skip to content
wihan/dev
markdown
browse the dokploy docs

dokploy_user (Resource)

A user account with an initial password, added to the API key’s active organization with a member role. The user signs in with the email and the password and can change the password afterwards.

~> Dokploy never returns the password, and cannot reset it for another user. The state keeps the value that Terraform sent, or nothing with password_wo. A change to password, password_wo_version, or email replaces the resource, which deletes the account and creates a new one. After a terraform import, add lifecycle { ignore_changes = [password] } or accept the replacement.

~> This resource needs self-hosted Dokploy. Dokploy Cloud refuses user.createUserWithCredentials.

Example Usage

terraform
# A team member with an initial password. The person signs in with the email
# and the password, then changes the password in Dokploy.
resource "dokploy_user" "dev" {
  email = "[email protected]"
  role  = "member"

  # Write-only: Terraform 1.11 or later. A version change replaces the
  # account, because Dokploy cannot reset another user's password.
  password_wo         = var.dev_initial_password
  password_wo_version = 1
}

# An admin with a plain password attribute.
resource "dokploy_user" "ops" {
  email    = "[email protected]"
  password = var.ops_initial_password
  role     = "admin"
}

# Give the member access to one project and the right to create services.
resource "dokploy_user_permissions" "dev" {
  user_id             = dokploy_user.dev.id
  accessed_projects   = [dokploy_project.app.id]
  can_create_services = true
}

Schema

Required

  • email (String) Login email. Dokploy refuses an email that already has an account. A change replaces the resource.
  • role (String) Member role in the active organization: member, admin, or the name of a custom role. owner is not allowed.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

  • password (String, Sensitive) Initial password, 8 characters or more. Set this attribute or password_wo. Dokploy has no endpoint that resets another user’s password, so a change replaces the resource.
  • password_wo (String, Sensitive, Write-only) Write-only form of password. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of password and password_wo. A new value reaches the server only when password_wo_version changes.
  • password_wo_version (Number) Version of password_wo. Change it to send the current password_wo value to the server. A version change replaces the resource, because Dokploy cannot reset another user’s password. It needs password_wo.

Read-Only

  • created_at (String) Creation timestamp of the membership from the server.
  • id (String) User id. dokploy_user_permissions.user_id references it.
  • member_id (String) Id of the membership record in the active organization.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

shell
# Import by the user id. The password cannot be recovered: add
# lifecycle { ignore_changes = [password] } after the import.
terraform import dokploy_user.dev rM64isnUKMgqgOnwm7zE3