Deploy GPG Keypairs with Terraform

Manage GPG keypairs on Bahriya with Terraform: store ASCII-armoured public and private keys, attach them to projects and mount them on containers.

Updated 31 Oct 20262 min read

A GPG keypair stores an ASCII-armoured public key and private key pair. GPG keypairs are scoped to your organisation, versioned with rotation history, and can be attached to projects and containers.

Required fields

Field	Type	Description
`handle`	string	A unique identifier (DNS-1123 compliant: lowercase, alphanumeric, hyphens).
`name`	string	A display name.
`publickey`	string	ASCII-armoured GPG public key.
`privatekey`	string	ASCII-armoured GPG private key.

Read-only fields

Field	Type	Description
`keyid`	string	The PGP key ID.
`algorithm`	string	Key algorithm (RSA, DSA, EdDSA, etc.).
`keybits`	integer	Key size in bits.
`uid`	string	The primary UID on the key.
`currentversion`	integer	The currently active version number.
`versioncount`	integer	How many versions are kept, the current one included.

Example

resource "bahriya_gpg_keypair" "signing_key" {
  handle     = "signing-key"
  name       = "Artifact Signing Key"
  publickey  = file("${path.module}/keys/signing.pub.asc")
  privatekey = file("${path.module}/keys/signing.sec.asc")
}

Attach it to a project so it deploys to the project's regions:

resource "bahriya_project" "production" {
  handle  = "production"
  name    = "Production"
  regions = ["helsinki-1", "falkenstein-1"]
}
 
resource "bahriya_project_gpg_keypair_attachment" "signing_key" {
  project_id = bahriya_project.production.id
  handle     = bahriya_gpg_keypair.signing_key.handle
}

Then mount it on a container — the public and private key blocks land as files in mountpath:

resource "bahriya_container" "signer" {
  # ... other fields ...
 
  gpgkeypairs = [
    {
      handle    = bahriya_gpg_keypair.signing_key.handle
      mountpath = "/etc/bahriya/gpg"
    },
  ]
}

To rotate key material, update the publickey and privatekey fields in your Terraform config and run terraform apply. The Bahriya API creates a new version and marks it current. Previous versions are retained for rollback (default: last 5).

After rotation, file-mounted containers pick up the new keys automatically within about 60 seconds. No manual redeploy is needed for file-mounted keys.

Importing an existing keypair

terraform import bahriya_gpg_keypair.signing_key <uuid>

Pricing

GPG keypairs are billed at $0.02 per month while they exist in your organisation, plus $0.02 per region per month when attached to a project.