Replace 1Password / Doppler Secrets with Self-Hosted Infisical

# Production Docker Compose: Infisical (Replaces 1Password / Doppler Secrets)
services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    networks:
      - stack_net

  infisical:
    image: infisical/infisical:latest-postgres
    container_name: stack-infisical
    restart: unless-stopped
    environment:
      - "ENCRYPTION_KEY=${INFISICAL_ENC_KEY:-6c1fe4e407b8911c104518103505b218}"
      - "AUTH_SECRET=${INFISICAL_AUTH_SECRET:-5032919449238192}"
      - "DB_CONNECTION_URI=postgres://postgres:${POSTGRES_PASSWORD:-strongpassword}@postgres:5432/infisical"
      - "REDIS_URL=redis://redis:6379"
      - "SITE_URL=https://secrets.${DOMAIN:-yourdomain.com}"
    volumes:
      - infisical_data:/data
    networks:
      - stack_net

  postgres:
    image: pgvector/pgvector:pg16
    container_name: stack-postgres
    restart: unless-stopped
    environment:
      - "POSTGRES_USER=postgres"
      - "POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-strongpassword}"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - stack_net

  redis:
    image: redis:7-alpine
    container_name: stack-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data
    networks:
      - stack_net

networks:
  stack_net:
    driver: bridge

volumes:
  caddy_data:
  infisical_data:
  postgres_data:
  redis_data:

# Automatic Let's Encrypt HTTPS for Infisical
infisical.{$DOMAIN:yourdomain.com} {
  encode zstd gzip
  reverse_proxy infisical:8080
}

Why Teams Switch to Infisical

• ✓Replaces Doppler & AWS Secrets Manager
• ✓Secret scanning & rotation
• ✓CLI injects secrets straight into local dev or Docker

Deploy Infisical in 60 Seconds

Sized automatically for Infisical (1024MB container RAM + OS overhead).