OPERATIONS
Security & accounts
Clear roles and explicit permissions for your server.
Accounts and roles
Use separate accounts with Administrator, Operator or Viewer roles. Permissions are enforced by the API and agent. Enable two-factor authentication and store recovery codes safely. Administrators can require two-factor authentication for administrators or for everyone.
The Linux privilege boundary
The API runs without root privileges. A separate agent validates supported system operations through a typed registry and records relevant actions in the audit log. Terminal and permitted host-file access use a linked Linux account and its actual permissions. Managing system operations also checks that account’s sudo rights.
Secure the connection
Use Settings → Security → HTTPS for Tailscale Serve or local-network HTTPS, or configure your own reverse proxy. Local HTTPS uses EveryOS’s certificate authority, which must be trusted on each device. An administrator session controls the real host; protect it accordingly.
Locking, sessions and audit
Lock the desktop when stepping away. Review account sessions and revoke access when needed; a desktop lock is not a revocation of a Linux authorization grant. Required two-factor authentication must be completed before entering the desktop. Keep recovery codes outside the server and use the audit log to review security-relevant actions.