Consuming modules and providers

Early access. Registry is rolling out behind an organization flag.

Once a module or provider is published, pull it with terraform init or tofu init. Both tools speak the same registry protocol, so the only setup is a credential for registry.lngbrdg.com.

Authenticate

The registry is private — every pull is authenticated, and there is no anonymous access — so configure a credential before your first init. Two paths.

A token in your CLI config

Mint a registry key and give it to Terraform as a per-host token. Terraform and OpenTofu map the host registry.lngbrdg.com to the environment variable TF_TOKEN_registry_lngbrdg_com (each dot becomes an underscore):

lbr registry key mint tf-reader --registry acme-prod --mode pull
export TF_TOKEN_registry_lngbrdg_com="<key-id>:<secret>"

The token is the key’s <key-id> and <secret> joined by a colon. Or set it as a credentials block in the CLI config (~/.terraformrc):

credentials "registry.lngbrdg.com" {
  token = "<key-id>:<secret>"
}

A key is scoped to one registry, so this authenticates the modules and providers under acme-prod. To resolve artifacts from several of your registries in a single init, use the credentials helper below — its credential is Org-scoped. In CI, set the same TF_TOKEN_… variable from an OIDC exchange, so no secret is stored.

The lbr credentials helper

lbr registry terraform-setup wires lbr in as a Terraform credentials helper, so every init fetches a fresh, short-lived credential — nothing long-lived is written to config or environment:

lbr registry terraform-setup

This installs a terraform-credentials-lbr shim into ~/.terraform.d/plugins (where Terraform and OpenTofu discover credentials helpers — not your PATH) and adds credentials_helper "lbr" to your CLI config. On each init, the helper mints a short-lived, pull-only Org credential and hands it to Terraform only for the Longbridge host; any other registry gets nothing, so the credential is never handed to a foreign host.

Use a module

Reference the module by its registry address — <registry>/<name>/<system>:

module "vpc" {
  source  = "registry.lngbrdg.com/acme-prod/vpc/aws"
  version = "~> 1.4"
}

Run terraform init (or tofu init), and the module is fetched and metered.

Use a provider

Add it to required_providers with the registry address as its source — <registry>/<type>:

terraform {
  required_providers {
    widget = {
      source  = "registry.lngbrdg.com/acme-prod/widget"
      version = "~> 1.2"
    }
  }
}

init downloads the provider and verifies its signature against the registry-advertised key — you configure nothing for signing. See Provider signing for how that key is managed.

Why there’s no terraform login

The registry advertises the modules.v1 and providers.v1 protocols but not login.v1, so terraform login registry.lngbrdg.com fails cleanly instead of half-working. The OAuth login flow is deferred — its consumers are overwhelmingly CI or lbr-equipped, both already covered by a token or the helper above. Use one of those.

Consuming from the OCI registry instead (OpenTofu)

The native protocol above is the product: signed providers, one wire for both tools, private by default. Recent OpenTofu (1.10 and later) can also install artifacts from an OCI registry — which Longbridge already runs — as a secondary convenience. This path is OpenTofu-only (Terraform has no equivalent) and unsigned, so it isn’t the path we steer you to, but it coexists.

Because your registry already serves the OCI wire, you can push these artifacts with docker or oras and point OpenTofu at them:

• Providers, as a mirror. oci_mirror redirects provider installation to OCI repositories (OpenTofu doesn’t support an OCI registry as a provider’s primary source, so this is install-time only, and nothing is signature-verified):

  provider_installation {
    oci_mirror {
      repository_template = "registry.lngbrdg.com/acme-prod/${namespace}/${type}"
      include             = ["registry.terraform.io/*/*"]
    }
  }

• Modules, as a source. Reference a module package by an oci:// address:

  module "vpc" {
    source = "oci://registry.lngbrdg.com/acme-prod/vpc?tag=1.4.0"
  }

See OpenTofu’s OCI registries guide for the mechanics. For signatures, Terraform support, and the managed publish flow, prefer the native protocol above.

Where to next

• Publishing modules and providers — the push side.
• Provider signing — what the automatic verification checks.
• Registry keys — mint and scope the credential.