diff --git a/modules/hetzner_server/main.tf b/modules/hetzner_server/main.tf
new file mode 100644
index 0000000..befaf11
--- /dev/null
+++ b/modules/hetzner_server/main.tf
@@ -0,0 +1,40 @@
+terraform {
+  required_version = ">= 1.0.0"
+  required_providers {
+    hcloud = { source = "hetznercloud/hcloud", version = "~> 1.68.0" }
+  }
+}
+
+locals {
+  # single naming scheme - propagates everywhere
+  ssh_key_name  = "${var.project_name}-key"
+  firewall_name = "${var.project_name}-fw"
+}
+
+resource "hcloud_ssh_key" "this" {
+  name       = local.ssh_key_name
+  public_key = var.ssh_public_key
+}
+
+resource "hcloud_firewall" "this" {
+  name = local.firewall_name
+
+  dynamic "rule" {
+    for_each = var.firewall_rules
+    content {
+      direction  = rule.value.direction
+      protocol   = rule.value.protocol
+      port       = rule.value.port
+      source_ips = rule.value.source_ips
+    }
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = var.project_name
+  image        = var.hcloud_image
+  server_type  = var.hcloud_server_type
+  location     = var.hcloud_location
+  user_data    = var.init_user_data
+  firewall_ids = [hcloud_firewall.this.id]
+}
\ No newline at end of file
diff --git a/modules/hetzner_server/outputs.tf b/modules/hetzner_server/outputs.tf
new file mode 100644
index 0000000..87795a9
--- /dev/null
+++ b/modules/hetzner_server/outputs.tf
@@ -0,0 +1,9 @@
+output "ipv4_address" {
+  description = "Primary public IPv4 address of the host"
+  value       = hcloud_server.this.ipv4_address
+}
+
+output "ipv6_address" {
+  description = "Primary public IPv6 address of the host"
+  value       = hcloud_server.this.ipv6_address
+}
\ No newline at end of file
diff --git a/modules/hetzner_server/variables.tf b/modules/hetzner_server/variables.tf
new file mode 100644
index 0000000..dd64239
--- /dev/null
+++ b/modules/hetzner_server/variables.tf
@@ -0,0 +1,45 @@
+variable "project_name" {
+  type        = string
+  description = "Project / host name"
+}
+
+variable "ssh_public_key" {
+  type        = string
+  description = "Public SSH key to manage the host"
+}
+
+variable "hcloud_server_type" {
+  type        = string
+  description = "Hetzner server type (e.g. cx22)"
+}
+
+variable "hcloud_image" {
+  type        = string
+  description = "OS image to boot (e.g. debian-13)"
+}
+
+variable "hcloud_location" {
+  type        = string
+  description = "Hetzner location (fsn1, nbg1, hel1, ash1)"
+  validation {
+    condition     = contains(["fsn1", "nbg1", "hel1", "ash1"], var.hcloud_location)
+    error_message = "location must be one of fsn1, nbg1, hel1, ash1"
+  }
+}
+
+variable "init_user_data" {
+  type        = string
+  description = "Pre-rendered cloud-init user data (optional)"
+  default     = null
+}
+
+variable "firewall_rules" {
+  type = list(object({
+    direction  = string
+    protocol   = string
+    port       = string
+    source_ips = list(string)
+  }))
+  description = "Firewall rules applied to the host"
+  default = []
+}
\ No newline at end of file