Firstlume
Firstlume plans your OpenTofu, Terraform and Terragrunt code, shows what will change resource by resource, waits for approval and applies exactly what was planned.
Each phase runs in a short-lived Kubernetes Job. The plan records the commit and keeps the plan file, encrypted.
Delete, replace, update, create: every resource gets its own card and diff. A replace is always shown as a replace.
Required by default, configurable per stack. One run at a time holds a stack; the others wait in line.
Checks out the planned commit and applies that plan file. You follow each resource: finished, failed or never reached.
An HTTP backend, with no plugin. Lock per unit and immutable, encrypted versions, in Postgres or any S3-compatible storage. Import the state you have today, or use only the state while your current CI keeps running.
terraform {
backend "http" {}
}
Check on a schedule, from every 15 minutes to every 7 days. A drift run is a plan that never applies and never asks for approval. The result stays on the stack.
run --all with one state per unit. Each unit saves when its apply ends, so one failure doesn't lose the others.
The runner reads secrets with a JWT issued per phase. Values never pass through the server or the database.
Variables, secrets and approval rules flow from the organization through folders to each stack. The nearest level wins.
.firstlume/config.yaml sets the engine and version and writes HCL, JSON, YAML, env and raw files per folder, before init.
Logins for Harbor, GHCR, Docker Hub and private Terraform registries, inherited by host and masked in the logs.
Connect Gitea, sign in with it, and Firstlume finds the .firstlume folders in your repos. GitHub and GitLab are planned.
One binary, one image and one Helm chart. The agent asks for work, so it can run in another cluster or network without the API reaching it. Runners on our infrastructure are planned, for teams that prefer not to run them.
helm install firstlume deploy/helm/firstlume \ -n firstlume --create-namespace \ --set controlPlane.database.url='postgres://…'
Install it with Helm in your own Kubernetes cluster. Your team runs it.
All the control, none of the upkeep. We set it up, keep it running and handle the upgrades. Your team just reviews and approves.
Firstlume is in active development. This list separates what you can use today from what is only planned.
run --allWrite to [email protected] and tell us what you run today.