Skip to content
Vaicoa
Alpha: for testing only; it does not yet meet the Cyber Resilience Act’s requirements. Status and limits →

Create a hub with vai up

vai up creates a hub in your own Hetzner project and makes this device its owner.

$ vai login
$ vai up acme --location nbg1 --hcloud-context acme-prod --twins-hcloud-context acme-twins
Alpha: for testing only; does not yet meet the Cyber Resilience Act's requirements.

It shows what it will create and asks before it does anything (--plan prints the list and exits; --yes skips the question).

What it does, in order

Section titled “What it does, in order”
  1. The image. A short-lived helper server writes the release’s Podman image and makes a snapshot of it in your project, checked against the signed manifest. The hub reuses the snapshot for your servers.
  2. Network, firewall, primary IP. A private network for the hub and your servers; a firewall that opens WireGuard’s port and, while vai up runs, SSH from your address only; a primary IPv4 that survives a replacement of the hub’s server.
  3. The server, from that snapshot: a cpx02 (1 vCPU, 1 GB) by default; --server-type picks another.
  4. The hub, installed after its release signature is checked, and started.
  5. Pairing. This device becomes the owner; it pins the hub’s own certificate authority.
  6. The recovery key, shown once. Store it on paper or in a password manager; you type its last group to confirm.
  7. The licence, activated by the hub.
  8. The tokens, handed to the hub and stored there encrypted with its data keys.
  9. The backup bucket, and the continuous backup of the hub’s database to it.
  10. SSH closed.

On Hetzner the whole run took 160 s (lab run, 20 October 2026). Every resource carries the labels vaicoa-managed=true and vaicoa-hub=<name>.

Interrupted?

Section titled “Interrupted?”

Run the same command again: every step finds what an earlier run made before it makes anything, and continues at the first step that did not finish. vai up NAME --abort deletes what an unfinished run made, after you type the hub’s name.

Afterwards

Section titled “Afterwards”
$ vai status
$ vai open          # the hub's portal in your browser, while vai runs

vai down NAME deletes the hub and everything of it in the project; it refuses while the hub still manages a server. vai upgrade installs another release on the hub’s server with its data and pairings kept.

Next: pair a device.