--- title: Better HomeLab Secret Management // Infisical Tutorial description: A hands-on walkthrough of self-hosting Infisical, an open-source secrets management platform, using Docker Compose in a home lab environment. Covers... canonical: https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Better HomeLab Secret Management // Infisical Tutorial | daily.dev og:description: A hands-on walkthrough of self-hosting Infisical, an open-source secrets management platform, using Docker Compose in a home lab environment. Covers... og:url: https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya og:image: https://api.daily.dev/og/posts/zVkSCycYA.png og:image:alt: Better HomeLab Secret Management // Infisical Tutorial og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Better HomeLab Secret Management // Infisical Tutorial **[Christian Lempa](https://daily.dev/sources/christianlempa)** · 31 min read · 9 upvotes · 2 comments ## Summary A hands-on walkthrough of self-hosting Infisical, an open-source secrets management platform, using Docker Compose in a home lab environment. Covers installation with PostgreSQL and Redis, configuring encryption keys, organizing secrets by environment (dev/staging/prod), synchronizing secrets to self-hosted GitLab CI/CD variables, and injecting secrets into Docker Compose stacks via the Infisical CLI using the `infisical run` command. Also touches on limitations with third-party Docker management UIs like Portainer, and briefly covers certificate management, KMS, and secret scanning features. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I inject secrets from Infisical into a Docker Compose stack without using .env files? Use the Infisical CLI command 'infisical run' with the project path, which automatically injects the secrets as environment variables into any command you run, such as 'docker compose up -d'. This avoids storing plaintext credentials in .env files on home lab servers, though it requires the CLI to be installed and authenticated with the self-hosted Infisical instance first. _Anyone wiring secrets into docker compose workflows can find more setups like this through daily.dev._ ### Can Infisical replace cert-manager for TLS certificate automation with a DNS provider? No, Infisical's certificate manager project only supports the ACME HTTP-01 challenge, not DNS-01, so it cannot directly integrate with DNS providers for certificate issuance. It can still store and manage imported certificates or a CA, but it is not a drop-in replacement for cert-manager or similar tools that rely on DNS-01 validation. _Developers comparing certificate automation tools can track these kinds of tradeoffs on daily.dev._ ### Does Infisical work directly with Docker management platforms like Portainer? No, Infisical cannot automatically inject secrets into third-party Docker management platforms such as Portainer, Dockge, or Arcane. To use secrets with custom applications you must modify the Dockerfile to embed the Infisical CLI, obtain an access token, and feed it into the container, which is more complex and typically requires CI/CD automation to rebuild images. _Those weighing secret-injection tradeoffs across Docker tooling can keep up with practical notes like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@thomijasir** · 1 upvotes > i use infisical before but its too huge for me, i like use dopbase instead for secret manager, its simple clean and open source **@trevorsuna** · 1 upvotes > Great walkthrough. The tricky bit is that the secret manager still has secrets of its own. I’d keep its main encryption key and recovery credentials away from the same server and Compose repo. Also worth testing a full backup, restore, and key rotation before calling it done—just in case. ## Similar posts on daily.dev - [Hugging Face Case Study](https://daily.dev/posts/hugging-face-case-study-ggldgx20k) · Programming Digest · 2 upvotes · 0 comments - [I stopped doing one mistake in Docker Compose files, and my self-hosted setup finally felt secure](https://daily.dev/posts/i-stopped-doing-one-mistake-in-docker-compose-files-and-my-self-hosted-setup-finally-felt-secure-3nittkcoz) · XDA Developers · 11 upvotes · 3 comments - [Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes](https://daily.dev/posts/rebuilding-my-homelab-with-compose-ruby-ipv6-and-no-kubernetes-tu8vhdqzn) · Hacker News · 1 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#self-hosting](https://daily.dev/tags/self-hosting), [#docker-compose](https://daily.dev/tags/docker-compose) [View this post on daily.dev](https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Better HomeLab Secret Management // Infisical Tutorial","url":"https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya"},"datePublished":"2026-07-14T14:29:44.163Z","dateModified":"2026-09-14T06:12:04.207Z","description":"A hands-on walkthrough of self-hosting Infisical, an open-source secrets management platform, using Docker Compose in a home lab environment. Covers...","image":"https://i.ytimg.com/vi/kGKQ-j4jTg0/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/kGKQ-j4jTg0/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Christian Lempa","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Christian Lempa","logo":"https://media.daily.dev/image/upload/s--r09bzzis--/f_auto/v1723788767/logos/christianlempa","url":"https://daily.dev/sources/christianlempa"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"cicd,self-hosting,docker-compose","timeRequired":"PT31M","video":{"@type":"VideoObject","name":"Better HomeLab Secret Management // Infisical Tutorial","description":"A hands-on walkthrough of self-hosting Infisical, an open-source secrets management platform, using Docker Compose in a home lab environment. Covers...","thumbnailUrl":"https://i.ytimg.com/vi/kGKQ-j4jTg0/sddefault.jpg","uploadDate":"2026-07-14T14:29:44.163Z","duration":"PT31M","url":"https://api.daily.dev/r/zVkSCycYA","embedUrl":"https://www.youtube.com/embed/kGKQ-j4jTg0"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Christian Lempa","item":"https://daily.dev/sources/christianlempa"},{"@type":"ListItem","position":3,"name":"Better HomeLab Secret Management // Infisical Tutorial"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya","comment":[{"@type":"Comment","text":"i use infisical before but its too huge for me, i like use dopbase instead for secret manager, its simple clean and open source","datePublished":"2026-09-13T06:33:49.703Z","url":"https://daily.dev/posts/zVkSCycYA#c-v2G2wqwrP","author":{"@type":"Person","name":"Thomi","url":"https://daily.dev/thomijasir","image":"https://lh3.googleusercontent.com/a/ACg8ocLtyffxvn3K0UNUAzTWujDzQJnRBTg7ou30fO6vzRsx5M41jstrcg=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Great walkthrough. The tricky bit is that the secret manager still has secrets of its own. I’d keep its main encryption key and recovery credentials away from the same server and Compose repo. Also worth testing a full backup, restore, and key rotation before calling it done—just in case.","datePublished":"2026-07-16T02:26:57.515Z","url":"https://daily.dev/posts/zVkSCycYA#c-aHUMgbNxg","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/better-homelab-secret-management-infisical-tutorial-zvkscycya#faq","mainEntity":[{"@type":"Question","name":"How do I inject secrets from Infisical into a Docker Compose stack without using .env files?","acceptedAnswer":{"@type":"Answer","text":"Use the Infisical CLI command 'infisical run' with the project path, which automatically injects the secrets as environment variables into any command you run, such as 'docker compose up -d'. This avoids storing plaintext credentials in .env files on home lab servers, though it requires the CLI to be installed and authenticated with the self-hosted Infisical instance first. Anyone wiring secrets into docker compose workflows can find more setups like this through daily.dev."}},{"@type":"Question","name":"Can Infisical replace cert-manager for TLS certificate automation with a DNS provider?","acceptedAnswer":{"@type":"Answer","text":"No, Infisical's certificate manager project only supports the ACME HTTP-01 challenge, not DNS-01, so it cannot directly integrate with DNS providers for certificate issuance. It can still store and manage imported certificates or a CA, but it is not a drop-in replacement for cert-manager or similar tools that rely on DNS-01 validation. Developers comparing certificate automation tools can track these kinds of tradeoffs on daily.dev."}},{"@type":"Question","name":"Does Infisical work directly with Docker management platforms like Portainer?","acceptedAnswer":{"@type":"Answer","text":"No, Infisical cannot automatically inject secrets into third-party Docker management platforms such as Portainer, Dockge, or Arcane. To use secrets with custom applications you must modify the Dockerfile to embed the Infisical CLI, obtain an access token, and feed it into the container, which is more complex and typically requires CI/CD automation to rebuild images. Those weighing secret-injection tradeoffs across Docker tooling can keep up with practical notes like this via daily.dev."}}]} ```