Excon::Error::Unauthorized When trying to exec ubicloud app from local #3688

anilgulgor · 2025-08-01T12:55:18Z

anilgulgor
Aug 1, 2025

Hi everyone,
I'm experiencing an authentication issue when trying to cloudify a Hetzner dedicated server using the demo/cloudify_server script. I'm getting the following error:

/usr/local/bundle/gems/excon-1.2.3/lib/excon/middlewares/expects.rb:13:in 'Excon::Middleware::Expects#response_call': Expected(200) <=> Actual(401 Unauthorized) (Excon::Error::Unauthorized)
        from /usr/local/bundle/gems/excon-1.2.3/lib/excon/middlewares/decompress.rb:35:in 'Excon::Middleware::Decompress#response_call'
        from /usr/local/bundle/gems/excon-1.2.3/lib/excon/middlewares/response_parser.rb:12:in 'Excon::Middleware::ResponseParser#response_call'
        from /usr/local/bundle/gems/excon-1.2.3/lib/excon/connection.rb:472:in 'Excon::Connection#response'
        from /usr/local/bundle/gems/excon-1.2.3/lib/excon/connection.rb:297:in 'Excon::Connection#request'
        from /usr/local/bundle/gems/excon-1.2.3/lib/excon/connection.rb:379:in 'Excon::Connection#get'
        from /app/lib/hosting/hetzner_apis.rb:69:in 'Hosting::HetznerApis#pull_ips'
        from /app/lib/hosting/apis.rb:7:in 'Hosting::Apis.pull_ips'
        from /app/model/vm_host.rb:176:in 'VmHost#create_addresses'
        from /app/prog/vm/host_nexus.rb:26:in 'block in Prog::Vm::HostNexus.assemble'
        from /usr/local/bundle/gems/sequel-5.94.0/lib/sequel/database/transactions.rb:264:in 'Sequel::Database#_transaction'
        from /usr/local/bundle/gems/sequel-5.94.0/lib/sequel/database/transactions.rb:239:in 'block in Sequel::Database#transaction'
        from /usr/local/bundle/gems/sequel-5.94.0/lib/sequel/connection_pool/timed_queue.rb:90:in 'Sequel::TimedQueueConnectionPool#hold'
        from /usr/local/bundle/gems/sequel-5.94.0/lib/sequel/database/connecting.rb:283:in 'Sequel::Database#synchronize'
        from /usr/local/bundle/gems/sequel-5.94.0/lib/sequel/database/transactions.rb:197:in 'Sequel::Database#transaction'
        from /app/prog/vm/host_nexus.rb:7:in 'Prog::Vm::HostNexus.assemble'
        from ./demo/cloudify_server:77:in '<main>'


HETZNER_USER="*****@gmail.com"
HETZNER_PASSWORD="*****"
HETZNER_SSH_PUBLIC_KEY="ssh-rsa ***** [email protected]"
HETZNER_SSH_PRIVATE_KEY="-----BEGIN OPENSSH PRIVATE KEY-----
*********
-----END OPENSSH PRIVATE KEY-----"

Environment:
Ubicloud running locally via Docker
Hetzner dedicated server leased and accessible
macOS Sequoia 15.0.0

Configuration verified:
HETZNER_USER set to correct Hetzner Robot panel email
HETZNER_PASSWORD set to correct Hetzner Robot panel password
HETZNER_SSH_PUBLIC_KEY contains the actual SSH public key content (not file path)
HETZNER_SSH_PRIVATE_KEY contains the actual SSH private key content (not file path)

SSH key fingerprint verified to match the one registered in Hetzner console panel.

Troubleshooting steps taken:
Verified Hetzner API credentials can be used to log into the web panel
Confirmed SSH key is properly registered in Hetzner panel
Double-checked that environment variables contain key content rather than file paths

Questions:
Are there any additional authentication requirements for the Hetzner Robot API that I might be missing?
Could the issue be related to the encrypted SSH private key requiring a passphrase?
Are there any specific Hetzner Robot API permissions or settings that need to be enabled?
Is there a way to test the Hetzner API connection independently to isolate the issue?

The error occurs specifically at the pull_ips API call (/subnet endpoint) which suggests the authentication is failing at the very first API request.
Any guidance would be greatly appreciated!

Additional info:
Server IP: 116.203.179.16
Location: hetzner-fsn1 (eu-central-h1)
SSH key type: RSA 3072-bit

Answered by byucesoy

Aug 1, 2025

Yes, that is very likely to be reason. In this case, even if the authentication works, future steps would fail due to bare metal vs VM difference.

View full answer

aamederen · 2025-08-01T13:24:31Z

aamederen
Aug 1, 2025
Maintainer

Hi @anilgulgor

There a few things that you can try. Can you check the following?

Did you apply the environment settings in demo/.env file? Have you restarted the docker compose after changing the environment variables?
Can you try the following commands after running docker exec -it ubicloud-app ./bin/pry?

Config.hetzner_user

Config.hetzner_password

Config.hetzner_ssh_private_key

Config.hetzner_ssh_public_key

Excon.new(
      Config.hetzner_connection_string, 
      user: Config.hetzner_user, 
      password: Config.hetzner_password, 
      headers: {"Content-Type" => "application/x-www-form-urlencoded"}
).get(path: "/subnet", expects: 200)

4 replies

anilgulgor Aug 1, 2025
Author

Hi, thanks for the suggestions! I've tested all the configurations and results:

Environment:
Config.hetzner_user - correctly set to my Hetzner email
Config.hetzner_password - correctly set to my Hetzner password
Config.hetzner_ssh_private_key - correctly set with SSH private key
Config.hetzner_ssh_public_key - correctly set with SSH public key

Docker compose was restarted after changing environment variables

When I run the direct Excon:

I get the same 401 Unauthorized error which confirms the issue is with the Hetzner API authentication, not with the environment configuration.

I'll double-check my Hetzner panel credentials and verify:
That API access is enabled for my account
That the username/password combination is correct
Whether there are any specific API permissions required

The fact that the direct API call also fails with 401 suggests the issue is on the Hetzner authentication side rather than the Ubicloud configuration.

aamederen Aug 1, 2025
Maintainer

You are right, it's probably related to the configuration on the Hetzner side. Please let us know if you figure out what was wrong and feel free to reach out for any other questions or issues.

anilgulgor Aug 1, 2025
Author

I think I found the issue :)

I'm using a Hetzner Cloud CX22 instance, but looking at the code, Ubicloud only supports Hetzner dedicated servers (bare metal).
CX22 uses Hetzner Cloud API, but Ubicloud uses the Robot API which is only for dedicated servers.

Could this be why I'm getting 401 errors?

byucesoy Aug 1, 2025
Maintainer

Yes, that is very likely to be reason. In this case, even if the authentication works, future steps would fail due to bare metal vs VM difference.

Answer selected by byucesoy

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Excon::Error::Unauthorized When trying to exec ubicloud app from local #3688

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Excon::Error::Unauthorized When trying to exec ubicloud app from local #3688

Uh oh!

Uh oh!

anilgulgor Aug 1, 2025

Replies: 1 comment · 4 replies

Uh oh!

aamederen Aug 1, 2025 Maintainer

Uh oh!

Uh oh!

anilgulgor Aug 1, 2025 Author

Uh oh!

aamederen Aug 1, 2025 Maintainer

Uh oh!

anilgulgor Aug 1, 2025 Author

Uh oh!

byucesoy Aug 1, 2025 Maintainer

anilgulgor
Aug 1, 2025

Replies: 1 comment 4 replies

aamederen
Aug 1, 2025
Maintainer

anilgulgor Aug 1, 2025
Author

aamederen Aug 1, 2025
Maintainer

anilgulgor Aug 1, 2025
Author

byucesoy Aug 1, 2025
Maintainer