adminops / provider mirror

Terraform provider mirror

A read-only network mirror of the Terraform provider registry, run for our own estate and for the client environments we operate. It exists so that terraform init keeps working when the upstream registry is unreachable, rate-limited, or simply slower than we can afford during a rollout.

Endpoint
/v1/providers/
Providers
18
Versions
1 672
On disk
61.4 GB
Last sync

Point the CLI at it

Add the block below to ~/.terraformrc (or %APPDATA%\terraform.rc on Windows). Everything under the listed prefixes is served from here; anything else still goes direct.

# ~/.terraformrc
provider_installation {
  network_mirror {
    url = "https://mirror.fadminops.space/v1/providers/"
    include = ["registry.terraform.io/hashicorp/*"]
  }
  direct {
    exclude = ["registry.terraform.io/hashicorp/*"]
  }
}

No credentials, no accounts — the mirror is unauthenticated and read-only. See the docs for CI images, air-gapped bundles and checksum verification.

Mirrored providers

Synced from registry.terraform.io on a six-hour cadence. Platforms: linux_amd64, linux_arm64, darwin_arm64, windows_amd64.

ProviderLatestVersionsPlatformsSize
hashicorp/aws6.14.1412428.1 GB
hashicorp/azurerm4.48.0296419.7 GB
hashicorp/google6.55.023849.8 GB
hashicorp/kubernetes2.39.09441.9 GB
hashicorp/helm3.0.26140.8 GB
hashicorp/tls4.1.03840.3 GB
hashicorp/random3.7.24440.2 GB
hashicorp/null3.2.42940.1 GB
hashicorp/http3.5.03140.1 GB
hashicorp/local2.5.32740.1 GB

The rest — vault, consul, dns, time, external, plus the integrations, cloudflare and grafana namespaces — is enumerated by the mirror protocol itself; there is no separate browse UI. How to query it →

What it is not

  • Not a registry: it serves providers only, not modules.
  • Not a proxy: nothing is fetched on demand. A provider that has not been synced returns 404.
  • Not a publisher: checksums and signatures are the upstream ones, passed through untouched.

Operational notes

  • Next sync window in .
  • Retention: every version upstream still lists, plus 24 months of withdrawn ones.
  • Read-only from the public internet; writes come from the sync host over the management network.