Frequently asked questions.

A private Terraform registry hosts your own modules, providers, and state behind your authentication, instead of pulling modules from public Git or the public registry. It gives you versioned releases, access control, supply-chain scanning, and a record of which workspaces consume each version. Terramantle provides this for both Terraform and OpenTofu, cloud-hosted or self-hosted.

Yes. Terramantle runs fully self-hosted with no outbound internet dependency, so it works inside air-gapped and regulated networks. You bring your own S3-compatible storage and database, mirror the providers you need, and no module, provider, or state data leaves your infrastructure. Supply-chain scanning and OPA policy checks run locally against the artefacts you host.

HCP Terraform's registry is tied to HashiCorp's platform and hosting. Terramantle is OpenTofu-first, runs self-hosted or air-gapped, and adds supply-chain governance on top of hosting, with SBOMs, CVE scanning, and a dependency graph showing which workspaces consume each module version. You keep the registry protocol your CLI already speaks, without the vendor lock-in.

Yes. Terramantle builds a dependency graph across your state, so before you change or deprecate a module version you can see every workspace and team that consumes it. That blast-radius view turns a risky bump into a reviewed change, instead of discovering the breakage after an apply fails downstream.

Yes. Terramantle is protocol-compatible with Terraform Cloud's registry and HTTP state backend interfaces. The migration steps are:

1. Publish your existing modules to Terramantle using the publish API or the CLI helper.
2. Update your module source URLs from app.terraform.io to registry.terramantle.dev/<org>.
3. Migrate your state files by pulling the current state from Terraform Cloud and pushing it to the Terramantle state backend.
4. Update your CI pipelines to use Pipeline Trust instead of Terraform Cloud agent tokens.

Enterprise tiers include dedicated migration support. See pricing for details.

The free Engineer tier on managed cloud is the quickest way to trial Terramantle without any infrastructure setup. If you want a guided self-hosted trial with support, get in touch and we'll set one up.

Yes. OpenTofu and Terraform share the same registry protocol. There are no changes required to your OpenTofu configuration - point the module source at registry.terramantle.dev, add credentials, and tofu init works exactly as expected. State backend configuration is also identical between the two tools.

Yes. Terramantle implements the Terraform Registry Protocol v1 as specified by HashiCorp. Any tool that supports registry-sourced modules or providers - Terraform, OpenTofu, Terragrunt, and others - works without modification. No CLI plugins or wrappers are required.

OIDC publishing lets GitHub Actions and GitLab CI prove their identity without storing long-lived credentials. The flow is:

1. You configure a Pipeline Trust rule in Terramantle, specifying which repository and branch are trusted.
2. At publish time, the CI job requests a short-lived OIDC token from the CI provider (audience: terramantle).
3. Terramantle verifies the token's signature against the CI provider's public keys and checks the repository claim against your trust rule.
4. A scoped access token is returned, valid only for the specific publish operation.

No credentials are stored in your CI pipeline. See the Pipeline Trust (OIDC) guide for configuration examples.

Terramantle supports three authentication methods:

• Bot tokens - long-lived tokens scoped to a namespace, generated in Settings → Bot Tokens. Available on all tiers with a quota per tier (Engineer: 1, Team: 3, Business: 10, Enterprise: unlimited).
• Pipeline Trust (OIDC) - keyless publishing from GitHub Actions and GitLab CI. Available on all tiers.
• SSO (OIDC/SAML) - integrate with your identity provider (Okta, Azure Entra, Keycloak, and others) for user login. Available on Team and above.

On the Engineer tier, the 3 most recent versions of each module are retained. Publishing a new version removes the oldest. No data is deleted without warning - you will see the retention limit applied in the dashboard before publishing. Upgrade to Team or above for unlimited version retention.

On the managed cloud tiers, your module archives, provider binaries, and state files are stored in S3-compatible object storage in the EU (Ireland). Metadata - version records, audit logs, scan results - is stored in a managed database in the same region.

On self-hosted deployments, you bring your own S3-compatible storage and database. No data leaves your infrastructure. See our Privacy Policy for full details on data handling for cloud tiers.

No. Terramantle does not require any agents or runners to be installed in your CI/CD environment.
There is no hidden charges or usage costs for CI/CD pipelines.