Infisical

Deploy Infisical on a VPS in One Click

Authentication & securityDevOps, CI/CD & containers

Open-source secrets manager for storing API keys, database credentials, and tokens with end-to-end encryption.

  • Ready in ~7 min
  • Free installation
  • We handle the setup
At a glance
Version
Latest (0.166)
Operating system
Ubuntu Server 24.04 LTS
Minimum RAM
4 GB
License
MIT
Addressing
IPv4, IPv6
GitHub
30,000
Deployment~7 min
Open source & self-hosted
VPS plans

Choose a VPS plan for Infisical

Blazing-fast NVMe drives and powerful processors. Take a ready-made plan or build the configuration yourself.
Minex
Perfect for personal projects and small websites.
€3.20/mo
Save €0.80 per month

  • 1 vCPU core
  • 1 GB DDR5 RAM
  • 20 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • 1 TB traffic
Basex
A great balance of power and affordable price.
€4.80/mo
Save €1.20 per month

  • 2 vCPU cores
  • 2 GB DDR5 RAM
  • 40 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • 2 TB traffic
Most popular
Corex
For growing applications and businesses.
€7.20/mo
Save €1.80 per month

  • 4 vCPU cores
  • 4 GB DDR5 RAM
  • 50 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic
Midex
Resources for high-load projects.
€9.60/mo
Save €2.40 per month

  • 4 vCPU cores
  • 6 GB DDR5 RAM
  • 60 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic
Proex
Maximum power and scalability.
€12.00/mo
Save €3.00 per month

  • 6 vCPU cores
  • 8 GB DDR5 RAM
  • 70 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic
Scalex
Resources for scaling.
€16.00/mo
Save €4.00 per month

  • 6 vCPU cores
  • 10 GB DDR5 RAM
  • 150 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic
Maxex
A large reserve of power.
€44.00/mo
Save €11.00 per month

  • 8 vCPU cores
  • 16 GB DDR5 RAM
  • 200 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic
Apex
The top configuration.
€79.99/mo
Save €20.00 per month

  • 16 vCPU cores
  • 32 GB DDR5 RAM
  • 400 GB NVMe SSD
  • Full root access
  • 1 dedicated IPv4
  • Unlimited traffic

What you can do with Infisical

Infisical is an open-source secrets management platform that replaces scattered .env files and hardcoded credentials with a single encrypted vault for API keys, database passwords, and tokens. It's built for engineering teams who need to separate secrets by project and environment — development, staging, production — instead of copying the same .env file across servers and CI runners.

Unlike Doppler or HashiCorp Vault Cloud, Infisical ships as MIT-licensed open source with a straightforward Docker stack (PostgreSQL + Redis), so running Infisical self hosted doesn't mean rebuilding your workflow around a proprietary agent. For teams handling regulated data or strict internal security policies, Infisical vps hosting keeps every credential — and the encryption keys protecting them — on infrastructure you control, rather than a third party's cloud.

The applications screen of the control panel with one-click install

Infisical features

A server surrounded by app icons — applications running on a VPS

Beyond basic secret storage, Infisical installation gives teams the access control and audit trail that ad-hoc .env management never had.

01

Environment separation

Secrets are scoped to dev, staging, and production per project, so a leaked staging token can't touch production.

02

Secret versioning with rollback

Every change to a secret is tracked, and any previous value can be restored in a click.

03

Role-based access control

Permissions are set per project, environment, and even individual secret path.

04

Full audit logging

Every read, write, and deletion is recorded with who, what, and when.

05

CLI injection via infisical run

Secrets are injected as environment variables at runtime, without ever writing a .env file to disk.

06

Machine identities

Services authenticate via OIDC, AWS IAM, or Kubernetes Auth instead of long-lived static tokens.

07

Native CI/CD integrations

GitHub Actions, GitLab CI, and Kubernetes Operator sync secrets automatically into pipelines and clusters.

Requirements

Which server to run it on

Minimum requirements for Infisical and the configuration worth starting with.
Minimum
  • CPU2 vCPU
  • Minimum RAM4 GB
  • Disk20 GB
Recommended
VPS Corex
  • CPU4 vCPU
  • Minimum RAM4 GB
  • Disk50 GB

Installation is free — you only pay for the server

Getting started

How to deploy Infisical

Three steps and the app is running on your server.
Step 1
Choose a server

Pick a plan with at least 4 GB RAM — Infisical runs its API alongside PostgreSQL and Redis in the same stack, and both need headroom under load.

Step 2
Pick the app

Mark Infisical in the catalog to install one click, and the template provisions the Infisical container together with its PostgreSQL and Redis dependencies.

Step 3
Get your credentials

Open the instance URL and complete the first-run signup — the first account you create becomes the server administrator automatically.

Why us

Why Host Infisical on Leneex

Speed, protection and support you can rely on — on every plan, with no hidden limits.
Deployment speed
Infisical's stack has three moving parts (app, Postgres, Redis) that normally take manual wiring; a template that provisions all three together turns a 30-45 minute setup into minutes.
Free installation
Since Infisical Community Edition is already free and open source, paying nothing extra for the hosting setup keeps the total cost of running your own secrets vault close to just the server itself.
DDoS protection
Infisical's API is the single point every CI pipeline and running service authenticates against, so an outage here doesn't just take down a dashboard — it blocks every deploy and secret injection until it's back.
Control and support
Secrets management involves generating and rotating ENCRYPTION_KEY and AUTH_SECRET values correctly; root access and 24/7 engineer support matter here more than on a stateless app, because a misconfigured key can lock an entire team out of their vault.
99.9% uptime with SLA compensation
When Infisical is down, every pipeline that calls infisical run at deploy time stalls, not just the web dashboard — uptime here has a direct, immediate cost to shipping.
Flexible payment
Teams that adopt a secrets manager specifically to tighten internal compliance often need invoicing for accounting, which fits naturally alongside the audit-log discipline Infisical already enforce.
What to choose

Infisical: Self-Hosted vs Cloud — Which to Choose

Infisical offers an official paid cloud product (Infisical Cloud, with EU and US regions), so the comparison is made directly against it.
Infisical Cloud
Self-hosted on LeneexRecommended
Resources and limitsUsage tied to your paid tier; free tier caps team size and featuresDedicated CPU, RAM, and Postgres/Redis capacity — no shared infrastructure
Control and accessInfisical operates the infrastructure; you manage app-level access onlyFull root access; encryption keys generated and held entirely by you
Feature limitsSAML SSO, advanced audit logs, and other enterprise features gated behind paid plansFull Community Edition feature set out of the box
ScalingScaling means moving to a higher-priced tierUpgrade server resources whenever secret volume or team size grows
CostSubscription scales with number of human and machine identitiesFixed monthly VPS price regardless of team or secret count
Who it fitsTeams that want zero infrastructure management and are fine with cloud-hosted keysTeams with compliance requirements to keep encryption keys off third-party infrastructure

Self-hosting Infisical is the clear choice when regulatory or internal policy requires that encryption keys never leave infrastructure you control. Infisical Cloud remains a reasonable option for small teams that want to skip server management entirely and don't have strict data-residency constraints.

Frequently Asked Questions about Infisical on VPS

What people ask most about Infisical and our servers.

  • Yes — Infisical supports importing existing .env files directly through the CLI, so migrating an existing project's secrets is a single command rather than manual re-entry.

  • Your PostgreSQL and Redis volumes stay on the same server storage during a plan upgrade, so upgrading resources doesn't touch stored secrets, project configuration, or audit history.

  • Since Infisical's login and CLI both operate over HTTPS, running the instance without valid TLS will block secret injection entirely.

  • Actual capacity depends mainly on how many CI pipelines and services call the API concurrently, since Redis caching absorbs most of the read load.

  • Leneex provisions the initial Docker Compose stack, but pulling new Infisical image versions and applying updates is the account holder's responsibility, same as with any self-managed Docker deployment.

What's already configured

The one-click deployment provisions the Infisical application container alongside its two dependencies — a PostgreSQL database for persistent storage and a Redis instance for caching and session handling — connected over a shared internal Docker network. The ENCRYPTION_KEY and AUTH_SECRET keys are required for the platform to encrypt data and sign authentication tokens, and Infisical will not start correctly without valid values for both. The web interface listens on port 8080 by default, though Leneex's reverse proxy layer may remap this.

First login

Navigate to your instance's assigned domain in a browser — this triggers Infisical's signup screen rather than a login form, since no accounts exist yet on a fresh deployment. The very first account created here is automatically designated the server administrator, with access to the Server Admin Console for managing every other user and instance-wide settings afterward. During this first signup, Infisical generates an Emergency Kit PDF — download and store it somewhere safe immediately, since it's the only recovery path if the admin account's credentials are ever lost.

First project setup

After logging in, create an Organization first, then add a Project inside it — Infisical automatically provisions development, staging, and production environment slugs for every new project, matching the environment-separation model the platform is built around. If SMTP isn't configured, email verification during signup may be skipped or require manual setup.

Deploy Infisical in about 7 minutes

Choose a server — we do the rest: install, configure and send you the credentials.