FAQ

What Marolum is

Does Marolum need write access to my state bucket? No. It sends ListObjectsV2 and GetObject and nothing else. There is no configuration that makes it write, and its own tests confirm overwrite and delete attempts are refused under its grant. Connect a backend

Can Marolum run, approve, or block a deployment? No. It is a record, and records do not have veto power. It never runs pulumi, never edits state, and never sits in a pipeline's critical path — a runner reports to it beside the deployment, and Marolum being down never changes an exit code. Runner integration

Does it work with Pulumi Cloud? No. Marolum reads DIY state in Amazon S3 or an S3-compatible store. Pulumi Cloud, the PostgreSQL state backend, Azure Blob, Google Cloud Storage, and local files have no adapter. Introduction

Does it support Terraform or OpenTofu? Within stated bounds. State observation is verified against Terraform 1.15.9 and OpenTofu 1.12.6; other builds are unverified. Terraform and OpenTofu can write native S3 lock files when locking is enabled, but Marolum does not currently observe them. Backend-native update history remains unavailable for those engines, so lock and update-history observation are Pulumi-only and these backends answer engine-unsupported for both rather than showing empty results. Connect a backend

Can it tell me who ran a deployment? No. Pulumi DIY state carries no actor, and Marolum does not invent one. Runner evidence carries the token's authority kind and name — credential provenance, not a person. Known limitations

Does it decrypt Pulumi secrets? No. Pulumi-marked secrets are redacted before they reach a browser model. Unmarked plaintext in an output is shown as Pulumi stored it, so treat the database as sensitive. Security and privacy

Setting up

How long does the first setup take? About fifteen minutes on a laptop with the Quickstart; an afternoon for a cloud deployment by hand; less with the Pulumi programs.

Why does the container run as UID 1000, and why do the docs keep saying chown? The process runs as the node user (ID 1000) and reads its secret files by numeric ID. On a Linux host a file you create as another user is unreadable inside the container until you chown 1000:1000 it. Docker Desktop on macOS and Windows maps ownership for you. Deployment and setup

Why won't it read my Kubernetes Secret or a projected file? Projected volumes materialize files as symlinks, and the file rules reject symlinks. Write the files into an emptyDir from an init container instead. Set up on Kubernetes

Can I put /data on EFS, NFS, or Azure Files? No. SQLite runs in WAL mode, which needs host-local locking. Use a block volume, or PostgreSQL. Deployment and setup

Can I run two replicas for high availability? On SQLite, no — the second refuses with ownership-conflict. On PostgreSQL with an Enterprise license, yes, up to a declared ceiling. PostgreSQL operations

Do I need PostgreSQL? Only if your compute cannot keep an exclusive block volume (Fargate, Container Apps), you need replicas, or you have measured SQLite past its envelope. SQLite is complete and supported. PostgreSQL operations

Which layout is my bucket? List .pulumi/stacks/ under your prefix: directories mean project-scoped, files directly there mean legacy. Marolum never guesses. Find your backend details

Does pulling the image need a registry login? A supported public Marolum image has not been released yet. The current candidate is private. Use the availability and verification instructions for an actual release; a working billing account does not establish public image availability. Upgrades and versioning

Using the console

I signed in and it bounced me back to the sign-in screen. The browser dropped the Secure session cookie because the page is plain HTTP. On a laptop over http://127.0.0.1, set MAROLUM_ALLOW_HTTP=true; anywhere else, put TLS in front and leave it unset. Troubleshooting

The backend diagnostic succeeded but Stacks is empty. Wrong layout or prefix, nine times out of ten. Backend problems

Why are there two rows for one deployment? One is the backend record, one is the runner's report. Marolum stores the trusted join but this build keeps them as separately labelled rows. Reading the operation timeline

What does "Before coverage began" mean? You are looking at a window earlier than Marolum's first observation of that stack. That interval is unknowable; history the backend pruned before then is gone. Coverage and gaps

Why is the Source filter disabled? It is not implemented in this build. The only option is All sources. Known limitations

Why does a failed operation show resource changes? Outcome and impact are separate facts. A failed update can have deleted things before it failed; a successful one can have changed nothing. Two questions every row answers

Can a viewer see everything? Every observation and operation, yes; no administration. Business stack read scopes narrow retained history per user, but live observation pages stay installation-wide. Users and permissions

Why can't the administrator read a transcript? Transcript bodies need the distinct transcript-reader role, on purpose. Assign it to a separate account. Roles and permissions

Data and retention

How far back does history go? As far back as the backend still held update history when Marolum first observed the stack, and forward from there forever (within retention). Nothing pruned earlier is reconstructed.

I purged a lot of evidence but the disk did not shrink. Deletion frees bytes inside the SQLite file; the file only shrinks after an offline VACUUM. Compacting

If I remove a backend and add it back, is the old history gone? No — but coverage restarts, tokens stop matching, and evidence that had expired is observed again as new with a fresh retention clock. Disable instead of removing. Changing your backends safely

Does a backup include everything? The database holds every account, token digest, observation, and audit row. It does not hold the transcript or state encryption keys; back those up separately or the bodies stay ciphertext. Backup and disaster recovery

Can I roll back an upgrade? Only by restoring the pre-upgrade backup. An older image refuses a newer schema and touches nothing. Upgrades and versioning

Does deleting evidence in Marolum delete anything from my bucket? Never. Retention governs Marolum's copy only.

Runners and CI

Do I have to use marolum exec? No. A backend-only installation retains complete operation history. Runner integration adds previews, in progress/cancelled/incomplete outcomes, and planned-versus-actual comparison. The HTTP contract is public if you prefer your own client. Runner integration

What happens to my deployment if Marolum is down? Nothing. The command runs unchanged, the exit code is its own, and the wrapper prints one warning. Undelivered evidence is lost; the backend observer still records the applying run.

Why does the runner get 404 for a stack I can see? The token's scope does not cover it. Out-of-scope and nonexistent stacks look identical to a token by design. Troubleshooting

Editions and licensing

What do I get without a license? Community: backend observation, the full operation timeline and resource history, up to 1 year of operation and resource history, local accounts with three fixed roles, integration tokens, export. No trial clock, no data truncation. Introduction

What happens when a license lapses? Nothing is deleted and no effective policy changes. Paid-only acts stop — placing a new hold, starting a new PostgreSQL adoption, assigning a custom role — while everything already in place stays. On Enterprise replicas, standbys stop serving and the primary continues. Edition downgrade

Can one license cover two installations? Yes, with purchased capacity. Business and Enterprise include one installation; additional installations cost 50% of the base price each. Use the same key in each installation. Account plan quotes let you add capacity after issuance once payment is confirmed. Business and Enterprise offer Unlimited within one customer organization; see Pricing for current amounts. These options change capacity, not edition features. Enterprise Advanced Security’s offline site license remains organization-wide. Decommissioning

Account and billing

Where do I buy a subscription or enter a discount code? Choose an edition and billing interval on Pricing. Sign in when required, review the selection and accept the license agreement on the next page, then continue to Stripe Checkout. Enter an eligible promotion code there and check the final total before completing the purchase. Codes can have product, customer, expiration and redemption limits.

Can I view my license key again? Yes. Sign into Account and select View license key for your active license. You can copy, download or hide it. Viewing returns the same key; it does not rotate it. Keep it secure: anyone with it can attempt activation. Do not put it in screenshots, public issues or support chat. The first collection uses Collect license key after the subscription is reconciled.

Why does my older key require replacement? Older keys were stored only as hashes and cannot be recovered. Account explains when an explicit replacement is required to enable future viewing. Replacement revokes the old key: update the key in your Marolum installation so future renewals can succeed. Existing signed leases retain their normal validity and grace. Do not replace a key merely to view one that is already retrievable.

How do I get invoices, update payment details or cancel renewal? Open Manage billing from Account. Stripe hosts those controls and returns you to Dekglas. Cancellation takes effect at the end of the current billing period. Plan changes are not currently available in the billing portal.

Is my Dekglas account the same as my self-hosted Marolum login? No. The Dekglas account manages your subscription and license. Your self-hosted installation has its own accounts and activation controls. For a forgotten Dekglas password, use the managed sign-in service's recovery flow. Account recovery is a separate support-reviewed process for replacing a lost billing identity, including explicit consent to revoke existing keys.

Advanced Security is sales-led and quoted by deployment size, with a lower starting price for small offline deployments and higher quotes for larger customers; see Pricing. Its organization-wide offline document has no online activation counter; the starting price is not a flat-price unlimited commercial offer. Choose standard Enterprise when connected licensing meets your needs.