letsencrypt: add hetzner cloud dns api

[BlackReloaded]

Summary by CodeRabbit

• New Features
  • Added Hetzner Cloud DNS provider for automated certificate issuance and renewal.
  • New configuration option to supply a Hetzner Cloud API token for DNS validation.
  • DNS-based validation now available for Hetzner Cloud, enabling seamless, automatic certificate management.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

fixes: #4276

[home-assistant]

Hi @BlackReloaded

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

[home-assistant]

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

[home-assistant]

Hi @BlackReloaded

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

Stale

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request adds support for a new DNS provider, dns-hetzner-cloud, across the application stack. Changes include documentation updates, build configuration additions, container image modifications, and runtime script enhancements to support the new provider alongside existing DNS providers.

Changes

Cohort / File(s)	Summary
Documentation and Configuration Schema letsencrypt/DOCS.md, letsencrypt/config.yaml	Added dns-hetzner-cloud to the supported DNS providers list and introduced new hetzner_cloud_api_token credential field in the DNS configuration schema.
Build Configuration & Image letsencrypt/Dockerfile, letsencrypt/build.yaml	Added CERTBOT_DNS_HETZNER_CLOUD_VERSION build ARG / env (set to 1.0.4) and integrated certbot-dns-hetzner-cloud==${CERTBOT_DNS_HETZNER_CLOUD_VERSION} into the pip install step.
Runtime / Init Scripts letsencrypt/rootfs/etc/cont-init.d/file-structure.sh, letsencrypt/rootfs/etc/services.d/lets-encrypt/run	Persisted dns_hetzner_cloud_api_token to the DNS API key output and added a dns-hetzner-cloud branch in the DNS provider switch that appends the provider-specific credential and propagation arguments.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

• Review consistency of the hetzner_cloud_api_token naming across config.yaml, file-structure.sh, and the run script.
• Confirm CERTBOT_DNS_HETZNER_CLOUD_VERSION value (1.0.4) is correct and matches any release notes or compatibility requirements.
• Verify the pip install line formatting and that adding the package doesn’t conflict with other certbot DNS plugin versions.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically identifies the main change: adding Hetzner Cloud DNS API support to the letsencrypt addon.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between cb47362 and 4421ca4.

📒 Files selected for processing (2)

• letsencrypt/DOCS.md (4 hunks)
• letsencrypt/rootfs/etc/services.d/lets-encrypt/run (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• letsencrypt/rootfs/etc/services.d/lets-encrypt/run

🧰 Additional context used

📓 Path-based instructions (1)

*/**(html|markdown|md)

⚙️ CodeRabbit configuration file

*/**(html|markdown|md): - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure the goal of the instruction is fronted.

• Apply the Microsoft Style Guide to ensure documentation maintains clarity and conciseness.
• In step-by-step instructions, front the location phrase in the instructional sentence.
• In step-by-step instructions, front the 'goal' in the instructional sentence.
• In step-by-step instructions, if in doubt what to front, front the 'goal' before the location phrase in the instructional sentence.
• do not hyphenate terms like 'top-right' or 'bottom-left' with 'corner'

*/**(html|markdown|md): - Use bold to mark UI strings.

• If "" are used to mark UI strings, replace them by bold.

• Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"

• Use sentence-style capitalization also in headings.

do not comment on HTML used for icons

Avoid flagging inline HTML for embedding videos in future reviews for this repository.

Files:

• letsencrypt/DOCS.md

🔇 Additional comments (1)

letsencrypt/DOCS.md (1)

65-65: All provider lists are now properly synchronized.

The previous concern about missing dns-hetzner-cloud from the "Supported DNS providers" list has been resolved. The new provider is correctly added across all three required locations:

• Line 65: Added to the inline provider list in alphabetical order (between dns-hetzner and dns-infomaniak)
• Line 136: Added to the credentials section in alphabetical order
• Lines 848–867: Added comprehensive configuration documentation with example and link to full documentation
• Line 1479: Added to the summary "Supported DNS providers" list in alphabetical order

All entries maintain consistent formatting and alphabetical ordering throughout the documentation.

Also applies to: 136-136, 848-867, 1479-1479

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

letsencrypt/rootfs/etc/services.d/lets-encrypt/run (1)

185-189: dns-hetzner-cloud case logic looks good; clarify the comment label

The new dns-hetzner-cloud branch correctly requires dns.hetzner_cloud_api_token and assembles ACME_ARGUMENTS in line with the other DNS providers. To avoid confusion with the existing # Hetzner block above, consider renaming this comment to # Hetzner Cloud.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 2f6933d and cb47362.

📒 Files selected for processing (6)

• letsencrypt/DOCS.md (2 hunks)
• letsencrypt/Dockerfile (2 hunks)
• letsencrypt/build.yaml (1 hunks)
• letsencrypt/config.yaml (2 hunks)
• letsencrypt/rootfs/etc/cont-init.d/file-structure.sh (1 hunks)
• letsencrypt/rootfs/etc/services.d/lets-encrypt/run (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

*/**(html|markdown|md)

⚙️ CodeRabbit configuration file

*/**(html|markdown|md): - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure the goal of the instruction is fronted.

• Apply the Microsoft Style Guide to ensure documentation maintains clarity and conciseness.
• In step-by-step instructions, front the location phrase in the instructional sentence.
• In step-by-step instructions, front the 'goal' in the instructional sentence.
• In step-by-step instructions, if in doubt what to front, front the 'goal' before the location phrase in the instructional sentence.
• do not hyphenate terms like 'top-right' or 'bottom-left' with 'corner'

*/**(html|markdown|md): - Use bold to mark UI strings.

• If "" are used to mark UI strings, replace them by bold.

• Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"

• Use sentence-style capitalization also in headings.

do not comment on HTML used for icons

Avoid flagging inline HTML for embedding videos in future reviews for this repository.

Files:

• letsencrypt/Dockerfile
• letsencrypt/config.yaml
• letsencrypt/build.yaml
• letsencrypt/DOCS.md

🔇 Additional comments (5)

letsencrypt/DOCS.md (1)

136-136: Credential key wiring looks correct

The hetzner_cloud_api_token field is added consistently alongside hetzner_api_token and matches the naming used in the new dnsapikey output and run script.

letsencrypt/build.yaml (1)

23-25: New Hetzner Cloud version arg is aligned with existing pattern

CERTBOT_DNS_HETZNER_CLOUD_VERSION is added in the same style and position as the other CERTBOT_DNS_* version args; no issues spotted.

letsencrypt/Dockerfile (1)

21-23: Docker ARG and pip install for Hetzner Cloud look consistent

The added build ARG and pip installation of certbot-dns-hetzner-cloud follow the existing pattern (alphabetical placement, version pin, and use in pip3 install). No issues found.

Also applies to: 75-77

letsencrypt/rootfs/etc/cont-init.d/file-structure.sh (1)

35-37: dnsapikey entry for Hetzner Cloud is correctly wired

The dns_hetzner_cloud_api_token line matches the new dns.hetzner_cloud_api_token config option and follows the same format and ordering as the existing dns_hetzner_api_token entry.

letsencrypt/config.yaml (1)

77-79: Schema updates for Hetzner Cloud are coherent and consistent

The hetzner_cloud_api_token field and dns-hetzner-cloud provider enum entry integrate cleanly with the existing DNS schema and respect the alphabetical ordering note. They line up with the new file-structure and run-script handling.

Also applies to: 133-136

[Dominik28111]

Any ETA on that? My cert expired and my UI is currently not useable with SSL.

[Dominik28111]

Change works like a charm on my fork ❤️

[martinbrook]

Any ETA on that? My cert expired and my UI is currently not useable with SSL.

Any update on getting this merged as the old API does not allow new names to be added since November 10th, https://www.hetzner.com/news/dns-beta/

[danido95]

Any ETA on that? My cert expired and my UI is currently not useable with SSL.

Any update on getting this merged as the old API does not allow new names to be added since November 10th, https://www.hetzner.com/news/dns-beta/

Any update on this would be nice, because I need to switch to the new Hetzner API.

[svalcken]

how can i use this? my AddOn is 5.4.9 and has not the Provider Hetzner Cloud.
i will migrate my DNS to new Hetzner Cloud DNS but without this Plugin, i must wait for it.

[Dominik28111]

how can i use this? my AddOn is 5.4.9 and has not the Provider Hetzner Cloud. i will migrate my DNS to new Hetzner Cloud DNS but without this Plugin, i must wait for it.

You can use my fork (repo has-addons). Save config from official one, if configured. Then uninstall it and go to Settings > Add-ons > Add-on store , click the three dots menu in the top right corner, select repositories and add the url of mine there. When searching for Let's encrypt you will see one from Core and one from Home Assistant Addons (my repo), install it from mine. Now you are able to temporarily use this change until it's merged officially.

[martinbrook]

how can i use this? my AddOn is 5.4.9 and has not the Provider Hetzner Cloud. i will migrate my DNS to new Hetzner Cloud DNS but without this Plugin, i must wait for it.

You can use my fork (repo has-addons). Save config from official one, if configured. Then uninstall it and go to Settings > Add-ons > Add-on store , click the three dots menu in the top right corner, select repositories and add the url of mine there. When searching for Let's encrypt you will see one from Core and one from Home Assistant Addons (my repo), install it from mine. Now you are able to temporarily use this change until it's merged officially.

Perfect, pulling from your fork works like a charm on my system, thanks for your work on this. Merry Xmas

[Dominik28111]

how can i use this? my AddOn is 5.4.9 and has not the Provider Hetzner Cloud. i will migrate my DNS to new Hetzner Cloud DNS but without this Plugin, i must wait for it.

You can use my fork (repo has-addons). Save config from official one, if configured. Then uninstall it and go to Settings > Add-ons > Add-on store , click the three dots menu in the top right corner, select repositories and add the url of mine there. When searching for Let's encrypt you will see one from Core and one from Home Assistant Addons (my repo), install it from mine. Now you are able to temporarily use this change until it's merged officially.

Perfect, pulling from your fork works like a charm on my system, thanks for your work on this. Merry Xmas

No problem. Merry Xmas. But don't forget the kudos for @BlackReloaded who made the change :)

[svalcken]

@Dominik28111 Thanks for your Repository. But i will not change the repository, this is a drift from master.

The change is awaiting for merge. Has anyone capacity and rights for the merge request? So it can move in the master and it must not installed from other repository.

For developing and testing the changes, it is a good way to use another repository, but not for an production system.

The Addon is at the moment for me the blocking for moving form Hetzner DNS API to the Hetzner Cloud API.

Current i will setup an Web an E-Mail Server in Hetzner with Letsenrypt. I will wait for the changes, i d'ont will made the integration doubled for old and new api.

I hope the merge will be in short next time.

[svalcken]

Why is this still stuck in the status? Who has write permissions?

[tinyoverflow]

Hey @agners, I'm sorry to ping you. This PR exists for nearly two months and the problem it fixes actually breaks setups. Can you please take a look into this, so we can get this fix pushed?

[tinyoverflow]

Hey @agners,

Is there any reason why this hasn't been merged yet or is there anything we can do to help this getting merged? I saw that other PRs are getting way more attention than this one, despite them being not as old or critical as this one.

This topic is kinda critical, as the missing patch leads to unrenewable SSL certificates resulting in broken HA setups.

I'd like to kindly ask you to take a look at this, as this shouldn't take more than 5 minutes to review.

[crazychatting]

please keep in mind: all of the hetzner domains will be migrated forcefully to the hetzner cloud in may, so all dns based challenges will have to use the new API. https://status.hetzner.com/incident/c2146c42-6dd2-4454-916a-19f07e0e5a44

So it feels like this PR is quite urgent because everyone is already migrating now as preparations.

[svalcken]

I am current also waiting for merged.

And this blocks me current to merge my domain on other Servers with the new api. Home Assistant is for me via Internet reachable and if i change the api then letsencrypt does not work with old api.

I request more attention be paid to this request.

Thanks.

[beckerj]

Verified all changes, they are consistent in syntax and style and just add the hetzner cloud provider in excactly the same fashion the old hetzner provider is integrated into the code.
Code has been verified to work as intended by me as well.