OpenTofu

License	FOSS problems	Maintenance	SSO	Users	Tested
MPL-2.0Copyleft license. Only the covered files must stay open — surrounding proprietary code in separate files is permitted.	—	Active	—	Unlimited	✅

Description

OpenTofu is a fork of Terraform, taken at the last commit still under MPL 2.0, before HashiCorp's 2023 relicensing. It's a Linux Foundation project, governed by a technical steering committee rather than one vendor, and stays wire-compatible with Terraform's config syntax and providers — the same .tf files, the same plan/apply workflow, just under different stewardship.

Features

• Wire-compatible with Terraform — the same HCL config format and the same provider ecosystem; existing .tf files work with little more than a provider-source-address change.
• Drift detection — tofu plan -refresh-only (or apply -refresh-only to commit the update) diffs the state file against what's actually deployed, without proposing any changes to fix it — a read-only check, not a mutation. Scheduling isn't built into the CLI itself; that needs a cron'd CI job running the same command, or a platform like HCP Terraform or Spacelift, layered on top.
• State encryption — client-side, shipped in v1.7, ahead of when Terraform's own CLI got it.
• Provider for_each — shipped in v1.9, a feature people had asked HashiCorp for over Terraform's own GitHub issues for years without it landing.

Example usage

The same OpenStack instance and boot volume Pulumi's own example provisions, in HCL:

resource "openstack_compute_keypair_v2" "main" {
  name       = "main"
  public_key = var.ssh_public_key
}

resource "openstack_blockstorage_volume_v3" "personal_services_boot" {
  name        = "personal-services-boot"
  size        = 20
  volume_type = "CEPH_1_perf1"
}

resource "openstack_compute_instance_v2" "personal_services" {
  flavor_name = "a4-ram16-disk0"
  key_pair    = openstack_compute_keypair_v2.main.name

  block_device {
    uuid                  = openstack_blockstorage_volume_v3.personal_services_boot.id
    source_type           = "volume"
    destination_type      = "volume"
    boot_index            = 0
    delete_on_termination = false
  }
}

tofu apply diffs this against tracked state and reconciles the difference — no runtime beyond the tofu binary itself, unlike Pulumi's language host process.

Usage patterns

• Drop-in Terraform replacement — swap the binary and provider source addresses, keep the config; this project's actual switch is close to a rename, not a rewrite.
• Self-managed state backend — S3, an S3-compatible server (this project uses Infomaniak's own gateway), Azure Blob, GCS, or local — no vendor-hosted backend required.
• CI-driven drift detection — since scheduling isn't built into the CLI, a cron'd tofu plan -refresh-only -detailed-exitcode in CI (or a hosted platform) is the usual way to catch drift automatically rather than only checking on demand.

License and governance

MPL 2.0 throughout, genuinely open — no dual-licensing, no single company able to relicense it again the way HashiCorp did to Terraform. Governance sits with a Linux Foundation technical steering committee, and its founding backers (Spacelift, Harness, Gruntwork, env0, Scalr) are companies that normally compete with each other — a stronger signal against single-company capture than "trust us" would be on its own. See Terraform's own page for the fuller IBM-acquisition context this exists in response to.

Conclusion

Why you would — genuinely open with none of Terraform's ownership risk, and not just catching up on features either: state encryption and provider for_each shipped before Terraform's own CLI had them. Adoption backs this up — downloads grew roughly 300% year over year, past 10M total. Switching cost from this project's existing .tf files is close to zero.

Why you wouldn't — Terraform's head start still shows in volume even where OpenTofu leads on specific features: more accumulated documentation, and more people to have already hit the same problem first. Infomaniak's own providers are Terraform-published, not OpenTofu-published, so compatibility rides on OpenTofu staying wire-compatible rather than an explicit guarantee from Infomaniak itself.