IaC Bazaar
DigitalOceanPlan-validated

DigitalOcean App Platform Service

Declarative App Platform deployment with services, workers, domains, and alerts.

terraformAlt & Specialty Clouds#digitalocean

Compare Serverless Containers across clouds →

do-app-platformterraform v1.7

Verification

Plan-validated

Passed: module logic verified on a mocked plan - inputs, validation rules, conditional creation and outputs resolve (no real provider, no cloud).

Conformance

  • Static validation (fmt · validate · tflint)
  • No applicable security policies for this provider
  • Plan tests (mocked: validation rules · outputs)

Provenance

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o do-app-platform-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/do-app-platform/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle do-app-platform-1.0.0.sigstore.json \
  do-app-platform-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "096234c657133102d047c1ca91eaabb5dc08bb7ddd4e56b00954757760ccb487  do-app-platform-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "app_platform" {
  source  = "www.iac-bazaar.com/iac-bazaar/do-app-platform/digitalocean"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Premium, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

do-app-platform

Declarative DigitalOcean App Platform application: HTTP services, background workers, lifecycle jobs, attached managed databases, custom domains with automatic TLS, alerts, and optional DigitalOcean DNS zones — all from one typed module call. Works with Terraform and OpenTofu (>= 1.6), DigitalOcean provider >= 2.0, < 3.0.

Status: static-validated, live-test pending. Validated with tofu fmt, tofu validate, and tflint against the digitalocean/digitalocean provider. Not yet applied against a live DigitalOcean account (App Platform live tests need a real git/registry source), so it ships under live-test quarantine.

Design & secure defaults

  • Secrets stay secret. SECRET env vars are passed in dedicated *_secrets maps marked sensitive = true, emitted with type = "SECRET" (encrypted at rest by App Platform), and never used as a for_each key — keys come from a parallel non-sensitive map. App Platform encrypts the values; they never appear as plaintext GENERAL vars.
  • Deliberate deploys. deploy_on_push defaults to false on every git and registry source, so a push upstream does not silently redeploy production. Opt in per component.
  • HTTPS everywhere. App Platform provisions and renews TLS for every custom domain automatically — there is no plaintext-only path.
  • Single source per component is enforced by validation: a service, worker, or job must define exactly one of image / github / gitlab / git.
  • Fail-loud alerts on by default (DEPLOYMENT_FAILED, DOMAIN_FAILED); add alert_emails to route them.
  • Plan-time invariants (preconditions): at least one runnable component must exist, and every *_secrets entry must reference a defined component.
  • Autoscaling drops the static instance_count automatically when an autoscaling block is set (App Platform rejects both together).

Requirements

  • Terraform or OpenTofu >= 1.6
  • digitalocean/digitalocean provider >= 2.0, < 3.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Key inputs
  • Outputs

Related modules

Azure✓ live-tested

Azure Container Apps Environment

Container Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.

$179.00v1.0.0
Google Cloud✓ live-tested

Cloud Run Job (v2)

A Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout.

$179.00v1.0.0
Google Cloud✓ live-tested

Cloud Run Service

Cloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right.

$179.00v1.0.0
AWS✓ live-tested

ECS Fargate Service

Full Fargate stack: cluster, task definition, service with ALB integration, autoscaling, and Cloud Map discovery.

$179.00v1.0.0
ScalewayAlt & Specialty Clouds

Scaleway Serverless Container

Container namespace, deployed container, custom domain, and registry wiring.

$179.00v1.0.0