Terrateam

Terrateam is an open-source, self-hosted platform that automates infrastructure changes through GitOps workflows. It integrates directly with pull requests to plan, validate, and deploy infrastructure code. The software is deployed as a server and uses private runners to execute tasks, ensuring that state and secrets remain under the user's control. This architecture allows teams to maintain full sovereignty over their infrastructure data while benefiting from automated orchestration.

The tool supports a wide range of infrastructure-as-code tools and is designed for scale, whether managing a few workspaces or thousands across monorepos. It uses a tag-based configuration system to define rules that apply across multiple environments, which prevents the need for repetitive manual configuration. Users can track every run, view detailed execution logs, and debug failures through a built-in user interface included in the open-source version.

Key features

• Support for OpenTofu, Terragrunt, CDKTF, and Pulumi
• Automation of plans and applies within GitOps pull requests
• Policy enforcement using OPA, Rego, and Checkov
• Infrastructure drift detection and cost estimation
• Tag-based configuration for managing large numbers of workspaces
• Parallel execution with apply-only locking
• Integration with OIDC for secure authentication
• Coordination of cross-environment dependencies
• Full UI for tracking runs and viewing execution logs

Terrateam is written in OCaml and is stateless by design. It allows for the definition of complex rules based on tags, such as requiring specific team approvals for production environments. The system is built to handle monorepos and complex dependency chains without performance degradation. It can be deployed via Docker Compose for self-hosting, allowing users to manage their own runners and state files. The software can also be used in conjunction with Stategraph to replace flat state files with a database for faster plans and better visibility.

Terrateam is a scalable orchestration layer for teams requiring secure, policy-driven infrastructure automation across diverse cloud environments.