Hetzner

Authentication

Hetzner uses an API token from the Hetzner Cloud Console. Create a project, then generate an API token under Security > API Tokens with read/write permissions.

Field	Required	Description
api_token	Yes	API token from Hetzner Cloud Console

Configuration

providers:
  hetzner:
    api_token: "${HETZNER_TOKEN}"
    region: nbg1
    image: ubuntu-22.04
    size: cpx11

defaults:
  provider: hetzner

Regions

Hetzner uses location codes:

Slug	Location
nbg1	Nuremberg, Germany
fsn1	Falkenstein, Germany
hel1	Helsinki, Finland
ash	Ashburn, USA
hil	Hillsboro, USA
sin	Singapore

Run managed providers regions hetzner to list all available locations.

Sizes

Hetzner server types use short prefixes. Shared vCPU plans:

Slug	Specs
cpx11	2 vCPU (AMD), 2 GB RAM, 40 GB disk
cpx21	3 vCPU (AMD), 4 GB RAM, 80 GB disk
cpx31	4 vCPU (AMD), 8 GB RAM, 160 GB disk
cx22	2 vCPU (Intel), 4 GB RAM, 40 GB disk
cx32	4 vCPU (Intel), 8 GB RAM, 80 GB disk

Run managed providers sizes hetzner --region nbg1 to list all available types in a location.

Images

Hetzner image slugs differ from DigitalOcean, use dots instead of dashes:

Slug	OS
ubuntu-22.04	Ubuntu 22.04 LTS
ubuntu-24.04	Ubuntu 24.04 LTS
debian-12	Debian 12

Auto storage

Hetzner does not support auto-provisioned storage. Configure S3-compatible storage manually in managed.yaml if your services need backup storage:

storage:
  endpoint: "s3.us-east-1.amazonaws.com"
  region: "us-east-1"
  bucket: "my-backups"
  access_key: "${S3_ACCESS_KEY}"
  secret_key: "${S3_SECRET_KEY}"

Networking

Hetzner private networking requires setting up a Hetzner Network (VPC) manually. Servers in the same network get private IPs. Without a network configured, managed uses public IPs for inter-server communication.