Merge pull request #6817 from coollabsio/hetzner-do

Hetzner integration

app/Actions/Database/StartDragonfly.php

@@ -55,11 +55,11 @@ class StartDragonfly
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartKeydb.php

@@ -56,11 +56,11 @@ class StartKeydb
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartMariadb.php

@@ -57,11 +57,11 @@ class StartMariadb
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartMongodb.php

@@ -61,11 +61,11 @@ class StartMongodb
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartMysql.php

@@ -57,11 +57,11 @@ class StartMysql
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartPostgresql.php

@@ -62,11 +62,11 @@ class StartPostgresql
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Database/StartRedis.php

@@ -56,11 +56,11 @@ class StartRedis
             $this->commands[] = "mkdir -p $this->configuration_dir/ssl";
 
             $server = $this->database->destination->server;
-            $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Actions/Proxy/StartProxy.php

@@ -19,6 +19,11 @@ class StartProxy
         if ((is_null($proxyType) || $proxyType === 'NONE' || $server->proxy->force_stop || $server->isBuildServer()) && $force === false) {
             return 'OK';
         }
+        $server->proxy->set('status', 'starting');
+        $server->save();
+        $server->refresh();
+        ProxyStatusChangedUI::dispatch($server->team_id);
+
         $commands = collect([]);
         $proxy_path = $server->proxyPath();
         $configuration = GetProxyConfiguration::run($server);
@@ -64,14 +69,12 @@ class StartProxy
             ]);
             $commands = $commands->merge(connectProxyToNetworks($server));
         }
-        $server->proxy->set('status', 'starting');
-        $server->save();
-        ProxyStatusChangedUI::dispatch($server->team_id);
 
         if ($async) {
             return remote_process($commands, $server, callEventOnFinish: 'ProxyStatusChanged', callEventData: $server->id);
         } else {
             instant_remote_process($commands, $server);
+
             $server->proxy->set('type', $proxyType);
             $server->save();
             ProxyStatusChanged::dispatch($server->id);

app/Actions/Server/DeleteServer.php

@@ -2,16 +2,102 @@
 
 namespace App\Actions\Server;
 
+use App\Models\CloudProviderToken;
 use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\Server\HetznerDeletionFailed;
+use App\Services\HetznerService;
 use Lorisleiva\Actions\Concerns\AsAction;
 
 class DeleteServer
 {
     use AsAction;
 
-    public function handle(Server $server)
+    public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $hetznerServerId = null, ?int $cloudProviderTokenId = null, ?int $teamId = null)
     {
-        StopSentinel::run($server);
-        $server->forceDelete();
+        $server = Server::withTrashed()->find($serverId);
+
+        // Delete from Hetzner even if server is already gone from Coolify
+        if ($deleteFromHetzner && ($hetznerServerId || ($server && $server->hetzner_server_id))) {
+            $this->deleteFromHetznerById(
+                $hetznerServerId ?? $server->hetzner_server_id,
+                $cloudProviderTokenId ?? $server->cloud_provider_token_id,
+                $teamId ?? $server->team_id
+            );
+        }
+
+        ray($server ? 'Deleting server from Coolify' : 'Server already deleted from Coolify, skipping Coolify deletion');
+
+        // If server is already deleted from Coolify, skip this part
+        if (! $server) {
+            return; // Server already force deleted from Coolify
+        }
+
+        ray('force deleting server from Coolify', ['server_id' => $server->id]);
+
+        try {
+            $server->forceDelete();
+        } catch (\Throwable $e) {
+            ray('Failed to force delete server from Coolify', [
+                'error' => $e->getMessage(),
+                'server_id' => $server->id,
+            ]);
+            logger()->error('Failed to force delete server from Coolify', [
+                'error' => $e->getMessage(),
+                'server_id' => $server->id,
+            ]);
+        }
+    }
+
+    private function deleteFromHetznerById(int $hetznerServerId, ?int $cloudProviderTokenId, int $teamId): void
+    {
+        try {
+            // Use the provided token, or fallback to first available team token
+            $token = null;
+
+            if ($cloudProviderTokenId) {
+                $token = CloudProviderToken::find($cloudProviderTokenId);
+            }
+
+            if (! $token) {
+                $token = CloudProviderToken::where('team_id', $teamId)
+                    ->where('provider', 'hetzner')
+                    ->first();
+            }
+
+            if (! $token) {
+                ray('No Hetzner token found for team, skipping Hetzner deletion', [
+                    'team_id' => $teamId,
+                    'hetzner_server_id' => $hetznerServerId,
+                ]);
+
+                return;
+            }
+
+            $hetznerService = new HetznerService($token->token);
+            $hetznerService->deleteServer($hetznerServerId);
+
+            ray('Deleted server from Hetzner', [
+                'hetzner_server_id' => $hetznerServerId,
+                'team_id' => $teamId,
+            ]);
+        } catch (\Throwable $e) {
+            ray('Failed to delete server from Hetzner', [
+                'error' => $e->getMessage(),
+                'hetzner_server_id' => $hetznerServerId,
+                'team_id' => $teamId,
+            ]);
+
+            // Log the error but don't prevent the server from being deleted from Coolify
+            logger()->error('Failed to delete server from Hetzner', [
+                'error' => $e->getMessage(),
+                'hetzner_server_id' => $hetznerServerId,
+                'team_id' => $teamId,
+            ]);
+
+            // Notify the team about the failure
+            $team = Team::find($teamId);
+            $team?->notify(new HetznerDeletionFailed($hetznerServerId, $teamId, $e->getMessage()));
+        }
     }
 }

app/Actions/Server/InstallDocker.php

@@ -4,7 +4,6 @@ namespace App\Actions\Server;
 
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneDocker;
 use Lorisleiva\Actions\Concerns\AsAction;
 
@@ -20,7 +19,7 @@ class InstallDocker
             throw new \Exception('Server OS type is not supported for automated installation. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://coolify.io/docs/installation#manually">documentation</a>.');
         }
 
-        if (! SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->exists()) {
+        if (! $server->sslCertificates()->where('is_ca_certificate', true)->exists()) {
             $serverCert = SslHelper::generateSslCertificate(
                 commonName: 'Coolify CA Certificate',
                 serverId: $server->id,

app/Console/Commands/CleanupStuckedResources.php

@@ -13,6 +13,7 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
+use App\Models\SslCertificate;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -58,6 +59,15 @@ class CleanupStuckedResources extends Command
         } catch (\Throwable $e) {
             echo "Error in cleaning stucked resources: {$e->getMessage()}\n";
         }
+        try {
+            $servers = Server::onlyTrashed()->get();
+            foreach ($servers as $server) {
+                echo "Force deleting stuck server: {$server->name}\n";
+                $server->forceDelete();
+            }
+        } catch (\Throwable $e) {
+            echo "Error in cleaning stuck servers: {$e->getMessage()}\n";
+        }
         try {
             $applicationsDeploymentQueue = ApplicationDeploymentQueue::get();
             foreach ($applicationsDeploymentQueue as $applicationDeploymentQueue) {
@@ -427,5 +437,18 @@ class CleanupStuckedResources extends Command
         } catch (\Throwable $e) {
             echo "Error in ServiceDatabases: {$e->getMessage()}\n";
         }
+
+        try {
+            $orphanedCerts = SslCertificate::whereNotIn('server_id', function ($query) {
+                $query->select('id')->from('servers');
+            })->get();
+
+            foreach ($orphanedCerts as $cert) {
+                echo "Deleting orphaned SSL certificate: {$cert->id} (server_id: {$cert->server_id})\n";
+                $cert->delete();
+            }
+        } catch (\Throwable $e) {
+            echo "Error in cleaning orphaned SSL certificates: {$e->getMessage()}\n";
+        }
     }
 }

app/Console/Commands/ClearGlobalSearchCache.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Livewire\GlobalSearch;
+use App\Models\Team;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Cache;
+
+class ClearGlobalSearchCache extends Command
+{
+    /**
+     * The name and signature of the console command.
+     */
+    protected $signature = 'search:clear {--team= : Clear cache for specific team ID} {--all : Clear cache for all teams}';
+
+    /**
+     * The console command description.
+     */
+    protected $description = 'Clear the global search cache for testing or manual refresh';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        if ($this->option('all')) {
+            return $this->clearAllTeamsCache();
+        }
+
+        if ($teamId = $this->option('team')) {
+            return $this->clearTeamCache($teamId);
+        }
+
+        // If no options provided, clear cache for current user's team
+        if (! auth()->check()) {
+            $this->error('No authenticated user found. Use --team=ID or --all option.');
+
+            return Command::FAILURE;
+        }
+
+        $teamId = auth()->user()->currentTeam()->id;
+
+        return $this->clearTeamCache($teamId);
+    }
+
+    private function clearTeamCache(int $teamId): int
+    {
+        $team = Team::find($teamId);
+
+        if (! $team) {
+            $this->error("Team with ID {$teamId} not found.");
+
+            return Command::FAILURE;
+        }
+
+        GlobalSearch::clearTeamCache($teamId);
+        $this->info("✓ Cleared global search cache for team: {$team->name} (ID: {$teamId})");
+
+        return Command::SUCCESS;
+    }
+
+    private function clearAllTeamsCache(): int
+    {
+        $teams = Team::all();
+
+        if ($teams->isEmpty()) {
+            $this->warn('No teams found.');
+
+            return Command::SUCCESS;
+        }
+
+        $count = 0;
+        foreach ($teams as $team) {
+            GlobalSearch::clearTeamCache($team->id);
+            $count++;
+        }
+
+        $this->info("✓ Cleared global search cache for {$count} team(s)");
+
+        return Command::SUCCESS;
+    }
+}

app/Events/ServerValidated.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PrivateChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class ServerValidated implements ShouldBroadcast
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    public ?int $teamId = null;
+
+    public ?string $serverUuid = null;
+
+    public function __construct(?int $teamId = null, ?string $serverUuid = null)
+    {
+        if (is_null($teamId) && auth()->check() && auth()->user()->currentTeam()) {
+            $teamId = auth()->user()->currentTeam()->id;
+        }
+        $this->teamId = $teamId;
+        $this->serverUuid = $serverUuid;
+    }
+
+    public function broadcastOn(): array
+    {
+        if (is_null($this->teamId)) {
+            return [];
+        }
+
+        return [
+            new PrivateChannel("team.{$this->teamId}"),
+        ];
+    }
+
+    public function broadcastAs(): string
+    {
+        return 'ServerValidated';
+    }
+
+    public function broadcastWith(): array
+    {
+        return [
+            'teamId' => $this->teamId,
+            'serverUuid' => $this->serverUuid,
+        ];
+    }
+}

app/Http/Controllers/Api/ServersController.php

@@ -746,7 +746,13 @@ class ServersController extends Controller
             return response()->json(['message' => 'Local server cannot be deleted.'], 400);
         }
         $server->delete();
-        DeleteServer::dispatch($server);
+        DeleteServer::dispatch(
+            $server->id,
+            false, // Don't delete from Hetzner via API
+            $server->hetzner_server_id,
+            $server->cloud_provider_token_id,
+            $server->team_id
+        );
 
         return response()->json(['message' => 'Server deleted.']);
     }

app/Jobs/ApplicationDeploymentJob.php

@@ -484,6 +484,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         );
         $this->generate_image_names();
         $this->generate_compose_file();
+
+        // Save build-time .env file BEFORE the build
+        $this->save_buildtime_environment_variables();
+
         $this->generate_build_env_variables();
         $this->add_build_env_variables_to_dockerfile();
         $this->build_image();
@@ -1432,9 +1436,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     'hidden' => true,
                 ],
             );
-        } elseif ($this->build_pack === 'dockercompose') {
-            // For Docker Compose, create an empty .env file even if there are no build-time variables
-            // This ensures the file exists when referenced in docker-compose commands
+        } elseif ($this->build_pack === 'dockercompose' || $this->build_pack === 'dockerfile') {
+            // For Docker Compose and Dockerfile, create an empty .env file even if there are no build-time variables
+            // This ensures the file exists when referenced in build commands
             $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
             $this->execute_remote_command(
@@ -3196,7 +3200,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
 
             $dockerfile_base64 = base64_encode($dockerfile->implode("\n"));
-            $this->application_deployment_queue->addLogEntry('Final Dockerfile:', type: 'info');
+            $this->application_deployment_queue->addLogEntry('Final Dockerfile:', type: 'info', hidden: true);
             $this->execute_remote_command(
                 [
                     executeInDocker($this->deployment_uuid, "echo '{$dockerfile_base64}' | base64 -d | tee {$this->workdir}{$this->dockerfile_location} > /dev/null"),

app/Jobs/RegenerateSslCertJob.php

@@ -45,7 +45,7 @@ class RegenerateSslCertJob implements ShouldQueue
 
         $query->cursor()->each(function ($certificate) use ($regenerated) {
             try {
-                $caCert = SslCertificate::where('server_id', $certificate->server_id)
+                $caCert = $certificate->server->sslCertificates()
                     ->where('is_ca_certificate', true)
                     ->first();
 

app/Jobs/ServerConnectionCheckJob.php

@@ -54,6 +54,11 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
                 return;
             }
 
+            // Check Hetzner server status if applicable
+            if ($this->server->hetzner_server_id && $this->server->cloudProviderToken) {
+                $this->checkHetznerStatus();
+            }
+
             // Temporarily disable mux if requested
             if ($this->disableMux) {
                 $this->disableSshMux();
@@ -86,6 +91,11 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
             ]);
 
         } catch (\Throwable $e) {
+
+            Log::error('ServerConnectionCheckJob failed', [
+                'error' => $e->getMessage(),
+                'server_id' => $this->server->id,
+            ]);
             $this->server->settings->update([
                 'is_reachable' => false,
                 'is_usable' => false,
@@ -95,6 +105,30 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function checkHetznerStatus(): void
+    {
+        try {
+            $hetznerService = new \App\Services\HetznerService($this->server->cloudProviderToken->token);
+            $serverData = $hetznerService->getServer($this->server->hetzner_server_id);
+            $status = $serverData['status'] ?? null;
+
+        } catch (\Throwable $e) {
+            Log::debug('ServerConnectionCheck: Hetzner status check failed', [
+                'server_id' => $this->server->id,
+                'error' => $e->getMessage(),
+            ]);
+        }
+        if ($this->server->hetzner_server_status !== $status) {
+            $this->server->update(['hetzner_server_status' => $status]);
+            $this->server->hetzner_server_status = $status;
+            if ($status === 'off') {
+                ray('Server is powered off, marking as unreachable');
+                throw new \Exception('Server is powered off');
+            }
+        }
+
+    }
+
     private function checkConnection(): bool
     {
         try {

app/Jobs/ValidateAndInstallServerJob.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Actions\Proxy\CheckProxy;
+use App\Actions\Proxy\StartProxy;
+use App\Events\ServerReachabilityChanged;
+use App\Events\ServerValidated;
+use App\Models\Server;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class ValidateAndInstallServerJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public $timeout = 600; // 10 minutes
+
+    public int $maxTries = 3;
+
+    public function __construct(
+        public Server $server,
+        public int $numberOfTries = 0
+    ) {
+        $this->onQueue('high');
+    }
+
+    public function handle(): void
+    {
+        try {
+            // Mark validation as in progress
+            $this->server->update(['is_validating' => true]);
+
+            Log::info('ValidateAndInstallServer: Starting validation', [
+                'server_id' => $this->server->id,
+                'server_name' => $this->server->name,
+                'attempt' => $this->numberOfTries + 1,
+            ]);
+
+            // Validate connection
+            ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
+            if (! $uptime) {
+                $errorMessage = 'Server is not reachable. Please validate your configuration and connection.<br>Check this <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br>Error: '.$error;
+                $this->server->update([
+                    'validation_logs' => $errorMessage,
+                    'is_validating' => false,
+                ]);
+                Log::error('ValidateAndInstallServer: Server not reachable', [
+                    'server_id' => $this->server->id,
+                    'error' => $error,
+                ]);
+
+                return;
+            }
+
+            // Validate OS
+            $supportedOsType = $this->server->validateOS();
+            if (! $supportedOsType) {
+                $errorMessage = 'Server OS type is not supported. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
+                $this->server->update([
+                    'validation_logs' => $errorMessage,
+                    'is_validating' => false,
+                ]);
+                Log::error('ValidateAndInstallServer: OS not supported', [
+                    'server_id' => $this->server->id,
+                ]);
+
+                return;
+            }
+
+            // Check if Docker is installed
+            $dockerInstalled = $this->server->validateDockerEngine();
+            $dockerComposeInstalled = $this->server->validateDockerCompose();
+
+            if (! $dockerInstalled || ! $dockerComposeInstalled) {
+                // Try to install Docker
+                if ($this->numberOfTries >= $this->maxTries) {
+                    $errorMessage = 'Docker Engine could not be installed after '.$this->maxTries.' attempts. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
+                    $this->server->update([
+                        'validation_logs' => $errorMessage,
+                        'is_validating' => false,
+                    ]);
+                    Log::error('ValidateAndInstallServer: Docker installation failed after max tries', [
+                        'server_id' => $this->server->id,
+                        'attempts' => $this->numberOfTries,
+                    ]);
+
+                    return;
+                }
+
+                Log::info('ValidateAndInstallServer: Installing Docker', [
+                    'server_id' => $this->server->id,
+                    'attempt' => $this->numberOfTries + 1,
+                ]);
+
+                // Install Docker
+                $this->server->installDocker();
+
+                // Retry validation after installation
+                self::dispatch($this->server, $this->numberOfTries + 1)->delay(now()->addSeconds(30));
+
+                return;
+            }
+
+            // Validate Docker version
+            $dockerVersion = $this->server->validateDockerEngineVersion();
+            if (! $dockerVersion) {
+                $requiredDockerVersion = str(config('constants.docker.minimum_required_version'))->before('.');
+                $errorMessage = 'Minimum Docker Engine version '.$requiredDockerVersion.' is not installed. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
+                $this->server->update([
+                    'validation_logs' => $errorMessage,
+                    'is_validating' => false,
+                ]);
+                Log::error('ValidateAndInstallServer: Docker version not sufficient', [
+                    'server_id' => $this->server->id,
+                ]);
+
+                return;
+            }
+
+            // Validation successful!
+            Log::info('ValidateAndInstallServer: Validation successful', [
+                'server_id' => $this->server->id,
+                'server_name' => $this->server->name,
+            ]);
+
+            // Start proxy if needed
+            if (! $this->server->isBuildServer()) {
+                $proxyShouldRun = CheckProxy::run($this->server, true);
+                if ($proxyShouldRun) {
+                    StartProxy::dispatch($this->server);
+                }
+            }
+
+            // Mark validation as complete
+            $this->server->update(['is_validating' => false]);
+
+            // Refresh server to get latest state
+            $this->server->refresh();
+
+            // Broadcast events to update UI
+            ServerValidated::dispatch($this->server->team_id, $this->server->uuid);
+            ServerReachabilityChanged::dispatch($this->server);
+
+        } catch (\Throwable $e) {
+            Log::error('ValidateAndInstallServer: Exception occurred', [
+                'server_id' => $this->server->id,
+                'error' => $e->getMessage(),
+                'trace' => $e->getTraceAsString(),
+            ]);
+
+            $this->server->update([
+                'validation_logs' => 'An error occurred during validation: '.$e->getMessage(),
+                'is_validating' => false,
+            ]);
+        }
+    }
+}

app/Livewire/GlobalSearch.php

@@ -617,7 +617,14 @@ class GlobalSearch extends Component
                     'type' => 'navigation',
                     'description' => 'Manage private keys and API tokens',
                     'link' => route('security.private-key.index'),
-                    'search_text' => 'security private keys ssh api tokens',
+                    'search_text' => 'security private keys ssh api tokens cloud-init scripts',
+                ],
+                [
+                    'name' => 'Cloud-Init Scripts',
+                    'type' => 'navigation',
+                    'description' => 'Manage reusable cloud-init scripts',
+                    'link' => route('security.cloud-init-scripts'),
+                    'search_text' => 'cloud-init scripts cloud init cloudinit initialization startup server setup',
                 ],
                 [
                     'name' => 'Sources',

app/Livewire/Project/Database/Dragonfly/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneDragonfly;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -249,13 +248,13 @@ class General extends Component
 
             $server = $this->database->destination->server;
 
-            $caCert = SslCertificate::where('server_id', $server->id)
+            $caCert = $server->sslCertificates()
                 ->where('is_ca_certificate', true)
                 ->first();
 
             if (! $caCert) {
                 $server->generateCaCertificate();
-                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
             }
 
             if (! $caCert) {

app/Livewire/Project/Database/Keydb/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneKeydb;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -255,7 +254,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)
+            $caCert = $this->server->sslCertificates()
                 ->where('is_ca_certificate', true)
                 ->first();
 

app/Livewire/Project/Database/Mariadb/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneMariadb;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -207,7 +206,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)->where('is_ca_certificate', true)->first();
+            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->common_name,

app/Livewire/Project/Database/Mongodb/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneMongodb;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -215,7 +214,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)->where('is_ca_certificate', true)->first();
+            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->common_name,

app/Livewire/Project/Database/Mysql/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneMysql;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -215,7 +214,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)->where('is_ca_certificate', true)->first();
+            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->common_name,

app/Livewire/Project/Database/Postgresql/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandalonePostgresql;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -169,7 +168,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)->where('is_ca_certificate', true)->first();
+            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->common_name,

app/Livewire/Project/Database/Redis/General.php

@@ -6,7 +6,6 @@ use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Helpers\SslHelper;
 use App\Models\Server;
-use App\Models\SslCertificate;
 use App\Models\StandaloneRedis;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
@@ -209,7 +208,7 @@ class General extends Component
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)->where('is_ca_certificate', true)->first();
+            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->commonName,

app/Livewire/Security/CloudInitScriptForm.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\CloudInitScript;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class CloudInitScriptForm extends Component
+{
+    use AuthorizesRequests;
+
+    public bool $modal_mode = true;
+
+    public ?int $scriptId = null;
+
+    public string $name = '';
+
+    public string $script = '';
+
+    public function mount(?int $scriptId = null)
+    {
+        if ($scriptId) {
+            $this->scriptId = $scriptId;
+            $cloudInitScript = CloudInitScript::ownedByCurrentTeam()->findOrFail($scriptId);
+            $this->authorize('update', $cloudInitScript);
+
+            $this->name = $cloudInitScript->name;
+            $this->script = $cloudInitScript->script;
+        } else {
+            $this->authorize('create', CloudInitScript::class);
+        }
+    }
+
+    protected function rules(): array
+    {
+        return [
+            'name' => 'required|string|max:255',
+            'script' => ['required', 'string', new \App\Rules\ValidCloudInitYaml],
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'name.required' => 'Script name is required.',
+            'name.max' => 'Script name cannot exceed 255 characters.',
+            'script.required' => 'Cloud-init script content is required.',
+        ];
+    }
+
+    public function save()
+    {
+        $this->validate();
+
+        try {
+            if ($this->scriptId) {
+                // Update existing script
+                $cloudInitScript = CloudInitScript::ownedByCurrentTeam()->findOrFail($this->scriptId);
+                $this->authorize('update', $cloudInitScript);
+
+                $cloudInitScript->update([
+                    'name' => $this->name,
+                    'script' => $this->script,
+                ]);
+
+                $message = 'Cloud-init script updated successfully.';
+            } else {
+                // Create new script
+                $this->authorize('create', CloudInitScript::class);
+
+                CloudInitScript::create([
+                    'team_id' => currentTeam()->id,
+                    'name' => $this->name,
+                    'script' => $this->script,
+                ]);
+
+                $message = 'Cloud-init script created successfully.';
+            }
+
+            // Only reset fields if creating (not editing)
+            if (! $this->scriptId) {
+                $this->reset(['name', 'script']);
+            }
+
+            $this->dispatch('scriptSaved');
+            $this->dispatch('success', $message);
+
+            if ($this->modal_mode) {
+                $this->dispatch('closeModal');
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-init-script-form');
+    }
+}

app/Livewire/Security/CloudInitScripts.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\CloudInitScript;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class CloudInitScripts extends Component
+{
+    use AuthorizesRequests;
+
+    public $scripts;
+
+    public function mount()
+    {
+        $this->authorize('viewAny', CloudInitScript::class);
+        $this->loadScripts();
+    }
+
+    public function getListeners()
+    {
+        return [
+            'scriptSaved' => 'loadScripts',
+        ];
+    }
+
+    public function loadScripts()
+    {
+        $this->scripts = CloudInitScript::ownedByCurrentTeam()->orderBy('created_at', 'desc')->get();
+    }
+
+    public function deleteScript(int $scriptId)
+    {
+        try {
+            $script = CloudInitScript::ownedByCurrentTeam()->findOrFail($scriptId);
+            $this->authorize('delete', $script);
+
+            $script->delete();
+            $this->loadScripts();
+
+            $this->dispatch('success', 'Cloud-init script deleted successfully.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-init-scripts');
+    }
+}

app/Livewire/Security/CloudProviderTokenForm.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\CloudProviderToken;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
+use Livewire\Component;
+
+class CloudProviderTokenForm extends Component
+{
+    use AuthorizesRequests;
+
+    public bool $modal_mode = false;
+
+    public string $provider = 'hetzner';
+
+    public string $token = '';
+
+    public string $name = '';
+
+    public function mount()
+    {
+        $this->authorize('create', CloudProviderToken::class);
+    }
+
+    protected function rules(): array
+    {
+        return [
+            'provider' => 'required|string|in:hetzner,digitalocean',
+            'token' => 'required|string',
+            'name' => 'required|string|max:255',
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'provider.required' => 'Please select a cloud provider.',
+            'provider.in' => 'Invalid cloud provider selected.',
+            'token.required' => 'API token is required.',
+            'name.required' => 'Token name is required.',
+        ];
+    }
+
+    private function validateToken(string $provider, string $token): bool
+    {
+        try {
+            if ($provider === 'hetzner') {
+                $response = Http::withHeaders([
+                    'Authorization' => 'Bearer '.$token,
+                ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
+                ray($response);
+
+                return $response->successful();
+            }
+
+            // Add other providers here in the future
+            // if ($provider === 'digitalocean') { ... }
+
+            return false;
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
+    public function addToken()
+    {
+        $this->validate();
+
+        try {
+            // Validate the token with the provider's API
+            if (! $this->validateToken($this->provider, $this->token)) {
+                return $this->dispatch('error', 'Invalid API token. Please check your token and try again.');
+            }
+
+            $savedToken = CloudProviderToken::create([
+                'team_id' => currentTeam()->id,
+                'provider' => $this->provider,
+                'token' => $this->token,
+                'name' => $this->name,
+            ]);
+
+            $this->reset(['token', 'name']);
+
+            // Dispatch event with token ID so parent components can react
+            $this->dispatch('tokenAdded', tokenId: $savedToken->id);
+
+            $this->dispatch('success', 'Cloud provider token added successfully.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-provider-token-form');
+    }
+}

app/Livewire/Security/CloudProviderTokens.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\CloudProviderToken;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class CloudProviderTokens extends Component
+{
+    use AuthorizesRequests;
+
+    public $tokens;
+
+    public function mount()
+    {
+        $this->authorize('viewAny', CloudProviderToken::class);
+        $this->loadTokens();
+    }
+
+    public function getListeners()
+    {
+        return [
+            'tokenAdded' => 'loadTokens',
+        ];
+    }
+
+    public function loadTokens()
+    {
+        $this->tokens = CloudProviderToken::ownedByCurrentTeam()->get();
+    }
+
+    public function deleteToken(int $tokenId)
+    {
+        try {
+            $token = CloudProviderToken::ownedByCurrentTeam()->findOrFail($tokenId);
+            $this->authorize('delete', $token);
+
+            // Check if any servers are using this token
+            if ($token->hasServers()) {
+                $serverCount = $token->servers()->count();
+                $this->dispatch('error', "Cannot delete this token. It is currently used by {$serverCount} server(s). Please reassign those servers to a different token first.");
+
+                return;
+            }
+
+            $token->delete();
+            $this->loadTokens();
+
+            $this->dispatch('success', 'Cloud provider token deleted successfully.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-provider-tokens');
+    }
+}

app/Livewire/Security/CloudTokens.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use Livewire\Component;
+
+class CloudTokens extends Component
+{
+    public function render()
+    {
+        return view('livewire.security.cloud-tokens');
+    }
+}

app/Livewire/Security/PrivateKey/Create.php

@@ -21,6 +21,8 @@ class Create extends Component
 
     public ?string $publicKey = null;
 
+    public bool $modal_mode = false;
+
     protected function rules(): array
     {
         return [
@@ -77,6 +79,14 @@ class Create extends Component
                 'team_id' => currentTeam()->id,
             ]);
 
+            // If in modal mode, dispatch event and don't redirect
+            if ($this->modal_mode) {
+                $this->dispatch('privateKeyCreated', keyId: $privateKey->id);
+                $this->dispatch('success', 'Private key created successfully.');
+
+                return;
+            }
+
             return $this->redirectAfterCreation($privateKey);
         } catch (\Throwable $e) {
             return handleError($e, $this);

app/Livewire/Server/CaCertificate/Show.php

@@ -39,7 +39,7 @@ class Show extends Component
 
     public function loadCaCertificate()
     {
-        $this->caCertificate = SslCertificate::where('server_id', $this->server->id)->where('is_ca_certificate', true)->first();
+        $this->caCertificate = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
 
         if ($this->caCertificate) {
             $this->certificateContent = $this->caCertificate->ssl_certificate;

app/Livewire/Server/CloudProviderToken/Show.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Livewire\Server\CloudProviderToken;
+
+use App\Models\CloudProviderToken;
+use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class Show extends Component
+{
+    use AuthorizesRequests;
+
+    public Server $server;
+
+    public $cloudProviderTokens = [];
+
+    public $parameters = [];
+
+    public function mount(string $server_uuid)
+    {
+        try {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
+            $this->loadTokens();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function getListeners()
+    {
+        return [
+            'tokenAdded' => 'handleTokenAdded',
+        ];
+    }
+
+    public function loadTokens()
+    {
+        $this->cloudProviderTokens = CloudProviderToken::ownedByCurrentTeam()
+            ->where('provider', 'hetzner')
+            ->get();
+    }
+
+    public function handleTokenAdded($tokenId)
+    {
+        $this->loadTokens();
+    }
+
+    public function setCloudProviderToken($tokenId)
+    {
+        $ownedToken = CloudProviderToken::ownedByCurrentTeam()->find($tokenId);
+        if (is_null($ownedToken)) {
+            $this->dispatch('error', 'You are not allowed to use this token.');
+
+            return;
+        }
+        try {
+            $this->authorize('update', $this->server);
+
+            // Validate the token works and can access this specific server
+            $validationResult = $this->validateTokenForServer($ownedToken);
+            if (! $validationResult['valid']) {
+                $this->dispatch('error', $validationResult['error']);
+
+                return;
+            }
+
+            $this->server->cloudProviderToken()->associate($ownedToken);
+            $this->server->save();
+            $this->dispatch('success', 'Hetzner token updated successfully.');
+            $this->dispatch('refreshServerShow');
+        } catch (\Exception $e) {
+            $this->server->refresh();
+            $this->dispatch('error', $e->getMessage());
+        }
+    }
+
+    private function validateTokenForServer(CloudProviderToken $token): array
+    {
+        try {
+            // First, validate the token itself
+            $response = \Illuminate\Support\Facades\Http::withHeaders([
+                'Authorization' => 'Bearer '.$token->token,
+            ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
+
+            if (! $response->successful()) {
+                return [
+                    'valid' => false,
+                    'error' => 'This token is invalid or has insufficient permissions.',
+                ];
+            }
+
+            // Check if this token can access the specific Hetzner server
+            if ($this->server->hetzner_server_id) {
+                $serverResponse = \Illuminate\Support\Facades\Http::withHeaders([
+                    'Authorization' => 'Bearer '.$token->token,
+                ])->timeout(10)->get("https://api.hetzner.cloud/v1/servers/{$this->server->hetzner_server_id}");
+
+                if (! $serverResponse->successful()) {
+                    return [
+                        'valid' => false,
+                        'error' => 'This token cannot access this server. It may belong to a different Hetzner project.',
+                    ];
+                }
+            }
+
+            return ['valid' => true];
+        } catch (\Throwable $e) {
+            return [
+                'valid' => false,
+                'error' => 'Failed to validate token: '.$e->getMessage(),
+            ];
+        }
+    }
+
+    public function validateToken()
+    {
+        try {
+            $token = $this->server->cloudProviderToken;
+            if (! $token) {
+                $this->dispatch('error', 'No Hetzner token is associated with this server.');
+
+                return;
+            }
+
+            $response = \Illuminate\Support\Facades\Http::withHeaders([
+                'Authorization' => 'Bearer '.$token->token,
+            ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
+
+            if ($response->successful()) {
+                $this->dispatch('success', 'Hetzner token is valid and working.');
+            } else {
+                $this->dispatch('error', 'Hetzner token is invalid or has insufficient permissions.');
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.server.cloud-provider-token.show');
+    }
+}

app/Livewire/Server/Create.php

@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Server;
 
+use App\Models\CloudProviderToken;
 use App\Models\PrivateKey;
 use App\Models\Team;
 use Livewire\Component;
@@ -12,6 +13,8 @@ class Create extends Component
 
     public bool $limit_reached = false;
 
+    public bool $has_hetzner_tokens = false;
+
     public function mount()
     {
         $this->private_keys = PrivateKey::ownedByCurrentTeam()->get();
@@ -21,6 +24,11 @@ class Create extends Component
             return;
         }
         $this->limit_reached = Team::serverLimitReached();
+
+        // Check if user has Hetzner tokens
+        $this->has_hetzner_tokens = CloudProviderToken::ownedByCurrentTeam()
+            ->where('provider', 'hetzner')
+            ->exists();
     }
 
     public function render()

app/Livewire/Server/Delete.php

@@ -16,6 +16,8 @@ class Delete extends Component
 
     public Server $server;
 
+    public bool $delete_from_hetzner = false;
+
     public function mount(string $server_uuid)
     {
         try {
@@ -41,8 +43,15 @@ class Delete extends Component
 
                 return;
             }
+
             $this->server->delete();
-            DeleteServer::dispatch($this->server);
+            DeleteServer::dispatch(
+                $this->server->id,
+                $this->delete_from_hetzner,
+                $this->server->hetzner_server_id,
+                $this->server->cloud_provider_token_id,
+                $this->server->team_id
+            );
 
             return redirect()->route('server.index');
         } catch (\Throwable $e) {
@@ -52,6 +61,18 @@ class Delete extends Component
 
     public function render()
     {
-        return view('livewire.server.delete');
+        $checkboxes = [];
+
+        if ($this->server->hetzner_server_id) {
+            $checkboxes[] = [
+                'id' => 'delete_from_hetzner',
+                'label' => 'Also delete server from Hetzner Cloud',
+                'default_warning' => 'The actual server on Hetzner Cloud will NOT be deleted.',
+            ];
+        }
+
+        return view('livewire.server.delete', [
+            'checkboxes' => $checkboxes,
+        ]);
     }
 }

app/Livewire/Server/Navbar.php

@@ -118,17 +118,31 @@ class Navbar extends Component
 
     public function showNotification()
     {
+        $this->server->refresh();
         $this->proxyStatus = $this->server->proxy->status ?? 'unknown';
-        $forceStop = $this->server->proxy->force_stop ?? false;
 
         switch ($this->proxyStatus) {
             case 'running':
                 $this->loadProxyConfiguration();
+                $this->dispatch('success', 'Proxy is running.');
                 break;
             case 'restarting':
                 $this->dispatch('info', 'Initiating proxy restart.');
                 break;
+            case 'exited':
+                $this->dispatch('info', 'Proxy has exited.');
+                break;
+            case 'stopping':
+                $this->dispatch('info', 'Proxy is stopping.');
+                break;
+            case 'starting':
+                $this->dispatch('info', 'Proxy is starting.');
+                break;
+            case 'unknown':
+                $this->dispatch('info', 'Proxy status is unknown.');
+                break;
             default:
+                $this->dispatch('info', 'Proxy status updated.');
                 break;
         }
 

app/Livewire/Server/New/ByHetzner.php

@@ -0,0 +1,565 @@
+<?php
+
+namespace App\Livewire\Server\New;
+
+use App\Enums\ProxyTypes;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Rules\ValidHostname;
+use App\Services\HetznerService;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Http;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class ByHetzner extends Component
+{
+    use AuthorizesRequests;
+
+    // Step tracking
+    public int $current_step = 1;
+
+    // Locked data
+    #[Locked]
+    public Collection $available_tokens;
+
+    #[Locked]
+    public $private_keys;
+
+    #[Locked]
+    public $limit_reached;
+
+    // Step 1: Token selection
+    public ?int $selected_token_id = null;
+
+    // Step 2: Server configuration
+    public array $locations = [];
+
+    public array $images = [];
+
+    public array $serverTypes = [];
+
+    public array $hetznerSshKeys = [];
+
+    public ?string $selected_location = null;
+
+    public ?int $selected_image = null;
+
+    public ?string $selected_server_type = null;
+
+    public array $selectedHetznerSshKeyIds = [];
+
+    public string $server_name = '';
+
+    public ?int $private_key_id = null;
+
+    public bool $loading_data = false;
+
+    public bool $enable_ipv4 = true;
+
+    public bool $enable_ipv6 = true;
+
+    public ?string $cloud_init_script = null;
+
+    public bool $save_cloud_init_script = false;
+
+    public ?string $cloud_init_script_name = null;
+
+    public ?int $selected_cloud_init_script_id = null;
+
+    #[Locked]
+    public Collection $saved_cloud_init_scripts;
+
+    public function mount()
+    {
+        $this->authorize('viewAny', CloudProviderToken::class);
+        $this->loadTokens();
+        $this->loadSavedCloudInitScripts();
+        $this->server_name = generate_random_name();
+        if ($this->private_keys->count() > 0) {
+            $this->private_key_id = $this->private_keys->first()->id;
+        }
+    }
+
+    public function loadSavedCloudInitScripts()
+    {
+        $this->saved_cloud_init_scripts = CloudInitScript::ownedByCurrentTeam()->get();
+    }
+
+    public function getListeners()
+    {
+        return [
+            'tokenAdded' => 'handleTokenAdded',
+            'privateKeyCreated' => 'handlePrivateKeyCreated',
+            'modalClosed' => 'resetSelection',
+        ];
+    }
+
+    public function resetSelection()
+    {
+        $this->selected_token_id = null;
+        $this->current_step = 1;
+        $this->cloud_init_script = null;
+        $this->save_cloud_init_script = false;
+        $this->cloud_init_script_name = null;
+        $this->selected_cloud_init_script_id = null;
+    }
+
+    public function loadTokens()
+    {
+        $this->available_tokens = CloudProviderToken::ownedByCurrentTeam()
+            ->where('provider', 'hetzner')
+            ->get();
+    }
+
+    public function handleTokenAdded($tokenId)
+    {
+        // Refresh token list
+        $this->loadTokens();
+
+        // Auto-select the new token
+        $this->selected_token_id = $tokenId;
+
+        // Automatically proceed to next step
+        $this->nextStep();
+    }
+
+    public function handlePrivateKeyCreated($keyId)
+    {
+        // Refresh private keys list
+        $this->private_keys = PrivateKey::ownedByCurrentTeam()->get();
+
+        // Auto-select the new key
+        $this->private_key_id = $keyId;
+
+        // Clear validation errors for private_key_id
+        $this->resetErrorBag('private_key_id');
+    }
+
+    protected function rules(): array
+    {
+        $rules = [
+            'selected_token_id' => 'required|integer|exists:cloud_provider_tokens,id',
+        ];
+
+        if ($this->current_step === 2) {
+            $rules = array_merge($rules, [
+                'server_name' => ['required', 'string', 'max:253', new ValidHostname],
+                'selected_location' => 'required|string',
+                'selected_image' => 'required|integer',
+                'selected_server_type' => 'required|string',
+                'private_key_id' => 'required|integer|exists:private_keys,id,team_id,'.currentTeam()->id,
+                'selectedHetznerSshKeyIds' => 'nullable|array',
+                'selectedHetznerSshKeyIds.*' => 'integer',
+                'enable_ipv4' => 'required|boolean',
+                'enable_ipv6' => 'required|boolean',
+                'cloud_init_script' => ['nullable', 'string', new \App\Rules\ValidCloudInitYaml],
+                'save_cloud_init_script' => 'boolean',
+                'cloud_init_script_name' => 'nullable|string|max:255',
+                'selected_cloud_init_script_id' => 'nullable|integer|exists:cloud_init_scripts,id',
+            ]);
+        }
+
+        return $rules;
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'selected_token_id.required' => 'Please select a Hetzner token.',
+            'selected_token_id.exists' => 'Selected token not found.',
+        ];
+    }
+
+    public function selectToken(int $tokenId)
+    {
+        $this->selected_token_id = $tokenId;
+    }
+
+    private function validateHetznerToken(string $token): bool
+    {
+        try {
+            $response = Http::withHeaders([
+                'Authorization' => 'Bearer '.$token,
+            ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
+
+            return $response->successful();
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
+    private function getHetznerToken(): string
+    {
+        if ($this->selected_token_id) {
+            $token = $this->available_tokens->firstWhere('id', $this->selected_token_id);
+
+            return $token ? $token->token : '';
+        }
+
+        return '';
+    }
+
+    public function nextStep()
+    {
+        // Validate step 1 - just need a token selected
+        $this->validate([
+            'selected_token_id' => 'required|integer|exists:cloud_provider_tokens,id',
+        ]);
+
+        try {
+            $hetznerToken = $this->getHetznerToken();
+
+            if (! $hetznerToken) {
+                return $this->dispatch('error', 'Please select a valid Hetzner token.');
+            }
+
+            // Load Hetzner data
+            $this->loadHetznerData($hetznerToken);
+
+            // Move to step 2
+            $this->current_step = 2;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function previousStep()
+    {
+        $this->current_step = 1;
+    }
+
+    private function loadHetznerData(string $token)
+    {
+        $this->loading_data = true;
+
+        try {
+            $hetznerService = new HetznerService($token);
+
+            $this->locations = $hetznerService->getLocations();
+            $this->serverTypes = $hetznerService->getServerTypes();
+
+            // Get images and sort by name
+            $images = $hetznerService->getImages();
+
+            ray('Raw images from Hetzner API', [
+                'total_count' => count($images),
+                'types' => collect($images)->pluck('type')->unique()->values(),
+                'sample' => array_slice($images, 0, 3),
+            ]);
+
+            $this->images = collect($images)
+                ->filter(function ($image) {
+                    // Only system images
+                    if (! isset($image['type']) || $image['type'] !== 'system') {
+                        return false;
+                    }
+
+                    // Filter out deprecated images
+                    if (isset($image['deprecated']) && $image['deprecated'] === true) {
+                        return false;
+                    }
+
+                    return true;
+                })
+                ->sortBy('name')
+                ->values()
+                ->toArray();
+
+            ray('Filtered images', [
+                'filtered_count' => count($this->images),
+                'debian_images' => collect($this->images)->filter(fn ($img) => str_contains($img['name'] ?? '', 'debian'))->values(),
+            ]);
+
+            // Load SSH keys from Hetzner
+            $this->hetznerSshKeys = $hetznerService->getSshKeys();
+
+            ray('Hetzner SSH Keys', [
+                'total_count' => count($this->hetznerSshKeys),
+                'keys' => $this->hetznerSshKeys,
+            ]);
+
+            $this->loading_data = false;
+        } catch (\Throwable $e) {
+            $this->loading_data = false;
+            throw $e;
+        }
+    }
+
+    public function getAvailableServerTypesProperty()
+    {
+        ray('Getting available server types', [
+            'selected_location' => $this->selected_location,
+            'total_server_types' => count($this->serverTypes),
+        ]);
+
+        if (! $this->selected_location) {
+            return $this->serverTypes;
+        }
+
+        $filtered = collect($this->serverTypes)
+            ->filter(function ($type) {
+                if (! isset($type['locations'])) {
+                    return false;
+                }
+
+                $locationNames = collect($type['locations'])->pluck('name')->toArray();
+
+                return in_array($this->selected_location, $locationNames);
+            })
+            ->values()
+            ->toArray();
+
+        ray('Filtered server types', [
+            'selected_location' => $this->selected_location,
+            'filtered_count' => count($filtered),
+        ]);
+
+        return $filtered;
+    }
+
+    public function getAvailableImagesProperty()
+    {
+        ray('Getting available images', [
+            'selected_server_type' => $this->selected_server_type,
+            'total_images' => count($this->images),
+            'images' => $this->images,
+        ]);
+
+        if (! $this->selected_server_type) {
+            return $this->images;
+        }
+
+        $serverType = collect($this->serverTypes)->firstWhere('name', $this->selected_server_type);
+
+        ray('Server type data', $serverType);
+
+        if (! $serverType || ! isset($serverType['architecture'])) {
+            ray('No architecture in server type, returning all');
+
+            return $this->images;
+        }
+
+        $architecture = $serverType['architecture'];
+
+        $filtered = collect($this->images)
+            ->filter(fn ($image) => ($image['architecture'] ?? null) === $architecture)
+            ->values()
+            ->toArray();
+
+        ray('Filtered images', [
+            'architecture' => $architecture,
+            'filtered_count' => count($filtered),
+        ]);
+
+        return $filtered;
+    }
+
+    public function getSelectedServerPriceProperty(): ?string
+    {
+        if (! $this->selected_server_type) {
+            return null;
+        }
+
+        $serverType = collect($this->serverTypes)->firstWhere('name', $this->selected_server_type);
+
+        if (! $serverType || ! isset($serverType['prices'][0]['price_monthly']['gross'])) {
+            return null;
+        }
+
+        $price = $serverType['prices'][0]['price_monthly']['gross'];
+
+        return '€'.number_format($price, 2);
+    }
+
+    public function updatedSelectedLocation($value)
+    {
+        ray('Location selected', $value);
+
+        // Reset server type and image when location changes
+        $this->selected_server_type = null;
+        $this->selected_image = null;
+    }
+
+    public function updatedSelectedServerType($value)
+    {
+        ray('Server type selected', $value);
+
+        // Reset image when server type changes
+        $this->selected_image = null;
+    }
+
+    public function updatedSelectedImage($value)
+    {
+        ray('Image selected', $value);
+    }
+
+    public function updatedSelectedCloudInitScriptId($value)
+    {
+        if ($value) {
+            $script = CloudInitScript::ownedByCurrentTeam()->findOrFail($value);
+            $this->cloud_init_script = $script->script;
+            $this->cloud_init_script_name = $script->name;
+        }
+    }
+
+    public function clearCloudInitScript()
+    {
+        $this->selected_cloud_init_script_id = null;
+        $this->cloud_init_script = '';
+        $this->cloud_init_script_name = '';
+        $this->save_cloud_init_script = false;
+    }
+
+    private function createHetznerServer(string $token): array
+    {
+        $hetznerService = new HetznerService($token);
+
+        // Get the private key and extract public key
+        $privateKey = PrivateKey::ownedByCurrentTeam()->findOrFail($this->private_key_id);
+
+        $publicKey = $privateKey->getPublicKey();
+        $md5Fingerprint = PrivateKey::generateMd5Fingerprint($privateKey->private_key);
+
+        ray('Private Key Info', [
+            'private_key_id' => $this->private_key_id,
+            'sha256_fingerprint' => $privateKey->fingerprint,
+            'md5_fingerprint' => $md5Fingerprint,
+        ]);
+
+        // Check if SSH key already exists on Hetzner by comparing MD5 fingerprints
+        $existingSshKeys = $hetznerService->getSshKeys();
+        $existingKey = null;
+
+        ray('Existing SSH Keys on Hetzner', $existingSshKeys);
+
+        foreach ($existingSshKeys as $key) {
+            if ($key['fingerprint'] === $md5Fingerprint) {
+                $existingKey = $key;
+                break;
+            }
+        }
+
+        // Upload SSH key if it doesn't exist
+        if ($existingKey) {
+            $sshKeyId = $existingKey['id'];
+            ray('Using existing SSH key', ['ssh_key_id' => $sshKeyId]);
+        } else {
+            $sshKeyName = $privateKey->name;
+            $uploadedKey = $hetznerService->uploadSshKey($sshKeyName, $publicKey);
+            $sshKeyId = $uploadedKey['id'];
+            ray('Uploaded new SSH key', ['ssh_key_id' => $sshKeyId, 'name' => $sshKeyName]);
+        }
+
+        // Normalize server name to lowercase for RFC 1123 compliance
+        $normalizedServerName = strtolower(trim($this->server_name));
+
+        // Prepare SSH keys array: Coolify key + user-selected Hetzner keys
+        $sshKeys = array_merge(
+            [$sshKeyId], // Coolify key (always included)
+            $this->selectedHetznerSshKeyIds // User-selected Hetzner keys
+        );
+
+        // Remove duplicates in case the Coolify key was also selected
+        $sshKeys = array_unique($sshKeys);
+        $sshKeys = array_values($sshKeys); // Re-index array
+
+        // Prepare server creation parameters
+        $params = [
+            'name' => $normalizedServerName,
+            'server_type' => $this->selected_server_type,
+            'image' => $this->selected_image,
+            'location' => $this->selected_location,
+            'start_after_create' => true,
+            'ssh_keys' => $sshKeys,
+            'public_net' => [
+                'enable_ipv4' => $this->enable_ipv4,
+                'enable_ipv6' => $this->enable_ipv6,
+            ],
+        ];
+
+        // Add cloud-init script if provided
+        if (! empty($this->cloud_init_script)) {
+            $params['user_data'] = $this->cloud_init_script;
+        }
+
+        ray('Server creation parameters', $params);
+
+        // Create server on Hetzner
+        $hetznerServer = $hetznerService->createServer($params);
+
+        ray('Hetzner server created', $hetznerServer);
+
+        return $hetznerServer;
+    }
+
+    public function submit()
+    {
+        $this->validate();
+
+        try {
+            $this->authorize('create', Server::class);
+
+            if (Team::serverLimitReached()) {
+                return $this->dispatch('error', 'You have reached the server limit for your subscription.');
+            }
+
+            // Save cloud-init script if requested
+            if ($this->save_cloud_init_script && ! empty($this->cloud_init_script) && ! empty($this->cloud_init_script_name)) {
+                $this->authorize('create', CloudInitScript::class);
+
+                CloudInitScript::create([
+                    'team_id' => currentTeam()->id,
+                    'name' => $this->cloud_init_script_name,
+                    'script' => $this->cloud_init_script,
+                ]);
+            }
+
+            $hetznerToken = $this->getHetznerToken();
+
+            // Create server on Hetzner
+            $hetznerServer = $this->createHetznerServer($hetznerToken);
+
+            // Determine IP address to use (prefer IPv4, fallback to IPv6)
+            $ipAddress = null;
+            if ($this->enable_ipv4 && isset($hetznerServer['public_net']['ipv4']['ip'])) {
+                $ipAddress = $hetznerServer['public_net']['ipv4']['ip'];
+            } elseif ($this->enable_ipv6 && isset($hetznerServer['public_net']['ipv6']['ip'])) {
+                $ipAddress = $hetznerServer['public_net']['ipv6']['ip'];
+            }
+
+            if (! $ipAddress) {
+                throw new \Exception('No public IP address available. Enable at least one of IPv4 or IPv6.');
+            }
+
+            // Create server in Coolify database
+            $server = Server::create([
+                'name' => $this->server_name,
+                'ip' => $ipAddress,
+                'user' => 'root',
+                'port' => 22,
+                'team_id' => currentTeam()->id,
+                'private_key_id' => $this->private_key_id,
+                'cloud_provider_token_id' => $this->selected_token_id,
+                'hetzner_server_id' => $hetznerServer['id'],
+            ]);
+
+            $server->proxy->set('status', 'exited');
+            $server->proxy->set('type', ProxyTypes::TRAEFIK->value);
+            $server->save();
+
+            return redirect()->route('server.show', $server->uuid);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.server.new.by-hetzner');
+    }
+}

app/Livewire/Server/Show.php

@@ -67,13 +67,21 @@ class Show extends Component
 
     public string $serverTimezone;
 
+    public ?string $hetznerServerStatus = null;
+
+    public bool $hetznerServerManuallyStarted = false;
+
+    public bool $isValidating = false;
+
     public function getListeners()
     {
         $teamId = $this->server->team_id ?? auth()->user()->currentTeam()->id;
 
         return [
             'refreshServerShow' => 'refresh',
+            'refreshServer' => '$refresh',
             "echo-private:team.{$teamId},SentinelRestarted" => 'handleSentinelRestarted',
+            "echo-private:team.{$teamId},ServerValidated" => 'handleServerValidated',
         ];
     }
 
@@ -138,6 +146,10 @@ class Show extends Component
             if (! $this->server->isEmpty()) {
                 $this->isBuildServerLocked = true;
             }
+            // Load saved Hetzner status and validation state
+            $this->hetznerServerStatus = $this->server->hetzner_server_status;
+            $this->isValidating = $this->server->is_validating ?? false;
+
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -218,6 +230,7 @@ class Show extends Component
             $this->isSentinelDebugEnabled = $this->server->settings->is_sentinel_debug_enabled;
             $this->sentinelUpdatedAt = $this->server->sentinel_updated_at;
             $this->serverTimezone = $this->server->settings->server_timezone;
+            $this->isValidating = $this->server->is_validating ?? false;
         }
     }
 
@@ -361,6 +374,87 @@ class Show extends Component
         }
     }
 
+    public function checkHetznerServerStatus(bool $manual = false)
+    {
+        try {
+            if (! $this->server->hetzner_server_id || ! $this->server->cloudProviderToken) {
+                $this->dispatch('error', 'This server is not associated with a Hetzner Cloud server or token.');
+
+                return;
+            }
+
+            $hetznerService = new \App\Services\HetznerService($this->server->cloudProviderToken->token);
+            $serverData = $hetznerService->getServer($this->server->hetzner_server_id);
+
+            $this->hetznerServerStatus = $serverData['status'] ?? null;
+
+            // Save status to database without triggering model events
+            if ($this->server->hetzner_server_status !== $this->hetznerServerStatus) {
+                $this->server->hetzner_server_status = $this->hetznerServerStatus;
+                $this->server->update(['hetzner_server_status' => $this->hetznerServerStatus]);
+            }
+            if ($manual) {
+                $this->dispatch('success', 'Server status refreshed: '.ucfirst($this->hetznerServerStatus ?? 'unknown'));
+            }
+
+            // If Hetzner server is off but Coolify thinks it's still reachable, update Coolify's state
+            if ($this->hetznerServerStatus === 'off' && $this->server->settings->is_reachable) {
+                ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
+                if ($uptime) {
+                    $this->dispatch('success', 'Server is reachable.');
+                    $this->server->settings->is_reachable = $this->isReachable = true;
+                    $this->server->settings->is_usable = $this->isUsable = true;
+                    $this->server->settings->save();
+                    ServerReachabilityChanged::dispatch($this->server);
+                } else {
+                    $this->dispatch('error', 'Server is not reachable.', 'Please validate your configuration and connection.<br><br>Check this <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br>Error: '.$error);
+
+                    return;
+                }
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function handleServerValidated($event = null)
+    {
+        // Check if event is for this server
+        if ($event && isset($event['serverUuid']) && $event['serverUuid'] !== $this->server->uuid) {
+            return;
+        }
+
+        // Refresh server data
+        $this->server->refresh();
+        $this->syncData();
+
+        // Update validation state
+        $this->isValidating = $this->server->is_validating ?? false;
+        $this->dispatch('refreshServerShow');
+        $this->dispatch('refreshServer');
+    }
+
+    public function startHetznerServer()
+    {
+        try {
+            if (! $this->server->hetzner_server_id || ! $this->server->cloudProviderToken) {
+                $this->dispatch('error', 'This server is not associated with a Hetzner Cloud server or token.');
+
+                return;
+            }
+
+            $hetznerService = new \App\Services\HetznerService($this->server->cloudProviderToken->token);
+            $hetznerService->powerOnServer($this->server->hetzner_server_id);
+
+            $this->hetznerServerStatus = 'starting';
+            $this->server->update(['hetzner_server_status' => 'starting']);
+            $this->hetznerServerManuallyStarted = true; // Set flag to trigger auto-validation when running
+            $this->dispatch('success', 'Hetzner server is starting...');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function submit()
     {
         try {

app/Livewire/Server/ValidateAndInstall.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Server;
 
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
+use App\Events\ServerValidated;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -63,6 +64,19 @@ class ValidateAndInstall extends Component
         $this->init();
     }
 
+    public function retry()
+    {
+        $this->authorize('update', $this->server);
+        $this->uptime = null;
+        $this->supported_os_type = null;
+        $this->docker_installed = null;
+        $this->docker_compose_installed = null;
+        $this->docker_version = null;
+        $this->error = null;
+        $this->number_of_tries = 0;
+        $this->init();
+    }
+
     public function validateConnection()
     {
         $this->authorize('update', $this->server);
@@ -136,8 +150,12 @@ class ValidateAndInstall extends Component
         } else {
             $this->docker_version = $this->server->validateDockerEngineVersion();
             if ($this->docker_version) {
+                // Mark validation as complete
+                $this->server->update(['is_validating' => false]);
+
                 $this->dispatch('refreshServerShow');
                 $this->dispatch('refreshBoardingIndex');
+                ServerValidated::dispatch($this->server->team_id, $this->server->uuid);
                 $this->dispatch('success', 'Server validated, proxy is starting in a moment.');
                 $proxyShouldRun = CheckProxy::run($this->server, true);
                 if (! $proxyShouldRun) {

app/Models/CloudInitScript.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class CloudInitScript extends Model
+{
+    protected $fillable = [
+        'team_id',
+        'name',
+        'script',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'script' => 'encrypted',
+        ];
+    }
+
+    public function team()
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public static function ownedByCurrentTeam(array $select = ['*'])
+    {
+        $selectArray = collect($select)->concat(['id']);
+
+        return self::whereTeamId(currentTeam()->id)->select($selectArray->all());
+    }
+}

app/Models/CloudProviderToken.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class CloudProviderToken extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'token' => 'encrypted',
+    ];
+
+    public function team()
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public function servers()
+    {
+        return $this->hasMany(Server::class);
+    }
+
+    public function hasServers(): bool
+    {
+        return $this->servers()->exists();
+    }
+
+    public static function ownedByCurrentTeam(array $select = ['*'])
+    {
+        $selectArray = collect($select)->concat(['id']);
+
+        return self::whereTeamId(currentTeam()->id)->select($selectArray->all());
+    }
+
+    public function scopeForProvider($query, string $provider)
+    {
+        return $query->where('provider', $provider);
+    }
+}

app/Models/PrivateKey.php

@@ -289,6 +289,17 @@ class PrivateKey extends BaseModel
         }
     }
 
+    public static function generateMd5Fingerprint($privateKey)
+    {
+        try {
+            $key = PublicKeyLoader::load($privateKey);
+
+            return $key->getPublicKey()->getFingerprint('md5');
+        } catch (\Throwable $e) {
+            return null;
+        }
+    }
+
     public static function fingerprintExists($fingerprint, $excludeId = null)
     {
         $query = self::query()

app/Models/Server.php

@@ -136,6 +136,7 @@ class Server extends BaseModel
                 $destination->delete();
             });
             $server->settings()->delete();
+            $server->sslCertificates()->delete();
         });
     }
 
@@ -161,7 +162,11 @@ class Server extends BaseModel
         'user',
         'description',
         'private_key_id',
+        'cloud_provider_token_id',
         'team_id',
+        'hetzner_server_id',
+        'hetzner_server_status',
+        'is_validating',
     ];
 
     protected $guarded = [];
@@ -889,6 +894,16 @@ $schema://$host {
         return $this->belongsTo(PrivateKey::class);
     }
 
+    public function cloudProviderToken()
+    {
+        return $this->belongsTo(CloudProviderToken::class);
+    }
+
+    public function sslCertificates()
+    {
+        return $this->hasMany(SslCertificate::class);
+    }
+
     public function muxFilename()
     {
         return 'mux_'.$this->uuid;
@@ -1327,7 +1342,7 @@ $schema://$host {
                 isCaCertificate: true,
                 validityDays: 10 * 365
             );
-            $caCertificate = SslCertificate::where('server_id', $this->id)->where('is_ca_certificate', true)->first();
+            $caCertificate = $this->sslCertificates()->where('is_ca_certificate', true)->first();
             ray('CA certificate generated', $caCertificate);
             if ($caCertificate) {
                 $certificateContent = $caCertificate->ssl_certificate;

app/Models/Team.php

@@ -258,6 +258,11 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         return $this->hasMany(PrivateKey::class);
     }
 
+    public function cloudProviderTokens()
+    {
+        return $this->hasMany(CloudProviderToken::class);
+    }
+
     public function sources()
     {
         $sources = collect([]);

app/Notifications/Server/HetznerDeletionFailed.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Notifications\Server;
+
+use App\Notifications\CustomEmailNotification;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+
+class HetznerDeletionFailed extends CustomEmailNotification
+{
+    public function __construct(public int $hetznerServerId, public int $teamId, public string $errorMessage)
+    {
+        $this->onQueue('high');
+    }
+
+    public function via(object $notifiable): array
+    {
+        ray('hello');
+        ray($notifiable);
+
+        return $notifiable->getEnabledChannels('hetzner_deletion_failed');
+    }
+
+    public function toMail(): MailMessage
+    {
+        $mail = new MailMessage;
+        $mail->subject("Coolify: [ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId}");
+        $mail->view('emails.hetzner-deletion-failed', [
+            'hetznerServerId' => $this->hetznerServerId,
+            'errorMessage' => $this->errorMessage,
+        ]);
+
+        return $mail;
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        return new DiscordMessage(
+            title: ':cross_mark: Coolify: [ACTION REQUIRED] Failed to delete Hetzner server',
+            description: "Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud.\n\n**Error:** {$this->errorMessage}\n\nThe server has been removed from Coolify, but may still exist in your Hetzner Cloud account. Please check your Hetzner Cloud console and manually delete the server if needed.",
+            color: DiscordMessage::errorColor(),
+        );
+    }
+
+    public function toTelegram(): array
+    {
+        return [
+            'message' => "Coolify: [ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud.\n\nError: {$this->errorMessage}\n\nThe server has been removed from Coolify, but may still exist in your Hetzner Cloud account. Please check your Hetzner Cloud console and manually delete the server if needed.",
+        ];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        return new PushoverMessage(
+            title: 'Hetzner Server Deletion Failed',
+            level: 'error',
+            message: "[ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId}.\n\nError: {$this->errorMessage}\n\nThe server has been removed from Coolify, but may still exist in your Hetzner Cloud account. Please check and manually delete if needed.",
+        );
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        return new SlackMessage(
+            title: 'Coolify: [ACTION REQUIRED] Hetzner Server Deletion Failed',
+            description: "Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud.\n\nError: {$this->errorMessage}\n\nThe server has been removed from Coolify, but may still exist in your Hetzner Cloud account. Please check your Hetzner Cloud console and manually delete the server if needed.",
+            color: SlackMessage::errorColor()
+        );
+    }
+}

app/Policies/CloudInitScriptPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\CloudInitScript;
+use App\Models\User;
+
+class CloudInitScriptPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, CloudInitScript $cloudInitScript): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, CloudInitScript $cloudInitScript): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, CloudInitScript $cloudInitScript): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, CloudInitScript $cloudInitScript): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, CloudInitScript $cloudInitScript): bool
+    {
+        return $user->isAdmin();
+    }
+}

app/Policies/CloudProviderTokenPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\CloudProviderToken;
+use App\Models\User;
+
+class CloudProviderTokenPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, CloudProviderToken $cloudProviderToken): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, CloudProviderToken $cloudProviderToken): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, CloudProviderToken $cloudProviderToken): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, CloudProviderToken $cloudProviderToken): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, CloudProviderToken $cloudProviderToken): bool
+    {
+        return $user->isAdmin();
+    }
+}

app/Rules/ValidCloudInitYaml.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Symfony\Component\Yaml\Exception\ParseException;
+use Symfony\Component\Yaml\Yaml;
+
+class ValidCloudInitYaml implements ValidationRule
+{
+    /**
+     * Run the validation rule.
+     *
+     * Validates that the cloud-init script is either:
+     * - Valid YAML format (for cloud-config)
+     * - Valid bash script (starting with #!)
+     * - Empty/null (optional field)
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (empty($value)) {
+            return;
+        }
+
+        $script = trim($value);
+
+        // If it's a bash script (starts with shebang), skip YAML validation
+        if (str_starts_with($script, '#!')) {
+            return;
+        }
+
+        // If it's a cloud-config file (starts with #cloud-config), validate YAML
+        if (str_starts_with($script, '#cloud-config')) {
+            // Remove the #cloud-config header and validate the rest as YAML
+            $yamlContent = preg_replace('/^#cloud-config\s*/m', '', $script, 1);
+
+            try {
+                Yaml::parse($yamlContent);
+            } catch (ParseException $e) {
+                $fail('The :attribute must be valid YAML format. Error: '.$e->getMessage());
+            }
+
+            return;
+        }
+
+        // If it doesn't start with #! or #cloud-config, try to parse as YAML
+        // (some users might omit the #cloud-config header)
+        try {
+            Yaml::parse($script);
+        } catch (ParseException $e) {
+            $fail('The :attribute must be either a valid bash script (starting with #!) or valid cloud-config YAML. YAML parse error: '.$e->getMessage());
+        }
+    }
+}

app/Rules/ValidHostname.php

@@ -0,0 +1,114 @@
+<?php
+
+namespace App\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Support\Facades\Log;
+
+class ValidHostname implements ValidationRule
+{
+    /**
+     * Run the validation rule.
+     *
+     * Validates hostname according to RFC 1123:
+     * - Must be 1-253 characters total
+     * - Each label (segment between dots) must be 1-63 characters
+     * - Labels can contain lowercase letters (a-z), digits (0-9), and hyphens (-)
+     * - Labels cannot start or end with a hyphen
+     * - Labels cannot be all numeric
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (empty($value)) {
+            return;
+        }
+
+        $hostname = trim($value);
+
+        // Check total length (RFC 1123: max 253 characters)
+        if (strlen($hostname) > 253) {
+            $fail('The :attribute must not exceed 253 characters.');
+
+            return;
+        }
+
+        // Check for dangerous shell metacharacters
+        $dangerousChars = [
+            ';', '|', '&', '$', '`', '(', ')', '{', '}',
+            '<', '>', '\n', '\r', '\0', '"', "'", '\\',
+            '!', '*', '?', '[', ']', '~', '^', ':', '#',
+            '@', '%', '=', '+', ',', ' ',
+        ];
+
+        foreach ($dangerousChars as $char) {
+            if (str_contains($hostname, $char)) {
+                try {
+                    $logData = [
+                        'hostname' => $hostname,
+                        'character' => $char,
+                    ];
+
+                    if (function_exists('request') && app()->has('request')) {
+                        $logData['ip'] = request()->ip();
+                    }
+
+                    if (function_exists('auth') && app()->has('auth')) {
+                        $logData['user_id'] = auth()->id();
+                    }
+
+                    Log::warning('Hostname validation failed - dangerous character', $logData);
+                } catch (\Throwable $e) {
+                    // Ignore errors when facades are not available (e.g., in unit tests)
+                }
+
+                $fail('The :attribute contains invalid characters. Only lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
+
+                return;
+            }
+        }
+
+        // Additional validation: hostname should not start or end with a dot
+        if (str_starts_with($hostname, '.') || str_ends_with($hostname, '.')) {
+            $fail('The :attribute cannot start or end with a dot.');
+
+            return;
+        }
+
+        // Check for consecutive dots
+        if (str_contains($hostname, '..')) {
+            $fail('The :attribute cannot contain consecutive dots.');
+
+            return;
+        }
+
+        // Split into labels (segments between dots)
+        $labels = explode('.', $hostname);
+
+        foreach ($labels as $label) {
+            // Check label length (RFC 1123: max 63 characters per label)
+            if (strlen($label) < 1 || strlen($label) > 63) {
+                $fail('The :attribute contains an invalid label. Each segment must be 1-63 characters.');
+
+                return;
+            }
+
+            // Check if label starts or ends with hyphen
+            if (str_starts_with($label, '-') || str_ends_with($label, '-')) {
+                $fail('The :attribute contains an invalid label. Labels cannot start or end with a hyphen.');
+
+                return;
+            }
+
+            // Check if label contains only valid characters (lowercase letters, digits, hyphens)
+            if (! preg_match('/^[a-z0-9-]+$/', $label)) {
+                $fail('The :attribute contains invalid characters. Only lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
+
+                return;
+            }
+
+            // RFC 1123 allows labels to be all numeric (unlike RFC 952)
+            // So we don't need to check for all-numeric labels
+        }
+    }
+}

app/Services/HetznerService.php

@@ -0,0 +1,143 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Support\Facades\Http;
+
+class HetznerService
+{
+    private string $token;
+
+    private string $baseUrl = 'https://api.hetzner.cloud/v1';
+
+    public function __construct(string $token)
+    {
+        $this->token = $token;
+    }
+
+    private function request(string $method, string $endpoint, array $data = [])
+    {
+        $response = Http::withHeaders([
+            'Authorization' => 'Bearer '.$this->token,
+        ])
+            ->timeout(30)
+            ->retry(3, function (int $attempt, \Exception $exception) {
+                // Handle rate limiting (429 Too Many Requests)
+                if ($exception instanceof \Illuminate\Http\Client\RequestException) {
+                    $response = $exception->response;
+
+                    if ($response && $response->status() === 429) {
+                        // Get rate limit reset timestamp from headers
+                        $resetTime = $response->header('RateLimit-Reset');
+
+                        if ($resetTime) {
+                            // Calculate wait time until rate limit resets
+                            $waitSeconds = max(0, $resetTime - time());
+
+                            // Cap wait time at 60 seconds for safety
+                            return min($waitSeconds, 60) * 1000;
+                        }
+                    }
+                }
+
+                // Exponential backoff for other retriable errors: 100ms, 200ms, 400ms
+                return $attempt * 100;
+            })
+            ->{$method}($this->baseUrl.$endpoint, $data);
+
+        if (! $response->successful()) {
+            throw new \Exception('Hetzner API error: '.$response->json('error.message', 'Unknown error'));
+        }
+
+        return $response->json();
+    }
+
+    private function requestPaginated(string $method, string $endpoint, string $resourceKey, array $data = []): array
+    {
+        $allResults = [];
+        $page = 1;
+
+        do {
+            $data['page'] = $page;
+            $data['per_page'] = 50;
+
+            $response = $this->request($method, $endpoint, $data);
+
+            if (isset($response[$resourceKey])) {
+                $allResults = array_merge($allResults, $response[$resourceKey]);
+            }
+
+            $nextPage = $response['meta']['pagination']['next_page'] ?? null;
+            $page = $nextPage;
+        } while ($nextPage !== null);
+
+        return $allResults;
+    }
+
+    public function getLocations(): array
+    {
+        return $this->requestPaginated('get', '/locations', 'locations');
+    }
+
+    public function getImages(): array
+    {
+        return $this->requestPaginated('get', '/images', 'images', [
+            'type' => 'system',
+        ]);
+    }
+
+    public function getServerTypes(): array
+    {
+        return $this->requestPaginated('get', '/server_types', 'server_types');
+    }
+
+    public function getSshKeys(): array
+    {
+        return $this->requestPaginated('get', '/ssh_keys', 'ssh_keys');
+    }
+
+    public function uploadSshKey(string $name, string $publicKey): array
+    {
+        $response = $this->request('post', '/ssh_keys', [
+            'name' => $name,
+            'public_key' => $publicKey,
+        ]);
+
+        return $response['ssh_key'] ?? [];
+    }
+
+    public function createServer(array $params): array
+    {
+        ray('Hetzner createServer request', [
+            'endpoint' => '/servers',
+            'params' => $params,
+        ]);
+
+        $response = $this->request('post', '/servers', $params);
+
+        ray('Hetzner createServer response', [
+            'response' => $response,
+        ]);
+
+        return $response['server'] ?? [];
+    }
+
+    public function getServer(int $serverId): array
+    {
+        $response = $this->request('get', "/servers/{$serverId}");
+
+        return $response['server'] ?? [];
+    }
+
+    public function powerOnServer(int $serverId): array
+    {
+        $response = $this->request('post', "/servers/{$serverId}/actions/poweron");
+
+        return $response['action'] ?? [];
+    }
+
+    public function deleteServer(int $serverId): void
+    {
+        $this->request('delete', "/servers/{$serverId}");
+    }
+}

app/Traits/HasNotificationSettings.php

@@ -17,6 +17,7 @@ trait HasNotificationSettings
         'general',
         'test',
         'ssl_certificate_renewal',
+        'hetzner_deletion_failure',
     ];
 
     /**

app/View/Components/Forms/Checkbox.php

@@ -22,7 +22,7 @@ class Checkbox extends Component
         public string|bool|null $checked = false,
         public string|bool $instantSave = false,
         public bool $disabled = false,
-        public string $defaultClass = 'dark:border-neutral-700 text-coolgray-400 focus:ring-warning dark:bg-coolgray-100 rounded-sm cursor-pointer dark:disabled:bg-base dark:disabled:cursor-not-allowed',
+        public string $defaultClass = 'dark:border-neutral-700 text-coolgray-400 dark:bg-coolgray-100 rounded-sm cursor-pointer dark:disabled:bg-base dark:disabled:cursor-not-allowed focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base',
         public ?string $canGate = null,
         public mixed $canResource = null,
         public bool $autoDisable = true,

app/View/Components/Forms/Datalist.php

@@ -4,7 +4,7 @@ namespace App\View\Components\Forms;
 
 use Closure;
 use Illuminate\Contracts\View\View;
-use Illuminate\Support\Str;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -19,9 +19,27 @@ class Datalist extends Component
         public ?string $label = null,
         public ?string $helper = null,
         public bool $required = false,
-        public string $defaultClass = 'input'
+        public bool $disabled = false,
+        public bool $readonly = false,
+        public bool $multiple = false,
+        public string|bool $instantSave = false,
+        public ?string $value = null,
+        public ?string $placeholder = null,
+        public bool $autofocus = false,
+        public string $defaultClass = 'input',
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
     ) {
-        //
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+                $this->instantSave = false; // Disable instant save for unauthorized users
+            }
+        }
     }
 
     /**
@@ -36,8 +54,6 @@ class Datalist extends Component
             $this->name = $this->id;
         }
 
-        $this->label = Str::title($this->label);
-
         return view('components.forms.datalist');
     }
 }