A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/dms-endpoint-should-be-ssl-configured/README.md

@@ -0,0 +1,17 @@
+# DMS Endpoint Should Be SSL Configured
+
+## Source Sentinel Policy
+`dms-endpoint-should-be-ssl-configured.sentinel`
+
+## Conversion Quality
+`Good`
+
+## Why this converts reasonably well
+The Sentinel version uses `tfconfig/v2` to accept either a constant value or a reference for `certificate_arn`. tfpolicy cannot inspect Terraform config reference metadata the same way, but it can still validate that the planned `certificate_arn` value is non-empty.
+
+## Key translation notes
+- Config-oriented Sentinel checks become an end-state tfpolicy check on `attrs.certificate_arn`
+- tfpolicy focuses on the resulting planned value instead of whether it came from a literal or a reference
+
+## Limitations encountered
+The tfpolicy version does not preserve the source-level distinction between constant values and references. It only checks that the final planned value is present.

.agents/skills/terraform-policy/examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl

@@ -0,0 +1,13 @@
+# Converted from HashiCorp PCI DSS Sentinel example: dms-endpoint-should-be-ssl-configured.sentinel
+# Conversion quality: Good
+
+resource_policy "aws_dms_endpoint" "dms_endpoint_should_be_ssl_configured" {
+    locals {
+        certificate_arn = core::try(attrs.certificate_arn, "")
+    }
+
+    enforce {
+        condition = local.certificate_arn != ""
+        error_message = "DMS endpoints should set certificate_arn for SSL configuration"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel

@@ -0,0 +1,55 @@
+# This policy checks if resources of type 'aws_dms_endpoint' have the 'certificate_arn'
+# shouldn't be empty
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+import "tfconfig/v2" as tfconfig
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+const = {
+	"policy_name":               "dms-endpoint-should-be-ssl-configured",
+	"message":                   "Attribute 'certificate_arn' shouldn't be empty for AWS DMS Endpoint. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9 for more details.",
+	"resource_aws_dms_endpoint": "aws_dms_endpoint",
+}
+
+# Functions
+
+get_violations = func(resources) {
+	return collection.reject(resources, func(res) {
+		certificate_arn_values = maps.get(res, "config.certificate_arn", "")
+		if certificate_arn_values is empty {
+			return false
+		}
+		return maps.get(certificate_arn_values, "constant_value", "") is not empty or maps.get(certificate_arn_values, "references", "") is not empty
+	})
+}
+
+# Variables
+
+dms_endpoint_resource = tf.config(tfconfig.resources).type(const.resource_aws_dms_endpoint).resources
+violations = get_violations(dms_endpoint_resource)
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}