Secrets with Infisical

Every template (except py-worker) ships a yarn secrets script that writes an environment’s variables from Infisical into the matching .env file, so secrets live in one vault instead of being passed around by hand.

Command	Writes
yarn secrets	.env (the dev environment)
yarn secrets -e test	.env.test
yarn secrets -e staging	.env.staging
yarn secrets -e prod	.env.production

The file is written only after the export succeeds; on any failure the script exits non-zero and leaves the existing file alone. Every one of these files is gitignored.

Setup (once per project)

1. Create a project in Infisical with environments dev, test, staging and prod (the slugs the script uses).

2. Add the variables from the template’s .env.example to each environment. The template’s Environment page says what each should be.

3. Install the CLI and log in:

   npm install -g @infisical/cli
   infisical login          # self-hosted: --domain https://<your-infisical>

4. Point the script at the project. It reads the project id from your shell, deliberately not from the repository: a value baked into the template would follow every copy of it to projects it has nothing to do with.

   export INFISICAL_PROJECT_ID=<project id>   # Project settings in Infisical

   Put it in your shell profile, or commit an .infisical.json to the project.

Where each template reads from

nest-api, node-worker, react-app

One path per project, INFISICAL_PATH (default /).

react-monorepo

One path per workspace, under INFISICAL_PATH_PREFIX (default /frontend): /frontend/client, /frontend/auth, /frontend/admin, /frontend/landing, and /frontend/types for the API-types generator. yarn secrets at the root runs every workspace’s; yarn workspace client secrets -e prod runs one.

In CI

The nest-api workflows run yarn secrets -e test before the tests. They need:

• INFISICAL_TOKEN: a machine identity’s token, as a repository secret;
• INFISICAL_PROJECT_ID: the project id, in the runner’s environment or the workflow’s env (not in the workflows by design);
• INFISICAL_API_URL: your Infisical instance, set in the workflows.

Caution

Without INFISICAL_PROJECT_ID, the step fails the job with INFISICAL_PROJECT_ID is not set. Add it where your runner reads its environment, or to each workflow’s env.

For production containers, don’t bake .env files into images (every template’s .dockerignore excludes them): give the container its variables from your deployment platform, or from infisical run -- <command>.