Create a VPS and roll a stack with Terraform — not tokens in the chat.
A Terraform connection points at modules you have allowlisted. Workflows can validate, plan, apply and show the result. Destroy stays off unless the connection allows it and a person has approved. Typical work: a Proxmox VM, deploying or upgrading a stack, preparing an environment. Provider credentials — including Proxmox API tokens — stay in the tenant vault. The run can be local or over an existing SSH connection.
What Terraform does here
Catalog-gated `terraform` connector (`addon.terraform`). It appears only when the connector is deployed and the tenant is entitled. An empty module allowlist fails closed.
Connections in admin
Register the connection, working directory and Terraform or OpenTofu binary. Secrets are not stored in the graph.
Proxmox VMs
Proxmox is a first-class provider path: API tokens and passwords go to secret-service, never into Terraform vars or the prompt. A workflow can create or change a VM from an allowlisted module.
Validate, plan, apply
Capabilities cover validate, plan, apply and show. Destroy is a separate, opt-in operation on that connection.
Allowlisted modules
Only listed modules and variable keys may run. Names that look like secrets are rejected — put those in the vault.
Local or over SSH
Terraform can run on the platform host or through an SSH connection to the machine that has the CLI and modules.
From a workflow step
The canvas selects the Terraform connector, connection, module and operation. Tenant policy and entitlements still apply before it runs.
Explore more
WinRM / PSRP
WinRM and PowerShell Remoting (PSRP) are one Windows connector family. You store the host and choose WinRM or PSRP, keep passwords and certificates in the vault, then test the path or run allowlisted Windows Ansible books. Same idea as SSH: a governed connection, not a shell in the prompt.
Ansible
Ansible connections bind inventory and playbooks into governed workflow steps. A run uses an allowlisted playbook, secret-referenced credentials and tenant policy. Chat does not get a free ansible-playbook shell.
SSH
SSH connections store host, port, user and secret-referenced keys. Workflows run allowlisted command profiles. Free-form ssh.execute-command is disabled; use ssh.execute-profile.
VPN
VPN connections (IPsec, SSTP or WireGuard, client or server role) sit in the same governed catalog as SSH and Ansible. Typical path: gateway first, then SSH or playbooks on the far side.
Workflows
A workflow is more than a diagram. It defines what happens, in what order, under which conditions and what should happen when a human needs to step in. Create workflows from triggers, agents, knowledge retrieval, decisions, tools, loops, approvals and actions.
Connectors
The platform composes tools, capabilities and connections: MCP, REST, SQL, GitHub, SSH, Ansible, Terraform, WinRM/PSRP and other deployed connectors. Calls go through tenant policy and secret references.
Ready to move beyond the chatbot?
Build AI that understands your business, follows your processes, finishes the work — and keeps token spend under your control.