# dokploy_ssh_key (Resource)

An SSH key pair that Dokploy uses to reach a remote server (`dokploy_server`) or a private git repository (the `git` source of an application or a compose).

~> **Dokploy stores and returns `private_key` in cleartext.** The attribute is sensitive, so Terraform does not print it, but anyone with API access to the server can read it. The `private_key_wo` companion keeps it out of the Terraform state.

~> **Dokploy cannot change a stored key pair.** A change to `public_key`, `private_key`, or `private_key_wo_version` replaces the resource. Each `dokploy_server` that references the key through `ssh_key_id` then updates to the new id in the same apply.

~> **Dokploy validates the private key format.** Supply a real key, for example from the `tls_private_key` resource of the `hashicorp/tls` provider or from `ssh-keygen`. A placeholder string fails with `Invalid private key format`.

## Example Usage

```terraform
# Generate the key pair in Terraform and register it in Dokploy. The
# hashicorp/tls provider keeps the private key in the state; the write-only
# companion below keeps it out of the Dokploy provider's part of the state.
resource "tls_private_key" "deploy" {
  algorithm = "ED25519"
}

resource "dokploy_ssh_key" "deploy" {
  name        = "deploy"
  description = "Key that Dokploy uses to reach the worker servers"
  public_key  = tls_private_key.deploy.public_key_openssh

  # Write-only: Terraform 1.11 or later. Change the version to send a new key,
  # which replaces the record because Dokploy cannot update a stored key.
  private_key_wo         = tls_private_key.deploy.private_key_openssh
  private_key_wo_version = 1
}

# Or register a key pair that already exists on disk.
resource "dokploy_ssh_key" "existing" {
  name        = "ci"
  public_key  = file("~/.ssh/ci.pub")
  private_key = file("~/.ssh/ci")
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Display name. Dokploy does not enforce a unique name.
- `public_key` (String) Public key in OpenSSH format, for example `ssh-ed25519 AAAA... deploy`. A change replaces the resource.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `description` (String) Free-text description. If you remove it from the configuration, the provider clears it on the server.
- `private_key` (String, Sensitive) Private key in OpenSSH or PEM format. Set this attribute or `private_key_wo`. A change replaces the resource.
- `private_key_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only form of `private_key`. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of `private_key` and `private_key_wo`. A new value reaches the server only when `private_key_wo_version` changes.
- `private_key_wo_version` (Number) Version of `private_key_wo`. Change it to send the current `private_key_wo` value to the server. A version change replaces the resource, because Dokploy cannot change a stored key pair. It needs `private_key_wo`.

### Read-Only

- `created_at` (String) Creation timestamp from the server.
- `id` (String) SSH key id. `dokploy_server.ssh_key_id` and the `git.ssh_key_id` of an application or a compose reference it.
- `organization_id` (String) Id of the organization that owns the key. The provider fills it from the API key's active organization.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
terraform import dokploy_ssh_key.deploy UvJz8naQ2Q1G26LblagBS
```