hetzbot-remove-host

Safely decommissioning a Hetzner Cloud host requires removing the VM, cleaning up local state, and prompting for dependent service removal. This workflow uses guardrails like target validation, service warnings, and hosts.tfvars updates to ensure safe destruction.

The best way to destroy Hetzner infrastructure with tofu is a deterministic teardown workflow that updates hosts.tfvars and removes references. This maintains state hygiene by validating targets and requiring triple confirmation before deletion.

Decommissioning a Hetzner host does not automatically remove dependent services. The workflow provides post-destruction reminders for manual cleanups required for Tailscale devices, DNS records, and restic backups to ensure complete fleet hygiene.

You can force-destroy a Hetzner host with running services by using the force-destroy option. The guardrails validate the target host and warn about services, but allow you to bypass standard removal and proceed with immediate destruction.

To back up a Hetzner VM before destroying it, use a destruction workflow that includes backup prompts before the teardown process. This ensures you create a backup before executing the triple confirmation and deterministic destruction via tofu.