Each phone pins the server's key when it pairs, and talks to that key only. The key lives in <data>/tls/.
- The machine's address changed: nothing to do. The server issues a new certificate on the same key, and phones keep working.
- The server was restored from a backup with its
tls/folder: nothing to do either. - The
tls/key was lost: the server has a new key, and every phone has to pair again. AI assistants need their configuration updated with the new fingerprint too.
That's why <data>/tls/ belongs in your backups. See The server's own backups.