New nametfv is now teriac. See what changed and how to move over.
v0.2.1

Open source · MIT · CLI 0.2.1 · Server 0.2.1

Terraform, Terragrunt, and OpenTofu, from your laptop to your pull requests.

One CLI for versions, plans and applies on your machine and in CI, and a self-hosted server that plans and applies your infrastructure from pull requests, with the right people approving every change.

Get started Server quick start
npm install -g @marcdomain/teriac

Press / to search the docs

~/projects/infra
$ npm install -g @marcdomain/teriac
$ teriac install latest
Installed terraform 1.17.2 successfully!
$ teriac install latest -p tofu
Installed opentofu 1.13.9 successfully!
$ teriac use 1.17.2
Now using terraform 1.17.2
$ teriac pin # writes .terraform-version
$ teriac ls
Installed terraform versions
  1.17.2 🚀
  1.16.7
$ teriac doctor
All checks passed. teriac is healthy.
Works with
  • Terraform
  • Terragrunt
  • OpenTofu
  • GitHub
  • GitHub Enterprise
  • Docker
  • Kubernetes
  • macOS
  • Linux
  • Windows

Two tools, one workflow

Use them together, or one at a time

The CLI and the server resolve versions the same way, so what you run locally is what gets planned in the pull request.

CLI · v0.2.1

teriac

One command for Terraform, Terragrunt and OpenTofu: install and switch versions, run plans and applies, and keep every project on the right version. Upgrading teriac never removes the versions you installed.

  • Install, switch and remove versions without sudo; everything lives in ~/.teriac/
  • Switches for you on cd, from .terraform-version, .tool-versions, terragrunt.hcl or required_version
  • Every download checked against its published SHA256 checksums
  • Pin, upgrade, prune, exec and doctor, plus tab completion
  • macOS, Linux and Windows, with mirrors for internal networks
npm install -g @marcdomain/teriac
CLI docs Command reference npm

Server · v0.2.1

teriac server

Pull request automation you host yourself. Every push gets a plan; every apply goes through the right people.

  • Finds the projects a pull request affects, with no config
  • Plans each one with the exact tool version it pins
  • Apply button that always runs the saved, reviewed plan
  • Per-project permissions and approvers from your teams
  • Policy checks, the two-person rule and an audit log
  • Drift alerts to Slack, Teams, Discord, Google Chat or webhooks
docker run -p 8080:8080 -v teriac-data:/data \
  -e TERIAC_GITHUB_APP_ID=123456 \
  -e TERIAC_GITHUB_PRIVATE_KEY_FILE=/run/secrets/app.pem \
  -e TERIAC_GITHUB_WEBHOOK_SECRET_FILE=/run/secrets/webhook \
  -e TERIAC_REPO_ALLOWLIST='github.com/acme/*' \
  ghcr.io/marcdomain/teriac-server:0.2.1
Quick start Helm chart Image

teriac server

From pull request to apply, in three steps

  1. 01

    Push

    Open or update a pull request. teriac finds every project the change touches: modules, Terragrunt includes, watched files.

  2. 02

    Plan

    Each project is locked and planned with the version it pins. The plan, policy findings and the apply command land in the PR.

  3. 03

    Apply

    Once the right people approve, click Apply or comment teriac apply. The saved plan runs, exactly as reviewed, and is audited.

Comment to run

Plan, apply and unlock from the pull request, or run Terraform commands like state list, import and output, each behind its own permission.

All PR commands
Pull request comments
teriac plan
teriac plan -p live/prod/app -t aws_instance.web
teriac plan -p live/prod/app --refresh-only
teriac apply -p live/prod/app
teriac state list -p live/prod/app
teriac unlock

Why teriac

Built for teams that ship infrastructure

Right version, every time

Version files, Terragrunt constraints and required_version are read for you. The shell hook switches on cd.

Learn more

Plans on every push

Affected projects are found on their own, including modules and Terragrunt includes, and planned in parallel.

Learn more

Per-project permissions

Who can plan, apply, destroy or edit state, and how many approvals each project needs, from your Git teams.

Learn more

Policy checks

Rules on every plan, plus any scanner such as Checkov. Audit or enforce, with an audited override.

Learn more

Drift alerts with blame

Scheduled read-only plans that tag who last changed each drifted resource, in the chat your team uses.

Learn more

Terragrunt aware

Mock outputs, re-plans and apply order are handled, so you never apply a plan built on wrong outputs.

Learn more

See it run

Watch a change go from laptop to apply

The PR comment, Terraform commands, the apply report and the dashboard

Start in thirty seconds

Install the CLI, or have the server planning your pull requests by lunch.

npm install -g @marcdomain/teriac
Install guide Star on GitHub