How to generate ssh keypairs in template.toml

[eyueldk]

I have a docker compose that needs SSH keys (generated via ssh-keygen), but I don't know how to generate it using template.toml. If there was a way to run a setup script before template.toml or inject bash commands/script, that would be wonderful.

Any ideas how to do this? My stack is almost ready, but I can't deploy it without ssh-keygen utility generating keypairs.

[dosubot[bot]]

Unfortunately, Dokploy's template.toml system does not support SSH key generation or running arbitrary shell commands. The template system is purely declarative—it only supports built-in helper functions like ${password:length}, ${base64:length}, ${hash:length}, ${uuid}, ${jwt:...}, etc. [1]. There is no ${sshKey} helper or script execution mechanism.

Workarounds you can use:

1. Generate keys at container startup — Add an entrypoint script in your Docker Compose that runs ssh-keygen on first boot if the keys don't already exist. For example:

   entrypoint: /bin/sh -c "test -f /keys/id_rsa || ssh-keygen -t rsa -b 4096 -f /keys/id_rsa -N '' && exec your-app"

2. Use file mounts for pre-generated keys — If you can generate the keys ahead of time, inject them via [[config.mounts]] in your template.toml [2]:

   [[config.mounts]]
   filePath = "/path/to/key"
   content = """your-key-content"""

   However, this obviously isn't dynamic and requires hardcoding key material, so option 1 is generally better.

3. Init container pattern — Add a lightweight init service in your docker-compose that generates the SSH keys into a shared volume, then your main service can use them:

   services:
     keygen:
       image: alpine
       command: sh -c "ssh-keygen -t ed25519 -f /keys/id_ed25519 -N '' && cat /keys/id_ed25519.pub > /keys/authorized_keys"
       volumes:
         - ssh-keys:/keys
     your-app:
       depends_on:
         keygen:
           condition: service_completed_successfully
       volumes:
         - ssh-keys:/keys
   volumes:
     ssh-keys:

Future outlook: A maintainer has mentioned that pre/post-deploy hook scripts are planned for a future version [3], which would solve this more elegantly. For now, the entrypoint or init container approach is your best bet.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.