Secrets Management with Infisical in Production

{
  "workspaceId": "64a1b2c3d4e5f6a7b8c9d0e1",
  "defaultEnvironment": "dev",
  "gitBranchToEnvironmentMapping": {
    "main": "prod",
    "staging": "staging",
    "develop": "dev"
  }
}

import { InfisicalClient } from '@infisical/sdk';

// Initialize the client
const infisical = new InfisicalClient({
  // For machine identities (recommended for production)
  clientId: process.env.INFISICAL_CLIENT_ID,
  clientSecret: process.env.INFISICAL_CLIENT_SECRET,

  // Optional: Self-hosted Infisical URL
  siteUrl: process.env.INFISICAL_URL || 'https://app.infisical.com',

  // Cache secrets for 5 minutes to reduce API calls
  cacheTtl: 300
});

export { infisical };

import { infisical } from './secrets';

interface DatabaseConfig {
  host: string;
  port: number;
  user: string;
  password: string;
  database: string;
}

export async function getDatabaseConfig(): Promise<DatabaseConfig> {
  const projectId = process.env.INFISICAL_PROJECT_ID!;
  const environment = process.env.NODE_ENV === 'production' ? 'prod' : 'dev';

  // Fetch all secrets from the database folder
  const secrets = await infisical.listSecrets({
    projectId,
    environment,
    path: '/database'
  });

  // Convert to a key-value map
  const secretMap = secrets.reduce((acc, secret) => {
    acc[secret.secretKey] = secret.secretValue;
    return acc;
  }, {} as Record<string, string>);

  return {
    host: secretMap.DB_HOST,
    port: parseInt(secretMap.DB_PORT, 10),
    user: secretMap.DB_USER,
    password: secretMap.DB_PASSWORD,
    database: secretMap.DB_NAME
  };
}

// Fetch a single secret
export async function getJwtSecret(): Promise<string> {
  const secret = await infisical.getSecret({
    projectId: process.env.INFISICAL_PROJECT_ID!,
    environment: process.env.NODE_ENV === 'production' ? 'prod' : 'dev',
    secretName: 'JWT_SECRET',
    path: '/auth'
  });

  return secret.secretValue;
}

import express from 'express';
import { getDatabaseConfig, getJwtSecret } from './config/database';
import { createPool } from './db/pool';
import { initializeAuth } from './auth/jwt';

async function bootstrap() {
  // Load secrets before starting the application
  console.log('Loading secrets from Infisical...');

  const [dbConfig, jwtSecret] = await Promise.all([
    getDatabaseConfig(),
    getJwtSecret()
  ]);

  // Initialize database connection pool
  const pool = createPool(dbConfig);

  // Initialize JWT authentication
  initializeAuth(jwtSecret);

  // Start Express server
  const app = express();

  app.get('/health', (req, res) => {
    res.json({ status: 'healthy' });
  });

  const port = process.env.PORT || 3000;
  app.listen(port, () => {
    console.log(`Server running on port ${port}`);
  });
}

bootstrap().catch((error) => {
  console.error('Failed to start application:', error);
  process.exit(1);
});

name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Infisical CLI
        run: |
          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
          sudo apt-get update && sudo apt-get install -y infisical

      - name: Export secrets to environment
        env:
          INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
        run: |
          # Export secrets as environment variables for subsequent steps
          infisical export --env=prod --format=dotenv > .env.production

      - name: Build application
        run: |
          # Secrets are available during build
          source .env.production
          npm ci
          npm run build

      - name: Deploy to production
        env:
          INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
        run: |
          # Use infisical run for deployment commands
          infisical run --env=prod -- ./scripts/deploy.sh

      - name: Cleanup secrets
        if: always()
        run: rm -f .env.production

stages:
  - build
  - deploy

variables:
  INFISICAL_TOKEN: $INFISICAL_TOKEN

build:
  stage: build
  image: node:20
  before_script:
    - curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash
    - apt-get update && apt-get install -y infisical
  script:
    - infisical run --env=staging -- npm ci
    - infisical run --env=staging -- npm run build
  artifacts:
    paths:
      - dist/

deploy:
  stage: deploy
  image: alpine:latest
  before_script:
    - apk add --no-cache curl bash
    - curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash
    - apk add infisical
  script:
    - infisical run --env=prod -- ./deploy.sh
  only:
    - main

# syntax=docker/dockerfile:1.4
FROM node:20-alpine AS builder

WORKDIR /app

# Copy package files
COPY package*.json ./

# Use Docker BuildKit secrets for npm install
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci --only=production

COPY . .
RUN npm run build

# Production image - no secrets included
FROM node:20-alpine AS runner

WORKDIR /app

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

# Secrets are injected at runtime via Infisical SDK
CMD ["node", "dist/index.js"]

import { infisical } from './secrets';

// Application supports both old and new secret during rotation window
export async function getApiKeys(): Promise<{ current: string; previous?: string }> {
  const secret = await infisical.getSecret({
    projectId: process.env.INFISICAL_PROJECT_ID!,
    environment: 'prod',
    secretName: 'EXTERNAL_API_KEY',
    path: '/services',
    // Include previous version for graceful rotation
    includeImports: true
  });

  return {
    current: secret.secretValue,
    previous: secret.secretVersion > 1 ? await getPreviousVersion(secret) : undefined
  };
}

// During rotation, try current key first, fall back to previous
export async function callExternalApi(endpoint: string): Promise<Response> {
  const { current, previous } = await getApiKeys();

  try {
    return await fetch(endpoint, {
      headers: { 'Authorization': `Bearer ${current}` }
    });
  } catch (error) {
    if (previous && error.status === 401) {
      // Current key not yet active, use previous
      return await fetch(endpoint, {
        headers: { 'Authorization': `Bearer ${previous}` }
      });
    }
    throw error;
  }
}