Users & 2FA

Manage panel accounts under Admin → Users.

Roles

Role	Can
Admin	Everything: sites, users, firewall, backups settings, events and instance.
User	Manage only the sites assigned to them (plus sites they create), and their own account. The raw vhost editor is admin-only.

Assign sites when creating a user, or later with the globe icon in the users table. You cannot delete your own account.

Two-factor authentication

Every user can enable TOTP two-factor authentication under Account & 2FA:

1. Click Set up 2FA.
2. In Google Authenticator tap + → Scan a QR code and scan the code, or choose Enter a setup key and type the key. Scan from inside the app, not with the phone's camera: on iPhone the camera hands otpauth codes to the Passwords app.
3. Enter the 6-digit code and your current password to confirm. If the app does not accept the code, click New key and scan again (delete the old entry in the app first).
4. Save the 8 recovery codes shown after confirming. Each one signs you in once if you lose your phone: type it instead of the 6-digit code.

From then on, signing in asks for a code. The account page shows how many recovery codes are left; New recovery codes (with your password) replaces them. To turn 2FA off, confirm with your password.

Locked out?

On the server:

xaxa user:reset-password you@example.com
xaxa user:disable-2fa you@example.com

Login protection

Login and 2FA attempts are rate-limited per IP and per account: after 10 wrong passwords, or 5 wrong 2FA codes, in 15 minutes the account has to wait, whatever IP the attempts come from (even the right password waits). fail2ban bans IPs that repeatedly fail SSH or panel logins. Remember me keeps you signed in for 30 days.