Cheap AI on Hetzner: cloud-init recipe walkthrough

New to deputyOS? The fastest path is to run it on your laptop first — no cloud bill, no commitment. This post covers the always-on Hetzner Cloud route — the cheapest mainstream cloud for an always-on agent, once you’re ready to commit.

Hetzner is the cheapest mainstream cloud for always-on workloads. Their CX22 (2 vCPU, 4 GB RAM, 40 GB disk) is €4.51/mo — enough for OpenClaw or Hermes with comfortable headroom. deputyOS supports Hetzner via a cloud-init recipe instead of a snapshot, because snapshots on Hetzner are billed separately and we want the workflow to be friction-free.

The recipe

In the deputyOS repo at cloud-init/hetzner.yaml, there’s a small cloud-config YAML. Until v0.3.0 lands publicly, you can copy it from the picker (pick Hardware: Hetzner; it shows the YAML inline). The shape:

#cloud-config
hostname: deputyos
package_update: true
package_upgrade: false      # we don't upgrade at first boot
write_files:
  - path: /etc/deputyos/bootstrap.env
    content: |
      DEPUTYOS_PROFILE=openclaw
      DEPUTYOS_CHANNEL=stable
      DEPUTYOS_RELEASE_VERSION=<<<NEEDS_DEPUTYOS_DIST_URL>>>
runcmd:
  - curl -fsSL https://cdn.deputyos.com/stable/install/hetzner-bootstrap.sh | bash

That last line is the only network call. It pulls a small bootstrap script from cdn.deputyos.com that:

1. Downloads the signed deputyOS rootfs tarball (verifies minisign sig).
2. Untars it into /.
3. Restarts the network stack (Hetzner-specific NIC names).
4. Drops the deputywizard token into /etc/issue so the next console login shows it.
5. Starts the wizard service.

The tarball is ~700 MB for standard tier; ~2.8 GB for rich + airgap. Coming via Hetzner’s fast egress, takes <1 minute.

Step-by-step

1. Create a Hetzner Cloud account

If you don’t have one. €20 credit is on the table for new accounts at the time of writing.

2. Create a server

In the console:

• Location: pick your closest (Nuremberg, Falkenstein, Helsinki, Ashburn, Hillsboro).
• Image: Debian 12 (we layer on top of it).
• Type: CX22 (€4.51/mo).
• Networking: default; IPv4 on.
• SSH keys: add yours.
• Volumes: skip for now.
• Cloud config: paste the YAML from the picker.
• Name: whatever.

Click Create & Buy now.

3. Wait for first boot + bootstrap

This is a little slower than the DigitalOcean path because cloud-init has to fetch the tarball. Two minutes is typical.

Open the Hetzner web console (server → Console). You’ll see the cloud-init logs scroll, then:

deputyos bootstrap complete.
wizard URL: http://<public-ip>:8088/wizard?token=<...>

4. Hit the wizard

Same wizard as Pi 5 / DigitalOcean. Pick profile, paste provider key, wire channels. Five minutes.

5. Lock down ingress

Important on Hetzner: by default 0.0.0.0:8088 is reachable from the public internet. Add a Hetzner firewall (Networking → Firewalls) that:

• Allows TCP 22 from your IPs.
• Drops everything else.

Or: tailscale up on the server (the bootstrap installs tailscaled), then access the wizard via the tailnet only.

What this costs

Daily-driver setup, monthly:

• CX22: €4.51
• 20 TB egress included (you won’t use this)
• OpenRouter tokens (light load): ~€3
• Hetzner Cloud Backups: €1.13 (20% of server cost; weekly snapshots)

About €8.50/month all-in. The cheapest cloud option that’s still good.

Caveats specific to Hetzner

• No GPU options at this price tier. (Hetzner GPU dedicated servers exist; €100+/mo. Not what we’re targeting.)
• Free IPv6 only on smallest tiers; IPv4 has a per-month fee included in CX22 but worth knowing.
• No 1-Click Marketplace. The cloud-init flow is the de-facto path.
• Snapshots cost €0.01/GB/mo — Hetzner-specific gotcha; if you take snapshots, they bill separately.

None of these are problems for an deputyOS workload; just be aware.

Why Hetzner is great for deputyOS specifically

• The price: nothing else at this performance tier is this cheap.
• EU jurisdiction: matters for some users from GDPR / data-sovereignty angles.
• Generous egress: 20 TB on CX22 — you’ll never hit it for an agent workload.
• No surprises: the pricing is transparent, the console is simple, the support is responsive.
• Excellent network: Hetzner’s backbone is consistently fast everywhere.

If you’ve never used Hetzner before, the deputyOS-on-Hetzner flow is also a great first-time use of the platform.

When you’d pick something else

• You want a 1-Click flow with no YAML pasting → DigitalOcean (listing in progress).
• You want US-only data residency → Linode or DigitalOcean.
• You want free → Oracle Cloud’s always-free arm tier (24 GB RAM, 4 OCPU, ridiculous deal).
• You want to run alongside other Hetzner workloads → also Hetzner (consolidation).

The picker gives you the cloud-init YAML for whichever cloud you pick. The workflow is the same shape on all of them. deputyOS doesn’t lock you in.

After it’s running

Same as any deputyOS deployment:

• deputyctl status to confirm health.
• deputyctl doctor for the 14-check baseline.
• deputyctl backup now to write your first backup.
• deputyctl update --check periodically (or set up the timer).

And then it just runs. We have deputyOS instances on Hetzner that have been up for months without intervention. The Linux part is the boring part — we made sure.

Get the recipe, spin up a CX22, ten minutes from now you’re chatting with your own assistant.