Open-source infrastructure, IaC tooling, and developer tools from VH & Co BV.
A self-hostable alternative to Terraform Cloud / Ansible AWX, supporting OpenTofu and Ansible from a single control plane, API-compatible with Terraform Cloud/Enterprise tooling.
Stackweaver is developed in a private monorepo and published here as eight independent satellite repositories. These are one-way distribution mirrors: they take issues, not pull requests.
| Component | Repo | OpenSSF Scorecard |
|---|---|---|
| Helm chart | stackweaver-helm |
|
| Backend API | stackweaver-api |
|
| Orchestrator | stackweaver-orchestrator |
|
| OpenTofu Runner | stackweaver-opentofu-runner |
|
| Ansible Runner | stackweaver-ansible-runner |
|
| Frontend | stackweaver-frontend |
|
| Zitadel bootstrap | stackweaver-zitadel-init |
|
| Secret bootstrap | stackweaver-secrets-init |
helm install stackweaver oci://ghcr.io/vhco-pro/charts/stackweaver --version <X.Y.Z>See the Helm satellite README for the full deployment guide, or
sw.vhco.pro/docs for the user documentation.
Ecosystem - developed in the open, pull requests welcome:
| Repo | What it is |
|---|---|
terraform-provider-stackweaver |
Terraform provider for Stackweaver, derived from terraform-provider-tfe and kept in sync with it |
stackweaver-operator |
Kubernetes operator for managing Stackweaver deployments |
| Repo | What it is |
|---|---|
stackgraph |
Infrastructure diagram generator for OpenTofu/Terraform - production-quality architecture diagrams from state files, plan JSON, and HCL source |
terraform-provider-garage |
Terraform provider for Garage, the S3-compatible object store (Admin API v2) |
builders |
PDS-backed golden-image builders for the homelab |
| Repo | What it is |
|---|---|
distil |
Zero-CVE container images. Fully automated, built with apko + Wolfi |
swift-release-action |
Reusable macOS Swift app release pipeline - reusable workflow plus a secret-free composite build/sign/package action |
| Repo | What it is |
|---|---|
ssm-connect |
Config-driven macOS menu-bar app that auto-establishes AWS SSM port-forward tunnels to EC2 workstations (SSO auth, bundled session-manager-plugin) |
dcv-session-agent |
On-box agent for multi-user Amazon DCV on a single self-managed EC2 host - per-user virtual sessions and AWS-SSO-identity token auth, no broker, no passwords |
claude-companion |
macOS menu-bar companion for Claude Code - tool-call auto-approval against a shared blacklist, session monitoring, usage and cost tracking |
postbode |
Gmail to ClearFacts/QPS purchase-invoice agent, running as a macOS launchd daemon |
homebrew-tap |
Homebrew tap for the org's macOS tools |
Most repositories here accept pull requests in the normal way. The seven
stackweaver-* distribution mirrors are the exception - they are
bot-synced and take issues instead. See
CONTRIBUTING.md
for which is which, and
SUPPORT.md
for where to ask questions.
- Reporting channel, scope, and disclosure process:
SECURITY.md - Release artifacts are signed with cosign keyless (Sigstore) and carry SLSA build provenance. There are no long-lived signing keys in this org.
Licences vary per repository - check the LICENSE file in each. In
summary:
- Stackweaver core (API, Orchestrator, Frontend, Helm chart, Zitadel
init, shared
core/module): BSL 1.1, with an Apache-2.0 Change Date and a SaaS-exclusion Additional Use Grant. - Stackweaver ecosystem tooling (the runners): Apache-2.0,
shipping a
NOTICEdisclosing the BSL upstream linkage.terraform-provider-stackweaveris MPL-2.0, inherited from its upstream. - Everything else: Apache-2.0, except
builders(GPL-3.0).
Stackweaver™ is a trademark of VH & Co. The Stackweaver name and word mark identify the official project; the source-code licences above do not grant any right to use the mark in product names, hosted services, or company names. See the Trademark Policy for the full terms.
Maintained by VH & Co BV · contact@vhco.pro