Set separate Terraform and OpenTofu minimums to support air-gapped modules #29238

Problem

• We want to use dynamic module sources so users can point modules at an internal registry through a variable.
• Coder still accepts Terraform 1.1.0, which is no longer maintained.
• OpenTofu shares this check but has its own version numbers and support dates. It needs a separate minimum.

Background

Some modules hardcode registry.coder.com when they call other modules. Mirroring the top-level module leaves those public registry requests in place.

Dynamic sources require Terraform 1.15 or OpenTofu 1.8. Coder already defaults to Terraform 1.15.5. The minimum still sits at 1.1.0 in provisioner/terraform/install.go:27:

minTerraformVersion = version.Must(version.NewVersion("1.1.0"))

Proposal

Keep the existing version check, but choose the minimum for each engine: Terraform 1.15 or OpenTofu 1.12. Both release series are maintained.

Once we identify the engine, the comparison is:

minimum := version.Must(version.NewVersion("1.15.0"))
if engine == "opentofu" {
    minimum = version.Must(version.NewVersion("1.12.0"))
}
supported := installedVersion.GreaterThanOrEqual(minimum)

Add engine detection and tests for both minimums. Keep OpenTofu as OpenTofu rather than falling back to Terraform.

The Terraform download path already exists and uses Coder's pinned version, not the newest release. Announce the new minimums before updating registry modules. Air-gapped installs and custom provisioner images with older binaries need a local binary update.

Alternatives

• Raise the shared minimum: reject maintained OpenTofu releases and download Terraform instead. Bad for OpenTofu users.
• Keep the minimum and adopt dynamic sources: newer modules fail on older binaries that Coder accepts. Bad user experience.
• Keep hardcoded sources: mirrored modules still contact the public registry. Bad for air-gapped use.

Related: #12009.

Generated by Coder Agents on behalf of @bpmct.