app.py

@@ -977,10 +977,26 @@ print(backup)
     return {"status": "reloaded", "backup": backup}
 
 
-async def _upsert_dns_records(zone: str, name: str) -> dict:
+def _get_hetzner_dns_token() -> str:
+    token = _read("HETZNER_DNS_TOKEN")
+    if token:
+        return token
+    rc, _out, err = _ssh(
+        "sascha@10.4.1.116",
+        "sudo /app-config/homelab-butler/vault-sync.sh",
+        timeout=120,
+    )
+    if rc != 0:
+        raise RuntimeError(f"Vault cache sync failed: {err[-300:]}")
+    _load_vault_cache()
     token = _read("HETZNER_DNS_TOKEN")
     if not token:
-        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable")
+        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable after vault sync")
+    return token
+
+
+async def _upsert_dns_records(zone: str, name: str) -> dict:
+    token = await asyncio.to_thread(_get_hetzner_dns_token)
     headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
     api = "https://api.hetzner.cloud/v1"
     async with httpx.AsyncClient(timeout=30) as client:

tests/test_app.py

@@ -309,3 +309,16 @@ def test_proxy_route_endpoint_configures_caddy_and_dns(monkeypatch):
         ("caddy", "speed.guck.tv", "127.0.0.1:8080"),
         ("dns", "guck.tv", "speed"),
     ]
+
+
+def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
+    reads = iter([None, "refreshed-token"])
+    calls = []
+    monkeypatch.setattr(app, "_read", lambda _name: next(reads))
+    monkeypatch.setattr(app, "_load_vault_cache", lambda: calls.append("reload"))
+    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, "vault-sync: ok", "")))
+
+    assert app._get_hetzner_dns_token() == "refreshed-token"
+    assert calls[0][0] == "sascha@10.4.1.116"
+    assert calls[0][1] == "sudo /app-config/homelab-butler/vault-sync.sh"
+    assert calls[1] == "reload"