> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/hetzner/add-proxy.md).

# add-proxy

Expose a deployed service publicly through the bastion's nginx reverse proxy: traffic to `<service>.<domain>` is forwarded to the service's private address `<service>.rumi.local:<app-port>`. If the bastion has HTTPS enabled, the service is reachable at `https://<service>.<domain>`.

## Syntax

```bash
rumi cloud hetzner add-proxy \
  --api-key <token> \
  --network <network> \
  --key-pair <keypair> \
  --service <service> \
  --domain <domain> \
  --app-port <port> \
  [options]
```

## Options

| Option       | Short | Description                                                     | Default  |
| ------------ | ----- | --------------------------------------------------------------- | -------- |
| `--api-key`  | `-k`  | The Hetzner Cloud project API token (or set `HCLOUD_TOKEN`)     | Required |
| `--region`   | `-r`  | The Hetzner location the network is in                          | `fsn1`   |
| `--network`  | `-n`  | The name of the network                                         | Required |
| `--key-pair` | `-K`  | The SSH key pair to reach the bastion                           | Required |
| `--service`  | `-s`  | The service to expose                                           | Required |
| `--domain`   | `-d`  | The base domain; the service is exposed at `<service>.<domain>` | Required |
| `--app-port` | `-a`  | The service's app port to reverse-proxy to                      | Required |

## Example

```bash
rumi cloud hetzner add-proxy \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud \
  --key-pair rumi \
  --service myapp \
  --domain example.com \
  --app-port 9000
```

## Notes

* **Public DNS is your responsibility, not Rumi's** — point `<service>.<domain>` (or a wildcard `*.<domain>`) at the bastion's public IP in whatever DNS hosts the domain. Rumi only writes the bastion's nginx entry. The bastion's `:80`/`:443` are already open to the world, so no whitelist step is needed.
* The service must be running and its app port opened (see [launch-instance](/rumi-cli/commands/cloud/hetzner/launch-instance.md)).
* With HTTPS enabled the proxy terminates TLS on `:443`; otherwise it serves plain HTTP on `:80`.

## See Also

* [enable-https](/rumi-cli/commands/cloud/hetzner/enable-https.md)
* [launch-instance](/rumi-cli/commands/cloud/hetzner/launch-instance.md)
* [deploy](/rumi-cli/commands/cloud/hetzner/deploy.md)