Users and accounts

Three roles

Administrator

The server. Health, updates, licensing, PHP extensions, webhooks, recovery, backup keys, the audit log, and every account on it.

Reseller

Their own customers and the accounts they own. Can create users, assign and transfer accounts, set disk limits, suspend, and set their own branding. Cannot see the server's health, its updates or another reseller's customers.

Customer

The accounts assigned to them, and nothing else. Sites, files, databases, backups, jobs.

The role is checked in the privileged core, per operation. Core re-authorises what the web tier says about who you are against its own records before anything happens. A compromised web tier can do no more than a signed-in administrator could.

Managing users

klyrn user list
klyrn user create you@example.com --name "Your Name" --role admin
klyrn user create customer@example.com --accounts acme,acme2
klyrn user create customer@example.com --reseller reseller@example.com

klyrn user reset customer@example.com      # new password
klyrn user disable customer@example.com
klyrn user enable customer@example.com
klyrn user delete customer@example.com
klyrn user totp-reset customer@example.com # clear a lost second factor

A password is generated when you do not supply one. Passwords are argon2id. Sessions are server-side, SameSite=Strict, and rotated on sign-in. From their own account page, every user can add TOTP with recovery codes and see and revoke their sessions.

Accounts and ownership

klyrn user assign acme customer@example.com
klyrn user assign acme none                        # admin only: leave it unowned
klyrn user account-transfer acme newowner@example.com
klyrn user account-suspend acme --reason "invoice 4417 unpaid"
klyrn user account-unsuspend acme

A transfer changes who manages the account, and nothing else. The files stay owned by the account's Unix user. No file is moved, no path changes, no site restarts.

A reseller cannot leave an account with no owner. They assign it to themselves or to one of their own customers. Only an administrator can un-own an account.

Suspending an account cascades to its sites, and unsuspending restores only the ones the cascade suspended. A site you suspended individually beforehand stays suspended.

Deleting an account

Nothing happens without a preview, the account name has to be typed exactly, and remote backup copies are kept by default.

klyrn user account-delete acme --confirm acme
klyrn user account-delete acme --confirm acme --backup-first
klyrn user account-delete acme --confirm acme --delete-remote-backups

The preview counts what will go, from the database. It lists every site with its type and certificate, every database by name, and the cron entries. It also gives the local backups and their total size, the remote copies, and the measured disk usage.

Removed: every site, every database, the local backups, the Unix user and the home directory, and the account row.

Kept, unless you ask otherwise: the copies in the bucket. They are the only thing that survives a mistake. The job says how many remain and that they can still be restored.

--backup-first backs every site up before removing anything and stops if a backup fails. The deletion is refused if any of the account's sites has a job running.

Team members and a second factor

A customer can add team members with limited rights, for chosen sites or for email only.

Administrators, resellers and customers can require a second factor from the people below them, with a grace period to set it up. A forgotten password is reset through a single-use emailed link, and staff can send one.

Who gets each feature

Under Settings, Features the administrator chooses who gets each module. In the code editor these are the editor itself, the live preview, the AI assistant and AI file access. The others are the storage optimizer, SFTP, the SSH shell, the terminal in the browser, mailing lists and IP addresses.

Each is given to everyone, to chosen roles or to nobody, with exceptions for one person where they are wanted.

The AI provider

Under Settings, AI the administrator connects any OpenAI-compatible provider. The code editor's assistant uses it.

The administrator also sets daily limits, one per person and one for the whole server.

Language

Each person chooses their own language, and the administrator sets the server default. English and Hebrew are available today. Every page of the panel is in Hebrew, right to left.

Adding another language is one folder of translations.

The audit log

Every operation that changes something is written to the audit log with the actor, their address, the operation, the target and the outcome. Reads are recorded too when what they read is a secret. That covers revealing a site's stored credentials, exporting a backup key and downloading a file.

Customers and resellers see who changed what on their own sites and accounts.

The audit log currently grows without bound: there is no retention policy and no export. On a busy server, watch its size.