hetzner-storage-box

name	hetzner-storage-box
description	Read and operate Hetzner Storage Boxes through Hetzner API management calls and WebDAV file requests with gateway-injected credentials.
user-invocable	true
requires	{"bins":["node"]}
credentials	[{"id":"hetzner-api-token","kind":"bearer","required":true,"secret_ref":{"source":"store","id":"HETZNER_API_TOKEN"},"scope":"api.hetzner.com/v1/storage_boxes","how_to_obtain":"Create a Hetzner Console API token for the project containing the Storage Box. Use read-only scope for inventory and read-write scope only for approved Storage Box management changes."},{"id":"hetzner-storage-box-basic-auth","kind":"header","required":false,"secret_ref":{"source":"store","id":"HETZNER_STORAGE_BOX_BASIC_AUTH"},"scope":"*.your-storagebox.de WebDAV Authorization header","how_to_obtain":"Base64-encode '<storage-box-username>:<password>' and store only that encoded value. The helper injects it as 'Authorization: Basic <secret>' for WebDAV file operations."}]
metadata	{"hybridclaw":{"category":"infrastructure","short_description":"Hetzner Storage Box inventory, snapshots, and guarded WebDAV file operations.","tags":["hetzner","storage-box","webdav","archive","infrastructure"],"stakes_tiers":{"green":"[Truncated]","amber":"[Truncated]","red":"[Truncated]"},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"hetzner-storage-box"}}}

Hetzner Storage Box

Use this skill for Storage Box inventory, lifecycle and snapshot management, plus WebDAV file reads and guarded uploads/archives.

Default Workflow

1. Use Hetzner API reads (list-storage-boxes, get-storage-box) for inventory and metadata.
2. Use WebDAV reads (list-files, download-file) for file inspection.
3. Use plan before any management, file write, or public-link request.
4. Treat hetzner_storage_box.cjs as the API/WebDAV wrapper. Do not handcraft Hetzner Storage Box API URLs, WebDAV URLs, JSON bodies, tiers, or secret refs from memory.
5. For prompt/user testing, stop after plan or after helper payload generation. Do not call the built-in http_request tool.
6. For real user requests that need live Storage Box API or WebDAV reads, pass the helper-emitted httpRequest object unchanged to http_request. The bearerSecretName or secretHeaders field is the secret reference; do not rewrite it, preflight it, inspect it, or ask the model for the secret.
7. If a live http_request call returns 401 or 403, stop after that first failure. Do not retry, do not fan out to more endpoints or paths, and ask the operator to set or verify the relevant secret.
8. Require explicit operator grant before creating boxes, changing settings, snapshots, uploads, archives, directory creation, public sharing, or deletes.
9. Never paste, print, or inspect HETZNER_API_TOKEN or Storage Box passwords. The gateway injects API bearer tokens and WebDAV Basic auth server-side.

Secret Setup

API management calls use HETZNER_API_TOKEN:

hybridclaw secret set HETZNER_API_TOKEN "<hetzner-console-api-token>"

HETZNER_API_TOKEN is the Hetzner Console token for Cloud and Storage Box management APIs. DNS uses its own HETZNER_DNS_API_TOKEN because Hetzner DNS is served by a separate DNS API and Auth-API-Token header.

WebDAV file operations use a Basic-auth secret containing only the base64 encoded username:password payload:

printf '%s'  | 
hybridclaw secret  HETZNER_STORAGE_BOX_BASIC_AUTH