Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise / HCP Terraform. This release adds cost visibility and first-class private-git-module authentication.
Highlights
- Cost estimation — see the monthly cost of your managed infrastructure without leaving Terrapod: a per-plan cost delta on every run and the current total on each workspace, priced by a native, original Terrapod engine over a self-generated pricesheet (no third-party pricing service). Covers ~41 resource types across AWS, Azure, and GCP, with usage-assumption bands (low/typical/high) for traffic-driven costs, fleet/group pricing (ASG, EKS/AKS/GKE node pools, VMSS, MIG, EMR priced by their units), multi-region pricing, and an air-gap mirror via
cost_estimation.prices_url. On by default. An optional AI layer (gated byai_summary) estimates the resources the engine can't price, offers savings advisories, and answers a grounded cost chat — always markedsource:ai-estimateand never summed into the deterministic total. - Private module source auth — first-class authentication for private, non-registry git module sources (
git::https://…,git::ssh://…, scp-style). Declare a credential once as a scoped, sensitivegit_http_auth/git_ssh_authworkspace variable — a static token or one minted per-run from an existing VCS connection — and Terrapod authenticates the fetch duringinit. Includes ssh↔https protocol rewriting (keep your source URLs unchanged), pre-trusted github.com/gitlab.com host keys baked into the runner image, and log-safe delivery (credentials live only in the per-run Secret and 0600 files, never a command line or the run log). Reuses the variable pipeline, so variable sets work too.
Bug Fixes
- Price EBS provisioned IOPS correctly (io1 flat, gp3 free-baseline, io2 graduated tiers) — previously dropped.
- Reflect fleet/group cost in the estimate total.
- Stop the multi-region pricesheet OOM-ing the API by streaming it through an on-disk SQLite index.
- Contain cost-engine pricing-edge exceptions to a clean 503 on the workspace cost endpoint (never a raw 500), and harden the git-auth credential path (path-scoped protocol rewrites, git tracing forced off so a token can't leak via
GIT_TRACE_CURL).
Status
Stable — additive MINOR release; no breaking changes to the API, wire protocol, config, Helm values, DB schema, or the go-terrapod/provider surface (every public contract snapshot grew, none shrank). A lagging runner/listener or un-upgraded SDK/provider keeps working.
Full Changelog: v1.1.1...v1.2.0