Forgot password? on the sign-in page emails a link that sets a new password, so nobody needs you or the command line. Set up email (Gmail, say), then switch it on.
In Broadcast: Server, People, Ways to sign in.
In Classic or Neu: Settings, Account & Access, Ways to sign in.
The link goes out through an email notification’s mail server, only to the account’s own address. If Send a test on an email notification already works, skip ahead.
Gmail won’t take your normal password here. In your Google account, switch on 2-Step Verification (Security), then open myaccount.google.com/apppasswords, type Usherr and press Create. Google shows 16 letters in four groups: copy them and type them WITHOUT THE SPACES. With the spaces, Gmail refuses it (error 534).
Where Usherr’s email is set up.
Pick Email. SMTP server: smtp.gmail.com (type it: the grey text is only an example). Port 587, STARTTLS. Username: your Gmail address. Password: the app password, no spaces. From address: your Gmail address too. Send to: where notifications go. Press Send a test: when it ends with Done: accepted by the server, press Add Email.
The link in the email starts with it.
The address your phones and computers open Usherr at, for example your Tailscale name with :8264. It saves by itself. A link opens on any device that can reach this address.
The link goes to the email address on the account.
Fill it in and save. For the others in the house: All accounts, Edit, Email. An account without one can’t use the email reset (an administrator sets its password instead).
Where the ways to sign in are switched on and off.
If the button is greyed out, the line above it says what’s missing. A link works once, for 30 minutes, signs the account out everywhere, and two-step sign-in still asks for its code.
In a private window, open Usherr, press Forgot your password?, type your username and press Email me a link. The email comes within a minute (look in spam the first time). You don’t have to set a new password: the link simply stops working after 30 minutes.
Anyone with an email address on their account can now reset a forgotten password themselves. Every request and reset shows on Activity.