Stacks

A stack is one OpenTofu root module and one state. Keep separate state in separate stacks.

The repository, branch, and working directory tell GantryCD which code belongs to the stack. A sync records the latest commit on the tracked branch. Push events can do this automatically when the repository is connected.

The OpenTofu version belongs to the stack. GantryCD installs that version for each run.

State

The managed backend is the simplest choice. GantryCD creates the backend and gives each run short-lived access to it.

Turn it off only when the OpenTofu code already configures another backend. GantryCD cannot inspect or repair state held in a backend it does not manage.

Labels

Labels help group and filter stacks. Labels that start with gantrycd:runner-group: also choose where the stack runs.

For example:

gantrycd:runner-group:region = eu-west
gantrycd:runner-group:size = large

The stack runs only on a group with both region=eu-west and size=large. A stack with no runner labels uses the default group.

Other labels are free-form. They can also attach shared contexts or limit access. Protect labels that can grant access to secrets.

Stack identity

Every stack has its own service account. GantryCD gives each run a short-lived token for that account. Roles on the account decide what the stack may do in GantryCD.

Most stacks need no roles. Add them when a stack reads another stack’s data or manages GantryCD through the Terraform provider.