From 4dfe859ed830e765ce182577fffdffb56e35b526 Mon Sep 17 00:00:00 2001
From: Felix Nehrke <felix@nehrke.info>
Date: Fri, 12 Jun 2026 02:28:24 +0200
Subject: [PATCH] Update DNS-module for Hetzner to use the `hcloud`-provider

Hetzner's legacy DNS console (dns.hetzner.com) and its old DNS API have
been permanently shut down. All DNS zone management has been migrated
entirely to the main Hetzner Cloud Console.

Since I hadn't made any changes in the last couple of months I was
simply not affected by that change until very recently.
So, this change drops the 3rd-party provider I had used previously and
now applies the official `hcloud`-provider.

The migrations was a bit of a hassle, because I had to manually remove
the obsolete references from the Tofu-state. Then I checked the migrated
sources and decided to simply drop the migrated DNS-zones altogether and
simply run `tofu apply` once more.
---
 .terraform.lock.hcl             | 16 ----------------
 config.auto.tfvars.tpl          |  1 -
 modules/hetzner/dns/main.tf     | 21 ++++++++++++---------
 modules/hetzner/dns/versions.tf |  6 +++---
 variables.tf                    |  4 ----
 versions.tf                     |  8 --------
 6 files changed, 15 insertions(+), 41 deletions(-)

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index 840e8fb..42bc6fe 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -72,19 +72,3 @@ provider "registry.opentofu.org/hetznercloud/hcloud" {
     "zh:eb15f600011e7822b526b137fc5e88db15a7ef7c826ebaa16fa6486cf1f1ce2a",
   ]
 }
-
-provider "registry.opentofu.org/timohirt/hetznerdns" {
-  version     = "2.2.0"
-  constraints = "2.2.0"
-  hashes = [
-    "h1:HyskQAglrOueur79gSCBgx9MNDOs0tz39aNYQiFgxz8=",
-    "zh:5bb0ab9f62be3ed92070235e507f3c290491d51391ef4edcc70df53b65a83019",
-    "zh:5ccdfac7284f5515ac3cff748336b77f21c64760e429e811a1eeefa8ebb86e12",
-    "zh:687c35665139ae37c291e99085be2e38071f6b355c4e1e8957c5a6a3bcdf9caf",
-    "zh:6de27f0d0d1513b3a4b7e81923b4a8506c52759bd466e2b4f8156997b0478931",
-    "zh:85770a9199a4c2d16ca41538d7a0f7a7bfc060678104a1faac19213e6f0a800c",
-    "zh:a5ff723774a9ccfb27d5766c5e6713537f74dd94496048c89c5d64dba597e59e",
-    "zh:bf9ab76fd37cb8aebb6868d73cbe8c08cee36fc25224cc1ef5949efa3c34b06c",
-    "zh:db998fe3bdcd4902e99fa470bb3f355883170cf4c711c8da0b5f1f4510f1be41",
-  ]
-}
diff --git a/config.auto.tfvars.tpl b/config.auto.tfvars.tpl
index e931597..549123d 100644
--- a/config.auto.tfvars.tpl
+++ b/config.auto.tfvars.tpl
@@ -1,4 +1,3 @@
-hetzner_dns_apitoken   = "YOUR_HETZNER_DNS_API_TOKEN"
 hetzner_cloud_apitoken = "YOUR_HETZNER_CLOUD_API_TOKEN"
 
 # Hetzner-locations: https://docs.hetzner.com/cloud/general/locations/
diff --git a/modules/hetzner/dns/main.tf b/modules/hetzner/dns/main.tf
index 565f6c8..d57b257 100644
--- a/modules/hetzner/dns/main.tf
+++ b/modules/hetzner/dns/main.tf
@@ -1,5 +1,6 @@
-resource "hetznerdns_zone" "this" {
+resource "hcloud_zone" "this" {
   name = var.zone
+  mode = "primary"
   ttl  = var.zone_ttl
 }
 
@@ -11,15 +12,17 @@ locals {
   })
 }
 
-resource "hetznerdns_record" "this" {
+resource "hcloud_zone_rrset" "this" {
   for_each = local.records
-  zone_id  = hetznerdns_zone.this.id
-  name     = each.value.name
-  type     = each.value.type
-  value = (each.value.type == "TXT"
-    ? "\"${join("\" \"", [for c in chunklist(split("", each.value.value), 255) : join("", c)])}\""
-    : each.value.value
-  )
+  zone  = hcloud_zone.this.name
+  name  = each.value.name
+  type  = each.value.type
+  records = [{
+    value = (each.value.type == "TXT"
+      ? "\"${join("\" \"", [for c in chunklist(split("", each.value.value), 255) : join("", c)])}\""
+      : each.value.value
+    )
+  }]
   ttl = each.value.ttl
 }
 
diff --git a/modules/hetzner/dns/versions.tf b/modules/hetzner/dns/versions.tf
index a2ad6d0..de15877 100644
--- a/modules/hetzner/dns/versions.tf
+++ b/modules/hetzner/dns/versions.tf
@@ -1,8 +1,8 @@
 terraform {
   required_providers {
-    hetznerdns = {
-      source = "timohirt/hetznerdns"
-      version = "2.2.0"
+    hcloud = {
+      source = "hetznercloud/hcloud"
+      version = ">= 1.60.0"
     }
   }
 }
diff --git a/variables.tf b/variables.tf
index 7dd9f2d..c57a07a 100644
--- a/variables.tf
+++ b/variables.tf
@@ -20,10 +20,6 @@ variable "add_local_ip_to_ssh_allowed_ips" {
   description = "Whether to add the current local ip to the set of IPs which have access to the cluster via SSH."
 }
 
-variable "hetzner_dns_apitoken" {
-  type = string
-}
-
 variable "hetzner_cloud_apitoken" {
   type = string
 }
diff --git a/versions.tf b/versions.tf
index 582355d..c731b00 100644
--- a/versions.tf
+++ b/versions.tf
@@ -14,10 +14,6 @@ terraform {
   }
 
   required_providers {
-    hetznerdns = {
-      source  = "timohirt/hetznerdns"
-      version = "2.2.0"
-    }
     hcloud = {
       source  = "hetznercloud/hcloud"
       version = "1.60.0"
@@ -33,10 +29,6 @@ terraform {
   }
 }
 
-provider "hetznerdns" {
-  apitoken = var.hetzner_dns_apitoken
-}
-
 provider "hcloud" {
   token = var.hetzner_cloud_apitoken
 }