Detached servers

Detaching is being rolled out and isn't available in every workspace yet. If a server's settings don't show Detach, contact support.

Detaching hands the server's current configuration to you. Your applications, databases, custom domains, TLS renewal, local snapshots, and configured S3 backups keep running. Billing for applications on this server stops at handover. strackt stops deploying, monitoring, patching, and maintaining the server, and *.on-strackt.dev URLs stop working. Set up your own domain before detaching if a site needs one.

During detach, provide a username and SSH public key for your admin account. Choose whether strackt removes its admin key after you confirm or keeps it so you can re-attach later in one click. Removing access is the recommended choice. strackt retains access until you confirm either way.

Confirm the handover

Sign in with your new account and read the code with the command on the server page. Enter the eight-character code in Confirm handover. This proves that your key and sudo access work. You have 14 days from activation. strackt sends reminders on days 1, 7, and 13. If you do not confirm by the deadline, the server returns to strackt management and changes you made after handover are overwritten.

After confirmation, the page says Finishing the handover while strackt removes its retained connection and stops monitoring. If you chose a clean break, strackt deletes its admin key. If the server could not rebuild, the guide explains that the old login remains configured until your next successful rebuild and gives a journalctl command to inspect the failure. If you kept access, the admin key remains in strackt-access.nix; delete that file and rebuild whenever you want to remove it.

Connect and rebuild

The server page shows the handoff SSH command and a downloadable guide. Sign in using the private key that matches the public key supplied during detach. The configuration and lock file live at /etc/nixos/; the server's files live at /etc/nixos/hosts/<id>/. The default.nix, hardware.nix, apps/, services/, and secrets/ files describe the system. Leave strackt-access.nix in place until you confirm the handover.

After editing configuration, apply it with the identifier shown on the server page:

For security updates, run sudo nix flake update from /etc/nixos, then rebuild with the same command. Keep a copy of the previous lock file first. If the new system fails, use sudo nixos-rebuild switch --rollback.

Backups and secrets

The backup schedule remains on the server. The credentials are encrypted at /etc/nixos/hosts/<id>/secrets/strackt-backup-<team-id>.yaml; the running job receives a root-only file under /run/strackt-backup/. The handover guide includes the exact encrypted path and timer names.

With an ed25519 handoff key, copy the encrypted YAML to a trusted device, convert your private key to an age identity, edit the copy with sops, then return the encrypted copy to the server as root. The downloadable guide gives the exact transfer commands:

If your handoff key has another type, the carried-over encrypted credentials remain usable but cannot be edited with that key. To replace them, use a root-owned plain file outside the Nix store and update the backup modules' credentials path and the host's SOPS declaration. The downloadable guide gives the exact steps. Keep the original encrypted file until the new backup succeeds.

Cancel a handover

The workspace owner can choose Cancel handover on the self-managed server page. This rebuilds the server with its strackt-managed configuration and overwrites manual configuration changes made after handover. strackt recalculates application billing when the return completes; a subscription whose grace period has ended may need to be restarted. If the return fails, check that the server is online and use Retry on the same page.

Re-attach or delete the account

After release, Re-attach is available only if you chose to keep strackt's access. Re-attaching regenerates the managed configuration and overwrites changes made on the server after handover. If you chose a clean break, add the server again using your own SSH key to return it to strackt.

Account deletion is refused while a handover or return is unfinished. Confirm the handover or let the server return to management before trying again. A released server remains running under your management when your account records are deleted. Keep your downloaded guide and server access details before deleting the account.