Infrahub Git Credential Helper

Git credential helpers for Infrahub. These tools allow git processes to authenticate against repositories managed by Infrahub by fetching credentials from the Infrahub GraphQL API.

Binaries

infrahub-git-credential

A git credential helper that implements the get, store, and erase subcommands. When git needs credentials for a remote, this helper queries Infrahub for the repository's stored credentials. store and erase are no-ops: the helper never writes to or deletes from Infrahub.

Requires credential.useHttpPath to be enabled:

git config --global credential.useHttpPath true

infrahub-git-askpass

A GIT_ASKPASS helper. When git needs a username or password, it calls this program with a prompt string and reads the response from stdout.

Configuration

Configuration is resolved in the following order:

Setting	Environment Variable	TOML Config	Default
Server address	INFRAHUB_INTERNAL_ADDRESS	[main].internal_address	-
API token	INFRAHUB_API_TOKEN	-	None
Config file path	INFRAHUB_CONFIG	-	infrahub.toml
Username	INFRAHUB_USERNAME	-	None
Password	INFRAHUB_PASSWORD	-	None
Timeout (seconds)	INFRAHUB_TIMEOUT	-	30
Proxy	INFRAHUB_PROXY	-	None
Skip TLS verification	INFRAHUB_TLS_INSECURE	-	false
Custom CA certificate	INFRAHUB_TLS_CA_FILE	-	None

Authentication supports two methods:

• Token auth: set INFRAHUB_API_TOKEN — sent as X-INFRAHUB-KEY header
• Password auth: set INFRAHUB_USERNAME and INFRAHUB_PASSWORD — logs in via /api/auth/login to obtain a bearer token

Both binaries also accept --config-file <path> to override the config file path.

Environment variables take precedence over TOML values.

Installation

The binaries are published to PyPI as a maturin-built wheel (the same distribution model as ruff and ty). Installing the package places both infrahub-git-credential and infrahub-git-askpass on your PATH, so any Python project manager works:

uv add infrahub-git-credential-helper
# or
pip install infrahub-git-credential-helper
# or
poetry add infrahub-git-credential-helper

This is the recommended way to bundle the helpers into a Python application (such as the Infrahub server): add it as a dependency and the binaries are installed into the environment's bin/ directory alongside any console scripts. Wheels are provided for Linux and macOS on both amd64 and arm64; they are independent of the Python version. See dev/PACKAGING.md for how this is built and published.

Building

cargo build --release

Binaries are output to target/release/infrahub-git-credential and target/release/infrahub-git-askpass.

Docker

The project includes a multi-stage Dockerfile that produces statically linked binaries (musl) in a scratch-based image. Supports both amd64 and arm64 architectures.

docker build -t registry.opsmill.io/opsmill/infrahub-git-credential-helper .

Use in a downstream Dockerfile:

COPY --from=registry.opsmill.io/opsmill/infrahub-git-credential-helper:latest /usr/bin/infrahub-git-credential /usr/bin/infrahub-git-credential
COPY --from=registry.opsmill.io/opsmill/infrahub-git-credential-helper:latest /usr/bin/infrahub-git-askpass /usr/bin/infrahub-git-askpass

License

This project is licensed under the Apache License, Version 2.0. See LICENSE.txt for details.