Skip to main content
Towbar integrations are enabled by the control-plane environment. The dashboard does not collect provider secrets and shows only integrations whose required values pass startup validation. Each provider has one installation-wide configuration. GitHub and GitLab require a second connection step after their runtime identity is valid. GitHub installs a GitHub App on an account or organization. GitLab authorizes one account through OAuth. Other providers become available as soon as their environment configuration is valid and the API restarts.

​
Supported integrations

​
Configuration model

  1. Edit /etc/towbar/towbar.env on the control-plane host.
  2. Enable the provider and add its required values. Structured notification and log-forwarding settings use the documented JSON variables.
  3. Run sudo towbar config validate.
  4. Apply the change with sudo towbar restart.
  5. Open Manage → Integrations and verify that the provider appears.
A partial enabled configuration fails validation instead of creating a broken dashboard entry. Secrets are read by the process that needs them and are not returned to the browser. GitLab OAuth grants are encrypted in PostgreSQL; GitHub stores only selected installation metadata. Use the environment variable reference for exact names. Continue with the provider-specific guides for GitHub, GitLab, AWS, Google Cloud, Azure, notifications, and log forwarding.

​
Provider access

Grant the narrowest permissions that support the configured workflows. Limit source access to intended repositories, backup identities to declared buckets or containers and prefixes, notification bots to target channels, and external-secret identities to the projects and environments that reference them. After rotating a credential, validate and restart Towbar, exercise one real operation, and revoke the previous credential only after the new path succeeds. A Configured state proves that Towbar accepted the environment shape; it does not prove the remote provider accepted an operation.

​
Removing an integration

Pause dependent automation first. Disable the provider, validate, restart, and confirm it disappears from Manage → Integrations. Existing operational history remains, but queued or future work that requires the missing provider fails closed. Remove manifests or routes that still reference it, then revoke the remote credential.
Last modified on September 22, 2026