Config File

The config file is a TypeScript module (default: ./infrastructure.ts) that defines your infrastructure and exports resources for the engine.

Export Format

Single Provider

export default {
  provider: 'aws',
  resources: [vpc, vm, db],
};

Multi-Provider

export default {
  provider: 'aws',
  providers: {
    aws: { region: 'us-east-1' },
    gcp: { region: 'us-central1' },
  },
  resources: [awsVm, gcpVm],
};

Remote State Backend

Optional. Config-file only — there are no CLI flags for backend settings.

export default {
  provider: 'aws',
  backend: {
    type: 's3',
    bucket: 'kyku-state',
    region: 'us-east-1',
    key: 'prod/state.json',
  },
  resources: [vpc, vm, db],
};

backend: {
  type: 'gcs',
  bucket: 'kyku-state',
  key: 'prod/state.json',
}

backend: {
  type: 'spaces',
  bucket: 'kyku-state',
  region: 'nyc3',
  key: 'prod/state.json',
}

backend: {
  type: 'http',
  address: 'https://state.example.com/prod/state.json',
}

State load/save is atomic on that object. The lock is ${key}.lock in the same bucket, or ${address}.lock for HTTP. S3 uses the standard AWS chain; GCS uses Application Default Credentials; Spaces uses DO_SPACES_ACCESS_KEY / DO_SPACES_SECRET_KEY (endpoint https://<region>.digitaloceanspaces.com); HTTP uses KYKU_HTTP_TOKEN or KYKU_HTTP_USERNAME + KYKU_HTTP_PASSWORD. Missing object-store credentials fail with an actionable error; Kyku never falls back to local .kyku/.

Include the environment in key (or address) if you use --env. Supported types: s3, gcs, spaces, http.

Individual resources can override the default provider:

const gcpVm = new Vm({
  id: 'vm-gcp',
  name: 'gcp-server',
  provider: 'gcp',
  // ...
});

Tags and Labels

All resources accept a tags record that maps to provider-native labels:

new Vm({
  tags: {
    environment: 'production',
    'managed-by': 'kyku',
  },
});

Tags never create dependency edges in the graph.

Object vs String References

Referencing a resource object creates a dependency edge. String references by logical ID do not:

// ✅ Object reference — creates Vm → Vpc dependency
network: myVpc,

// ❌ String reference — NO dependency created
network: 'vpc-main',

Always use object references for proper dependency ordering.

Provider-Specific Config Options

Common

new Vpc({
  region: 'us-east',                    // Abstract region
  distributeAcrossAzs: 3,               // Auto-subnet count
});

VM

Property	Type	Description
instanceType	InstanceType	Abstract size or provider map
image	ImageType	Abstract image or provider map
network	Vpc | string	VPC reference
subnet	Subnet | string	Subnet reference
securityGroups	(SecurityGroup | string)[]	Security groups
sshPublicKey	string	Public key content
sshKey	SshKey | string	SSH key reference
userData	string	Cloud-init script
distributeAcrossAzs	boolean	Auto-placement across AZs

Database

Property	Type	Description
engine	'postgresql' | 'mysql' | 'mariadb'	Database engine
version	string	Engine version
instanceType	InstanceType	Abstract size
storage	number	Storage in GB
username	string	Master username
password	Secret<string>	Master password (auto-encrypted)
iamAuth	boolean	IAM authentication
vpc	Vpc | string	VPC placement
securityGroups	(SecurityGroup | string)[]	Security groups
backupRetention	number	Backup retention days

Load Balancer

Property	Type	Description
lbType	'application' | 'network'	LB type
vpc	Vpc | string	VPC reference
listeners	LoadBalancerListener[]	Listener configs
healthCheck	HealthCheck	Health check config
spanAcrossAzs	boolean	Cross-AZ balancing
securityGroups	(SecurityGroup | string)[]	Attached SGs
size	string	Abstract size