Keep an alternate path before renewing a remote Tailscale device key
Reauthentication can interrupt the same connection being used to repair a remote device.
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 6 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,626 articlesGuidance and analysis from DSE
Choose one-off or reusable Tailscale enrollment keys deliberately
A reusable key can enroll multiple nodes, so its custody and replacement plan must match that reach.
Read the guide
Treat a Tailscale tag as a workload identity, not a label on an employee laptop
Tagging changes device identity and can keep a device present after its former user leaves.
Read the guide
Prefer scoped restic service capabilities over a broadly executable privileged binary
Keep elevated backup reading power attached to the intended Linux service and reviewed execution path.
Read the guide
Review restic retention groups before counting snapshots to keep
Calculate retention against the selected host, path, and tag groups before enabling removal.
Read the guide
Preview restic restore deletion before reconciling a populated target
Review every proposed target deletion before reconciling an existing directory from a restic snapshot.
Read the guide
Set restic destination chunker parameters before copying snapshots
Choose destination chunking parameters before transferring a restic snapshot history.
Read the guide
Check explicit restic source paths against exclusion expectations
Review executed restic source arguments alongside filters before accepting backup scope.
Read the guide
Match restic repository format to the oldest recovery client
Include the emergency recovery executable in restic repository-format compatibility checks.
Read the guide
Constrain Borg serve to exact repository paths when that is the intent
Test the exact repository boundary granted to a Borg server client.
Read the guide