A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/dms-endpoints-should-use-ssl/README.md

@@ -0,0 +1,18 @@
+# DMS Endpoint SSL Mode
+
+## Source Sentinel Policy
+`dms-endpoints-should-use-ssl.sentinel`
+
+## Conversion Quality
+`Perfect`
+
+## Why it converts well
+This policy is a straightforward single-resource attribute check. The Sentinel version iterates over `aws_dms_endpoint` resources and rejects any resource whose `ssl_mode` is not in an allowlist. tfpolicy can express the same intent directly with one `resource_policy`, one allowlist, and one `enforce` block.
+
+## Key translation notes
+- Sentinel `collection.reject()` becomes one positive `condition`
+- `maps.get(res, "values.ssl_mode", null)` becomes `core::try(attrs.ssl_mode, "")`
+- No cross-resource logic, state inspection, or reference metadata is involved
+
+## Limitations encountered
+No significant tfpolicy limitation blocks this conversion.

.agents/skills/terraform-policy/examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl

@@ -0,0 +1,14 @@
+# Converted from HashiCorp PCI DSS Sentinel example: dms-endpoints-should-use-ssl.sentinel
+# Conversion quality: Perfect
+
+resource_policy "aws_dms_endpoint" "require_ssl_mode" {
+    locals {
+        ssl_mode = core::try(attrs.ssl_mode, "")
+        valid_ssl_modes = ["require", "verify-ca", "verify-full"]
+    }
+
+    enforce {
+        condition = core::contains(local.valid_ssl_modes, local.ssl_mode)
+        error_message = "DMS endpoints must set ssl_mode to one of: require, verify-ca, verify-full"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel

@@ -0,0 +1,50 @@
+# This policy requires resources of type `aws_dms_endpoint` have attribute "ssl_mode" set to one of: require, verify-ca, verify-full.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Imports
+
+import "tfplan/v2" as tfplan
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+
+const = {
+	"policy_name":               "dms-ssl-enabled",
+	"message":                   "Attribute 'ssl_mode' must be set to one of: require, verify-ca, verify-full for 'aws_dms_endpoint' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9 for more details.",
+	"resource_aws_dms_endpoint": "aws_dms_endpoint",
+	"ssl_mode":                  "ssl_mode",
+	"valid_ssl_modes":           ["require", "verify-ca", "verify-full"],
+}
+
+# Variables
+
+resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_dms_endpoint).resources
+violations = collection.reject(resources, func(res) {
+	return maps.get(res, "values." + const.ssl_mode, null) in const.valid_ssl_modes
+})
+
+summary = {
+	"policy_name": "dms-ssl-enabled",
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}