Mirrors, offline and Windows

Where downloads come from

Tool	Version list	Downloads	Checksums
Terraform	`releases.hashicorp.com`	`releases.hashicorp.com`	`SHA256SUMS` from the release
OpenTofu	GitHub API	`github.com` releases	`SHA256SUMS` from the release
Terragrunt	GitHub API	`github.com` releases	`SHA256SUMS` from the release

Signed downloads

New in 0.2.0 of the CLI and the server.

Before installing, teriac checks that the release's checksum file is signed by the tool's vendor, then checks the download against it. A tampered mirror or download is refused.

Tool	Signed by	Checked
Terraform	HashiCorp (PGP)	always
OpenTofu	OpenTofu (PGP)	always
Terragrunt	Gruntwork (PGP)	when the release publishes a signature (releases from early 2026 on); older ones are checked against their checksum only

The vendors' public keys ship with teriac. If your mirror doesn't copy the .sig / .gpgsig files, turn the check off:

export TERIAC_VERIFY_SIGNATURES=false

The checksum is still checked either way.

Mirrors

Download from an internal mirror (Artifactory, Nexus, …) instead of the public sites. Each variable replaces one host and keeps the rest of the path:

Variable	Replaces	Used for
`TERIAC_HASHICORP_MIRROR`	`https://releases.hashicorp.com`	Terraform (downloads and version list)
`TERIAC_GITHUB_MIRROR`	`https://github.com`	OpenTofu and Terragrunt downloads

export TERIAC_HASHICORP_MIRROR=https://artifactory.example.com/artifactory/hashicorp
export TERIAC_GITHUB_MIRROR=https://user:token@nexus.example.com/repository/github

Plain http:// mirrors and credentials in the URL work.
Checksums are still checked, against the mirrored SHA256SUMS file, and its signature too, so copy the .sig / .gpgsig files into your mirror as well.

How the path is kept

With TERIAC_HASHICORP_MIRROR=https://artifactory.example.com/artifactory/hashicorp:

https://releases.hashicorp.com/terraform/1.9.0/terraform_1.9.0_linux_amd64.zip
→ https://artifactory.example.com/artifactory/hashicorp/terraform/1.9.0/terraform_1.9.0_linux_amd64.zip

So set the mirror up as a remote (proxy) repository of the original host, with the same layout.

The GitHub API and rate limits

OpenTofu and Terragrunt version lists come from the GitHub API. GitHub allows 60 requests an hour without a token. Set GITHUB_TOKEN (or GH_TOKEN) to raise the limit; the token needs no permissions:

export GITHUB_TOKEN=ghp_xxx

If the API can't be reached, installing an exact version (teriac install 1.8.0 -p tofu) still works; latest and ranges like 1.8.^ need the list.

Offline and air-gapped machines

Version lists are cached for an hour in ~/.teriac/cache/.
Installed versions never need the network again: use, exec, auto-switch (when the version is installed) and the shell hook all work offline.
For air-gapped networks, point both mirror variables at your internal repository.

Proxies

teriac downloads with Node.js. Behind a proxy, use a mirror inside your network (above), or route traffic through your proxy at the network level.

Windows

Everything works on Windows without administrator rights:

Store: %USERPROFILE%\.teriac\
PATH: set with [Environment]::SetEnvironmentVariable("PATH", ..., "User") (User scope, no admin)
Shell hook: PowerShell profile, via teriac shell-init powershell
Plugin cache: %APPDATA%\terraform.rc

npm install -g @marcdomain/teriac
teriac install latest
teriac use latest
Add-Content $PROFILE "`nInvoke-Expression (teriac shell-init powershell | Out-String)"

Open a new terminal after the first run so the User PATH change is picked up.