Skip to main content
← back to extensions

Opentofu

@vcjdeboer/opentofuv2026.10.23.2· 3d agoBEHAVIORSACCEPTED WARNINGS
01README

Plan and apply OpenTofu through a sha-bound gate.

A plan is saved outside the repository and recorded only as its sha256, counts and an address-and-action summary. apply runs a private copy of exactly that plan file, and only when the sha256 passed back after review matches it, HEAD and the configuration are unchanged, the plan is fresh, and the file itself holds no delete, replace or forget the definition does not permit. Stale plan files are removed. Pinned tofu and provider versions (optionally an h1-checked filesystem mirror), fixed argv, a closed environment, and no state, plan contents or credential values in any record or log.

02Behaviors1
@vcjdeboer/opentofuv2026.10.23.2opentofu/opentofu.ts

Global Arguments

ArgumentTypeDescription
tofuBinstringAbsolute path of the tofu binary; nothing else on PATH is used
tofuVersionstringThe tofu version tofuBin must report
providers?recordExactly the providers the configuration may use, source to version; any other is refused
configDirstringThe configuration directory, relative to the swamp repository; it must be tracked by git
cliConfigFile?stringA CLI configuration file directly in configDir (TF_CLI_CONFIG_FILE); without one tofu gets /dev/null, never ~/.tofurc
providerMirror?stringAn unpacked filesystem mirror; when set, cliConfigFile must name only it and the lock's h1 must be the mirror's
env?recordThe only extra environment tofu gets (e.g. AWS_PROFILE, AWS_REGION); values may be vault expressions
extraPath?arrayDirectories added to tofu's PATH after tofuBin's own (e.g. for a credential helper)
outputs?arrayThe outputs the output method records; each must exist and be non-sensitive
expectedAddresses?arrayManaged resource addresses the state must hold; the output record lists the missing ones
rules?arrayConfiguration rules checked by validate and plan
permitActions?arrayDestructive actions an apply may take; by default a plan with any delete, replace or forget is refused
allowMixedImport?booleanWhether a plan that imports may also create or update; by default an import plan may only import
planMaxAgeMinutes?numberThe age after which a saved plan is refused
timeouts?objectSeconds per tofu run (plan 900, apply 1800, other 300)
fn version()
tofu version -json; refuses any tofu or provider version other than the pinned ones
fn validate()
The definition's configuration rules, the lock file against the provider pins (and the mirror's h1), then init -backend=false and validate in a temporary data directory: no backend, no credential
fn init()
init with the configured backend and -lockfile=readonly, on a clean committed configuration
fn plan()
A saved plan in ~/.swamp-opentofu/<definition>/plans (0600): exit kind, sha256, counts and an address-and-action summary recorded; logs the tofu show command to read it; first removes saved plan files older than planMaxAgeMinutes
fn apply()
Apply a private copy of exactly the saved plan planId whose sha256 is given; refused (and recorded) on a sha, commit or configuration mismatch, a stale plan, a version change, a destructive action not permitted (read from the plan file itself), an import plan that also creates or updates, or a plan already applied
fn output()
Record the allowlisted non-sensitive outputs and the state's managed addresses; refuses a missing or sensitive allowlisted output
03Previous Versions2
2026.10.23.1
2026.10.22.1
04Stats
A
93 / 100
Downloads
4
Archive size
45.1 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License1/2partial

    no SPDX license declared

  • Verified public repository2/2earned
Repository
https://github.com/vcjdeboer/swamp-opentofu

06Platforms
07Labels
#opentofu#terraform#iac#infrastructure#plan-apply