dokploy

Terraform + Ansible setup for a self-hosted Dokploy instance.

Setup

1. Create a Hetzner Cloud API key
2. Create a Cloudflare DNS key with Zone.DNS edit permission

Local setup

Secrets live in terraform/.env and are injected as TF_VAR_* environment variables into the local shell session:

TF_VAR_hcloud_token=...
TF_VAR_cloudflare_api_token=...
TF_VAR_domain_name=...

direnv

Setup direnv on the development machine and add terraform/.envrc:

dotenv_if_exists .env

Then load the variables into the shell:

cd terraform
direnv allow

Run Terraform / Tofu manually:

tofu init
tofu plan
tofu apply

Without direnv

Load the file manually, scoped to a single command:

cd terraform
set -a; . ./.env; set +a
tofu plan

Or use a wrapper that keeps the variables contained to the tofu subprocess:

#!/bin/sh
set -a
. ./.env
set +a
exec tofu "$@"

CI/CD

CI reads the same variables from the git forge's secret store — no .env file is needed.

Add the necessary variables

GitHub Actions example:

env:
  TF_VAR_hcloud_token: ${{ secrets.TF_VAR_HCLOUD_TOKEN }}
  TF_VAR_cloudflare_api_token: ${{ secrets.TF_VAR_CLOUDFLARE_API_TOKEN }}
  TF_VAR_domain_name: ${{ secrets.TF_VAR_DOMAIN_NAME }}