress_enabled=true", "ingress_tls_enabled=true", "ingress_certmanager_enabled=true" ], "config": { "placeholder": "letsencrypt-prod" } } ] }, { "name": "database", "title": "PostgreSQL", "items": [ { "name": "database_external", "type": "bool", "title": "External PostgreSQL", "required": false, "default": true }, { "name": "database_secret_name", "type": "str", "title": "DB Secret Name", "required": true, "default": "infisical-postgres", "description": "Kubernetes Secret containing DB_CONNECTION_URI for external PostgreSQL.", "needs": [ "database_external=true" ], "config": { "placeholder": "infisical-postgres" } }, { "name": "database_connection_uri", "type": "secret", "title": "DB Connection URI", "required": true, "default": "postgresql://infisical:CHANGE_ME@postgres.example.internal:5432/infisical?sslmode=disable", "description": "Full PostgreSQL connection URI for external databases. URL-encode special characters in usernames/passwords.", "needs": [ "database_external=true" ], "config": { "placeholder": "postgresql://infisical:password@postgres.example.internal:5432/infisical?sslmode=disable" } }, { "name": "database_user", "type": "str", "title": "Database User", "required": true, "default": "infisical", "needs": [ "database_external=false" ], "config": { "placeholder": "infisical" } }, { "name": "database_name", "type": "str", "title": "Database Name", "required": true, "default": "infisical", "needs": [ "database_external=false" ], "config": { "placeholder": "infisical" } }, { "name": "database_password", "type": "secret", "title": "Database Password", "required": true, "description": "PostgreSQL password for the bundled database, written to helm-secrets.yaml.", "needs": [ "database_external=false" ], "config": { "autogenerated": { "length": 32, "characters": [ "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9" ] } } } ] }, { "name": "redis", "title": "Redis", "items": [ { "name": "redis_external", "type": "bool", "title": "External Redis", "required": false, "default": false }, { "name": "redis_url", "type": "secret", "title": "Redis URL", "required": true, "default": "redis://:CHANGE_ME@redis.example.internal:6379", "description": "Full Redis URL for external Redis.", "needs": [ "redis_external=true" ], "config": { "placeholder": "redis://:password@redis.example.internal:6379" } }, { "name": "redis_password", "type": "secret", "title": "Redis Password", "required": true, "description": "Redis password for the bundled Redis chart, written to helm-secrets.yaml.", "needs": [ "redis_external=false" ], "config": { "autogenerated": { "length": 32, "characters": [ "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9" ] } } }, { "name": "redis_persistence_enabled", "type": "bool", "title": "Redis Persistence", "required": false, "default": true, "needs": [ "redis_external=false" ] }, { "name": "redis_storage_class", "type": "str", "title": "Redis StorageClass", "required": false, "default": "ceph-rbd", "description": "StorageClass for the bundled Redis PVC.", "needs": [ "redis_external=false", "redis_persistence_enabled=true" ], "config": { "placeholder": "ceph-rbd" } }, { "name": "redis_storage_size", "type": "str", "title": "Redis Storage Size", "required": false, "default": "2Gi", "description": "PVC size for the bundled Redis chart.", "needs": [ "redis_external=false", "redis_persistence_enabled=true" ], "config": { "placeholder": "2Gi" } } ] }, { "name": "resources", "title": "Resources", "items": [ { "name": "resources_cpu_request", "type": "str", "title": "CPU Request", "required": false, "default": "250m", "config": { "placeholder": "250m" } }, { "name": "resources_memory_request", "type": "str", "title": "Memory Request", "required": false, "default": "512Mi", "config": { "placeholder": "512Mi" } }, { "name": "resources_memory_limit", "type": "str", "title": "Memory Limit", "required": false, "default": "1000Mi", "config": { "placeholder": "1000Mi" } }, { "name": "redis_cpu_request", "type": "str", "title": "Redis CPU Request", "required": false, "default": "50m", "needs": [ "redis_external=false" ], "config": { "placeholder": "50m" } }, { "name": "redis_memory_request", "type": "str", "title": "Redis Memory Request", "required": false, "default": "128Mi", "needs": [ "redis_external=false" ], "config": { "placeholder": "128Mi" } }, { "name": "redis_memory_limit", "type": "str", "title": "Redis Memory Limit", "required": false, "default": "256Mi", "needs": [ "redis_external=false" ], "config": { "placeholder": "256Mi" } } ] }, { "name": "email", "title": "Email", "toggle": "email_enabled", "items": [ { "name": "email_enabled", "type": "bool", "title": "SMTP Email", "required": false, "default": false, "description": "Add SMTP keys to the Infisical Kubernetes Secret." }, { "name": "email_host", "type": "str", "title": "SMTP Host", "required": true, "default": "smtp.home.arpa", "needs": [ "email_enabled=true" ], "config": { "placeholder": "smtp.home.arpa" } }, { "name": "email_port", "type": "int", "title": "SMTP Port", "required": true, "default": 587, "needs": [ "email_enabled=true" ], "config": { "placeholder": "587" } }, { "name": "email_from_address", "type": "str", "title": "From Address", "required": true, "default": "infisical@home.arpa", "needs": [ "email_enabled=true" ], "config": { "placeholder": "infisical@home.arpa" } }, { "name": "email_from_name", "type": "str", "title": "From Name", "required": false, "default": "Infisical", "needs": [ "email_enabled=true" ], "config": { "placeholder": "Infisical" } }, { "name": "email_username", "type": "str", "title": "SMTP Username", "required": true, "default": "", "needs": [ "email_enabled=true" ], "config": { "placeholder": "user@example.com" } }, { "name": "email_password", "type": "secret", "title": "SMTP Password", "required": false, "default": "", "needs": [ "email_enabled=true" ] }, { "name": "email_secure", "type": "bool", "title": "SMTP Secure", "required": false, "default": false, "needs": [ "email_enabled=true" ] }, { "name": "email_require_tls", "type": "bool", "title": "Require TLS", "required": false, "default": true, "needs": [ "email_enabled=true" ] }, { "name": "email_ignore_tls", "type": "bool", "title": "Ignore TLS", "required": false, "default": false, "needs": [ "email_enabled=true" ] } ] } ] }