dokploy_ssh_key (Resource)

An SSH key pair that Dokploy uses to reach a remote server (dokploy_server) or a private git repository (the git source of an application or a compose).

~> Dokploy stores and returns private_key in cleartext. The attribute is sensitive, so Terraform does not print it, but anyone with API access to the server can read it. The private_key_wo companion keeps it out of the Terraform state.

~> Dokploy cannot change a stored key pair. A change to public_key, private_key, or private_key_wo_version replaces the resource. Each dokploy_server that references the key through ssh_key_id then updates to the new id in the same apply.

~> Dokploy validates the private key format. Supply a real key, for example from the tls_private_key resource of the hashicorp/tls provider or from ssh-keygen. A placeholder string fails with Invalid private key format.

Example Usage

# Generate the key pair in Terraform and register it in Dokploy. The
# hashicorp/tls provider keeps the private key in the state; the write-only
# companion below keeps it out of the Dokploy provider's part of the state.
resource "tls_private_key" "deploy" {
  algorithm = "ED25519"
}

resource "dokploy_ssh_key" "deploy" {
  name        = "deploy"
  description = "Key that Dokploy uses to reach the worker servers"
  public_key  = tls_private_key.deploy.public_key_openssh

  # Write-only: Terraform 1.11 or later. Change the version to send a new key,
  # which replaces the record because Dokploy cannot update a stored key.
  private_key_wo         = tls_private_key.deploy.private_key_openssh
  private_key_wo_version = 1
}

# Or register a key pair that already exists on disk.
resource "dokploy_ssh_key" "existing" {
  name        = "ci"
  public_key  = file("~/.ssh/ci.pub")
  private_key = file("~/.ssh/ci")
}

Schema

Required

• name (String) Display name. Dokploy does not enforce a unique name.
• public_key (String) Public key in OpenSSH format, for example ssh-ed25519 AAAA... deploy. A change replaces the resource.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• description (String) Free-text description. If you remove it from the configuration, the provider clears it on the server.
• private_key (String, Sensitive) Private key in OpenSSH or PEM format. Set this attribute or private_key_wo. A change replaces the resource.
• private_key_wo (String, Sensitive, Write-only) Write-only form of private_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of private_key and private_key_wo. A new value reaches the server only when private_key_wo_version changes.
• private_key_wo_version (Number) Version of private_key_wo. Change it to send the current private_key_wo value to the server. A version change replaces the resource, because Dokploy cannot change a stored key pair. It needs private_key_wo.

Read-Only

• created_at (String) Creation timestamp from the server.
• id (String) SSH key id. dokploy_server.ssh_key_id and the git.ssh_key_id of an application or a compose reference it.
• organization_id (String) Id of the organization that owns the key. The provider fills it from the API key’s active organization.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import dokploy_ssh_key.deploy UvJz8naQ2Q1G26LblagBS