Administrator guide

Signing in

Administrators sign in with a passkey, or with a password followed by an authenticator code, a passkey or a recovery code. Two-step sign-in cannot be switched off for administrators or resellers. Your Security page lists your passkeys, authenticator app, recovery codes, signed-in devices, API tokens and password; ending a device signs it out within seconds.

A PIN on a trusted browser. After you sign in you can keep one browser signed in. From then on it asks for a short PIN instead of your password and second step. The browser is proven by a key that cannot leave it plus a cookie that changes at every visit, so a copied cookie gets nothing. A PIN never replaces the confirmation for risky actions. Under Settings, Sign-in security you choose which kinds of people may do this, for how many days (30 by default, 90 at most) and the shortest PIN (6 digits for administrators and resellers by default). Five wrong PINs remove the browser. Changing your password, or removing your PIN, removes every trusted browser.

Some actions ask you to confirm it is you again (step-up). The confirmation lasts five minutes and the session is rotated when you give it.

Finding your way

• Home is an index of every tool you may open, in ten categories and a More group: Websites & domains, Files & access, Databases & storage, Email, Software, Security, Monitoring, Customers, Server and Panel. Servers and live activity sit beside it. Type in the search box (press /) to find a tool by the word you use, such as cron, ftp or mx.
• Pins. Pin any tile, sidebar entry or page header and it comes first on Home and in the command palette, on every device you sign in on. Arrange moves or unpins them.
• The sidebar is about twelve lines for an administrator: Home, your pins and one line per category, each opening in place. It folds to a narrow rail. The five configuration pages are one entry, Configuration, with a tile for each.
• The menu is built from modules. Install or switch on a module and its pages appear; you only see what your role allows.
• Ctrl K (Cmd K on a Mac) opens the command palette: go to any page or run any action you are allowed to run.
• Every action is also on the command line (respirecloudctl) and in the API, and most changes show a plan first.

Every action carries a risk level:

Actions that support it show a plan first: what will be created, changed or removed, as a diff. Nothing is applied until you choose Apply changes.

Servers

The server you installed on is the control server and runs the first agent. To add another, press Add a server on the Cluster page. If the panel is not yet ready for more servers it offers a plan to get it ready first, then you create an enrolment token and run the command it gives you on the new machine (see Add more servers). Each server has its own key and can only receive its own operations. Retiring a server drops its connection and its key.

People, roles and grants

• Four levels: administrator, reseller, user (the account owner) and sub-user. Each person manages only their own subtree.
• Roles are data. Built-in roles come from the permissions each module declares; you can add your own, such as a support role that can view and act as customers.
• Grants can be scoped to a single site, domain or folder. A deny grant always wins: a deny on one site, domain, mailbox, database or folder hides it and refuses actions on it for that person, administrators included.
• Explain access: the panel can show why someone is or is not allowed to do something.
• API tokens are scoped and can be revoked at once. A token can never change passwords, passkeys or other sign-in settings.

Plans, limits and sizing

A plan is a set of limits: domains, sites, mailboxes, databases, storage, containers and the rest, each declared by the module that enforces it. Modules reserve a unit before they create something and release it when it is removed or when creation fails, so counts stay right. When a limit is reached the action fails with limit_exceeded and names the limit.

Plans and sizing (under Customers) has four tabs: Plans, Capacity planner, Overselling and Server profile. The profile is chosen from the server's memory and CPU and is applied to nginx, PHP, MariaDB and the rest; a value you set by hand is kept. The planner says how many more accounts of a plan fit, with what-if for more accounts or servers. Modules (under Panel) switches a module on or off; its data stays. See sizing and plans.

Hosting accounts

• Create makes the identity and a Linux user on the chosen server, with its own home directory and, if you allow it, a shell.
• Each account runs inside its own systemd slice with CPU, memory, IO and process limits; disk quotas apply where the filesystem supports them.
• Suspend locks the Linux user and ends the account's sessions and API tokens in the same step. Unsuspend reverses it.
• Delete is critical: it removes the Linux user and home (unless you keep the home), and the other modules remove the account's domains, zones, sites, databases, container stacks and backups.

Single sign-on

Under Security, Single sign-on adds an OIDC or SAML provider. Use Test sign-on before anyone depends on it. People still meet the panel's second factor, nobody becomes an administrator from a provider's claim unless you switch that on, and administrators always keep a local sign-in. Sign-in alerts (new country, impossible travel) appear in the notification bell. Details: single sign-on and team access.

The assistant

Press Ctrl J on any screen to open the assistant. It needs a model. If your licence includes the RespireSoft AI subscription, the panel turns AI on by itself at the first start: no provider account, no key to paste. Use is counted in credits, and Assistant settings shows what each request cost and what is left. Before anything is sent, you choose once what it may see. Without the subscription, or beside it, add your own key (or a model on your own server) under the assistant's settings; until then it says so. It turns a request into a plan with the exact diff, and nothing runs until you approve. Read-only is the default, and a kill switch stops it. See the assistant.

The guide helps each person from their first screen: it asks what they want to do first and walks them through it in plain words. Without AI it stays as a checklist. You can turn it off for a kind of person or for a plan.

The Store and your licence

Store lists signed modules, add-ons and starter templates, with a built-in catalogue when the Store server cannot be reached. Install, upgrade and rollback show a plan first and run as jobs. The licence is active, in grace or degraded; a lapsed licence stops new things, never existing ones. A new install without a key starts a free 14-day trial. Releases and Store add-ons are downloaded only through your licence, and the Licence page lists every limit with how much is used.

Updates

The Updates page shows the installed version, the channel, the newest signed release with its notes, the history and each server's version. By default the panel installs a release by itself every night from 03:00 for two hours, in the server's time zone. You can instead be told and press Update now, take only patch releases by itself, or pause or turn it off (for air-gapped servers).

• Before it installs, the panel keeps the running release and a copy of its own database.
• If the new release does not start, it goes back by itself, and the page says why. A release that failed is not tried again by itself.
• Go back returns to the saved release on purpose; changes made in the panel since the update are undone, and sites, mail, DNS and files are not touched.
• Only the panel and its agent stop, for about a minute or two. Open tabs show a notice and come back by themselves.
• Other servers follow one at a time, then the Store modules. An update needs a licence that is active or in grace.

Acting as a customer

Staff who hold the impersonation permission can act as a customer to see exactly what they see. It needs a reason and a fresh confirmation, has a time limit, and shows a banner that cannot be dismissed. While acting as someone you cannot change their password, passkeys, authenticator or tokens, and every action is recorded with both identities.

The audit log

Every change is written to a hash-chained audit log with who, as whom, from where, and the parameters (passwords and other secrets are redacted). You can search and export it as JSON or CSV with a checksum manifest, and run a check that recomputes the chain and reports the first row that does not match. There is no action that edits or deletes an audit row.

Keeping servers healthy

• Security: firewall with an automatic rollback timer, CrowdSec, malware and integrity scans, unattended upgrades with a health watch, and a security score.
• Stats and logs: metrics, alerts, log search and live tail.
• Backups: targets, schedules, retention, verification and restores.
• Modules that manage configuration have a reconcile action that puts the server back to the desired state if something changed behind the panel's back.

Recovering a whole server

Schedule server-backup.sh (the installer places it in /usr/lib/respirecloud/recovery/) and keep the recovery bundle and its passphrase away from the server and the backup. A blank node with the panel installed is rebuilt with server-restore.sh; server-check.sh lists what came back. The licence activation, signed-in sessions and mail in the queue do not come back, and there is no point-in-time recovery. See whole-server recovery.