One server behind the Cloudflare proxy
Cloudflare’s proxy is not a load balancer: it forwards to one address and does not health-check or balance several origins. Today that address becomes a Hetzner load balancer placed behind the proxy, with TLS moved to it and the proxied record pointed at it; the one to two hours are that move. Cloudflare Load Balancing as the balancer itself — a pool, an origin, a health monitor, and nothing to move on the server — is planned as the second traffic provider and would lift this case to a fit of 8.
- Prerequisite work
- Hetzner load balancer behind the proxy, TLS moved to it, proxied DNS record pointed at it
- Time to set up
- 1–2 h
- Adapter
- Snapshot or webhook
- Fit
- 6 → 8/106 today, 8 once Cloudflare Load Balancing ships as a traffic provider
Prerequisites, time and fit are this case's row in the onboarding cases table. Hetscale's own setup is about 15 minutes in every case; the rest is work on your side.
Steps
- 01Create a Hetzner load balancer behind the proxy
Create a Hetzner Cloud Load Balancer (€7.49 per month, Hetzner list price, September 2026) in the same network zone as your server, with a health check on your app’s health endpoint. That health check is the readiness signal Hetscale trusts.
- 02Move TLS to the load balancer
Terminate TLS at the Hetzner load balancer instead of on the server, so every node behind it is identical. Cloudflare keeps terminating TLS for your visitors in front of it.
- 03Point the proxied DNS record at the load balancer
Change the orange-cloud record from the server’s address to the load balancer’s. Cloudflare keeps forwarding to the balancer; restrict the load balancer or the server firewall to Cloudflare’s IP ranges so nothing reaches your nodes around it.
- 04Connect read-only
Start the 14-day Observe trial with a read-only Hetzner token; the day-0 report shows what a group would have done with your last 30 days.
- 05Rehearse, then go Live
One Rehearsal creates a short-lived server, adds it as a target, waits for the health check, drains it and deletes it while you watch; Hetzner bills at least one started hour. Then set minimum 2 and go Live.
FAQ for this case
Can Cloudflare Load Balancing be the balancer instead?
Not yet. Cloudflare Load Balancing is planned as the second traffic provider (a pool, your servers as origins, a health monitor, 30–45 minutes of setup). Onboarding records whether your seed sits behind the Cloudflare proxy; that count decides when it ships. Until then the Hetzner load balancer behind the proxy is the supported setup.
What does the Hetzner load balancer cost?
€7.49 per month for the smallest type, Hetzner list price, September 2026, on your own Hetzner invoice. Hetscale does not resell it.
How is a node removed?
Removed from the Hetzner load balancer first; the balancer keeps existing connections alive for up to five minutes and sends no new ones. Hetscale waits the group’s drain window, shuts the server down, then deletes it.