Updates the Infisical template from v0.135.0-postgres to v0.162.6 (latest stable as of 2026-07-14).
Changes
Image bump: infisical/infisical:v0.135.0-postgres → infisical/infisical:v0.162.6. Upstream stopped publishing the -postgres tag suffix after v0.146.0 — plain vX.Y.Z tags are now the (only) Postgres-backed standalone build.
Removed the db-migration service: since the standalone image gained auto-start-migrations, the backend runs migration:latest automatically on boot (guarded by a Postgres advisory lock). This matches the current official docker-compose.prod.yml, which no longer ships a migration service.
Per-deployment secrets: ENCRYPTION_KEY is now generated via ${hash:32} (random 16-byte hex, as required by upstream) and AUTH_SECRET via ${base64:32}, instead of the hardcoded example values from upstream's .env.example that every deployment shared.
Fixed SITE_URL: http://${main_domain} instead of http://${main_domain}:8080 — the domain is proxied by Traefik on port 80, so the :8080 suffix produced wrong absolute URLs (email links, OAuth redirects).
Refreshed SMTP env: added SMTP_FROM_ADDRESS, fixed SMTP_FROM_NAME (the toml previously set a nonexistent SMTP_NAME), and dropped SMTP_SECURE (removed upstream in favor of SMTP_REQUIRE_TLS/SMTP_IGNORE_TLS defaults).
Cleanup: removed the ~30 empty CLIENT_*/POSTHOG_*/CAPTCHA_* env placeholders from template.toml — they were never passed to the container (the compose environment: list doesn't include them), so this is a no-op functionally. Also removed pull_policy: always (tag is pinned) and the stray env_file/ALLOW_EMPTY_PASSWORD on redis.
Migration notes
Volume names (pg_infisical_data, redis_infisical_data) and Postgres 14 are unchanged, so existing deployments that re-apply the compose keep their data; on first boot of the new image the backend migrates the DB schema automatically.
Existing deployments keep their env (Dokploy templates only seed env at creation), so the new generated secrets only affect fresh installs. Do not change ENCRYPTION_KEY/AUTH_SECRET on an existing install.
Verification (deployed on hostinger.dokploy.com)
Deploy status: done in 103s, migrations auto-ran on boot
GET / → HTTP 200, Infisical frontend served through the generated domain
GET /api/status → {"message":"Ok","redisConfigured":true,...}
GET /api/v1/admin/config → {"initialized":false,"allowSignUp":true,...} and /admin/signup → 200 (fresh instance is bootstrappable)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/Dokploy/templates/pull/1005
**Author:** [@Siumauricio](https://github.com/Siumauricio)
**Created:** 7/14/2026
**Status:** ✅ Merged
**Merged:** 7/14/2026
**Merged by:** [@Siumauricio](https://github.com/Siumauricio)
**Base:** `canary` ← **Head:** `fix/infisical-update`
---
### 📝 Commits (1)
- [`29a7970`](https://github.com/Dokploy/templates/commit/29a7970397313724c0f6414e2a75592ad4f76775) fix(infisical): update to v0.162.6
### 📊 Changes
**3 files changed** (+23 additions, -85 deletions)
<details>
<summary>View changed files</summary>
📝 `blueprints/infisical/docker-compose.yml` (+13 -46)
📝 `blueprints/infisical/meta.json` (+1 -1)
📝 `blueprints/infisical/template.toml` (+9 -38)
</details>
### 📄 Description
## Summary
Updates the Infisical template from `v0.135.0-postgres` to **`v0.162.6`** (latest stable as of 2026-07-14).
### Changes
- **Image bump**: `infisical/infisical:v0.135.0-postgres` → `infisical/infisical:v0.162.6`. Upstream stopped publishing the `-postgres` tag suffix after `v0.146.0` — plain `vX.Y.Z` tags are now the (only) Postgres-backed standalone build.
- **Removed the `db-migration` service**: since the standalone image gained `auto-start-migrations`, the backend runs `migration:latest` automatically on boot (guarded by a Postgres advisory lock). This matches the current official [`docker-compose.prod.yml`](https://github.com/Infisical/infisical/blob/main/docker-compose.prod.yml), which no longer ships a migration service.
- **Per-deployment secrets**: `ENCRYPTION_KEY` is now generated via `${hash:32}` (random 16-byte hex, as required by upstream) and `AUTH_SECRET` via `${base64:32}`, instead of the hardcoded example values from upstream's `.env.example` that every deployment shared.
- **Fixed `SITE_URL`**: `http://${main_domain}` instead of `http://${main_domain}:8080` — the domain is proxied by Traefik on port 80, so the `:8080` suffix produced wrong absolute URLs (email links, OAuth redirects).
- **Refreshed SMTP env**: added `SMTP_FROM_ADDRESS`, fixed `SMTP_FROM_NAME` (the toml previously set a nonexistent `SMTP_NAME`), and dropped `SMTP_SECURE` (removed upstream in favor of `SMTP_REQUIRE_TLS`/`SMTP_IGNORE_TLS` defaults).
- **Cleanup**: removed the ~30 empty `CLIENT_*`/`POSTHOG_*`/`CAPTCHA_*` env placeholders from `template.toml` — they were never passed to the container (the compose `environment:` list doesn't include them), so this is a no-op functionally. Also removed `pull_policy: always` (tag is pinned) and the stray `env_file`/`ALLOW_EMPTY_PASSWORD` on redis.
### Migration notes
- Volume names (`pg_infisical_data`, `redis_infisical_data`) and Postgres 14 are unchanged, so existing deployments that re-apply the compose keep their data; on first boot of the new image the backend migrates the DB schema automatically.
- Existing deployments keep their env (Dokploy templates only seed env at creation), so the new generated secrets only affect fresh installs. **Do not** change `ENCRYPTION_KEY`/`AUTH_SECRET` on an existing install.
### Verification (deployed on hostinger.dokploy.com)
- Deploy status: `done` in 103s, migrations auto-ran on boot
- `GET /` → HTTP 200, Infisical frontend served through the generated domain
- `GET /api/status` → `{"message":"Ok","redisConfigured":true,...}`
- `GET /api/v1/admin/config` → `{"initialized":false,"allowSignUp":true,...}` and `/admin/signup` → 200 (fresh instance is bootstrappable)
Closes #215
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/Dokploy/templates/pull/1005
Author: @Siumauricio
Created: 7/14/2026
Status: ✅ Merged
Merged: 7/14/2026
Merged by: @Siumauricio
Base:
canary← Head:fix/infisical-update📝 Commits (1)
29a7970fix(infisical): update to v0.162.6📊 Changes
3 files changed (+23 additions, -85 deletions)
View changed files
📝
blueprints/infisical/docker-compose.yml(+13 -46)📝
blueprints/infisical/meta.json(+1 -1)📝
blueprints/infisical/template.toml(+9 -38)📄 Description
Summary
Updates the Infisical template from
v0.135.0-postgrestov0.162.6(latest stable as of 2026-07-14).Changes
infisical/infisical:v0.135.0-postgres→infisical/infisical:v0.162.6. Upstream stopped publishing the-postgrestag suffix afterv0.146.0— plainvX.Y.Ztags are now the (only) Postgres-backed standalone build.db-migrationservice: since the standalone image gainedauto-start-migrations, the backend runsmigration:latestautomatically on boot (guarded by a Postgres advisory lock). This matches the current officialdocker-compose.prod.yml, which no longer ships a migration service.ENCRYPTION_KEYis now generated via${hash:32}(random 16-byte hex, as required by upstream) andAUTH_SECRETvia${base64:32}, instead of the hardcoded example values from upstream's.env.examplethat every deployment shared.SITE_URL:http://${main_domain}instead ofhttp://${main_domain}:8080— the domain is proxied by Traefik on port 80, so the:8080suffix produced wrong absolute URLs (email links, OAuth redirects).SMTP_FROM_ADDRESS, fixedSMTP_FROM_NAME(the toml previously set a nonexistentSMTP_NAME), and droppedSMTP_SECURE(removed upstream in favor ofSMTP_REQUIRE_TLS/SMTP_IGNORE_TLSdefaults).CLIENT_*/POSTHOG_*/CAPTCHA_*env placeholders fromtemplate.toml— they were never passed to the container (the composeenvironment:list doesn't include them), so this is a no-op functionally. Also removedpull_policy: always(tag is pinned) and the strayenv_file/ALLOW_EMPTY_PASSWORDon redis.Migration notes
pg_infisical_data,redis_infisical_data) and Postgres 14 are unchanged, so existing deployments that re-apply the compose keep their data; on first boot of the new image the backend migrates the DB schema automatically.ENCRYPTION_KEY/AUTH_SECRETon an existing install.Verification (deployed on hostinger.dokploy.com)
donein 103s, migrations auto-ran on bootGET /→ HTTP 200, Infisical frontend served through the generated domainGET /api/status→{"message":"Ok","redisConfigured":true,...}GET /api/v1/admin/config→{"initialized":false,"allowSignUp":true,...}and/admin/signup→ 200 (fresh instance is bootstrappable)Closes #215
🤖 Generated with Claude Code
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.