Hetzner Cloud

The edge site lives in Hetzner Cloud, region nbg1. It's a single-node Talos cluster — control-plane-1, a cx33 instance — fronted by a Hetzner-managed VPC, label-selected cloud firewalls, and a floating IP that survives instance replacement.

Driven by tofu/environment/edge via the hetznercloud/hcloud provider.

Why Hetzner

• Cheap, predictable pricing for a 24/7 edge node. A cx33 is a couple of euros a month and covers what the edge cluster needs.
• A real API with a first-class OpenTofu provider — VMs, networks, floating IPs, firewalls, and labels are all declarative.
• EU-resident for any data that hits the edge before it tunnels back home through NetBird.

Alternatives considered

Option	Why not
AWS / GCP / Azure	Overkill and overpriced for a single edge instance
DigitalOcean	Comparable, slightly more expensive; no obvious upside
OVH / Hetzner Robot dedicated	Too much hardware for the edge role

Layout

Resource	Value	Notes
Network	edge	172.30.0.0/16, delete-protected
Subnet	k8s	172.30.0.0/24, in eu-central
Instance	control-plane-1	cx33, Talos image
Floating IP	edge-1	Inbound traffic target — survives node replace

Cloud firewalls

Hetzner cloud firewalls are label-selected, so adding a node to the right firewall is a label edit, not a topology change.

Firewall	Targets (label)	Ingress	Sources
talos-control	talos_control=true	50000/tcp (apid), 6443/tcp (kube-api), 2379-2380/tcp (etcd)	172.30.0.0/24
talos-internal	talos=true	50001 (trustd), 51871/udp (Cilium WG), 4240/4244/4245/4250 (Cilium/Hubble), 9962-9964 (metrics), 10250 (kubelet)	172.30.0.0/24
allow-http	http=true	80, 443	0.0.0.0/0
allow-ssh	ssh=true	22	0.0.0.0/0

Talos itself doesn't run SSH. allow-ssh opens port 22 for Git over SSH: the edge Envoy Gateway listens there and forwards the stream to Gitea on the talos cluster, see PROXY protocol v2.

NetBird

• Network: edge → resource edge Management Subnet = 172.30.0.0/24
• Routing peer: control-plane-1 is in edge_peers (metric 9999, masquerade)
• Sidecars: edge_sidecar_envoy group has a cross-network policy to the production public subnet (192.168.105.0/24) — this is the path that lets the edge Envoy gateway reach apps on the production cluster, the basis of the edge → production traffic chain.

OpenTofu workflow

cd tofu/environment/edge
tofu init
tofu plan -out=plan
tofu apply plan

The provider authenticates with an API token stored in SOPS. The token is decrypted on the workstation only for a plan or apply; nothing runs OpenTofu in CI.

Backups

The edge cluster has no backup target today: k8up is not deployed on edge (k8s/clusters/edge/ carries no k8up Kustomization, the backups component's edge overlay contributes only a NetworkPolicy, and no edge app references it), and no OpenTofu module provisions an off-site bucket for it. What lives on the node — openbeehive's local-path PVC and the single-instance CNPG clusters of both edge apps — is protected by nothing but the minutes-long rebuild.

Operational notes

• Replacing the instance. Re-create with the same name, re-attach the floating IP, re-apply Talos config. The cloud firewalls and VPC stay untouched because they're label-selected.
• Region. nbg1 is the only region used; switching regions is an apply, but the Talos image must be in that region's snapshot library.
• Quotas. Hetzner enforces per-project caps on instances / floating IPs / networks. Keep the edge env on its own project for clean blast-radius control.
• Monitoring. Gatus checks the floating IP from outside the homelab; vmagent from the monitoring stack scrapes node metrics from inside the mesh.

Where to look next

• Proxmox — same role for the production cluster
• NetBird — how the edge joins the rest of the homelab
• Topics → Real client IPs across the chain