# dokploy_registry (Resource)

A container registry login (Settings > Registry). Dokploy pulls private images with it, and pushes the images it builds to it when `dokploy_application.registry_id` references it.

~> **Dokploy runs `docker login` on create and on update.** A registry that the Dokploy server cannot reach, or a wrong user or password, fails the apply with `Command execution failed`. Dokploy stores the record only after the login succeeds.

~> **The read endpoint omits the password.** The provider cannot detect a password that changed in the Dokploy UI, and `terraform import` leaves `password` empty: set it in the configuration and apply once. The `password_wo` companion keeps the password out of the Terraform state.

## Example Usage

```terraform
# A GitHub Container Registry login. Dokploy pulls private images with it
# and pushes the images it builds when an application references it.
resource "dokploy_registry" "ghcr" {
  name     = "ghcr"
  url      = "ghcr.io"
  username = "my-org-bot"

  # Write-only: Terraform 1.11 or later. Dokploy runs `docker login` on every
  # create and update, so the token must be valid at apply time.
  password_wo         = var.ghcr_token
  password_wo_version = 1

  # Images are pushed as ghcr.io/my-org/<app name>.
  image_prefix = "my-org"

  # Test the login before the provider writes the record.
  verify_connection = true
}

# Push the built image of an application to the registry.
resource "dokploy_application" "api" {
  name           = "api"
  environment_id = dokploy_project.app.production_environment_id
  registry_id    = dokploy_registry.ghcr.id

  github = {
    github_id  = data.dokploy_github_provider.main.id
    owner      = "my-org"
    repository = "api"
    branch     = "main"
  }
}

# A self-hosted registry on a custom port.
resource "dokploy_registry" "internal" {
  name     = "internal"
  url      = "registry.internal.example.com:5000"
  username = "deploy"
  password = var.internal_registry_password
}
```

```terraform
# Test the login before the provider writes the record. If the test fails,
# the apply fails and the provider writes nothing. The token is write-only:
# Terraform does not write it to the plan or to the state.
resource "dokploy_registry" "checked" {
  name     = "ghcr-checked"
  url      = "ghcr.io"
  username = "my-org-bot"

  password_wo         = var.ghcr_token
  password_wo_version = 1

  verify_connection = true
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Display name. Dokploy does not enforce a unique name.
- `url` (String) Registry host, with an optional port and without a scheme, for example `ghcr.io`, `registry.example.com:5000`, or `docker.io`.
- `username` (String) Login user.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `image_prefix` (String) Path that Dokploy puts in front of each image name it pushes, for example an organization or a project on the registry. If you remove it from the configuration, the provider clears it.
- `password` (String, Sensitive) Login password or access token. Set this attribute or `password_wo`.
- `password_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only form of `password`. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of `password` and `password_wo`. A new value reaches the server only when `password_wo_version` changes.
- `password_wo_version` (Number) Version of `password_wo`. Change it to send the current `password_wo` value to the server. It needs `password_wo`.
- `registry_type` (String) Registry type. Dokploy v0.30.5 accepts only `cloud`, which covers every external registry. Defaults to `cloud`.
- `verify_connection` (Boolean) Test the connection with `registry.testRegistry` before the provider creates or updates the record. If the test fails, the apply fails with the server message, and the provider writes nothing. The default is no check: `null` and `false` both skip the test. Dokploy stores no value for this attribute, so `terraform import` leaves it `null`. Dokploy already runs `docker login` on create and on update, so this attribute adds an early check only.

### Read-Only

- `created_at` (String) Creation timestamp from the server.
- `id` (String) Registry id. `dokploy_application.registry_id` references it.
- `organization_id` (String) Id of the organization that owns the registry.

## Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used with the `id` attribute, for example:

```terraform
# The password is not readable through the API: set it in the configuration
# and apply once after the import.
import {
  to = dokploy_registry.ghcr
  id = "NMnoMScQ5m2MjGwlsc-gG"
}
```

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
terraform import dokploy_registry.ghcr NMnoMScQ5m2MjGwlsc-gG
```