Infisical

# MISSION: Scaffold "Infisical" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Infisical**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Infisical
- **What It Does**: Infisical is an open-source platform for secrets, PKI certificate, and privileged access management, with a React/Vite dashboard, a Node.js/TypeScript API on PostgreSQL, a companion Go service for KMS and HSM-backed keys, and ClickHouse for audit logs.
- **Domain & Category**: Secret Management
- **Production Scale**: 6-20 people
- **Development Mode**: HYBRID
- **Architectural Rationale**: Audit logs are split into ClickHouse for analytical-scale queries, key-management and HSM/PKCS11 operations run in a separate Go service backed by Redis task queues, and dynamic-secret rotation for Oracle and SAP ASE ships with vendored native drivers baked into the backend image.
- **Live Website Reference**: https://infisical.com
- **Source Repository**: https://github.com/Infisical/infisical
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: React, TypeScript, Vite, Go, PostgreSQL, ClickHouse, Redis, Docker, Rust
- **Primary Language(s)**: TypeScript, Go, Gherkin, Python
- **License of the reference repo**: NOASSERTION
- **Frontend**: React — Renders the dashboard SPA in frontend/, using Zustand for state and CASL for permission checks.; Vite — Dev server and bundler for the frontend app.; Tailwind CSS — Utility CSS framework for the dashboard UI.
- **Backend & APIs**: Node.js / TypeScript API — Main backend in backend/, run with tsx in dev and bundled with tsup; exposes the REST API the dashboard and CLI use.; Go service (backend-go) — A second Go module alongside the Node backend, with AWS/GCP KMS clients, chi routing, and a Postgres driver.; Knex — Migration and query tooling for the Postgres schema, invoked through migration:* and seed npm scripts.
- **Data & persistence**: PostgreSQL — Primary relational store for secrets, users, and org data, migrated and queried through Knex with the pg client.; ClickHouse — Separate store for audit logs, with its own migration path distinct from the Postgres knex migrations.; Redis — Used by the Go service as a Redis-backed task queue (asynq) and cache client (go-redis).
- **Infrastructure & deploy**: Docker — Root Dockerfile.standalone-infisical (plus a FIPS variant) builds the all-in-one self-hosted image.; Helm — Charts for the gateway, NKP, and standalone-Postgres deployment topologies.; PKCS11 / HSM support — Native pkcs11js build dependencies in the backend image and a Go PKCS11 client for hardware-backed keys.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/Infisical/infisical @ 6a258bb)
1. **Audit logs are written to ClickHouse, separate from the Postgres relational store**: backend/package.json defines a clickhouse-migration:latest script (running src/db/run-clickhouse-migrations.ts) distinct from the knex-based migration:* scripts used for the main Postgres schema, so audit-log writes and analytical queries do not compete with transactional Postgres load.
2. **Postgres schema changes go through hand-written Knex migrations, not an ORM**: backend/package.json scripts (migration:up, migration:latest, migration:rollback) all invoke knex --client pg against knexfile.ts/knexfile.mjs, and auditlog-migration:* scripts run a parallel Knex migration set for the audit-log tables.
3. **A second Go module runs alongside the Node backend for KMS and keyed operations**: backend-go/go.mod (module github.com/infisical/api) depends on AWS KMS and GCP KMS clients, github.com/jackc/pgx/v5 for Postgres, github.com/redis/go-redis/v9 and github.com/hibiken/asynq for Redis-backed task queuing, and the chi router, indicating key-management and background-job work is handled outside the TypeScript backend process.
4. **Hardware security module support requires native PKCS11 bindings in both runtimes**: backend/Dockerfile installs python3, make, and g++ specifically to compile pkcs11js during npm ci, and backend-go/go.mod depends on github.com/ThalesGroup/crypto11 and github.com/miekg/pkcs11, so HSM-backed keys are supported from both the Node and Go sides.
5. **Dynamic secrets for Oracle and SAP ASE ship with vendored native drivers**: backend/Dockerfile has a dedicated oracle build stage that downloads and checksum-verifies the Oracle Instant Client, and installs freetds-dev/unixodbc-dev at build time and freetds-bin/libaio1t64/smbclient at runtime, so rotating dynamic secrets against Oracle, SAP ASE, and MSSQL does not depend on drivers being present on the host.
6. **Remote session recording for the PAM gateway is decoded in the browser via Rust-to-WASM**: wasm/ironrdp-decoder/Cargo.toml builds a wasm-bindgen crate on top of the ironrdp-* crates for "offline session replay," matching the @devolutions/iron-remote-desktop-rdp dependency in frontend/package.json used to render RDP sessions in the dashboard.
7. **Self-hosting ships as one all-in-one image plus separate Helm charts per topology**: Dockerfile.standalone-infisical (and a FIPS variant, Dockerfile.fips.standalone-infisical) build a single combined image, while helm-charts/infisical-gateway, helm-charts/infisical-nkp, and helm-charts/infisical-standalone-postgres are separate charts for gateway, NKP, and standalone-Postgres deployments.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Utilize Vite 6 with TanStack Router for fully type-safe routing. Manage server state and caching via TanStack Query v5 with optimistic UI updates.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (PostgreSQL, ClickHouse, Redis): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.