Terraducktel plans, scans, and gates every Terraform and Helm change before it touches production — running entirely on your own docker compose, for the cost of nothing per seat.
Terraform Cloud, Spacelift, and friends are great — until the per-seat bill lands, or your state and cloud credentials leave your network. Terraducktel is the boring version of the same idea: a small FastAPI orchestrator, Postgres, and your own cloud storage.
Every run walks the same gated path — clone, scan, plan, price, approve, apply — and every step is visible while it happens, not after.
Grouped by cloud account and region, with live drift status and a running count of what's waiting on you. Import a whole repo's worth of stacks in one pass, or add workspaces by hand.
Each run streams its output live: git clone, security scan, Terraform plan, OPA policy check, cost estimate. If something's going to fail, you see exactly where.
Every apply parks at awaiting_approval until an operator reviews the exact plan and clicks approve. Any operator — including whoever triggered it. Every decision lands in the audit log.
One gated pipeline across all three clouds. Register accounts, subscriptions, or projects; the executor injects the right provider credentials per run.
Keep Terraform state in S3, Azure Blob, or GCS — chosen per workspace. Each AWS account still gets its own dedicated bucket, and the state path mirrors your git layout, 1:1.
AWS keys, GitHub PATs, Slack URLs — Fernet-encrypted with an HKDF-derived key. Plaintext never leaves the request handler.
A background worker periodically plans every workspace and surfaces drift right on the dashboard.
Point it at a repo that follows account/region/leaf and bulk-import every stack, with environment auto-detected per leaf.
Target a Kubernetes cluster instead of an AWS account. helm diff replaces plan, same approval FSM, same audit trail.
Each BU owns its own accounts, clusters, and workspaces. Superadmins see across all of them for break-glass ops.
Clone it, set four values in .env, and bring up Postgres, LocalStack, the API, and the UI. Sign in with the seeded admin account and import your first workspace straight from Git.
# clone & configure git clone https://github.com/mormor83/terraducktel.git cd terraducktel && cp .env.example .env # bring it up docker compose up -d postgres localstack api ui docker compose exec -T api alembic upgrade head docker compose exec -T api python scripts/seed_dev_users.py # → http://localhost:3001 # → admin@test.com / password123
MIT licensed, no telemetry, no seat count. Fork it, run it, break it, fix it.
