Cloud Providers
Supported VM providers and configuration options.
CIFP supports multiple cloud providers for proxy VM deployment. An admin selects the default provider in the Admin Dashboard under Proxy Provider. Each provider offers dedicated inbound IPv4 addresses, programmatic API access, and Docker-based provisioning.
Hetzner Cloud
Hetzner Cloud is the recommended provider for cost-efficient proxy deployment. Servers are provisioned via the Hetzner Cloud REST API (api.hetzner.cloud/v1) with cloud-init for automated Docker installation and proxy image deployment.
Regions
The full, always-current list of regions for every provider — with country flags, cities, and codes — lives on the Regional Availability page. Regions are managed in the database and editable from the Admin Dashboard, so that page never drifts from what customers can actually select. The Create Proxy dropdown draws from the same source.
Pricing
| Server Type | vCPU | RAM | Monthly |
|---|---|---|---|
cpx11 | 2 (AMD, shared) | 2 GB | ~$4.70/mo (incl. IPv4) |
cpx31 | 4 (AMD, shared) | 8 GB | ~$15.50/mo |
cpx41 | 8 (AMD, shared) | 16 GB | ~$28.00/mo |
Each server includes a dedicated public IPv4 address. A stateful cloud firewall (free) restricts inbound traffic to ports 3128 and 8080 only.
Configuration
Configure Hetzner Cloud in the Admin Dashboard:
- Set Default Provider to
Hetzner Cloud - Enter your Hetzner Cloud API Token (project-scoped, from Hetzner Console)
- Enter GCP KMS configuration (Project ID, Key Ring, Key ID) for DEK encryption
The API token can also be set via the HETZNER_CLOUD_API_KEYenvironment variable. Optional S3 credentials (HETZNER_CLOUD_S3_ACCESS_KEY,HETZNER_CLOUD_S3_SECRET_KEY) are available for future backup and image storage.
Cloud Firewall
A stateful Hetzner Cloud Firewall is automatically created and applied to all proxy VMs via label selectors (cifp-managed=true). Inbound rules:
- TCP 3128 — Proxy traffic (from any IP)
- TCP 8080 — Internal management API (authenticated via API key)
All other inbound traffic is dropped. Outbound traffic is unrestricted.
API Endpoints Used
| Endpoint | Method | Purpose |
|---|---|---|
/servers | POST | Create VM with cloud-init |
/servers/{id} | GET | Get VM state + public IP |
/servers/{id} | DELETE | Delete VM |
/servers/{id}/actions/shutdown | POST | Graceful stop (pause) |
/servers/{id}/actions/poweron | POST | Start (resume) |
/actions/{id} | GET | Poll async action status |
/firewalls | POST | Create CIFP firewall (once) |
KMS Architecture
When Hetzner Cloud is the active provider, proxy secret encryption uses GCP Cloud KMS managed by the control plane:
- Control plane generates a 32-byte DEK (AES-256 key)
- DEK is encrypted with GCP KMS and stored in the database
- Sidecar fetches the plaintext DEK from the control plane at boot via an authenticated HTTP endpoint
- DEK is cached locally in the sidecar's SQLite for restart resilience
GCP KMS is accessed via the gcloud kms encrypt/decryptCLI. The control plane host must have gcloud installed and authenticated with appropriate KMS permissions.
Adding New Providers
The provider system is extensible. To add a new provider (e.g., DigitalOcean, Vultr), implement the ProxyProviderinterface and register it in the provider registry. The KMS architecture (GCP KMS, control-plane-managed DEKs) works with any provider.