# dokploy_user (Resource)

A user account with an initial password, added to the API key's active organization with a member role. The user signs in with the email and the password and can change the password afterwards.

~> **Dokploy never returns the password, and cannot reset it for another user.** The state keeps the value that Terraform sent, or nothing with `password_wo`. A change to `password`, `password_wo_version`, or `email` replaces the resource, which deletes the account and creates a new one. After a `terraform import`, add `lifecycle { ignore_changes = [password] }` or accept the replacement.

~> This resource needs self-hosted Dokploy. Dokploy Cloud refuses `user.createUserWithCredentials`.

## Example Usage

```terraform
# A team member with an initial password. The person signs in with the email
# and the password, then changes the password in Dokploy.
resource "dokploy_user" "dev" {
  email = "dev@example.com"
  role  = "member"

  # Write-only: Terraform 1.11 or later. A version change replaces the
  # account, because Dokploy cannot reset another user's password.
  password_wo         = var.dev_initial_password
  password_wo_version = 1
}

# An admin with a plain password attribute.
resource "dokploy_user" "ops" {
  email    = "ops@example.com"
  password = var.ops_initial_password
  role     = "admin"
}

# Give the member access to one project and the right to create services.
resource "dokploy_user_permissions" "dev" {
  user_id             = dokploy_user.dev.id
  accessed_projects   = [dokploy_project.app.id]
  can_create_services = true
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `email` (String) Login email. Dokploy refuses an email that already has an account. A change replaces the resource.
- `role` (String) Member role in the active organization: `member`, `admin`, or the name of a custom role. `owner` is not allowed.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `password` (String, Sensitive) Initial password, 8 characters or more. Set this attribute or `password_wo`. Dokploy has no endpoint that resets another user's password, so a change replaces the resource.
- `password_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only form of `password`. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of `password` and `password_wo`. A new value reaches the server only when `password_wo_version` changes.
- `password_wo_version` (Number) Version of `password_wo`. Change it to send the current `password_wo` value to the server. A version change replaces the resource, because Dokploy cannot reset another user's password. It needs `password_wo`.

### Read-Only

- `created_at` (String) Creation timestamp of the membership from the server.
- `id` (String) User id. `dokploy_user_permissions.user_id` references it.
- `member_id` (String) Id of the membership record in the active organization.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
# Import by the user id. The password cannot be recovered: add
# lifecycle { ignore_changes = [password] } after the import.
terraform import dokploy_user.dev rM64isnUKMgqgOnwm7zE3
```