Bielu.Aspire.Infisical 1.0.0-beta.639136501677821366

Bielu.Aspire.Common

A collection of common extensions and resources for .NET Aspire in the Bielu ecosystem.

Packages

Installation

dotnet add package Bielu.Aspire.Common
dotnet add package Bielu.Aspire.Resources
dotnet add package Bielu.Aspire.OnePassword
dotnet add package Bielu.Aspire.Infisical
dotnet add package Bielu.Aspire.Infisical.Client

Usage

File Store Resource

Register a file store as a bind mount or volume for container resources:

var store = builder.AddFileStore("my-store", "relative/path");
builder.AddContainer("my-container", "my-image")
    .WithStorage(store, "/container/path");

1Password Connect

Add 1Password Connect API and Sync containers to your Aspire app host:

var (syncApi, connectApi) = builder.AddOnePasswordConnect();

Infisical Secrets Management

Add a self-hosted Infisical secrets management container with dedicated PostgreSQL and Redis/Valkey dependencies.

With Redis (default cache)

var (infisical, db, redis) = builder.AddInfisicalWithDependencies("infisical");

With Valkey cache

var (infisical, db, valkey) = builder.AddInfisicalWithValkeyDependencies("infisical");

Using existing resources

Share PostgreSQL and cache instances across services:

var redis = builder.AddRedis("redis");
var postgres = builder.AddPostgres("postgres").AddDatabase("mydb");
var infisical = builder.AddInfisicalUsingResources(postgres, redis);

Referencing Infisical from a service project

All AddInfisical* methods return an IResourceBuilder<InfisicalResource> which implements IResourceWithConnectionString and IResourceWithWaitSupport, so you can use .WithReference() and .WaitFor():

// AppHost (Program.cs)
var (infisical, db, redis) = builder.AddInfisicalWithDependencies("infisical");
builder.AddProject<Projects.MyApi>("myapi")
    .WithReference(infisical)
    .WaitFor(infisical);

Automatic client configuration from AppHost (recommended)

Client credentials (ClientId, ClientSecret, ProjectId, etc.) are automatically read from the Infisical:Client section in the AppHost's configuration and stored on the InfisicalResource. When you call WithInfisicalClient, these values are injected as environment variables into the consuming project — no manual configuration needed in each service project.

// AppHost appsettings.json (or user-secrets)
{
  "Infisical": {
    "EncryptionKey": "...",
    "AuthSecret": "...",
    "Client": {
      "ProjectId": "<your-project-id>",
      "Environment": "dev",
      "ClientId": "<machine-identity-client-id>",
      "ClientSecret": "<machine-identity-client-secret>"
    }
  }
}

// AppHost (Program.cs)
var (infisical, db, redis) = builder.AddInfisicalWithDependencies("infisical");

// Client config flows automatically from Infisical:Client section
builder.AddProject<Projects.MyApi>("myapi")
    .WithInfisicalClient(infisical);

// MyApi Service (Program.cs) — no settings needed!
builder.AddInfisicalConfiguration("infisical");

// Secrets from Infisical are now available via IConfiguration
var secret = builder.Configuration["MY_SECRET"];

You can also configure or override client settings programmatically at the resource level with WithClientConfiguration, or per-service via the optional callback on WithInfisicalClient:

// Override at resource level (applies to all services)
var (infisical, db, redis) = builder.AddInfisicalWithDependencies("infisical");
infisical.WithClientConfiguration(client =>
{
    client.ProjectId = "<your-project-id>";
    client.Environment = "dev";
    client.ClientId = "<machine-identity-client-id>";
    client.ClientSecret = "<machine-identity-client-secret>";
});

// Override per-service (e.g., different environment for a specific service)
builder.AddProject<Projects.MyApi>("myapi")
    .WithInfisicalClient(infisical, client =>
    {
        client.Environment = "staging";
    });

WithInfisicalClient injects environment variables (Infisical__Client__ProjectId, etc.) that the .NET configuration system maps to Infisical:Client:*, which AddInfisicalConfiguration reads automatically. It also calls .WithReference(infisical) and .WaitFor(infisical) under the hood.

Client-side configuration (service project)

In your service project, install Bielu.Aspire.Infisical.Client and call AddInfisicalConfiguration to wire Infisical secrets into the .NET configuration system. The Infisical server URL is resolved automatically from the Aspire connection string. Powered by JJConsulting.Infisical.

Machine Identity auth

// MyApi Service (Program.cs)
builder.AddInfisicalConfiguration("infisical", settings =>
{
    settings.ProjectId = "<your-project-id>";
    settings.Environment = "dev";
    settings.ClientId = "<machine-identity-client-id>";
    settings.ClientSecret = "<machine-identity-client-secret>";
});

// Secrets from Infisical are now available via IConfiguration
var secret = builder.Configuration["MY_SECRET"];

Service Token auth

builder.AddInfisicalConfiguration("infisical", settings =>
{
    settings.ProjectId = "<your-project-id>";
    settings.Environment = "dev";
    settings.ServiceToken = "<your-service-token>";
});

Client settings can also be bound from the Infisical:Client configuration section instead of (or in addition to) the callback:

{
  "Infisical": {
    "Client": {
      "ProjectId": "<your-project-id>",
      "Environment": "dev",
      "ClientId": "<machine-identity-client-id>",
      "ClientSecret": "<machine-identity-client-secret>"
    }
  }
}

In addition to the configuration provider, AddInfisicalConfiguration also registers IInfisicalSecretsService and IInfisicalAuthenticationService in DI for direct secret access.

Standalone (all config via Infisical:* section)

var infisical = builder.AddInfisical("infisical");

Configuration

The following configuration keys are read from the Infisical section (e.g. appsettings.json or user secrets):

Kestrel HTTPS from Infisical PKI

Infisical's PKI / Certificates module doesn't store certificates under a user-defined name — each certificate is issued for a Subscriber, identified by SubscriberName. Use these extensions when you want Kestrel to consume a PKI-issued certificate directly (no PFX upload):

builder.WebHost.ConfigureKestrel((context, kestrel) =>
{
    var infisical = kestrel.ApplicationServices.GetRequiredService<InfisicalClient>();

    kestrel.ListenAnyIP(443, listen =>
    {
        // Use the latest already-issued certificate for the subscriber:
        listen.UseHttpsFromInfisicalPki(
            client:         infisical,
            subscriberName: "my-api.example.com",
            protocols:      HttpProtocols.Http1AndHttp2);

        // Or issue a fresh certificate at startup:
        // listen.IssueHttpsFromInfisicalPki(infisical, "my-api.example.com");
    });
});

If your subscriber lives in a different Infisical project than the one resolved from the client's auth context, pass it explicitly via the projectId parameter.

One-line bootstrap

If you don't want to wire up ConfigureKestrel/ListenAnyIP yourself, use the UseInfisicalPkiHttps helper directly on WebApplicationBuilder:

var builder = WebApplication.CreateBuilder(args);
builder.AddInfisicalConfiguration("infisical");

// Binds Kestrel to :443 with HTTPS using the latest cert from the PKI subscriber.
builder.UseInfisicalPkiHttps("my-api-prod");

// Or issue a fresh certificate at startup, on a custom port:
// builder.UseInfisicalPkiHttps("my-api-prod", port: 8443, issueNew: true);

var app = builder.Build();
app.Run();

The InfisicalClient is resolved from DI, so AddInfisicalConfiguration (or any other registration of InfisicalClient) must be called first.

Use UseHttpsFromInfisical (secret-based) when the certificate is stored as a Base64-encoded PFX in Infisical Secrets, and UseHttpsFromInfisicalPki when it is managed by Infisical's PKI module.

Trusting the PKI certificate from HttpClient

When calling a service that presents an Infisical PKI–issued certificate, you can teach every HttpClient (including typed clients) to trust it without disabling validation, via ConfigureHttpClientDefaults:

// Applies to ALL HttpClients created through IHttpClientFactory:
builder.Services.ConfigureHttpClientDefaultsToTrustInfisicalPki("my-api-prod");

// Or per-client:
builder.Services.AddHttpClient<MyApiClient>()
    .TrustInfisicalPkiCertificate("my-api-prod");

The handler trusts the leaf cert by thumbprint and, when available, builds a custom chain using the subscriber's issuing CA / chain PEM as the root, so CA-signed certs validate without pinning. The system trust store is still honored — only failing validations fall back to the Infisical anchors.

Reverse Proxy Endpoint Hostname

Override the target hostname for an existing endpoint:

builder.AddProject<MyProject>("my-project")
    .WithHttpEndpoint(name: "http")
    .WitHostnameForEndpoint("http", "custom-hostname");

Requirements

• .NET 10.0 or later
• .NET Aspire 13.2 or later

Building

dotnet build src/Bielu.Aspire.Common.sln

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the MIT License — see the LICENSE file for details.

Author

Arkadiusz Biel (@bielu)

❤️ This project is royalty free and open source, so if you are using and love it, you can support it by becoming a GitHub sponsor ❤️