The admin app

The web panel for the whole server, at https://admin.<server hostname>/. It shows every account at once, and it is where you create admin users, inspect domains, mail, certificates and services across the server, and connect the server to your own systems.

Only an admin user can sign in. A fresh server has none, so the first visit is a two-step bootstrap: get in with a token from the host, then create the admin users who sign in normally.

Getting in the first time

On a server with no admin user, the login page shows only the token form. As root on the server:

elpanctl server:login

This prints the login page's URL and a token. The token signs in as the admin user root, which the command creates when it is missing; it is valid for five minutes and signs in once. Paste it into Server Token on the login page and press Sign In With Token. The token is never put into a URL, so it never lands in a browser history or an access log.

root is an ordinary admin user that a bare server:login creates and names, and server:login <username> does the same for any admin user without their password, second step or allowed addresses: Break-glass on the host.

The first admin user

Each person who administers the server gets their own admin user. Create one from the host, or from System › Admin Users once you are signed in:

elpanctl server:admin-user:create <username>

The new admin user has no password. The command prints a setup link (https://admin.<server hostname>/r/<code>) and an eight-digit PIN; hand them over on a channel you trust, and the person sets their own password, passkey and authenticator app. The link is valid for seven days and used once. The PIN is shown once and can't be shown again: if it is lost, reset the admin user's credentials for a new link. --allow-ip limits where the admin user may sign in from, and --with-password also prints a generated password for scripts. The setup link, the claim page and the PIN, resets and deletion are in Admin Users.

The home page

The home page (Home in the menu) shows the server:

• Server ID and the number of Accounts.
• Host profile: the sizing profile the host runs, from /etc/elpan/sizing.conf; without that file the standard values apply. See Sizing profiles.
• Not installed: the optional components that are absent, with their package names, so you can see why the panel doesn't offer a feature.
• Web Applications Behind Upstream, when any WordPress, Drupal or other installation on the server is behind the newest release; each line links to the installations it counts.

Below are shortcuts to Accounts and the API Documentation.

The menu

The menu has two sections. The docs are organized by subject, not by the menu, so this table says where each screen is covered.

Section	Screen	Covered in
Accounts	Accounts	Accounts
	Domains	Domains
	Sign-in Help Requests	Sign-in Help Requests
	Auth Log	Auth Log
System	Hosts, Services	Hosts and services
	DNS Records	DNS Records
	DNS Publication Failures	DNS Publication Failures
	Shared IP Address Groups	Shared IP Address Groups
	Web Applications	Web Applications
	Upgrade Runs	Upgrade Runs
	Outgoing Mail Quarantine	Outgoing Mail Quarantine
	Outgoing Mail Queue	Outgoing Mail Queue
	Email Traffic Log	Email Traffic Log
	Certificates	Certificates
	ACME Client Accounts	ACME Client Accounts
	Admin Users	Admin Users
	Bot Challenge	Bot challenge
	Appearance	Appearance
	Integrations	Server API, API Keys, Webhooks

Your own sign-in (password, passkeys, authenticator app, devices) is at Password & Security, under your username in the top bar: Second step and passkeys.

What the bare hostname serves

https://<server hostname>/ is not the admin app and doesn't redirect to it: it serves a static Elpan splash page, and the server API under /api/v1, the same API as on the admin host. See Server API.