teriac.yaml

teriac.yaml (or teriac.yml) sits at the root of a repo. It's optional: teriac finds projects on its own. Use it to name projects, pin versions, add watches, or add stricter rules.

Rules are read from the base branch, so a PR can't change its own rules.
The project list is read from the PR, so a new project is planned in the PR that adds it.
A repo's rules can only tighten the server's repos.yaml, never loosen them.
The server can ignore the file with allow_repo_config: false.

A complete example

autodiscover: true               # also find projects not listed here (default)
require_apply_project: true      # a repo can turn this on, never off
apply_requirements: [mergeable]

projects:
  - name: prod-network
    dir: live/prod/network
    workspace: default
    engine: terragrunt
    version: 1.9.8               # Terraform / OpenTofu version
    terragrunt_version: 1.2.1
    approvals: [{ from: team:network, count: 1 }]
    permissions:
      apply: [team:network]
  - name: orders
    dir: stacks/orders
    engine: opentofu
    autoplan: false
    watch: ["/lambda/orders/**", "scripts/build.sh"]

rules:
  - match: live/prod/**
    apply_requirements: [undiverged]
    two_person_rule: true

drift:
  - name: prod-nightly
    projects: ["live/prod/**"]
    schedule: "0 6 * * 1-5"
    timezone: Europe/Berlin
    notify: [infra-alerts]       # channel names from the server's repos.yaml

Top level

Key	Default
`autodiscover`	`true`	Find projects that aren't listed. `false`: only the listed ones
`projects`	`[]`	Projects, see below
`rules`	`[]`	Extra project rules, same shape as `repos.yaml`'s `projects[]`
`apply_requirements`	`[]`	`approved`, `mergeable`, `undiverged` for every project
`require_apply_project`	`false`	Refuse a bare `teriac apply`
`drift`	`[]`	Drift schedules (if the server allows `allow_repo_schedules`)
`reapprove_on_change`		`true` asks for a fresh approval after every code change. A repo can turn it on, never off.
`keep_approval_on_rebase`		`false` drops approvals on any rebase. A repo can turn it off, never on.
`stale_base`		`warn` or `block`: stricter than the server only.

projects[]

Key
`dir`	required	The project's folder, relative to the repo root. Must stay inside the repo
`name`	the folder (`dir@workspace` for other workspaces)	Used with `-p` and in comments
`workspace`	`default`	Terraform workspace
`engine`	detected	`terraform`, `opentofu` (or `tofu`), `terragrunt`
`version`	pinned files	Terraform / OpenTofu version
`terragrunt_version`	pinned files	Terragrunt version
`autoplan`	`true`	`false`: plan only on request
`watch`		Extra files that should re-plan this project (globs; a leading `/` is the repo root)
`approvals`		Extra required approvals
`permissions`		Extra permission limits
`apply_requirements`		Extra requirements

Per-project approvals, permissions and apply_requirements become a rule matching the project's name.

Same project, several workspaces

projects:
  - { name: app-staging, dir: stacks/app, workspace: staging }
  - { name: app-prod,    dir: stacks/app, workspace: prod, approvals: [{ from: team:sre, count: 2 }] }

teriac plan -p app-prod
teriac apply -p app-prod

Validation

Problems are reported on the PR. Unknown apply requirements are ignored with a warning; an unknown engine or a dir outside the repo is an error.