Registry formats · Terraform
OrbitalReg's terraform
repository format implements HashiCorp's provider network mirror
protocol and the module registry protocol under one repo. Mirror
registry.terraform.io providers once, run
terraform init air-gapped forever, and publish
internal providers and modules that never touch the public registry — inside the same
self-hosted artifact registry that already holds your container images, Helm charts
and packages.
Two lines of CLI config
network_mirror at your registry.
A network mirror is only a physical location, so Terraform never
uses service discovery for it — the base URL goes straight into the
CLI's provider_installation block.
From then on every terraform init
asks OrbitalReg for the version index and the archive list, and downloads
the exact zip whose sha256 is pinned in your lock file.
Populating the mirror is one authenticated upload per provider archive. Mirrors are read-only over the standard protocol, so OrbitalReg adds its own PUT endpoint — same developer-role gate as module tarballs.
# ~/.terraformrc — every terraform init resolves providers from OrbitalReg
provider_installation {
network_mirror {
url = "https://registry.example.com/terraform/platform/mirror/providers/"
}
}# Populate the mirror (developer role or above) — once per archive
$ curl -X PUT -H "Authorization: Bearer $ORBITALREG_TOKEN" \
--data-binary @terraform-provider-aws_5.60.0_linux_amd64.zip \
https://registry.example.com/terraform/platform/mirror/providers/\
registry.terraform.io/hashicorp/aws/5.60.0/linux/amd64/terraform-provider-aws_5.60.0_linux_amd64.zip
# What Terraform asks for afterwards
GET …/providers/registry.terraform.io/hashicorp/aws/index.json → {"versions": {"5.60.0": {}}}
GET …/providers/registry.terraform.io/hashicorp/aws/5.60.0.json → {"archives": {"linux_amd64": {"url": "…", "hashes": ["zh:…"]}}}What you get
Implements HashiCorp's provider network mirror protocol: the two JSON operations Terraform CLI asks for (index.json and {version}.json) plus a redirect to the stored zip. Point provider_installation.network_mirror at your OrbitalReg repo and terraform init resolves providers from it.
The same terraform repo speaks the module registry protocol, so source = "myorg/mymodule/aws" resolves through service discovery against your own host. Providers and modules in one governed place.
Populate the mirror once with a PUT upload — registry.terraform.io providers or an internal provider that was never meant to reach the public registry — and every terraform init afterwards runs with no internet at all.
The hostname in the mirror path is a metadata field OrbitalReg looks up in its own database — never a host it requests. Unlike an upstream-proxying mirror there is no outbound call to a client-controlled address, so the mirror needs no entry in your egress allowlist.
Every archive response carries zh: sha256 hashes of the exact zip stored, so Terraform's dependency lock file verifies what it downloads. Archive downloads never carry credentials; the two JSON endpoints do, if your CLI config supplies them.
Provider archives land in the same artifacts table as module tarballs and the other 40+ formats: developer-role uploads, per-repo retention, the append-only audit log, and the same presigned-S3 download path.
Why not a dedicated tool
Single-purpose registries such as boring-registry or a Terraform Cloud
private registry do the provider job well. What they cannot do is hold
the container image the provider deploys, the Helm chart next to it, the
npm and Maven packages the application is built from, scan all of them
for CVEs, and refuse to serve anything unsigned. In OrbitalReg the
terraform format is
one adapter among 40+, governed by the same projects, roles, retention
policies and append-only audit log — and it is part of the
free version.
Coming from JFrog Artifactory's Terraform repositories or a Nexus raw proxy? The migration page covers the cutover, and the pricing comparison puts JFrog's published tiers next to ours.
Questions
A network mirror is an HTTP location Terraform CLI can install providers from instead of the public Terraform Registry. It is configured in the CLI's provider_installation block with a network_mirror URL and serves two JSON documents per provider — a version list and, per version, the archive URLs and hashes for each OS and architecture. HashiCorp defines the protocol; OrbitalReg implements it as part of its terraform repository format.
Create a terraform repository in OrbitalReg, upload each provider archive with a PUT to /terraform/<project>/<repo>/providers/{hostname}/{namespace}/{type}/{version}/{os}/{arch}/{filename} (developer role or above), then point the air-gapped machines' CLI config at https://<your-host>/terraform/<project>/<repo>/providers/ via provider_installation { network_mirror { url = ... } }. From then on terraform init needs no internet access.
Yes. The same repo serves the module registry protocol through .well-known/terraform.json service discovery, so private modules referenced as source = "org/module/provider" resolve against your OrbitalReg host. The two protocols are separate wire formats that happen to share one repo; the mirror never touches service discovery.
For the job of hosting providers and modules privately, yes — with the difference that it is one part of a universal, self-hosted artifact registry that also holds your container images, Helm charts, npm, Maven and Python packages, scans them for CVEs and gates pulls on signatures. boring-registry is a focused single-purpose tool; Terraform Cloud is SaaS; Artifactory charges for the platform. OrbitalReg's free version includes the terraform format.
Yes. terraform-provider-orbitalreg is published to the Terraform Registry and manages projects, repositories, service accounts, retention policies, security blocks and webhook subscriptions as code — so the mirror that serves your providers is itself declared in Terraform.
Documentation: provider network mirror · terraform format reference · terraform-provider-orbitalreg · air-gapped operations
Free forever · no contract
One Helm chart, one Go binary, Postgres and S3-compatible storage. The terraform format is included in every tier, including the free one.