Concepts

Roles, hosting accounts, packages, feature lists, domains, the separate panels on port 8443 and the API on port 2087.

This page explains the ideas the rest of the documentation uses. Read it once before you set up your first customers.

Roles

Everyone who signs in to HF Panel has one role. The role decides which panel they use and what they see there.

Role	Panel	What they can do
Administrator	Server Admin	everything: the server, every account and reseller, settings, security, billing, updates
Staff	Server Admin	extra administrator logins, made under Staff logins: Full access (a second administrator) or Read-only (sees everything and answers tickets, but changes nothing)
Reseller	Reseller Panel	creates and manages their own customers' accounts within the limits the administrator gives them, with their own packages, feature lists and brand
Customer	Control Panel	the owner of one hosting account: websites, domains, email, databases, files, backups, billing and support
Team member	Control Panel	a person the customer invites under Team, with a role such as Websites & files, Email only or Read-only

Note: the first administrator is created at the end of the installation. Add more with hf-panel create-admin on the server, or under Server Admin › Accounts › Staff logins.

Team members

A customer can let other people into their Control Panel without sharing their own password. They invite them by email and choose a role:

Role	What the member can use
Full access	websites, files, email, databases, billing, support and the activity log
Websites & files	websites and files, including HF Files
Email only	email, including webmail
Databases only	databases, including HF Studio
Billing only	invoices and payments
Read-only	looks at websites, email and databases, but never changes anything
Custom	only the screens the owner ticks

Members sign in on the same Control Panel address with their email address and their own password, two-factor code or passkey. They never see the owner's own Password & security page. Each package sets how many team members an account may have.

Hosting accounts

A hosting account is one customer's space on the server. When you create one, HF Panel makes:

a Linux user with its home folder /home/<username> (no shell login; SFTP only)
its own PHP service, so one account cannot read another account's files
folders for websites (web/), temporary files (tmp/), SSH keys (.ssh/) and logs (logs/)
a disk quota and the limits of its package
a Control Panel login with the same username

Usernames are 3–16 lowercase letters and numbers, starting with a letter. The account's password works for the Control Panel and for SFTP.

Administrators and resellers can suspend an account (its websites show a "suspended" page, its logins, cron jobs, FTP and apps stop) and unsuspend it again. Delete removes the websites, email, databases, DNS zones and the Linux user.

Packages

A package (also called a plan) sets what an account may use: disk space, domains, mailboxes, databases, team members, Web Disk logins, CPU, memory, processes, files (inodes), hourly email sending and more, plus a monthly price for billing. Every account has one package. Changing an account's package changes its limits at once.

A new server comes with three example packages, Starter, Business and Pro, which you can edit or delete. Resellers make their own packages for their own customers.

Feature lists

A feature list switches tools off for the packages it is given to. Every customer screen is a feature, for example Git, Docker apps or Mailing lists, and some parts of screens too, such as forwarders, autoresponders and remote MySQL. A tool that is switched off disappears from the customer's menu, and the server refuses it. A package without a feature list has every tool.

Administrators make feature lists under Server Admin › Accounts › Feature lists. Resellers make their own, within what the administrator allows them.

Domains

Each account has a main domain and can add more:

Kind	What it is
Main domain	the account's first website, given when the account is created
Addon domain	another website with its own folder
Subdomain	a name under one of the account's domains, such as `shop.example.com`, with its own folder
Parked domain	another name that shows the same website as an existing domain (an alias)

Each website lives in /home/<username>/web/<domain>/public_html. When a domain is added, HF Panel sets up the web server, a DNS zone (when the DNS server is on) and, when email is on, the mail domain with SPF, DKIM and DMARC. A free Let's Encrypt certificate follows by itself once the domain points at the server.

A domain points at the server in one of two ways:

its nameservers are your nameservers (by default ns1.yourdomain.com and ns2.yourdomain.com), so the zone on your server is used; or
it keeps its DNS elsewhere, and the A record (and MX for email) at that provider points at the server. The Control Panel's DNS setup page lists the records to add.

The server's own domain

At installation you give the server one domain, for example yourdomain.com. Every address of the server is a name under it:

Name	Used for
`server.yourdomain.com`	Server Admin, on port 8443
`panel.yourdomain.com`	Control Panel, on port 8443
`reseller.yourdomain.com`	Reseller Panel, on port 8443
`files.yourdomain.com`	HF Files
`db.yourdomain.com`	HF Studio
`api.yourdomain.com`	the API, on port 2087
`webmail.yourdomain.com`	HF Mail
`mail.yourdomain.com`	the mail server (MX, and the server's reverse DNS)
`smtp.yourdomain.com`, `imap.yourdomain.com`	mail apps: outgoing and incoming mail
`ftp.yourdomain.com`	FTP
`ns1.yourdomain.com`, `ns2.yourdomain.com`	your nameservers

These names belong to the server. Customers cannot add them as websites.

Separate panels on the panel port

By default HF Panel runs separate panels: Server Admin, Control Panel and Reseller Panel each on their own name. They all use the panel port, 8443 (you can choose another one at installation with --port).

Each panel has its own sign-in. Signing in to one does not sign you in to another.
Only the people a panel is for can sign in there.
Administrators and resellers use Log in on an account to open that customer's Control Panel, and come back with Return to admin (resellers: Return to reseller).
Emails, password resets and links always send each person to their own panel.

Without the port, the panel names send visitors to your website. With --no-portals at installation, or hf-panel portals off later, everyone signs in at one address instead: https://panel.yourdomain.com:8443.

Tip: hf-panel portals on the server shows each panel's address, whether its DNS points at the server and whether it has SSL.

The API on its own port

The API at https://api.yourdomain.com:2087/v1 is for programs: billing systems, scripts, payment webhooks, other HF Panel servers and the HF Server desktop app. Every request carries an API token (made under Password & security › API tokens) or another machine key. A browser that opens the API gets "403 Forbidden". The older address, https://panel.yourdomain.com:8443/api/v1, keeps working for programs that already use it.

More than one server

Extra HF Panel servers can join the main one with a join code (hf-panel node-enable <main IP> on the extra server, then Server Admin › Accounts › Servers › Add server on the main one). New accounts can be placed on any server, DNS and billing stay on the main one, and Move accounts moves an account between servers. See Migrating.