- Backend (
backend/, port 3000 by default) – orchestrator + REST APIs for repos/orgs/jobs. - Statesman (
taco/cmd/statesman, port 8080) – state storage API and Terraform Cloud-compatible endpoints. - UI (
ui/, port 3030) – TanStack Start frontend that talks to both services and WorkOS.
Prerequisites
- Go toolchain for backend + statesman, Node 18+ for UI (
pnpmornpm). - A WorkOS project with User Management enabled and at least one organization + member (needed for UI auth and org IDs).
- Optional: GitHub App for repo onboarding (the backend can help you create one via
/github/setup).
Shared secrets and ports
- Pick two secrets and reuse them across components:
ORCHESTRATOR_BACKEND_SECRET≡DIGGER_INTERNAL_SECRET(backend) ≡ UI env.STATESMAN_BACKEND_WEBHOOK_SECRET≡OPENTACO_ENABLE_INTERNAL_ENDPOINTS(statesman) ≡ UI env.
- Default ports: backend
3000, statesman8080, UI3030.
High-level workflow
- Start backend with internal + API endpoints enabled (so UI can call
/api/*and/github/*). - Start statesman with internal endpoints enabled; use memory storage for quick start.
- Configure UI
.env.localwith URLs + secrets + WorkOS creds; runpnpm dev --host --port 3030. - Sync org/user into backend and statesman (WorkOS org id and user id/email) via the provided curl snippets in each page.
- (Optional) GitHub App: set
ORCHESTRATOR_GITHUB_APP_URLto your install URL orhttp://localhost:3000/github/setupto create one via the backend.
Troubleshooting cheatsheet
- Backend /api/ returns 404*:
DIGGER_ENABLE_API_ENDPOINTSnottrueor org not upserted. - Statesman 403: webhook secret mismatch. Statesman 404/500 resolving org: org not synced (missing
external_org_id). - UI WorkOS auth succeeds but org is empty: add membership in WorkOS and resync org/user to services.
- GitHub connect opens 404: set
ORCHESTRATOR_GITHUB_APP_URLto a valid install/setup URL.

