@openstrap/hetzner

Hetzner Cloud provider plugin for OpenStrap. Makes a server in a Hetzner project and reaches it at its own public address.

The plugin takes no options. Which project a machine lives in and where it goes are facts about the machine, so its blueprint says them:

targets:
  server:
    provider: hetzner
    image: ubuntu-24.04
    architecture: amd64        # absent: the architecture of the computer openstrap runs on
    size: medium               # or machineType: cx33, exactly that server type
    location: fsn1             # absent: Hetzner chooses
    credentials:
      secret: hetzner.project  # the name of a secret openstrap holds: a Hetzner API token

// openstrap.config.mjs
import hetzner from "@openstrap/hetzner";
export default { plugins: [hetzner(), /* ssh, keychain, … */] };

What a machine is here

| openstrap | Hetzner | |---|---| | the machine | a server named after the target, labelled openstrap=machine | | image: | a system image of that name and architecture; its id is the pin | | size: | the cheapest current server type with at least that many cores, memory and disk, offered in location | | machineType: | exactly that server type (cx33), refused where Hetzner has none by that name, it is built for another architecture, or it is not offered in location | | the managed user and key | cloud-init user data; the same key is a Hetzner SSH key openstrap-<name>, so Hetzner mails no root password, and cloud-init then closes root | | publish: and public services | firewall openstrap-<name>: port 22 and the published ports, inbound TCP from anywhere | | the machine's public addresses | the Primary IPs Hetzner makes with the server, set to auto_delete and labelled, so none stays billed | | destroy | the server, then everything labelled openstrap-machine=<name>: addresses, firewall, key |

Every resource made for a machine carries openstrap=machine and openstrap-machine=<name>. That label is what is deleted with the machine and what remains(name) asks Hetzner about.

create is all or nothing. Where any step fails — the key, the firewall, the server, its addresses — everything labelled with the machine's name and every address Hetzner made with the server is deleted before the failure is reported. If that cleanup fails too, the error says so and names the label to look for.

A server of the same name that openstrap did not make is taken over by find, as a hypervisor's machine of that name would be. Its firewall, key and addresses, if they are not labelled for this machine, are never changed or deleted.

The token is read by openstrap from its secret store and handed to the plugin for the calls about one machine. It is sent in the Authorization header and appears in no URL and no error.

Status

Unit tests run the provider against an in-memory project answering as the API reference says (npm test). Not yet run against a live project:

HCLOUD_TOKEN=… npm run test:live

which makes the cheapest fitting x86 server, waits for sshd and deletes it. It then asks Hetzner for everything labelled with the test machine's name: it passes only when the answer is empty, and otherwise deletes what is there and fails, naming each resource. Billed as one started hour of that server and of its IPv4 address.