Users and access parameters

The YAML keys for system users, their applications, file transfer accounts, extra database users and SSH access.

Each key below carries a label for where it belongs in the configuration. A GUI key has a field in the interface; a YAML only key is set in the Source (YAML) view, which accepts the same configuration.

System users

A system user is the account that owns the files and runs the applications. Every application belongs to exactly one system user.

Example - every key in this section, with realistic values:

system_users:
  - username: prod
    vhosts:
      - server_name: example.com
        app_type: wordpress

system_users

host list GUI

Default empty.

The list of accounts on this host, each with its own applications. Separating applications per account keeps their files, databases and processes apart.

username

system user string GUI

The account name, which also determines the home directory and the database name. Required for every account.

Note: lowercase letters and digits, starting with a letter, at most 24 characters. Some reserved names are refused.

File transfer accounts

File transfer accounts give someone access to files without giving them the system account itself. Prefer Secure File Transfer Protocol (SFTP) over plain FTP.

Example - every key in this section, with realistic values:

ftp_sftp: true             # use encrypted SFTP (host level)
ftp_sftp_port: 222
ftp_hostname: sftp.example.com
system_users:
  - username: prod
    ftp:
      - user: designer
        homedir: /var/www/prod/example.com   # must be inside the user's directory

ftp

system user list GUI

Default empty.

Extra file-transfer accounts under this system user. Give an external designer or agency access to one folder only.

user

system user string GUI

The login name of the file-transfer account. Required for every entry under ftp.

homedir

system user string GUI

The folder this account is limited to. Restricts access to one application instead of the whole account.

Note: must be inside the system user's own directory. The deployment fails otherwise.

ftp_sftp

host boolean GUI required

Default false.

Enables encrypted file transfer over SFTP. Plain FTP sends passwords unencrypted. Use SFTP whenever you can.

Note: required before you can add SSH keys to a file-transfer account, otherwise the deployment fails.

ftp_sftp_port

host integer port YAML only advanced

Default 222.

The port SFTP listens on. Avoids a clash with regular SSH.

ftp_hostname

host string GUI advanced

The host name shown for file-transfer connections. Give customers a branded address to connect to.

Extra database users

Extra database accounts. The admin role has full read/write access to all databases on the server; the readonly role has read-only access.

Example - every key in this section, with realistic values:

system_users:
  - username: prod
    db_extra_users:
      - name: reporting
        db_role: readonly       # admin | readonly

db_extra_users

system user list GUI

Default empty.

Additional database accounts alongside the automatically created one. Give a reporting tool or an external developer their own database login.

name

system user string GUI

The login name of the extra database user. Required for every entry under db_extra_users.

Note: lowercase letters and digits, starting with a letter, at most 24 characters, and unique.

db_role

system user enum GUI required

One of admin, readonly.

The role - admin has full read/write access to all databases on the server, readonly has read-only access. A reporting tool or external analyst should almost always be readonly; admin reaches every database on the server.

Note: required, and must be exactly one of the two values.

SSH access

SSH gives command-line access to the server. Keys are safer than passwords, because a key cannot be guessed.

Example - every key in this section, with realistic values:

ssh_keys:
  - ssh-ed25519 AAAAC3Nza... team@example.com
ssh_passwords: false         # disable password login (keys only)
ssh_port: 22                 # YAML only; the firewall opens the new port for you

ssh_keys

host list GUI

Default empty.

Public keys that get access to every account on this host. Give your whole team access in one place, without sharing passwords.

ssh_port

host integer port YAML only

Default 22.

The port the server listens on for SSH. A non-standard port removes most automated login attempts from your logs.

ssh_passwords

host boolean GUI

Default true.

Whether logging in with a password is allowed at all. Turning it off is one of the most effective hardening steps, because passwords can be guessed.

Note: add and test your SSH key first.

© 2026 Hosted Power — TurboStack