Infisical

Towbar can load runtime secrets for an app, resource, or Compose project from an Infisical folder when a deployment runs. The machine identity credentials stay in /etc/towbar/towbar.yml. See External secrets for workload manifest examples and folder behavior.

Prepare access

Create a machine identity in Infisical, grant it access only to the projects, environments, paths, and secret versions your workloads need, and create a client ID and secret for that identity. For a self-hosted Infisical installation, use its HTTPS base URL. Enable allowPrivateNetwork only if that installation intentionally resolves to an internal address reachable from Towbar.

/etc/towbar/towbar.yml

integrations:
  infisical:
    enabled: true
    baseUrl: https://app.infisical.com
    allowPrivateNetwork: false
    clientId: "<machine-identity-client-id>"
    clientSecret: "<machine-identity-client-secret>"

Run sudo towbar config validate and sudo towbar restart. Confirm that Infisical appears under Manage → Integrations → External secrets. This proves the local configuration is valid; a deployment that references a test secret verifies the remote permissions.

Verify access

Grant the machine identity read access to the intended project, environment, and path. Configure a non-production workload using the external-secret source guide, then deploy it to verify remote authorization. The integration’s configured indicator only verifies Towbar’s local configuration. If resolution fails, check the deployment’s secret stage, path, identity permissions, network reachability, and secret version. Rotate the client secret in YAML, restart Towbar, and deploy a test reference before revoking the old credential.

Infisical integration settings in Towbar.

The Infisical page confirms that Towbar loaded the runtime configuration; test a reference to verify remote access.

Overview

Source control

Container registries

Backup providers

External secrets

Platform services

Notifications

Prepare access

Verify access

​Prepare access

​Verify access

Prepare access

Verify access