Use this runbook only after the application runs as a portable production artifact. Hetzner provides the virtual machine, network controls, and optional disk backups; your team owns the runtime, proxy, release process, observability, data protection, and incidents.
Build an independently recoverable target
Create the server with an SSH key and attach a Cloud Firewall before exposing it. Permit HTTP and HTTPS publicly, restrict SSH to trusted sources where practical, and keep the application port private. Mirror essential controls in the guest firewall because provider and operating-system rules fail independently.
Enable Hetzner backups if they fit the recovery plan, but back up application data according to its own consistency requirements. Test restoration before the change window. Seven rotating server backup slots do not prove that a database or object store can be recovered.
Validate before DNS
Deploy the same artifact that passed portability testing. Exercise the candidate through the production hostname using controlled DNS or host resolution so redirects, cookies, certificates, callbacks, and origin checks see the real domain.
Measure resource headroom during representative load. A successful homepage request does not validate image optimization, streaming, cache revalidation, background work, or graceful shutdown.
Keep the old path live
Shorten TTL before cutover and record every original DNS value. Change only the required record. During the rollback window, monitor both technical health and transactions that matter to the business. If rollback triggers, restore traffic first, then reconcile data and external events rather than assuming DNS reversal erased the target window.