My Homelab Has No .env Files. Self-Hosted Secrets With Tailscale + Infisical
Self-host a secrets manager on your own hardware, reach it from anywhere, and keep it off the public internet. In this video I set up Infisical on a homelab box, put it on my Tailscale tailnet with a real HTTPS certificate, and move my Docker Compose stacks off .env files so every stack pulls its passwords from one place. Everything in this video runs on the free plan of both products. What we cover: - Putting every box on a tailnet, with no port forwarding or router config - Self-hosting Infisical with Docker Compose - Giving it an HTTPS address with tailscale serve, with no reverse proxy - Projects, environments, and one machine identity per stack - Starting Nextcloud and Grafana with infisical run, with no .env on disk - Locking the network with Tailscale tags and grants, so only your homelab boxes can reach Infisical - How CI can join the tailnet for one job and pull secrets over the tunnel 00:00 - Introduction & The Problem with .env Files 01:23 - How Tailscale & Infisical Work Together 03:24 - Setting Up Tailscale 05:29 - Self-Hosting Infisical via Docker Compose 08:12 - Configuring MagicDNS & HTTPS with Tailscale Serve 11:02 - Initial Infisical Setup & Super Admin Configuration 12:06 - Projects, Environments, & Folders in Infisical 14:09 - Nextcloud Setup: Creating Machine Identities & Universal Auth 16:04 - Using Infisical CLI to Inject Secrets (No .env Needed) 19:37 - Setting Up Grafana & Postgres (second stack) 22:53 - Restricting Network Access with Tailscale ACL Tags 26:05 - Extending Access: CI/CD Pipelines & Secret Syncs 27:57 - Summary & Final Thoughts Links: Infisical: https://infisical.com Self-host Infisical with Docker Compose: https://infisical.com/docs/self-hosting/deployment-options/docker-compose Install the Infisical CLI: https://infisical.com/docs/cli/overview infisical run: https://infisical.com/docs/cli/commands/run Tailscale: https://tailscale.com Install Tailscale on Linux: https://tailscale.com/kb/1031/install-linux tailscale serve: https://tailscale.com/docs/features/tailscale-serve Tailscale grants: https://tailscale.com/docs/reference/syntax/grants Go deeper on secrets management in Infisical: https://www.youtube.com/watch?v=BMeng7nkRYs Christian Lempa's Infisical homelab video: https://www.youtube.com/watch?v=kGKQ-j4jTg0