Platform
The infrastructure as code platform for OpenTofu.
StackShip is an infrastructure as code platform for OpenTofu. Every configuration gets a workspace with remote state, variables, a run queue, and a GitHub source.
What's included
Everything your OpenTofu workflow needs.
- 01
Projects and workspaces
Group workspaces by project. Each owns its state, variables, and runs.
- 02
Remote state with history
Every write is a state version you can inspect, restore, or download.
- 04
Private module registry
Push a semver tag on GitHub to publish a module version.
- 05
GitHub pull request runs
Pull requests get plans. Pushes to your branch start runs.
- 06
Short-lived cloud credentials
AWS, Google Cloud, and Azure access without stored keys.
How it's organized
Organizations, projects, and workspaces.
Organizations contain projects. Projects group workspaces. Workspaces do the work.
Organization
Your team's account: members, SSO, roles, and the audit log.
Project
A folder that groups related workspaces.
Workspace
One OpenTofu configuration with its own state, variables, and run queue.
Integrations
Connect GitHub, AWS, Google Cloud, and Azure.
GitHub for source. Federated identity for your clouds. Write-only secrets for everything else.
- GitHub App
- Pull request plans, GitHub checks, and runs on push.
- AWS
- Short-lived federated credentials for every run.
- Google Cloud
- Short-lived federated credentials for every run.
- Microsoft Azure
- Short-lived federated credentials for every run.
- Any other provider
- Write-only secrets, exposed as environment variables.
# Private module registrymodule "network" { source = "stackship.run/acme/network/aws" version = "~> 1.2"} # Publish a new versiongit tag v1.3.0git push origin v1.3.0FAQ
Remote state and workspace questions
Where is OpenTofu state stored?
In StackShip. Every write creates a new state version you can inspect, download, or restore. Runs and local tofu commands share one lock, so only one writer changes state at a time.
Can workspaces share outputs with terraform_remote_state?
Yes. Grant a workspace outputs access for tfe_outputs, or state access for terraform_remote_state. No extra tokens are needed, and every full-state read is audited.
Where do runs execute?
StackShip runs each plan and apply in a fresh, isolated Linux environment that is discarded after the phase. There are no runners to install or maintain.
How does the private module registry work?
Link a GitHub repository to a module and push a semver tag. Each tag becomes a module version you reference as source = "stackship.run/<org>/<name>/<system>".
Get started
Run your first plan today.
Free for every organization. Sign up with email or Google.