> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/hetzner/launch-instance.md).

# launch-instance

Launch a Rumi service (worker) instance into an existing network and open its application ports. The Rumi application itself is deployed onto the worker by the controller afterwards (the snapshot is base + Java only). Requires the bastion to be running.

## Syntax

```bash
rumi cloud hetzner launch-instance \
  --api-key <token> \
  --network <network> \
  --key-pair <keypair> \
  --service <name> \
  [options]
```

## Options

| Option       | Short | Description                                                         | Default  |
| ------------ | ----- | ------------------------------------------------------------------- | -------- |
| `--api-key`  | `-k`  | The Hetzner Cloud project API token (or set `HCLOUD_TOKEN`)         | Required |
| `--region`   | `-r`  | The Hetzner location to launch into                                 | `fsn1`   |
| `--network`  | `-n`  | Name of the network to launch into                                  | Required |
| `--key-pair` | `-K`  | The SSH key pair to launch with                                     | Required |
| `--service`  | `-s`  | The name of the service instance to launch                          | Required |
| `--ports`    | `-p`  | Comma-separated app ports to open to the network (e.g. `9000,9001`) | none     |

## Example

```bash
rumi cloud hetzner launch-instance \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud \
  --key-pair rumi \
  --service myapp \
  --ports 9000,9001
```

## Notes

* Boots from the baked `service` (Worker base) snapshot, labelled so both the base service firewall (SSH within the network) and a per-service app-port firewall auto-apply.
* `--ports` creates a **per-service firewall** opening those TCP ports to the network CIDR. It is applied by label, so it attaches whether it is created before or after the instance — giving dynamic app-port opening. Omitting `--ports` opens no app ports (open them later by re-running with `--ports`).
* Registers `<service>.rumi.local` on the bastion's DNS and points the worker's resolver at the bastion.
* Multiple services can coexist in one network; each gets a distinct name and its own per-service firewall. All are swept by [deprovision](/rumi-cli/commands/cloud/hetzner/deprovision.md).

## See Also

* [start-instance](/rumi-cli/commands/cloud/hetzner/start-instance.md)
* [stop-instance](/rumi-cli/commands/cloud/hetzner/stop-instance.md)
* [terminate-instance](/rumi-cli/commands/cloud/hetzner/terminate-instance.md)
* [launch-platform](/rumi-cli/commands/cloud/hetzner/launch-platform.md)
* [deprovision](/rumi-cli/commands/cloud/hetzner/deprovision.md)