Picking and standing up a Hetzner CX23

The box

I went with Hetzner’s CX23. It is the cost-optimised tier: shared Intel CPU, 4 GB RAM, and 40 GB of NVMe storage. It cost around €4.85 a month when I signed up, with no minimum term. That is enough machine for a personal agent whose main job is making API calls rather than running large local workloads.

I considered other providers. The decision became less interesting once I tried to buy the thing. Some offered a cheap first year, then roughly tripled the price at renewal. Others had kept their entry-level tiers out of stock for weeks. Hetzner showed me a price I could keep paying and had a server available when I clicked through.

There was no grand infrastructure thesis behind this. I picked Hetzner because the signup worked and the price was real.

The hcloud prerequisite

The next commands need Hetzner’s hcloud CLI installed and authenticated against a Cloud project. Get it from github.com/hetznercloud/cli. Use Homebrew on a Mac, snap on Linux, or download the binary release. I would use whichever method already fits the machine rather than add another package manager for one tool.

Create a project token in the Hetzner Cloud Console, then export it as HCLOUD_TOKEN. The context command stores the project connection under a name you can recognise later.

# After installing the hcloud CLI from https://github.com/hetznercloud/cli
export HCLOUD_TOKEN=*** paste-the-project-token-here ***
hcloud context create michael-personal

Standing up the box

There are two commands from here. First, register the laptop’s public SSH key with Hetzner. --name gives the registered key a label. --public-key-from-file is the flag that takes the path to the local .pub file.

hcloud ssh-key create \
  --name laptop-ed25519 \
  --public-key-from-file ~/.ssh/id_ed25519.pub

Then create the server. This names it hermes-01, selects the CX23 type and Ubuntu 24.04 image, and puts it in Hetzner’s nbg1 location. The last flag refers to the registered key by name.

hcloud server create \
  --name hermes-01 \
  --type cx23 \
  --image ubuntu-24.04 \
  --location nbg1 \
  --ssh-key laptop-ed25519

That last detail is a footgun. On hcloud server create, --ssh-key takes the ID or name of a key already registered with Hetzner. It does not take a file path. --public-key-from-file is the flag that accepts a .pub file path, and it belongs to hcloud ssh-key create.

The create command prints the new server details to stdout, including its public IPv4. Keep that output in view. That address is the PUBLIC_IP needed in the next article. It will look something like 78.46.123.45.

Where this leaves you

The box is up. Port 22 is reachable from anywhere on the internet, and you have the public IPv4 needed in a moment. The next article closes that exposure in a strict order: private network first, SSH configuration second, firewall last.

Next: Article 2: Locking down a personal-agent box.

More soon — Michael.

Michael Short is the founder of The Agent Files.