Skip to content
Dekglas

Marolum by Dekglas

Self-Managed IaC Backend Observability

Read-only visibility into self-hosted Pulumi, Terraform, and OpenTofu state.

Community is always free and available. No license key required.

Downloads and documentation

Marolum 0.21.1 is a supported release. Read its release notes and known limitations before you deploy.

Cropped Marolum dashboard showing backend health totals and the expanded synthetic backend.

See observation health

01 / 4

Marolum 0.21.1 Community · Synthetic data · Cropped view

View full capture (new tab)
See observation health. Full capture: Marolum 0.21.1 Community, Marolum Light, observing synthetic Pulumi state on a local S3-compatible service. One fixture stack is deliberately unreadable, so the backend shows as partial. These are observation states, not Connection diagnostics or a cloud or VMware deployment.

What Marolum does

Inspect state

Browse backends, stacks, resources, and redacted outputs in one place.

Retain evidence

Keep operation timelines, comparisons, and exports after source records are pruned.

Review as a team

Share a browser view without sharing raw state files or storage credentials.

Stay read-only

No apply, destroy, import, or refresh. Your deployment tools keep the keys.

Security at its core

Read-only by design

Scope backend credentials to list and read. The observer cannot apply, destroy, import, refresh, or write your state.

Scoped access

Browser roles and evidence-write tokens have separate authority. Scope integration tokens to the stacks they may report on, and revoke them when access is no longer needed.

Secrets stay opaque

Engine-marked secrets stay opaque. Additional capture is opt-in with separate access and retention rules. Unmarked sensitive values still require your care.

Verifiable releases

Published image digests, signatures, SBOMs, and provenance let you verify the release. You control deployment, TLS, storage encryption, and backups.

Security fixes and baseline protections are shared across editions. Read the security model and its limits.

Engine and backend support

Observability Engine Adapters

  • Pulumi
  • Terraform
  • OpenTofu

Backend Filesystems

  • AWS S3
  • S3-compatible backends (SeaweedFS, RustFS, MinIO, etc.)
  • Google Cloud Storage
  • Azure Blob
  • Linux Filesystem
  • PostgreSQL

GCS and Azure live-provider validation is pending. Filesystem and PostgreSQL sources require operator configuration. Native history and lock observation are Pulumi-only. Compatibility notes.

Editions

Community is always free. Business and Enterprise are the paid editions.

Community

The complete observation core for individuals and teams. Always free.

  • Unlimited users, backends, stacks, and resources
  • State inventory, redacted outputs, and backend diagnostics
  • Operation timelines, comparisons, and resource history
  • Up to 1 year of operation and resource history
  • Local accounts, fixed roles, and SQLite
  • Runner evidence ingestion and versioned exports
  • Customer-hosted SMTP notifications

Free

Explore Community

Business

For teams needing longer retention and more access controls.

  • Everything in Community
  • Retention up to 3,650 days
  • Custom roles and resource-scoped access
  • One OIDC or SAML sign-in connection
  • Saved views, signed webhooks, and advanced reliability summaries
  • PostgreSQL application database, single replica

Includes one installation.

$200 / month

Continue with Business

Enterprise

For organizations with broader identity and governance requirements.

  • Everything in Business
  • Multiple OIDC or SAML connections
  • SCIM provisioning and trusted-proxy sign-in
  • Legal-hold placement
  • Best-effort maintainer support

Includes one installation.

$500 / month

Continue with Enterprise

Enterprise Advanced Security

For restricted or air-gapped licensing. Not a separate security feature tier.

  • The same Enterprise capabilities
  • Organization-wide offline license
  • No connected licensing requirement
  • Identical application security controls and fixes

From $10,000 / year

Contact licensing

Prices are in USD. Monthly or annual subscriptions renew at the selected interval until canceled. Manage billing and cancellation from your account.

Downloads and documentation

Deploy by the digest in your version's release record, and follow the setup guide. Only the newest supported release is supported.

Docker HubDocumentation

Roadmap

  • Next: Simpler setup, recovery guidance, and further backend validation.
  • Future: A separate, opt-in control-plane module with its own execution credentials. Not available today. The core stays read-only; buying a license will not enable execution.

Share a workflow, feature request, or product question. Your feedback helps us prioritize improvements.

Feedback

Please leave credentials, state files, and confidential customer data out of your message.

Marolum is an independent product by Dekglas. It is not affiliated with, sponsored by, or endorsed by Pulumi Corporation; IBM or HashiCorp; The Linux Foundation or the OpenTofu project; Amazon Web Services; Microsoft; Google; or the PostgreSQL project or PostgreSQL Community Association of Canada. Product names and trademarks belong to their respective owners.