Revoke, detach and uninstall Guard

You can end Guard’s access to your homelab without touching the machine, stop only a published address, or remove Guard from a host. This page covers each, what it ends and what stays.

​

Choose what you want to end

​

Detach a server

Open the server’s Guard panel and select Detach server, then Detach and revoke. Or run techstack api servers detach <server-id> with --confirm-server-id <server-id>. The confirmation must repeat the exact server ID; see the command reference. In one step Techstack revokes:

• Guard’s credential;
• the server’s host-key identity;
• the server’s kombify.me address and its kombify Connect listing.

Nothing runs on your machine as part of this. The machine, its containers and its data are not touched, and no provider is called. The server’s record stays in Techstack as a detached record. This cannot be undone from the panel. To manage the server again, pair it again (see Pair a server).

​

What happens to the address and the listing

Detach ends the server’s reach: its kombify.me route is revoked and it is removed from your devices in kombify Connect. Revocation is repeated until both confirm; until then the server shows a reason such as “Ending access has not finished everywhere yet. It is retried.” The name can briefly remain, but it no longer reaches your server and answers with an error. Revoking the device from kombify Connect has the reverse effect: it ends Guard’s access to Techstack as well.

​

What happens on the server

The next time the detached Guard contacts Techstack it is refused with guard_identity_revoked, and it ends its local state:

• it destroys its identity key and the credential it holds, including any pairing token it still kept;
• it removes its queued telemetry;
• it deletes operation records Techstack acknowledged.

Records that Techstack never acknowledged are kept, because they cannot be recreated. Guard logs how many remain. Keep or export the Guard state directory (/var/lib/techstack/guard), then delete it. A Guard with no secrets left stays idle. A new pairing command starts over.

​

Rotate a credential

Rotate credential issues a replacement credential, shown once, and the old one stops being accepted. Copy the replacement to Guard on the server before you close the dialog.

​

Publish or stop publishing an address

A paired server has no public route. Nothing is published until you turn it on for that server, and the relay carries no traffic until then.

1. In the Guard panel, under Publish at a kombify.me address, enter a Service name and the Port on this server.
2. Select Publish. This needs a fresh sign-in with a second factor from the last five minutes.

The port is on the server’s own loopback. Anyone on the internet can open the address, and the relay authenticates Guard, not the visitor, so publish only a service that protects itself. Select Stop publishing at any time to withdraw it; withdrawing never needs the second factor. This option is available only in a connected installation. See kombify.me for how addresses work.

​

Remove Guard from a host

There is no packaged uninstall command for Guard on Linux in the current release. Detach first, so Techstack stops trusting the server and Guard destroys its secrets. Removing the software is then a manual step. Guard places these on the host: To remove Guard, run these steps as an administrator, in this order:

1. Stop and disable the services: sudo systemctl disable --now techstack-agent.service techstack-guard-executor.socket.
2. Delete the unit files techstack-agent.service, techstack-agent.service.legacy, techstack-guard-executor.socket and techstack-guard-executor@.service from /etc/systemd/system, then run sudo systemctl daemon-reload.
3. Delete the two executables listed above.
4. Delete the credential, state and log directories listed above.
5. Delete the system user with sudo userdel kombify-guard.

A host that never switched to the privilege-split layout has only the daemon unit and no kombify-guard user, so the steps for the other items report that they do not exist. That is expected.

​

What remains

Removing Guard does not remove what StackKits or you installed with it:

• Docker and your containers, volumes and application data;
• the StackKits runtime and workspace. Remove a StackKits deployment with the remove command;
• a published address. Removing Guard alone does not withdraw it, so select Stop publishing or detach the server first.