Known limitations

These are the limits of Firstlume as it stands, and what to do about them where something can be done.

Sign-in and roles

Sign-in is through Gitea (OIDC) or the admin token, with a single role per organization. Anyone in a group of auth.oidc.adminGroups sees every organization. Everyone else sees only those they were invited to, and every member is an administrator of the organization. Finer roles and approvers by person or group are planned.

Canceling a running run

Canceling a run in progress isn't supported, on purpose: interrupting an apply can corrupt the state. Queued runs can be canceled.

Tools are downloaded on each run

Terraform, OpenTofu and Terragrunt come from their official releases, with the SHA256 checksum verified, on every run. The executor needs outbound internet access, or a mirror, which can't be configured yet.

Terraform license

Terraform versions 1.6 and later are under the BSL. To offer the platform commercially, use engine: opentofu or Terraform ≤ 1.5.7.

Not built yet

• GitHub and GitLab integration. Today, repositories on any Git host can be used by clone URL, and runs start from the UI, the API or the drift schedule
• Native Terragrunt units: run_all is one run for all units
• The State tab in the UI: versions, diff, rollback and forced unlock
• Reading an organization's bucket credential from Vault, and moving versions between storages
• Moving folders, and removing an inherited variable at a lower level