hetzner

Run uv run "$HERE/scripts/invoke.py" — $HERE is the directory that holds this SKILL.md — with everything the user typed after the Skill name, verbatim and however many lines, on stdin. Exit 0: do what it prints. On any other exit, if you introduced a known construction error and can correct it while preserving the user's request and authority, account for effects already produced, submit the corrected invocation through the same shim, and continue from the failed boundary; a refusal before the operation starts consumes no operation. Otherwise show what it printed to the user verbatim and stop. Never repair input the user supplied, or automatically retry exact help, an unmet dependency, an unrelated failure, or a failure whose origin or valid correction is unknown.

Arguments

operands and instruction carry one instruction between them. With neither, use the task established in the conversation; if there is none, ask what the user wants to do on Hetzner.

Establish the operation

1. Read the project's deployment documentation and existing infrastructure, configuration, and release files. Resolve the target Hetzner project/context, environment, resource identity, requested outcome, and existing authorization. Where several targets remain plausible, settle the target before any remote operation. Preparation or inspection alone authorizes no deployment.
2. Keep the project's chosen stack and source of truth. Manage resources already owned by Terraform or Ansible through that project's workflow; reconcile emergency changes back into it. For a new small setup, use hcloud for Cloud resources, cloud-init for bootstrap, and SSH for installation and deployment. Add a platform or configuration tool only when the task calls for it.
3. For Cloud access, check hcloud version and the relevant command's --help; use the official CLI documentation for missing details or installation. Check hcloud and SSH only when that operation needs them; local preparation can continue without remote tools or credentials. Resolve credentials through an existing named context or a securely supplied environment token. For a named context, prevent an ambient token from overriding it: use env -u HCLOUD_TOKEN hcloud --context "$HCLOUD_CONTEXT" location list to verify access and retain that environment/context selection on subsequent commands. In token-only mode, establish which project owns the credential and retain the same source. Verify resource ownership before mutation; a public catalog read establishes connectivity, not the intended project's identity.
4. Inspect current state, then perform only the requested operation using the relevant reference below. An uncertain write result requires reconciliation before another write. Finish with the actual verification result, including any unfinished work.

Read for the current task