Dependably Packages · Terraform

A private Terraform provider mirror

One network mirror in the CLI configuration, no change to any required_providers block. Providers come through a pull-through cache that verifies every checksum, so terraform init never reaches registry.terraform.io directly.

Read the setup guide About Dependably Packages

terraform init · providers

Point Terraform at your registry

Provider installation is configured once per machine, or per CI job with TF_CLI_CONFIG_FILE. If anonymous pull is off, the token goes in the mirror URL.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

hcl · repo.example.com

# ~/.terraformrc (or %APPDATA%\terraform.rc)
provider_installation {
  network_mirror {
    url = "https://repo.example.com/terraform/"
  }
}

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

The checksum is verified against the digest the upstream publishes before the artefact is stored.
The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
A name your organization reserves cannot be squatted upstream and resolved into your builds.
Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The Terraform guide continues with a verification step and reverting the configuration. Terraform is served as a mirror: it proxies and caches, and does not accept uploads.

Read the setup guide Keep bad packages out of your builds.Know when something is down or weakened before your users do.