Usage

All commands are run from the root of the repository, where nac.yaml is located. The file is optional: without it, every field falls back to its default. A typical configuration only lists the environment variables required by the Terraform provider, so that nac setup can check them:

env:
  required: [ACI_URL, ACI_USERNAME, ACI_PASSWORD]

A complete run of the workflow looks like this:

nac setup
nac init
nac validate
nac plan
nac apply
nac test

Global Options

The following options are available on every command:

Option	Environment Variable	Default	Description
--config	NAC_CONFIG	nac.yaml	Path to the configuration file
-v, --verbosity	NAC_VERBOSITY	WARNING	DEBUG, INFO, WARNING, ERROR or CRITICAL
--no-color	NO_COLOR		Disable colored output
--version			Show the version and exit

Pass-Through Arguments

Every command except setup forwards additional arguments to the wrapped tool, for example a variable file to terraform plan:

nac plan -var-file=prod.tfvars

--help shows the options of nac followed by the options of the wrapped tool. The exit code of the wrapped tool is returned, so nac can be used in CI/CD pipelines the same way as the wrapped tools.

Artifacts

All commands except setup accept --artifacts, which also writes the output of the command to <command>.txt in the working directory, for example validate.txt or apply.txt. This is useful to collect the results of a CI/CD pipeline.

Commands

nac setup

Verifies the prerequisites and reports the resolved tool versions. It is a pre-flight check for both CI/CD and local use:

• checks that uv is on the PATH if nac-validate or nac-test has no suitable local installation, and tenv if tools.terraform.version is set
• resolves the terraform or tofu binary
• checks that every variable in env.required is set, without printing the values
• reports the resolved terraform/tofu, nac-validate and nac-test versions, and warns if nac-validate or nac-test are outside the tested versions of the module

The command fails with a non-zero exit code if a prerequisite is missing. Warnings about tested versions never fail it.

Option	Description
--yes, --install	Skip the confirmation prompt for the OpenTofu installation
--prewarm	Pre-warm the uvx cache for nac-validate and nac-test, skipped for tools resolved to a local installation

nac init

Runs terraform init (or tofu init) in the working directory.

nac validate

Runs nac-validate against the data model, using the validate.schema and validate.rules from nac.yaml.

If render.target is configured, a targeted terraform apply -target=<target> -auto-approve is run first to render the data model to render.output, which is then validated instead of data.paths. This is used by architectures that resolve variables and templates in the Terraform module, such as NX-OS.

Schema and rules packaged with the Terraform module or with bundles in nac/bundles/ are loaded by default (see Packaged Schema and Rules). To opt out, set NAC_VALIDATE_ARTIFACTS=false or pass --no-artifacts.

nac plan

Runs terraform plan -out=plan.tfplan. With --artifacts, the plan is additionally written to plan.txt and plan.json using terraform show.

nac apply

If a saved plan plan.tfplan exists in the working directory, it is applied with terraform apply plan.tfplan and deleted after a successful apply. Otherwise, terraform apply is run interactively with its usual confirmation prompt.

Option	Description
--auto-approve	Skip the confirmation prompt when applying without a saved plan

nac test

Runs nac-test against the data model, using the test.templates, test.filters and test.output from nac.yaml. The data model is render.output if render is configured, else data.paths, followed by data.defaults if configured.

Templates, filters and Jinja tests packaged with the Terraform module or with bundles in nac/bundles/ are loaded by default. To opt out, set NAC_TEST_ARTIFACTS=false or pass --no-artifacts.

nac destroy

Runs terraform destroy, which asks for confirmation unless --auto-approve is passed.

Option	Description
--auto-approve	Skip the confirmation prompt