Description

Talan Clouds is a modular infrastructure platform designed to simplify and standardize cloud-native deployments across environments. It integrates best practices for security, scalability, and automation using Terraform, Kubernetes, and Cloud provider services. Built for flexibility and team collaboration, Talan Clouds accelerates application delivery in modern DevOps ecosystems.

Cloud Agnostic IaC based SaaS Skeleton.

Features

• ✅ AWS Support out of the box (Azure and GCP support in progress)
• 🏢 Multi-tenancy architecture using layered design: provider, group, network, managed, app, and tenant
• 🌍 Environment isolation made easy — define multiple environments with a single variable: TFVARenv_id
• 🛠️ Infrastructure as Code using Terraform and Helm
• 🔗 Multiple backend providers supported: Local, Cloud, PostgreSQL (S3 support coming soon)

Infrastructure Instance layers

Quick start

• Install Nodejs 24.x LTS
• Install helpers tln & tpm

npm i -g tln-cli@1.117.0 tln-pm@0.23.0

• Install wget if needed

brew install wget

• Go to your home folder and prepare local dev environment (change projects folder name if it's already used)

cd ~ && mkdir projects && cd projects && tln config --terse && mkdir project-talan && cd project-talan && tln config --terse

* Clone stable version

git clone --depth 1 --branch v26.4.0 git@github.com:project-talan/tln-clouds.git && cd tln-clouds

* or main branch

git clone git@github.com:project-talan/tln-clouds.git && cd tln-clouds

Important

* Commands below assume that Terraform Cloud is used as a storage for states

* By skipping --backend cloud local backend will be used

* You will need domain name to configure all layers (myproject.io as an example below)

• Use .env.template file as an examples and fill it with actual values insode root .env

TFTOKENappterraformio=<yourterraformcloud_token>
TFVARorgid=<yourterraformcloudorg>   TFVARproject_id=myproject   TFVARgroup_id=dev   TFVARenv_id=dev01   TFVARtenant_id=demo
TFVARaccountid=<yourawsaccountid>
TFVARregistry=   TFVARrepositories=["dev.myproject.services.iam","dev.myproject.web.landing"]   TFVARimagetagmutability=
TFVARdomain_name=myproject.dev   TFVARdns_records=dev01.myproject.dev,api   TFVARuseprimarydomain=false   TFVARapibaseurl=https://api.dev01.myproject.dev
TFVARpostgresql={ size = "db.t4g.micro", allocatedstorage = "20", maxallocatedstorage = "30", masteruserpassword = true, engineversion = "17.4", family = "postgres17", majorengineversion = "17", multiaz = false, managemasteruserpassword = true, backupschedule = "cron(0 /2   ? )", backuplifecycledeleteafter = 97, backuplifecyclecoldstorageafter = 7, rdssnapshot_identifier = null }   TFVARdatabases={ "iam" = { owner = "admin", password = "admin" }, "notify" = { owner = "admin", password = "admin" } }
TFVARdbinstanceidentifier=   TFVARtenant_databases={}   TFVARuserpoolid=   TFVARusecognitoprovider=false   TFVARidentityproviders={"demo-oidc":{"providertype":"OIDC","providerdetails":{"attributesrequestmethod":"POST","attributesurl":"https://idp.dev01.myproject.dev/realms/demo/protocol/openid-connect/userinfo","authorizescopes":"openid profile email","authorizeurl":"https://idp.dev01.myproject.dev/realms/demo/protocol/openid-connect/auth","clientid":"demo","clientsecret":"...","jwksuri":"https://idp.dev01.myproject.dev/realms/demo/protocol/openid-connect/certs","oidcissuer":"https://idp.dev01.myproject.dev/realms/demo","token_url":"https://idp.dev01.myproject.dev/realms/demo/protocol/openid-connect/token"}}}

AWS

* Create aws/.env file using aws/.env.template as an example

AWSACCESSKEYID=<youraws_id>     AWSSECRETACCESSKEY=<youraws_key>     AWS_REGION=eu-central-1     AWSDEFAULTREGION=eu-central-1

TFVARawsk8sversion=1.33     TFVARawsk8snodegroups={ng1 = { name = "ng1", "instancetypes" = ["t3.small"], "minsize": 1, "desiredsize": 2, "maxsize": 3, "disksize": 20 }}

• Install dependencies

tln install aws --depends

• Construct six AWS Infrastructure Instance layers

* Provider layer - configure ECR

tln construct aws -- --backend cloud --init --apply --layer provider --state project,provider

* Groupr layer - configure Route53, certificate & validation. You will need to modify DNS nameservers at your registrar side

tln construct aws -- --backend cloud --init --apply --layer group --state project,provider,group

* Network layer - configure VPC, Bastion

tln construct aws -- --backend cloud --init --apply --layer network --state project,provider,group,env,layer

* Managed layer - K8s

tln construct aws -- --backend cloud --init --apply --layer managed --state project,provider,group,env,layer

* At this point you have secure access via bastion to your cloud resources, initiate sshuttle connection to your cloud network via bastion (first terminal)

tln connect aws -- --layer network --prefix bastion

* Open another shell with necessary environment variables (second terminal)

tln shell aws

* Check pods in cluster

kubectl get pods -A

* Deploy App layer - configure Nginx ingress, Postgres DBs, DNS records (second terminal)

tln construct aws -- --backend cloud --init --apply --layer app --state project,provider,group,env,layer

* You can install test traefik/whoami component into cluster

tln whoami aws -- [--plan]

* Deploy Tenant (demo) layer - Tenant specific DNS, database etc.

tln construct aws -- --backend cloud --init --apply --layer tenant --state project,provider,group,env,tenant

* You can check endpoints availability in browser https://dev01.myprojecy.io & https://api.dev01.myproject.io * Now you can deconstruct all layers and free all Cloud resources * Undeploy Tenant (demo)

tln deconstruct aws -- --backend cloud --init --apply --layer tenant --state project,provider,group,env,tenant

* Delete whoami

tln whoami aws -- --delete

* Undeploy App layer

tln deconstruct aws -- --backend cloud --init --apply --layer app --state project,provider,group,env,layer

* Close sshuttle connection (first terminal)

^C

* Delete Managed layer

tln deconstruct aws -- --backend cloud --init --apply --layer managed --state project,provider,group,env,layer

* Delete Network layer

tln deconstruct aws -- --backend cloud --init --apply --layer network --state project,provider,group,env,layer

* Delete Groupr layer

tln deconstruct aws -- --backend cloud --init --apply --layer group --state project,provider,group

• Delete Provider layer

tln deconstruct aws -- --backend cloud --init --apply --layer provider --state project,provider

Ingegration

Recommended aproach is to use git subtree to connect your main repository with tln clouds one

• Bind repositories

tln -u subtree-add -- --prefix platform/env --subtree https://github.com/project-talan/tln-clouds.git --ref v26.4.0

• Option upgrade to the new version

tln -u subtree-pull -- --prefix platform/env --subtree https://github.com/project-talan/tln-clouds.git --ref v26.5.0 --squash

Command line options

General format

tln [construct | deconstruct] [aws | azure | gcp] [-u] -- [option, [option], ...]

| Option | Description | Example | | ------------- | ------------- | ------------- | | backend | Defines which backend provider should bu used (cloud, pg) | $ tln construct aws -- --backend cloud
$ tln construct aws -- --backend pg | | state | Defines how store name will be built: project, provider, env, layer, tenant, | $ tln construct aws -- --backend cloud --layer network --state project,provider,env,layer
will use myproject-aws-dev-dev01-network Terraform Cloud workspace | | init | Run Terraform init | $ tln construct aws -- --backend cloud --init --layer network --state project,provider,env,layer | | upgrade | Run Terraform upgrade mode for init | $ tln construct aws -- --backend cloud --init --upgrade --layer network --state project,provider,env,layer | | plan | Run Terraform plan | $ tln construct aws -- --backend cloud --plan --layer network --state project,provider,env,layer | | apply | Run Terraform apply | $ tln construct aws -- --backend cloud --apply --layer network --state project,provider,env,layer | | auto-approve | Tun on auto approve for apply & destroy | $ tln construct aws -- --backend cloud --apply --auto-approve --layer network --state project,provider,env,layer |