fix(infisical): update to v0.162.6

- Bump image from v0.135.0-postgres to v0.162.6 (upstream dropped the
  -postgres tag suffix after v0.146.0; plain tags are the postgres build)
- Remove the db-migration service: the standalone image runs database
  migrations automatically on boot (auto-start-migrations), matching the
  official docker-compose.prod.yml which no longer ships that service
- Generate ENCRYPTION_KEY (${hash:32}) and AUTH_SECRET (${base64:32})
  per deployment instead of shipping hardcoded example secrets
- Fix SITE_URL to http://${main_domain} (no :8080; the domain is proxied)
- Refresh SMTP env names (SMTP_FROM_ADDRESS/SMTP_FROM_NAME; SMTP_SECURE
  was removed upstream) and drop unused CLIENT_* env placeholders that
  were never passed to the container

Closes #215

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/gitlab-ce/docker-compose.yml

@@ -1,24 +1,65 @@
 services:
   gitlab:
-    image: gitlab/gitlab-ce:19.1.2-ce.0
+    image: gitlab/gitlab-ce:latest
     restart: unless-stopped
-    shm_size: "256m"
+    hostname: gitlab.example.com
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         external_url 'http://${GITLAB_HOST}'
+        gitlab_rails['gitlab_ssh_host'] = '${GITLAB_HOST}'
+        gitlab_rails['gitlab_shell_ssh_port'] = 2224
+        gitlab_rails['db_adapter'] = 'postgresql'
+        gitlab_rails['db_host'] = 'postgresql'
+        gitlab_rails['db_port'] = '5432'
+        gitlab_rails['db_database'] = '${POSTGRES_DB}'
+        gitlab_rails['db_username'] = '${POSTGRES_USER}'
+        gitlab_rails['db_password'] = '${POSTGRES_PASSWORD}'
+        # Redis config for external TCP connection
+        gitlab_rails['redis_url'] = 'redis://redis:6379/0'
+        gitlab_rails['redis_host'] = 'redis'
+        gitlab_rails['redis_port'] = 6379
+        gitlab_rails['redis_socket'] = nil
+        gitlab_rails['gitlab_email_enabled'] = false
+        gitlab_rails['gitlab_default_can_create_group'] = true
+        gitlab_rails['gitlab_username_changing_enabled'] = false
+        unicorn['worker_processes'] = 2
+        unicorn['worker_timeout'] = 60
+        postgresql['enable'] = false
+        redis['enable'] = false
+        nginx['enable'] = true
         nginx['listen_port'] = 80
         nginx['listen_https'] = false
-        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
-        gitlab_rails['gitlab_email_enabled'] = false
-        puma['worker_processes'] = 0
-        sidekiq['concurrency'] = 10
         prometheus_monitoring['enable'] = false
+    ports:
+      - "80"
+      - "2224"
     volumes:
       - gitlab_config:/etc/gitlab
       - gitlab_logs:/var/log/gitlab
       - gitlab_data:/var/opt/gitlab
+    depends_on:
+      - postgresql
+      - redis
+
+  postgresql:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
 
 volumes:
   gitlab_config:
   gitlab_logs:
   gitlab_data:
+  postgresql_data:
+  redis_data:

blueprints/gitlab-ce/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "gitlab-ce",
   "name": "GitLab CE",
-  "version": "19.1.2",
+  "version": "latest",
   "description": "GitLab Community Edition is a free and open source platform for managing Git repositories, CI/CD pipelines, and project management.",
   "logo": "gitlab-ce.svg",
   "links": {

blueprints/gitlab-ce/template.toml

@@ -1,11 +1,15 @@
 [variables]
 main_domain = "${domain}"
-gitlab_root_password = "${password:32}"
+postgres_db = "gitlab"
+postgres_user = "gitlab"
+postgres_password = "${password:32}"
 
 [config]
 env = [
   "GITLAB_HOST=${main_domain}",
-  "GITLAB_ROOT_PASSWORD=${gitlab_root_password}",
+  "POSTGRES_DB=${postgres_db}",
+  "POSTGRES_USER=${postgres_user}",
+  "POSTGRES_PASSWORD=${postgres_password}",
 ]
 
 [[config.domains]]

blueprints/infisical/docker-compose.yml

@@ -1,58 +1,29 @@
 services:
-  db-migration:
-    depends_on:
-      db:
-        condition: service_healthy
-    image: infisical/infisical:v0.135.0-postgres
-    environment:
-      - NODE_ENV=production
-      - ENCRYPTION_KEY
-      - AUTH_SECRET
-      - SITE_URL
-      - DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
-      - REDIS_URL=redis://redis:6379
-      - SMTP_HOST
-      - SMTP_PORT
-      - SMTP_FROM_NAME
-      - SMTP_USERNAME
-      - SMTP_PASSWORD
-      - SMTP_SECURE=true
-    command: npm run migration:latest
-    pull_policy: always
-
   backend:
+    image: infisical/infisical:v0.162.6
     restart: unless-stopped
     depends_on:
       db:
         condition: service_healthy
       redis:
         condition: service_started
-      db-migration:
-        condition: service_completed_successfully
-    image: infisical/infisical:v0.135.0-postgres
-    pull_policy: always
     environment:
       - NODE_ENV=production
-      - ENCRYPTION_KEY
-      - AUTH_SECRET
-      - SITE_URL
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - AUTH_SECRET=${AUTH_SECRET}
+      - SITE_URL=${SITE_URL}
       - DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
       - REDIS_URL=redis://redis:6379
-      - SMTP_HOST
-      - SMTP_PORT
-      - SMTP_FROM_NAME
-      - SMTP_USERNAME
-      - SMTP_PASSWORD
-      - SMTP_SECURE=true
-
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
+      - SMTP_FROM_NAME=${SMTP_FROM_NAME}
+      - SMTP_USERNAME=${SMTP_USERNAME}
+      - SMTP_PASSWORD=${SMTP_PASSWORD}
 
   redis:
     image: redis:7.4.1
-    env_file: .env
     restart: always
-    environment:
-      - ALLOW_EMPTY_PASSWORD=yes
-
     volumes:
       - redis_infisical_data:/data
 
@@ -60,12 +31,11 @@ services:
     image: postgres:14-alpine
     restart: always
     environment:
-      - POSTGRES_PASSWORD
-      - POSTGRES_USER
-      - POSTGRES_DB
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_DB=${POSTGRES_DB}
     volumes:
       - pg_infisical_data:/var/lib/postgresql/data
-
     healthcheck:
       test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
       interval: 5s
@@ -75,6 +45,3 @@ services:
 volumes:
   pg_infisical_data:
   redis_infisical_data:
-
-
-

blueprints/infisical/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "infisical",
   "name": "Infisical",
-  "version": "0.135.0",
+  "version": "0.162.6",
   "description": "All-in-one platform to securely manage application configuration and secrets across your team and infrastructure.",
   "logo": "infisical.jpg",
   "links": {

blueprints/infisical/template.toml

@@ -3,56 +3,27 @@ main_domain = "${domain}"
 postgres_password = "${password}"
 postgres_user = "infisical"
 postgres_db = "infisical"
+encryption_key = "${hash:32}"
+auth_secret = "${base64:32}"
 
 [config]
 env = [
-  "ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218",
-  "AUTH_SECRET=5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=",
+  "ENCRYPTION_KEY=${encryption_key}",
+  "AUTH_SECRET=${auth_secret}",
   "POSTGRES_PASSWORD=${postgres_password}",
   "POSTGRES_USER=${postgres_user}",
   "POSTGRES_DB=${postgres_db}",
-  "SITE_URL=http://${main_domain}:8080",
+  "SITE_URL=http://${main_domain}",
   "SMTP_HOST=",
-  "SMTP_PORT=",
-  "SMTP_NAME=",
+  "SMTP_PORT=587",
+  "SMTP_FROM_ADDRESS=",
+  "SMTP_FROM_NAME=Infisical",
   "SMTP_USERNAME=",
   "SMTP_PASSWORD=",
-  "CLIENT_ID_HEROKU=",
-  "CLIENT_ID_VERCEL=",
-  "CLIENT_ID_NETLIFY=",
-  "CLIENT_ID_GITHUB=",
-  "CLIENT_ID_GITHUB_APP=",
-  "CLIENT_SLUG_GITHUB_APP=",
-  "CLIENT_ID_GITLAB=",
-  "CLIENT_ID_BITBUCKET=",
-  "CLIENT_SECRET_HEROKU=",
-  "CLIENT_SECRET_VERCEL=",
-  "CLIENT_SECRET_NETLIFY=",
-  "CLIENT_SECRET_GITHUB=",
-  "CLIENT_SECRET_GITHUB_APP=",
-  "CLIENT_SECRET_GITLAB=",
-  "CLIENT_SECRET_BITBUCKET=",
-  "CLIENT_SLUG_VERCEL=",
-  "CLIENT_PRIVATE_KEY_GITHUB_APP=",
-  "CLIENT_APP_ID_GITHUB_APP=",
-  "SENTRY_DSN=",
-  "POSTHOG_HOST=",
-  "POSTHOG_PROJECT_API_KEY=",
-  "CLIENT_ID_GOOGLE_LOGIN=",
-  "CLIENT_SECRET_GOOGLE_LOGIN=",
-  "CLIENT_ID_GITHUB_LOGIN=",
-  "CLIENT_SECRET_GITHUB_LOGIN=",
-  "CLIENT_ID_GITLAB_LOGIN=",
-  "CLIENT_SECRET_GITLAB_LOGIN=",
-  "CAPTCHA_SECRET=",
-  "NEXT_PUBLIC_CAPTCHA_SITE_KEY=",
-  "PLAIN_API_KEY=",
-  "PLAIN_WISH_LABEL_IDS=",
-  "SSL_CLIENT_CERTIFICATE_HEADER_KEY=",
 ]
 mounts = []
 
 [[config.domains]]
 serviceName = "backend"
-port = 8_080
+port = 8080
 host = "${main_domain}"