Hetzner → HTTPS in ~90 seconds

Empty Hetzner project → live HTTPS endpoint in ~90 seconds, end-to-end. The cheapest x86 EU tier (cx23 — €3.99/mo, 2 vCPU / 4 GB / 40 GB), a fresh AGE-sealed deploy key, a real Let's Encrypt cert against <ip>.nip.io. No domain to register, no DNS records to wire up, no plaintext key material on disk.

# one-time
brew install hcloud oddur/yoink/yoink   # yoink ≥ 0.15.0

# init: AGE identity + sealed deploy key + skeleton yoink.yaml
yoink init --create-ssh-key DEPLOY_SSH_KEY --proxy-email [email protected]

# provision a cx23 in nbg1, baked with cloud-init
hcloud context create bt-scratch
hcloud ssh-key create --name yoink-scratch \
  --public-key-from-file <(yoink secrets ssh-key public --name DEPLOY_SSH_KEY)
hcloud server create --name bt-scratch-01 --type cx23 \
  --image ubuntu-24.04 --location nbg1 \
  --ssh-key yoink-scratch \
  --user-data-from-file cloud-init.yaml

# register host with yoink + deploy
IP=$(hcloud server ip bt-scratch-01)
yoink hosts add --address $IP --user root --ssh-key-secret DEPLOY_SSH_KEY
HOST_IP=$IP yoink preflight --wait 90s
HOST_IP=$IP yoink up

# verify
curl https://$IP.nip.io   # → yoink!

Architecture

Prerequisites

brew install hcloud
brew install oddur/yoink/yoink                               # ≥ 0.15.0

A Hetzner Cloud account and an API token with read+write scope. New to Hetzner? Sign up at accounts.hetzner.com/signUp, create a project at console.hetzner.cloud, then generate the token under Security → API Tokens — paste it at the hcloud context create prompt below.

The two files you'll write by hand

The recipe-specific YAML (the placeholder service + the cloud-init payload) lives in your repo. Drop both into a fresh directory:

# services/yoink-hello.yaml — placeholder behind the proxy
services:
  - name: yoink-hello
    image: nginx
    tag: alpine
    networks: [yoink]
    domain:
      - ${HOST_IP:-placeholder}.nip.io
    run:
      port: 80
      replicas: 1
      cmd:
        - sh
        - -c
        - "echo 'yoink!' > /usr/share/nginx/html/index.html && exec nginx -g 'daemon off;'"
      healthcheck_path: /
      healthcheck_timeout: 30s
      options:
        # Loosened for nginx-as-root; see RunOptions reference for prod-shape defaults.
        user: "0:0"
        cap_drop: []
        tmpfs:
          /usr/share/nginx/html: "size=1m,mode=0755"
          /var/cache/nginx: "size=4m,mode=0755"
          /var/run: "size=1m,mode=0755"

# cloud-init.yaml — host-bootstrap, runs once on first boot
#cloud-config
package_update: true
packages: [ca-certificates, curl]
runcmd:
  - curl -fsSL https://get.docker.com | sh
  - systemctl enable --now docker
  # Pre-pull yoink's healthcheck-probe images so the first deploy doesn't race.
  - docker pull curlimages/curl:8.10.1
  - docker pull busybox:1.37

cloud-init.yaml is provider-flavored (Hetzner / EC2 / Linode all consume this format slightly differently). It lives in your repo, not in yoink. The service fragment uses ${VAR:-default} env-var substitution so the file parses cleanly when no host is provisioned yet.

Walkthrough

yoink init --create-ssh-key DEPLOY_SSH_KEY --proxy-email [email protected]

hcloud context create bt-scratch                     # paste API token at prompt
hcloud ssh-key create --name yoink-scratch \
  --public-key-from-file <(yoink secrets ssh-key public --name DEPLOY_SSH_KEY)
hcloud server create --name bt-scratch-01 --type cx23 \
  --image ubuntu-24.04 --location nbg1 \
  --ssh-key yoink-scratch \
  --user-data-from-file cloud-init.yaml

IP=$(hcloud server ip bt-scratch-01)
yoink hosts add --address $IP --user root --ssh-key-secret DEPLOY_SSH_KEY

HOST_IP=$IP yoink preflight --wait 90s   # waits for cloud-init to finish installing Docker
HOST_IP=$IP yoink up                      # ACME runs inline; ~5–15s for the cert

curl https://$IP.nip.io
# → yoink! [step]

echo | openssl s_client -connect $IP.nip.io:443 -servername $IP.nip.io 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates
# issuer=C=US, O=Let's Encrypt, CN=E8 [step]

Cleanup

hcloud server delete bt-scratch-01
yoink hosts remove $(echo $IP | tr ':.' '-')         # drop the fragment

Optional, only if this was a true one-off:

hcloud ssh-key delete yoink-scratch
rm secrets.age yoink.yaml

Hetzner billing is hourly capped at the monthly price; hcloud server list is worth bookmarking.

Troubleshooting

Next steps

• Bring your own app — drop the cmd: and the loose options: from services/yoink-hello.yaml; point image:/tag: at your image. The Caddy + ACME wiring stays the same.
• Build the image on your laptop instead of pulling from a registry. Add a build: block and run yoink up --build. See Deploy modes.
• Add a third-party service like postgres, redis, or restic backups via yoink add — one command renders a vetted service fragment alongside your config. The TanStack stack recipe walks the full pattern; the restic-backups recipe shows the secrets-and-schedule shape.
• Move from <ip>.nip.io to a real hostname — replace the domain: value, point an A record at $IP. Nothing else changes.
• Tighten TLS with Cloudflare Origin Certificates + origin-pull mTLS once you have a real domain.
• Scale to multiple hosts sharing one ACME state pool: Multi-host Let's Encrypt with Redis.

See also

• Reverse proxy guide — the bundled Caddy proxy and how to add HTTPS to any service.
• Sealed secrets workflow — managing the AGE identity and sealed SSH key this quickstart generates.
• Standalone (no-registry) deploys — how --build ships the image to the host without a registry.
• First deploy — the minimal version of this flow without the Hetzner provisioning steps.