Harbor

Hetzner Cloud

Harbor on a Hetzner Cloud server, x86 or Arm, with its data on an encrypted Volume, reached at your own domain or through Tailscale.

On this page

A Hetzner Cloud server runs Harbor, and a Hetzner Volume, a separate disk you attach to it, holds the documents, encrypted. Harbor runs on both of Hetzner's server architectures, x86 and Arm.

What you need#

  • A Hetzner Cloud account and a project.
  • For the internet path: a domain you can add a DNS record to, such as harbor.example.com. For the Tailscale path: a Tailscale account instead.
  • Somewhere for backups to go, ideally not Hetzner: a Backblaze B2 bucket or an SFTP host. See Backups.

1. Create the server#

In the Cloud Console, open your project and Add Server:

  • Location: near you.
  • Image: Debian 12.
  • Type: shared vCPU with at least 2 vCPUs and 4 GB of memory. x86 (Intel or AMD) and Arm64 (Ampere) both work.
  • Networking: keep Public IPv4 switched on. Harbor's images come from GitHub's container registry, which cannot be reached over IPv6 alone.
  • SSH keys: add yours.
  • Volumes: add one of 100 GB or more, sized for scans rather than PDFs. If the console offers to format and mount it, the installer will erase that again; choosing manual mounting saves it the trouble.
  • Firewalls: see the next step.
  • Cloud config: leave empty.

Hetzner's server backups do not include Volumes. Harbor's own nightly backups are what you restore from.

2. Decide how you will reach it#

Pick one now; the firewall depends on it. Firewalls are created under Firewalls in the project and applied to the server.

At your own domain, over HTTPS. Anyone with a browser, no app needed.

  1. Create an A record for your domain pointing at the server's IPv4 address, at your domain registrar or in Hetzner's DNS.
  2. Allow inbound TCP 22 (SSH), 80 and 443. Port 80 is only used to obtain and renew the certificate.

Privately, through Tailscale. Only your own devices, nothing open to the internet. Allow inbound TCP 22 only, so you can still reach the server over SSH.

3. Run the installer#

Over SSH, as root:

ssh root@your-server-ip
curl -fsSL https://get.docker.com | sh
curl -fsSLO https://raw.githubusercontent.com/openharborhq/harbor/main/install.sh
less install.sh
sh install.sh

What to answer:

  • Where should that live? Press enter for /data.
  • How should you reach Harbor? 2 for your domain, then type the domain. Or 1 for Tailscale; the installer can install it and sign the server in.
  • Backup repository. Where backups go, or leave it empty for now.
  • Set up an encrypted volume now? Yes. Pick the disk whose size matches your Volume, usually /dev/sdb. The server's own disk is not offered. Type its name to confirm.
  • How should it unlock after a reboot? 1, you unlock it. Cloud servers have no TPM, and nobody is at a keyboard to type a passphrase at boot.

The volume's passphrase is written to /root/harbor-luks-passphrase. Copy it onto the break-glass envelope, then delete that file.

4. Create your account#

On the domain path, the installer ends with a setup link:

https://harbor.example.com/setup?token=…

Open it. The vault creates its first account only through that link, so nobody who finds your domain before you can claim the vault. The certificate is issued on that first visit; if the page does not load, the A record probably does not point at the server yet, and harbor logs caddy says so.

On the Tailscale path, open the tailnet address the installer printed.

Then continue with First run.

After a reboot#

When the server restarts, the vault stays closed until you unlock it:

ssh root@your-server-ip
harbor unlock

If SSH does not answer, the server's Console in the Cloud Console works as a keyboard and screen.