Instance administration
Instance-wide surfaces, users across every team, instance settings, and who owns the whole thing.
What it is
Only instance admins see these pages, and instance admin is a flag on an account, not a team capability.
Users
Settings -> Users.
| Action | What it does |
|---|---|
| Manage users | The full list, with Admin, Owner, and Suspended badges |
| Manage user | Open one account: suspend, reset the password, promote to instance admin |
| Register a user | Mints a single-use registration link. It works once and expires in 24 hours. You share it yourself |
| Pending links | Reveal or Revoke a link before it is used. Revoke all revokes every pending link at once, whoever minted it |
| Delete a user | Shows an impact preview first, since a person owns things |
Deplo sends no email of its own, which is why account creation is a link you hand over rather than an invitation it mails.
A person who registers through a link lands in their own team. Adding them to yours is a separate step, in Settings -> Members.
Instance settings
Settings -> Deplo.
| Setting | What it does |
|---|---|
| Panel address | Where the dashboard answers. See The panel's own address |
| Certificate account email | The address Let's Encrypt has for this instance |
| Max log range | The ceiling on how far back log queries may reach. Default 7 days, 1 to 90 |
| Gravatar | Whether a person with no picture of their own falls back to their Gravatar. Off by default, and off means everyone wears a face Deplo generates, or their initials if they pick those |
| Updates | Whether a newer Deplo release exists, with a link to the release notes |
The page also shows this instance's version and which host it runs on.
What turning Gravatar on sends
Deplo never dials gravatar.com itself - each person's browser does, with a hash of their email address in the URL. Their IP address and that hash reach a third party as a result, which is why it ships off. The switch only decides whether Gravatar is offered at all; each person still chooses their own picture in Settings > Account - a generated face, an upload, their Gravatar, or their initials.
Instance owner
The tier above instance admin, held by the account created at first-run setup.
- No other admin can demote, suspend, or reset the owner.
- The owner cannot drop their own admin flag either.
- It exists because instance admin is a flat boolean that any admin can write on any other admin. Without a crown, one promoted admin could take the whole instance, first account included.
Transfer ownership is on the same page: only by the owner, only to an active instance admin, and only with the password re-entered.
Lost owner account
If the owner account is genuinely lost, the only way back is a command run on the host that runs the control plane. That is the one intended shell path in the entire product.
Instance-wide variables
Variables -> All teams applies to every app of every team, at the lowest priority, so any team can override one. Good for an internal registry mirror or a proxy setting, wrong for anything one team should not see.
Servers
Servers are instance-wide, not team-owned, so the whole of Settings -> Servers is an instance-admin surface, including which teams may deploy to which machine. See Server settings.
Limits and gotchas
- Instance admin is not team capabilities. An admin still needs a membership and a role to act inside a team.
- A registration link is single-use and hashed. Even two people clicking at once cannot both consume it.
- Deleting a user is not the same as removing them from a team. Read the impact preview.
- Raising Max log range does not make hosts keep more. Docker rotates container logs by size.
If it does not work
If it does not work
Settings -> Servers missing from the sidebar, can't edit another admin, or a registration link rejected: see Sign-in and access troubleshooting.
See also
Did this page help you?