Terraform providers via proxied repository

usercATl1 0
Viewed 23

I am looking for solution to implement proxy repo for Terraform providers. I've successfully managed to force terraform to look for provider binary package saved in my local directory by configuring provider_installation block in .terraformrc file.

I have to configure terraform to use Nexus because of security purposes but I would like to keep it dynamic so I've decided to do it by proxy repo via Nexus that will be mirroring official Terraform repository.

Do you guys know is that even possible, if so could you give me some advice?

Thank you!

terraform
1 Answers

I'm afraid I'm not sure what "Nexus" is, but in Terraform terms any server which hosts providers that originate on some other hostname is called a network mirror and so it must provide a server-side implementation of Terraform's provider mirror protocol.

An implementation of that protocol is often just a static copy of a subset of providers. It is possible in principle for it to instead be a proxy which dynamically fetches provider packages from their origin servers on request, but that is considerably harder to implement and at the time of writing I don't know of any such implementation.

Terraform's provider installer uses TLS and verifies certificates, so it isn't straightforward to try to "trick" Terraform into thinking that your custom server is registry.terraform.io. The provider mirror protocol avoids the need to do that because the user explicitly configures Terraform to use the mirror, and Terraform includes the real hostname as part of the path when requesting metadata from the mirror.

Unless "Nexus" has an implementation of the Terraform provider mirror protocol I don't think what you want to achieve will be possible. However, if you are willing to create a static mirror of the particular providers you intend to use and occasionally update it with any new releases then it's possible to implement the provider mirror protocol just as a static web server containing a mixture of metadata files and provider .zip files.

Martin Atkins0
Related