Rackbar GitHub

macOS menu bar app · for Hetzner Cloud

Every server, across every project, one click away.

Rackbar lists the servers of every Hetzner Cloud project in the menu bar and writes an ssh config from the same list, so ssh acme/web-1 and ssh acme/Tab just work. 

brew install --cask rackbar
Coming soon
View on GitHub

read-only token · App Sandbox · macOS 27 · MIT · Mac App Store later

Type the project.
Press Tab.

Every server with a public IPv4 gets a Host acme/web-1 entry, written for you. ssh, scp, rsync and mosh read it, and so does your shell's tab completion.

The label is the namespace: one per project, or one for every project a customer has.

A terminal: typing “ssh acme/” and pressing Tab lists acme/bastion, acme/cache-1, acme/db-1, acme/web-1, acme/web-2, acme/worker-1. Completing to acme/web-1 and pressing Return logs in to web-1.

What you would otherwise look up.

The addresses you keep pasting into a terminal, and the state of each machine, without opening the console.

All projects, one list.

One read-only API token per Hetzner project, grouped under labels you choose. Several projects under one label share one heading and one ssh namespace.

Copy, don't retype.

Click a row for its IPv4. The menu has the name, IPv6, private IP and ssh alias. Storage Boxes too, with how full they are.

ssh that just works.

Every server becomes Host <label>/<server>. ssh, scp, rsync and mosh read it, and so does your shell's tab completion.

State at a glance.

Filled is running, hollow is off. Filled against hollow is a shape, not a shade, so it reads in every appearance.

  • running
  • off
  • changing
  • wrong

Read-only by design. It lists, it copies, it never powers anything on or off. Power actions are not on the roadmap, and patches for them are not accepted.

Your keys stay yours.

Rackbar runs in the App Sandbox. It does not get ~/.ssh. It gets one folder that you create and pick once, and it owns the one file in there.

  • ~/.ssh/
  • ├── id_ed25519Rackbar cannot see this
  • ├── confignor this
  • └── hcloud/the only folder you granted
  •     └── configwritten by Rackbar
You add two lines to your own config, once. Rackbar never touches it.
Tokens
Only in the macOS Keychain: readable after first unlock, never synced. Not in UserDefaults, not on a command line.
Files
Your keys and your ~/.ssh/config are outside the sandbox. The one folder you pick is all Rackbar can write to.
Entitlements
The network, the folder you picked, and a bookmark to find it again after a restart. That is the whole list.

What the sync will not do

  1. Write from an incomplete picture.

    If any project fails to load (an expired token, a dropped network) nothing is written. Writing would delete that project's hosts over a passing error.

  2. Write anything ssh could misread.

    A name outside [A-Za-z0-9._/-], an address that is not an IP, a user or key path with whitespace: the whole job is refused, and Settings says which one.

  3. Churn.

    The file is written atomically with mode 600, and not at all when nothing changed.

Set up in three steps.

Once. Each step is in the Settings window too, with the text ready to copy.

  1. Add a read-only token

    In the Hetzner Cloud Console, under Security → API tokens → Generate, with Read permission. One per project. Rackbar tries it before it keeps it.

    Open the Hetzner Console

  2. Pick ~/.ssh/hcloud

    Create a folder of its own inside ~/.ssh and choose it in Settings → SSH. It is the only folder Rackbar can see.

    mkdir ~/.ssh/hcloud

  3. Add two lines to ~/.ssh/config

    At the end, once. Your own Host blocks above them still win.

    Match all
Include hcloud/config

    Or append them from a terminal:

    printf '\nMatch all\nInclude hcloud/config\n' >> ~/.ssh/config

No completions in zsh? Its completion system is off in the stock macOS ~/.zshrc. Add autoload -Uz compinit && compinit, before plugins such as zsh-syntax-highlighting.

Settings get a real window.

A popover closes the moment you switch to the browser to create a token. Projects, the ssh setup and the refresh interval live in a window that stays put.

Questions.

Why read-only?

Listing servers and writing an ssh config only need read access, so that is all Rackbar asks for. A Read token cannot change anything in your project, whatever the app does with it. A menu bar is also one stray click from anything it offers, and nobody should restart a database by mistake.

Where are my tokens stored?

In the data protection Keychain on your Mac: readable after first unlock, never synced. Not in UserDefaults, not on a command line. Rackbar tries a token before it keeps it, and removing a project deletes its tokens from the Keychain.

Does it work with several projects?

That is what it is for. Add one token per Hetzner project, each under a label. Tokens that share a label share one heading and one ssh namespace, which helps when a customer's servers are spread over several projects. A refresh costs three requests per token, made side by side.

Why at the end of ~/.ssh/config?

Because ssh takes the first value it finds. Whatever you set above the Include wins over the generated entries:

Host acme/*
    User deploy
    IdentityFile ~/.ssh/work_ed25519

Host acme/db-1
    ProxyJump acme/bastion

Match all
Include hcloud/config

Match all closes whatever Host block came last. Without it, the Include would only apply inside that block.

Is there a Linux version?

Rackbar is macOS only. On Linux with Omarchy, its sibling omarchy-hcloud does the same in the Omarchy bar.