Users and accounts

Three roles

Administrator

The server. Health, updates, licensing, PHP extensions, webhooks, recovery, backup keys, the audit log, and every account on it.

Reseller

Their own customers and the accounts they own. Can create users, assign and transfer accounts, set disk limits, suspend, and set their own branding. Cannot see the server's health, its updates or another reseller's customers.

Customer

The accounts assigned to them, and nothing else. Sites, files, databases, backups, jobs.

The role is checked in the privileged core, per operation, not in the interface. The web tier's opinion about who you are is re-authorised against core's own records before anything happens, so a compromised web tier can do no more than a signed-in administrator could.

Managing users

klyrn user list
klyrn user create you@example.com --name "Your Name" --role admin
klyrn user create customer@example.com --accounts acme,acme2
klyrn user create customer@example.com --reseller reseller@example.com

klyrn user reset customer@example.com      # new password
klyrn user disable customer@example.com
klyrn user enable customer@example.com
klyrn user delete customer@example.com
klyrn user totp-reset customer@example.com # clear a lost second factor

A password is generated when you do not supply one. Passwords are argon2id; sessions are server-side, SameSite=Strict, and rotated on sign-in. Every user can add TOTP with recovery codes from their own account page, and can see and revoke the sessions they are signed in on.

Accounts and ownership

klyrn user assign acme customer@example.com
klyrn user assign acme none                        # admin only: leave it unowned
klyrn user account-transfer acme newowner@example.com
klyrn user account-suspend acme --reason "invoice 4417 unpaid"
klyrn user account-unsuspend acme

A transfer changes who manages the account, and nothing else. The files stay owned by the Unix user: that identity belongs to the account, not to the person who manages it. No file is moved, no path changes, no site restarts.

A reseller cannot leave an account with no owner: they have to assign it to themselves or to one of their own customers. Only an administrator can un-own an account.

Suspending an account cascades to its sites, and unsuspending restores only the ones the cascade suspended. A site you suspended individually beforehand stays suspended, which is almost always what you meant.

Deleting an account

This is the most destructive thing in the product, and it is built accordingly: nothing happens without a preview, the account name has to be typed exactly, and remote backup copies are kept by default.

klyrn user account-delete acme --confirm acme
klyrn user account-delete acme --confirm acme --backup-first
klyrn user account-delete acme --confirm acme --delete-remote-backups

The preview counts what will go, from the database rather than by estimate: every site with its type and certificate, every database by name, the cron entries, the local backups and their total size, the remote copies, and the measured disk usage.

Removed: every site, every database, the local backups, the Unix user and the home directory, and the account row.

Kept, unless you ask otherwise: the copies in the bucket. They are the only thing that survives a mistake, and "delete everything everywhere" should never be the path of least resistance. The job says how many remain and that they can still be restored.

--backup-first backs every site up before removing anything and stops if a backup fails. The deletion is refused outright if any of the account's sites has a job running.

The audit log

Every operation that changes something is written to the audit log with the actor, their address, the operation, the target and the outcome, including the ones that only read, when what they read is a secret. Revealing a site's stored credentials, exporting a backup key and downloading a file are all recorded, because the interesting question about those is who asked.

The audit log currently grows without bound: there is no retention policy and no export. On a busy server, watch its size.