tfv server
Dashboard and API
The tfv server dashboard: runs, locks with unlocking, drift, audit log, sign-in with OIDC or passwords, and the REST API.
Open the server's URL in a browser.
What it shows
- an overview of runs, failures, locks and drift;
- every plan and apply, with its change list and redacted log;
- locks, with an Unlock button;
- drift schedules, findings, and who last changed each resource;
- the audit log, including Audit → Policy findings.
It has light and dark themes. Viewers can see everything; admins can also unlock and start drift checks.
Sign-in
| Sign-in | Settings |
|---|---|
| Okta or any OIDC provider | TFV_OIDC_ISSUER, TFV_OIDC_CLIENT_ID, TFV_OIDC_CLIENT_SECRET, TFV_OIDC_ADMIN_GROUPS, TFV_OIDC_ALLOWED_GROUPS. Redirect URI: <public url>/auth/oidc/callback |
| Username and password | dashboard.users in repos.yaml, or TFV_DASHBOARD_USERS_FILE. Hash passwords with node packages/server/src/hash-password.ts (source) |
| API token | TFV_API_TOKEN (admin) |
With Helm:
| Method | Values | Roles |
|---|---|---|
| Okta / any OIDC provider | dashboard.oidc.* |
adminGroups → admin, allowedGroups → viewer, everyone else is refused |
| Username and password | dashboard.users or usersExistingSecret |
role: admin or viewer per user |
| API token | dashboard.apiToken.existingSecret |
Admin. For automation and /api |
Sessions are signed, HttpOnly cookies. Set TFV_SESSION_SECRET (32+ characters) or sessions end
when the server restarts; the Helm chart generates one and keeps it across upgrades. Login attempts
are rate limited, and the page loads nothing from third parties.
API
These need a dashboard session or Authorization: Bearer $TFV_API_TOKEN:
| Request | What it does |
|---|---|
GET /api/runs |
Plans and applies |
GET /api/locks |
Current locks |
GET /api/audit |
Audit log |
GET /api/drift |
Drift findings |
GET /api/drift/schedules |
Drift schedules |
POST /api/drift/run?key=… |
Start a drift check (admin) |
POST /api/locks/unlock |
Release a lock (admin) |
curl -H "Authorization: Bearer $TFV_API_TOKEN" https://tfv.acme.dev/api/locks/healthz, /readyz and /metrics (Prometheus) are open. With Helm, set
serviceMonitor.enabled: true to scrape /metrics.
Based on packages/server/README.md and charts/tfv-server/README.md in the tfv repo.