Running your app on a Hetzner VPS

A Hetzner VPS is a small Linux server in a German or Finnish datacenter that costs about €5 per month. You get root access, a public IP, and no hand-holding.

This is the opposite of Vercel. Nobody auto-scales your app. Nobody issues preview URLs from Git. You SSH in, you install Docker, you ship.

For the right person, that is freedom.

What you get for €5

Hetzner’s entry CX or CAX (ARM) plans give you roughly 2 vCPU, 4 GB RAM, and 40 GB SSD. That runs a surprising amount:

One Docker Compose stack with web, API, Postgres, Redis
Several small side projects behind reverse proxy paths
A self-hosted tool or two (Plausible, n8n, your own blog)

Bandwidth is generous for EU traffic. US-facing apps may feel farther away — pick a US location if Hetzner offers one for your plan, or accept latency.

You are billed monthly. No per-request meter. A traffic spike does not change the invoice unless you exceed included transfer or need a bigger box.

The trade-off is time. You are the platform team now.

Docker Compose deploys

My advice: never install Node or Postgres directly on the host. Use Docker Compose.

One docker-compose.yml describes your stack:

services:
  web:
    build: .
    ports:
      - "3000:3000"
    env_file: .env
    depends_on:
      - db

  db:
    image: postgres:16
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}

volumes:
  pgdata:

On the server:

git pull
docker compose up -d --build

That is your deploy pipeline until you add something fancier. GitHub Actions can SSH and run the same two commands on push to main.

Keep secrets in .env on the server, not in Git. Back up the pgdata volume or use managed Postgres if you outgrow local DB on the same disk.

Caddy for TLS

You need HTTPS. Caddy is the simplest path on a single VPS.

Caddy terminates TLS automatically with Let’s Encrypt. Point your domain’s A record at the VPS IP. Caddy handles certs and renewal.

Example Caddyfile:

api.myapp.com {
  reverse_proxy web:3000
}

Run Caddy as another Compose service or on the host proxying to container ports. One entry point, many apps — add blocks per subdomain.

No certbot cron jobs. No nginx config archaeology. Caddy’s defaults are sane.

Backups

On a VPS, you own backups.

Minimum viable plan:

Database dumps on a schedule — pg_dump to a file, copy off-server
Volume snapshots if Hetzner offers them for your plan
Object storage elsewhere — Backblaze B2, Cloudflare R2 — for dump files

Test a restore once. A backup you have never restored is a wish.

If you skip backups, accept that one bad docker volume rm ends the company.

The trade-off

Hetzner is cheap and powerful. It is also your pager.

You handle:

OS security updates
Disk filling up
Postgres upgrades
DDoS that exceeds what ufw and Caddy can shrug off
The 3 a.m. “site is down” message

That is fine when:

You enjoy ops or want to learn it
Margin matters more than sleep
The app is internal, low-stakes, or you have monitoring wired up

Skip the VPS when:

You would rather pay $20–50/month to never SSH again
Compliance needs managed infrastructure
You have no time for backup and security hygiene

StackPlan still recommends Hetzner for cost-sensitive indie apps with steady traffic — especially in Europe — when the builder accepts operational responsibility.

When it is worth it

A €5–€20 Hetzner box often beats serverless at consistent load. One Postgres, one API, one Redis — all on one machine — can serve thousands of daily users if the code is lean.

The math breaks when you need multi-region, instant autoscale, or zero ops headcount.

If you are ready to carry the pager, Hetzner is the best euro you will spend on infra. If not, that is not a failure — it is an honest read of where your time should go.