dokploy_destination (Resource)

An S3-compatible bucket that receives Dokploy backups.

~> Dokploy stores and returns access_key and secret_access_key in cleartext. Both attributes are sensitive, so Terraform does not print them, but anyone with API access to the server can read them. The access_key_wo and secret_access_key_wo companions keep them out of the Terraform state.

Example Usage

# Cloudflare R2 is S3-compatible and works as a Dokploy backup destination.
resource "dokploy_destination" "backups" {
  name              = "app-backups"
  provider_name     = "Cloudflare"
  endpoint          = "https://${var.r2_account_id}.r2.cloudflarestorage.com"
  bucket            = "app-backups"
  region            = "WEUR"
  access_key        = var.r2_access_key
  secret_access_key = var.r2_secret_access_key
}

# Test the bucket before the provider writes the record. The Dokploy server
# must reach the endpoint. If the test fails, the apply fails and the provider
# writes nothing. Both keys are write-only: Terraform does not write them to
# the plan or to the state.
resource "dokploy_destination" "checked" {
  name          = "app-backups"
  provider_name = "AWS"
  endpoint      = "https://s3.eu-west-1.amazonaws.com"
  bucket        = "app-backups"
  region        = "eu-west-1"

  access_key_wo                = var.s3_access_key
  access_key_wo_version        = 1
  secret_access_key_wo         = var.s3_secret_access_key
  secret_access_key_wo_version = 1

  verify_connection = true
}

Schema

Required

• bucket (String) Bucket name.
• endpoint (String) S3 endpoint URL.
• name (String) Display name.
• provider_name (String) Storage provider label, for example Cloudflare, AWS, or DigitalOcean. Free text. Dokploy does not validate it.
• region (String) Bucket region.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• access_key (String, Sensitive) S3 access key id. Set this attribute or access_key_wo.
• access_key_wo (String, Sensitive, Write-only) Write-only form of access_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of access_key and access_key_wo. A new value reaches the server only when access_key_wo_version changes.
• access_key_wo_version (Number) Version of access_key_wo. Change it to send the current access_key_wo value to the server. It needs access_key_wo.
• additional_flags (List of String) Extra flags for the storage client. Defaults to an empty list. If you remove it from the configuration, the provider clears the flags.
• secret_access_key (String, Sensitive) S3 secret access key. Set this attribute or secret_access_key_wo.
• secret_access_key_wo (String, Sensitive, Write-only) Write-only form of secret_access_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of secret_access_key and secret_access_key_wo. A new value reaches the server only when secret_access_key_wo_version changes.
• secret_access_key_wo_version (Number) Version of secret_access_key_wo. Change it to send the current secret_access_key_wo value to the server. It needs secret_access_key_wo.
• verify_connection (Boolean) Test the connection with destination.testConnection before the provider creates or updates the record. If the test fails, the apply fails with the server message, and the provider writes nothing. The default is no check: null and false both skip the test. Dokploy stores no value for this attribute, so terraform import leaves it null. The test lists the bucket with rclone, which needs an endpoint that the Dokploy server can reach.

Read-Only

• created_at (String) Creation timestamp from the server.
• id (String) Destination id.

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

import {
  to = dokploy_destination.backups
  id = "d1a2b3c4d5e6f7g8h9i0j"
}

The terraform import command can be used, for example:

terraform import dokploy_destination.backups d1a2b3c4d5e6f7g8h9i0j