> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations

> Understand which providers Towbar supports, where credentials live, and when each integration appears.

Towbar integrations are enabled by the control-plane environment. The dashboard does not collect provider secrets and shows only integrations whose required values pass startup validation. Each provider has one installation-wide configuration.

GitHub and GitLab require a second connection step after their runtime identity is valid. GitHub installs a GitHub App on an account or organization. GitLab authorizes one account through OAuth. Other providers become available as soon as their environment configuration is valid and the API restarts.

## Supported integrations

| Category           | Providers                                                                      | Used for                                                                                      |
| ------------------ | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
| Source control     | GitHub App, GitLab OAuth                                                       | Repository discovery, immutable source archives, webhooks, previews, and deployment reporting |
| Container registry | OCI Registry V2                                                                | Private image pulls and image transfer between build and runtime servers                      |
| Backup storage     | AWS S3, S3-compatible, Cloudflare R2, Google Cloud Storage, Azure Blob Storage | Managed-database backup objects and restore sources                                           |
| External secrets   | Infisical, Doppler                                                             | Resolving referenced values during deployment without placing them in Git                     |
| Platform services  | Cloudflare, OpenTelemetry                                                      | DNS or tunnel operations, and workload telemetry export                                       |
| Notifications      | Slack, email through SMTP, Discord, Telegram, webhook push                     | Transactional mail and category-based operational notifications                               |
| Log forwarding     | New Relic, Axiom, Better Stack, Datadog, OpenTelemetry OTLP, Grafana Loki      | Batched workload-log delivery independent of deployment workflows                             |

## Configuration model

1. Edit `/etc/towbar/towbar.env` on the control-plane host.
2. Enable the provider and add its required values. Structured notification and log-forwarding settings use the documented JSON variables.
3. Run `sudo towbar config validate`.
4. Apply the change with `sudo towbar restart`.
5. Open **Manage → Integrations** and verify that the provider appears.

A partial enabled configuration fails validation instead of creating a broken dashboard entry. Secrets are read by the process that needs them and are not returned to the browser. GitLab OAuth grants are encrypted in PostgreSQL; GitHub stores only selected installation metadata.

Use the [environment variable reference](/docs/reference/environment-variables#runtime-integrations) for exact names. Continue with the provider-specific guides for [GitHub](/docs/integrations/github), [GitLab](/docs/integrations/gitlab), [AWS](/docs/integrations/aws), [Google Cloud](/docs/integrations/gcp), [Azure](/docs/integrations/azure), [notifications](/docs/integrations/notifications), and [log forwarding](/docs/integrations/log-drains).

## Provider access

Grant the narrowest permissions that support the configured workflows. Limit source access to intended repositories, backup identities to declared buckets or containers and prefixes, notification bots to target channels, and external-secret identities to the projects and environments that reference them.

After rotating a credential, validate and restart Towbar, exercise one real operation, and revoke the previous credential only after the new path succeeds. A **Configured** state proves that Towbar accepted the environment shape; it does not prove the remote provider accepted an operation.

## Removing an integration

Pause dependent automation first. Disable the provider, validate, restart, and confirm it disappears from **Manage → Integrations**. Existing operational history remains, but queued or future work that requires the missing provider fails closed. Remove manifests or routes that still reference it, then revoke the remote credential.