Settings

teriac server is configured with TERIAC_* environment variables, plus repos.yaml for rules. This page covers the settings you'll use most. Every variable is in the environment variable reference.

Environment variables

Env var	Default	What it does
`TERIAC_REQUIRE_APPLY_PROJECT`	`false`	`true` turns off a bare `teriac apply`; people must apply one project at a time with `-p`
`TERIAC_REPO_ALLOWLIST`		Allowed repos, e.g. `github.com/acme/*` (or list them in `repos.yaml`)
`TERIAC_REPOS_CONFIG`	`/data/repos.yaml`	Rules, approvers, channels, drift schedules
`TERIAC_PUBLIC_URL`	`http://localhost:<port>`	The URL GitHub and browsers use. Needed for links, the progress spinner and OIDC
`TERIAC_ACK_REACTION`	`eyes`	Reaction on a command teriac picked up: `eyes`, `rocket`, `+1`, `heart`, `hooray`, `laugh`, `confused`, `-1` or `none`. Per repo: `ack_reaction`
`TERIAC_PROGRESS_REPLY`	`false`	Off: each result is posted once, as a new comment, and never edited (👀 shows it was picked up). On: a spinning "Running…" reply that is edited into the result. Needs a public https `TERIAC_PUBLIC_URL`; skipped otherwise. Per repo: `progress_reply`
`TERIAC_COMMENT_MODE`	`new`	`new`: each plan and apply gets its own comment under the command. `update`: one comment at the top, edited in place. Per repo: `comment_mode`
`TERIAC_PARALLELISM`	`4`	Plans and applies running at once, across all PRs
`TERIAC_PR_PARALLELISM`	parallelism − 1	One PR's share, so other PRs always get a slot. Freed slots go to the PR with the fewest runs going
`TERIAC_DEFAULT_VERSION`	`latest`	Tool version when a project pins none
`TERIAC_PREINSTALL`		Warm the cache, e.g. `terraform@1.9.8,tofu@1.8.5`
`GITHUB_TOKEN`		Optional: teriac uses its GitHub App automatically. Set it on servers without a github.com App (GitHub Enterprise) to download OpenTofu and Terragrunt as a signed-in user. Needs no permissions
`TERIAC_GITHUB_MIRROR` / `TERIAC_HASHICORP_MIRROR`		Download OpenTofu/Terragrunt and Terraform from your own mirror (Artifactory, Nexus) instead of GitHub and HashiCorp
`TERIAC_DRIFT`	`true`	Run drift schedules
`TERIAC_SESSION_SECRET`	random	Signs dashboard sessions (32+ characters). Set it, or sessions end on restart
`TERIAC_API_TOKEN`		Admin token for automation and `/api`
`TERIAC_VERIFY_SIGNATURES`	`true`	Check the vendor's signature on downloaded Terraform, OpenTofu and Terragrunt; `false` for mirrors that don't copy `.sig` files.
`TERIAC_BACKUP_ENABLED`	`false`	Scheduled database backups. The `TERIAC_BACKUP_*` settings are on the Backups page

TERIAC_* values are never passed to Terraform. Each secret can also be read from a file: <NAME>_FILE.

Env vars and Helm values

Env var	Helm value
`TERIAC_GITHUB_APP_ID`	`github.appId`
`TERIAC_GITHUB_PRIVATE_KEY`, `TERIAC_GITHUB_WEBHOOK_SECRET`	`github.existingSecret` (keys `private-key`, `webhook-secret`)
`TERIAC_GITHUB_API_URL`	`github.apiUrl`
`TERIAC_REPO_ALLOWLIST`	`config.repoAllowlist`
`TERIAC_REQUIRE_APPLY_PROJECT`	`config.requireApplyProject`
`TERIAC_ACK_REACTION`	`config.ackReaction`
`TERIAC_PROGRESS_REPLY`	`config.progressReply`
`TERIAC_COMMENT_MODE`	`config.commentMode`
`TERIAC_PARALLELISM`	`config.parallelism`
`TERIAC_PR_PARALLELISM`	`config.prParallelism`
`TERIAC_RUN_TIMEOUT_SECONDS`	`config.runTimeoutSeconds`
`TERIAC_DEFAULT_VERSION`	`config.defaultVersion`
`TERIAC_PREINSTALL`	`config.preinstall`
`TERIAC_DRIFT`	`config.drift`
`TERIAC_PUBLIC_URL`	`config.publicUrl`
`TERIAC_LOG_LEVEL`	`config.logLevel`
`TERIAC_VERIFY_SIGNATURES`	`config.verifySignatures`
`TERIAC_BACKUP_*`	`backup.*` (see Backups)
`TERIAC_REPOS_CONFIG`	`repos` (the chart writes the file)
`TERIAC_OIDC_*`	`dashboard.oidc.*`
`TERIAC_DASHBOARD_USERS_FILE`	`dashboard.users`, `dashboard.usersExistingSecret`
`TERIAC_API_TOKEN`	`dashboard.apiToken.existingSecret`
`TERIAC_SESSION_SECRET`	`dashboard.sessionSecret.existingSecret` (generated if empty)
`TERIAC_SESSION_HOURS`	`dashboard.sessionHours`

Anything else goes in extraEnv or extraEnvFrom.

Comment styles

Three settings shape how teriac talks on a PR. They can be set per repo in repos.yaml too.

Setup	Feels like
Defaults	👀 on your comment, then a new comment with the result. Nothing is ever edited
`TERIAC_PROGRESS_REPLY=true`	A "Running…" reply with a spinner appears at once and turns into the result
`TERIAC_COMMENT_MODE=update`	One summary comment at the top of the PR, kept up to date
`TERIAC_ACK_REACTION=none`	No reaction

repos:
  - id: github.com/acme/infra
    ack_reaction: rocket
    progress_reply: true
    comment_mode: update

Parallelism

Plans and applies share TERIAC_PARALLELISM slots (4 by default) across all PRs. One PR can use at most TERIAC_PR_PARALLELISM (one less than the total), so there's always a slot for someone else, and a freed slot goes to the PR with the fewest runs going. Raise both for big monorepos, and give the pod CPU and memory to match.

Tool downloads

The server installs tools with the same code as the CLI, into its data volume:

the version each project pins, or TERIAC_DEFAULT_VERSION;
checksum-verified, then cached for every later run;
from your mirror with TERIAC_HASHICORP_MIRROR / TERIAC_GITHUB_MIRROR;
warmed at start-up with TERIAC_PREINSTALL.

On a github.com App, OpenTofu and Terragrunt lists are fetched with the App's own token. On GitHub Enterprise, set GITHUB_TOKEN to a github.com token (no permissions needed) to avoid the anonymous rate limit.

Private modules

The image has no SSH client, so Terraform module sources must use https: git::https://github.com/acme/modules.git//vpc?ref=v1.2.0, not git@github.com:…. For private modules, give git a token with extraEnv (or -e with Docker):

extraEnv:
  - { name: GIT_CONFIG_COUNT, value: "1" }
  - name: GIT_CONFIG_KEY_0
    valueFrom: { secretKeyRef: { name: teriac-git, key: insteadof } }   # url.https://x-access-token:<token>@github.com/.insteadOf
  - { name: GIT_CONFIG_VALUE_0, value: "https://github.com/" }

The key holds url.https://x-access-token:<token>@github.com/.insteadOf, so every https://github.com/ URL is fetched with the token. The token is a secret, so keep it in a Secret, as above, not in plain values.