Terraform Installer For Seqera Platform Enterprise (Docker-Compose)

A successful Seqera Platform deployment requires making decisions about networking, security posture, container orchestration, permissions, etc. which can sometimes be overwhelming to a client administrator who just wants to get their users onboarded and using the features offered by the Platform.

The Seqera CX team has developed a field tool to simplify deployment in two ways:

1. Reduce the infrastructure and configuration burden, so that a first-time deployment of Seqera Platform Enterprise requires less than 1 hour of work and only a few minutes for subsequent redeployments.

2. Provide an Infrastructure-As-Code (IaC) solution so activities are repeatable and artifacts can be checked into source-control.

Table of Contents

• Disclaimer
• Supported Versions & Components
• Appropriateness Criteria
• Prerequisites
  • 01: Tool Dependencies
  • 02: AWS IAM Permissions
• Configuration Steps (Mandatory)
  • 01: Clone the repository
  • 02: Prepare Configuration Files
    • 02A: Prepare secrets
    • 02B: Prepare the terraform.tfvars file
  • 03: Create an AWS IAM Role with the necessary permissions
  • 04: Modify OpenSSH config
• Configuration Steps (Optional)
  • 01: Review your Terraform state storage strategy
  • 02: Fusion Binary Vendoring
  • 03: Update your Git repo settings
  • 04: Initiate Crypto secret rotation
  • 05: Using a Private Certificate Authority
  • 06: Enable EC2 Instance Role Authentication
  • 07: Enable Data Lineage (Platform v26.1.0+)
• Execution Steps
  • Deployment
  • Teardown
• Warnings
• Multiple Deployment Consideration

Disclaimer

This is an unofficial field tool. Use at your own discretion!!

The solution is delivered on a best-effort basis, but provides no guarantees of appropriateness for your specific scenario. Please conduct your due diligence prior to execution within your environment.

For further information on how the project is managed, please see:

• Terraform Assets
  Project resources (generated by terraform-docs).

• Design Decisions
  Information about project structure, design decisions, and assumptions made.

• Security Scanning
  How we scan for / mitigate security vulnerabilities found within the solution.

• Deficiencies & Gotchas
  Information on existing deficiencies and gotchas.

• Software License Warning Ensure you are compliant with software licenses.

Supported Versions & Components

This section calls out the version floors and component-lifecycle notices that affect what you can expect from this installer.

• Seqera Platform v25 or later. Earlier versions are no longer maintained here. If you need to deploy a pre-v25 version of Seqera Platform — for example, to reproduce an existing customer environment — check out the legacy-final-pre-v25 tag (created May 6/26), which marks the final commit that supported the legacy version range:

  git checkout legacy-final-pre-v25

  New features and fixes are not backported to that tag.

• Seqerakit components are deprecated (as of Release 1.8, circa 2026-06-17). The existing seqerakit_* tfvars, the post-deployment seqerakit step, and the generated seqerakit.yml template remain in the repo to avoid breaking in-flight deployments, but they are no longer actively maintained and are not guaranteed to work out of the box. This functionality will be replaced in future with the seqera Terraform provider.

Appropriateness Criteria

You must meet the following criteria to use this solution successfully.

1. You are a client of Seqera Labs.
2. You will run Seqera Platform in AWS.
3. Your corporate policies allow you to store secrets in AWS Systems Manager Parameter Store (SSM).
4. You have access to a local Linux-based terminal (Mac supported, with caveats).
5. You can use Terraform to provision infrastructure.
6. You use OpenSSH and can maintain a ~/.ssh/config file.
7. (New as of May 21, 2025) You have access to a local container runtime (e.g. Docker).
8. (New as of 2026-05-06) You are deploying Seqera Platform v25 or later. For pre-v25 deployments, see Supported Versions & Components.

Prerequisites

01: Tool Dependencies

See Tool Dependencies for tooling requirements.

02: AWS IAM Permissions

See Permissions for the required AWS IAM permissions.

Configuration Steps (Mandatory)

See Configuration Files for file details.

01: Clone the repository

1. Download a copy of the repository to your local workstation:

   git clone <path_to_offical_repo> && cd <name_of_local_directory>

02: Prepare Configuration Files

1. Select a name for your Seqera Platform application (default: tower-template).

   This is a namespace isolator which prevents concurrent instances (e.g., dev and prod) from accidentally sharing configurations.

02A: Prepare secrets

1. Follow the instructions in Prepare Secrets and then return here.

2. Follow the instructions in Prepare SSM Secrets and then return here.

   Remember your application name and SSM prefixes, as these are required for later configuration steps.

02B: Prepare the terraform.tfvars file

1. Follow the instructions in Prepare TFvars.

03: Create an AWS IAM Role with the necessary permissions

1. Follow the instructions in Prepare AWS IAM Permissions.

04: Modify OpenSSH config

1. Follow the instructions in Prepare OpenSSH.

Configuration Steps (Optional)

The following configuration actions are encouraged but not mandatory.

01: Review your Terraform state storage strategy

1. Follow the instructions in Review Terraform State Strategy.

02: Fusion Binary Vendoring

1. Follow the instructions in Fusion Binary Vendoring.

03: Update your Git repo settings

1. Follow the instructions in Update Githooks Settings.

04: Initiate Crypto secret rotation (ADVANCED)

1. Follow the instructions in Crypto Secret Rotation.

05: Using a Private Certificate Authority (ADVANCED)

1. Follow the instructions in Private Certificates

06: Enable EC2 Instance Role Authentication

1. Follow the instructions in Using AWS EC2 Instance Role

07: Enable Data Lineage (Platform v26.1.0+)

1. Follow the instructions in Data Lineage.

Execution Steps

Deployment

1. Via terminal, navigate to the project root and initialize the project:

   $ terraform init

2. Create and review an execution plan:

   # Recommended approach.
   # Execute the Seqera-supplied Python script to check your `terraform.tfvars` file for known configuration conflicts prior to terraform binary invocation.
   $ make plan
   
   # Alternative approach.
   # Execute plan without Python script verification execution.
   $ terraform plan

3. Execute the actions reviewed in the Terraform plan:

   # Recommended approach.
   # Execute the Seqera-supplied Python script to check your  `terraform.tfvars` file for known configuration conflicts prior to terraform binary invocation.
   $ make apply
   
   # Alternative approach.
   # Execute plan without Python script verification execution.
   # Note: You can append `--auto-approve` to the end of the command to avoid the need to type 'yes' to approve the deployment.
   $ terraform apply

Teardown

1. To destroy the deployed infrastructure:

   $ terraform destroy

Upgrade Steps

Please see Upgrade Steps for instructions on how to upgrade an existing installation to a new Release.

WARNINGS

1. If a database (regardless if container or RDS) was created as part of the deployment, teardown will destroy it and all data within.
   Prior to deletion, consider backing up your database if the data may be needed in future.

2. Terraform is not aware of actions executed within the Seqera Platform (i.e., invocation of Tower Forge to create compute environments by users / automation tools like Seqerakit). Executing terraform destroy without first conducting a purge of objects within Seqera Platform will result in orphaned assets in your AWS Account.

Multiple Deployment Consideration

Given client environment variability, Seqera offers no official guidance re: how best to run multiple concurrent implementations (e.g. entirely separate repositories, different branches in a monorepo, Terraform workspaces, git submodules, etc). Each site must decide what is best for them and implement accordingly.

With that said, for design purposes, this tool assumes that multiple project instances will live in the same filesystem (each within its own exclusive namespace). Each project's ssh_config file uses an alias matching the unique app_name from your tfvars file, making it possible to add multiple non-conflicting Include statements in your ~/.ssh/config.