Server Providers

Supported providers #

• Hetzner Cloud — fully integrated. Depfloy creates the machine, attaches an SSH key, and triggers the install process.
• Amazon Web Services — fully integrated. Depfloy launches an EC2 instance in the VPC and subnet you pick, opens the ports the install needs, and gives the server a fixed address with an Elastic IP.
• DigitalOcean — fully integrated. Depfloy creates the droplet, adds its SSH key to your account, and optionally puts a Cloud Firewall in front of it.
• Manual / Bring-your-own-server — no provider integration. You create the server yourself with any cloud provider (GCP, Vultr, Linode, dedicated hardware, your own laptop) and connect it to Depfloy over SSH using a bootstrap command. This is also the route for an EC2 instance or a droplet you created yourself rather than through Depfloy.

Providers you have not connected yet are still listed on the Initialize Server screen, greyed out with a link back to this page.

Connect Hetzner Cloud #

1. In your Hetzner Cloud Console, create a new API token. Give it Read & Write access to the project Depfloy will manage servers in.
2. Back in Depfloy, open Configuration → Server Providers and click Add Provider → Hetzner.
3. Paste the API token and choose a friendly name for the connection.
4. Save. The provider now shows up under Initialize Server as a one-click option.

Connect Amazon Web Services #

AWS asks for three fields: an Access Key ID, its Secret Access Key, and a Default Region. The region is only a starting point — you pick the region for each server when you create it.

1. In the AWS Console, open IAM → Users and create a user for Depfloy (or pick an existing one).
2. Attach the policy below to it. It is the complete set of permissions Depfloy uses; nothing in it grants access to anything outside EC2, and the AMI lookup is scoped to Canonical’s public Ubuntu parameters.
3. Create an access key for that user (Security credentials → Create access key), choosing the “Application running outside AWS” use case.
4. In Depfloy, open Configuration → Server Providers and click Add Provider → Amazon Web Services.
5. Paste the Access Key ID and Secret Access Key, pick a default region, and save.

Depfloy verifies the key against AWS before saving it, so a key with a typo or an expired key is rejected at this point rather than at the moment you try to create a server.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DepfloyEc2Access",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeRegions",
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeImages",
                "ec2:DescribeInstances",
                "ec2:DescribeAddresses",
                "ec2:ImportKeyPair",
                "ec2:DeleteKeyPair",
                "ec2:CreateSecurityGroup",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:AllocateAddress",
                "ec2:AssociateAddress",
                "ec2:DisassociateAddress",
                "ec2:ReleaseAddress",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DepfloyUbuntuAmiLookup",
            "Effect": "Allow",
            "Action": "ssm:GetParameter",
            "Resource": "arn:aws:ssm:*::parameter/aws/service/canonical/*"
        },
        {
            "Sid": "DepfloyPricingLookup",
            "Effect": "Allow",
            "Action": "pricing:GetProducts",
            "Resource": "*"
        },
        {
            "Sid": "DepfloyCredentialCheck",
            "Effect": "Allow",
            "Action": "sts:GetCallerIdentity",
            "Resource": "*"
        }
    ]
}

What Depfloy creates in your account #

Ordering a server creates four things, and deleting it in Depfloy removes all four:

• an EC2 instance in the subnet you picked
• a key pair, holding the public half of the key Depfloy connects with
• a security group allowing inbound 22, 80 and 443
• an Elastic IP, when you leave that option on

The security group is not the only firewall on the machine: the install also configures UFW with the same three ports. Rules you add under the server’s Firewall section apply there.

More than one AWS account #

You can connect several AWS accounts — a production one and a sandbox, say — and each server remembers which account it came from. Deleting a server always goes back to the account that created it.

Connect DigitalOcean #

DigitalOcean asks for one field: an API Token.

1. In the DigitalOcean Control Panel, open API → Tokens and click Generate New Token.
2. Give it write scope as well as read. Depfloy creates a droplet, an SSH key and — unless you turn it off — a Cloud Firewall, and none of those are read operations.
3. In Depfloy, open Configuration → Server Providers and click Add Provider → Digital Ocean.
4. Paste the token, name the connection, and save.

Depfloy calls DigitalOcean with the token before storing it, so a token with a typo in it, or one that has expired, is rejected at this point rather than when you go to create a server. That call reads your account, which means a read-only token is accepted here and then fails on the first droplet — worth setting the scope when you generate the token rather than after.

What Depfloy creates in your account #

Ordering a droplet creates up to four things, and deleting the server in Depfloy releases all four:

• an SSH key on the account, holding the public half of the key Depfloy connects with
• the droplet itself
• a Cloud Firewall, unless you turn that option off
• a Reserved IP, if you turn that option on

They are released in a deliberate order: the Reserved IP first, while the droplet still holds it, then the droplet, then the firewall and the key. A Reserved IP is free while it is attached to a droplet and billed by the hour once it is not, so releasing it before the droplet is what keeps that gap from opening.

Depfloy orders droplets with DigitalOcean’s own backups, monitoring agent and IPv6 left off, so what runs on the machine is what the install put there.

Manual / Bring-your-own-server #

You do not need to connect a provider at all. The Initialize Server flow includes a “Manual” option that hands you a one-line bootstrap command — run it on a clean Ubuntu server with SSH access and Depfloy connects to it.

Update or remove credentials #

If you need to rotate a token or disconnect a provider:

• Update — click the provider, paste the new token, and save. Existing servers continue to work uninterrupted.
• Remove — click Disconnect. A provider that still has servers cannot be disconnected: those servers need its credentials to be deleted or reached again later. Delete the servers first, or leave the provider connected.

For the actual server creation flow, see Initialize Server.