A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/cloudtrail-server-side-encryption-enabled/README.md

@@ -0,0 +1,17 @@
+# CloudTrail Server-Side Encryption Enabled
+
+## Source Sentinel Policy
+`cloudtrail-server-side-encryption-enabled.sentinel`
+
+## Conversion Quality
+`Good`
+
+## Why this is Good
+The Sentinel policy is config-oriented and checks whether `kms_key_id` is present as a configured value. tfpolicy can preserve the same enforcement intent by validating the planned end-state value for `attrs.kms_key_id`.
+
+## Key translation notes
+- `tfconfig/v2` config inspection becomes a planned-value check in tfpolicy
+- The converted policy focuses on whether `kms_key_id` is ultimately present, not whether it originated as a constant in the config
+
+## Limitations encountered
+The tfpolicy version does not preserve the config-level distinction between explicit constant values and other configuration forms. It validates the final planned attribute value instead.

.agents/skills/terraform-policy/examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl

@@ -0,0 +1,13 @@
+# Converted from HashiCorp PCI DSS Sentinel example: cloudtrail-server-side-encryption-enabled.sentinel
+# Conversion quality: Good
+
+resource_policy "aws_cloudtrail" "cloudtrail_server_side_encryption_enabled" {
+    locals {
+        kms_key_id = core::try(attrs.kms_key_id, "")
+    }
+
+    enforce {
+        condition = local.kms_key_id != ""
+        error_message = "CloudTrail resources must set kms_key_id for server-side encryption"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel

@@ -0,0 +1,53 @@
+# This policy requires that resources of type `aws_cloudtrail` have server-side encryption enabled.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Imports
+
+import "tfconfig/v2" as tfconfig
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+
+const = {
+	"resource_aws_cloudtrail":         "aws_cloudtrail",
+	"policy_name":                     "cloudtrail-server-side-encryption-enabled",
+	"message":                         "Attribute 'kms_key_id' must be present for 'aws_cloudtrail' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-2 for more details.",
+	"cloudtrail_attribute_kms_key_id": "kms_key_id",
+	"constant_value":                  "constant_value",
+}
+
+# Variables
+
+resources = tf.config(tfconfig.resources).type(const.resource_aws_cloudtrail).resources
+
+violations = collection.reject(resources, func(res) {
+	key_path = "config.kms_key_id"
+	return maps.get(res, key_path, false) is not false and
+		maps.get(res, key_path + "." + const.constant_value, false) is not ""
+})
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}