# dokploy_registry (Resource)

A container registry login (Settings > Registry). Dokploy pulls private images with it, and pushes the images it builds to it when `dokploy_application.registry_id` references it.

~> **Dokploy runs `docker login` on create and on update.** A registry that the Dokploy server cannot reach, or a wrong user or password, fails the apply with `Command execution failed`. Dokploy stores the record only after the login succeeds.

~> **The read endpoint omits the password.** The provider cannot detect a password that changed in the Dokploy UI, and `terraform import` leaves `password` empty: set it in the configuration and apply once. The `password_wo` companion keeps the password out of the Terraform state.

## Example Usage

```terraform
# A GitHub Container Registry login. Dokploy pulls private images with it
# and pushes the images it builds when an application references it.
resource "dokploy_registry" "ghcr" {
  name     = "ghcr"
  url      = "ghcr.io"
  username = "my-org-bot"

  # Write-only: Terraform 1.11 or later. Dokploy runs `docker login` on every
  # create and update, so the token must be valid at apply time.
  password_wo         = var.ghcr_token
  password_wo_version = 1

  # Images are pushed as ghcr.io/my-org/<app name>.
  image_prefix = "my-org"
}

# Push the built image of an application to the registry.
resource "dokploy_application" "api" {
  name           = "api"
  environment_id = dokploy_project.app.production_environment_id
  registry_id    = dokploy_registry.ghcr.id

  github = {
    github_id  = data.dokploy_github_provider.main.id
    owner      = "my-org"
    repository = "api"
    branch     = "main"
  }
}

# A self-hosted registry on a custom port.
resource "dokploy_registry" "internal" {
  name     = "internal"
  url      = "registry.internal.example.com:5000"
  username = "deploy"
  password = var.internal_registry_password
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Display name. Dokploy does not enforce a unique name.
- `url` (String) Registry host, with an optional port and without a scheme, for example `ghcr.io`, `registry.example.com:5000`, or `docker.io`.
- `username` (String) Login user.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `image_prefix` (String) Path that Dokploy puts in front of each image name it pushes, for example an organization or a project on the registry. If you remove it from the configuration, the provider clears it.
- `password` (String, Sensitive) Login password or access token. Set this attribute or `password_wo`.
- `password_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only form of `password`. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of `password` and `password_wo`. A new value reaches the server only when `password_wo_version` changes.
- `password_wo_version` (Number) Version of `password_wo`. Change it to send the current `password_wo` value to the server. It needs `password_wo`.
- `registry_type` (String) Registry type. Dokploy v0.30.5 accepts only `cloud`, which covers every external registry. Defaults to `cloud`.

### Read-Only

- `created_at` (String) Creation timestamp from the server.
- `id` (String) Registry id. `dokploy_application.registry_id` references it.
- `organization_id` (String) Id of the organization that owns the registry.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
# The password is not readable through the API: set it in the configuration
# and apply once after the import.
terraform import dokploy_registry.ghcr NMnoMScQ5m2MjGwlsc-gG
```