Admin Guide

How LamaCP is organised

A LamaCP server has three kinds of accounts:

• The administrator runs the server: settings, updates, IP addresses, PHP and Node.js versions, reseller packages and resellers. The administrator hosts nothing itself.
• Resellers have their own domains and a share of the server (their package). They make customer packages and customers from that share.
• Customers belong to one reseller and manage their sites, apps, containers, mail, databases and files within their package.

Every account is also a Linux user with its own home directory. Sites, apps, containers, PHP and FTP run as that user, so one account cannot read another's files. Limits are checked on every change, and on ext4 the file system enforces each account's disk limit.

First sign-in

At the end of the installation the installer prints the sign-in address. It has the form https://panel.example.com:2006/<secret>. The panel listens on port 2006, and only the sign-in page has a secret path. Without a session, every other address of the panel gives no answer, so keep the address in a password manager.

1. Sign in with the administrator name and password from the installation.
2. Open Account and security in the account menu (top right) and set up two-factor sign-in with any authenticator app. Keep the recovery codes.
3. Check Server › Ports and services: every service the panel needs should be running, and the ports should answer.
4. Under Server › License, enter a license key if you bought one. Without a key the server runs the Free plan.

Your own hosting account

The installer also makes a hosting account for the administrator. It is a reseller with no limits but the server's, and it shares your e-mail address. Its first site is the server's base domain. After you sign in you land in this account. The account menu switches between My hosting and Server administration, so you don't need a second login to host your own sites.

On a server installed before this existed, make or link the account under Server › Settings › Your hosting account. Unlinking it leaves it as an ordinary reseller, with everything in it.

Dashboard and resource usage

The dashboard shows the server's processor, memory and disk, the state of its services, recent activity and whether backups are in place. A banner appears when a new LamaCP version is out, or when the server has more than its plan allows.

Dashboard › Resource usage charts processor and memory use over time: one reading a minute for recent ranges, and hourly averages for longer ones. You can see it for the whole server or per account.

Server settings

Server › Settings has the following sections.

• Updates: the LamaCP version, when the panel last checked, and the Update button (see Updates).
• Security: the minimum password length for panel accounts, mailboxes and FTP accounts. You can also make two-factor sign-in required. When it is required, a user without it can reach only the setup page until they set it up.
• Features: switches for features that work but have run on few servers so far, such as Import.
• Your hosting account: see above.
• Container registries: registries that Docker may reach over plain HTTP (an internal registry, for example). This is a server-wide Docker setting.
• Panel address: which IP address the panel's port answers on. Binding the panel to one address keeps it off the others.
• Disk limits: whether the file system enforces each account's disk limit. When it does, writes past the limit fail from every path: the panel, SSH, FTP, apps and containers.
• Backups: the schedule, how many backups to keep, and where to store them (see Backups).

License and plans

Server › License shows the plan the server runs, its limits and how much of each is used. To activate a license, enter the key and press Activate. The panel renews the license with lamacp.com every day. It sends only the key, the installation's id and the usage counts, never anything about the sites or mail. If lamacp.com cannot be reached, the license keeps holding until it expires (about two weeks).

The plan's limits hold for the whole server, on top of each account's package. When a server has more than its plan allows (after a license ends, for example), nothing stops at first. The panel warns for 30 days, and you choose which sites, mail domains and mailboxes stay on. Only after that are the others paused. To move a license to another server, press Remove here, or free it from your lamacp.com account.

From a shell, lamacp license does the same as this page.

Updates

LamaCP itself

The panel looks for a new release once a day and shows a banner and a dot on the bell icon when one is out. Press Update under Server › Settings › Updates. Every release is signed: only a release whose signature verifies with the project's key is installed. If the new version does not start, the update rolls back by itself. The log of the last update stays on the page.

The operating system

Server › System updates lists the Debian or Ubuntu packages that have a newer version: PHP, nginx, the mail server, the databases and the kernel. Security fixes show up here first, so install them soon. A kernel update needs a reboot to take effect.

IP addresses

Server › IP addresses lists the server's addresses; Find addresses on this server adds the ones the network has. For each address choose what it serves: web sites, the name server, mail. Sites use the shared default address unless they are given another; a dedicated address belongs to one customer. An address answers unknown host names with nothing.

Set each address's reverse DNS (PTR) name at your hosting provider (mail servers check it); the field here is a note for yourself.

Runtimes: PHP and Node.js versions

Server › Runtimes installs the language versions that sites and apps can use.

• PHP: each PHP site chooses one of the installed versions, and several versions can run side by side. A version that the distribution does not carry comes from Ondřej Surý's repository, the usual source of every PHP version. Each version is installed with PHP-FPM and the usual extensions: MySQL, PostgreSQL, SQLite, curl, GD, mbstring, XML, zip, intl and bcmath.
• Node.js: versions are installed with nvm, and whoever makes an app picks one. A command that starts with node, npm or npx runs with that version.

Database engines

Databases › Engines shows MySQL/MariaDB, PostgreSQL and MongoDB with their versions and state. For each engine you can allow remote connections. Customers then list the addresses that may connect to each of their databases: at most 10, none wider than a /16. The firewall opens the port to those addresses only, and only the database's own user may log in, over TLS.

DNS zones

LamaCP runs authoritative DNS with PowerDNS. Every domain added to the panel gets a zone with sensible records: the web and mail addresses, SPF, DKIM and DMARC. To use this server's DNS, point the domain's name servers at it at the registrar.

Server › DNS zones lists zones that no account has, for example one left behind by a removed site. While such a zone exists, the server also resolves the domain from it, so delete zones you no longer need. When a domain's DNS is kept elsewhere (at the registrar or at Cloudflare), delete its zone here. The server then stops answering for the domain and resolves it like any other.

Ports, services and the firewall

Server › Ports and services lists the ports that the services need and whether something answers on them. It also shows the mail certificates, the services with their state and Restart buttons, and the other ports that listen on public addresses.

The services the panel itself needs (ssh, lamacpd, lamacp-web, nginx and postgresql) can be restarted here but not stopped, because stopping one would cut the way back in. LamaCP runs its own firewall. The ports that containers publish stay closed until their owner opens them on the container's page.

Resellers, packages and users

Reseller packages

Under Accounts › Packages, make a package for each kind of reseller you sell. A package sets limits for:

• disk and monthly traffic (0 means unlimited);
• domains, subdomains and sites;
• apps, containers, and processor and memory limits;
• e-mail accounts, forwarders and mailing lists;
• FTP accounts;
• each database engine;
• the number of customers.

A reseller uses its package for its own domains and hands out the rest to its customers.

Making a reseller

1. Open Accounts › Users and press New user.
2. Pick the role Reseller, a user name (it becomes the Linux account and the home directory) and a package.
3. Enter the reseller's first domain. It gets a site, a DNS zone and mail, set up the same way as for a customer.

A reseller then signs in and makes its own customer packages and customers. Accounts › Resources shows how much of each package a reseller and all its customers use, including their disk.

Helping a user

Press Sign in as in a user's row to see the panel exactly as they do, without their password. A banner shows whose account you are in, and Return to my account takes you back. Both steps are written to the audit log.

The start page

Under Accounts › Start page, set the page a new site's folder starts with. You can write the HTML or load it from a file.

Backups

Backups use restic: they are encrypted and deduplicated, so each night stores only what is new. Each account gets its own backup: its files (sites and mail included), its databases and its settings. The panel itself is backed up too.

1. Under Server › Settings › Backups, choose where the backups go: a directory (better on another disk), or any S3-compatible storage with its endpoint, bucket and keys.
2. Set the hour they run (server time) and how many daily, weekly and monthly backups to keep.
3. Copy the repository key and keep it somewhere other than this server. Without it nobody can read the backups, you included.

Customers and resellers restore their own files and download their database dumps under Backups (see the User Guide). Backups come with the paid plans.

Import from DirectAdmin

LamaCP can bring accounts over from a DirectAdmin server. Turn on Server › Settings › Features first, or run lamacp features untested on as root. Server › Import then appears in the menu.

1. Make the resellers under Accounts › Users first, with packages that have room for what comes over.
2. Connect to the DirectAdmin server over SSH. LamaCP only reads there, and it keeps the password in memory only while the connection is open.
3. Choose the reseller each DirectAdmin user goes to, and the PHP version for sites with PHP files.
4. Start the import. Users, domains, sites, mailboxes and messages, forwarders, DNS records, MySQL databases and files come over. Customers keep their panel and mailbox passwords.

The import can run again. Whatever exists already is reused, and files, mail and databases are copied again; messages that arrived in between stay. Webmail address books and signatures can be copied too. When the DNS records point to the new server, move the domains' name servers or records over.

Terminal and audit log

Server › Terminal is a shell in the browser. It runs as the administrator's own Linux account, not as root, and without sudo. To use sudo there, root can link your login to an existing account in the sudo group. Every session is written to the audit log.

Server › Audit log records every privileged action: who did what, when, and from which address, including signing in as another user. Resellers and customers find their own activity in the account menu.

API tokens

Under Account and security › API tokens, make a token for scripts and automation. Each token has a name, its access (read only, or read and change) and an optional expiry. Send it as Authorization: Bearer <token> to /api/v1/ on the panel's address. The page shows when and from where each token was last used, and you can revoke a token at any time.

From the shell

The lamacp command on the server covers what is useful without the panel:

• lamacp install runs the installer again. It is idempotent and only runs steps that are not done yet.
• lamacp self-update updates LamaCP.
• lamacp license shows, activates or removes the license.
• lamacp features untested on|off switches features that are still being tested.

Need help? Write to support@lamacp.com, or see the FAQ.