# Nojam documentation

How to install and run Nojam, set up Vault for it, move from one shared state to one per namespace, and check its security.

**This guide is published with the first public release.** Pilot customers get the full guide now, with the source repository.

[Request a pilot](https://nojam.io/pilot.md) or [join early access](https://nojam.io/early-access.md) to hear when it is out.

## Start here

- [Install Nojam for a pilot](https://nojam.io/docs/install.md): The host, the GitHub App, the Vault role, the runner image and the checks to run before production.
- [Your first pull request](https://nojam.io/docs/first-pull-request.md): A stack in runner.yaml, a plan on the pull request, an approval and an apply, end to end.

## Concepts

- [Stacks and targets](https://nojam.io/docs/stacks-and-targets.md): How a repository declares stacks, how each stack maps to targets such as dev, uat and production regions, and how they are discovered.
- [Plans and approvals](https://nojam.io/docs/plans-and-approvals.md): What is planned on a pull request, who may approve, how approval binds to the plan, and when a merge needs approval again.
- [Vault credentials for jobs](https://nojam.io/docs/vault-credentials.md): How a job logs in to Vault, the sealed hand-over, read-only plan roles, apply roles bound to main, and revocation.
- [Deployments and rollback](https://nojam.io/docs/deployments-and-rollback.md): Promotion order, canary regions, all-or-nothing deployments, and what rollback restores and what it cannot.

## Vault

- [Vault setup](https://nojam.io/docs/vault-setup.md): What Nojam needs on each cluster: the JWT auth mount, the roles, the policies and the issuer, with a platform stack in Terraform.
- [Namespaces and vending](https://nojam.io/docs/namespaces.md): One namespace per team on Vault Enterprise, and creating a team namespace from one line in teams.yaml.
- [Splitting a shared state](https://nojam.io/docs/state-split.md): Moving from one shared state to one per namespace with nojam state split, proven with zero-diff plans before anything applies.
- [Protection rules](https://nojam.io/docs/protection.md): The built-in baseline, break-glass, critical mounts, grants across namespaces and your own rules by Vault path.
- [Providers and modules](https://nojam.io/docs/providers.md): The provider mirror, the allow-list, lock files, provider changes on the pull request, and module pinning.

## Operating Nojam

- [Configuration reference](https://nojam.io/docs/configuration.md): Every server and runner setting, runner.yaml, sign-in, ServiceNow, OPA, audit anchoring and compliance streaming.
- [Pipeline steps](https://nojam.io/docs/pipeline-steps.md): Your own checks after every plan, declared once by the platform team, that a pull request cannot drop.
- [High availability](https://nojam.io/docs/high-availability.md): Several replicas on PostgreSQL, leader election, durable webhooks and fenced runner attempts.
- [Alerts](https://nojam.io/docs/alerts.md): The Prometheus alert rules and the runbook for each one.
- [Backup and restore](https://nojam.io/docs/backup-and-restore.md): What to back up, how to restore, and the restore drill.
- [Retention](https://nojam.io/docs/retention.md): What Nojam keeps and for how long: webhook payloads, plan files, job logs and the audit log.
- [Support bundle](https://nojam.io/docs/support-bundle.md): What to send when something is stuck, and what is never in it.

## Security

- [Threat model](https://nojam.io/docs/threat-model.md): What Nojam protects, the actors and trust boundaries, the threats and controls, and the open items.
- [Cryptographic inventory](https://nojam.io/docs/cryptography.md): The keys Nojam holds and the algorithms it uses.
- [Security testing](https://nojam.io/docs/security-testing.md): The checks on every change, the fix time frames, and how findings are handled.
- [Verifying a release](https://nojam.io/docs/verifying-releases.md): Checking cosign signatures, SBOMs and SLSA provenance before you install.

---

Canonical page: https://nojam.io/docs/  
Site map for AI agents: https://nojam.io/llms.txt