Removing a Node

There is one command, and it is destructive. Read this before you run it.

Uninstall

sudo scripts/tc-operator/tc-operator uninstall --config operator.yaml

In this form it is safe. It:

Takes a database dump first, to /etc/trusted-codes/backup-<timestamp>.sql.gz, mode 0600.
Counts real user rows.
Refuses if there are any, and tells you where the backup is.

That refusal is the guardrail. Tearing the stack down removes the data volumes, and on a node with real users that is not recoverable from anything still on the box.

Uninstall With `--purge`

sudo scripts/tc-operator/tc-operator uninstall --config operator.yaml --purge

This is the destructive path. It still takes the dump first, then asks you to type the project name at the terminal to confirm. Past that confirmation it tears the stack down with its volumes and removes the generated certificates and secrets.

What that means concretely:

The database is gone, with every account, connection, codeword and vault on the node.
/etc/trusted-codes/secrets.env is removed. With it goes the node’s federation identity and the key that decrypts personal data. The backup dump it just wrote is unreadable without that file.
The mTLS certificate is removed. A future install mints a new one with a new fingerprint, which has to be verified and admitted again.

So before you purge: copy the backup and a copy of secrets.env off the box, if there is any chance you will want the data back. Copying the dump alone gives you a file nobody can read.

The confirmation prompt is the only one in the whole of tc-operator. Everything else runs without a typed gate, because everything else touches only your own box and is recoverable. This one is not.

Removing a Local Rehearsal Node

tc-operator uninstall --local --config operator.yaml --purge

Same command, pointed at the isolated loopback project a --local install creates. It leaves a real node on the same machine alone.

What Uninstall Does Not Do

It removes your node from your box. It does not remove it from the registry.

Your node’s admission entry, and the central record of it, are removed by Trusted Codes — the command that does it is central, and is not part of the operator distribution at all. If you are decommissioning a node for good, tell them, so a fresh install later starts from zero rather than colliding with a stale entry.

Peers that already hold your node in their copy of the registry stop trusting it when the signed registry republishes without it. That is not instant, and it is not something you control from the box.

If You Only Want to Stop Serving Something

You probably do not want uninstall at all.

To stop one web surface: tc-operator service stop <surface>. The bundle is kept and a restart is quick. See Running the node.
To stop accepting new accounts: set auth.registration_mode: closed and reload.
To stop other servers placing invitations on your node: the inbound kill switch in the admin app, under Node Settings. It can be set to deny from any state.
To leave the mesh without leaving the node: turn the federation flags off in operator.yaml and reload.

Each of these is reversible. Uninstall is not.