Infisical：开源团队密钥管理平台¶

# 克隆仓库
git clone https://github.com/Infisical/infisical.git
cd infisical

# 配置环境变量
cp .env.example .env
# 编辑 .env 设置必要的配置

# 启动
docker-compose -f docker-compose.prod.yml up -d

helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
helm install infisical infisical/infisical \
    --namespace infisical \
    --create-namespace

# macOS
brew install infisical/get-cli/infisical

# Linux (Debian/Ubuntu)
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
sudo apt-get install infisical

# Windows (scoop)
scoop bucket add infisical https://github.com/Infisical/scoop-infisical.git
scoop install infisical

# npm (跨平台)
npm install -g @infisical/cli

infisical login
# 浏览器打开认证页面，完成后 CLI 自动获取凭证

DATABASE_URL = postgresql://user:pass@localhost:5432/mydb
REDIS_URL = redis://localhost:6379
OPENAI_API_KEY = sk-xxxxxxxxxxxxx
JWT_SECRET = super-secret-jwt-key

# 初始化项目关联
cd my-project
infisical init
# 选择对应的 Infisical 项目

# 查看密钥
infisical secrets

# 使用密钥运行命令（自动注入环境变量）
infisical run -- python app.py
infisical run -- npm start
infisical run -- docker-compose up

# 指定环境
infisical run --env=prod -- python app.py

# 导出为 .env 格式
infisical export --format=dotenv > .env

# 导出为 JSON
infisical export --format=json > secrets.json

# 从 .env 导入
infisical secrets set --env=dev < .env

# 设置单个密钥
infisical secrets set API_KEY=new-key-value --env=dev

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Infisical CLI
        run: |
          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
          sudo apt-get install infisical

      - name: Run with secrets
        run: |
          infisical run --env=prod --projectId=${{ secrets.INFISICAL_PROJECT_ID }} -- ./deploy.sh
        env:
          INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}

deploy:
  image: infisical/cli:latest
  script:
    - export INFISICAL_TOKEN=$INFISICAL_TOKEN
    - infisical run --env=prod -- ./deploy.sh

# 不要在 Dockerfile 中硬编码密钥！
# 运行时通过 Infisical 注入

# docker run 时注入
# docker run -e INFISICAL_TOKEN=xxx my-app

services:
  app:
    build: .
    environment:
      - INFISICAL_TOKEN=${INFISICAL_TOKEN}
    command: infisical run -- python app.py

services:
  infisical-agent:
    image: infisical/cli:latest
    command: agent --config /config/agent.yaml
    volumes:
      - secrets:/secrets
      - ./agent-config.yaml:/config/agent.yaml

  app:
    build: .
    volumes:
      - secrets:/secrets:ro
    depends_on:
      - infisical-agent

volumes:
  secrets:

# 安装 Infisical Kubernetes Operator
helm install infisical-secrets-operator infisical/secrets-operator \
    --namespace infisical-operator \
    --create-namespace

apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: my-app-secrets
spec:
  hostAPI: https://app.infisical.com/api
  authentication:
    universalAuth:
      secretsScope:
        projectSlug: my-project
        envSlug: prod
      credentialsRef:
        secretName: infisical-machine-identity
        secretNamespace: default
  managedSecretReference:
    secretName: my-app-k8s-secret
    secretNamespace: default
    secretType: Opaque

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          envFrom:
            - secretRef:
                name: my-app-k8s-secret

pip install infisical-python

from infisical_client import ClientSettings, InfisicalClient

client = InfisicalClient(ClientSettings(
    client_id="your-machine-identity-client-id",
    client_secret="your-machine-identity-client-secret",
    site_url="https://app.infisical.com"
))

# 获取所有密钥
secrets = client.listSecrets(options={
    "environment": "prod",
    "project_id": "your-project-id"
})

# 获取单个密钥
secret = client.getSecret(options={
    "environment": "prod",
    "project_id": "your-project-id",
    "secret_name": "DATABASE_URL"
})
print(secret.secret_value)

npm install @infisical/sdk

import { InfisicalClient } from "@infisical/sdk";

const client = new InfisicalClient({
    clientId: process.env.INFISICAL_CLIENT_ID,
    clientSecret: process.env.INFISICAL_CLIENT_SECRET,
    siteUrl: "https://app.infisical.com"
});

const secret = await client.getSecret({
    environment: "prod",
    projectId: "your-project-id",
    secretName: "STRIPE_SECRET_KEY"
});
console.log(secret.secretValue);

DB_HOST = localhost
DB_PORT = 5432
DB_USER = myuser
DB_PASS = secretpass
DB_NAME = myapp

# 引用其他密钥组合
DATABASE_URL = postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}

# 手动触发轮换
infisical secrets rotate --env=prod --secret-name=DB_PASSWORD

# 查看密钥访问日志
infisical audit-logs --projectId=xxx

# Web UI 中可以看到：
# - 谁在什么时候访问了哪个密钥
# - 谁修改了密钥（包括旧值新值）
# - 密钥的版本历史

# 查看密钥历史版本
infisical secrets get DATABASE_URL --version=3

# 回滚到特定时间点
# （在 Web UI 中选择 "Point-in-Time Recovery"）
# 选择时间 → 预览变更 → 确认回滚

# 批量导入
infisical secrets set --env=dev \
    DATABASE_URL="postgres://..." \
    REDIS_URL="redis://..." \
    API_KEY="sk-..."

# 或从文件导入
infisical import --env=dev --src=.env