Terraform and OpenTofu from pull requests, with state stored as a dependency graph in PostgreSQL.
Plans read only what a change touches. Changes that do not overlap run at the same time.

Website · Docs · Blog · Slack

Stategraph runs Terraform and OpenTofu from pull requests, and can store your state as a graph in PostgreSQL instead of a state file. It has two parts:

• Stategraph Orchestration: plans every pull request on GitHub or GitLab and posts the result as a comment. Policy checks, cost estimates, and approvals run in the review. The apply runs on merge or on a comment. Open source and self-hostable.
• Stategraph Infrastructure as a Database: stores each state as a dependency graph in PostgreSQL. A plan reads only the resources your change reaches, changes that touch different resources apply at the same time, and you can query every state with SQL. Works from the CLI with any CI; no VCS provider required.

Each part works without the other. You can start with Orchestration against your existing state backend and move the state into the database later.

Orchestration plans each pull request and posts the plan as a comment. The apply runs on a stategraph apply comment or on merge.

• Plan on every pull request, posted as a comment
• Apply from the pull request, with approvals routed by CODEOWNERS
• Policy checks with OPA/Rego, Conftest, and Checkov before an apply
• Cost estimates in the pull request, with thresholds that require another approval
• Drift detection on a schedule
• Tag-based configuration for 10 or 10,000 workspaces, in a monorepo or across repositories
• Terraform, OpenTofu, Terragrunt, CDKTF, and Pulumi

Runs on GitHub and GitLab. Configure it in .stategraph/config.yml. See the Orchestration docs.

With a state file, every write locks the whole file. Infrastructure as a Database stores each state as a graph of resources and dependencies in PostgreSQL, and locks only the resources a change touches.

Scoped plans. A plan reads only the subgraph your change reaches, not the whole state.

Concurrent changes. Each plan and apply is a transaction that locks the resources it changes. Changes that do not overlap apply at the same time. Changes that overlap are rejected at commit.

SQL across every state. JOINs, CTEs, and blast radius, from the console, the CLI, or the API.

$ stategraph query "SELECT type, count(*) FROM resources GROUP BY type"
 aws_instance         20
 aws_security_group   15
 aws_subnet            6

Every plan and apply is recorded as a transaction, with its logs. A change that reaches several states applies as one transaction with stategraph tf mtx.

Hosted: Start free. Connects to GitHub or GitLab; plan limits are on the pricing page.

Self-hosted (Open Source):

git clone https://github.com/stategraph/stategraph
cd stategraph/docker/terrat

# Run the setup wizard
docker compose up setup
# then open http://localhost:3000

The open-source build runs Orchestration only, for up to 3 active users a month per GitHub or GitLab installation. The full walkthrough is in the self-hosted Open Source quickstart. An open-source build of the Stategraph server is in development.

You need a running Stategraph server first. Pick one:

Hosted: Stategraph Cloud. We run the server.

Self-hosted: the Enterprise build, with a license key, on your PostgreSQL, deployed with Docker Compose, Kubernetes, ECS, or Cloud Run. See Self-hosting.

BYOC: we operate Stategraph inside your AWS, GCP, or Azure account. Contact us.

Then install the CLI and point it at your server:

curl -sSL https://get.stategraph.com/install.sh | sh

export STATEGRAPH_API_BASE="https://your-server.example.com"
export STATEGRAPH_API_KEY="<your-api-key>"        # console: Settings → API Keys
export STATEGRAPH_TENANT_ID="<your-tenant-id>"    # shown in stategraph info

stategraph info                     # confirm the connection

Then import a state:

terraform state pull > terraform.tfstate
stategraph import tf --name networking terraform.tfstate
stategraph plan                     # plan against the imported state

• Your Terraform, unmodified: Stategraph runs the Terraform or OpenTofu binary you already use. No provider changes, no HCL edits; terraform plan/apply becomes stategraph plan/apply.
• No VCS provider required: the CLI talks to the server directly. Use it with Orchestration, with your existing CI, or from your laptop.
• Credentials stay with you: the CLI runs Terraform where you run it. The server stores state; it never runs Terraform and never sees your cloud.
• Reversible: stategraph states export writes a standard terraform.tfstate back out.

The full walkthrough, including exploring what you imported, is in the quickstart.

• Quickstart: Stategraph Cloud, self-hosted, or import your state
• Core concepts: states, transactions, and the graph
• Orchestration docs: PR workflows, policy, cost, drift
• CLI reference: every command
• Editions and pricing: Open Source, Enterprise, Infrastructure as a Database, and the Stategraph Cloud plans

• Slack: chat with the team and other users
• GitHub Discussions: questions and ideas
• GitHub Issues: bugs and feature requests

We welcome contributions! See CONTRIBUTING.md.

The code in this repository is MPL-2.0 licensed.

Stategraph Infrastructure as a Database is commercial software, available in the hosted service or self-hosted with a license key. Stategraph Orchestration is open source, with enterprise features (RBAC, centralized configuration, advanced approval workflows) available in the hosted service and the self-hosted Enterprise Edition. The open-source build, which the self-hosted setup above runs, allows up to 3 active users per month per GitHub or GitLab installation (an active user is anyone who triggers a plan or apply that month); runs are unlimited. The self-hosted Enterprise Edition has no user limit, and hosted plan limits are on the pricing page.