feat(selfhost): optional Infisical secrets management for self-host deploys

[claytonlin1110]

Summary

• Adds a maybe_infisical_run helper (scripts/lib/selfhost-deploy-common.sh) that prefixes a command with infisical run -- when SELFHOST_USE_INFISICAL=1 is set — Infisical's own intended integration shape, wired in at the deploy-script level with zero application code changes (src/ never knows or cares which mechanism supplied a given env.SOMETHING).
• Strictly opt-in and additive: with the flag unset (the default), neither deploy script even checks whether the infisical binary exists — an operator who has never heard of Infisical is completely unaffected.
• Wired into both deploy-selfhost-image.sh and deploy-selfhost-prebuilt.sh, but only at the restart (docker compose up) step — the actual container process launch — not the image pull/build steps, which don't need injected secrets.
• Documents setup (Infisical Cloud vs. a self-hosted Infisical instance, project/environment mapping) in docs/self-hosting-security, plus — importantly — the real technical boundary of this integration: infisical run -- only injects vars into its own child process's environment, which Docker Compose only picks up for environment: entries using ${VAR} interpolation, not for the blanket env_file: .env passthrough the native-secrets list (GitHub App key, webhook secret, API/MCP tokens, etc.) already uses. The docs are explicit that Infisical is additive for other variables, not a drop-in override for those pre-wired secrets — so operators don't assume broader coverage than the integration actually has.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Closes #5120

Validation

• git diff --check
• npm run actionlint (ran as part of npm run test:ci)
• npm run typecheck
• npm run test:coverage — ran the full suite; 48 test files / 130 tests fail identically on a clean upstream/main checkout with zero changes (confirmed by stashing this PR's diff and re-running on the exact same base commit) — pre-existing, broad Windows-environment flakiness (subprocess-timing, symlink-handling, and native-SQLite-behavior tests) unrelated to this change. None of the failing files are ones this PR touches.
• npm run ui:lint
• npm run ui:typecheck
• New/changed logic has unit tests: test/unit/selfhost-deploy-common.test.ts (new — covers maybe_infisical_run's opt-in/opt-out and fail-closed-when-missing branches directly) and test/unit/selfhost-image-deploy.test.ts (extended — confirms the wrapper is actually wired into the real deploy script's restart step, and only that step)

If any required check was skipped, explain why:

• npm run cf-typegen:check (part of npm run test:ci) fails locally on this Windows dev machine with a wrangler ENOENT — scripts/gen-cf-typegen.mjs calls execFileSync("wrangler", ...) without shell: true, which cannot invoke npm's .cmd shim on Windows (reproduces in isolation, independent of any change in this PR; passes fine on the actual CI's Linux runners). Every step in npm run test:ci before that point passed.
• This issue's own "Verified end-to-end against a real Infisical project (secrets actually resolve into the running container)" deliverable was NOT performed. I don't have a real Infisical account/project available in this environment, and fabricating that verification would be dishonest. What I did verify, with a fake infisical binary standing in for the real CLI: the opt-in flag genuinely gates whether infisical is invoked at all (both directions), the wrapper fails closed with a clear error when SELFHOST_USE_INFISICAL=1 but the infisical binary isn't installed (rather than silently deploying without the secrets an operator asked for), and only the restart/up step is wrapped, not pull. A maintainer or another contributor with a real Infisical account should verify end-to-end before this integration is fully trusted — the shell-level wrapping logic is solid, but I cannot personally attest that real Infisical-sourced secrets resolve into a running container.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — deploy-script + docs only.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — the only UI-adjacent change is a static docs page.)
• Visible UI changes include a UI Evidence section. N/A — this PR's only apps/loopover-ui change is a static documentation page (new prose section on an existing docs route); no interactive/stateful UI surface to screenshot.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (docs/self-hosting-security updated; no changelog edit.)

Notes

• Per the issue's requirement feat(docs): add install site and mcp diagnostics #1, the default .env + Docker Compose secrets: path is untouched and unaffected — confirmed by the existing selfhost-image-deploy.test.ts suite's pre-existing tests all still passing unmodified alongside the new Infisical-specific ones.
• See the "Validation" section above for the honest scope of what's verified vs. what still needs a real Infisical account to confirm.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.06%. Comparing base (7d59907) to head (498e192).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5785   +/-   ##
=======================================
  Coverage   95.06%   95.06%           
=======================================
  Files         580      580           
  Lines       46156    46156           
  Branches    14804    14804           
=======================================
  Hits        43880    43880           
  Misses       1516     1516           
  Partials      760      760           

Flag	Coverage Δ
shard-1	43.93% <ø> (ø)
shard-2	35.77% <ø> (ø)
shard-3	32.26% <ø> (ø)
shard-4	32.95% <ø> (ø)
shard-5	31.75% <ø> (ø)
shard-6	44.63% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-14 15:41:56 UTC}

6 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds an opt-in `maybe_infisical_run` shell wrapper that prefixes the docker compose restart step with `infisical run --` when `SELFHOST_USE_INFISICAL=1`, wired into both self-host deploy scripts with zero application-code changes, plus thorough docs explaining the `env_file` vs `environment:` interpolation limitation. The implementation is correct and minimal: default path is an untouched passthrough, the wrapper is applied only at the container-launch step (not pull/build), it fails closed via `require_cmd infisical` when the binary is missing, and tests exercise all four branches (default/off/on/missing-binary) with a fake infisical binary that proves the command actually flows through it. The docs URLs to infisical.com are expected external references for an optional third-party integration, not something that should be config-driven.

Nits — 4 non-blocking

• scripts/lib/selfhost-deploy-common.sh:82-100 — the comment block on `maybe_infisical_run` is quite long (14 lines); consider trimming to the non-obvious constraint (must wrap `up`, not `pull`/`build`) and moving the rest to the docs page which already covers it.
• The docs page (apps/loopover-ui/src/routes/docs.self-hosting-security.tsx) links to infisical.com and infisical CLI docs with `target="_blank" rel="noreferrer"`; consider `rel="noopener noreferrer"` for consistency with other external links in this file if that's the existing convention.
• scripts/lib/selfhost-deploy-common.sh:88-90 — if a future variable needs `env_file` passthrough via Infisical, the docs already flag this; no action needed now but worth a follow-up issue if operators request it.
• test/unit/selfhost-deploy-common.test.ts and selfhost-image-deploy.test.ts together cover all four states of the flag well; no additional coverage needed.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5120
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 381 registered-repo PR(s), 253 merged, 104 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	claytonlin1110; Gittensor profile; 381 PR(s), 104 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: claytonlin1110
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, JavaScript, TypeScript, Rust
• Official Gittensor activity: 381 PR(s), 104 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/docs/self-hosting-security	desktop			—
/docs/self-hosting-security	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.