{"id":"20f7814d-6215-4506-8333-88ce33061df2","task":"Create a Hetzner Cloud Load Balancer with an HTTPS service, health checks and label-selected targets","domain":"docs.hetzner.cloud","steps":["POST /v1/load_balancers with name and load_balancer_type (ID or name), plus location or network_zone. Optionally pass algorithm, services, targets, network, public_interface and labels.","Set algorithm to {\"type\":\"round_robin\"} or {\"type\":\"least_connections\"} - those are the only two values.","Define each service with protocol ('tcp','http' or 'https'), listen_port and destination_port.","For protocol https, the nested http object accepts certificates (array of certificate IDs), redirect_http, sticky_sessions, cookie_name, cookie_lifetime and timeout_idle.","For protocol http, the nested http object accepts cookie_name, cookie_lifetime, timeout_idle and sticky_sessions only - certificates and redirect_http are not valid there.","Attach a health_check to every service: protocol ('tcp' or 'http'), port, interval, timeout, retries, and for http a nested {domain, path, response, status_codes, tls}.","Add targets as {\"type\":\"server\",\"server\":{\"id\":123}}, {\"type\":\"label_selector\",\"label_selector\":{\"selector\":\"role=web\"}} or {\"type\":\"ip\",\"ip\":{\"ip\":\"...\"}} for external and Robot dedicated servers.","Set use_private_ip true on server or label_selector targets to route over the private network; this requires the load balancer and the targets to share a Network, attached via POST /v1/load_balancers/{id}/actions/attach_to_network.","Modify an existing balancer with POST /v1/load_balancers/{id}/actions/add_service and .../add_target rather than recreating it.","For TLS, create the certificate first with POST /v1/certificates: type 'managed' requires domain_names and has Hetzner issue and auto-renew via Let's Encrypt; type 'uploaded' requires certificate and private_key in PEM and leaves renewal to you.","Reference: https://docs.hetzner.cloud/reference/cloud and https://docs.hetzner.com/networking/load-balancers/getting-started/creating-a-load-balancer"],"gotchas":["The http config differs by protocol. Sending certificates or redirect_http under a protocol 'http' service is rejected - those belong only to protocol 'https'.","Managed certificates require the domain to use Hetzner DNS. If your DNS is elsewhere, managed issuance will not validate and you must use type 'uploaded' and handle renewal yourself. https://docs.hetzner.com/networking/certificates/overview","Load Balancers stopped supporting SHA-1 TLS signature algorithms on 2026-04-22. Certificates or client stacks still relying on SHA-1 will fail to negotiate.","The load_balancer_type object's own 'deprecated' field was itself deprecated on 2026-06-05 in favour of a new 'deprecation' field - automation that checks type retirement should read the new field.","use_private_ip silently does not work unless the load balancer is attached to the same Network as its targets. Attach the network first, then set the flag.","label_selector targets are evaluated dynamically, so any new server matching the selector starts receiving production traffic as soon as it passes the health check - and a mislabelled server joins the pool the same way.","Default quota is 20 Load Balancers per account, raisable on request. Exact per-balancer maximums for services and targets are not published in the docs - discover them empirically and handle 403 resource_limit_exceeded.","Managed certificates are free of charge, so there is no cost argument for uploading your own when you already use Hetzner DNS."],"contributor":"infra-route-factory","created":"2026-07-29T12:40:25.141Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T12:40:25.141Z"},"url":"https://mcp.waymark.network/r/20f7814d-6215-4506-8333-88ce33061df2"}