A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/elasticsearch-https-required/README.md

@@ -0,0 +1,18 @@
+# Elasticsearch HTTPS Required
+
+## Source Sentinel Policy
+`elasticsearch-https-required.sentinel`
+
+## Conversion Quality
+`Good`
+
+## Why it is not labeled Perfect
+The enforcement intent is preserved, but the structure changes more noticeably than in a simple attribute check. The Sentinel version uses helper functions plus nested map lookups. The tfpolicy version rewrites that logic into direct block access with `core::try()` and separate `enforce` blocks.
+
+## Key translation notes
+- Nested `maps.get()` calls become `core::try(local.endpoint_options[0]....)`
+- One compound Sentinel predicate becomes multiple focused `enforce` blocks
+- The end-state requirement is preserved clearly in tfpolicy
+
+## Limitations encountered
+This conversion depends on provider schema shape for `domain_endpoint_options`. As with other tfpolicy policies, block/list/set handling must match the exposed schema exactly.

.agents/skills/terraform-policy/examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl

@@ -0,0 +1,26 @@
+# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-https-required.sentinel
+# Conversion quality: Good
+
+resource_policy "aws_elasticsearch_domain" "https_required" {
+    locals {
+        endpoint_options = core::try(attrs.domain_endpoint_options, [])
+        endpoint_options_present = core::length(local.endpoint_options) > 0
+        enforce_https = core::try(local.endpoint_options[0].enforce_https, false)
+        tls_security_policy = core::try(local.endpoint_options[0].tls_security_policy, "")
+    }
+
+    enforce {
+        condition = local.endpoint_options_present
+        error_message = "Elasticsearch domains must define domain_endpoint_options"
+    }
+
+    enforce {
+        condition = local.enforce_https == true
+        error_message = "Elasticsearch domains must set domain_endpoint_options.enforce_https = true"
+    }
+
+    enforce {
+        condition = local.tls_security_policy == "Policy-Min-TLS-1-2-PFS-2023-10"
+        error_message = "Elasticsearch domains must use tls_security_policy 'Policy-Min-TLS-1-2-PFS-2023-10'"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel

@@ -0,0 +1,68 @@
+# This policy requires resources of type `aws_elasticsearch_domain` have the `tls_security_policy` set to latest policy that is 'Policy-Min-TLS-1-2-PFS-2023-10' and 'enforce_https' set to true for `domain_endpoint_options` attribute.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Import
+
+import "tfplan/v2" as tfplan
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Params
+param master_count_value default 3
+
+# Constants
+const = {
+	"policy_name":                       "elasticsearch-https-required",
+	"message":                           "Attribute 'tls_security_policy' must be set to latest policy that is 'Policy-Min-TLS-1-2-PFS-2023-10' and 'enforce_https' set to true for the attribute 'domain_endpoint_options' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-8 for more details.",
+	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
+	"enforce_https":                     "enforce_https",
+	"tls_security_policy":               "tls_security_policy",
+	"allowed_tls_latest_policy":         "Policy-Min-TLS-1-2-PFS-2023-10",
+}
+
+# Functions
+
+get_violations = func(resources) {
+	return collection.reject(resources, func(res) {
+		domain_endpoint_options_values = maps.get(res, "values.domain_endpoint_options", [])
+		if domain_endpoint_options_values is empty {
+			return false
+		}
+		tls_security_policy_value = maps.get(domain_endpoint_options_values[0], const.tls_security_policy, null)
+		enforce_https_value = maps.get(domain_endpoint_options_values[0], const.enforce_https, true)
+		if tls_security_policy_value is null {
+			return false
+		}
+		return enforce_https_value is true and tls_security_policy_value == const.allowed_tls_latest_policy
+	})
+}
+
+# Variables
+
+elasticsearch_resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticsearch_domain).resources
+violations = get_violations(elasticsearch_resources)
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}