Hosted state

Every Stack owns exactly one state, stored encrypted and served over OpenTofu’s standard http backend — no runner, agent, or plugin required. It’s also a perfectly good first step: you can adopt hosted state alone and keep running tofu wherever you run it today.

Wire up a CLI

Mint a state key in the Stack’s settings (shown once, revocable), then declare an empty http backend and configure it by environment:

terraform {
  backend "http" {}
}

export TF_HTTP_ADDRESS="https://api.stacks.lngbrdg.com/state/v1/<org>/<stack>"
export TF_HTTP_LOCK_ADDRESS="$TF_HTTP_ADDRESS"
export TF_HTTP_UNLOCK_ADDRESS="$TF_HTTP_ADDRESS"
export TF_HTTP_LOCK_METHOD=LOCK
export TF_HTTP_UNLOCK_METHOD=UNLOCK
export TF_HTTP_USERNAME="<key id>"
export TF_HTTP_PASSWORD="<key secret>"
tofu init

Locking

The backend implements the protocol’s LOCK/UNLOCK verbs. A second writer — another laptop, CI, a hosted Run — is refused with the holder’s identity, or waits if you pass -lock-timeout. A crashed process’s lock can be force-released from the Stack’s Console page — see Troubleshooting for when that’s safe.

Versions and restore

Every write is an immutable state version, retained and listed in the Console. Restoring an old version appends it as a new current version — history is never rewritten. The next plan then shows you exactly what drifted while you were away.

Migrating in

From any existing backend (local, S3, TFC, …), point your config at the http backend as above and run:

tofu init -migrate-state

OpenTofu copies the state across; the first version appears in the history.

Migrating out

Your state is not hostage. Change the backend block back to wherever you’re going and run tofu init -migrate-state again — or download any version from the Console and use it directly.

Encryption

State is encrypted before it reaches object storage, under a per-Stack data key wrapped by a service key. State carries your resources’ attributes in plaintext by OpenTofu’s design — treat state keys accordingly (they’re revocable; rotate freely).