terraform-provider-zerops

Zerops Terraform Provider

Manage Zerops projects, services, deployments, storage, and networking with Terraform or OpenTofu.

Status: The Zerops public API is beta, and this provider is pre-1.0. Breaking changes are possible in 0.x releases.

Requirements

• Terraform 1.x or OpenTofu 1.x (tested with Terraform 1.15.9 and OpenTofu 1.12.1).
• A CLI supporting Terraform provider protocol 6. Older CLI compatibility has not been established.
• A Zerops account and an integration token with permissions for the resources you manage.

Installation

Use the same configuration with Terraform and OpenTofu:

terraform {
  required_providers {
    zerops = {
      source  = "zeropsio/zerops"
      version = "~> 0.1"
    }
  }
}

provider "zerops" {}

Run terraform init or tofu init to install the provider.

Authentication

Set ZEROPS_TOKEN to your integration token, or configure the sensitive token provider attribute. Keep credentials out of version control.

Explicit provider attributes take precedence over environment variables. The endpoint must be an HTTPS origin. Some sensitive reads require sudo-enabled credentials; the provider does not perform privilege escalation. Sensitive values remain in Terraform state: protect state files and backend access.

Quick example

With authentication configured and the installation block above:

resource "zerops_project" "example" {
  name               = "example"
  description        = "Managed by Terraform"
  mode               = "LIGHT"
  env_isolation      = "none"
  ssh_isolation      = "vpn"
  public_ipv4_shared = false
}

resource "zerops_service" "app" {
  project_id         = zerops_project.example.id
  hostname           = "app"
  type               = "nodejs@22"
  start_without_code = true
  desired_state      = "RUNNING"
}

resource "zerops_service" "db" {
  project_id = zerops_project.example.id
  hostname   = "db"
  type       = "postgresql:single@16"
}

This creates a project, a service ready for a later deployment, and a single-node PostgreSQL database; it does not deploy application code. See examples for deployment and configuration examples.

Resources and data sources

Full schemas and import instructions are available in the Registry documentation.

Resources

• zerops_integration_token
• zerops_object_storage
• zerops_project
• zerops_project_dedicated_ipv4
• zerops_project_env
• zerops_project_import
• zerops_project_l7_balancer_config
• zerops_project_prometheus_config
• zerops_project_remote_logging
• zerops_project_vpn_peer
• zerops_public_http_routing
• zerops_public_port_routing
• zerops_service
• zerops_service_backup_config
• zerops_service_deploy
• zerops_service_env
• zerops_service_git_integration
• zerops_service_restart
• zerops_service_subdomain_access

Data sources

• zerops_locations
• zerops_organization
• zerops_project
• zerops_project_export
• zerops_projects
• zerops_regions
• zerops_service
• zerops_service_env_vars
• zerops_service_types

Known limitations

• Managed types that offer both single-node and highly available modes (for example PostgreSQL, MariaDB, Valkey, ClickHouse, Elasticsearch, Kafka, NATS, Qdrant, SeaweedFS and Typesense) need an explicit mode in type, such as postgresql:single@16 or postgresql:ha@16. The shorthand postgresql@16 creates an HA service on Zerops, so the provider rejects it during planning (from v0.1.2), for zerops_service and for service entries in zerops_project_import YAML that lack a mode. The set of such families is read from the live catalog; if the catalog cannot be read, a built-in snapshot of the families above is used. Services created with the shorthand by earlier provider versions can switch type to the qualified value shown in their base attribute without replacement.
• PostgreSQL defaults to a 2 GB disk floor, enforced during planning because the platform currently fails to provision PostgreSQL below it (generic HTTP 500 error). Configure the floor with postgresql_min_disk_gb / ZEROPS_POSTGRESQL_MIN_DISK_GB when the catalog changes. In the same way, ClickHouse RAM defaults to and must be at least 0.375 GB (ZEROPS_CLICKHOUSE_MIN_RAM_GB), because smaller sizes fail server validation, and Elasticsearch RAM defaults to and must be at least 2 GB (ZEROPS_ELASTICSEARCH_MIN_RAM_GB), because smaller sizes fail with HTTP 500. These floors apply to both modes and are checked against both min_ram_gb and max_ram_gb.
• Project credit limits cannot be read back reliably; changing or removing a configured limit can prevent later project updates.
• Avoid reserved service hostnames such as core and l7httpbalancer; they may interfere with project operation and deletion.
• The API's server-side Git builds may ignore tag or commit references and reject private repositories. Consult the deployment resource documentation for provider-side Git deployment options.
• API failures can leave partially created resources that require manual cleanup in the Zerops dashboard.

Embedding the provider

Go applications, such as a Pulumi bridge, can use the public provider package to construct the fully registered Terraform Plugin Framework provider:

import "github.com/zeropsio/terraform-provider-zerops/provider"

p := provider.New("0.1.1", provider.WithUserAgent("pulumi-zerops/0.1.0"))

WithUserAgent is optional. It identifies the embedding product in API requests as pulumi-zerops/0.1.0 terraform-provider-zerops/0.1.1; without it the provider retains its Terraform CLI User-Agent. The product must be nonempty and contain no whitespace or control characters.

Development

make build
make test
make docs-check
make lint

See CONTRIBUTING.md for prerequisites, documentation generation, and guarded acceptance tests.

License

MIT. Copyright (c) 2026 Zerops s.r.o.