Installing the Terraform Provider

This guide covers installing Terraform, adding the Bahriya provider, authenticating, and keeping the provider up to date.

Prerequisites

You need two things before you start:

1. Terraform CLI (v1.0 or later)
2. A Bahriya personal access token (PAT)

Install Terraform

If you don't already have Terraform installed:

macOS (Homebrew):

brew tap hashicorp/tap
brew install hashicorp/tap/terraform

Linux (apt):

wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform

Windows (Chocolatey):

choco install terraform

Direct download:

Visit developer.hashicorp.com/terraform/install for all platforms and architectures.

Verify the installation:

terraform version

Add the Bahriya provider

The provider is published on the HashiCorp Terraform Registry.

Create a .tf file (e.g. main.tf) with the provider requirement:

terraform {
  required_providers {
    bahriya = {
      source  = "bahriya-cloud/bahriya"
      version = "~> 0.1"
    }
  }
}
 
provider "bahriya" {}

Then initialise the working directory:

terraform init

Terraform downloads the provider binary and locks the exact version in .terraform.lock.hcl. Commit this lock file to version control so your team uses the same provider version.

Authenticate

The provider needs a personal access token (PAT) and your organisation ID.

Create a personal access token

1. Sign in to the Bahriya console at app.bahriya.cloud.
2. Click your profile avatar, then Tokens.
3. Click Create token and copy the pat_... value.

Set credentials

Option 1 — environment variables (recommended):

export BAHRIYA_TOKEN="pat_..."
export BAHRIYA_ORGANISATION_ID="your-org-uuid"

Option 2 — provider block:

provider "bahriya" {
  token           = var.bahriya_token
  organisation_id = var.bahriya_org_id
}

Environment variables are recommended so credentials stay out of your .tf files and don't end up in version control.

Find your organisation ID

Your organisation ID is a UUID. You can find it in the Bahriya console URL when viewing your organisation, or by using the Reis CLI:

reis org:list

Version pinning

The version constraint in required_providers controls which provider versions Terraform will accept:

The ~> operator is recommended — it allows patch and minor updates within the same major version while protecting you from breaking changes.

Updating the provider

When a new version of the provider is released:

terraform init -upgrade

This downloads the latest version that satisfies your version constraint and updates the lock file. Review the changelog before upgrading — new fields may become available, and behaviour may change.

To check which version you are currently using:

terraform version

To see what would change before upgrading:

terraform providers lock -platform=linux_amd64 -platform=darwin_amd64 -platform=darwin_arm64

After upgrading, run terraform plan before terraform apply to check for any unexpected changes.

Multi-organisation setups

If you manage resources across multiple Bahriya organisations, use provider aliases:

provider "bahriya" {
  alias           = "prod"
  organisation_id = var.prod_org_id
}
 
provider "bahriya" {
  alias           = "staging"
  organisation_id = var.staging_org_id
}
 
resource "bahriya_project" "prod_app" {
  provider = bahriya.prod
  handle   = "my-app"
  name     = "My App (Production)"
  regions  = ["falkenstein-1"]
}
 
resource "bahriya_project" "staging_app" {
  provider = bahriya.staging
  handle   = "my-app"
  name     = "My App (Staging)"
  regions  = ["helsinki-1"]
}

Both aliases use the same PAT. The organisation_id determines which organisation each resource belongs to.

CI/CD usage

In automated pipelines, set credentials as pipeline secrets:

# GitHub Actions example
env:
  BAHRIYA_TOKEN: ${{ secrets.BAHRIYA_TOKEN }}
  BAHRIYA_ORGANISATION_ID: ${{ secrets.BAHRIYA_ORGANISATION_ID }}

Then run terraform init, terraform plan, and terraform apply -auto-approve as normal. No interactive prompts are needed — the provider reads credentials from environment variables.

Next steps

• Terraform overview — available resources, data sources, and field naming conventions
• Deploy your first container — a complete HTTP container example
• Complete example — all resource types together