dokploy_vault_provider (Resource)

A secret-vault connection. Dokploy pulls runtime secrets from it at deploy time. Other resources reference a secret in their env attribute as ${{vault.<name>.<key>}}, a plain string that this provider does not parse or validate. The resource models eight provider types: hashicorp (also OpenBao, which uses the same wire protocol), infisical, aws, doppler, azure, scaleway, phase (Phase.dev, Dokploy v0.30.5 and later), and aws_parameter_store (AWS Systems Manager Parameter Store, Dokploy v0.30.6 and later).

~> Dokploy masks each secret on each read. Dokploy returns each secret field in the config blocks of this resource as the literal string ********, on create, read, and update alike. The provider therefore cannot detect a config value that changed in the Dokploy UI. Read keeps each config block exactly as Terraform last wrote it, secret and non-secret fields alike. Manage the config of a vault provider only through Terraform. An edit in the UI stays undetected until the next apply that modifies this resource. That apply writes the full body and overwrites the edit with the Terraform config.

~> Each secret field has a write-only companion, for example hashicorp.token_wo with hashicorp.token_wo_version. Terraform keeps the companion out of the plan and the state. The server does not return the secret, so the provider sends the companion’s value on every update. Change the version to start an update when only the secret changed.

~> terraform import cannot recover a config block. The import leaves the config blocks null. Supply the block that matches the actual provider type in the configuration. The first terraform apply then writes it as a full-body update, not as a partial patch.

~> Dokploy does not validate vault credentials on create or update, for any provider type. Only verify_connection = true reaches the real vault, through vaultProvider.testConnection, before the write. Without it, a misconfigured vault provider applies successfully and fails only on the next deploy that needs a secret from it.

Example Usage

terraform

variable "vault_token" {
  type      = string
  sensitive = true
}

resource "dokploy_vault_provider" "secrets" {
  name = "prod-vault"

  hashicorp = {
    url   = "https://vault.example.com:8200"
    token = var.vault_token
    # namespace = "admin" # Vault Enterprise only. Omit it for open-source Vault or OpenBao.
    # mount     = "secret" # KV mount path. This is the server default.
  }

  assignments = [
    {
      project_id = dokploy_project.example.id
      # environment_ids = [] # Omit it, or leave it empty, to cover each
      #                        environment in the project.
    }
  ]

  # Tests the real vault through vaultProvider.testConnection before the
  # write, so a bad token or an unreachable server fails the apply instead
  # of a broken vault provider.
  verify_connection = true
}

# Reference a secret from this vault provider in the `env` of another resource.
# Dokploy resolves ${{vault.<name>.<key>}} at deploy time. The provider
# passes the string through unchanged and does not parse or validate it.
# The doubled `$$` escapes the Terraform `${...}` interpolation, so the
# literal `${{...}}` reaches Dokploy.
#
# resource "dokploy_application" "api" {
#   # ...
#   env = <<-EOT
#     DATABASE_PASSWORD=$${{vault.prod-vault.database_password}}
#   EOT
# }

# Phase.dev (Dokploy v0.30.5 and later).
resource "dokploy_vault_provider" "phase" {
  name = "phase"

  phase = {
    token_wo         = var.phase_token
    token_wo_version = 1
    app_id           = "app_0123456789"
    env              = "production"
    # path    = "/"                     # Server default.
    # api_url = "https://api.phase.dev" # Server default. Set it for a self-hosted Phase.
  }

  assignments = []
}

# AWS Systems Manager Parameter Store (Dokploy v0.30.6 and later).
resource "dokploy_vault_provider" "ssm" {
  name = "ssm"

  aws_parameter_store = {
    region            = "eu-west-1"
    access_key_id     = var.aws_access_key_id
    secret_access_key = var.aws_secret_access_key
    parameter_path    = "/wihan-dev/" # Optional. It must start with `/`.
  }

  assignments = []
}

Schema

Required

assignments (Attributes List) Projects, and optionally specific environments in them, that can use this vault provider. An empty list is valid: the server accepts assignments = [] and returns it. (see nested schema for assignments)
name (String) Display name, 1 to 64 characters, that matches ^[a-zA-Z0-9_-]+$. Dokploy rejects a duplicate name. The provider checks for a duplicate before it sends a create request, so a collision fails with a clear error instead of the raw server error.

Optional

aws (Attributes) AWS Secrets Manager connection. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store.

~> The shape of this block comes from the OpenAPI contract, not from a live probe. The acceptance tests of this resource are the first live confirmation of it. (see nested schema for aws)

aws_parameter_store (Attributes) AWS Systems Manager Parameter Store connection. Needs Dokploy v0.30.6 or later. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for aws_parameter_store)
azure (Attributes) Azure Key Vault connection. The API requires each field; Azure has no optional field here. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store.

~> The shape of this block comes from the OpenAPI contract, not from a live probe. (see nested schema for azure)

doppler (Attributes) Doppler connection. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for doppler)
hashicorp (Attributes) HashiCorp Vault or OpenBao connection. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for hashicorp)
infisical (Attributes) Infisical connection. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for infisical)
phase (Attributes) Phase.dev connection. Needs Dokploy v0.30.5 or later. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for phase)
scaleway (Attributes) Scaleway Secret Manager connection. Set exactly one of hashicorp, infisical, aws, doppler, azure, scaleway, phase, or aws_parameter_store. (see nested schema for scaleway)
verify_connection (Boolean) Test the config against the real vault before the write, through vaultProvider.testConnection. Defaults to false. On failure, the apply fails with the server message, and the provider creates or updates nothing. This attribute is provider-only, and Dokploy stores no value for it, so terraform import always seeds it with false.

Read-Only

created_at (String) Creation timestamp from the server.
id (String) Vault provider id.

Nested Schema for `assignments`

Required:

project_id (String) Id of the assigned project.

Optional:

environment_ids (Set of String) Ids of the environments in the project that this assignment covers. Omit it, or set an empty list, to cover each environment in the project. The server stores and returns an empty set for that case, not null.

Nested Schema for `aws`

Required:

region (String) AWS region for Secrets Manager, for example us-east-1.

Optional:

access_key_id (String, Sensitive) AWS access key id. Set this attribute or access_key_id_wo.
access_key_id_wo (String, Sensitive, Write-only) Write-only form of access_key_id. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of access_key_id and access_key_id_wo. The server does not return the value, so every update sends it. Change access_key_id_wo_version to start an update when only this value changed.
access_key_id_wo_version (Number) Version of access_key_id_wo. Change it to start an update when only access_key_id_wo changed. It needs access_key_id_wo.
endpoint (String) Custom Secrets Manager endpoint, for a compatible service or a VPC endpoint. Omit it to use the default AWS endpoint. The server has no default for this field.
secret_access_key (String, Sensitive) AWS secret access key. Set this attribute or secret_access_key_wo.
secret_access_key_wo (String, Sensitive, Write-only) Write-only form of secret_access_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of secret_access_key and secret_access_key_wo. The server does not return the value, so every update sends it. Change secret_access_key_wo_version to start an update when only this value changed.
secret_access_key_wo_version (Number) Version of secret_access_key_wo. Change it to start an update when only secret_access_key_wo changed. It needs secret_access_key_wo.

Nested Schema for `aws_parameter_store`

Required:

access_key_id (String) AWS access key id. Dokploy stores and returns it in cleartext.
region (String) AWS region for Parameter Store, for example eu-west-1.

Optional:

endpoint (String) Custom Parameter Store endpoint URL, for a compatible service or a VPC endpoint. Omit it to use the default AWS endpoint. The server has no default for this field.
parameter_path (String) Path prefix under which Dokploy discovers parameters, for example /wihan-dev/. It must start with /. Omit it to discover every parameter. The server has no default for this field.
secret_access_key (String, Sensitive) AWS secret access key. Set this attribute or secret_access_key_wo.
secret_access_key_wo (String, Sensitive, Write-only) Write-only form of secret_access_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of secret_access_key and secret_access_key_wo. The server does not return the value, so every update sends it. Change secret_access_key_wo_version to start an update when only this value changed.
secret_access_key_wo_version (Number) Version of secret_access_key_wo. Change it to start an update when only secret_access_key_wo changed. It needs secret_access_key_wo.

Nested Schema for `azure`

Required:

client_id (String) Azure AD application client id.
tenant_id (String) Azure AD tenant id.
vault_uri (String) Azure Key Vault URI, for example https://myvault.vault.azure.net/.

Optional:

client_secret (String, Sensitive) Azure AD application client secret. Set this attribute or client_secret_wo.
client_secret_wo (String, Sensitive, Write-only) Write-only form of client_secret. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of client_secret and client_secret_wo. The server does not return the value, so every update sends it. Change client_secret_wo_version to start an update when only this value changed.
client_secret_wo_version (Number) Version of client_secret_wo. Change it to start an update when only client_secret_wo changed. It needs client_secret_wo.

Nested Schema for `doppler`

Optional:

config (String) Doppler config name. The wire field is also named config. Omit it, and Doppler infers it from the service token. The server has no default for this field.
project (String) Doppler project slug. Omit it, and Doppler infers it from the service token. The server has no default for this field.
service_token (String, Sensitive) Doppler service token. Set this attribute or service_token_wo.
service_token_wo (String, Sensitive, Write-only) Write-only form of service_token. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of service_token and service_token_wo. The server does not return the value, so every update sends it. Change service_token_wo_version to start an update when only this value changed.
service_token_wo_version (Number) Version of service_token_wo. Change it to start an update when only service_token_wo changed. It needs service_token_wo.

Nested Schema for `hashicorp`

Required:

url (String) Vault or OpenBao server URL, for example https://vault.example.com:8200.

Optional:

mount (String) KV secrets engine mount path. Defaults to secret.
namespace (String) Vault Enterprise namespace. Omit it for open-source Vault or OpenBao. The server has no default for this field.
token (String, Sensitive) Vault authentication token. Set this attribute or token_wo.
token_wo (String, Sensitive, Write-only) Write-only form of token. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of token and token_wo. The server does not return the value, so every update sends it. Change token_wo_version to start an update when only this value changed.
token_wo_version (Number) Version of token_wo. Change it to start an update when only token_wo changed. It needs token_wo.

Nested Schema for `infisical`

Required:

client_id (String) Infisical machine identity client id.
environment_slug (String) Infisical environment slug, for example dev or prod.
project_id (String) Infisical project id.

Optional:

client_secret (String, Sensitive) Infisical machine identity client secret. Set this attribute or client_secret_wo.
client_secret_wo (String, Sensitive, Write-only) Write-only form of client_secret. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of client_secret and client_secret_wo. The server does not return the value, so every update sends it. Change client_secret_wo_version to start an update when only this value changed.
client_secret_wo_version (Number) Version of client_secret_wo. Change it to start an update when only client_secret_wo changed. It needs client_secret_wo.
secret_path (String) Path inside the Infisical project to read secrets from. Defaults to /.
site_url (String) Infisical instance URL. Defaults to the Infisical Cloud URL.

Nested Schema for `phase`

Required:

app_id (String) Phase application id.
env (String) Phase environment name, for example production.

Optional:

api_url (String) Phase API URL. Defaults to the Phase Cloud URL, https://api.phase.dev. Set it for a self-hosted Phase instance.
path (String) Path inside the Phase application to read secrets from. Defaults to /.
token (String, Sensitive) Phase service token. Set this attribute or token_wo.
token_wo (String, Sensitive, Write-only) Write-only form of token. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of token and token_wo. The server does not return the value, so every update sends it. Change token_wo_version to start an update when only this value changed.
token_wo_version (Number) Version of token_wo. Change it to start an update when only token_wo changed. It needs token_wo.

Nested Schema for `scaleway`

Required:

project_id (String) Scaleway project id.

Optional:

api_url (String) Scaleway Secret Manager API URL. Defaults to https://api.scaleway.com.
region (String) Scaleway region. Defaults to fr-par.
secret_key (String, Sensitive) Scaleway API secret key. Set this attribute or secret_key_wo.
secret_key_wo (String, Sensitive, Write-only) Write-only form of secret_key. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of secret_key and secret_key_wo. The server does not return the value, so every update sends it. Change secret_key_wo_version to start an update when only this value changed.
secret_key_wo_version (Number) Version of secret_key_wo. Change it to start an update when only secret_key_wo changed. It needs secret_key_wo.

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

terraform

# Dokploy masks every secret field as "********" on every read. Import
# cannot recover the config block, so the imported state holds a null block.
# Write the block for the type of the provider in the configuration: hashicorp,
# infisical, aws, doppler, azure, or scaleway. The first apply after the
# import is a full update. It is not an empty plan.
import {
  to = dokploy_vault_provider.secrets
  id = "v1a2b3c4d5e6f7g8h9i0j"
}

The terraform import command can be used, for example:

shell

terraform import dokploy_vault_provider.secrets v1a2b3c4d5e6f7g8h9i0j

dokploy_vault_provider (Resource)

Example Usage

Schema

Required

Optional

Read-Only

Nested Schema for assignments

Nested Schema for aws

Nested Schema for aws_parameter_store

Nested Schema for azure

Nested Schema for doppler

Nested Schema for hashicorp

Nested Schema for infisical

Nested Schema for phase

Nested Schema for scaleway

Import

Nested Schema for `assignments`

Nested Schema for `aws`

Nested Schema for `aws_parameter_store`

Nested Schema for `azure`

Nested Schema for `doppler`

Nested Schema for `hashicorp`

Nested Schema for `infisical`

Nested Schema for `phase`

Nested Schema for `scaleway`