Connect Hetzner and set up your node

Your node is the server that receives, scrubs and stores your workspace's errors. It runs in your Hetzner Cloud project and Hetzner bills it to you; Belvador creates and maintains it. One workspace has one node, shared by all its projects.

Before you start#

• You are an owner or admin of the workspace, with two-factor authentication turned on.

• A Hetzner Cloud account with a payment method.

1. Create a dedicated Hetzner project#

In Hetzner Console, create a new project named “Belvador”. A Hetzner API token controls a whole project, so a separate project means the token can only touch Belvador's machine. Do not put other servers in it.

2. Generate an API token#

In that project open Security → API Tokens → Generate API token and choose Read & Write — Belvador needs to create the server and firewall. Hetzner shows the token only once: copy it now.

3. Connect it in Belvador#

Open Node → Connect Hetzner, paste the token, confirm with your authenticator code and choose a Token custody mode:

The token is sent from your browser straight to Belvador's vault. It never passes through the Belvador app or its database, and the vault is the only part of Belvador that talks to Hetzner. After connecting, the page shows Hetzner connected with the last characters of the token so you can recognise it.

4. Create the node#

Choose Create node. Belvador picks the cheapest machine that fits — cx23, or the ARM cax11 when cx23 is sold out — in Falkenstein, Nuremberg or Helsinki. Hetzner bills it to your account at its hourly rate.

The timeline shows each step:

1. Check token

2. Create firewall

3. Create server

4. Start server

5. Enroll agent — the node proves its identity to Belvador with a one-time ticket

6. Harden host

7. Connect to edge

8. Install node software

9. Health check

10. Ready

You can leave the page; setup continues in the background. In our tests it took about 90 seconds; Hetzner capacity can make it slower.

If a step fails, the timeline shows which one with a short explanation and Retry from this step. You can expand the log for details. With Strict custody, setup may pause and ask for a temporary token.

What runs on the node#

• No inbound ports are open, SSH included. The node only connects out — to Belvador's edge and, for backups, to Cloudflare R2.

• Belvador's agent installs only signed node software and keeps it updated — see Updates.

• Your errors are stored on the node's disk; your browser reads them through edge.belvador.dev with short-lived signed tickets.

• The node also judges your monitors. After it reconnects, it first takes in what the edge buffered while it was away (up to 10 minutes) so it never reports a run as missed just because it could not hear it.

Responsibilities#

Changing the server, its firewall or its disk in Hetzner Console yourself can break the node. Use the actions on the Node page instead.

If you revoke the token in Hetzner#

The node keeps running and receiving errors. Operations that need Hetzner — resizing, rebuilding, deleting — fail until Belvador has a valid token again. With Strict custody this is expected: you provide a temporary token when an operation needs one.