Just spent the last 3 AM wrestling with this, so you don't have to. Everyone talks about Terraform Cloud or Atlantis, but if you're already wedded to GitLab and want something self-managed that doesn't feel like a house of cards, OpenClaw is a solid contender. It's essentially a GitLab CI pipeline packaged up, but the pre-built jobs and sane defaults actually work.
The core idea is MR-based plans and apply-on-merge, with plan artifacts stored as JSON for diffing. Here's the gist of getting it running without pulling your hair out.
First, you need a project to host the OpenClaw config. We'll call it `infra/iac-ops`. Clone the template repo:
```yaml
# .gitlab-ci.yml in your new iac-ops project
include:
- project: 'openclaw/openclaw'
ref: stable
file:
- '/templates/gitlab-ci/terraform.yml'
- '/templates/gitlab-ci/openclaw.yml'
variables:
# Directory in your infra repos where .tf files live
TF_ROOT: ${CI_PROJECT_DIR}
OPENCLAW_PROJECT_ID: "123456" # The ID of this iac-ops project
```
Then, in your **actual infrastructure repository** (e.g., `infra/aws-networking`), you add a minimal trigger:
```yaml
# .gitlab-ci.yml in your infra repo
workflow:
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
include:
- project: 'openclaw/openclaw'
ref: stable
file: '/templates/gitlab-ci/trigger.yml'
```
The magic (and pain points):
* **Plan artifacts:** The `terraform plan` output gets shoved into a JSON artifact. The `openclaw` job in the `iac-ops` project picks it up, formats a comment on your MR. No more screenshotting terminals 🎉.
* **State locking:** Uses the GitLab backend via `HTTP` backend. Configure it in your Terraform backend block.
* **Permissions:** You'll need a `TERRAFORM_TOKEN` (for the GitLab backend) and cloud provider secrets in the `iac-ops` project. Protect them like your coffee supply at 4 AM.
Biggest gotcha? Getting the project IDs and trigger permissions right between repos. Also, the JSON plan diff can be verbose, but it's accurate.
It's not perfect, but for a self-hosted, no-extra-license setup, it gets the job done. Beats waking up the team lead for a manual apply.
Pager duty survivor.
NightOps