otty / dotfiles

All tools/Terraform

Terraform

terraform

An infrastructure as code tool that lets you build, change, and version infrastructure safely and efficiently.

Detected by terraform | macOS, Linux, Windows |developer.hashicorp.com

Sync it terraform.toml

Sync rules

What travels, what stays, what never leaves

Terraform in your home directory Every rule on this page, by file

plugin_cache_dir = "/Users/octocat/.terraform.d/plugin-cache"machine-local

disable_checkpoint = true

credentials "app.terraform.io" {

…

Each machine keeps its own copy of these.

token

Lifted into your secret store; the rest of the file syncs.

· ~/.terraform.d/credentials.tfrc.json Never synced

plugin_cache_dir = "C:/Users/octocat/AppData/Roaming/terraform.d/plugin-cache"machine-local

disable_checkpoint = true

credentials "app.terraform.io" {

…

Each machine keeps its own copy of these.

token

Lifted into your secret store; the rest of the file syncs.

· %APPDATA%/terraform.d/credentials.tfrc.json Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/terraform.tomlThe file this page is generated from

id = "terraform"

name = "Terraform"

homepage = "https://developer.hashicorp.com/terraform"

description = "An infrastructure as code tool that lets you build, change, and version infrastructure safely and efficiently."

icon = "SimpleIcons:terraform"

detect = ["terraform"]

# https://developer.hashicorp.com/terraform/cli/config/config-file — on Unix

# and macOS "the configuration file must be named .terraformrc (with a leading

# period) and placed in the user's home directory"; on Windows "the file must

# be named terraform.rc and placed in the user's %APPDATA% directory". They

# are one file under two names, which the sibling check cannot see from the

# names, so every rule below pairs them by hand.

paths = [

"~/.terraformrc",

"%APPDATA%/terraform.rc",

]

exclude = []

# https://developer.hashicorp.com/terraform/cli/commands/login — "Terraform

# will obtain an API token and save it in plain text in a local CLI

# configuration file called credentials.tfrc.json", written to ~/.terraform.d

# on Unix and %APPDATA%\terraform.d on Windows. The file is nothing but

# {"credentials": {"<host>": {"token": …}}}, so the whole of it is the

# credential. `terraform logout` removes the same file.

secret = [

"~/.terraform.d/credentials.tfrc.json",

"%APPDATA%/terraform.d/credentials.tfrc.json",

]

# The other place an HCP Terraform token lands is a `credentials "host" {

# token = … }` block in the CLI configuration file itself — the `credentials`

# setting on the config-file page. The file is HCL, so the rule is

# line-oriented, and `token` is the only argument such a block takes. Both

# names of the file, or the token is lifted out on Unix and syncs in the clear

# from a Windows machine.

[[secret_paths]]

file = ["~/.terraformrc", "%APPDATA%/terraform.rc"]

match = { prefix = ["token"] }

# plugin_cache_dir is an absolute directory on this machine's disk — same

# page: "Enables plugin caching by specifying a directory path where provider

# plugins are stored". Wanting the cache is portable; the path to it is not.

# The directory is one the user named, so it is kept for rebuilding this

# machine rather than dropped, and never applied to another.

[[machine_lines]]

file = ["~/.terraformrc", "%APPDATA%/terraform.rc"]

match = { prefix = ["plugin_cache_dir"] }

scope = "backup"

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/terraform. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits plugin_cache_dir and plugin_cache_dir for you — that part is Otty’s own sync, or a template you write by hand.