Administration

Users & settings

There are two kinds of login: one main administrator defined on the server, and panel users the administrator creates. Settings are the main administrator's alone.

Two kinds of account

Account	How it's managed	Can do
Main administrator	Email and password come from `SM_ADMIN_EMAIL` / `SM_ADMIN_PASSWORD` in the server's `.env`. Can't be edited, disabled or deleted from the panel. 2FA is optional, but recommended.	Everything, including Users and Settings.
Panel users	Created by the main administrator. Their password is stored hashed in the panel. Two-factor authentication is mandatory.	Everything else: projects, deploys, domains, SSL, databases, files, cron, workers, Adminer. They can't see the Users or Settings pages, and the API refuses those actions.

Adding a user

Users → Add user
Enter their name and email. Leave "Set the password myself" off to generate a strong 20-character password.
Share the sign-in details
The email and temporary password are shown once, with copy buttons. Send them over a secure channel.
First sign-in
After entering their password, the user lands on Secure your account. They must scan the QR code and confirm a code before they can use anything. Until then the API rejects every other request, and Adminer stays locked.
Change the password
The user can change their password from Account (their name, in the sidebar's Panel section).

Managing users

Edit: change name or email.
Reset password: generates a new password (shown once) and signs them out everywhere.
Reset 2FA: for a lost phone. They're signed out and must enrol again at their next sign-in.
Disable / enable: blocks sign-in and ends current sessions immediately, without deleting the account.
Delete: type their email to confirm. Deployments they started stay in the history.

The list shows each user's 2FA status (Pending 2FA setup until they enrol) and when they last signed in, with the IP in the tooltip. Deploy logs and the dashboard show who triggered each manual deploy.

Your account

Everyone has an Account page with their profile, last sign-in, two-factor status and, for panel users, a password change form. Only the main administrator can turn their own 2FA off. For panel users it's required.

Settings Main administrator

Let's Encrypt: contact email for certificate expiry notices. It must be set before any certificate can be issued. Panel users see a hint to ask the main administrator if it's missing.
StackPanel version: the running commit (hash, date, message), branch and git source, with Check for updates and Update now. A warning appears if newer code was pulled but the container wasn't rebuilt, or if files in the checkout were edited on the server. See Updating.
Domain for sale page: the enquiry email on every for-sale domain. Saving updates live pages immediately.
Users: a shortcut to user management.
Panel domain: serve the panel on its own domain with HTTPS. See Panel domain & HTTPS for locking the port down afterwards.
Environment: read-only view of port, home path, deploy user and host driver. Change these in .env.

The main administrator's email and password live only in the server's .env; the panel can't show or change them. To change the password, edit SM_ADMIN_PASSWORD and run docker compose up -d.