Hosting providers

Users are not accounts

A user is somebody who signs in. An account is a Unix user that owns files, sites, databases and cron entries. A user may be assigned several accounts; an account belongs to at most one user. Keeping them separate is what lets ownership move without moving a byte.

Administrator

The server: health, updates, licensing, PHP extensions, webhooks, backup keys, recovery, the audit log, every account.

Reseller

Their own customers and the accounts they own: create users, assign and transfer accounts, set limits, suspend, brand the panel. Never the server's health, its updates, or another reseller's customers.

Customer

The accounts assigned to them, and nothing else. A customer cannot set their own limits.

Roles are checked in the privileged core, per operation. Users, roles and hosting accounts.

Giving a customer an account

klyrn user create customer@example.com --name "Acme" --role customer
klyrn site create acme.example --type wordpress --account acme --admin-email owner@acme.example
klyrn user assign acme customer@example.com
klyrn account quota acme --limit 10G

Creating the first site for a new account name creates the account: the Unix user, its home with a mode nobody else can list, its PHP-FPM master inside its own systemd slice. Assigning the account to the user is what makes it appear when they sign in. The panel does the same four things from the New site form.

Account names are lowercase, start with a letter, and are 3–16 characters; reserved names (root, klyrn, www-data, mysql, admin and the like) are refused. A name already taken as a Unix user is refused rather than reused.

Bounding what an account may use

Two different kinds of limit, and the difference matters when a customer asks why something happened.

Disk: a boundary, measured

Usage and inodes are measured every fifteen minutes. Past the limit, uploads, extractions, copies, new archives, restores and new sites are refused, with the limit, the usage and the age of the measurement in the message. Delete, rename and edit stay allowed, because deleting is the way back under. A script the account runs itself can still write past it; the next measurement shows that it did.

CPU, memory, processes: a kernel limit

A systemd slice per account with CPUQuota, MemoryMax and TasksMax, set from the account's page in the panel or through the API: Unlimited, Recommended (derived from this server's hardware) or Custom. Measured: a 25% quota ran a busy loop at 25.00% of one core over ten seconds. It reaches Node.js applications and PHP: each account runs its own PHP-FPM master inside its slice, so its workers are in the account’s cgroup. It does not reach cron.

Lowering a memory limit below what an account is using right now warns that the kernel would kill its processes immediately, and refuses unless you confirm. Every existing account stays unlimited across an upgrade. Resource limits, measured.

Resellers and white label

A reseller is a user with a role, their own customers, and a brand: logo, name, accent colour and support contact, shown to their customers on the sign-in page and in the panel. The hierarchy is two levels deep and cannot be made deeper; a reseller cannot create a reseller.

klyrn user create reseller@example.com --name "Acme Hosting" --role reseller
klyrn user create customer@example.com --reseller reseller@example.com

Reseller accounts need a Business or Enterprise licence, and neither is on sale yet. It is the one feature the Free edition withholds; creating or promoting a reseller on a plan without it is refused with that reason. Resellers and white-label branding.

Backups per site, and the bucket

klyrn backup schedule acme.example daily --keep 7
klyrn backup create acme.example
klyrn backup restore 12 --only databases --yes

A backup is the site's files, one dump per database, the cron entries, and a manifest with a SHA-256 per artefact. It is marked verified only after the archive has been listed back and every checksum matched. Copies to an S3-compatible bucket are encrypted on the server before they leave it; the key is versioned and never discarded, so rotating it adds a key rather than stranding last month's copies.

The bucket also holds an encrypted manifest of every account and site, rewritten after each remote backup, so a replacement machine can list what it is about to restore before restoring anything. Backups · Disaster recovery.

Suspend, transfer, delete

klyrn user account-suspend acme --reason "invoice 4417 unpaid"
klyrn user account-unsuspend acme
klyrn user assign acme other@example.com
klyrn user account-delete acme --confirm acme --backup-first

Suspension

Every name the account answers for (aliases and redirects included) returns a fixed 403 page. Files, databases, backups, cron and certificates are untouched. Whoever lifts it must rank at least as high as whoever imposed it.

Transfer

Changes who manages the account and nothing else. No file moves, no path changes, no site restarts.

Deletion

A preview counted from the database, the account name typed exactly, refused outright while any of its sites has a job running, and the off-site copies kept unless you say otherwise. With --backup-first, a backup that fails stops the deletion.

Users and accounts has every flag.

Moving a customer in

klyrn import cpanel /root/backup-acme.tar.gz
klyrn import show 1
klyrn import apply 1 --account acme

From a cPanel or DirectAdmin backup, or over SSH from a live cPanel server (as root or as the account) or from any server at all. Nothing is installed on the source and nothing is written here until you have read the plan. The imported site is live on the new server first, with a preview and an eleven-check verification report, and the old server keeps serving until you change DNS. Mailboxes are counted and reported; KLYRN hosts no mail. Migration · What to expect.

Automating it

klyrn user token ops@example.com --name "Provisioning" --days 90 --scopes sites,databases,backups

Every panel action is a typed operation, and the HTTP API calls the same registry with the same checks. A token is narrowed to the job it does; signed webhooks tell your systems about backups, certificates, suspensions and failed jobs without polling. CLI, API and webhooks.