Magalu Cloud

OrkStage creates Magalu Cloud resources with the MagaluCloud/mgc OpenTofu provider (pinned to ~> 0.56.0), one isolated state per resource, kept in an Object Storage bucket in your own tenant. Health, existence checks and restarts use the regional REST API (https://api.magalu.cloud/<region>/, header X-API-Key).

What OrkStage createsCopy Anchor Link

There is no capability for cache.redis or ingress. Magalu Cloud has no managed Redis in the provider. The network load balancer needs its targets at creation time, while OrkStage creates an ingress before the services it routes to, so load balancing is built into vm-docker instead.

DBaaS does not return the master password, so when a resource on another provider needs the database credentials, the adapter reads the password generated in that database's OpenTofu state (in your bucket). Inside Magalu Cloud VMs, services receive the reference as <ID>_CREDENTIALS_REF, not the value.

Target configurationCopy Anchor Link

Credential secretCopy Anchor Link

{
  "apiKey": "<Magalu Cloud API key>",
  "stateAccessKeyId": "<Object Storage key pair id>",
  "stateSecretAccessKey": "<Object Storage key pair secret>"
}

The key pair reads and writes OpenTofu state and is also given to the provider for bucket operations. Secrets reach OpenTofu only as runner environment variables: TF_VAR_mgc_api_key, TF_VAR_mgc_key_pair_id and TF_VAR_mgc_key_pair_secret (sensitive root variables, because the provider takes these values from configuration only), plus AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for the S3 backend.

PermissionsCopy Anchor Link

When creating the API key, grant read and write access to Network (VPC), Virtual Machines, SSH Keys, DBaaS, Load Balancer and Object Storage. A target that deploys only some resource types can leave the others out.

Prepare state storageCopy Anchor Link

Create the bucket before validating the target. OrkStage never creates it.

mgc object-storage buckets create acme-orkstage-tfstate

Create it in the target region, keep it private and turn on versioning in the console. State is reached at https://<region>.magaluobjects.com with path style addressing. S3 lock files are off: Magalu Object Storage support for conditional writes is not documented, and OrkStage already runs one operation per resource at a time.

RegionsCopy Anchor Link

Regions are br-se1 and br-ne1.

Actions for triggersCopy Anchor Link

Known limitsCopy Anchor Link

• The network load balancer is TCP only (no path routing, no TLS termination) and is marked experimental by Magalu Cloud.
• No autoscaling: replicas is a fixed VM count. Changing the image or environment replaces the VMs.
• Images must be pullable without registry credentials.
• Environment values are written to VM user data.
• VMs get a public IPv4 each so they can pull images. Inbound traffic is limited to the service port (from anywhere for public services, from the VPC otherwise). natGateway is not applied, and availabilityZones does not create more subnets.
• DBaaS: publicAccess and same zone HA are not offered; backups are always on (1 to 35 days); the requested PostgreSQL version must be active in the region, or the module fails with the list of active versions.
• Object Storage: publicAccess, tier and retentionDays are not applied, and a bucket must be empty before it is destroyed.
• Magalu Cloud tags are tenant wide and authoritative per resource, so template tags are not applied.
• Running containers on Magalu Cloud Kubernetes is not supported.