GCScript.Configuration.Infisical 1.0.0

GCScript.Configuration.Infisical

Loads secrets from Infisical into Microsoft.Extensions.Configuration, on top of the official Infisical.Sdk. Secrets are read once, when the configuration is built, and are never exported to the process environment.

Install

dotnet add package GCScript.Configuration.Infisical

Usage

HostApplicationBuilder builder = Host.CreateApplicationBuilder();
builder.Configuration.AddInfisical();

builder.Services.AddOptions<AcmeApiOptions>()
	.Bind(builder.Configuration)
	.ValidateDataAnnotations()
	.ValidateOnStart();

// appsettings.json — not secrets
{
  "Infisical": {
    "SiteUrl": "https://infisical.example.com",
    "ProjectId": "00000000-0000-0000-0000-000000000000",
    "Environment": "prod"
  }
}

The credentials of a machine identity (Universal Auth) come from Infisical's standard environment variables, shared with the CLI and the official SDKs:

[Environment]::SetEnvironmentVariable('INFISICAL_UNIVERSAL_AUTH_CLIENT_ID', '<client id>', 'User')
[Environment]::SetEnvironmentVariable('INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET', '<client secret>', 'User')

Secrets land at the configuration root with their Infisical name. Map them onto options classes with [ConfigurationKeyName]:

public sealed class AcmeApiOptions {
	[Required, Url, ConfigurationKeyName("ACME_API_URL")] public string BaseUrl { get; init; } = "";
	[Required, ConfigurationKeyName("ACME_API_TOKEN")] public string Token { get; init; } = "";
}

Multiple projects

Call AddInfisical once per project, each with its own section. Settings in Infisical apply to every project and the named section overrides them:

builder.Configuration
	.AddInfisical("Infisical:Shared")
	.AddInfisical("Infisical:App");

{
  "Infisical": {
    "SiteUrl": "https://infisical.example.com",
    "Shared": { "ProjectId": "11111111-1111-1111-1111-111111111111" },
    "App": { "ProjectId": "22222222-2222-2222-2222-222222222222" }
  }
}

When two projects define the same key, the one added last wins. The machine identity needs access to every project it reads.

Settings

Anything can be set in code instead, with or without appsettings.json:

builder.Configuration.AddInfisical(o => {
	o.SiteUrl = "https://infisical.example.com";
	o.ProjectId = "00000000-0000-0000-0000-000000000000";
	o.Environment = "dev";
});

With Recursive, secret keys must be unique across folders (e.g. ACME_API_TOKEN, not API_TOKEN).

Errors

Incomplete settings, rejected credentials and unreachable servers all throw InfisicalConfigurationException while the configuration is built. The message names what failed and never includes secret values: if the underlying SDK error echoes the Client ID or Client Secret, they are masked as *** and the original exception is not attached, so ToString() and loggers cannot leak them either.

License

MIT