---
title: "Deploy Infisical on StackBlaze"
description: "Deploy Infisical with managed PostgreSQL, Valkey for its job queues, invitation emails that send, and a public HTTPS URL. The admin account is created with a generated password before the app is reachable, and public sign-up is closed, so nobody else can claim your instance. Keep every environment’s secrets in one place and give CI and servers their own machine identities."
category: "security, development, work"
url: https://www.stackblaze.com/templates/infisical
---

# Deploy Infisical

Deploy Infisical with managed PostgreSQL, Valkey for its job queues, invitation emails that send, and a public HTTPS URL. The admin account is created with a generated password before the app is reachable, and public sign-up is closed, so nobody else can claim your instance. Keep every environment’s secrets in one place and give CI and servers their own machine identities.

**[Deploy Infisical on StackBlaze](https://dashboard.stackblaze.com/new/template/infisical)**

## This stack

- **Infisical**: Web service
- **PostgreSQL**: managed database · TCP:5432
- **Valkey**: managed cache · TCP:6379
- **Email**: platform add-on

## What you get

- **Encrypted secrets per environment**: Each project gets Development, Staging and Production out of the box. Values are encrypted at rest with a key generated for your deploy.
- **Projects, folders and tags**: Group secrets by service, nest them in folders, tag and comment them, and paste a whole .env file to import it in one go.
- **Versions and commits**: Every change is committed with its author, and each secret keeps its version history, so you can see what changed and when.
- **Machine identities for CI and servers**: Give pipelines and workloads their own identity with a client ID and secret, scoped to the projects and role you choose, such as read only.
- **Invite your team**: Add people from Access Control. Invitations go out through the Email add-on, and each member gets a role per organization and project.
- **Closed from the first second**: No setup page for strangers: the admin is created at first start, sign-up is invite only, login is email only and anonymous secret sharing is off.

## After you deploy

1. **Sign in as the admin**: Open your app URL and sign in with INFISICAL_ADMIN_EMAIL and the generated INFISICAL_ADMIN_PASSWORD from the app’s Variables. A short setup asks for your name and organization.
2. **Make the account yours**: Change the admin email to your own address in Personal Settings and set a new password, then invite your team from Access Control.
3. **Add secrets and connect your apps**: Create a project, add or paste your secrets per environment, and create a machine identity for each pipeline or server that needs to read them.

## How it is wired

- **PostgreSQL holds the secrets**: Projects, encrypted secret values, versions and identities live in the attached PostgreSQL database, with passwords generated at deploy. Redeploys keep everything.
- **Valkey runs the queues**: Background jobs such as reminders, syncs and cleanups run through queues in the Valkey add-on, next to the app.
- **Your encryption key**: ENCRYPTION_KEY is generated for your deploy and wraps every stored secret. Keep a copy somewhere safe: data encrypted with it can’t be read without it.
- **Mail goes through the Email add-on**: Invitations, password resets and new-device notices send through the platform relay from your project’s sending address. There is no mail server to set up.

## Common questions

### How do I sign in the first time?

Open your app URL and sign in with INFISICAL_ADMIN_EMAIL (admin@example.com) and INFISICAL_ADMIN_PASSWORD from the app’s Variables. The account is created when the app first starts, before it is reachable, so the admin setup page is never open to visitors. Change the email to your own afterwards.

### Can anyone sign up on my instance?

No. Sign-up is invite only and login is by email and password. You can allow sign-up for your own email domain, or turn on other login methods, in the Server Console.

### Which features are included?

This is the free self-hosted edition: projects, environments, folders, versions, machine identities, invitations and secret sharing for signed-in users. Features such as SAML or OIDC single sign-on, custom roles, audit logs, approvals, secret rotation and dynamic secrets need a license key from Infisical.

### How do my apps and pipelines read secrets?

Create a machine identity in Access Control, add universal auth to get a client ID and secret, and give it a role on the projects it needs. Your pipeline logs in with those and reads only what that role allows.

### Where is my data stored?

In the attached PostgreSQL database, encrypted with the ENCRYPTION_KEY generated for your deploy. Valkey only holds job queues and cache. Both stay when you redeploy.

### Can I use my own domain?

Yes. Attach a custom domain from the dashboard, for example secrets.example.com, and set SITE_URL to the new https address so links in emails use it.

### What does it cost?

You pay for the compute, storage and bandwidth Infisical, PostgreSQL and Valkey use, and for the emails it sends, not per user.


Source: https://github.com/Infisical/infisical