fleetworks / warden / product
What Warden is
A focused gatehouse for one organization’s Terraform Cloud footprint: the record of what exists, what it maps to, and who may act on it. It is a companion to Terraform Cloud, not a replacement for it.
The model
Everything belongs to exactly one organization. These are the records Warden keeps and how they connect.
- tenant boundary
Organization
Owns every service, cloud account, workspace, service account and webhook endpoint. No read crosses it.
- yp_service_id
Service
An owned software service registered in Yellow Pages. It links to the AWS and Azure accounts it runs in, and is either onboarded or not.
- environment
AWS and Azure accounts
Cloud accounts the organization owns, each with an environment (PROD, NON-PROD, SANDBOX). A service-account link marks whether a pairing is onboarded to Terraform Cloud.
- workspace_name
Workspace
A Terraform Cloud workspace record, addressed by its unique name. It maps to one service, one AWS account, and one repo on a VCS tenant.
- wl_…
Service account and PAT
A machine identity owned by the organization. It authenticates with personal access tokens that carry scopes.
- https only
Webhook endpoint
An HTTPS URL that receives workspace events, signed with its own secret.
The API
A Hono API that implements the Gatehouse contract under /api/gatehouse. The upstream contract declares every endpoint public; Warden deliberately requires a verified identity on every endpoint except the public subtree, so one organization never sees another’s data.
The API serves its own OpenAPI document at /openapi.json, and a generated TypeScript client (types, TanStack Query hooks and zod schemas) is built from it and checked for drift in CI.
The web console
A Next.js console for platform engineers and org admins: a workspaces table filtered by service, a grouped workspace detail with its Review, the organization’s services and AWS and Azure accounts with their onboarding state, and the integrations page for PATs and webhooks.
The mobile companion
An Expo app that lists and opens workspaces, shows the account view, and receives push notifications. Its builds go through fastlane to TestFlight and Google Play; this site does not offer it as a public store download.
What it does not do
Warden keeps the governed record of your workspaces. It does not call Terraform Cloud today: creating a workspace writes Warden’s record and emits a workspace.created event, and does not create or run anything in Terraform Cloud.
The desktop app is a placeholder window while its build and release pipeline is set up, so it is not offered here.
At a glance
- API base path
- /api/gatehouse
- Auth
- Fleetworks identity (JWT) or a scoped PAT
- Roles
- org:viewer, org:contributor, org:admin, ci:agent
- VCS providers
- GitHub, GitLab, Azure DevOps
- Cloud accounts
- AWS and Azure
- Response shape
- { data, type, meta }
Bring your Terraform Cloud footprint into one place
Sign in with your Fleetworks account. An org admin grants your role, and your organization’s workspaces are there.