Let friends help run your server with subusers

Running a server with friends is easier when someone else can press Renew while you eat, or restart the server when it lags. The wrong way to do that is to hand out your password. It is also your login for torchlite.host and for SFTP, and anyone who has it can do everything you can, including deleting files.

The right way is a subuser: a friend with their own login who sees your server in their panel and can do only what you allow. You set this up on the Users page.

How subusers work

A subuser is a separate panel account that has access to your server. Some things to know before you invite anyone:

• You stay the owner. A subuser cannot delete the server, take it over or remove you.
• Permissions are ticked one by one. Each page and button in the panel needs a matching permission. Without it, the page is hidden from the subuser's sidebar or the button does not appear.
• Nobody can give more than they have. A subuser who is allowed to manage users can only hand out permissions they hold themselves.
• Every action is logged. The Activity page shows who started, stopped or edited what, so you can always check.
• Their work counts as activity. What a subuser does on your server, such as starting it or editing a file, is logged on the server and counts towards the 5-day inactivity rule, just like your own. Signing in to the panel does not count for anyone, theirs or yours: only what is done on the server.

A subuser needs nothing from you except an email address. They do not need a server of their own.

Invite someone

1. Open your server and go to Users in the sidebar.
2. Click New user.
3. In the Create new subuser window, type your friend's address under User Email.
4. Tick the permissions they should have. The next sections help you choose.
5. Click Invite User.

What happens next depends on whether that email already has a Torchlite panel account:

• It does: nothing is sent. The server simply appears in their server list next time they open the panel.
• It does not: the panel creates an account for that address and emails a Setup Your Account link, where your friend chooses a password. After that they log in at game.torchlite.host with their email and that password.

Use the exact address your friend uses, or wants to use, for Torchlite. If they later want a free server of their own, the same email and password work on torchlite.host.

The permissions, group by group

The invite window groups permissions under headings such as CONTROL and FILE, with a box to tick a whole group. Here is what each group covers:

A few of these do more than their name suggests:

• Renew needs control.restart. The Renew button only shows for users who can restart the server. Give it to anyone you want to keep the server alive while you are away.
• The Minecraft tools need a SETTINGS permission. Modpacks, Plugin Manager, Mod Manager, Versions, Configs and the rest only appear for users with at least one SETTINGS permission. Some of those tools can replace or reinstall the server's files, so this is a bigger grant than "rename" sounds.
• backup.download exposes everything. A backup contains every file on the server, including configs with passwords in them.
• backup.restore can wipe files. A restore can delete all current files first.

When in doubt, leave a box unticked. The subuser will tell you soon enough if they are missing something.

What to give a co-admin

There is no single right set, but these three cover most groups of friends.

A player who keeps the server running. Someone who renews while you are away and restarts it when it misbehaves:

• websocket.connect, control.console, control.start, control.restart

A co-admin. Someone who installs plugins, edits configs and looks after the world with you:

• all of CONTROL and WEBSOCKET;
• FILE: create, read, read-content, update, delete, archive and sftp;
• BACKUP: create and read;
• STARTUP: read; SCHEDULE: read; ACTIVITY: read;
• SETTINGS: rename, so the Minecraft tools appear.

What to keep for yourself, even with a trusted co-admin:

• all of USER, so nobody can invite people behind your back;
• backup.delete, backup.download and backup.restore, because your one backup is your undo button;
• DATABASE, or at least view_password;
• startup.update and startup.docker-image, which can stop the server from starting;
• settings.reinstall.

You can always add a permission later when someone actually needs it. Starting small costs nothing.

Change or remove access

To change what someone can do, find them in the list on Users, click Modify permissions, tick or untick boxes and click Save. The change applies straight away.

To remove someone, use the delete button on their row and confirm with Yes, remove subuser. Their access to this server ends immediately; their own account and any servers of their own are not touched.

If they had database.view_password, open Databases and use Rotate Password on the database afterwards, then put the new password in your plugin configs. They used their own password for SFTP and the panel, so there is nothing else to change.

Common problems

My friend never got an email

The panel only emails people who do not have an account yet. If their address already has one, they just log in and the server is in their list. Otherwise, ask them to check their spam folder for the Setup Your Account message.

My friend sees the server but the console is empty

They are missing websocket.connect. Without it the panel cannot stream the console or the stats to them.

My friend cannot press Renew

The Renew button needs control.restart. Add it under CONTROL with Modify permissions.

The Plugin Manager is missing for my friend

The Minecraft tools only show for users with a SETTINGS permission. Give them settings.rename if you trust them with those tools.

My friend cannot log in over SFTP

They need file.sftp and the file permissions for what they want to do. They must use the Username shown in Settings when they are logged in themselves, which contains their own panel username, and their own password, as the SFTP guide explains.