Install and maintain Infisical on Ubuntu

Infisical Core 0.162.14 is installed as its pinned native Debian package on Ubuntu 24.04 x86-64, reconfigured with infisical-ctl, and proxied by Nginx.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• Ubuntu 24.04 or newer on x86-64.
• A dedicated domain because SITE_URL is set to the public endpoint.

What the AppStore installation creates

• Pinned infisical-core Debian package version 0.162.14-1
• Configuration under /etc/infisical
• Infisical runit/systemd service and local API on port 8080
• Nginx reverse proxy and optional Let’s Encrypt TLS

1. Install package prerequisites

sudo apt update
sudo apt install -y --no-install-recommends ca-certificates curl nginx openssl \
  postgresql postgresql-contrib qemu-guest-agent redis-server \
  certbot python3-certbot-nginx ufw
sudo systemctl enable --now postgresql redis-server nginx qemu-guest-agent

2. Create the database, secrets, and install the verified package

The image creates a PostgreSQL database, generates separate encryption/authentication secrets, writes a mode-0600 configuration, and verifies the exact package checksum before installation.

sudo -u postgres psql
CREATE ROLE infisical WITH LOGIN PASSWORD 'CHANGE_ME_DB_PASSWORD';
CREATE DATABASE infisical OWNER infisical;
GRANT ALL PRIVILEGES ON DATABASE infisical TO infisical;
\q

sudo install -d -o root -g root -m 0700 /etc/infisical
openssl rand -hex 16
openssl rand -base64 32
sudo nano /etc/infisical/infisical.rb
# Set ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, REDIS_URL, SITE_URL, PORT=8080, and TELEMETRY_ENABLED=false.
sudo chmod 0600 /etc/infisical/infisical.rb

curl -fL 'https://artifacts-infisical-core.infisical.com/deb/pool/stable/i/in/infisical-core_0.162.14-1_amd64.deb' -o /tmp/infisical-core.deb
printf '%s  %s\n' 'ffd8fe2ebaa329744bbaa0ef83a2812ae2ca3075133480ebf22faac4cbb8f63c' '/tmp/infisical-core.deb' | sha256sum --check -
sudo apt install -y /tmp/infisical-core.deb
sudo infisical-ctl version
sudo infisical-ctl reconfigure
sudo apt-mark hold infisical-core

3. Set SITE_URL and configure Nginx

Set the public URL in /etc/infisical/infisical.rb, reconfigure, and proxy Nginx to the local service on port 8080.

sudo nano /etc/infisical/infisical.rb
# infisical_core['SITE_URL'] = 'https://app.example.com'
sudo infisical-ctl reconfigure
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d app.example.com -m admin@example.com --agree-tos --redirect

4. Create the first account

Verify both the local and proxied status endpoints, then create the first account immediately in the web interface.

curl -f http://127.0.0.1:8080/api/status
curl -f https://app.example.com/api/status

Important files and data

• Infisical configuration: /etc/infisical/infisical.rb
• Infisical logs: /var/log/infisical-core/
• Nginx site: /etc/nginx/sites-available/infisical
• Package state: inspect with dpkg -l infisical-core

Health checks and logs

Run these checks after installation and after each upgrade:

sudo infisical-ctl status
curl -f http://127.0.0.1:8080/api/status
sudo systemctl status infisical-runsvdir nginx --no-pager
sudo tail -n 100 /var/log/infisical-core/infisical-core/current

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo infisical-ctl status
# Back up and test a release before removing the hold.
sudo apt-mark unhold infisical-core
sudo apt install ./SELECTED_infisical-core_amd64.deb
sudo infisical-ctl reconfigure
sudo apt-mark hold infisical-core

Backup scope

• Infisical’s database and application data using the vendor-supported backup method
• /etc/infisical and every encryption/signing key required to decrypt the backup
• Nginx and TLS configuration

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• If the local API works but the public URL fails, inspect the Nginx server name and proxy configuration.
• If login redirects to the wrong URL, correct SITE_URL and rerun sudo infisical-ctl reconfigure.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.