Resellers

Creating a reseller

klyrn user create reseller@example.com --name "Acme Hosting" --role reseller
klyrn user create customer@example.com --reseller reseller@example.com
klyrn user reseller customer@example.com reseller@example.com
klyrn user reseller customer@example.com none     # detach

Reseller accounts require a licence that includes them: a Business or Enterprise licence. Creating or promoting one on a plan without the feature is refused with that reason and where to change it.

Nested resellers do not exist. The hierarchy is exactly two levels deep, host and reseller, and a customer belongs to at most one of them.

What a reseller can do

Their customers

Create, update and delete the users they manage. A user outside their own set is reported as not found, because "forbidden" would confirm it exists.

Their accounts

List, assign, transfer, suspend and unsuspend the accounts they own.

Disk limits

Set a limit on an account they own. Not on an account they own themselves, or the limit their administrator gave them would not hold.

Branding

Their own logo, name, accent colour and support contact, shown to their customers.

Jobs and events

Only the jobs their own people started.

What they cannot reach: server health, the update engine, licensing, PHP extensions, webhooks, backup keys, recovery, the server profile and the audit log. Those belong to the host.

White-label branding

One brand row per owner. Row zero is the host's, and every reseller may have their own. A customer sees their reseller's brand if it is set, otherwise the host's. A reseller sees their own if set, otherwise the host's, and may edit it.

Logo

PNG, SVG, JPEG or WebP, up to 200 KB decoded.

Name

Up to 40 characters, with no markup or control characters.

Accent colour

A hex triplet or an oklch() value.

Support URL and email

An http or https URL up to 200 characters, and an address that parses.

The sign-in page needs the brand before anyone has signed in. Reading it is the one operation on the server that needs no session. A brand with every field cleared is deleted.

Removing the "powered by KLYRN" line is a licensed feature. The setting is stored whatever your plan, and honoured only when the licence includes white-labelling.

Your own nameservers

A reseller can put their own nameserver names, such as ns1.theirbrand.com, on their customers' zones. The panel shows the glue records to create at the registrar and checks them live.

IP addresses

The administrator can give a hosting account a dedicated address and allot addresses to resellers. Each address shows its reverse DNS, checked live.

Who may lift a suspension

The person lifting it must rank at least as high as the person who imposed it. A reseller may lift their own suspension. A reseller may not lift an administrator's. The message names who imposed it and who may lift it.

A suspension imposed from the root command line counts as an administrator's, so any administrator can lift it.

Demoting or deleting a reseller

Turning a reseller back into a customer, or deleting them, clears the reseller link on every customer they managed and removes their branding row. Their customers become unmanaged and immediately see the host's brand.

The accounts themselves are untouched. Reassign them with klyrn user assign.