Documentation
Vizier runs OpenTofu and Terraform, and refuses to run a module whose provenance it cannot check. These guides cover installing it, running it, and operating it for a team.
Install Vizier Local
Get the binary, verify its checksum, and run your first module - from an empty directory to a proven apply. Covers your own modules from git and the public registry, and how to pin what you run.
curl -fsSL https://raw.githubusercontent.com/\
CyberCoreSystems/vizier/main/install.sh | sh
$ vizier version
vizier 1.6.0Vizier Central
The self-hosted control plane for a team: people and roles, one evidence floor per environment, review before an apply, state locking and durable run history. You host it against your own Postgres.
Identity and access
How Central fits an identity estate you already run: OIDC for Entra ID and Okta, SAML 2.0, LDAP and Active Directory, and SCIM 2.0 provisioning. Written for the reviewer who has to sign it off, not for the operator configuring it.
Roles and permissions
What each role in Central may do, which actions weaken the evidence floor and therefore need an owner, and how permissions are checked on every request rather than cached at sign-in.
Module registry
Install any IaC Bazaar module with plain `tofu init` or `terraform init`, using the standard registry protocol. No extra tooling, and it works alongside the public registry.
Catalog API
Read a module and its proof over HTTP: verification status, the published SHA-256, and the signature bundle. This is what Vizier itself calls, and what your own tooling can call.
Not documentation, but nearby
- What Vizier is - the argument for proof-checked runs, and how it compares to what you already use.
- What verification means here - what a live test actually did, and what it does not claim.
- The module catalog - every module, its verification status and its published digest.