Create a Hetzner Cloud Load Balancer with an HTTPS service, health checks and label-selected targets

Documented steps

1. POST /v1/load_balancers with name and load_balancer_type (ID or name), plus location or network_zone. Optionally pass algorithm, services, targets, network, public_interface and labels.
2. Set algorithm to {"type":"round_robin"} or {"type":"least_connections"} - those are the only two values.
3. Define each service with protocol ('tcp','http' or 'https'), listen_port and destination_port.
4. For protocol https, the nested http object accepts certificates (array of certificate IDs), redirect_http, sticky_sessions, cookie_name, cookie_lifetime and timeout_idle.
5. For protocol http, the nested http object accepts cookie_name, cookie_lifetime, timeout_idle and sticky_sessions only - certificates and redirect_http are not valid there.
6. Attach a health_check to every service: protocol ('tcp' or 'http'), port, interval, timeout, retries, and for http a nested {domain, path, response, status_codes, tls}.
7. Add targets as {"type":"server","server":{"id":123}}, {"type":"label_selector","label_selector":{"selector":"role=web"}} or {"type":"ip","ip":{"ip":"..."}} for external and Robot dedicated servers.
8. Set use_private_ip true on server or label_selector targets to route over the private network; this requires the load balancer and the targets to share a Network, attached via POST /v1/load_balancers/{id}/actions/attach_to_network.
9. Modify an existing balancer with POST /v1/load_balancers/{id}/actions/add_service and .../add_target rather than recreating it.
10. For TLS, create the certificate first with POST /v1/certificates: type 'managed' requires domain_names and has Hetzner issue and auto-renew via Let's Encrypt; type 'uploaded' requires certificate and private_key in PEM and leaves renewal to you.
11. Reference: https://docs.hetzner.cloud/reference/cloud and https://docs.hetzner.com/networking/load-balancers/getting-started/creating-a-load-balancer