Prepare a Server on Hetzner
This guide gets a Hetzner Cloud server ready for Bring Your Own Server, with its firewall and backup storage. Skysize installs everything else on the server.
Each step has two tabs: click through the Console, or paste from Command line. Your choice applies to the whole page.
Commands use Hetzner's hcloud command-line tool on your own computer. To set it up, create an API token with read and write access under Security → API tokens in the Hetzner Console, then run hcloud context create skysize and paste the token. You also need an SSH key at ~/.ssh/id_ed25519.pub.
1. Choose your values
Pick the location closest to your users, and the plan for your use.
| Use | TYPE | vCPU | RAM | Disk |
|---|---|---|---|---|
| One production and one staging | cpx32 (shared) | 4 | 8 GB | 160 GB |
ccx13 (dedicated) | 2 | 8 GB | 80 GB | |
| Production with staging and development branches | cpx42 (shared) | 8 | 16 GB | 320 GB |
ccx23 (dedicated) | 4 | 16 GB | 160 GB |
Prefer dedicated vCPUs for production: shared ones can vary with other customers' load. Avoid CAX plans: they are ARM, and the installer refuses to run on them.
- Console
- Command line
In the Hetzner Console, open your project. Use the same location in every step.
LOCATION=nbg1
NAME=skysize-odoo
TYPE=cpx32
MY_IP=$(curl -4 -s https://ifconfig.me)/32
2. Create the firewall
A new Hetzner server has no firewall, so every port is open. This one allows only what is needed:
| Direction | Protocol | Port | Source | Why |
|---|---|---|---|---|
| In | TCP | 22 | Your IP address | Your access to the server |
| In | TCP | 80 | Any IPv4 and IPv6 | Certificates and redirects |
| In | TCP | 443 | Any IPv4 and IPv6 | Your Odoo sites |
Add no outbound rules, so that all outbound traffic stays allowed: the server needs it. Skysize itself needs no inbound port. Leave PostgreSQL (5432) closed unless you use read-only database access.
If your own IP changes, update the port 22 rule in the console.
- Console
- Command line
- Open Firewalls → Create Firewall, and name it
skysize-odoo. - Add the three inbound rules above, and remove any others it proposes.
- Click Create Firewall. You apply it to the server in the next step.
hcloud firewall create --name "$NAME"
hcloud firewall add-rule "$NAME" --direction in --protocol tcp --port 22 --source-ips "$MY_IP"
hcloud firewall add-rule "$NAME" --direction in --protocol tcp --port 80 \
--source-ips 0.0.0.0/0 --source-ips ::/0
hcloud firewall add-rule "$NAME" --direction in --protocol tcp --port 443 \
--source-ips 0.0.0.0/0 --source-ips ::/0
3. Create the server
Use Ubuntu 24.04, and keep the public IPv4 that Skysize requires. The IP stays the same for as long as the server exists. Note it: your DNS records will point to it.
- Console
- Command line
Click Create Server, and set:
| Setting | Value |
|---|---|
| Location | Yours |
| Image | Ubuntu 24.04 |
| Type | The plan from step 1 |
| Networking | Keep Public IPv4 on |
| SSH keys | Add yours |
| Firewalls | skysize-odoo |
| Name | skysize-odoo |
Then click Create & Buy now.
hcloud ssh-key create --name "$NAME" --public-key-from-file ~/.ssh/id_ed25519.pub
hcloud server create --name "$NAME" --type "$TYPE" --image ubuntu-24.04 \
--location "$LOCATION" --ssh-key "$NAME" --firewall "$NAME"
hcloud server ip "$NAME"
4. Connect to the server
ssh root@YOUR_SERVER_IP
This is where you paste the Skysize install command.
5. Create the backup storage
Skysize makes no backups until a project has a backup target. In the Hetzner Console:
- Open Object Storage and create a private bucket, ideally in another location than your server.
- Open Security → S3 credentials and generate a key. Copy the secret straight away: it is only shown once.
6. Set the backup target
Once your project exists, open its Settings → Backup Target, click Add Target, and fill in:
| Field | Value |
|---|---|
| Type | S3-compatible (Wasabi, R2, MinIO...) |
| Bucket | Your bucket's name |
| Endpoint | https://fsn1.your-objectstorage.com, with your bucket's location |
| Region | Your bucket's location, such as fsn1 |
| Prefix | The project name |
| Access key ID and Secret access key | The key from step 5 |
Click Test to check it from your server.
Sending email from Odoo
Hetzner blocks outgoing ports 25 and 465 on cloud servers by default. Use an SMTP relay on port 587. See Configure Outgoing Email.
Connect the server to Skysize
Your server is ready. Follow Set Up Your Own Server, starting at the step that registers the server. In short: register it in the dashboard, connect to it over SSH, and paste the install command. The status changes to Online within a minute of the installer finishing.
Once your first project runs, add your domain.
If something goes wrong
The dashboard says ports 80 and 443 are not reachable. Check the firewall rules above, and that the public IP in the server's settings is the one you noted. Then click Check again.
The server stays Offline. The server connects out to Skysize, so no inbound rule fixes this. Run these on the server:
sudo systemctl status skysize-agent
sudo journalctl -u skysize-agent -n 50
nc -zv cp.skysize.io 50051
If the installer did not finish, or the join token was already used, use Regenerate join token on the server's page and run the install command again.
Still stuck? Open Support in the dashboard and include the output of those commands.