horkos 0.2.0

Cloud infrastructure language where insecure code won't compile
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

<div align="center">

<img src="web/public/logo.svg" width="64" height="64" alt="Horkos" />

# Horkos

**If it's insecure, it won't compile.**

[![Crates.io](https://img.shields.io/crates/v/horkos.svg)](https://crates.io/crates/horkos)
[![CI](https://github.com/aimable100/horkos/actions/workflows/ci.yml/badge.svg)](https://github.com/aimable100/horkos/actions)
[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue.svg)](#license)

A type-safe language for Terraform where insecure code won't compile.

[Try it Online](https://horkos.cloud) · [Documentation](https://horkos.cloud/#/docs) · [Changelog](docs/CHANGELOG.md) · [Twitter](https://twitter.com/horkosLang)

</div>

---

## Why Horkos?

Terraform lets you build anything. Including mistakes.

| Problem | Terraform | Horkos |
|---------|-----------|--------|
| Security | Opt-in | **Enforced** |
| Errors caught | CI/runtime | **Compile time** |
| AI-generated code | Compiles if insecure | **Fails until secure** |
| Audit trail | Comments (maybe) | **`unsafe` blocks** |

---

## How It Works

```horkos
// One line. Secure by default.
val bucket = S3.createBucket("data")
```

Compiles to 5 Terraform resources: bucket, versioning, encryption, public access block, logging.

```horkos
// Weakening security? Explain yourself.
val public = unsafe("Static website - ticket #402") {
    S3.createBucket("www", publicAccess: true)
}
```

**If it compiles, it's secure.**

---

## Get Started

```bash
# Install
cargo install horkos

# Write
echo 'val bucket = S3.createBucket("data")' > main.hk

# Compile
horkos compile
```

Or try it in your browser at [horkos.cloud](https://horkos.cloud).

<details>
<summary><strong>Other install methods</strong></summary>

**Homebrew**
```bash
brew install aimable100/tap/horkos
```

**npm**
```bash
npm install -g horkos
```

**Docker**
```bash
docker run --rm -v $(pwd):/workspace ghcr.io/aimable100/horkos compile
```

**Binary**

Download from [GitHub Releases](https://github.com/aimable100/horkos/releases).

**Verify Downloads**

All releases include checksums and Sigstore signatures:

```bash
# Verify checksum
sha256sum -c checksums-v0.2.0.txt

# Verify signature (requires cosign)
cosign verify-blob --signature horkos-linux-x64.tar.gz.sig \
  --certificate horkos-linux-x64.tar.gz.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github.com/aimable100/horkos' \
  horkos-linux-x64.tar.gz
```

</details>

---

## What's Supported

**Resources:** S3, VPC, Subnets, Security Groups, Internet Gateway, CloudWatch, RDS

**Language:**
- Type-safe resource creation
- `unsafe` blocks with mandatory justification
- Taint tracking (`Unverified<T>`) for imported Terraform
- Conditionals, list methods, string methods
- Compile-time `assert()`

**Terraform:** `>= 1.5.0` with AWS Provider `>= 5.0, < 6.0`

See [ROADMAP](docs/ROADMAP.md) for planned features.

---

## Documentation

- [User Guide](docs/GUIDE.md) - Language reference
- [Architecture](docs/ARCHITECTURE.md) - Compiler internals
- [Contributing](docs/DEVELOPMENT.md) - Development setup

---

## Security

Report vulnerabilities to security@horkos.cloud. See [SECURITY.md](SECURITY.md).

## License

MIT OR Apache-2.0

---

<div align="center">

*In Greek mythology, Horkos punished oath-breakers. Here, your infrastructure declarations are oaths.*

</div>