Introduction

teriac covers the whole path of an infrastructure change, from the binary on your laptop to the apply that runs after review. It works with Terraform, Terragrunt and OpenTofu, and has two parts you can use together or apart.

	teriac CLI	teriac server
What it is	One CLI: versions, plans and applies	Pull request automation you host yourself
Where it runs	Your laptop, CI runners	Docker or Kubernetes (Helm)
Install	npm install -g @marcdomain/teriac	ghcr.io/marcdomain/teriac-server image or the teriac-server chart
What you get	The right tool version in every project, without sudo	A plan on every push, an Apply button, permissions, approvals, policy checks, drift alerts and a dashboard
Version	0.2.1	0.2.1

The CLI

teriac installs, switches and manages several versions of each tool. Every binary lives in ~/.teriac/, so upgrading teriac itself never removes the versions you installed.

• Install and switch any version, including patch ranges like 1.9.^ and pre-releases.
• Auto-switch reads .terraform-version, .tool-versions, terragrunt.hcl, the state file or required_version, and installs what's missing.
• Shell hook: entering a Terraform project switches the version for you.
• Pin a version for your team, upgrade to the latest patch, prune old versions, run one command with another version with exec, and check your setup with doctor.
• Verified downloads: every Terraform, Terragrunt and OpenTofu download is checked against their published SHA256 checksums.
• Corporate networks: mirrors such as Artifactory and Nexus, proxies, offline installs.
• macOS, Linux and Windows, with no administrator rights needed.

Start with Installation, then How it works.

The server

teriac server watches your pull requests. On every push it:

1. finds the affected projects, with no config needed;
2. plans each one with the exact tool version it pins;
3. posts the plan as a comment, with the exact command to apply each project, and a check run per project with an Apply button.

Every action goes through per-project permissions and required approvers taken from your Git platform's users and teams. On top of that you get:

• Terraform commands from the PR: state list, import, output, state mv and more, each with its own permission;
• policy checks on every plan, including scanners like Checkov;
• the two-person rule and tamper-proof output;
• Terragrunt dependency handling: no apply on mock outputs, re-plans after a dependency is applied, dependency order;
• scheduled drift checks that alert Slack, Teams, Discord, Google Chat or any webhook, and tag who last changed each resource;
• a dashboard and REST API with OIDC sign-in, and Prometheus metrics.

Start with the server overview, or go straight to the quick start.

Where to go next

I want to…	Read
Install the CLI	Installation
Move over from tfv	Migrating from tfv
Switch versions per project	Auto-switch and pinning
Use teriac in a pipeline	Using teriac in CI
Run the server	Quick start
Control who can apply	Rules and permissions
Look up a setting	Environment variables, repos.yaml, teriac.yaml
Fix a problem	FAQ and troubleshooting

teriac is open source under the MIT license: github.com/marcdomain/teriac.