skip to content
wihan/dev
markdown
browse the dokploy docs

dokploy_certificate (Resource)

A TLS certificate that Traefik serves for the domains that reference it. Upload the chain and the key here, then select the certificate on a dokploy_domain with certificate_type = "custom".

~> Dokploy stores and returns private_key in cleartext. The attribute is sensitive, so Terraform does not print it, but anyone with API access to the server can read it. The private_key_wo companion keeps it out of the Terraform state.

~> Dokploy does not validate the PEM content on create or update. A malformed certificate applies successfully and fails when Traefik loads it.

Example Usage

terraform
# Upload a certificate that Traefik serves for a domain. Keep the private key
# out of the state with the write-only companion.
resource "dokploy_certificate" "wildcard" {
  name             = "wildcard-example-com"
  certificate_data = file("${path.module}/certs/wildcard.example.com.pem")

  # Write-only: Terraform 1.11 or later. Change the version when the key file
  # changes, or Terraform does not send the new key.
  private_key_wo         = file("${path.module}/certs/wildcard.example.com.key")
  private_key_wo_version = 1
}

# Use the certificate on a domain.
resource "dokploy_domain" "app" {
  application_id   = dokploy_application.web.id
  host             = "app.example.com"
  https            = true
  certificate_type = "custom"
}

# A certificate that a specific remote server serves. auto_renew and
# server_id cannot change on a stored certificate; a change replaces it.
resource "dokploy_certificate" "worker" {
  name             = "worker-example-com"
  certificate_data = file("${path.module}/certs/worker.pem")
  private_key      = file("${path.module}/certs/worker.key")
  auto_renew       = false
  server_id        = dokploy_server.worker.id
}

Schema

Required

  • certificate_data (String) The certificate chain in PEM format. Read it from a file with file(), or take it from an ACME provider resource.
  • name (String) Display name. Dokploy does not enforce a unique name.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

  • auto_renew (Boolean) Whether Dokploy renews the certificate. Defaults to false. Dokploy cannot change it on a stored certificate, so a change replaces the resource.
  • private_key (String, Sensitive) The private key in PEM format. Set this attribute or private_key_wo.
  • private_key_wo (String, Sensitive, Write-only) Write-only form of private_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of private_key and private_key_wo. A new value reaches the server only when private_key_wo_version changes.
  • private_key_wo_version (Number) Version of private_key_wo. Change it to send the current private_key_wo value to the server. It needs private_key_wo.
  • server_id (String) Id of the dokploy_server that serves the certificate. Omit it for the Dokploy host. A change replaces the resource.

Read-Only

  • certificate_path (String) Name of the Traefik certificate file that Dokploy generates.
  • id (String) Certificate id.
  • organization_id (String) Id of the organization that owns the certificate. The provider fills it from the API key’s active organization.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

shell
terraform import dokploy_certificate.wildcard uxdzS4pe4_mMDIzGjwXY8