Staff and roles

/admin/staff lists staff, pending invitations and disabled accounts, and the roles they hold. The controller checks permissions on every request; hiding a button is only a convenience.

Built-in roles

Role	For	Permissions
Owner	Everything, including staff and roles. Keep this to one or two people.	All
Admin	Runs the platform day to day	All except Staff and roles, Outgoing email and Sign-in security
Support	Customers and their servers. No nodes or catalog.	See all servers, Power, Suspend, Console, Reinstall, See customers, Manage accounts, Sign in as customer, Audit log
Network ops	Nodes, storage and IP space. Can’t act on customer accounts.	See all servers, Move between nodes, See nodes, Manage nodes, Manage IP pools, Audit log

Permissions

Group	Permission	Allows
Servers	See all servers	Every customer’s servers, graphs, jobs and private networks. Any other server permission also lets them see servers, so they can act on them. Without one, staff don’t see customers’ servers at all.
	Create servers	Provision servers for customers by hand
	Power	Start, stop, restart and force off any server
	Change package and addresses	Upgrade, downgrade and add or remove IPv4 addresses
	Suspend	Suspend and unsuspend servers
	Terminate	Destroy servers permanently and free their addresses
	Console	Open the console of any server. A session lasts up to 8 hours, and closes within a minute if the role loses this permission.
	Reinstall	Wipe and reinstall any server
	Move between nodes	Live and offline moves. Seeing which nodes a server could move to also needs See nodes.
	Reverse DNS	Change the PTR records of any server’s addresses
	Snapshots	Take, restore and delete snapshots of any server
	Backups	Change any server’s backup schedule, back up and restore
	Firewall	Change any server’s firewall rules and groups
	Settings, root password and rescue	Hostname, ISO, boot order, root password resets and rescue mode on any server. These give full control of the server.
Customers	See customers	Accounts, sessions, activity and self-service allowances
	Manage accounts	Lock, sign out, reset two-factor, notes
	Manage resellers	Quotas, locations, packages and which customers they own
	Sign in as customer	30-minute support sessions, always audited
Infrastructure	See nodes	Nodes, groups, storage and placement, with the addresses in IP pools, firewall policies and transfers. Which customer or server each belongs to also needs See customers or See all servers.
	Announcements	Post maintenance windows, incidents and notices. One that puts nodes into maintenance mode by itself also needs Manage nodes, to post, resolve or cancel.
	Manage nodes	Drain, maintenance, settings, storage, enroll and remove
	Manage IP pools	Create pools, reserve and release addresses
Catalog	Packages and templates	Plans, locations and OS images
	Imports	See and run imports from VirtFusion and Virtualizor
Administration	Audit log	Everything staff, customers and the API did
	See who’s signed in	The Signed in list on the Overview: everyone signed in now, staff included, with their device, address and when they were last active
	API & webhooks	See, add, change and test webhooks, and what they sent
	Platform settings	Branding, customer features, limits, networks and DNS. Other staff can read settings, but not which mail server the panel uses or its username.
	Outgoing email	The mail server, its password, the from name and address, the wording of every email, and sending tests. Emails carry sign-in and password reset links, so whoever has this can take over accounts. Give it with care.
	Sign-in security	Whether staff and customers need two-factor, how long sessions last, and the staff sign-in allowlist. Whoever has this decides who can get in. Give it with care.
	Staff and roles	Invite staff, change roles, edit roles
	License	Enter, check and release the panel’s license key. Every staff member can see the license.

Custom roles

Add your own roles from the grouped permission list. Names are 2–40 characters and unique. Editing a role changes every member who holds it straight away.

Rules

Only an Owner can invite an Owner or grant or remove the Owner role. There must always be at least one active Owner.
Staff and roles, Outgoing email and Sign-in security can each be used to take over other accounts, an Owner’s included. The built-in Admin role has every permission except these three. Give them to a role on purpose.
You can’t change your own role or disable yourself.
The Owner role can’t be edited. Built-in roles keep their names and can’t be deleted. A role with members can’t be deleted.
Disabling a staff member ends their sessions and revokes the API tokens in their client area. An account has to be disabled before it can be removed.
Denied attempts are recorded in the audit log, for example a Support user trying to drain a node.

Changing a staff member

Click someone’s name (or Edit) on the staff list to open their page, /admin/staff/<id>. With Staff and roles you can:

Change their name, sign-in email and role. A new email is what they sign in with from then on, and the old address gets an email saying it was changed. For someone still invited, the invitation goes again to the new address and the old link stops working.
Send password reset: signs them out and emails a link, valid for 24 hours, to choose a new password. They keep their two-factor and still need it to sign in.
Reset two-factor and password, for a lost phone or security key: their authenticator app, recovery codes and passkeys stop working, they’re signed out, and the link has them choose a new password and set up two-factor again. This is the reset that the sign-in page’s “Staff accounts need two-factor” message refers to.
Sign out everywhere: ends every session they have.

Their page also shows whether two-factor is on, their passkeys and sessions, when their password last changed, and links to the audit log for what they’ve done and what was done to their account.

Changing someone’s email or sign-in could hand their account to whoever does it, so it has stricter rules than roles:

Only someone whose role holds every permission the other person has can change their details or sign-in. Owners can change anyone; an Owner can only be changed by an Owner.
Nobody changes their own account here. Your own name, password and two-factor are under your account.
An invited account is reset by sending the invitation again, and a disabled one has to be re-enabled first.

Each change is in the audit log. Staff without the permission see the page read-only.

Under Settings → Sign-in and sessions an Owner can require two-factor for staff (on by default) and limit which addresses staff can sign in from.

Your own client area

Client area, at the bottom of the admin sidebar, switches to your own client account: the panel as customers see it, for servers you use yourself. It’s made when you join the team, with your name and email, so server emails reach you. Back to admin at the top of every page returns to the admin area.

Unlike a support session it has no time limit and nothing is read-only: SSH keys, API tokens, startup scripts and servers are all yours to change.
It signs in through your staff account and has no password of its own, so your password, two-factor and sessions are changed in the admin area. Creating an API token there asks for your staff password.
It’s part of your staff access: its API tokens only work while you’re active staff and from the addresses staff can sign in from, and they’re revoked if you’re disabled or removed. Other staff can’t sign in to it as a customer.
To give a staff member a server, use Servers → New server and pick them as the customer: staff are listed with the customers, marked Staff, and the server goes to their client area.
A customer who joins the team is invited with the email they already use. Their customer account, servers and all, becomes their client area, and they sign in with the staff account from then on. If they leave (disabled, then removed) or the invitation is revoked, it goes back to being an ordinary customer account with its old password. Resellers and locked customers can’t be invited this way: use another email, or unlock the account first.

Who’s signed in

The admin Overview has a Signed in list beside the jobs, for staff whose role has See who’s signed in (Owner and Admin to begin with). It shows everyone signed in to the panel now, staff included, and refreshes itself every 30 seconds:

Each person’s name, marked with their staff role or Reseller; customers aren’t marked. Your own session says you. The browser and system they signed in with, their address, and when they were last active.
A green dot and a green time mean they used the panel in the last five minutes (online). The rest are still signed in, but idle. The heading counts who’s online and how many people are signed in.
A session counts until it goes unused for the session length in Settings → Sign-in and sessions (12 hours to begin with), and never longer than 30 days. Signing out, a password change, locking or disabling the account ends it straight away.
A staff member signed in as a customer shows on that customer’s row, marked Support, for the 30 minutes it lasts.
Everyone, Staff and Customers filter it; customers include resellers. Names link to the customer or reseller (with See customers) or to the staff list.

Through the API it’s GET /admin/sessions, for signed-in staff only, not API tokens.

Audit log

/admin/audit-log records every change: who made it, from where, and every refused attempt. It’s append-only; there’s no way to edit or delete entries, including for the Owner. Filters live in the URL, so a filtered view can be shared as a link. Server, node and pool pages link to their own history. The CSV export covers up to 1,000 rows of the current filter.