launch-bastion

Launch the bastion: the network's public entry point and internal DNS server. It must be launched before any other role.

Syntax

rumi cloud hetzner launch-bastion \
  --api-key <token> \
  --network <network> \
  --key-pair <keypair> \
  [options]

Option

Short

Description

Default

--api-key

-k

The Hetzner Cloud project API token (or set HCLOUD_TOKEN)

Required

--region

-r

The Hetzner location to launch into

fsn1

--network

-n

Name of the network to launch into

Required

--key-pair

-K

The SSH key pair to launch with

Required

rumi cloud hetzner launch-bastion \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud \
  --key-pair rumi

Boots from the baked bastion snapshot into the network, then waits for nginx (:80, the first-boot-completion signal).
Runs BIND for the rumi.local internal zone (listening on the bastion's private IP) so the fleet can resolve each other by name.
Copies the launch private key onto the bastion (~/.ssh/rumi) so it can SSH into the rest of the fleet for DNS registration and deploys.
The bastion seeds its own DNS zone at first boot, so it needs no separate DNS-registration step.