Infrahub

Replace <vm-ip> with the public IP of your VM. The default login user is azureuser.

ssh azureuser@<vm-ip>

sudo systemctl is-active docker.service infrahub.service docker --version docker compose version

You should see active printed twice, the Docker Engine version, and the Docker Compose v2 plugin version.

cd /opt/infrahub && sudo docker compose --env-file .env ps

All seven containers should report Up. The ones with health checks should also report (healthy).

The stack is infrahub-server, task-manager, two task-worker replicas, database (Neo4j), task-manager-db (PostgreSQL), cache (Redis) and message-queue (RabbitMQ).

Every credential on this image is generated on first boot and is unique to your VM. Read them from the credentials file:

sudo cat /root/infrahub-credentials.txt

Keep this file safe. It contains your admin password and your API token.

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/api/config

HTTP 200 confirms the Infrahub server is up and serving.

This image publishes exactly one host port. The graph database that holds your source of truth is reachable only on the private container network, and so are PostgreSQL, Redis and RabbitMQ.

sudo ss -ltnH '! src 127.0.0.0/8' | awk '{print $4}' | sed 's/.*://' | sort -un

You should see 22 (SSH) and 80 (Infrahub) only. The Neo4j ports 7474 and 7687, the PostgreSQL port 5432, the Redis port 6379 and the RabbitMQ port 5672 must not appear.

Browse to http://<vm-ip>/ and sign in as admin with the password from Step 4.

After signing in, you land on the Infrahub home view. The left-hand navigation has the object explorer, the schema browser and the branch controls.

The schema is the heart of Infrahub. It lets you model your own infrastructure rather than accept a fixed data model.

Open Schema from the navigation to browse the node kinds currently loaded, their attributes and their relationships.

The Infrahub API is GraphQL. You can authenticate either with a session token from a password login, or directly with the API token from Step 4 using the X-INFRAHUB-KEY header. The token is simpler for scripting.

First, set your token as a shell variable, using the value from Step 4:

TOKEN='<INFRAHUB_API_TOKEN>'

Confirm it authenticates against a resource that requires authentication:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' \
  -H "X-INFRAHUB-KEY: $TOKEN" http://127.0.0.1/api/schema

HTTP 200 confirms the token is valid. The same request without the header is refused, because anonymous access is disabled on this image:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/api/schema

This step turns Infrahub into your source of truth. The following command loads a small schema that defines a Site node kind in a Demo namespace, with a name, a site code and a device count.

cat > /tmp/demo-schema.json <<'EOF' { "schemas": [ { "version": "1.0", "nodes": [ { "name": "Site", "namespace": "Demo", "label": "Site", "description": "A physical network site.", "default_filter": "name__value", "display_labels": ["name__value"], "attributes": [ { "name": "name", "kind": "Text", "unique": true }, { "name": "code", "kind": "Text", "optional": true }, { "name": "device_count", "kind": "Number", "optional": true } ] } ] } ] } EOF curl -s -o /dev/null -w 'HTTP %{http_code}\n' \
  -X POST 'http://127.0.0.1/api/schema/load?branch=main' \
  -H "X-INFRAHUB-KEY: $TOKEN" -H 'Content-Type: application/json' \
  --data-binary @/tmp/demo-schema.json

The schema is applied asynchronously. Confirm the new kind is live:

curl -s -H "X-INFRAHUB-KEY: $TOKEN" \
  'http://127.0.0.1/api/schema?branch=main' | grep -c DemoSite

A count of 1 or more confirms DemoSite is now part of your schema.

Now create an object of the kind you just defined, using a GraphQL mutation:

curl -s -X POST 'http://127.0.0.1/graphql' \
  -H "X-INFRAHUB-KEY: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"query":"mutation { DemoSiteCreate(data: {name: {value: \"london-1\"}, code: {value: \"LON1\"}, device_count: {value: 24}}) { ok object { id name { value } } } }"}'

Then read it back with a GraphQL query:

curl -s -X POST 'http://127.0.0.1/graphql' \
  -H "X-INFRAHUB-KEY: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"query":"query { DemoSite(name__value: \"london-1\") { edges { node { id name { value } code { value } device_count { value } } } } }"}'

The response contains the object you created, with the values you wrote. That round trip (define a schema, create an object, read it back) is Infrahub working end to end.

You can see the same object in the web interface under the object explorer.

Branching is the defining capability of Infrahub. Create a branch and make changes against it. The main branch stays untouched until you merge.

curl -s -X POST 'http://127.0.0.1/graphql' \
  -H "X-INFRAHUB-KEY: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"query":"mutation { BranchCreate(data: {name: \"demo-change\", description: \"trial change\"}) { ok object { id name } } }"}'

List your branches to confirm:

curl -s -X POST 'http://127.0.0.1/graphql' \
  -H "X-INFRAHUB-KEY: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"query":"query { Branch { id name description } }"}'

Queries and mutations can then be scoped to that branch by posting to /graphql/demo-change instead of /graphql.

In the web interface, the branch selector at the top of the page switches the whole view to your branch. Proposed Changes is where a branch is reviewed and merged.

The password from Step 4 is generated for your VM, but you should still set your own. In the web interface, open the account menu and change the password there.

Sign in to the AWS Marketplace, search for Infrahub by SecureAnyCloud, and choose Continue to Subscribe. Then choose Continue to Configuration and Continue to Launch.

Pick your region, an m5.2xlarge (or larger) instance type, your VPC and subnet, and your EC2 key pair. Choose a security group that allows SSH (22) from your admin network and HTTP (80) from the networks that use the application. Then launch the instance.

You can also launch the AMI directly. Resolve the product AMI id for your region from the listing, then run:

REGION="us-east-1" AMI_ID="<ami-id>"
# the Infrahub AMI id for your region KEY_NAME="your-key" SG_ID="sg-xxxxxxxx"
# allows 22 from your admin CIDR and 80 from your users SUBNET_ID="subnet-xxxxxxxx" aws ec2 run-instances \
  --region "$REGION" \
  --image-id "$AMI_ID" \
  --instance-type m5.2xlarge \
  --key-name "$KEY_NAME" \
  --security-group-ids "$SG_ID" \
  --subnet-id "$SUBNET_ID" \
  --associate-public-ip-address \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=infrahub}]'

On first boot, the image resolves the public IP of the instance through EC2 IMDSv2. The application therefore advertises the correct address with no manual configuration.

On the first boot of each instance, infrahub-firstboot.service regenerates every secret and initializes empty databases. It brings the stack up, verifies the admin login and the API-token round trip, and writes the credentials to a root-only file.

First boot brings up a seven-container stack, so allow a few minutes before the web UI is reachable. Retrieve the credentials over SSH:

sudo cat /root/infrahub-credentials.txt

The file contains the per-instance web URL, the admin username (admin) and password, and the per-instance API token:

infrahub.url=http://<instance-public-ip>/ infrahub.admin.user=admin infrahub.admin.pass=<INFRAHUB_ADMIN_PASSWORD> INFRAHUB_ADMIN_PASSWORD=<INFRAHUB_ADMIN_PASSWORD> INFRAHUB_API_TOKEN=<INFRAHUB_API_TOKEN>

These values are unique to your instance. Store them somewhere safe.

Infrahub runs as a Docker Compose stack under infrahub.service. Check the systemd units and the containers:

for s in docker.service infrahub.service; do printf "%-28s %s\n" "$s" "$(systemctl is-active $s)"; done
sudo docker compose --project-directory /opt/infrahub --env-file /opt/infrahub/.env ps \
  --format "table {{.Name}}\t{{.Service}}\t{{.Status}}"

All eight containers should report healthy:

docker.service active infrahub.service active NAME SERVICE STATUS infrahub-cache-1 cache Up 5 minutes (healthy) infrahub-database-1 database Up 5 minutes (healthy) infrahub-infrahub-server-1 infrahub-server Up 4 minutes (healthy) infrahub-message-queue-1 message-queue Up 5 minutes (healthy) infrahub-task-manager-1 task-manager Up 5 minutes (healthy) infrahub-task-manager-db-1 task-manager-db Up 5 minutes (healthy) infrahub-task-worker-1 task-worker Up 4 minutes infrahub-task-worker-2 task-worker Up 4 minutes

The application answers on port 80. /api/config confirms the hardened defaults, with anonymous access and telemetry both off:

curl -sS http://localhost/api/config | python3 -c 'import json,sys; m=json.load(sys.stdin)["main"]; print("allow_anonymous_access:", m["allow_anonymous_access"]); print("telemetry_optout:", m["telemetry_optout"])'

allow_anonymous_access: False telemetry_optout: True

Browse to http://<instance-public-ip>/ and sign in as admin with the password from the credentials file.

After signing in, you land on the dashboard. It shows open proposed changes, your branches, connected Git repositories, recent activity and the task overview:

Infrahub is schema-driven. Every kind of object you store is defined by a schema.

Open Object Management to browse the built-in Core schema and to load your own node and generic kinds. Each kind has attributes and relationships that model your infrastructure domain:

You can load a schema from the UI or by posting it to the API. For example, to load a schema definition file:

API_TOKEN="<INFRAHUB_API_TOKEN>"
# from /root/infrahub-credentials.txt curl -sS -X POST 'http://<instance-public-ip>/api/schema/load?branch=main' \
  -H "X-INFRAHUB-KEY: $API_TOKEN" \
  -H 'Content-Type: application/json' \
  --data-binary @my-schema.json

Every change can be made on a branch and reviewed as a proposed change before it merges to main. This gives you version control over your infrastructure data.

Open Branches to see the default branch and create new ones:

Infrahub exposes a GraphQL API at /graphql. Authenticate with the per-instance API token from the credentials file. For example, count the accounts in the source of truth:

API_TOKEN="<INFRAHUB_API_TOKEN>"
# from /root/infrahub-credentials.txt curl -sS -X POST 'http://<instance-public-ip>/graphql' \
  -H "X-INFRAHUB-KEY: $API_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"query":"query { CoreAccount { count } }"}'

{"data":{"CoreAccount":{"count":2}}}