Hosting providers

Users are not accounts

A user is somebody who signs in. An account is a Unix user that owns files, sites, databases and cron entries. A user may be assigned several accounts. An account belongs to at most one user. Because they are separate, ownership can move without moving a byte.

Administrator

The server: health, updates, licensing, PHP extensions, webhooks, backup keys, recovery, the audit log, every account.

Reseller

Their own customers and the accounts they own: create users, assign and transfer accounts, set limits, suspend, brand the panel. Never the server's health, its updates, or another reseller's customers.

Customer

The accounts assigned to them, and nothing else. A customer cannot set their own limits.

Roles are checked in the privileged core, per operation. Users, roles and hosting accounts.

Giving a customer an account

klyrn user create customer@example.com --name "Acme" --role customer
klyrn site create acme.example --type wordpress --account acme --admin-email owner@acme.example
klyrn user assign acme customer@example.com
klyrn account quota acme --limit 10G

Creating the first site for a new account name creates the account. That is the Unix user, its home with a mode nobody else can list, and its PHP-FPM master inside its own systemd slice. Assigning the account to the user makes it appear when they sign in. The panel does the same four things from the New site form.

Account names are lowercase, start with a letter, and are 3 to 16 characters. Reserved names (root, klyrn, www-data, mysql, admin and the like) are refused. So is a name already taken as a Unix user.

Bounding what an account may use

Disk: a boundary, measured

Usage and inodes are measured every fifteen minutes. Past the limit, uploads, extractions, copies, new archives, restores and new sites are refused. The message gives the limit, the usage and the age of the measurement. Delete, rename and edit stay allowed, because deleting is the way back under. A script the account runs itself can still write past the limit, and the next measurement shows that it did.

CPU, memory, processes: a kernel limit

A systemd slice per account with CPUQuota, MemoryMax and TasksMax. Set it from the account's page in the panel or through the API: Unlimited, Recommended (derived from this server's hardware) or Custom. Measured: a 25% quota ran a busy loop at 25.00% of one core over ten seconds. It reaches Node.js applications and PHP, because each account runs its own PHP-FPM master inside its slice. It does not reach cron.

Lowering a memory limit below what an account is using warns that the kernel would kill its processes immediately, and refuses unless you confirm. Every existing account stays unlimited across an upgrade. Resource limits, measured.

Resellers and white label

A reseller is a user with a role, their own customers, and a brand: logo, name, accent colour and support contact. Their customers see it on the sign-in page and in the panel. The hierarchy is two levels deep, and a reseller cannot create a reseller.

klyrn user create reseller@example.com --name "Acme Hosting" --role reseller
klyrn user create customer@example.com --reseller reseller@example.com

Reseller accounts need a Business or Enterprise licence, and neither is on sale yet. It is the one feature the Free edition withholds. Creating or promoting a reseller on a plan without it is refused with that reason. Resellers and white-label branding.

Backups per site, and the bucket

klyrn backup schedule acme.example daily --keep 7
klyrn backup create acme.example
klyrn backup restore 12 --only databases --yes

A backup is the site's files, one dump per database, the cron entries, and a manifest with a SHA-256 per artefact. It is marked verified only after the archive has been listed back and every checksum matched. Copies to an S3-compatible bucket are encrypted on the server before they leave it. The key is versioned and never discarded, so rotating it leaves last month's copies readable.

The bucket also holds an encrypted manifest of every account and site, rewritten after each remote backup. A replacement machine reads it to list what it is about to restore. Backups, Disaster recovery.

Suspend, transfer, delete

klyrn user account-suspend acme --reason "invoice 4417 unpaid"
klyrn user account-unsuspend acme
klyrn user assign acme other@example.com
klyrn user account-delete acme --confirm acme --backup-first

Suspension

Every name the account answers for (aliases and redirects included) returns a fixed 403 page. Files, databases, backups, cron and certificates are untouched. Whoever lifts it must rank at least as high as whoever imposed it.

Transfer

Changes who manages the account and nothing else. No file moves, no path changes, no site restarts.

Deletion

Needs a preview counted from the database and the account name typed exactly. It is refused while any of the account's sites has a job running. Off-site copies are kept unless you say otherwise. With --backup-first, a backup that fails stops the deletion.

Users and accounts has every flag.

Moving a customer in

klyrn import cpanel /root/backup-acme.tar.gz
klyrn import show 1
klyrn import apply 1 --account acme

Import from a cPanel or DirectAdmin backup, over SSH from a live cPanel server (as root or as the account), or from any server at all. Nothing is installed on the source, and nothing is written here until you have read the plan. The imported site is live on the new server first, with a preview and an eleven-check verification report. The old server keeps serving until you change DNS. Mailboxes and FTP logins come across from cPanel, DirectAdmin and Plesk. Migration, What to expect.

Automating it

klyrn user token ops@example.com --name "Provisioning" --days 90 --scopes sites,databases,backups

Every panel action is a typed operation, and the HTTP API calls the same registry with the same checks. A token is narrowed to the job it does. Signed webhooks tell your systems about backups, certificates, suspensions and failed jobs without polling. CLI, API and webhooks.