Documentation

Install it in thirty seconds, connect an AWS account, and run it: every page here is generated from the repository or rendered from the documents operators actually follow.

Install

Thirty seconds to a running product with a fabricated estate, then the same command for a real one.

Capabilities

What the self-hosted build does and does not do: each capability's status, every module that runs with the IAM actions it makes, what is never read, and the versions it is tested on.

Connect AWS

The reader role, the management account, discover, verify, enable — the exact permission list, rendered from the template that creates the role — and the second role that reads a Cost & Usage Report.

Configuration reference

Every variable each role reads, with its default and the reasoning beside it — generated from the annotated example files, which remain the authority.

API reference

The contract, rendered: every operation with the credential, module and role it requires, its parameters, bodies and responses, and every schema.

Licensing

How to obtain, install and renew a licence, what happens when one lapses, and what a build with no key can do.

Security

The self-assessment — every isolation and fail-closed invariant with the test that holds it — the scanners, the pen-test scope, and how to report a vulnerability.

Operations

The runbook — the queue, a failing collector, migrations, token rotation, the public page, the demo tenant, limits and scanners — and the collector how-to.

Provisioning agent

Install, configure, verify, upgrade and revoke the agent that runs OpenTofu in your account — and what it can never do.

Changelog

One entry per tagged release, written by hand at the tag.

The first ten questions

The ones a new deployment asks, each answered by one page.