A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/elasticsearch-in-vpc-only/README.md

@@ -0,0 +1,18 @@
+# Elasticsearch In VPC Only
+
+## Source Sentinel Policy
+`elasticsearch-in-vpc-only.sentinel`
+
+## Conversion Quality
+`Limited`
+
+## Why this is limited
+The Sentinel policy is config-oriented and accepts either constant subnet IDs or references inside `vpc_options.subnet_ids`. tfpolicy does not expose the same config-level `constant_value` and `references` metadata, so it cannot preserve that distinction exactly.
+
+## What the tfpolicy approximation does
+The tfpolicy version checks the planned end state and requires `vpc_options[0].subnet_ids` to contain one or more values.
+
+## Limitations encountered
+- It validates the resulting planned subnet IDs, not whether they originated from constants vs references
+- It assumes the provider exposes `vpc_options` and `subnet_ids` in the expected schema shape
+- It is a useful enforcement approximation, but not a one-to-one tfconfig translation

.agents/skills/terraform-policy/examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl

@@ -0,0 +1,14 @@
+# Approximation of HashiCorp PCI DSS Sentinel example: elasticsearch-in-vpc-only.sentinel
+# Exact conversion quality: Limited
+
+resource_policy "aws_elasticsearch_domain" "elasticsearch_in_vpc_only" {
+    locals {
+        vpc_options = core::try(attrs.vpc_options, [])
+        subnet_ids = core::try(local.vpc_options[0].subnet_ids, [])
+    }
+
+    enforce {
+        condition = core::length(local.subnet_ids) > 0
+        error_message = "Elasticsearch domains should define one or more subnet_ids in vpc_options"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel

@@ -0,0 +1,64 @@
+# This policy requires resources of type `aws_elasticsearch_domain` have the `subnet_ids` should not be empty inside 'vpc_options'.
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Import
+
+import "tfconfig/v2" as tfconfig
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+const = {
+	"policy_name":                       "elasticsearch-in-vpc-only",
+	"message":                           "Attribute 'subnet_ids' should not be empty for the attribute 'vpc_options' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-2 for more details.",
+	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
+	"subnet_ids":                        "subnet_ids",
+	"constant_value":                    "constant_value",
+	"references":                        "references",
+}
+
+# Functions
+
+get_violations = func(resources) {
+	return collection.reject(resources, func(res) {
+		vpc_options_values = maps.get(res, "config.vpc_options", [])
+		if vpc_options_values is empty {
+			return false
+		}
+		subnet_ids_values = maps.get(vpc_options_values[0], const.subnet_ids, [])
+		if subnet_ids_values is empty {
+			return false
+		}
+		return maps.get(subnet_ids_values, const.constant_value, []) is not empty or maps.get(subnet_ids_values, const.references, []) is not empty
+	})
+}
+
+# Variables
+
+elasticsearch_resources = tf.config(tfconfig.resources).type(const.resource_aws_elasticsearch_domain).resources
+violations = get_violations(elasticsearch_resources)
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+
+print(report.generate_policy_report(summary))
+
+# Rules
+
+main = rule {
+	violations is empty
+}