A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/cloudfront-associated-with-waf/README.md

@@ -0,0 +1,19 @@
+# CloudFront Associated with WAF
+
+## Source Sentinel Policy
+`cloudfront-associated-with-waf.sentinel`
+
+## Conversion Quality
+`Not convertible` as an exact translation
+
+## What the approximation does
+The included tfpolicy approximation checks only that `web_acl_id` is set to a non-empty value on `aws_cloudfront_distribution` resources.
+
+## Why exact conversion is not possible today
+The Sentinel policy uses `tfconfig/v2` plus reference metadata (`references`) to reason about whether the CloudFront distribution is associated with a WAF resource. Current tfpolicy guidance does not expose equivalent reference metadata, so it cannot distinguish:
+- literal values
+- references to WAF resources
+- computed values
+
+## Key limitation
+This means tfpolicy can enforce presence of a `web_acl_id`, but it cannot safely reproduce the Sentinel policy's reference-aware behavior.

.agents/skills/terraform-policy/examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl

@@ -0,0 +1,14 @@
+# Approximation of HashiCorp PCI DSS Sentinel example: cloudfront-associated-with-waf.sentinel
+# Exact conversion quality: Not convertible
+# This tfpolicy only checks for a non-empty web_acl_id value.
+
+resource_policy "aws_cloudfront_distribution" "require_web_acl_id" {
+    locals {
+        web_acl_id = core::try(attrs.web_acl_id, "")
+    }
+
+    enforce {
+        condition = local.web_acl_id != ""
+        error_message = "CloudFront distributions should set web_acl_id to associate a WAF or WAF Classic ACL"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel

@@ -0,0 +1,61 @@
+// This policy checks whether 'aws_cloudfront_distribution' are associated with either AWS WAF Classic or AWS WAF web ACLs.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+// Imports
+
+import "tfconfig/v2" as tfconfig
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+// Constants
+
+const = {
+	"policy_name": "cloudfront-associated-with-waf",
+	"message":     "'aws_cloudfront_distribution' are associated with either AWS WAF Classic or AWS WAF web ACLs. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-6 for more details.",
+	"resource_aws_cloudfront_distribution": "aws_cloudfront_distribution",
+}
+
+// Functions
+
+get_violations = func(resources) {
+	return collection.reject(resources, func(res) {
+		web_acl_id = maps.get(res.config, "web_acl_id", {})
+		if web_acl_id is null or web_acl_id is empty {
+			return false
+		}
+		references = maps.get(web_acl_id, "references", [])
+		return references is not empty
+	})
+}
+
+// Variables
+
+config_resources = tf.config(tfconfig.resources)
+cloudfront_distribution_resource = config_resources.type(const.resource_aws_cloudfront_distribution).resources
+
+violations = get_violations(cloudfront_distribution_resource)
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+// Outputs
+
+print(report.generate_policy_report(summary))
+
+// Rules
+
+main = rule {
+	violations is empty
+}