Skip to content
Sencai.docs

Operating a Hetzner footprint

Your servers run on Hetzner Cloud, and you are tired of one browser tab for the provider console, another for whatever tracks your inventory, and a third for whoever owns DNS. This is the scenario Sencai covers most completely, because Hetzner Cloud is the one provider where the Live cloud screens write to your actual account instead of only recording a row in Sencai.

That distinction is the whole reason this page exists. Most of Sencai reads your infrastructure or keeps a record of it. Live cloud → Networks, Live cloud → Firewalls, and Live cloud → DNS genuinely create, change, and delete things at the provider. On Hetzner Cloud that gives you a real single pane: connect a project token, adopt what already runs, then operate networking, firewalls, and DNS without leaving the app.

What Sencai does not do is replace the Hetzner console entirely. Some operations are absent (you cannot resize a Hetzner instance through Sencai), some provider concepts are only partly represented, and the similarly-named Networking & Edge screens do not touch your account at all. Read the order below before you start, and read What will surprise you before you delete anything.

What this looks like in Sencai

Section titled “What this looks like in Sencai”

1. Connect one token per Hetzner project

Section titled “1. Connect one token per Hetzner project”

Start at Connect a cloud provider. Hetzner’s form is a single API Token field - no region, no second credential. Save it, then click Validate on the row, because saving does not check the token. Adding and validating credentials needs the Admin or Owner role.

Hetzner tokens are scoped to one project, so connect one credential per project you want Sencai to see. Permissions your credentials need covers the choice that actually matters here: Hetzner offers Read or Read & Write and nothing in between. Start with Read if you only want to look.

2. Adopt what is already running

Section titled “2. Adopt what is already running”

You do not have to recreate anything. From the credential’s row, Run scan - a read-only sweep that never changes your account - and review the results in Compliance & Audit → Inventory (/gravity/inventory). On Hetzner a scan finds servers, volumes, networks, load balancers, and floating IPs.

Import existing infrastructure explains the two steps that follow: adopt a resource so Sencai tracks it, then promote a server, network, or disk into a fully managed record if you want to operate it. Only the adopt step touches your account, and only to add Sencai’s tracking tags - which a Read token cannot do.

3. Private networking

Section titled “3. Private networking”

Live cloud → Networks (/gravity/live-cloud/networks) is the real thing: creating a network here creates it at Hetzner, and deleting one destroys it. Networks & connectivity walks the screen.

The part that catches people out is that editing a network’s name only edits its name. Subnets, routes, and the network’s IP range each have their own action, and changing the IP range asks you to type the network’s name first - because attached servers can briefly lose connectivity, or the provider can refuse the change outright.

4. Firewalls

Section titled “4. Firewalls”

Live cloud → Firewalls (/gravity/live-cloud/firewalls) creates, edits, attaches, and deletes real Hetzner firewalls. See Firewalls & security groups for rule fields and a sensible starting rule set.

Two practical notes. You attach firewalls by the server’s native ID at the provider - for Hetzner, a number - not by Sencai’s own instance ID. And an attachment applies the moment you confirm: non-matching traffic is dropped immediately, with no further confirmation, so check your own source range before you restrict SSH on a host you depend on.

5. DNS

Section titled “5. DNS”

Live cloud → DNS (/gravity/live-cloud/dns) manages zones and records on Hetzner Cloud with the same token as everything else - there is no separate DNS credential. DNS has the details.

Records load lazily when you expand a zone. Each row is a set of values sharing a name and type, not a single value, so editing or deleting a row acts on every value in that set. You cannot rename a record or change its type after creating it; delete and recreate instead.

6. Day-to-day servers

Section titled “6. Day-to-day servers”

Provision & manage instances covers the rest: the provisioning wizard, instance states, tagging for cost allocation, and the browser terminal. Every provisioning and lifecycle action is written to your organization’s audit log with the user who triggered it.

What will surprise you

Section titled “What will surprise you”

Networks are Hetzner Cloud only; firewalls also cover AWS. Live cloud → Networks and Live cloud → Firewalls have nothing to show for any other connected provider, even one that provisions instances perfectly well. If your footprint is split across providers, this use case only covers the Hetzner part of it - do not plan on driving an AWS VPC or security group from these screens.

DNS makes a weaker claim than the other two. Hetzner Cloud is confirmed working for creating, reading, updating, and deleting zones and records. Other providers are unconfirmed rather than known-absent - which is not a reason to try it on production. Use that provider’s own console until the DNS page says otherwise.

A firewall’s “attached to” count can under-report. Sencai lists servers a firewall is attached to directly. Attachments made by label do not show up in that count, so an empty count is not proof that a firewall protects nothing. Check the Hetzner console before deleting one you are unsure about.

Hetzner has no middle permission setting. Read & Write is full control of the project, including deletion, and there is no “create but never delete” token. If you want Sencai to manage DNS but never touch servers, the only real isolation is a separate Hetzner project with its own token.

Resize is not available for Hetzner instances. Hetzner instance types are fixed at creation, so Sencai offers stop, start, and terminate but not a type change. Restart and retry-after-failure are not available on any provider yet.

A promoted server does not get the browser terminal automatically. That setup runs on an instance’s first boot, which already happened before Sencai knew about a server you imported. Finish it manually the first time - the app links you to the steps once you promote a host.

What’s next

Section titled “What’s next”