Infrastructure as Code

Infrastructure as Code (IaC)

Manage infrastructure in declarative, versioned, reviewable definitions instead of click-ops and runbooks. This note maps the four-way tool landscape and where each fits the homelab; the declarative-pull counterpart (config management) is Ansible — the pair of threads that meet in the golden-repo idea of a fully described fleet.

The landscape (all four captured)

• terraform (OSS) (49.8k★, Go) — the reference point. HCL declarative, state-file driven, provider ecosystem as the moat. Post-license-change (BUSL) it’s the incumbent being reacted to, not the default pick it once was.
• opentofu (OSS) (30.3k★, MPL-2.0, Go) — the Linux Foundation-backed fork from the BUSL exodus; drop-in Terraform replacement, registry in place, community roadmap (state encryption, .tofu.hcl). Note: repo moved opentofu-org → opentofu org (old path 404s).
• pulumi (OSS) (25.7k★, Apache-2.0, Go engine + multi-language) — real languages (TS/Python/Go/C#/Java/YAML) instead of HCL; same provider surface via bridges. The “if you already have a language and a type system, why invent one” bet.
• alchemy (OSS) (1.4k★, Apache-2.0, TypeScript) — Infrastructure as Effects (IaE): infra and application logic in one fully type-safe program, built on the Effect library. No YAML, no dedicated interpreter — native ESM TypeScript. Cloud errors map to controlled Effect-typed errors (declarative retries/failure handling); Effect Layers wire IAM/env/provider switching; supports AWS (S3, DynamoDB, Lambda, SQS) + Cloudflare (Workers, R2, D1); local dev with AWS emulators in Docker or workerd, hot reload. Sam Goodwin’s “Infrastructure as Code is solved” flywheel thesis.

The axes that actually differ

• Language: HCL dialect (Terraform) vs HCL-with-community-roadmap (OpenTofu) vs real languages (Pulumi) vs one language + one effect system (Alchemy)
• State: all four keep desired-vs-actual reconciliation state; Terraform/OpenTofu share the state file semantics, Pulumi same model different format, Alchemy stores state but the program is the source of truth you run
• Infra vs app split: Terraform/OpenTofu/Pulumi all manage infra that the application is then deployed onto; Alchemy collapses the split — one program may declare the bucket and the code that runs against it
• License/politics: Terraform BUSL → OpenTofu exists; Pulumi/Alchemy permissive
• Ecosystem gravity: Terraform provider registry is the shared asset — OpenTofu inherits it, Pulumi bridges it, Alchemy is bespoke (AWS + Cloudflare focus)

Homelab positioning

The garden’s existing IaC-flavored notes: dnscontrol (OSS) (DNS as JS — the “Pulumi model, DNS-sized” already running here), Self-hosted CI-CD (Forgejo + runners apply the IaC), Homelabs. Declarative push (IaC) + declarative pull (Ansible) + immutable base images is the full coverage triangle; the homelab already runs DNS-as-code, so the next natural step is small-scope OpenTofu for the pfSense/router adjuncts and Oracle Cloud free tier.

Open

• (open: OpenTofu trial — one Oracle Cloud resource as the first state file; compare HCL ergonomics vs dnsconfig.js experience)
• (open: Alchemy hands-on — Effect types are the interesting part; does the IaE error-mapping model hold up on a real AWS free-tier stack?)
• noite (OSS) answers the celld question from the PaaS side (2026-10-05): celld’s app hosting + Worker API compatibility wrapped in a multi-tenant control plane — infrastructure-as-typed-program (rat-stack kin), MCP provisioning so agents deploy end-to-end.

Related: Ansible · dnscontrol (OSS) · Self-hosted CI-CD · Golden repo · Software factory (the ladder extended to agent pipelines — “Terraform for agents”)

stackd: AWS on your own machine, for real (2026-10-08)

rad9800 → stackd (OSS) (18★ Go, Apache-2.0, very early; tweet + README captured): a local AWS emulator built because existing ones (LocalStack et al.) “weren’t enough” for Organizations, CloudTrail and EventBridge. The differentiator is realness on both planes: data plane — EC2 RunInstances boots actual QEMU/KVM VMs, EKS spins real k3s clusters with add-ons and audit logs, ECS/CodeBuild run real Docker containers; control plane — full IAM policy evaluation (SCPs, RCPs, permission boundaries, session policies), Organizations (delegated admins, effective policies, cross-account), STS/SAML/OIDC federation, Identity Center, KMS. Every call recorded; CloudTrail delivers to S3/CloudWatch/EventBridge where rules match and dispatch — “follow a single API call end to end: IAM → resource → audit log → event rule → target.” One Go binary, fully offline, optional SQLite persistence (fork state like a branch). Honest box: “not complete AWS parity… unsupported operations return errors, not fake success” — the anti-mock discipline. For the IaC lane: rehearsal/testing substrate with the governance surfaces (SCP/CloudTrail/EventBridge) emulated, which is exactly what the osp.fyi OpenFrame-cli rehearsal lane (in the Homelabs candidates ledger) and policy-testing workflows need.

Encore: infrastructure inferred from application code (2026-10-09)

(USER question: “do we have oss note on encore?” — none existed; captured 2026-10-09.) encore (OSS) (encoredev, 12.4k★ Go, MPL-2.0; site + repo captured) — “automated infrastructure for humans and agents… build, validate, and ship without waiting on Terraform PRs or platform tickets.” The model: an open-source infrastructure SDK (TypeScript + Go; Python/Rust coming) where resources (SQL DB, Pub/Sub, object storage, cache, cron, secrets) are declared in code, each becoming a node in an application graph; encore run stands up the whole system locally with real Postgres, real Pub/Sub semantics, distributed tracing — and the optional managed platform diffs that graph against an environment and provisions the cloud equivalents in your own AWS/GCP account (RDS/Cloud SQL, SNS+SQS, S3/GCS, ElastiCache, least-privilege IAM wired from code paths). The workflow pitch is the agent-era part: local → per-PR preview environments (ephemeral + database branching from seed) → push-to-deploy, so “the fail-loop moves from push, wait, fix to run locally, see it work, push” — “particularly effective with AI coding agents, since every change can be validated with real infrastructure immediately”; infrastructure namespaces let multiple branches or agents work in parallel with isolated state. Escape hatches stated as doctrine: Terraform provider, import any cloud SDK, migrate service-by-service, and a migrate-away guide (“99% of your code is regular Go or TypeScript”). Honest limits: app-layer integration (services must use the SDK), 99%-use-case resource scope, AWS/GCP only (Azure roadmap). For the note’s axes: Encore is a fifth column — not IaC-for-infra (Terraform/Pulumi) nor BaaS (Supabase) nor PaaS (Fly), but infrastructure-from-application-code with local-realism as the differentiator; kin to stackd’s AWS-on-your-machine (both kill the “can’t test infra locally” gap — stackd via emulator, Encore via real Postgres + graph diffing). USER association (2026-10-09): alchemy is the reminder-kin — both collapse the infra/app split, but from opposite ends: alchemy (OSS) (Infrastructure-as-Effects) makes the program the source of truth — one typed Effect program, plan/deploy as effects, AWS+Cloudflare, alpha — while Encore provides an SDK plus the runtime/platform layer (real-Postgres local realism, preview envs, graph-diff provisioning). Alchemy asks the app to own infra semantics; Encore asks infra to host the app’s graph. Shared doctrine: no YAML, escape hatches, agent-first docs (alchemy ships an agent bootstrap prompt + llms.txt; Encore ships namespaces for parallel agents).