Environment variables

Every secret can also be read from a file: set <NAME>_FILE to the file's path, for example TERIAC_GITHUB_PRIVATE_KEY_FILE=/run/secrets/app.pem.

CLI

Variable	Default
`TERIAC_HOME`	`~/.teriac`	Where versions, the active binaries and caches live
`TERIAC_HASHICORP_MIRROR`		Replaces `https://releases.hashicorp.com` (Terraform)
`TERIAC_GITHUB_MIRROR`		Replaces `https://github.com` (OpenTofu, Terragrunt)
`TERIAC_VERIFY_SIGNATURES`	`true`	Check the vendor's PGP signature on downloads; `false` for mirrors without `.sig` files.
`TERIAC_RETRY_DELAY_MS`	2s, 5s, 10s	Fixed wait between retries of a failed download (up to 4 attempts)
`GITHUB_TOKEN` / `GH_TOKEN`		Raises GitHub's API limit for OpenTofu and Terragrunt version lists
`TF_PLUGIN_CACHE_DIR`		Read by Terraform; `teriac plugin-cache status` reports it
`NO_COLOR`		Plain help output

Variable	Default
`TERIAC_GITHUB_APP_ID`		Required. The GitHub App's ID
`TERIAC_GITHUB_PRIVATE_KEY`		Required. The App's private key (PEM). `\n` is turned into newlines
`TERIAC_GITHUB_WEBHOOK_SECRET`		Required. The App's webhook secret
`TERIAC_GITHUB_API_URL`	`https://api.github.com`	GitHub Enterprise Server, e.g. `https://ghe.acme.com/api/v3`

Variable	Default
`TERIAC_REPO_ALLOWLIST`		Comma-separated repo globs, e.g. `github.com/acme/*`. Needed unless `repos.yaml` lists repos
`TERIAC_REPOS_CONFIG`	`<data dir>/repos.yaml`	The rules file. When set, it must exist
`TERIAC_REQUIRE_APPLY_PROJECT`	`false`	Refuse a bare `teriac apply`

Variable	Default
`TERIAC_PARALLELISM`	`4`	Plans and applies at once, across all PRs
`TERIAC_PR_PARALLELISM`	parallelism − 1	One PR's share
`TERIAC_RUN_TIMEOUT_SECONDS`	`3600`	Time limit per Terraform command (minimum 60)
`TERIAC_DEFAULT_VERSION`	`latest`	Tool version when a project pins none
`TERIAC_PREINSTALL`		Tools to install at start-up, e.g. `terraform@1.9.8,tofu@1.8.5`
`TERIAC_HASHICORP_MIRROR` / `TERIAC_GITHUB_MIRROR`		Download mirrors, as for the CLI
`GITHUB_TOKEN`		github.com token for OpenTofu/Terragrunt lists on GitHub Enterprise
`TERIAC_DRIFT`	`true`	Run drift schedules
`TERIAC_VERIFY_SIGNATURES`	`true`	Check the vendor's signature on downloaded tools.

Variable	Default
`TERIAC_ACK_REACTION`	`eyes`	`eyes`, `rocket`, `+1`, `heart`, `hooray`, `laugh`, `confused`, `-1` or `none`
`TERIAC_PROGRESS_REPLY`	`false`	Spinning "Running…" reply, edited into the result
`TERIAC_COMMENT_MODE`	`new`	`new` or `update`

Variable	Default
`TERIAC_PUBLIC_URL`	`http://localhost:<port>`	The server's public URL
`TERIAC_SESSION_SECRET`	random	Signs sessions; 32+ characters
`TERIAC_SESSION_HOURS`	`12`	Session length
`TERIAC_API_TOKEN`		Admin token for `/api`
`TERIAC_DASHBOARD_USERS_FILE`		YAML list of dashboard users
`TERIAC_OIDC_ISSUER`		Turns on OIDC sign-in
`TERIAC_OIDC_CLIENT_ID`		Required with OIDC
`TERIAC_OIDC_CLIENT_SECRET`		Required with OIDC
`TERIAC_OIDC_NAME`	`Okta` / `single sign-on`	Sign-in button label
`TERIAC_OIDC_SCOPES`	`openid,profile,email,groups`
`TERIAC_OIDC_GROUPS_CLAIM`	`groups`
`TERIAC_OIDC_ADMIN_GROUPS`		Comma-separated admin groups
`TERIAC_OIDC_ALLOWED_GROUPS`		Comma-separated viewer groups

New in 0.2.1. See Backups.

Variable	Default
`TERIAC_BACKUP_ENABLED`	`false`	Scheduled database backups, and restore onto an empty volume
`TERIAC_BACKUP_SCHEDULE`		Cron, e.g. `0 3 * * *`. Required
`TERIAC_BACKUP_TIMEZONE`	`UTC`	Time zone of the schedule
`TERIAC_BACKUP_BACKEND`		`s3`, `gcs` or `azure`. Required
`TERIAC_BACKUP_BUCKET`		Bucket (Azure: container) name only. Required
`TERIAC_BACKUP_PATH`	`teriac`	Folder in the bucket
`TERIAC_BACKUP_S3_REGION`
`TERIAC_BACKUP_S3_ENDPOINT`		S3-compatible services only (MinIO, R2, B2, …)
`TERIAC_BACKUP_S3_STORAGE_CLASS`		e.g. `STANDARD_IA`
`TERIAC_BACKUP_AZURE_ACCOUNT`		Storage account. Required for Azure
`TERIAC_BACKUP_AZURE_KEY`		Account key, if not using workload identity. Also `_FILE`
`TERIAC_BACKUP_NOTIFY`		Comma-separated channels from `repos.yaml`

Without workload identity, S3 uses AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, and GCS uses GOOGLE_APPLICATION_CREDENTIALS.

Variable	Default
`TERIAC_PORT`	`8080`	HTTP port
`TERIAC_DATA_DIR`	`/data`	Checkouts, plans, binaries, provider cache, database
`TERIAC_LOG_LEVEL`	`info`	`debug`, `info`, `warn`, `error`. Logs are JSON lines

repos.yaml names the variables that hold chat secrets, so you choose the names. Common ones:

Variable	Used by
`TERIAC_SLACK_TOKEN`	`channels.<name>.token_env` (Slack bot token)
`TERIAC_TEAMS_WEBHOOK`	`channels.<name>.webhook_url_env`

These are given to Terraform and Terragrunt (every other TERIAC_* variable is removed):

Variable
`TERIAC_REPO`	`owner/name`
`TERIAC_PR_NUMBER`	The PR number
`TERIAC_HEAD_SHA`	The commit being planned
`TERIAC_PROJECT`	The project's name
`TERIAC_WORKSPACE`	The workspace
`TERIAC_USER`	Who started the run
`TERIAC_BRANCH`	The branch (drift checks)
`TF_IN_AUTOMATION`, `TF_INPUT=0`, `CHECKPOINT_DISABLE=1`	Non-interactive Terraform
`TG_NON_INTERACTIVE`, `TG_NO_COLOR` (and `TERRAGRUNT_*` forms)	Non-interactive Terragrunt
`TF_PLUGIN_CACHE_DIR`	The shared provider cache