DigitalOcean App Platform Service

Name: DigitalOcean App Platform Service
Brand: IaC Bazaar
SKU: do-app-platform
Availability: InStock

Declarative App Platform deployment with services, workers, domains, and alerts.

terraformAlt & Specialty Cloudsdigitalocean

Compare Managed App Platform across clouds →

do-app-platformvizier v1.2.0

Verification

Plan-validated

Passed: module logic verified on a mocked plan - inputs, validation rules, conditional creation and outputs resolve (no real provider, no cloud).

Conformance

Static validation (fmt · validate · tflint)
No applicable security policies for this provider
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o do-app-platform-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/do-app-platform/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle do-app-platform-1.0.0.sigstore.json \
  do-app-platform-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "096234c657133102d047c1ca91eaabb5dc08bb7ddd4e56b00954757760ccb487  do-app-platform-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "app_platform" {
  source  = "www.iac-bazaar.com/iac-bazaar/do-app-platform/digitalocean"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads plan-validated because the record says so, and the link lands on this page.

README.md, GitLab, Gitea

[![IaC Bazaar: plan-validated](https://www.iac-bazaar.com/api/artifacts/do-app-platform/badge)](https://www.iac-bazaar.com/catalog/do-app-platform?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, plan-validated on IaC Bazaar: [DigitalOcean App Platform Service](https://www.iac-bazaar.com/catalog/do-app-platform?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "app_platform" {
  source  = "www.iac-bazaar.com/iac-bazaar/do-app-platform/digitalocean"
  version = "1.0.0"
}
```

Preview:

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

do-app-platform

Declarative DigitalOcean App Platform application: HTTP services, background workers, lifecycle jobs, attached managed databases, custom domains with automatic TLS, alerts, and optional DigitalOcean DNS zones — all from one typed module call. Works with Terraform and OpenTofu (>= 1.6), DigitalOcean provider >= 2.0, < 3.0.

Status: static-validated, live-test pending. Validated with tofu fmt, tofu validate, and tflint against the digitalocean/digitalocean provider. Not yet applied against a live DigitalOcean account (App Platform live tests need a real git/registry source), so it ships under live-test quarantine.

Design & secure defaults

Secrets stay secret. SECRET env vars are passed in dedicated *_secrets maps marked sensitive = true, emitted with type = "SECRET" (encrypted at rest by App Platform), and never used as a for_each key — keys come from a parallel non-sensitive map. App Platform encrypts the values; they never appear as plaintext GENERAL vars.
Deliberate deploys. deploy_on_push defaults to false on every git and registry source, so a push upstream does not silently redeploy production. Opt in per component.
HTTPS everywhere. App Platform provisions and renews TLS for every custom domain automatically — there is no plaintext-only path.
Single source per component is enforced by validation: a service, worker, or job must define exactly one of image / github / gitlab / git.
Fail-loud alerts on by default (DEPLOYMENT_FAILED, DOMAIN_FAILED); add alert_emails to route them.
Plan-time invariants (preconditions): at least one runnable component must exist, and every *_secrets entry must reference a defined component.
Autoscaling drops the static instance_count automatically when an autoscaling block is set (App Platform rejects both together).

Requirements

Terraform or OpenTofu >= 1.6
digitalocean/digitalocean provider >= 2.0, < 3.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

Usage
Key inputs
Outputs

Create a free account Sign in

Related modules

Static validatedLive test pending

aws-app-runner

auto_deployments takes every push to the image tag straight to production with no review, which quietly makes the deployment gate "who can push". Off by default, egress routed through your VPC, and the pull role kept separate from the run role.

View module

Static validatedLive test pending

huawei-app-platform

A CAE environment, application and components. deploy_after_create is off in the API, so a component exists with a source, a runtime and a replica count and serves nothing; it is on here. The runtime list still offers Java8, Nodejs8 and Php7, which the module names and asks about, and 500m of CPU cannot take 4Gi of memory.

View module

Static validatedLive test pending

aws-elastic-beanstalk

AWS Elastic Beanstalk with the defaults turned the right way: managed platform updates are ON (AWS leaves them off, so the platform is never patched), health reporting is enhanced rather than basic, logs stream to CloudWatch and survive termination, IMDSv1 is disabled, deployments go out in batches instead of all at once, and application versions are pruned before they hit the quota.

View module

Live-tested

azure-app-service

App Service plan + Linux web app with deployment slots, custom domain + managed TLS, VNet integration and autoscale.

View module

Static validatedLive test pending

gcp-app-engine

The application cannot be deleted and its region cannot be changed - destroy removes it from state and nothing else - and the region pins Firestore for the project. Without IAP every service is public on its appspot hostname. The permanent region must be accepted by name, IAP fronts every service unless public is stated, and a disabled serving status is a choice rather than an accident.

View module