@flui-cloud/cli 0.0.1

package/lib/src/modules/providers/implementations/hetzner/hetzner-volume-operations.service.js

@@ -0,0 +1,312 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var HetznerVolumeOperationsService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HetznerVolumeOperationsService = void 0;
+const common_1 = require("@nestjs/common");
+const kubernetes_service_1 = require("../../../infrastructure/shared/services/kubernetes.service");
+const COPY_POD_IMAGE = 'busybox:1.37';
+const SNAPSHOT_LABEL_MARKER = 'flui.cloud/pvc-clone-snapshot';
+const SOURCE_PVC_LABEL = 'flui.cloud/snapshot-of';
+const COPY_JOB_TIMEOUT_SECONDS = 30 * 60;
+/**
+ * Hetzner does not expose volume snapshots or volume cloning at the API level
+ * (https://docs.hetzner.com/cloud/volumes/, https://github.com/hetznercloud/csi-driver/issues/88).
+ * To honor the IVolumeOperations contract on Hetzner we implement "snapshot"
+ * as a labeled PVC clone built via the copy-pod pattern: a Job that mounts
+ * source + destination PVC on the same node and tars data across.
+ *
+ * Cost note: each "snapshot" on Hetzner is a full Volume billed at the
+ * standard volume rate (€0.057/GB-mo, 10 GB minimum). The capabilities
+ * surface this so the CLI/cost estimator can warn users.
+ */
+let HetznerVolumeOperationsService = HetznerVolumeOperationsService_1 = class HetznerVolumeOperationsService {
+    constructor(k8s) {
+        this.k8s = k8s;
+        this.logger = new common_1.Logger(HetznerVolumeOperationsService_1.name);
+        this.capabilities = {
+            supportsSnapshotRetention: false,
+            supportsCsiSnapshot: false,
+            requiresCopyPodFallback: true,
+            snapshotCostPerGbMonthEur: null,
+        };
+    }
+    async createSnapshot(input) {
+        const { kubeconfig, namespace, sourcePvcName, snapshotName, labels } = input;
+        const sourcePvc = await this.k8s.getResource(kubeconfig, 'PersistentVolumeClaim', sourcePvcName, namespace);
+        if (!sourcePvc) {
+            throw new Error(`Source PVC ${namespace}/${sourcePvcName} not found, cannot snapshot`);
+        }
+        const sourceUid = sourcePvc?.metadata?.uid;
+        const storageRequest = sourcePvc?.spec?.resources?.requests?.storage ?? '10Gi';
+        const sizeGb = this.parseStorageGb(storageRequest);
+        const storageClass = sourcePvc?.spec?.storageClassName;
+        const sourceNode = sourcePvc?.metadata?.annotations?.['volume.kubernetes.io/selected-node'];
+        const snapshotPvcLabels = {
+            ...labels,
+            [SNAPSHOT_LABEL_MARKER]: 'true',
+            [SOURCE_PVC_LABEL]: sourcePvcName,
+            ...(sourceUid ? { 'flui.cloud/source-pvc-uid': sourceUid } : {}),
+        };
+        const newPvcManifest = this.renderPvcManifest({
+            name: snapshotName,
+            namespace,
+            storageClassName: storageClass,
+            storage: storageRequest,
+            labels: snapshotPvcLabels,
+        });
+        await this.k8s.applyManifest(kubeconfig, newPvcManifest);
+        this.logger.log(`[hetzner-snapshot] Created clone PVC ${namespace}/${snapshotName} (size=${sizeGb}Gi, sourceNode=${sourceNode ?? 'n/a'})`);
+        const jobName = `${snapshotName}-copy`;
+        const jobManifest = this.renderCopyJobManifest({
+            jobName,
+            namespace,
+            sourcePvcName,
+            destPvcName: snapshotName,
+            nodeSelectorHostname: sourceNode,
+            labels: snapshotPvcLabels,
+        });
+        await this.k8s.applyManifest(kubeconfig, jobManifest);
+        this.logger.log(`[hetzner-snapshot] Started copy-pod Job ${namespace}/${jobName}`);
+        await this.waitForJobCompletion(kubeconfig, namespace, jobName, COPY_JOB_TIMEOUT_SECONDS);
+        await this.cleanupCopyJob(kubeconfig, namespace, jobName);
+        return {
+            snapshotId: snapshotName,
+            kind: 'pvc-clone',
+            namespace,
+            sourceSizeGb: sizeGb,
+            createdAt: new Date().toISOString(),
+            ready: true,
+        };
+    }
+    async deleteSnapshot(input) {
+        try {
+            await this.k8s.deleteResource(input.kubeconfig, 'PersistentVolumeClaim', input.snapshotId, input.namespace);
+        }
+        catch (err) {
+            if (input.ignoreNotFound && err?.message?.includes('not found')) {
+                return;
+            }
+            throw err;
+        }
+    }
+    async listSnapshots(input) {
+        const labelSelectorParts = [`${SNAPSHOT_LABEL_MARKER}=true`];
+        if (input.labelSelector) {
+            labelSelectorParts.push(input.labelSelector);
+        }
+        const labelSelector = labelSelectorParts.join(',');
+        const namespace = input.namespace ?? '';
+        if (!namespace) {
+            this.logger.debug('[hetzner-snapshot] cluster-wide list requires namespace iteration; returning empty result. Caller should pass per-namespace queries.');
+            return [];
+        }
+        const items = await this.k8s.listResourcesByLabel(input.kubeconfig, 'PersistentVolumeClaim', namespace, labelSelector);
+        return items.map((pvc) => {
+            const labels = pvc?.metadata?.labels ?? {};
+            const sizeGb = this.parseStorageGb(pvc?.spec?.resources?.requests?.storage ?? '0');
+            return {
+                snapshotId: pvc?.metadata?.name,
+                kind: 'pvc-clone',
+                namespace: pvc?.metadata?.namespace,
+                sourcePvcName: labels[SOURCE_PVC_LABEL],
+                appId: labels['flui-app-id'],
+                sizeGb,
+                createdAt: pvc?.metadata?.creationTimestamp ??
+                    new Date().toISOString(),
+                ready: pvc?.status?.phase === 'Bound',
+                labels,
+            };
+        });
+    }
+    async createPvcFromSnapshot(input) {
+        const sourcePvc = await this.k8s.getResource(input.kubeconfig, 'PersistentVolumeClaim', input.snapshotId, input.namespace);
+        if (!sourcePvc) {
+            throw new Error(`Snapshot PVC ${input.namespace}/${input.snapshotId} not found`);
+        }
+        const sourceNode = sourcePvc?.metadata?.annotations?.['volume.kubernetes.io/selected-node'];
+        const newPvcLabels = {
+            ...input.labels,
+            'flui.cloud/restored-from': input.snapshotId,
+        };
+        const pvcManifest = this.renderPvcManifest({
+            name: input.newPvcName,
+            namespace: input.namespace,
+            storageClassName: input.storageClassName,
+            storage: `${input.sizeGb}Gi`,
+            labels: newPvcLabels,
+        });
+        await this.k8s.applyManifest(input.kubeconfig, pvcManifest);
+        const jobName = `${input.newPvcName}-restore`;
+        const placementNode = input.preferredNode ?? sourceNode;
+        const jobManifest = this.renderCopyJobManifest({
+            jobName,
+            namespace: input.namespace,
+            sourcePvcName: input.snapshotId,
+            destPvcName: input.newPvcName,
+            nodeSelectorHostname: placementNode,
+            labels: newPvcLabels,
+        });
+        await this.k8s.applyManifest(input.kubeconfig, jobManifest);
+        await this.waitForJobCompletion(input.kubeconfig, input.namespace, jobName, COPY_JOB_TIMEOUT_SECONDS);
+        await this.cleanupCopyJob(input.kubeconfig, input.namespace, jobName);
+        return { pvcName: input.newPvcName };
+    }
+    async cleanupCopyJob(kubeconfig, namespace, jobName) {
+        // Delete child pods first — they hold the PVC `Used By` reference and
+        // would block subsequent PVC deletion until kubelet finalizers tick.
+        try {
+            const pods = await this.k8s.listResourcesByLabel(kubeconfig, 'Pod', namespace, `job-name=${jobName}`);
+            for (const pod of pods) {
+                const podName = pod?.metadata?.name;
+                if (!podName)
+                    continue;
+                await this.k8s
+                    .deleteResource(kubeconfig, 'Pod', podName, namespace)
+                    .catch((err) => this.logger.warn(`[hetzner-snapshot] Pod cleanup failed for ${namespace}/${podName}: ${err.message}`));
+            }
+        }
+        catch (err) {
+            this.logger.warn(`[hetzner-snapshot] Pod listing for cleanup failed in ${namespace}/${jobName}: ${err.message}`);
+        }
+        await this.k8s
+            .deleteResource(kubeconfig, 'Job', jobName, namespace)
+            .catch((err) => this.logger.warn(`[hetzner-snapshot] Job cleanup failed for ${namespace}/${jobName}: ${err.message}`));
+    }
+    async waitForJobCompletion(kubeconfig, namespace, jobName, timeoutSeconds) {
+        const pollIntervalMs = 5000;
+        const start = Date.now();
+        while (Date.now() - start < timeoutSeconds * 1000) {
+            const job = await this.k8s.getResource(kubeconfig, 'Job', jobName, namespace);
+            const succeeded = job?.status?.succeeded ?? 0;
+            const failed = job?.status?.failed ?? 0;
+            if (succeeded > 0)
+                return;
+            if (failed > 0) {
+                throw new Error(`Copy-pod Job ${namespace}/${jobName} failed (failed=${failed})`);
+            }
+            await new Promise((r) => setTimeout(r, pollIntervalMs));
+        }
+        throw new Error(`Copy-pod Job ${namespace}/${jobName} timed out after ${timeoutSeconds}s`);
+    }
+    renderPvcManifest(args) {
+        const labelLines = Object.entries(args.labels)
+            .map(([k, v]) => `    ${this.yamlString(k)}: ${this.yamlString(v)}`)
+            .join('\n');
+        return [
+            'apiVersion: v1',
+            'kind: PersistentVolumeClaim',
+            'metadata:',
+            `  name: ${args.name}`,
+            `  namespace: ${args.namespace}`,
+            '  labels:',
+            labelLines,
+            'spec:',
+            '  accessModes:',
+            '    - ReadWriteOnce',
+            `  storageClassName: ${args.storageClassName}`,
+            '  resources:',
+            '    requests:',
+            `      storage: ${args.storage}`,
+            '',
+        ].join('\n');
+    }
+    renderCopyJobManifest(args) {
+        const labelLines = Object.entries(args.labels)
+            .map(([k, v]) => `    ${this.yamlString(k)}: ${this.yamlString(v)}`)
+            .join('\n');
+        const nodeSelectorBlock = args.nodeSelectorHostname
+            ? [
+                '      nodeSelector:',
+                `        kubernetes.io/hostname: ${args.nodeSelectorHostname}`,
+            ].join('\n')
+            : '';
+        return [
+            'apiVersion: batch/v1',
+            'kind: Job',
+            'metadata:',
+            `  name: ${args.jobName}`,
+            `  namespace: ${args.namespace}`,
+            '  labels:',
+            labelLines,
+            'spec:',
+            '  backoffLimit: 1',
+            `  activeDeadlineSeconds: ${COPY_JOB_TIMEOUT_SECONDS}`,
+            '  ttlSecondsAfterFinished: 30',
+            '  template:',
+            '    metadata:',
+            '      labels:',
+            labelLines,
+            '    spec:',
+            '      restartPolicy: Never',
+            ...(nodeSelectorBlock ? [nodeSelectorBlock] : []),
+            '      containers:',
+            '        - name: copy',
+            `          image: ${COPY_POD_IMAGE}`,
+            '          command:',
+            '            - /bin/sh',
+            '            - -c',
+            "            - 'set -e; cd /src && tar -cf - . | tar -C /dst -xf - && sync'",
+            '          volumeMounts:',
+            '            - name: src',
+            '              mountPath: /src',
+            '              readOnly: true',
+            '            - name: dst',
+            '              mountPath: /dst',
+            '      volumes:',
+            '        - name: src',
+            '          persistentVolumeClaim:',
+            `            claimName: ${args.sourcePvcName}`,
+            '            readOnly: true',
+            '        - name: dst',
+            '          persistentVolumeClaim:',
+            `            claimName: ${args.destPvcName}`,
+            '',
+        ].join('\n');
+    }
+    parseStorageGb(value) {
+        if (!value)
+            return 0;
+        const match = String(value).match(/^(\d+(?:\.\d+)?)([KMGTP]i?)?$/);
+        if (!match)
+            return 0;
+        const num = Number.parseFloat(match[1]);
+        const unit = match[2];
+        switch (unit) {
+            case 'Ki':
+                return num / (1024 * 1024);
+            case 'Mi':
+                return num / 1024;
+            case 'Gi':
+                return num;
+            case 'Ti':
+                return num * 1024;
+            case 'K':
+                return num / 1_000_000;
+            case 'M':
+                return num / 1000;
+            case 'G':
+                return num;
+            case 'T':
+                return num * 1000;
+            default:
+                return num;
+        }
+    }
+    yamlString(value) {
+        return JSON.stringify(value);
+    }
+};
+exports.HetznerVolumeOperationsService = HetznerVolumeOperationsService;
+exports.HetznerVolumeOperationsService = HetznerVolumeOperationsService = HetznerVolumeOperationsService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [kubernetes_service_1.KubernetesService])
+], HetznerVolumeOperationsService);

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage-connection.controller.d.ts

@@ -0,0 +1,18 @@
+import { HetznerObjectStorageConnectionService } from './hetzner-object-storage-connection.service';
+export declare class ConnectHetznerObjectStorageDto {
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+}
+export declare class HetznerObjectStorageConnectionController {
+    private readonly service;
+    constructor(service: HetznerObjectStorageConnectionService);
+    connect(dto: ConnectHetznerObjectStorageDto): Promise<{
+        ready: boolean;
+        tokenId: string;
+    }>;
+    status(): Promise<{
+        connected: boolean;
+        region: string;
+    }>;
+}

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage-connection.controller.js

@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HetznerObjectStorageConnectionController = exports.ConnectHetznerObjectStorageDto = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const hetzner_object_storage_connection_service_1 = require("./hetzner-object-storage-connection.service");
+class ConnectHetznerObjectStorageDto {
+}
+exports.ConnectHetznerObjectStorageDto = ConnectHetznerObjectStorageDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectHetznerObjectStorageDto.prototype, "accessKey", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectHetznerObjectStorageDto.prototype, "secretKey", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConnectHetznerObjectStorageDto.prototype, "region", void 0);
+let HetznerObjectStorageConnectionController = class HetznerObjectStorageConnectionController {
+    constructor(service) {
+        this.service = service;
+    }
+    async connect(dto) {
+        return this.service.connect(dto);
+    }
+    async status() {
+        const creds = await this.service.loadCreds();
+        return { connected: !!creds, region: creds?.region };
+    }
+};
+exports.HetznerObjectStorageConnectionController = HetznerObjectStorageConnectionController;
+__decorate([
+    (0, common_1.Post)('connect'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ConnectHetznerObjectStorageDto]),
+    __metadata("design:returntype", Promise)
+], HetznerObjectStorageConnectionController.prototype, "connect", null);
+__decorate([
+    (0, common_1.Get)('status'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], HetznerObjectStorageConnectionController.prototype, "status", null);
+exports.HetznerObjectStorageConnectionController = HetznerObjectStorageConnectionController = __decorate([
+    (0, swagger_1.ApiTags)('Provider Connections'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('management/providers/hetzner/object-storage'),
+    __metadata("design:paramtypes", [hetzner_object_storage_connection_service_1.HetznerObjectStorageConnectionService])
+], HetznerObjectStorageConnectionController);

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage-connection.service.d.ts

@@ -0,0 +1,24 @@
+import { ApiTokenRepository } from '../../../../access/repositories/api-token.repository';
+import { KeyStorageService } from '../../../../access/services/key-storage.service';
+import { GenericS3Backend } from '../../../../storage/implementations/generic-s3.backend';
+export interface ConnectHetznerObjectStorageInput {
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+}
+export declare class HetznerObjectStorageConnectionService {
+    private readonly apiTokenRepo;
+    private readonly keyStorage;
+    private readonly genericS3;
+    private readonly logger;
+    constructor(apiTokenRepo: ApiTokenRepository, keyStorage: KeyStorageService, genericS3: GenericS3Backend);
+    connect(input: ConnectHetznerObjectStorageInput): Promise<{
+        ready: boolean;
+        tokenId: string;
+    }>;
+    loadCreds(): Promise<{
+        accessKey: string;
+        secretKey: string;
+        region: string;
+    } | null>;
+}

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage-connection.service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var HetznerObjectStorageConnectionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HetznerObjectStorageConnectionService = void 0;
+const common_1 = require("@nestjs/common");
+const api_token_repository_1 = require("../../../../access/repositories/api-token.repository");
+const credentials_entity_1 = require("../../../../management/entities/credentials.entity");
+const cloud_provider_enum_1 = require("../../../enums/cloud-provider.enum");
+const credential_purpose_enum_1 = require("../../../../access/enums/credential-purpose.enum");
+const key_storage_service_1 = require("../../../../access/services/key-storage.service");
+const generic_s3_backend_1 = require("../../../../storage/implementations/generic-s3.backend");
+const storage_backend_provider_enum_1 = require("../../../../storage/enums/storage-backend-provider.enum");
+const DEFAULT_REGION = 'nbg1';
+function endpointFor(region) {
+    return `https://${region}.your-objectstorage.com`;
+}
+let HetznerObjectStorageConnectionService = HetznerObjectStorageConnectionService_1 = class HetznerObjectStorageConnectionService {
+    constructor(apiTokenRepo, keyStorage, genericS3) {
+        this.apiTokenRepo = apiTokenRepo;
+        this.keyStorage = keyStorage;
+        this.genericS3 = genericS3;
+        this.logger = new common_1.Logger(HetznerObjectStorageConnectionService_1.name);
+    }
+    async connect(input) {
+        const region = input.region ?? DEFAULT_REGION;
+        const endpoint = endpointFor(region);
+        const probeBucket = `flui-probe-${Date.now().toString(36)}`;
+        // Validate creds via probe bucket create+delete
+        try {
+            await this.genericS3.ensureBucket({
+                provider: storage_backend_provider_enum_1.StorageBackendProvider.HETZNER_OBJECT_STORAGE,
+                endpoint,
+                region,
+                bucket: probeBucket,
+                accessKey: input.accessKey,
+                secretKey: input.secretKey,
+                forcePathStyle: true,
+            });
+        }
+        catch (err) {
+            throw new common_1.BadRequestException(`Hetzner Object Storage credentials invalid: ${err?.message ?? err}`);
+        }
+        // Best-effort cleanup of probe bucket
+        try {
+            await this.genericS3.deleteObjects({
+                provider: storage_backend_provider_enum_1.StorageBackendProvider.HETZNER_OBJECT_STORAGE,
+                endpoint,
+                region,
+                bucket: probeBucket,
+                accessKey: input.accessKey,
+                secretKey: input.secretKey,
+                forcePathStyle: true,
+            }, []);
+        }
+        catch {
+            // ignore — we couldn't enumerate, but the key is valid
+        }
+        // Disable previous OS credentials for Hetzner (only one active per user assumed for MVP)
+        const existing = await this.apiTokenRepo.findByProviderAndPurpose(cloud_provider_enum_1.CloudProvider.HETZNER, credential_purpose_enum_1.CredentialPurpose.OBJECT_STORAGE);
+        for (const t of existing ?? []) {
+            try {
+                await this.apiTokenRepo.deleteToken(t.id);
+            }
+            catch (err) {
+                this.logger.warn(`Failed to delete previous Hetzner OS token ${t.id}: ${err?.message}`);
+            }
+        }
+        const encryptedSecret = this.keyStorage.encryptKeyToString(input.secretKey);
+        const encryptedAccess = this.keyStorage.encryptKeyToString(input.accessKey);
+        const created = await this.apiTokenRepo.createToken(cloud_provider_enum_1.CloudProvider.HETZNER, `Hetzner Object Storage (${region})`, `Auto-saved by Flui at ${new Date().toISOString()}`, encryptedSecret, {
+            credentialType: credentials_entity_1.CredentialType.ACCESS_KEY_SECRET,
+            encryptedAccessKey: encryptedAccess,
+            purpose: credential_purpose_enum_1.CredentialPurpose.OBJECT_STORAGE,
+        });
+        return { ready: true, tokenId: created.id };
+    }
+    async loadCreds() {
+        const tokens = await this.apiTokenRepo.findByProviderAndPurpose(cloud_provider_enum_1.CloudProvider.HETZNER, credential_purpose_enum_1.CredentialPurpose.OBJECT_STORAGE);
+        const t = tokens?.[0];
+        if (!t)
+            return null;
+        const secretKey = this.keyStorage.decryptKeyFromString(t.encrypted_token);
+        const accessKey = t.encrypted_access_key
+            ? this.keyStorage.decryptKeyFromString(t.encrypted_access_key)
+            : '';
+        // Region inferred from label "(nbg1)"
+        const match = t.label ? /\((\w+)\)/.exec(t.label) : null;
+        const region = match?.[1] ?? DEFAULT_REGION;
+        return { accessKey, secretKey, region };
+    }
+};
+exports.HetznerObjectStorageConnectionService = HetznerObjectStorageConnectionService;
+exports.HetznerObjectStorageConnectionService = HetznerObjectStorageConnectionService = HetznerObjectStorageConnectionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [api_token_repository_1.ApiTokenRepository,
+        key_storage_service_1.KeyStorageService,
+        generic_s3_backend_1.GenericS3Backend])
+], HetznerObjectStorageConnectionService);

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage.backend.d.ts

@@ -0,0 +1,7 @@
+import { GenericS3Backend } from '../../../../storage/implementations/generic-s3.backend';
+import { StorageBackendProvider } from '../../../../storage/enums/storage-backend-provider.enum';
+import { StorageBackendCredentials, VeleroBSLConfig } from '../../../../storage/interfaces/backup-storage-backend.interface';
+export declare class HetznerObjectStorageBackend extends GenericS3Backend {
+    readonly provider: StorageBackendProvider;
+    toVeleroBSL(creds: StorageBackendCredentials): VeleroBSLConfig;
+}

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage.backend.js

@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HetznerObjectStorageBackend = void 0;
+const common_1 = require("@nestjs/common");
+const generic_s3_backend_1 = require("../../../../storage/implementations/generic-s3.backend");
+const storage_backend_provider_enum_1 = require("../../../../storage/enums/storage-backend-provider.enum");
+let HetznerObjectStorageBackend = class HetznerObjectStorageBackend extends generic_s3_backend_1.GenericS3Backend {
+    constructor() {
+        super(...arguments);
+        this.provider = storage_backend_provider_enum_1.StorageBackendProvider.HETZNER_OBJECT_STORAGE;
+    }
+    toVeleroBSL(creds) {
+        return {
+            provider: 'aws',
+            config: {
+                region: creds.region,
+                s3ForcePathStyle: 'true',
+                s3Url: creds.endpoint,
+            },
+            credentialsKey: 'cloud',
+            bucket: creds.bucket,
+            prefix: creds.pathPrefix,
+        };
+    }
+};
+exports.HetznerObjectStorageBackend = HetznerObjectStorageBackend;
+exports.HetznerObjectStorageBackend = HetznerObjectStorageBackend = __decorate([
+    (0, common_1.Injectable)()
+], HetznerObjectStorageBackend);

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * API-only module che aggiunge il provisioning automatico di Hetzner Object
+ * Storage (require ApiTokenRepository → DataSource TypeORM, NON safe per CLI).
+ *
+ * Importa questo modulo in ProvidersModule (API), NON in CliProvidersModule.
+ */
+export declare class HetznerObjectStorageModule {
+}

package/lib/src/modules/providers/implementations/hetzner/object-storage/hetzner-object-storage.module.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HetznerObjectStorageModule = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const storage_module_1 = require("../../../../storage/storage.module");
+const storage_backend_provider_enum_1 = require("../../../../storage/enums/storage-backend-provider.enum");
+const object_storage_provisioner_registry_token_1 = require("../../../../storage/tokens/object-storage-provisioner-registry.token");
+const api_token_entity_1 = require("../../../../access/entities/api-token.entity");
+const api_token_repository_1 = require("../../../../access/repositories/api-token.repository");
+const key_storage_service_1 = require("../../../../access/services/key-storage.service");
+const hetzner_provider_module_1 = require("../hetzner-provider.module");
+const hetzner_object_storage_connection_service_1 = require("./hetzner-object-storage-connection.service");
+const hetzner_object_storage_connection_controller_1 = require("./hetzner-object-storage-connection.controller");
+const hetzner_object_storage_provisioner_1 = require("./hetzner-object-storage.provisioner");
+/**
+ * API-only module che aggiunge il provisioning automatico di Hetzner Object
+ * Storage (require ApiTokenRepository → DataSource TypeORM, NON safe per CLI).
+ *
+ * Importa questo modulo in ProvidersModule (API), NON in CliProvidersModule.
+ */
+let HetznerObjectStorageModule = class HetznerObjectStorageModule {
+};
+exports.HetznerObjectStorageModule = HetznerObjectStorageModule;
+exports.HetznerObjectStorageModule = HetznerObjectStorageModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            storage_module_1.StorageModule,
+            hetzner_provider_module_1.HetznerProviderModule,
+            typeorm_1.TypeOrmModule.forFeature([api_token_entity_1.ApiTokenEntity]),
+        ],
+        controllers: [hetzner_object_storage_connection_controller_1.HetznerObjectStorageConnectionController],
+        providers: [
+            api_token_repository_1.ApiTokenRepository,
+            key_storage_service_1.KeyStorageService,
+            hetzner_object_storage_connection_service_1.HetznerObjectStorageConnectionService,
+            hetzner_object_storage_provisioner_1.HetznerObjectStorageProvisioner,
+            (0, object_storage_provisioner_registry_token_1.multiProvisionerProvider)({
+                provide: object_storage_provisioner_registry_token_1.OBJECT_STORAGE_PROVISIONER_REGISTRY,
+                useFactory: (p) => ({
+                    provider: storage_backend_provider_enum_1.StorageBackendProvider.HETZNER_OBJECT_STORAGE,
+                    provisioner: p,
+                }),
+                inject: [hetzner_object_storage_provisioner_1.HetznerObjectStorageProvisioner],
+                multi: true,
+            }),
+        ],
+        exports: [
+            hetzner_object_storage_connection_service_1.HetznerObjectStorageConnectionService,
+            hetzner_object_storage_provisioner_1.HetznerObjectStorageProvisioner,
+            object_storage_provisioner_registry_token_1.OBJECT_STORAGE_PROVISIONER_REGISTRY,
+        ],
+    })
+], HetznerObjectStorageModule);