# Terraform CLI configuration (~/.terraformrc)
# Documentation:
#   https://developer.hashicorp.com/terraform/cli/config/config-file
#   https://developer.hashicorp.com/terraform/cli/config/config-file#provider-plugin-cache
#   https://developer.hashicorp.com/terraform/cli/commands/providers/mirror
#
# Deployed by `infra setup terraform`. Non-empty existing files are preserved
# (recommended copy at ~/.terraformrc.infra).

# --- Active defaults (safe for local dev) ---

# Unpacked provider cache (binaries only — not zip). Verification uses lock-file
# `h1:` hashes (directory hash). `zh:` hashes only apply to published zip packages.
# If init reports checksum mismatch against this cache:
#   1) Prefer: terraform providers lock -platform=darwin_arm64 -platform=linux_amd64
#      (or let Terraform ≥1.4 contact the registry and append the missing `h1:`).
#   2) Or remove the bad entry under plugin-cache and re-init.
# Do NOT set plugin_cache_may_break_dependency_lock_file for this — it often
# forces a cache hit that still fails LinkFromOtherCache when lock hashes differ.
plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"

# --- Escape hatch (leave commented; breaks portable lock files) ---

# plugin_cache_may_break_dependency_lock_file = true

# --- Provider installation: packed filesystem mirror (zip layout) ---
# Different from plugin_cache_dir: mirror keeps provider .zip packages so `zh:`
# checksums work. Populate once with `terraform providers mirror`, then uncomment
# and adjust `include` / `exclude` below.
#
# Populate (run from a Terraform root that requires the providers you want):
#   mkdir -p "$HOME/.terraform.d/providers-mirror"
#   terraform providers mirror \
#     -platform=darwin_arm64 \
#     -platform=linux_amd64 \
#     "$HOME/.terraform.d/providers-mirror"
#   # Optional: add more OS/arch pairs you deploy to (e.g. -platform=linux_arm64).
# Docs: https://developer.hashicorp.com/terraform/cli/commands/providers/mirror
#
# Common HashiCorp providers (aws / random / null / archive / tls / local / time /
# cloudinit / template / http / external). Uncomment to prefer local zip mirror
# for these; everything else still goes `direct` to the registry.

# provider_installation {
#   filesystem_mirror {
#     path = "$HOME/.terraform.d/providers-mirror"
#     include = [
#       "registry.terraform.io/hashicorp/aws",
#       "registry.terraform.io/hashicorp/random",
#       "registry.terraform.io/hashicorp/null",
#       "registry.terraform.io/hashicorp/archive",
#       "registry.terraform.io/hashicorp/tls",
#       "registry.terraform.io/hashicorp/local",
#       "registry.terraform.io/hashicorp/time",
#       "registry.terraform.io/hashicorp/cloudinit",
#       "registry.terraform.io/hashicorp/template",
#       "registry.terraform.io/hashicorp/http",
#       "registry.terraform.io/hashicorp/external",
#     ]
#   }
#   direct {
#     exclude = [
#       "registry.terraform.io/hashicorp/aws",
#       "registry.terraform.io/hashicorp/random",
#       "registry.terraform.io/hashicorp/null",
#       "registry.terraform.io/hashicorp/archive",
#       "registry.terraform.io/hashicorp/tls",
#       "registry.terraform.io/hashicorp/local",
#       "registry.terraform.io/hashicorp/time",
#       "registry.terraform.io/hashicorp/cloudinit",
#       "registry.terraform.io/hashicorp/template",
#       "registry.terraform.io/hashicorp/http",
#       "registry.terraform.io/hashicorp/external",
#     ]
#   }
# }

# --- Provider installation: full registry mirror (air-gapped) ---
# Same populate step as above — mirror every provider the working directory needs:
#   terraform providers mirror \
#     -platform=darwin_arm64 \
#     -platform=linux_amd64 \
#     "$HOME/.terraform.d/providers-mirror"
# Then uncomment so registry.terraform.io is served only from the local zip tree.

# provider_installation {
#   filesystem_mirror {
#     path    = "$HOME/.terraform.d/providers-mirror"
#     include = ["registry.terraform.io/*/*"]
#   }
#   direct {
#     exclude = ["registry.terraform.io/*/*"]
#   }
# }

# --- Provider installation: local plugins dir (legacy unpacked layout) ---

# provider_installation {
#   filesystem_mirror {
#     path    = "$HOME/.terraform.d/plugins"
#     include = ["registry.terraform.io/*/*"]
#   }
#   direct {
#     exclude = ["registry.terraform.io/*/*"]
#   }
# }

# --- Provider installation: local dev overrides (provider checkout) ---

# provider_installation {
#   dev_overrides {
#     "hashicorp/aws" = "$HOME/github.com/hashicorp/terraform-provider-aws"
#   }
#   direct {}
# }

# --- Telemetry (uncomment to opt out of HashiCorp checkpoint) ---

# disable_checkpoint = true
# disable_checkpoint_signature = true

# --- Terraform Cloud / Enterprise ---

# credentials "app.terraform.io" {
#   token = "YOUR_TFC_TOKEN"
# }

# hosts {
#   name = "app.terraform.io"
#   services = {
#     modules = "https://app.terraform.io/api/registry/v1/modules/"
#   }
# }

# --- Network mirror (private registry proxy) ---

# provider_installation {
#   network_mirror {
#     url = "https://terraform-mirror.example.internal/"
#   }
#   direct {
#     exclude = ["registry.terraform.io/*/*"]
#   }
# }
