Remove a compromised node shipped

A drone is lost on a sortie, or a laptop with a node key is stolen. This guide takes it out of the fleet everywhere at once: its sessions end, its handshakes are refused at every node and at the relays, and the mesh secret it held is replaced. The mechanism is described under Revocation.

A node or a key

Revoke the node when the device itself is out of your hands: its id and every key it held are revoked, and it can return only as a new identity. Revoke a key (give it in base64) when the device is safe but a key leaked: the record stays and keeps its other keys, so rotate in a next key first.

Sign and push

$ atlasd fleet revoke drone03 --reason "lost on sortie 12" \
    --push /etc/atlas/config.toml --push-relays

The command removes the record, rotates the mesh secret to the remaining records, signs the next sequence number and hands the list to the local daemon, which floods it over every session; --push-relays sends the revoked transport keys to the relay registry. Without the flags, push later with atlasd fleet push -c <config> --relays.

From the dashboard instead: Fleet → Remove nodes…, tick the node, add the reason, Preview (seq 7 → 8, mesh secret to 5 nodes), Sign and push. The node you are on must hold a config-author key the fleet trusts, and cannot remove itself.

Confirm it held

• Every node reports the new sequence: atlasd fleet show -c /etc/atlas/config.toml, or the Fleet tab, where the node is marked revoked in the records table and both matrices.
• Within a second no node holds a session with it: security.evicted_total rises on each former neighbour and security.peer_evicted is in their journals. atlasd status shows routes through other next hops.
• On the relays, the key's session is dropped within one poll and its next attempt is refused.
• If the removed node is still running, its atlasd status says revoked by fleet seq 8.

Afterwards

A removal made from the dashboard was signed on that node: pull the list back to the operator host with atlasd fleet show -c <config> --json before the next edit. To bring a replacement in, generate a new identity with atlasd keygen --identity and add it with fleet add-node; the operator host keeps the newest mesh secret beside its list and seals a copy into the new record.

Boundaries

The removed node keeps what it already received; nothing new reaches it, and traffic captured on the air before the removal stays unreadable because session keys are ephemeral. Relays learn revocations from the registry, polled every 30 s by default, or from a [relay] revoked_keys_file on the relay host.