Getting started

What TFsmith does

TFsmith turns your identity tenant into Terraform. Connect a tenant with a READ-ONLY admin API token, browse every exportable object in a clean UI, and click any object for a hand-written-quality Terraform resource block with a matching import block - or export a whole-tenant bundle zip that terraform plan can adopt in one pass. Okta, Auth0, and Authentik at launch.

TFsmith is read-only by architecture: it never writes to your tenant, and secrets are never emitted into HCL - they become sensitive Terraform variables.

Deploy (Docker)

TFsmith ships as a single container plus Postgres. A minimal compose:

services:
  tfsmith:
    image: ghcr.io/keltech-services/tfsmith:latest
    ports: ["8080:8080"]
    environment:
      TFSMITH_DATABASE_URL: postgresql+psycopg://tfsmith:CHANGE_ME@tfsmith-db/tfsmith
      # Optional - match your NAS/host user for volume ownership:
      # PUID: "1000"
      # PGID: "10"
    volumes:
      - /path/on/host/data:/data
      - /path/on/host/secrets:/secrets
    depends_on: [tfsmith-db]
  tfsmith-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: tfsmith
      POSTGRES_PASSWORD: CHANGE_ME
      POSTGRES_DB: tfsmith
    volumes:
      - /path/on/host/postgres:/var/lib/postgresql/data

On first boot TFsmith generates /secrets/master.key - the key that encrypts your API tokens and stored exports. Back it up and never regenerate it: the app refuses to boot with a mismatched key, and stored data cannot be decrypted without it.

First run

1. Open the app and create the first administrator account.

2. Enter your license: a TFSM- activation key (purchased at tfsmith.com - arrives by email in about a minute), or an offline license file. There is no free tier; nothing works without a license. The only data ever sent during activation is your license key and a random install id - never your tenants, never your data.

3. Connect your first tenant (see Connecting a tenant). TFsmith pulls it once automatically; after that only the Refresh button contacts your provider.

Where things live

/data holds the encrypted per-tenant exports; /secrets/master.key is the master key; Postgres holds users, tenants (tokens encrypted), settings, and the audit log. Back up all three together.