Terraform provider

The FuseScope provider, fuseone-io/fusescope, lets Terraform and OpenTofu create, change and delete FuseScope resources through the FuseScope API. Keep alerts, dashboards and access in Git, review them in pull requests and apply the same configuration to every environment.

Use this page when you want to manage FuseScope from Terraform or OpenTofu: install the provider, authenticate it and find the resource you need.

Requirements

• Terraform 1.4 or later, or OpenTofu 1.6 or later. Older Terraform versions show permanent drift on nested attributes that FuseScope fills in.
• A FuseScope instance reachable from where Terraform runs.
• A service account API key whose role can manage the resources you declare (see Authenticate).

Install

The provider is published on the Terraform Registry as fuseone-io/fusescope. Declare it and run terraform init (or tofu init):

versions.tf

terraform {
  required_providers {
    fusescope = {
      source  = "fuseone-io/fusescope"
      version = "~> 0.1"
    }
  }
}

provider "fusescope" {
  endpoint = "https://fusescope.example.com"
}

Install without the Registry

Each GitHub release has signed zip archives for Linux, macOS, Windows and FreeBSD. For an air-gapped machine, unpack the archive for your platform into a local plugin directory:

VERSION=0.1.0
PLATFORM=linux_amd64
DIR=~/.terraform.d/plugins/registry.terraform.io/fuseone-io/fusescope/$VERSION/$PLATFORM
mkdir -p "$DIR"
unzip terraform-provider-fusescope_${VERSION}_${PLATFORM}.zip -d "$DIR"
terraform init

Check the archive against terraform-provider-fusescope_<version>_SHA256SUMS from the same release before you unpack it. OpenTofu reads the same directory layout under ~/.terraform.d/plugins.

Authenticate

The provider sends a FuseScope API key on every request. Create it on a service account:

1. In Settings → Service Accounts, create a service account, for example terraform.
2. Give it a role that covers what you manage. Editor is enough for alert rules, dashboards, saved views and planned downtimes. Notification channels, routing policies, users, service accounts and single sign-on need Admin.
3. Add a key and copy it. It is shown only once.

Pass the key and the URL through environment variables, so the secret stays out of your configuration:

export FUSESCOPE_ENDPOINT=https://fusescope.example.com
export FUSESCOPE_ACCESS_TOKEN=<service account API key>
terraform plan

Provider argument	Environment variable	Default	Meaning
endpoint	FUSESCOPE_ENDPOINT	http://localhost:8080	Root URL of the FuseScope instance.
access_token	FUSESCOPE_ACCESS_TOKEN	none	Service account API key. Sensitive.
http_timeout	FUSESCOPE_HTTP_TIMEOUT	provider default	Request timeout as a Go duration, for example 35s.
http_max_retry	FUSESCOPE_HTTP_MAX_RETRY	provider default	Retries on transient failures.

An argument set in the provider block wins over its environment variable.

Caution

Terraform state holds the values of sensitive attributes, such as webhook URLs, PagerDuty keys and the RUM public key. Keep state in an encrypted remote backend with restricted access.

Resources

Every resource has a data source with the same name, so you can read objects created in the UI. The full attribute reference is on the Registry.

Area	Resource	What it manages
Alerting	fusescope_rule	Alert rules: metrics, logs, traces, exceptions and PromQL
	fusescope_notification_channel	Notification channels: Slack, PagerDuty, Opsgenie, Microsoft Teams, Google Chat, email, webhook and more
	fusescope_route_policy	Routing policies
	fusescope_planned_maintenance	Planned downtime
Dashboards	fusescope_dashboard	Dashboards
	fusescope_public_dashboard	Public sharing of a dashboard
	fusescope_saved_view	Saved Explorer views for logs, traces and metrics
Real User Monitoring	fusescope_rum_application	RUM applications and their first public key
Access	fusescope_user, fusescope_user_role	Users and role assignments
	fusescope_service_account, fusescope_service_account_role	Service accounts and their roles
	fusescope_auth_domain	Single sign-on domains (OIDC, SAML)

fusescope_role is a data source only. Role assignments take the ID of a built-in role (signoz-viewer, signoz-editor or signoz-admin); GET /api/v1/roles lists the IDs of your instance.

variable "viewer_role_id" {
  type = string
}

resource "fusescope_service_account" "dashboards_bot" {
  name = "dashboards-bot"
}

resource "fusescope_service_account_role" "dashboards_bot" {
  service_account_id = fusescope_service_account.dashboards_bot.id
  role_id            = var.viewer_role_id
}

Not supported

The provider follows what the FuseScope backend accepts:

• Custom roles. FuseScope has only the built-in Viewer, Editor and Admin roles, so there is no fusescope_role resource.
• Anomaly alert rules. A fusescope_rule with rule_type = "anomaly_rule" is rejected; use threshold_rule or promql_rule.
• Telegram channels. The telegram channel config is in the schema but FuseScope does not accept it.

Guides

• Alerts as code: channels, rules and routing policies for one service.
• RUM applications: create an application and feed its key to the browser SDK.
• Import existing resources: bring objects created in the UI under Terraform.

The provider is open source under the Mozilla Public License 2.0: fuseone-io/terraform-provider-fusescope.