InfraPI
Open source · MIT · Internal developer platform

Self-service infrastructure, as APIs.

InfraPI turns the infrastructure products you already run into governed, multi-tenant REST APIs. One URL layout, one token, one RBAC model, an OpenAPI contract enforced on every request — so a portal, a CLI or a pipeline creates what it needs without a ticket.

Explore the products Start learning GitHub
One consistent surface for every API /apis/{group}/{version}/namespaces/{ns}/{resource} OpenAPI enforced RFC 9457 errors Prometheus · OpenTelemetry

The problem

Platform teams drown in tickets and one-off integrations

Tickets instead of APIs

Teams wait days for a host, a DNS record or a dashboard that a script could create in seconds.

One-off integrations

Every internal API in front of a product is a hand-written client of that product, to keep in step with each of its releases.

Tenancy bolted on

Who may create what, in which team's space, is re-invented in each tool — or left to shared admin credentials.

How it fits together

Composable layers, adopted one at a time

Products

Each one stands alone. Together, they are a platform.

Kayra

v0.3

Identity, namespaces and RBAC for your platform.

Who callers are, which tenant they act in, what they may do there, and which APIs each tenant is subscribed to.

Overview Docs GitHub

tofu-api

v0.6 · early

Any OpenTofu provider as a REST API.

An OpenAPI contract generated from the provider's schemas, rules in one YAML file per provider, no code per resource.

Overview Docs GitHub

lib

v0.11

The Go foundation of every InfraPI service.

URL layout, auth, contract enforcement, RFC 9457 errors, metrics, tracing and Vault, shared by every service.

Overview Docs GitHub

How it works

From a Terraform provider to a governed API in three steps

  1. 01

    Describe

    Pick the resource types of an OpenTofu provider to expose, and the rules over them, in one YAML file.

    provider:
  source: hashicorp/aws
  version: 6.0.0
  config:
    region: ${AWS_REGION}
resources:
  aws_instance:
    attributes:
      instance_type:
        enum: [t3.micro, t3.small]
  2. 02

    Serve

    One binary for every provider. The OpenAPI contract is generated from the provider's schemas at start.

    systemctl enable --now tofu-api@aws
# contract at /-/openapi/aws/v1.json
# Swagger UI at /-/docs
  3. 03

    Call

    Any caller gets a plain REST API, checked against the contract, scoped to its namespace.

    curl -X POST \
  :8080/aws/v1/namespaces/acme/instance \
  -d '{"ami":"ami-0abc…",
       "instance_type":"t3.micro"}'

Why InfraPI

Built for platform teams who run their own infrastructure

Composable

Adopt one piece at a time — tofu-api alone in front of one product, Kayra for tenancy and RBAC, lib for your own services.

Contract-first

Every API serves its OpenAPI contract and rejects any request that does not match it, before a handler runs.

Multi-tenant by design

Namespaces are the tenants. With tofu-api each one runs with its own credentials from Vault, so isolation comes from the credentials.

Plain to operate

Single Go binaries, systemd units, RPM and DEB packages, Prometheus metrics and OpenTelemetry traces. No cluster required.

Learn

Hands-on tutorials

All tutorials
tofu-api Beginner

Turn the AWS provider into an EC2 instance API

Generate an OpenAPI contract for EC2 instances from the AWS provider's schemas with tofu-api gen, then restrict instance types with a rule. No AWS account needed.

15 min

Open source, MIT licensed

Every InfraPI product is developed in the open. Use it, fork it, open an issue or send a pull request.

View on GitHub Start learning