Registry with Terraform

Early access. Registry is rolling out behind an organization flag.

The Longbridge provider manages Registry through four resources. Configure the provider with a Console API key, then declare a registry and its credentials.

resource "longbridge_registry" "prod" {
  slug         = "acme-prod"
  display_name = "Acme production"
}

# A long-lived CI credential. The secret lands in state — keep state sensitive.
resource "longbridge_registry_key" "ci" {
  registry = longbridge_registry.prod.slug
  name     = "ci-pusher"
  mode     = "readwrite"
}

# Keyless push from GitHub Actions — no secret anywhere.
resource "longbridge_registry_oidc_rule" "github" {
  registry        = longbridge_registry.prod.slug
  name            = "github-actions"
  issuer          = "https://token.actions.githubusercontent.com"
  audience        = "longbridge"
  subject_pattern = "repo:acme/*:ref:refs/heads/main"
  mode            = "readwrite"
}

# Mirror a private Docker Hub repo under your own rate limits.
resource "longbridge_registry_upstream_credential" "docker_hub" {
  registry = longbridge_registry.prod.slug
  upstream = "docker.io"
  username = "acme"
  password = var.docker_hub_token
}

Immutability and secrets

• The registry slug, display_name, and region are immutable — the registry API has no rename, so changing any of them replaces the registry.
• A longbridge_registry_key is immutable too; rotate by changing a field (which mints a new key and revokes the old).
• Reveal-once secrets — a key’s secret, an upstream password — are stored in Terraform state. Use a remote backend with encryption at rest and restrict access to it.

Each resource imports by its natural id, for example terraform import longbridge_registry.prod acme-prod or terraform import longbridge_registry_key.ci acme-prod/<key-id>.

Where to next

• CLI — the same operations from your terminal.
• Terraform & OpenTofu — provider setup and authentication.