Rackpulse
macOS menu bar app for Hetzner Cloud
Hetzner Cloud status, charts and costs in your Mac menu bar
Rackpulse is a macOS menu bar app for Hetzner Cloud. It shows whether your servers are running, how busy they are and what they cost this month, and it alerts you when something goes wrong.
v0.2.0 · macOS 14 or later · free
fig. 1 · the panel, with sample data
Simple or with agent
agent optionalSimple mode needs only a Hetzner Cloud API token. Install the agent on a server to also see what happens inside it. You can mix both: some servers with the agent, some without.
| Feature | Simple | Agent |
|---|---|---|
| Servers | ||
| Running status and a one-line summary | Included | Included |
| CPU, disk I/O and network charts | Included | Included |
| Traffic against the included amount | Included | Included |
| Power controls | Included | Included |
| Costs, budgets and idle spend | Included | Included |
| Inside the server | ||
| Memory and load | Not included | Included |
| Disk space per file system | Not included | Included |
| Failed services and pending reboots | Not included | Included |
| Docker | ||
| Containers with health, restarts, CPU and memory | Not included | Included |
| Container pages and Docker disk usage | Not included | Included |
| Uptime | ||
| From Hetzner’s start and stop history | Included | Included |
| Recorded on the server, including crashes Hetzner cannot see | Not included | Included |
| Alerts | ||
| Server down, CPU, traffic, disk I/O, budget, changes | Included | Included |
| Disk space, memory, Docker, failed service, reboot, agent not answering | Not included | Included |
| Installed on your servers | nothing | read-only agent |
What you see
with a tokenEverything here works with the Hetzner API alone. Nothing is installed on your servers.
One status line
"All 5 servers running" or "1 not running · 2 alerts" across all projects, in the colour of the worst alert.
Grouped by project
Servers are grouped by project, with problems sorted to the top. Switch to a single project from the menu.
Charts
CPU, disk IOPS and network for 1 hour, 6 hours, 24 hours, 7 days or 30 days. Hover a chart to read any moment.
Uptime
The last 24 hours and 30 days, from Hetzner’s start and stop history and Rackpulse’s own checks.
Power controls
Start, shut down, reboot, power off and reset, each confirmed first. Needs a Read & Write token.
Costs
Month to date and the forecast to month end, per project, with an optional budget. Idle spend, such as stopped servers that still bill, is listed separately.
Alerts
Notifications with Snooze and Open buttons. Quiet hours hold them back. Each server can use the global rules, its own thresholds or no alerts.
Environments
Tag each server as Production, Staging or Development, or let Rackpulse read an env label from Hetzner.
Menu bar readout
A status dot in the colour of the worst alert, plus the busiest server’s CPU, this month’s cost or the alert count.
Keyboard
Press ⌃⌥R anywhere to open the panel, then type to find a server.
Touch ID lock
Optionally lock the panel after your Mac sleeps until you unlock it with Touch ID.
Go deeper with the agent
optional, per serverMemory, disk space, Docker containers, failed services and pending reboots live inside the server, and the Hetzner API does not report them. The agent is a small read-only Linux program that reports them.
Memory and load
Memory use, load and uptime since boot, with failed systemd services and pending reboots.
Disk space
Space and inodes per file system, with an alert when one fills up or turns read-only.
Docker containers
Grouped by Compose project, with health, restarts, CPU and memory.
A page per container
7 days of charts, ports (local only or public), volumes and mounts, networks and the last health check.
Docker disk usage
How much space images, volumes and build cache take, and how much of it is reclaimable.
Uptime on the server
30 days recorded on the server itself. It catches crashes Hetzner cannot see and keeps history while your Mac sleeps.
Set up the agent on a server
optional · per server01Open Set up agent
Open a server in Rackpulse and choose Set up agent. Rackpulse creates a key for that server.02Run the command on the server
The command contains the server's own key in place of rb1_...curl -fsSL https://tools-cdn.en3sis.com/tools/rackpulse/agent/install.sh \ | sudo sh -s -- --pair rb1_...03Open port 7311
Make TCP port 7311 reachable from your Mac, as shown on the right. Rackpulse connects within a few seconds.
port 7311, by the address Rackpulse uses
Public IPv4 or IPv6
Add an inbound rule to the server’s Hetzner Cloud Firewall: TCP, port 7311. If you have a fixed IP, set it as the source. If ufw is active:
sudo ufw allow 7311/tcpTailscale or another VPN
No public rule needed. If ufw is active:
sudo ufw allow in on tailscale0 to any port 7311 proto tcpHetzner private network
No public rule needed. Your Mac must reach the private network, for example through a VPN server in it.
Update the agent
Run the script again without --pair. It keeps the key, port and address.
curl -fsSL https://tools-cdn.en3sis.com/tools/rackpulse/agent/install.sh \
| sudo shRemove the agent
Run this on the server, remove the firewall rule, then choose Remove agent in Rackpulse.
sudo rackpulse-agent uninstall- Linux on x86_64 and ARM64
- systemd service under its own user
- read-only, cannot run commands
- keeps 30 days of history on the server
Screens
sample dataEstimated from list prices × hours each resource existed this month, without VAT.
Alerts
12 rules| rule | fires when | mode |
|---|---|---|
| Server down | A server is not running and you did not stop it | Simple |
| Sustained CPU | CPU stays above the threshold for the whole period | Simple |
| Traffic quota | Outgoing traffic passes a share of the included traffic | Simple |
| Disk I/O anomaly | Disk IOPS stay above a multiple of the 7-day median (off by default) | Simple |
| Budget | The month’s cost forecast goes above the project’s budget | Simple |
| Unexpected change | A server or volume appears or disappears, a server is rebuilt, or a firewall changes | Simple |
| Disk space | A file system passes a share of its space or inodes, or turns read-only | Agent |
| Memory | Memory use stays above the threshold for the whole period | Agent |
| Docker containers | A container is unhealthy, keeps restarting, or stopped with an error | Agent |
| Failed service | A systemd service is in the failed state | Agent |
| Reboot required | Installed updates need a reboot | Agent |
| Agent not answering | Hetzner says the server runs, but the agent does not answer, for example because it froze | Agent |
Each rule has its own threshold and duration. Costs are estimates from list prices: Hetzner has no billing API, so VAT, credits and traffic overage are not included.
Privacy and security
Three destinations
Rackpulse contacts api.hetzner.cloud, its update feed and the agents you pair. No account, no analytics, no telemetry.
Keychain
Tokens and agent keys are stored in the macOS Keychain, never in files or logs.
App Sandbox
Runs in the macOS App Sandbox with outgoing network access only. Signed and notarized by Apple.
Limited changes
With a Read token, Rackpulse cannot change anything. With Read & Write, it only sends the five power actions, after you confirm.
Read-only agent
The agent cannot run commands or change anything, only reads from Docker, and runs sandboxed by systemd.
Per-server keys
Each server has its own key, and the agent’s certificate is pinned on the first connection. Change a key from the app at any time.
Install
macOS 14 or later- 01
Install the app
Open Rackpulse.dmg and drag Rackpulse to Applications. It needs macOS 14 or later.
- 02
Create a Hetzner Cloud API token
In the Hetzner Console, open your project and go to Security, then API tokens, then Generate API token. Choose Read to monitor only, or Read & Write to also use the power controls.
- 03
Add the project
Click the Rackpulse icon in the menu bar, paste the token and click Verify and Save. Add one token per project.
- 04
Set up the agent on a server Agent
Open a server, choose Set up agent and run the command it shows. Skip this step to stay in Simple mode.
requirements
- Mac
- macOS 14 Sonoma or later
- Hetzner
- A Hetzner Cloud API token per project
- Server
- Linux on x86_64 or ARM64 with systemd Agent
- Network
- TCP port 7311 reachable from your Mac Agent
Rackpulse checks its update feed once a day. You can turn this off in the menu.
Support
bugs, questions, ideasFor a bug, include your macOS version, the Rackpulse version from About, and what you expected to happen. If the agent is involved, add its version from the agent setup page.
Questions
7Do I need to install anything on my servers?
No. Rackpulse works with a Hetzner Cloud API token only. The agent is optional and adds memory, disk space, Docker containers and uptime recorded on the server.
Which token permission should I choose?
Read to monitor only. Read & Write if you also want the power controls (start, shut down, reboot, power off, reset). With a Read token, Rackpulse cannot change anything.
How accurate are the costs?
They are estimates from list prices and the hours each resource existed this month. Hetzner has no billing API, so VAT, credits and traffic overage are not included.
Does the agent need a public port?
Your Mac connects to the agent on TCP port 7311. On a public address, add an inbound rule to the server’s Hetzner Cloud Firewall. Over Tailscale, a VPN or a private network, no public rule is needed.
How do I remove the agent?
Run sudo rackpulse-agent uninstall on the server, then remove the firewall rule. In Rackpulse, choose Remove agent on the server page.
Does Rackpulse support dedicated servers?
No. It reads the Hetzner Cloud API, so it covers Cloud servers, volumes, IPs and firewalls.
How does it update?
Rackpulse checks its update feed once a day. You can turn this off in the menu. To update the agent, run the install command on the server again without --pair. It keeps its key, port and address.
Rackpulse is an independent project for Hetzner Cloud. It is not affiliated with or endorsed by Hetzner Online GmbH.