danjdewhurst Hetzner Cloud Security
SSH Keys
Create an SSH Key
hcloud ssh-key create [options] --name <name> (--public-key <key> | --public-key-from-file <file>)
| Flag | Description |
|---|---|
--name |
Key name (required) |
--public-key |
Public key string |
--public-key-from-file |
Path to file containing the public key |
--label |
User-defined labels as key=value (repeatable) |
-o, --output |
Output options: json|yaml |
List SSH Keys
hcloud ssh-key list [options]
Columns: id, name, fingerprint, public_key, age, created, labels
| Flag | Description |
|---|---|
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe an SSH Key
hcloud ssh-key describe [options] <ssh-key>
| Flag | Description |
|---|---|
-o, --output |
Output options: json|yaml|format |
Delete SSH Keys
hcloud ssh-key delete <ssh-key>...
Accepts one or more SSH keys by name or ID.
Update an SSH Key
hcloud ssh-key update [options] <ssh-key>
| Flag | Description |
|---|---|
--name |
New SSH key name |
Labels
hcloud ssh-key add-label [--overwrite] <ssh-key> <label>...
hcloud ssh-key remove-label <ssh-key> (--all | <label>...)
Certificates
Create a Certificate (Uploaded)
hcloud certificate create --name <name> --type uploaded --cert-file <file> --key-file <file>
| Flag | Description |
|---|---|
--name |
Certificate name (required) |
-t, --type |
Certificate type: uploaded or managed (default: uploaded) |
--cert-file |
File containing the PEM encoded certificate (required for uploaded) |
--key-file |
File containing the PEM encoded private key (required for uploaded) |
--label |
User-defined labels as key=value (repeatable) |
-o, --output |
Output options: json|yaml |
Create a Certificate (Managed)
hcloud certificate create --name <name> --type managed --domain <domain>
| Flag | Description |
|---|---|
--name |
Certificate name (required) |
-t, --type |
Must be managed |
--domain |
Domain the certificate is valid for (repeatable for multiple domains) |
--label |
User-defined labels as key=value (repeatable) |
-o, --output |
Output options: json|yaml |
Retry Managed Certificate Issuance
hcloud certificate retry <certificate>
Retries issuance of a managed certificate that failed.
List Certificates
hcloud certificate list [options]
Columns: id, name, type, domain_names, not_valid_after, not_valid_before, fingerprint, issuance_status, renewal_status, age, created, labels
| Flag | Description |
|---|---|
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Certificate
hcloud certificate describe [options] <certificate>
| Flag | Description |
|---|---|
-o, --output |
Output options: json|yaml|format |
Delete Certificates
hcloud certificate delete <certificate>...
Accepts one or more certificates by name or ID.
Update a Certificate
hcloud certificate update [options] <certificate>
| Flag | Description |
|---|---|
--name |
New certificate name |
Labels
hcloud certificate add-label [--overwrite] <certificate> <label>...
hcloud certificate remove-label <certificate> (--all | <label>...)
Cross-Resource Protection
Protection prevents accidental deletion (and rebuild for servers). Enable or disable protection per resource type:
Server Protection
hcloud server enable-protection <server> (delete|rebuild)...
hcloud server disable-protection <server> (delete|rebuild)...
Servers support two protection types: delete and rebuild. Specify one or both.
Other Resource Protection
Networks, volumes, floating IPs, primary IPs, load balancers, and images support delete protection:
hcloud network enable-protection <network> delete
hcloud network disable-protection <network> delete
hcloud volume enable-protection <volume> delete
hcloud volume disable-protection <volume> delete
hcloud floating-ip enable-protection <floating-ip> delete
hcloud floating-ip disable-protection <floating-ip> delete
hcloud primary-ip enable-protection <primary-ip> delete
hcloud primary-ip disable-protection <primary-ip> delete
hcloud load-balancer enable-protection <load-balancer> delete
hcloud load-balancer disable-protection <load-balancer> delete
hcloud image enable-protection <image> delete
hcloud image disable-protection <image> delete
Cross-Resource Reverse DNS
Set reverse DNS (PTR) records on resources with public IP addresses. Use --ip to target a specific address when the resource has multiple IPs.
Server
hcloud server set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <server>
Floating IP
hcloud floating-ip set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <floating-ip>
Primary IP
hcloud primary-ip set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <primary-ip>
Load Balancer
hcloud load-balancer set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <load-balancer>
Reverse DNS Flags
| Flag | Description |
|---|---|
-i, --ip |
IP address for which the reverse DNS entry should be set |
-r, --hostname |
Hostname to set as a reverse DNS PTR entry |
--reset |
Reset the reverse DNS entry to the default value |
Cross-Resource Labels
All managed resources support labels for organisation and filtering.
Add Labels
hcloud <resource> add-label [--overwrite] <id-or-name> <label>...
Labels use key=value format. Use --overwrite (-o) to replace an existing label key.
Supported resources: server, network, volume, floating-ip, primary-ip, load-balancer, firewall, image, ssh-key, certificate, placement-group
Remove Labels
hcloud <resource> remove-label <id-or-name> (--all | <label>...)
| Flag | Description |
|---|---|
-a, --all |
Remove all labels from the resource |
Filtering by Labels
Use label selectors on any list command to filter results:
hcloud server list -l env=production
hcloud server list -l 'env=production,team=backend'
hcloud server list -l 'env!=staging'
hcloud network list -l project=myapp
Labels for Firewall Targeting
Firewalls can target servers by label selector instead of individual server IDs:
hcloud firewall apply-to-resource --type label_selector --label-selector 'env=production' <firewall>
hcloud firewall remove-from-resource --type label_selector --label-selector 'env=production' <firewall>