Deployment Guide

Infracast can be deployed as SaaS (zero ops), Docker (self-hosted), or Terraform on AWS. Choose the model that fits your requirements.

Option 1: SaaS (Recommended)

The fastest way to get started — no infrastructure required.

1. Sign up at app.infracast.io
2. Create your organization and first tenant
3. Add credentials for your cloud accounts or on-prem infrastructure
4. Run your first discovery job

SaaS includes:

• Automatic upgrades (zero downtime)
• Managed PostgreSQL with daily backups
• 99.9% uptime SLA
• SOC 2 Type II compliant infrastructure

Option 2: Docker (Self-Hosted)

Best for evaluation, air-gapped environments, or small teams.

Prerequisites

• Docker 20.10+ and Docker Compose v2
• 4 GB RAM minimum (8 GB recommended)
• 10 GB disk

Quick Start

git clone <distribution-url>   # provided with your license entitlement
cd infracast
cp .env.example .env
# Edit .env with your settings
docker compose up -d

Environment Variables (.env)

.env

# Database
POSTGRES_USER=infracast
POSTGRES_PASSWORD=change-me-in-production
POSTGRES_DB=infracast

# API
API_SECRET_KEY=generate-a-32-byte-random-string
JWT_SECRET=another-32-byte-random-string

# License (optional — Free tier works without)
# INFRACAST_LICENSE_FILE=/etc/infracast/license.json
# INFRACAST_LICENSE_JSON={"..."}

# NVD CVE database (optional but recommended for CVE correlation)
# NVD_API_KEY=your-nvd-api-key

# Content CDN (optional — defaults to infracast CDN)
# CONTENT_CDN_URL=https://<your-cdn>.cloudfront.net

# CORS — note: this one takes NO prefix
# ALLOWED_ORIGINS=https://app.example.com

Variable names verified against the code

INFRACAST_JWT_SECRET is the JWT signing secret, matching the shipped docker-compose.yml. Earlier revisions of this page listed three variables that nothing in the codebase reads — API_SECRET_KEY, ADMIN_USERNAME and ADMIN_PASSWORD (zero readers each). Setting them has no effect and raises no error. There is no environment-variable admin bootstrap; create the first admin with infracast user create as shown below.

The license line previously read "optional — Free tier works without". The server does start without a license, but there is no Free tier: the tiers are trial, pro, business, enterprise, enterprise_plus and gov.

ALLOWED_ORIGINS is the one server variable that takes no INFRACAST_ prefix — it is read directly rather than through the config shim.

Verify Installation

# Check all containers are running
docker compose ps

# Verify API health
curl http://localhost:8080/healthz
# Expected: {"status":"ok","db_connected":true}

# UI available at
open http://localhost:3000

Create the First Admin

docker compose exec infracast ./infracast user create \
  --username admin \
  --password 'YourSecurePassword!' \
  --role system-admin

Production Considerations for Docker

Not Production-Ready Out of the Box

The default Docker Compose setup uses single-node PostgreSQL with no backups. For production Docker deployments:

• Point DATABASE_URL to a managed PostgreSQL (RDS, Cloud SQL, Supabase)
• Add TLS termination via nginx or Traefik reverse proxy
• Use Docker Secrets or a vault for credentials (not plain .env files)
• Set up log aggregation (CloudWatch, Datadog, etc.)

Recommended Production Docker Setup

docker-compose.prod.yml

services:
  infracast:
    image: ghcr.io/azgardtek/infracast:latest
    restart: always
    ports:
      - "8080:8080"
    environment:
      DATABASE_URL: "postgres://infracast:${DB_PASSWORD}@your-rds-host:5432/infracast?sslmode=require"
      JWT_SECRET: "${JWT_SECRET}"
      API_SECRET_KEY: "${API_SECRET_KEY}"
      NVD_API_KEY: "${NVD_API_KEY}"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3

  nginx:
    image: nginx:alpine
    restart: always
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro

Option 3: Terraform on AWS

Best for enterprise self-hosted, MSSP, or FedRAMP requirements.

See Getting Started: Terraform for the full walkthrough.

High-Level Steps

git clone <distribution-url>   # provided with your license entitlement
cd infracast/deploy/terraform/aws
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars

terraform init
terraform plan
terraform apply

Terraform creates: VPC, ALB, ECS cluster, RDS PostgreSQL, S3 buckets, CloudFront, IAM roles, and CloudWatch log groups.

Terraform Variables Reference

Variable	Required	Default	Description
environment	Yes	—	dev or prod
aws_region	Yes	—	AWS region (e.g., us-east-1)
domain_name	Yes	—	Domain for the deployment
certificate_arn	Yes	—	ACM certificate ARN
vpc_cidr	No	10.0.0.0/16	VPC CIDR block
db_instance_class	No	db.t3.medium	RDS instance type
db_multi_az	No	false	Enable Multi-AZ for RDS
db_storage_gb	No	20	Initial RDS storage in GB
ecs_cpu	No	512	ECS task CPU units
ecs_memory	No	1024	ECS task memory in MB
ecs_desired_count	No	1	Number of ECS tasks
ecs_min_count	No	1	Auto-scaling minimum
ecs_max_count	No	3	Auto-scaling maximum
tags	No	{}	Additional resource tags

Environment Variables Reference

Full list of API server environment variables:

Variable	Required	Description
DATABASE_URL	Yes	PostgreSQL connection string
JWT_SECRET	Yes	Secret for signing JWTs (32+ bytes)
API_PORT	No	HTTP listen port (default: 8080)
PLUGIN_DIR	No	Directory of plugin binaries (default: /usr/local/lib/infracast/plugins)
INFRACAST_LICENSE_FILE	No	Path to license JSON file
INFRACAST_LICENSE_JSON	No	License JSON as environment variable
NVD_API_KEY	No	NIST NVD API key for faster CVE sync
CONTENT_CDN_URL	No	Content pack CDN URL
CONTENT_CACHE_DIR	No	Local cache for content packs
CONTENT_PUBLIC_KEY	No	Ed25519 public key for content verification (base64)
ALLOWED_ORIGINS	No	CORS origins (comma-separated, default *)
LOG_LEVEL	No	Log verbosity: debug, info, warn, error
LOG_FORMAT	No	json or text (default: json)

Post-Deployment Steps

After any deployment method:

1. Log in to the UI and change the default admin password
2. Create a tenant for your organization
3. Add credentials for your infrastructure providers
4. Create your first discovery job and verify assets appear in the graph
5. Configure alerting for critical findings (see Monitoring)
6. Set up backups if self-hosted (see Backup & Restore)