Suspend, terminate and delete an account
An account leaves service in stages, each one more final than the last:
| Status | How it gets there | What it means | Way back |
|---|---|---|---|
| Suspended | Suspend, account:suspend | Disabled at every level. Nothing is deleted. Incoming mail is deferred. | Unsuspend, account:unsuspend |
| Pending deletion | Terminate, account:terminate | Disabled the same way, frozen, and waiting for its deletion. Incoming mail is rejected. | Restore, account:restore: back to suspended |
| Being deleted | Delete now, account:purge, or the nightly schedule | The deletion is running. | None |
Suspension is for an account that may come back, e.g. an unpaid invoice.
Termination is the start of the deletion, and the panel treats the account
as one that is going away. The actions are in the Status section of the
account's page, each behind a confirmation, and every change of status is
logged on the server's auth syslog channel.
What a disabled account loses
A suspended account and a terminated account are cut off the same way. The account's data stays where it is, locked, so that an unsuspension finds everything as it was.
| Access | What happens |
|---|---|
| The account panel, its API keys, its MCP tokens | Refused. A signed-in session ends on its next request. |
| SSH, FTP, mail sign-ins (IMAP, POP3, submission) | Refused, for a password and for a key alike. |
| Running processes, app servers, containers | Stopped. The account's own systemd user manager is taken down. |
| Cron jobs | Not run, and the crontab cannot be edited. |
| Websites | Answer 503 with a page that says the account is suspended. The ACME paths under /.well-known/ still work, so certificates keep renewing. |
| DNS | The records the holder added by hand stop answering. The records the panel generates (the zone's NS and SOA, the websites' and mail's addresses) keep answering, so the 503 page is reachable and the zone stays delegated and signed. |
| Databases | The database users are locked out. Nothing is dropped. |
| Incoming mail | Suspended: deferred with 450, so the senders' servers retry for days and the mail arrives once the account is back. Terminated: rejected with 550, because the mailboxes are going away. |
| Outgoing mail queued through a relay | Not sent. |
| Webhook endpoints (terminated only) | Disabled, and nobody is told. |
The panel's own gates (the account panel, the API, MCP), FTP and the mail sign-ins read the status live and refuse at once. The rest is done by a background worker and lands a few seconds after the status changes.
Reset credentials, account:reset and account:reset-password are
refused for a suspended or terminated account: writing a password to the
host would lift the lock that the suspension put on the Unix account.
Suspend and unsuspend
elpanctl account:suspend <username>
elpanctl account:unsuspend <username>
Unsuspending restores everything the suspension stopped, from the account's current settings: the user manager comes back up, and with it the app servers and containers of an account with persistent services (Limits); websites, database logins and DNS records come back; deferred mail flows in. Neither command works on a terminated account: the only ways out of Pending deletion are Restore and the deletion.
Terminate
elpanctl account:terminate <username> [--force]
Termination asks for confirmation (--force skips it), disables the account
like a suspension, and marks it pending deletion. From then on the account
is frozen: its limits cannot be edited and no domain can be added. Its
incoming mail is rejected rather than deferred, its webhook endpoints are
disabled, and the grace period starts: the account's page shows the status
Pending deletion, the date in Terminated, and Can be deleted
from the date the grace period ends, or Deleted automatically on that
date when automatic deletion is on.
Termination deletes nothing. The account stays in this state until you delete it, the schedule does, or it is restored.
Restore
elpanctl account:restore <username>
Restore takes a terminated account back out of the deletion flow. It
comes back suspended, never active: re-enabling it is a separate,
deliberate account:unsuspend. Incoming mail goes back from rejected to
deferred. A restore is refused once a deletion of the account is queued,
running or failed.
The grace period and automatic deletion
Two server settings, under Settings on the Deletions page
(Accounts › Accounts › Deletions) and in server:edit:
| Setting | Default | Meaning |
|---|---|---|
| Grace period | P30D (30 days) | How long after termination an account can be deleted without skipping the grace period. An ISO 8601 duration. |
| Automatic deletion | off | Whether the server deletes accounts whose grace period has ended, every night, at most ten a night, keeping their backups. |
elpanctl server:edit --account-purge-grace=P30D --account-purge-automatic=on
elpanctl account:purge:due [--dry-run] [--limit=<n>]
server:edit with no option prints the current settings. account:purge:due
does what the nightly schedule does, on demand: it queues the deletion of
the terminated accounts whose grace period has ended, ten at most unless
--limit says otherwise; --dry-run only lists them.
Delete
A deletion removes the account and everything it owns: its DNS zones, hostnames, mailboxes, websites, databases, certificates, home directory and Unix users. By default its backups are kept, and they are the only way back from a deletion of the wrong account.
Only a terminated account can be deleted. Delete now on the account's page is behind sudo mode, asks you to type the username, and skips the grace period. On the command line:
elpanctl account:purge <username> [--now] [--final-backup] [--purge-backups] [--dry-run] [--sync] [--force]
| Option | Effect |
|---|---|
--now | Skip the grace period. Without it, the command is refused until the grace period has ended, and says from when it will work. |
--final-backup | Back the account up once more first. Fails the deletion when no backup repository is set up or the backup fails. |
--purge-backups | Also delete the account's backups, for an erasure request: Also delete the backups of this account on the form. Not with --final-backup. |
--dry-run | Print what would be deleted and delete nothing. |
--sync | Run the deletion in this command rather than in a background worker. |
--force | Skip the confirmation prompt. |
The server API does the same with DELETE /api/v1/accounts/<username>,
which terminates a live account and deletes a terminated one; see
Server API.
What a deletion does
A deletion is a job that runs through fixed steps and records each one: it checks that the account can be deleted and marks it as being deleted; stops its processes and discards its queued outgoing mail; takes the final backup if asked; deletes what the account owns in dependency order (web applications, web mounts, application servers, containers, databases, credentials, mailboxes and other domain accounts, identity applications, websites and mail, hostnames, certificates, and the DNS zones last); deletes the backups if asked; waits until the databases are gone from their engines and the zones from the name server; detaches and deletes the home directory, clears the storage quota and deletes the three Unix users; and deletes the account itself.
A step that fails stops the deletion there; nothing retries it on its own.
When the cause is fixed, Retry or account:purge:retry resumes it from
that step. A deletion refuses to start while a hostname in one of the
account's zones, or an application on one of its identity providers,
belongs to somebody else.
What a deletion keeps
- The backups, unless
--purge-backups. Even then the deletion only forgets the snapshots; the space comes back with a prune of the repository, which nothing runs by itself. See Backups. - The deletion record: who asked, when, the options, the steps and the log. It is never pruned.
- The username. It can never be used for a new account: the name lives on in the server's logs and in the holder's own records, and a new owner would be confused with the old one.
- A DNS zone at Cloudflare or deSEC. The panel deletes its own copy and never touches the zone in the holder's provider account; the deletion's log names each such zone, so that you can tell the holder.
- The server's
authsyslog lines, the deletion's included.
Not kept: the account's own sign-in history in the Auth Log. The domains become free for any account once the zones are deleted. The panel sends nothing to the account holder at termination or at deletion, since the only mailboxes it knows for them are the ones being deleted: tell them through your own channel.
Follow a deletion
The Deletions page lists every deletion with its state (Pending, Running, Waiting, Succeeded, Failed), its current step, who requested it and when it finished. A deletion's own page shows the steps done and to come, why it stopped, when it last made progress, and its log; a deleted account's page redirects there. On the command line:
elpanctl account:purge:list [--state=<state>] [--username=<username>] [--limit=<n>]
elpanctl account:purge:status <purge-id-or-username>
elpanctl account:purge:retry <purge-id> [--sync]
A deletion that goes quiet, e.g. because its worker was killed, counts as failed once nothing has been heard from it for fifteen minutes, and a retry resumes it.