hetzner-delete

hetzner-delete

Destroy a server and remove the debris. The destroy itself is one hcloud call — the value here is the guard rails around it and the six places it leaves orphans.

Invocation: /hetzner-delete <name> — a key under servers in the roster. No default. Never operate on the fleet.default entry implicitly.

Sibling skills: /hetzner-create (provision) · /hetzner-ssh (connect).

hcloud server delete has no confirmation prompt and no --force flag. It takes a name and destroys the box immediately. Every safeguard below exists because the CLI provides none.

---

Step 0 — Resolve and check protection

cat ~/.config/hetzner/hetzner.json

Condition	Action
<name> not in servers	Print available keys and stop. Never fuzzy-match a name.
protected: true	REFUSE. Print the message below and stop. Take no snapshot, touch nothing
No <name> given	Ask. Never assume, never fall back to fleet.default

⛔ REFUSED — '<name>' is protected.

To delete it:
  1. set "protected": false in fleet.servers.<name> of ~/.config/hetzner/hetzner.json
  2. re-run this command

Nothing was touched.

The two-key rule is the point: unprotecting is a deliberate edit in another tool at another moment. Never offer to make that edit as part of this run — doing so collapses two keys into one and defeats the guard entirely.

---

Step 1 — Blast radius

Show exactly what dies and what survives. Read live state; do not trust the roster alone.

hcloud server describe <hcloud_server>
hcloud volume list   -o noheader | grep <hcloud_server> || true
hcloud floating-ip list -o noheader | grep <hcloud_server> || true
hcloud firewall describe <firewall> -o 'format={{len .AppliedTo}}' 2>/dev/null

WILL DESTROY
  server    <name>   <type>, <location>, up <N>d
  disk      <N> GB   — all data on it
  ip        <ip>     — released, NOT recoverable, may be reassigned to a stranger
  volumes   <list or none>

WILL KEEP
  firewall  <firewall>   — shared, still attached to <N> other server(s)
  ssh key   <label>      — shared across the fleet