add Hetzner DNS <-> hcloud pairing - #3
Open
aforemny wants to merge 2 commits into
Open
Conversation
Declaratively manage Hetzner DNS zones, RRSets, and individual records via OpenTofu and the official hetznercloud/hcloud provider. Unlike the local-service pairings this targets a remote cloud API: there is no upstream service to enable, tokenFile is required, tfstate lives under a dedicated declarative-hetzner-dns system user, and the reconciler only waits for the network. Checks are implemented using a local double of the Hetzner Cloud DNS API (services/hetzner-dns/emulator.py).
kmein
reviewed
Aug 11, 2026
| @@ -0,0 +1,299 @@ | |||
| #!/usr/bin/env python3 | |||
Collaborator
There was a problem hiding this comment.
I would like to know where the interface implemented here comes from. Is there an OpenAPI spec somewhere? I think a more clean (maybe even automated?) mocking should be possible.
| }; | ||
| serviceConfig = { | ||
| ExecStart = "${pkgs.python3}/bin/python3 ${./emulator.py}"; | ||
| # TODO |
Collaborator
There was a problem hiding this comment.
Which TODO item is meant here?
| environment.systemPackages = [ pkgs.curl ]; | ||
| environment.etc."hcloud-dns-token".text = apiToken; | ||
| environment.etc."hcloud-tsig-key".text = tsigSecret; | ||
| systemd.services.hetzner-dns-emulator = { |
Collaborator
There was a problem hiding this comment.
Would it be possible to have the "Hetzner API" running on another VM?
| tf = tflib.hetznerDnsTfConfig cfg; | ||
| in | ||
| { | ||
| options.services.hetzner-dns.runtime = { |
Collaborator
There was a problem hiding this comment.
Just a thought: Technically is does not make sense to call this runtime since there is no Hetzner runtime configuration on the server. The design decision is up to you. I have so far enjoyed the uniformity of the module interface here.
| nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; | ||
|
|
||
| # This repository. | ||
| declarative-runtime.url = "github:youruser/declarative-runtime"; |
Collaborator
There was a problem hiding this comment.
Suggested change
| declarative-runtime.url = "github:youruser/declarative-runtime"; | |
| declarative-runtime.url = "github:applicative-systems/declarative-runtime"; |
| Create a Hetzner Cloud API token with DNS permissions ("Security > API tokens" | ||
| in the Hetzner Cloud console) and place it on the target host — e.g. via | ||
| sops-nix or agenix. Point `tokenFile` at that host path. `tokenFile` is | ||
| required: a cloud API token cannot be self-bootstrapped. |
Collaborator
There was a problem hiding this comment.
Suggested change
| required: a cloud API token cannot be self-bootstrapped. | |
| required. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Declaratively manage Hetzner DNS zones, RRSets, and individual records
via OpenTofu and the official hetznercloud/hcloud provider.
Unlike the local-service pairings this targets a remote cloud API: there
is no upstream service to enable, tokenFile is required, tfstate lives
under a dedicated declarative-hetzner-dns system user, and the
reconciler only waits for the network.
Checks are implemented using a local double of the Hetzner Cloud DNS API
(services/hetzner-dns/emulator.py).