otty / apps

All apps/Terraform

Terraform

terraform

An infrastructure as code tool that lets you build, change, and version infrastructure safely and efficiently.

Runs as terraform|macOS, Linux, Windows|developer.hashicorp.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Terraform in your home directory Every rule on this page, by file

plugin_cache_dir = "/Users/octocat/.terraform.d/plugin-cache"machine-local

disable_checkpoint = true

credentials "app.terraform.io" {

…

Each machine keeps its own copy of these.

token

Lifted into your secret store; the rest of the file syncs.

· ~/.terraform.d/credentials.tfrc.json Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/terraform/otty.tomlThe file this page is generated from

id = "terraform"

name = "Terraform"

homepage = "https://developer.hashicorp.com/terraform"

description = "An infrastructure as code tool that lets you build, change, and version infrastructure safely and efficiently."

icon = "SimpleIcons:terraform"

executables = ["terraform"]

[dotfiles]

# https://developer.hashicorp.com/terraform/cli/config/config-file — on Unix

# and macOS "the configuration file must be named .terraformrc (with a leading

# period) and placed in the user's home directory"; on Windows "the file must

# be named terraform.rc and placed in the user's %APPDATA% directory". They

# are one file under two names, which the sibling check cannot see from the

# names, so every rule below pairs them by hand.

paths = [

"~/.terraformrc",

"%APPDATA%/terraform.rc",

]

exclude = []

# https://developer.hashicorp.com/terraform/cli/commands/login — "Terraform

# will obtain an API token and save it in plain text in a local CLI

# configuration file called credentials.tfrc.json", written to ~/.terraform.d

# on Unix and %APPDATA%\terraform.d on Windows. The file is nothing but

# {"credentials": {"<host>": {"token": …}}}, so the whole of it is the

# credential. `terraform logout` removes the same file.

secret = [

"~/.terraform.d/credentials.tfrc.json",

"%APPDATA%/terraform.d/credentials.tfrc.json",

]

# The other place an HCP Terraform token lands is a `credentials "host" {

# token = … }` block in the CLI configuration file itself — the `credentials`

# setting on the config-file page. The file is HCL, so the rule is

# line-oriented, and `token` is the only argument such a block takes. Both

# names of the file, or the token is lifted out on Unix and syncs in the clear

# from a Windows machine.

[[dotfiles.secret_paths]]

file = ["~/.terraformrc", "%APPDATA%/terraform.rc"]

match = { prefix = ["token"] }

# plugin_cache_dir is an absolute directory on this machine's disk — same

# page: "Enables plugin caching by specifying a directory path where provider

# plugins are stored". Wanting the cache is portable; the path to it is not.

# The directory is one the user named, so it is kept for rebuilding this

# machine rather than dropped, and never applied to another.

[[dotfiles.machine_lines]]

file = ["~/.terraformrc", "%APPDATA%/terraform.rc"]

match = { prefix = ["plugin_cache_dir"] }

scope = "backup"

[commands]

format = 1

label = "Terraform workflow"

description = "Initialize, validate, plan and apply Terraform configuration. Only flags listed in the Fig spec are offered, so apply -auto-approve and similar are left out."

quality = "ai-draft"

base = "fig:terraform"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/terraform.ts"

license = "MIT"

[[commands.field]]

id = "chdir"

label = "Working directory"

type = "path"

option = ["-chdir"]

path = { kind = "directory", role = "input", must_exist = true }

sources = ["fig"]

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["chdir"]

[[commands.subcommand]]

path = ["init"]

label = "Initialize working directory"

description = "Download providers and modules. Backend options are left out."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/terraform.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "upgrade"

label = "Upgrade modules and plugins"

type = "boolean"

option = ["-upgrade"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "no_color"

label = "Disable color"

type = "boolean"

option = ["-no-color"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "init"

label = "Initialize"

fields = ["upgrade"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["upgrade", "no_color"]

[[commands.subcommand]]

path = ["validate"]

label = "Validate configuration"

description = "Check whether the configuration is valid."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/terraform.ts"

license = "MIT"

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = []

[[commands.subcommand]]

path = ["plan"]

label = "Plan changes"

description = "Show what Terraform would change. Nothing is applied."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/terraform.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "out"

label = "Save plan to file"

type = "path"

option = ["-out"]

path = { kind = "file", role = "output", must_exist = false }

effect = "overwrite"

sources = ["fig"]

[[commands.subcommand.field]]

id = "var_file"

label = "Variable file"

type = "path"

option = ["-var-file"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.field]]

id = "var"

label = "Variables (name=value)"

type = "string"

option = ["-var"]

multiple = true

sources = ["fig"]

[[commands.subcommand.field]]

id = "target"

label = "Target resource addresses"

type = "string"

option = ["-target"]

multiple = true

sources = ["fig"]

[[commands.subcommand.field]]

id = "destroy"

label = "Plan to destroy everything"

type = "boolean"

option = ["-destroy"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "detailed_exitcode"

label = "Detailed exit code"

type = "boolean"

option = ["-detailed-exitcode"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "refresh"

label = "Refresh state first"

type = "enum"

option = ["-refresh"]

choices = [{ value = "true", label = "Yes" }, { value = "false", label = "No" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "parallelism"

label = "Parallelism"

type = "integer"

option = ["-parallelism"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "no_color"

label = "Disable color"

type = "boolean"

option = ["-no-color"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "plan"

label = "Plan and save"

fields = ["out", "var_file", "var"]

required = []

[[commands.subcommand.task]]

id = "destroy_plan"

label = "Plan a destroy"

fields = ["destroy", "out"]

required = ["destroy"]

set = { destroy = [true] }

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["out", "var_file", "var", "target", "destroy"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["detailed_exitcode", "refresh", "parallelism", "no_color"]

[[commands.subcommand]]

path = ["apply"]

label = "Apply changes"

description = "Create or update infrastructure, optionally from a saved plan file. Review the plan first."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/terraform.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "plan_file"

label = "Saved plan file"

type = "path"

position = 0

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.task]]

id = "apply_plan"

label = "Apply saved plan"

fields = ["plan_file"]

required = ["plan_file"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["plan_file"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/terraform. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits plugin_cache_dir and plugin_cache_dir for you — that part is Otty’s own sync, or a template you write by hand.