Settings

Environment variables

Env var	Default	What it does
TFV_REQUIRE_APPLY_PROJECT	false	true turns off a bare tfv apply; people must apply one project at a time with -p
TFV_REPO_ALLOWLIST		Allowed repos, e.g. github.com/acme/* (or list them in repos.yaml)
TFV_REPOS_CONFIG	/data/repos.yaml	Rules, approvers, channels, drift schedules
TFV_ACK_REACTION	eyes	Reaction on a command tfv picked up: eyes, rocket, +1, heart, hooray, laugh, confused, -1 or none. Per repo: ack_reaction
TFV_PROGRESS_REPLY	false	Off: each result is posted once, as a new comment, and never edited (👀 shows it was picked up). On: a spinning "Running…" reply that is edited into the result. Needs a public https TFV_PUBLIC_URL; skipped otherwise. Per repo: progress_reply
TFV_COMMENT_MODE	new	new: each plan and apply gets its own comment under the command. update: one comment at the top, edited in place. Per repo: comment_mode
TFV_PARALLELISM	4	Plans and applies running at once, across all PRs
TFV_PR_PARALLELISM	parallelism − 1	One PR's share, so other PRs always get a slot. Freed slots go to the PR with the fewest runs going
TFV_DEFAULT_VERSION	latest	Tool version when a project pins none
TFV_PREINSTALL		Warm the cache, e.g. terraform@1.9.8,tofu@1.8.5
GITHUB_TOKEN		Optional: tfv uses its GitHub App automatically. Set it on servers without a github.com App (GitLab, Bitbucket, GitHub Enterprise) to download OpenTofu and Terragrunt as a signed-in user. Needs no permissions
TFV_GITHUB_MIRROR / TFV_HASHICORP_MIRROR		Download OpenTofu/Terragrunt and Terraform from your own mirror (Artifactory, Nexus) instead of GitHub and HashiCorp
TFV_DRIFT	true	Run drift schedules
TFV_SESSION_SECRET	random	Signs dashboard sessions (32+ characters). Set it, or sessions end on restart
TFV_API_TOKEN		Admin token for automation and /api

TFV_* values are never passed to Terraform. Each secret can also be read from a file: <NAME>_FILE.

Helm values

The most used values are below. The full list, with comments and defaults, is in charts/tfv-server/values.yaml.

Value	Default	What it does
github.appId / github.existingSecret		Required. App ID, and a Secret with private-key and webhook-secret
github.apiUrl		GitHub Enterprise Server API URL
config.repoAllowlist	[]	Repos tfv may act on, e.g. github.com/acme/*
config.requireApplyProject	false	Refuse a bare tfv apply; one project at a time
config.ackReaction	eyes	Reaction on a command tfv picked up
config.progressReply	false	Off: results are posted once and never edited. On: a spinning "Running…" reply edited into the result (needs a public https URL)
config.commentMode	new	new: a new comment for each plan and apply. update: one comment at the top, edited in place
config.parallelism	4	Plans and applies running at once, shared fairly between PRs
config.preinstall	[]	e.g. [terraform@1.9.8, tofu@1.8.5]
repos	{}	Full repos.yaml: rules, approvers, channels, people, drift schedules
extraEnvFrom / extraEnv	[]	Cloud credentials, TFV_SLACK_TOKEN, TFV_TEAMS_WEBHOOK, GITHUB_TOKEN (for OpenTofu/Terragrunt downloads), …
serviceAccount.annotations	{}	Workload identity: IRSA, GKE, Azure
persistence.size	20Gi	Checkouts, saved plans, binaries, provider cache, database
serviceMonitor.enabled	false	Prometheus scraping of /metrics
podDisruptionBudget.enabled	false	Stop node drains from interrupting an apply
networkPolicy.enabled	false	Allow inbound traffic only from networkPolicy.ingressFrom

How the chart runs it

• One replica, as a StatefulSet. Locks and history are kept in SQLite on the volume.
• Locked down. It runs as non-root (uid 10001) with a read-only root filesystem, all Linux capabilities dropped, and the RuntimeDefault seccomp profile.
• Applies finish before shutdown. terminationGracePeriodSeconds: 3600 lets a running apply finish on upgrades.
• Config changes roll the pod. Checksums of the config, secrets and dashboard settings are pod annotations.