Built-in roles and capabilities
Every panel user has one role. A role is a set of capabilities plus a scope: either all hostings in the cluster, or only the hostings the user has been granted. The five built-in roles are fixed. They appear, read-only, under Built-in roles on the Roles page. To grant a different mix, create a custom role.
| Role | Scope | Capabilities |
|---|---|---|
| Owner | All hostings | 32 |
| Administrator | All hostings | 30 |
| Operator | Only assigned hostings | 17 |
| Customer | Only assigned hostings | 16 |
| Read-only | Only assigned hostings | 3 |
The counts are the ones the Roles page shows. “Only assigned” means the user sees a hosting only after an Owner grants it on that hosting’s Access tab. See Give a user access to a site.
The machine ids in the role builder and in the /api/v1 API are super_admin (Owner), admin, operator, customer and viewer (Read-only).
Capabilities by role
Section titled “Capabilities by role”A tick means the role holds the capability. The labels are the ones in the role builder.
| Capability | Owner | Administrator | Operator | Customer | Read-only |
|---|---|---|---|---|---|
| Hosting | |||||
| View hostings | yes | yes | yes | yes | yes |
| Create hostings | yes | yes | yes | ||
| Delete hostings | yes | yes | yes | yes | |
| Suspend / resume | yes | yes | yes | yes | |
| Edit hosting config (PHP, cache, redirects, …) | yes | yes | yes | yes | |
| Write raw nginx config (admin-level: nginx runs as root) | yes | yes | |||
| File manager | yes | yes | yes | yes | |
| Manage databases | yes | yes | yes | yes | |
| Manage cron jobs | yes | yes | yes | yes | |
| Migrate / clone hostings | yes | yes | yes | yes | |
| WordPress | |||||
| Manage WordPress (plugins, staging, …) | yes | yes | yes | yes | |
| View WordPress vulnerability scans | yes | yes | yes | yes | yes |
| Backups | |||||
| Run backups | yes | yes | yes | yes | |
| Restore backups | yes | yes | yes | yes | |
| Manage off-site backup targets | yes | yes | |||
| TLS | |||||
| Manage TLS certificates | yes | yes | yes | yes | |
| Security | |||||
| Manage security (WAF, fail2ban, firewall) | yes | yes | yes | yes | |
| Monitoring | |||||
| View monitoring & stats | yes | yes | yes | yes | yes |
| Manage monitors & alerts | yes | yes | yes | yes | |
| Cluster | |||||
| View cluster nodes | yes | yes | |||
| Manage nodes (enroll, update, install) | yes | yes | |||
| View service health | yes | yes | |||
| Manage services (restart, ROFS fix) | yes | yes | |||
| Platform | |||||
| Manage web users | yes | ||||
| Manage roles | yes | ||||
| Edit global settings | yes | yes | |||
| Manage hosting profiles | yes | yes | |||
| View audit log | yes | yes | |||
| View email log | yes | yes | |||
| Import from another panel | yes | yes | |||
| Manage trash (restore / purge) | yes | yes | |||
| Manage API keys (remote management API) | yes | yes |
Customer holds the same capabilities as Operator except Create hostings. In the role builder, Manage services (restart, ROFS fix) means restarting services and repairing a filesystem that was mounted read-only (ROFS). The panel shows a Customer a shorter sidebar. The role is meant for a site’s end user, who manages only the sites granted to them.
Pages that need the Owner role
Section titled “Pages that need the Owner role”Some pages check for Owner directly, whatever capabilities a role holds. A custom role cannot open them.
| Page or action | What happens for a non-Owner |
|---|---|
| Users | Redirected to the dashboard. |
| Roles | Redirected to the dashboard. |
| Nodes and everything on it, including node settings | Redirected to the dashboard. |
| Settings forms | An Administrator with Edit global settings can open the pages, but every form is disabled. Saving anyway returns “Only an Owner can change settings.” |
| A hosting’s Access tab | The tab is not shown. |
Check a role
Section titled “Check a role”- Open Roles in the sidebar and read the Scope and Capabilities columns of the Built-in roles table.
- Open Users, click Manage on a user and read the role under Role.
- A user’s effective permissions are re-read on every request. After you change a role, the person does not need to sign in again.