infisical/docs/self-hosting/overview.mdx

---
title: "Deployment options"
description: "Explore deployment options for self hosting Infisical"
---

To meet various compliance requirements, you may want to self-host Infisical instead of using [Infisical Cloud](https://app.infisical.com/). 
Self-hosted Infisical allows you to maintain your sensitive information within your own infrastructure and network, ensuring complete control over your data.

<Tabs>
  <Tab title="Quick deploy AWS">
    <iframe width="560" height="315" src="https://www.youtube.com/embed/jR-gM7vIY2c" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
    This deployment option will use AWS Cloudformation to auto deploy an instance of Infisical on a single EC2 via Docker Compose.

    **Resources that will be provisioned** 
    - 1 EC2 instance 
    - 1 DocumentDB cluster 
    - 1 DocumentDB instance 
    - Security groups

    <a href="https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://ec2-instance-cloudformation.s3.amazonaws.com/cloudformation.template&stackName=infisical">
        <img width="200" src="../images/deploy-aws-button.png" />
    </a>

  </Tab>
  <Tab title="Quick deploy Digital Ocean">
    <Note>This deployment option is highly available</Note>
    Coming soon
  </Tab>
  <Tab title="Helm Kubernetes">
    <Note>This deployment option is highly available</Note>
    
  **Prerequisites**
  - You have understanding of [Kubernetes](https://kubernetes.io/)
  - You have understanding of [Helm package manager](https://helm.sh/) 
  - You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster


  #### 1. Fill our environment variables

  Before you can deploy the Helm chart, you must fill out the required environment variables. To do so, please copy the below file to a `.yaml` file. 
  Refer to the available [environment variables](/self-hosting/configuration/envars) to learn more

  <Accordion title="values.yaml">
  [View all available Helm chart values parameters](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical)
  ```yaml
  frontend:
    enabled: true
    name: frontend
    podAnnotations: {}
    deploymentAnnotations: {}
    replicaCount: 2
    image:
      repository: infisical/frontend
      tag: "latest"
      pullPolicy: IfNotPresent
    kubeSecretRef: ""
    service:
      annotations: {}
      type: ClusterIP
      nodePort: ""

  frontendEnvironmentVariables:
    SITE_URL: infisical.local

  backend:
    enabled: true
    name: backend
    podAnnotations: {}
    deploymentAnnotations: {}
    replicaCount: 2
    image:
      repository: infisical/backend
      tag: "latest"
      pullPolicy: IfNotPresent
    kubeSecretRef: ""
    service:
      annotations: {}
      type: ClusterIP
      nodePort: ""

  backendEnvironmentVariables:
    ENCRYPTION_KEY: MUST_REPLACE
    JWT_SIGNUP_SECRET: MUST_REPLACE
    JWT_REFRESH_SECRET: MUST_REPLACE
    JWT_AUTH_SECRET: MUST_REPLACE
    JWT_SERVICE_SECRET: MUST_REPLACE
    SMTP_HOST: MUST_REPLACE
    SMTP_PORT: 587
    SMTP_SECURE: false
    SMTP_FROM_NAME: Infisical
    SMTP_FROM_ADDRESS: MUST_REPLACE
    SMTP_USERNAME: MUST_REPLACE
    SMTP_PASSWORD: MUST_REPLACE
    SITE_URL: infisical.local

  ## Mongo DB persistence
  mongodb:
    enabled: true

  ## By default the backend will be connected to a Mongo instance within the cluster
  ## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
  ## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
  ## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
  mongodbConnection:
    externalMongoDBConnectionString: ""

  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: "nginx"
      # cert-manager.io/issuer: letsencrypt-nginx
    hostName: infisical.local   ## <- Replace with your own domain 
    frontend:
      path: /
      pathType: Prefix
    backend:
      path: /api
      pathType: Prefix
    tls: []
      # - secretName: letsencrypt-nginx
      #   hosts:
      #     - infisical.local

    mailhog:
      enabled: false
  ```
  </Accordion>

  Once you have a local copy of the values file, fill our the required environment variables and save the file.


  #### 2. Install Infisical Helm repository 

  ```bash
  helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' 
    
  helm repo update
  ```

  #### 3. Install the Helm chart 

  By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
  that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.

  ```bash
  ## Installs to default namespace
  helm install infisical-helm-charts/infisical --generate-name --values <path to the values.yaml you downloaded/created in step 2>
  ```

  <Note>
  If you have not filled out all of the required environment variables, you will see an error message prompting you to 
  do so. 
  </Note>

  #### 4. Your Infisical installation is complete and should be running on the host name you specified in Ingress in `values.yaml`.
    
  </Tab>
  <Tab title="Bare Docker Compose">
    1. Install Docker on your VM

    ```bash
    # Example in ubuntu
    apt-get update
    apt-get upgrade
    apt install docker-compose
    ```

    2. Download the required files

    ```bash
    # Download env file template
    wget -O .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example

    # Download docker compose template
    wget -O docker-compose.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.yml

    # Download nginx config
    mkdir nginx && wget -O ./nginx/default.conf https://raw.githubusercontent.com/Infisical/infisical/main/nginx/default.dev.conf
    ```

    3. Tweak the `.env` according to your preferences. Refer to the available [environment variables](/self-hosting/configuration/envars)

    ```bash
    # update environment variables like mongo login
    nano .env
    ```

    4. Get the service up and running.

    ```bash
    # Start up services in detached mode
    docker-compose -f docker-compose.yml up -d
    ```

    5. Your Infisical installation is complete and should be running on [http://localhost:80](http://localhost:80). Please note that the containers are not exposed to the internet and only bind to the localhost. It's up to you to configure a firewall, SSL certificates, and implement any additional security measures.

  </Tab>
</Tabs>