> Source: https://nexusatlas.dev/guides/remove-node — Nexus Atlas developer documentation (Guides). Converted from the HTML page; the page is canonical.

# Remove a compromised node shipped

A drone is lost on a sortie, or a laptop with a node key is stolen. This guide takes it out of the fleet everywhere at once: its sessions end, its handshakes are refused at every node and at the relays, and the mesh secret it held is replaced. The mechanism is described under [Revocation](https://nexusatlas.dev/docs/concepts/identity#revocation).

> **What you need:** a record fleet (`[auth] provider = "fleet"`), the operator host with the authoring copy of the list and the config-author key, and for the relays the control-plane token in `$ATLAS_CONTROL_PLANE_TOKEN`.

## A node or a key

Revoke the **node** when the device itself is out of your hands: its id and every key it held are revoked, and it can return only as a new identity. Revoke a **key** (give it in base64) when the device is safe but a key leaked: the record stays and keeps its other keys, so rotate in a [next key](https://nexusatlas.dev/guides/key-rotation) first.

## Sign and push

```
$ atlasd fleet revoke drone03 --reason "lost on sortie 12" \
    --push /etc/atlas/config.toml --push-relays
```

The command removes the record, rotates the mesh secret to the remaining records, signs the next sequence number and hands the list to the local daemon, which floods it over every session; `--push-relays` sends the revoked transport keys to the relay registry. Without the flags, push later with [atlasd fleet push -c <config> --relays](https://nexusatlas.dev/docs/cli#cmd-fleet-push).

From the dashboard instead: Fleet → **Remove nodes…**, tick the node, add the reason, **Preview** (seq 7 → 8, mesh secret to 5 nodes), **Sign and push**. The node you are on must hold a config-author key the fleet trusts, and cannot remove itself.

## Confirm it held

- Every node reports the new sequence: `atlasd fleet show -c /etc/atlas/config.toml`, or the Fleet tab, where the node is marked **revoked** in the records table and both matrices.

- Within a second no node holds a session with it: `security.evicted_total` rises on each former neighbour and `security.peer_evicted` is in their journals. `atlasd status` shows routes through other next hops.

- On the relays, the key's session is dropped within one poll and its next attempt is refused.

- If the removed node is still running, its `atlasd status` says *revoked by fleet seq 8*.

## Afterwards

A removal made from the dashboard was signed on that node: pull the list back to the operator host with `atlasd fleet show -c <config> --json` before the next edit. To bring a replacement in, generate a new identity with [atlasd keygen --identity](https://nexusatlas.dev/docs/cli#cmd-keygen-identity) and add it with `fleet add-node`; the operator host keeps the newest mesh secret beside its list and seals a copy into the new record.

## Boundaries

The removed node keeps what it already received; nothing new reaches it, and traffic captured on the air before the removal stays unreadable because session keys are ephemeral. Relays learn revocations from the registry, polled every 30 s by default, or from a `[relay] revoked_keys_file` on the relay host.