Deploy on Hetzner Cloud

Hetzner Cloud sells simple virtual machines (“Cloud Servers”) in European and some other regions. This guide covers only the Hetzner-specific steps. Everything after you can log in to the VM is the same on every provider and lives in Deploy to a Linux VM: read it alongside this page.

Official documentation: https://docs.hetzner.com/cloud/. Check the provider’s current pricing, locations and limits before you choose; they change.

1. Create the server

In the Cloud Console:

1. Create a project, then Add Server.
2. Location: pick the one closest to your users.
3. Image: Debian or Ubuntu LTS.
4. Type: a small shared-CPU type with 2 GB of memory or more is comfortable for one small app. Both x86-64 and Arm (Ampere) types exist; an Arm type needs a linux/arm64 image (see step 4 of the shared guide).
5. SSH keys: add your public key (~/.ssh/id_ed25519.pub). Do not choose a password login.
6. Firewalls: attach the firewall you create in the next section.
7. Backups are an optional paid add-on for the whole server; they do not replace database backups.

Note the server’s public IPv4 address (and IPv6, if you want it).

2. Firewall: 22, 80 and 443 only

Under Firewalls, create one with these inbound rules and apply it to the server:

Hetzner firewalls are stateful, so replies are allowed automatically. Port 80 must stay open: Caddy uses it to obtain and renew certificates. Add UDP 443 as well if you want HTTP/3; without it browsers use HTTPS over TCP.

3. DNS

Create an A record for your domain with the server’s IPv4 address (and an AAAA record for IPv6). You can use Hetzner DNS or any other DNS provider. Check with dig +short your-domain.example.

4. Log in and continue

ssh root@<ip-address>

Create a normal user with sudo rights and use it from now on (root login is convenient but risky):

adduser deploy && usermod -aG sudo deploy
mkdir -p /home/deploy/.ssh && cp ~/.ssh/authorized_keys /home/deploy/.ssh/ \
  && chown -R deploy:deploy /home/deploy/.ssh

Then follow Deploy to a Linux VM from step 3: install Docker or Podman, copy or build the app, set the production settings, start it with compose up, and set up backups, updates and rollback.

Hetzner notes

• Logs stay on the server (see Logs); the Cloud Console does not collect them.
• Snapshots of the server are available in the Console and are useful before a risky change. They are not a database backup.
• The Cloud Console’s Rescue system and console access help if you lock yourself out of SSH.