Tenant portal · Vloud

The tenant portal is the customer-facing surface for each hosting account. When you sell hosting to someone, that’s where they live. It runs at /tenant/* on the same engine, with a completely separate auth realm from the operator dashboard.

Two distinct auth realms

Realm	Login URL	Who	Sees
Operator	`/login`	You (the host)	All accounts, all settings, the whole panel
Tenant	`/tenant/login`	Your customer	Only their account — files, mailboxes, databases, domains, DNS, cron

JWT tokens for the two realms are stamped with different kind claims (operator vs tenant). A tenant token cannot validate against an operator endpoint, even if the signature is correct — the engine refuses cross-realm access by design. Operators can also be tenants on a different account in the same browser; sessions are independent.

What a tenant gets

Once you set a password for the tenant on an account, they can log in at /tenant/login with their email + password. The portal surfaces:

Files

Web file manager rooted at /home/<slug>/.
Upload / download / rename / edit / chmod.
Tenant-side terminal (browser-based shell as the Linux user), 30-min session with 10-min idle timeout.
SSH key management — tenant adds their own keys for direct shell access.

Databases

MySQL / PostgreSQL databases scoped to their account.
phpMyAdmin SSO from the portal (no separate login).
Create / drop databases + users within their quota.

Email

Mailbox CRUD: add, delete, change password, set quota.
Forwarding rules + autoresponders + Sieve filters.
Webmail SSO (Roundcube) — opens with the tenant already authenticated.

Domains + DNS

Attach / detach domains to their account.
Edit DNS records on zones the operator delegates to them.
Trigger SSL re-issuance.

Cron

Per-tenant crontab editor.
Resource-capped (the cron jobs run inside the tenant’s systemd slice).

Apps

One-click installers — WordPress, Drupal, Joomla, Nextcloud, phpBB, Laravel.
Tenant-managed app deploys.

Backups

View backup history for their account.
Restore from a tarball (operator can disable this if you don’t want tenants self-restoring).

Setting a tenant password

The operator decides who gets a tenant login. From the account detail page → Tenant access → Set password (or Invite via email if SMTP is configured). The tenant receives a one-time invite link; setting their password creates the tenant credentials.

2FA + security

Tenant 2FA available — operator can require it for all tenants or leave it optional.
Lockout: 5 failed login attempts → 15-minute lockout (column tenant_locked_until).
Per-tenant SSH key trust — keys added in the portal show up on the operator dashboard for audit.

What tenants cannot do

Hard limits enforced by the engine:

See other tenants’ accounts.
See operator-level pages (Modules, License, Hosting packages, etc.).
Exceed their account’s quotas (disk, mail storage, DB size, cron count).
Modify nginx config directly.
Run arbitrary privileged commands.

The tenant terminal runs as the tenant’s Linux user — same shell isolation as SSH. Whatever they can do over SSH, they can do in the terminal.

Branding the tenant portal

If your license includes white-label, you can replace Vloud branding on the tenant portal with your own — logo, name, footer links, support email. Dashboard → Settings → Branding. The operator dashboard keeps Vloud branding (it’s the panel for the platform itself).

Introducing a customer to their portal

When you create a hosting account for a customer:

Set their domain + initial site (or let them deploy).
Set their tenant password (or send the invite email).
Send them the portal URL — typically https://<your-dashboard-host>/tenant/login (or your white-labelled equivalent).
Point them at the tenant-facing docs — your customers reading the same Vloud docs you read.

Common operator questions

“My customer says they can’t see X.” Most often a feature gate. Check their hosting package — email feature off in their package means no email surface. See Tiers & features.

“My customer locked themselves out.” Operator → Account detail → Tenant access → Reset password. Or unlock manually: sudo sqlite3 /opt/vloud/packages/server/vloud.db "UPDATE accounts SET tenant_locked_until = NULL WHERE id = <id>".

“My customer wants to upload a 10 GB file.” Tenant disk quota check first; raise it on the account if needed. Webmail upload limit is 25 MB by default; SFTP for anything bigger.

“Can the tenant see my other customers?” No, by design — every query the tenant portal makes is scoped through account_id joins in middleware. Cross-account access returns 403.