Firstlume
ENPT PT Talk to us

See every resource before it changes.

Firstlume plans your OpenTofu, Terraform and Terragrunt code, shows what will change resource by resource, waits for approval and applies exactly what was planned.

Talk to us Read the docs

From commit to apply, with nothing hidden.

01

Plan

Each phase runs in a short-lived Kubernetes Job. The plan records the commit and keeps the plan file, encrypted.

02

Review

Delete, replace, update, create: every resource gets its own card and diff. A replace is always shown as a replace.

03

Approve

Required by default, configurable per stack. One run at a time holds a stack; the others wait in line.

04

Apply

Checks out the planned commit and applies that plan file. You follow each resource: finished, failed or never reached.

Deleting or replacing takes its own yes.

Turn on one setting, and the approve button stays locked until someone confirms, resource by resource, each thing the plan will delete or recreate. The server checks it too, and the run records what was confirmed and by whom. It's off by default, and folders and stacks inherit it.

Built for the infrastructure you already have.

State that stays yours

An HTTP backend, with no plugin. Lock per unit and immutable, encrypted versions, in Postgres or any S3-compatible storage. Import the state you have today, or use only the state while your current CI keeps running.

terraform {
  backend "http" {}
}

Drift detection

Check on a schedule, from every 15 minutes to every 7 days. A drift run is a plan that never applies and never asks for approval. The result stays on the stack.

Terragrunt

run --all with one state per unit. Each unit saves when its apply ends, so one failure doesn't lose the others.

Vault, not a second vault

The runner reads secrets with a JWT issued per phase. Values never pass through the server or the database.

Inherited settings

Variables, secrets and approval rules flow from the organization through folders to each stack. The nearest level wins.

Declared in the repo

.firstlume/config.yaml sets the engine and version and writes HCL, JSON, YAML, env and raw files per folder, before init.

Registry credentials

Logins for Harbor, GHCR, Docker Hub and private Terraform registries, inherited by host and masked in the logs.

Gitea today

Connect Gitea, sign in with it, and Firstlume finds the .firstlume folders in your repos. GitHub and GitLab are planned.

In your cluster or on ours. You choose.

One binary, one image and one Helm chart. The agent asks for work, so it can run in another cluster or network without the API reaching it. Runners on our infrastructure are planned, for teams that prefer not to run them.

  • Each run's Job is non-root, has a read-only filesystem and is never retried
  • Cloud credentials come from the pod's identity (IRSA, Workload Identity)
  • Secrets, tokens and plans are encrypted with AES-256-GCM and masked in logs
Read the install guide 
helm install firstlume deploy/helm/firstlume \
  -n firstlume --create-namespace \
  --set controlPlane.database.url='postgres://…'

Two ways to run it.

Self-hosted

Install it with Helm in your own Kubernetes cluster. Your team runs it.

  • Your database and your S3-compatible storage
  • Your secrets stay in your Vault
  • Agents in as many clusters as you need
Talk to us about self-hosting

With us

All the control, none of the upkeep. We set it up, keep it running and handle the upgrades. Your team just reviews and approves.

  • No platform for your team to install or maintain
  • Runners on our infrastructure (planned) or in your cluster, your call
  • Connect your Git and your code, and start reviewing plans
  • Scope and pricing built around your team
Talk to us about your setup

What exists, and what's next.

Firstlume is in active development. This list separates what you can use today from what is only planned.

Available today

  • Plan and apply with review per resource and configurable approval
  • Per-resource confirmation for deletes and replaces (optional setting)
  • Apply progress per resource
  • Scheduled drift detection
  • State backend: locks, versions, encryption, import and state-only tokens
  • State in Postgres, S3-compatible storage or the organization's own bucket
  • Terragrunt with run --all
  • Declared files, Vault secrets and registry credentials
  • Organizations, folders and stacks, with inherited settings
  • Sign-in through Gitea (OIDC) and invitations
  • Web UI, Kubernetes agent and Helm chart

Planned

  • GitHub and GitLab
  • Plan on pull request, commit status, apply on merge
  • Native Terragrunt: one run per unit, dependency graph, agents by network or zone
  • Approvers by person or group, finer roles and an audit trail
  • OpenTelemetry export and notifications (webhook, Slack, Rocket.Chat)
  • Hooks per phase, scheduled tasks and OPA policies
  • Runners on our infrastructure, for customers who choose them
  • Backup, restore and high availability

Want to see it on your infrastructure?

Write to hello@firstlume.io and tell us what you run today.

Talk to us Read the docs