All chapters

First sign-in and the one-time password

The installer created one administrator, called admin, and printed its password once. That password opens the panel for exactly one thing: choosing your own.

Open the panel

  1. In your browser, go to https://<your server's address>:8443/.
  2. The browser warns about the certificate. That is expected: the installer made a self-signed certificate so the panel could start at all. Accept it for this address. To replace it with a real certificate later, the report printed the three commands (install the two files into /etc/cplex/tls/ and restart cplex-api).
  3. The sign-in page opens. Type admin as the username and the password from the installer's report, and press Sign in.
The cpleks sign-in page: a card titled Sign in with Username and Password fields and a green Sign in button.
The sign-in page. The note under the button is the panel's own: a session lasts twelve hours, or one hour of sitting idle, and ends when you close the browser.

A wrong username and a wrong password get the same answer, that username and password do not match, on purpose: the page does not tell anybody which accounts exist.

Choose your own password

Until you do, the panel shows one screen and nothing else, and the server refuses every other request with this account is still using the password the installer generated. The reason is on the screen: the password was printed to a terminal, so it is in that machine's log, and on a cloud server that log can be read through the provider's console.

  1. In The installer's password, type the password from the report again.
  2. In Your new password and And again, type a new one, at least 12 characters. Length is the only rule: a few ordinary words beat a short password with symbols.
  3. Press Save and open the panel. Every other session on this account is signed out; this one stays.
The Choose a password screen, asking for the installer's password and a new password twice, with a Save and open the panel button.
The only screen the panel shows until the installer's password is replaced.

Find your way around

The panel opens on Sites. The rail on the left holds everything else; an administrator sees all of it:

  • Sites: every website, with a card per site and the certificates that need attention.
  • Accounts and Plans: customers, their hosting accounts and the packages you sell (Users, customers and plans).
  • Databases, Add-ons, Logs: a plan's databases, the add-ons this server offers, and a site's logs.
  • Modules: what the machine runs for every site: PHP and other runtimes, database servers, mail, FTP, DNS.
  • Server, Backups, Activity: the machine itself, its backups and the record of every change.
  • Settings: your sign-in, the panel's version and licence, the server's public address and time zone.

A customer who signs in sees only their own sites, databases, add-ons, logs and account settings. Sign out is at the foot of the rail.

The Sites screen listing three example sites as cards, with the rail of sections on the left.
The Sites screen of a test machine with three example sites.

The first things to do

  1. Settings ▸ How the internet reaches this server: press Set the address and type the server's public IPv4 address. On a cloud instance the machine's own network interface usually carries a private address, so the panel cannot find the public one by itself; every site's DNS check compares against what you type here.
  2. Settings ▸ Sign-in: turn on two-factor authentication with an authenticator app, or add a security key. The panel can do everything an SSH session can, so it deserves at least the same lock.
  3. Settings ▸ Licence: activate your licence (Your licence).
  4. Modules: install what your sites need, for example PHP and MariaDB (Modules).
  5. Plans, then Accounts, then Sites: a package, a customer with a hosting account, and the first site (Sites).

The panel listens on port 8443 and can be reached from anywhere your firewalls allow. Restricting 8443 to your own address, in the firewall in front of the machine, is the single biggest thing you can do for the panel's security. The Settings screen says the same.

If you lose the administrator password

There is no "forgot password" link, deliberately: a reset link on a public port would be a way in rather than a way back. The administrator's password is reset from SSH on the server:

CPLEX_PASSWORD='a long new password' sudo -u cplex --preserve-env=CPLEX_PASSWORD \
    /usr/local/sbin/cplexctl passwd -user admin

Customers and resellers are reset by whoever manages them, from Accounts ▸ Reset password.