Hetzner Agent Skill

Hetzner — the cheap European box, made safe and reproducible

Hetzner Cloud is chosen for one reason: price/performance. A 2 vCPU / 4 GB AMD

box runs about €7.99/mo, the EU Intel line dips under €4, and EU locations

include 20 TB of egress. The risk is that "cheap" becomes "unhardened and

unmonitored" — a root-SSH box on a public IPv4 with password auth on. Your job

is to make the cheap box safe and reproducible: every server comes up

from a committed cloud-init file and a Cloud Firewall ruleset, never from

click-ops in the console. A box you can't recreate from a file isn't a box, it's

a pet.

Decide before you create

Pick the line, then the location. Prices are post-2026-04-01 (a price adjustment

took effect that date); treat exact cents as "verify in the console."

| Line | Chip | When to pick | Price band | EU-only? |

|---|---|---|---|---|

| CX | Intel (shared) | Cost-optimized, tiny EU workloads | ~€3.99/mo (2 vCPU/4 GB/40 GB) | Yes |

| CPX | AMD (shared) | Default for apps; best general value | CPX22 ~€7.99, CPX32 ~€13.99, CPX42 ~€25.49 | No |

| CAX | ARM64 (shared) | Cheapest per-core; ARM-clean workloads | Cheapest per-core | Yes |

| CCX | Dedicated vCPU | Steady CPU load, no noisy-neighbor | CCX13 ~€15.99 (2 vCPU/8 GB) | No |

Rules:

• IPv4 costs extra (~€0.50–0.60/mo); IPv6 is free. An IPv6-only box is

cheaper, but it breaks anything that can't reach IPv6: many container

registries, some package mirrors, CI runners, SSH clients on IPv4-only nets.

If docker pull or apt will run on the box, keep one IPv4 unless you've

confirmed every upstream is dual-stack. Why: a saved €0.50/mo is not worth a

broken docker pull at 2 a.m.

• Location decides your traffic budget. EU locations (Nuremberg, Falkenstein,

Helsinki) include 20 TB/mo egress; overage ~€1/TB. US (Ashburn, Hillsboro)

and Singapore have far lower included transfer. Why: pick US "for latency,"

serve a video, and the surprise bill is the traffic cap, not the instance.

• No APAC own datacenter. If your users are in Asia, this is a real latency

cost — name it, don't hide it.

Full dated matrix, latency notes, and the no-SLA / no-managed-DB reality:

references/plans-and-locations.md.

Provision reproducibly

Install the official CLI (latest v1.65.0, released 2026-05-21) and create a

context (the token comes from the project's *Security → API tokens*, Read &

Write):

brew install hcloud            # or: see github.com/hetznercloud/cli releases
hcloud context create my-project   # paste the Read+Write API token when prompted
hcloud server-type list        # confirm names/prices before you create

Bring the box up with cloud-init so hardening happens before first login:

hcloud server create \
  --name app-01 \
  --type cpx22 \
  --location fsn1 \
  --image debian-12 \
  --ssh-key my-laptop \
  --firewall app-edge \
  --user-data-from-file cloud-init.yaml

Use --location, not --datacenter: the datacenter attribute is **deprecated

and removed after 2026-07-01** for Servers and Primary IPs. Trimmed cloud-init

skeleton (full annotated file in references/cloud-init.md):

#cloud-config
users:
  - name: deploy
    groups: [sudo]
    shell: /bin/bash
    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
    ssh_authorized_keys:
      - ssh-ed25519 AAAA... you@laptop   # your real public key, not a placeholder
disable_root: true                       # no root login at all
ssh_pwauth: false                        # no password auth, anywhere
package_update: true
packages: [ufw, fail2ban, unattended-upgrades]
runcmd:
  - sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
  - sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
  - ufw default deny incoming && ufw allow 22 && ufw allow 80 && ufw allow 443 && ufw --force enable
  - systemctl enable --now fail2ban
  - systemctl restart ssh

Rule: never create a box with a bare root password and "I'll harden it later."

Later is a window where the box is reachable as root with password auth on, and

Hetzner IPv4 space is scanned constantly. Bake it into boot.

Two firewalls, in order

The Cloud Firewall runs at the network edge — stateful, applied before the

packet reaches the VM, and survives a misconfigured host. Create and apply it

with or before the server:

hcloud firewall create --name app-edge
hcloud firewall add-rule app-edge --direction in --protocol tcp --port 22  --source-ips 0.0.0.0/0 --source-ips ::/0
hcloud firewall add-rule app-edge --direction in --protocol tcp --port 80  --source-ips 0.0.0.0/0 --source-ips ::/0
hcloud firewall add-rule app-edge --direction in --protocol tcp --port 443 --source-ips 0.0.0.0/0 --source-ips ::/0
hcloud firewall apply-to-resource app-edge --type server --server app-01

Inbound is default-deny — you only describe what you *allow*. Then the host

ufw (set up in cloud-init above) is defense-in-depth: if you ever detach or

fat-finger the Cloud Firewall, the box still isn't wide open. Why both: the edge

firewall is your primary defense, but a single layer is a single point of

failure, and the two are configured through different surfaces (API vs host).

Tighten SSH to your own IP/range once you know it:

hcloud firewall delete-rule app-edge --direction in --protocol tcp --port 22 --source-ips 0.0.0.0/0 --source-ips ::/0
hcloud firewall add-rule    app-edge --direction in --protocol tcp --port 22 --source-ips 203.0.113.4/32

SSH hardening rules

• Key-only auth. PasswordAuthentication no, PubkeyAuthentication yes. A

password is brute-forceable; an ed25519 key is not.

• No root login. PermitRootLogin no + a sudo user. Root over SSH is the

single most-targeted login on the internet.

• fail2ban on. Bans IPs after repeated failures — cheap insurance for the

one port you must expose.

• Moving port 22 is obscurity, not security. It quiets log noise; it does not

harden anything. Do it if you like clean logs, but never *instead* of key-only

+ a firewall.

Hand off to Docker / Coolify

"Host ready" means all of the following are true:

• [ ] ssh root@<ip> is refused; ssh deploy@<ip> works with the key only.
• [ ] sshd -T | grep -E 'permitrootlogin|passwordauthentication' shows both no.
• [ ] Cloud Firewall attached; only 22 (scoped)/80/443 inbound.
• [ ] ufw status enabled with the same allowlist.
• [ ] unattended-upgrades and fail2ban running.

This skill stops at a clean, hardened host. Then route the install/deploy:

coolify for the Coolify install + app deploy flow,

docker for Dockerfiles, compose, and image hardening.

Day-2

• Snapshot ≠ backup. A snapshot is a one-off manual image you can boot from;

the Backups add-on is automated, rotating, ~20% of the server price. A

snapshot you took once in March is not a backup strategy — for that, see

backups.

• Resize grows, never shrinks. You can scale the disk up; you cannot scale it

back down. Size conservatively or you're stuck paying for it.

• Volumes for data you want to outlive/detach from the server. Keep databases

and uploads on a volume so a server rebuild doesn't take the data with it.

• Reverse DNS must match for outbound mail to be accepted — set the PTR in the

console/hcloud if the box sends email. Forward DNS records belong to

domains-dns.

• No SLA, no managed DB. There's no uptime guarantee, no managed-database

product, and phone support only for dedicated-server customers — you run

Postgres yourself, you monitor it yourself. For monitoring and alerting, see

monitoring; treat the box as something you must

watch, not something Hetzner watches for you. Name the trade-off to the user;

don't pretend it's AWS.

Anti-patterns

| Anti-pattern | Why it's wrong | Do instead |

|---|---|---|

| Root SSH + password auth left on | The most-scanned login on the public internet; bots find it in minutes | PermitRootLogin no, PasswordAuthentication no, key + sudo user |

| Only host ufw, no Cloud Firewall | A host misconfig or reset exposes everything; no edge layer | Cloud Firewall default-deny first, ufw as defense-in-depth |

| --source-ips 0.0.0.0/0 on everything "temporarily" | Temporary rules become permanent; the whole box is exposed | Scope inbound to 80/443 public, SSH to your IP/range |

| Click-ops in the console | Not reproducible — you can't recreate or review the box | cloud-init file + hcloud commands committed to the repo |

| Snapshot treated as backup | One stale manual image, no rotation, no schedule | Enable the Backups add-on or push to off-box storage |

| US location, then surprised by the bill | US/Singapore include far less than EU's 20 TB egress | EU location for egress-heavy apps; check the traffic cap first |

| IPv6-only to save €0.50 | Registry/CI/mirror pulls over IPv4-only break | Keep one IPv4 unless every upstream is confirmed dual-stack |

| Using --datacenter | Deprecated, removed after 2026-07-01 | Use --location |

Verify

ssh -o BatchMode=yes root@<ip>                 # expect: refused / permission denied
ssh deploy@<ip> 'sshd -T | grep -E "permitrootlogin|passwordauthentication"'
# expect: permitrootlogin no / passwordauthentication no
hcloud firewall describe app-edge              # expect: only 22 (scoped)/80/443 inbound
ssh deploy@<ip> 'ss -tlnp'                      # expect: only expected listeners

To lint a cloud-init / hardening file before you ever create the box, run

scripts/verify.sh path/to/cloud-init.yaml — it statically checks for the

must-haves (no root login, no password auth, an SSH key, a firewall step,

fail2ban) with no network calls.