# Nojam > Nojam runs Terraform and OpenTofu for HashiCorp Vault: every change is planned on the pull request, approved by a second person on the exact plan, applied with a short-lived Vault credential, and kept on a tamper-evident audit record. Nojam is self-hosted: one Go binary and PostgreSQL, runners in Podman. It supports GitHub.com and GitHub Enterprise Server. Made by I.M. PR Inc., Canada. Contact: hello@nojam.io. Every page on this site has a Markdown copy at the same address ending in .md. Every claim is backed by a named test (see Proof). ## Product - [Terraform and OpenTofu for HashiCorp Vault, with no standing credentials](https://nojam.io/index.md): Nojam plans every Vault change on the pull request, gets a second person to approve the exact plan, applies it with a credential that lives for minutes, and keeps a tamper-evident audit record. Self-hosted. - [Vault-native safety for Terraform and OpenTofu](https://nojam.io/vault-native.md): What Nojam does because it understands HashiCorp Vault: credentials per job and phase, protection for what cannot be rebuilt, break-glass in Vault itself, isolated team namespaces and a safe state split. - [How Nojam is secured](https://nojam.io/security.md): Nojam is built on the assumption that a pull request, a runner or the network may be hostile: per-job Vault credentials sealed in transit, assured approvals, a controlled provider supply chain, signed releases and security testing on every change. - [Change evidence for regulated Vault estates](https://nojam.io/compliance.md): What Nojam records for every change to HashiCorp Vault, how that lines up with SOC 2, ISO 27001, PCI DSS and DORA change-management controls, and what it does not cover. - [Claims and the tests behind them](https://nojam.io/proof.md): Every claim on the Nojam website is backed by a named test in the Nojam repository. The claims, the tests, and every measured number with its conditions. - [Nojam licence](https://nojam.io/licence.md): Nojam is source-available. Personal and non-commercial use is free; companies need a commercial licence, with an evaluation licence for a pilot. - [Request a Nojam pilot](https://nojam.io/pilot.md): A two-week Nojam pilot on your own Vault: one cluster, up to ten repositories, shadow mode next to your current pipeline, and a written report at the end. - [Join the Nojam early access list](https://nojam.io/early-access.md): Get one email when the first public release of Nojam is out. - [Privacy notice](https://nojam.io/privacy.md): What the Nojam website collects, why, and how to have it removed. - [Nojam blog](https://nojam.io/blog.md): Test reports and notes on running Terraform for HashiCorp Vault safely. ## Compare - [Nojam compared with other Terraform runners](https://nojam.io/compare.md): How Nojam compares with Atlantis, HCP Terraform, Spacelift, env0 and StateGraph for a HashiCorp Vault estate, including what each of them does better. - [Nojam and Atlantis](https://nojam.io/compare/atlantis.md): Nojam and Atlantis: what Atlantis does better, where Nojam differs for a HashiCorp Vault estate, and when to choose which. - [Nojam and HCP Terraform](https://nojam.io/compare/hcp-terraform.md): Nojam and HCP Terraform: what HCP Terraform does better, where Nojam differs for a HashiCorp Vault estate, and when to choose which. - [Nojam and Spacelift](https://nojam.io/compare/spacelift.md): Nojam and Spacelift: what Spacelift does better, where Nojam differs for a HashiCorp Vault estate, and when to choose which. - [Nojam and env0](https://nojam.io/compare/env0.md): Nojam and env0: what env0 does better, where Nojam differs for a HashiCorp Vault estate, and when to choose which. - [Nojam and StateGraph](https://nojam.io/compare/stategraph.md): Nojam and StateGraph: what StateGraph does better, where Nojam differs for a HashiCorp Vault estate, and when to choose which. ## Blog - [On our first tests: 37,707 Vault resources, 121 stacks, no failures](https://nojam.io/blog/on-our-first-tests.md): We built a realistic Vault estate of 121 stacks and 37,707 resources and ran Nojam through it, from bootstrap to a shared module change across 36,000 roles. ## Docs - [Nojam documentation](https://nojam.io/docs.md): How to install, configure and operate Nojam, set up Vault for it, split a shared state and review its security. ## Start here - [Install Nojam for a pilot](https://nojam.io/docs/install.md): The host, the GitHub App, the Vault role, the runner image and the checks to run before production. - [Your first pull request](https://nojam.io/docs/first-pull-request.md): A stack in runner.yaml, a plan on the pull request, an approval and an apply, end to end. ## Concepts - [Stacks and targets](https://nojam.io/docs/stacks-and-targets.md): How a repository declares stacks, how each stack maps to targets such as dev, uat and production regions, and how they are discovered. - [Plans and approvals](https://nojam.io/docs/plans-and-approvals.md): What is planned on a pull request, who may approve, how approval binds to the plan, and when a merge needs approval again. - [Vault credentials for jobs](https://nojam.io/docs/vault-credentials.md): How a job logs in to Vault, the sealed hand-over, read-only plan roles, apply roles bound to main, and revocation. - [Deployments and rollback](https://nojam.io/docs/deployments-and-rollback.md): Promotion order, canary regions, all-or-nothing deployments, and what rollback restores and what it cannot. ## Vault - [Vault setup](https://nojam.io/docs/vault-setup.md): What Nojam needs on each cluster: the JWT auth mount, the roles, the policies and the issuer, with a platform stack in Terraform. - [Namespaces and vending](https://nojam.io/docs/namespaces.md): One namespace per team on Vault Enterprise, and creating a team namespace from one line in teams.yaml. - [Splitting a shared state](https://nojam.io/docs/state-split.md): Moving from one shared state to one per namespace with nojam state split, proven with zero-diff plans before anything applies. - [Protection rules](https://nojam.io/docs/protection.md): The built-in baseline, break-glass, critical mounts, grants across namespaces and your own rules by Vault path. - [Providers and modules](https://nojam.io/docs/providers.md): The provider mirror, the allow-list, lock files, provider changes on the pull request, and module pinning. ## Operating Nojam - [Configuration reference](https://nojam.io/docs/configuration.md): Every server and runner setting, runner.yaml, sign-in, ServiceNow, OPA, audit anchoring and compliance streaming. - [Pipeline steps](https://nojam.io/docs/pipeline-steps.md): Your own checks after every plan, declared once by the platform team, that a pull request cannot drop. - [High availability](https://nojam.io/docs/high-availability.md): Several replicas on PostgreSQL, leader election, durable webhooks and fenced runner attempts. - [Alerts](https://nojam.io/docs/alerts.md): The Prometheus alert rules and the runbook for each one. - [Backup and restore](https://nojam.io/docs/backup-and-restore.md): What to back up, how to restore, and the restore drill. - [Retention](https://nojam.io/docs/retention.md): What Nojam keeps and for how long: webhook payloads, plan files, job logs and the audit log. - [Support bundle](https://nojam.io/docs/support-bundle.md): What to send when something is stuck, and what is never in it. ## Security - [Threat model](https://nojam.io/docs/threat-model.md): What Nojam protects, the actors and trust boundaries, the threats and controls, and the open items. - [Cryptographic inventory](https://nojam.io/docs/cryptography.md): The keys Nojam holds and the algorithms it uses. - [Security testing](https://nojam.io/docs/security-testing.md): The checks on every change, the fix time frames, and how findings are handled. - [Verifying a release](https://nojam.io/docs/verifying-releases.md): Checking cosign signatures, SBOMs and SLSA provenance before you install. ## Optional - [Everything in one file](https://nojam.io/llms-full.txt): every page above, in Markdown.