Rails + Kamal + Hetzner Deploy Kit — production HTTPS in 15 minutes for €4/month

Deploying Rails with Kamal is supposed to be simple. In practice you lose an evening between the Hetzner console, the Cloudflare dashboard, the Kamal docs and three GitHub issues about Let's Encrypt behind a proxy.

This kit is that evening, done for you. Drop it into your Rails 7.1+ / 8 app and run four commands:

make server — creates + hardens a Hetzner box (Docker, ufw, fail2ban, swap, SSH lockdown)

make dns — Cloudflare A record + SSL Full (strict) + Always HTTPS, via API

make check — 15 preflight checks so you see what's missing BEFORE kamal setup fails

make first — kamal setup: proxy + Let's Encrypt + Postgres + web + jobs

WHAT'S INSIDE

• bin/hetzner-bootstrap.sh — idempotent server creation through the Hetzner API, waits until Docker is ready, saves the IP for you

• cloud-init/server.yaml — deploy user, Docker CE, ufw 22/80/443, fail2ban, unattended-upgrades, sshd hardening, 2 GB swap

• bin/cloudflare-dns.sh — DNS + SSL mode + Always HTTPS through the API, no dashboard clicking

• bin/preflight.sh — checks tools, secrets, SSH, Docker and DNS resolution

• config/deploy.yml — Kamal 2: kamal-proxy TLS, web + Solid Queue job roles, Postgres 16 accessory bound to localhost, persistent volume, asset_path, aliases (kamal console / logs / dbc)

• .kamal/secrets, .env.kit.example, Makefile

• docs/TROUBLESHOOTING.md — the 14 errors everyone hits (redirect loops, ACME 403 behind Cloudflare, exec format error, missing secrets, OOM on assets…) with the fix for each

• docs/CHECKLIST.md — go-live checklist

• bin/install-backups.sh + bin/backup-db.sh — nightly pg_dump to Hetzner Object Storage / Cloudflare R2 (any S3 endpoint), cron + healthcheck ping, restore instructions

• .github/workflows/deploy.yml — push-to-main deploys from GitHub Actions with a concurrency lock and /up smoke test (no local Docker needed)

Cost of the resulting stack: Hetzner cx22 ≈ €4.29/month. Cloudflare Free. Let's Encrypt free. Stop paying $25+/month to a PaaS for a side project.

Works with Rails 8 defaults (Thruster, Solid Queue), Ubuntu 24.04, and Apple Silicon builds (cross-compiles to amd64).

LICENSE & REFUNDS

Use it in unlimited personal and client projects. 14-day refund if it doesn't work for you — send me the preflight.sh output and I'll fix it or refund you.

Made by Gilber Garcia, Rails + DevOps freelancer. Every one of my own products is deployed exactly this way.