A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/elasticsearch-encrypted-at-rest/README.md

@@ -0,0 +1,18 @@
+# Elasticsearch Encrypted at Rest
+
+## Source Sentinel Policy
+`elasticsearch-encrypted-at-rest.sentinel`
+
+## Conversion Quality
+`Good`
+
+## Why this is Good
+The original intent maps cleanly to tfpolicy, but the block shape still has to be rewritten in tfpolicy terms using `core::try()` around `encrypt_at_rest[0].enabled`.
+
+## Key translation notes
+- Nested map access becomes direct tfpolicy block access
+- The conversion checks the planned end state of `encrypt_at_rest`
+- The outcome is preserved even though the syntax changes substantially
+
+## Limitations encountered
+This depends on the provider exposing `encrypt_at_rest` in the expected block/list structure. As with other tfpolicy policies, raw provider schema shape matters.

.agents/skills/terraform-policy/examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl

@@ -0,0 +1,14 @@
+# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-encrypted-at-rest.sentinel
+# Conversion quality: Good
+
+resource_policy "aws_elasticsearch_domain" "elasticsearch_encrypted_at_rest" {
+    locals {
+        encrypt_at_rest = core::try(attrs.encrypt_at_rest, [])
+        encryption_enabled = core::try(local.encrypt_at_rest[0].enabled, false)
+    }
+
+    enforce {
+        condition = local.encryption_enabled == true
+        error_message = "Elasticsearch domains must enable encrypt_at_rest"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel

@@ -0,0 +1,54 @@
+# This policy requires resources of type `aws_elasticsearch_domain` have the `encrypt_at_rest` should have 'enabled' attribute set to `true`.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Import
+
+import "tfplan/v2" as tfplan
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+const = {
+	"policy_name":                       "elasticsearch-encrypted-at-rest",
+	"message":                           "Attribute 'enabled' must be set to true for the attribute 'encrypt_at_rest' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-1 for more details.",
+	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
+}
+
+# Functions
+
+get_violations = func(resources) {
+	return collection.reject(resources, func(res) {
+		encrypt_at_rest_values = maps.get(res, "values.encrypt_at_rest", [])
+		return encrypt_at_rest_values is not empty and encrypt_at_rest_values[0].enabled is true
+	})
+}
+
+# Variables
+
+elasticsearch_resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticsearch_domain).resources
+violations = get_violations(elasticsearch_resources)
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}