A private Terraform provider mirror
One network mirror in the CLI configuration, no change to any required_providers block. Providers come through a pull-through cache that verifies every checksum, so terraform init never reaches registry.terraform.io directly.
Point Terraform at your registry
Provider installation is configured once per machine, or per CI job with TF_CLI_CONFIG_FILE. If anonymous pull is off, the token goes in the mirror URL.
The placeholders are your base URL and a token from the web UI.
# ~/.terraformrc (or %APPDATA%\terraform.rc)
provider_installation {
network_mirror {
url = "https://repo.example.com/terraform/"
}
}What happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- OSV publishes no advisory feed for Terraform providers, so the vulnerability arms of the policy gate do not apply here.
- A name your organization reserves cannot be squatted upstream and resolved into your builds.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The Terraform guide continues with a verification step and reverting the configuration. Terraform is served as a mirror: it proxies and caches, and does not accept uploads.