.env files were fine until migrations, rotations, Kubernetes, OIDC, and app sprawl turned them into a liability.
June
At small scale, .env files felt good enough. Then the environment grew. Apps moved hosts. Docker gave way to k3s. OIDC secrets regenerated. Databases stayed external. App configs needed to be restored, moved, and updated.
.env filesSuddenly, secrets were not just “configuration.” They were scattered operational risk.
Infisical became part of the platform foundation before the k3s app migration. Secrets could be stored centrally and delivered into Kubernetes through the operator instead of recreating the same .env sprawl in a new format.
A secret copied everywhere is not really a secret.
paste commands hereSingle sign-on sounds simple until Authentik, Pangolin, app callback URLs, headers, secrets, internal routes, and public routes all need to agree on reality.
June
The goal was simple: use SSO for self-hosted apps exposed through the homelab routing stack. The reality was not simple.
Some apps supported OIDC cleanly. Some needed proxy auth. Some cared deeply about callback URLs. Some needed internal SSL validation disabled. Some broke when provider secrets changed. Authentik provider edits could regenerate client secrets, which meant app environment variables and restarts had to stay in sync.
The actual work was not “turn on OIDC.” It was making the browser, app, proxy, identity provider, internal route, public route, and secrets all agree on the same story.
OIDC works great once every tiny little liar in the chain agrees on reality.
paste commands here