Command line (enconfctl)¶

enconfctl is the panel's local admin and emergency tool. It talks directly to the panel database and the system — so it works even when the web interface or the API is unreachable. The classic use case: a locked-out admin whose password needs resetting, or a quick health check right on the server.

The tool ships with the enconf-webpanel package and lives at /usr/bin/enconfctl.

Root required

Most commands require root — they read the protected config /etc/enconf/api.env and access the panel database directly. Run enconfctl with sudo.

Overview¶

$ sudo enconfctl help

Command	Purpose
`status`	State of the panel services (api, agent, nginx, PostgreSQL, MariaDB, mail, FTP, fail2ban)
`doctor`	Runs the security-audit checklist locally
`repair [step] [--apply]`	Re-renders the server config from the database — the last resort when nothing works
`admin reset-password <email>`	Resets an admin's password
`admin create <email>`	Creates a new admin
`admin list`	Lists all admin users
`user list`	All users (ID, email, role, active)
`customer list`	All customers
`site list`	All websites
`version`	Prints the version

Check services — `status`¶

$ sudo enconfctl status
Panel-Dienste:
  enconf-api   active
  enconf-agent active
  nginx        active
  postgresql   active
  mariadb      active
  ...

Services that aren't installed (e.g. on a web-only node) show as n/a.

Health check — `doctor`¶

doctor verifies a subset of the hardening checklist right on the server:

$ sudo enconfctl doctor
Security-Audit:
  ✔ Panel secret /etc/enconf/api.env is 0600 root:root
  ✔ PHP pools with open_basedir + disable_functions (12 checked)
  ✔ /tmp/<user> is 0700 user:user (12 checked)
  ✔ Webroots are 0710 owner:www-data (12 checked)
  ✔ Brute-force protection (fail2ban) active
  ✔ 12 customer AppArmor profile(s) loaded

A red ✘ marks a violated invariant, a yellow ⚠ a hint (e.g. "no PHP pools found" on a non-web node). The full audit list is in the project documentation.

Repair the config — `repair`¶

When the server config is broken — mangled nginx vhosts, missing certificates, orphaned PHP pools, drifting DNS/firewall rules — repair re-renders everything from the database as the source of truth. It's the same repair mechanism the panel uses internally, just straight from the command line.

Safe by default: preview first, then apply

Without --apply, repair runs a dry-run — it only shows what it would change and touches nothing. Only --apply actually repairs.

$ sudo enconfctl repair                 # preview all steps (nothing is changed)
$ sudo enconfctl repair --apply         # repair everything
$ sudo enconfctl repair list            # list available steps
$ sudo enconfctl repair RepairNginxVhosts --apply   # apply a single step

Example preview:

$ sudo enconfctl repair
Vorschau (Dry-Run) — es werden KEINE Änderungen vorgenommen. Mit --apply reparieren.

RepairSSL              Änderungen  (geplant 8, geschrieben 0, unverändert 8, 14ms)
    ~ example.com: certificate missing on disk (ssl_enabled in DB) → would re-issue
RepairNginxVhosts      Änderungen  (geplant 8, geschrieben 0, unverändert 8, 12ms)
    ~ example.com: vhost would be re-rendered from DB state
...

Available steps: TLS, ghost sites, SSL certificates, nginx vhosts, Apache vhosts, redirect vhosts, staging vhosts, nginx includes, backup snapshots, orphans, webspace permissions. Every step is idempotent (running it repeatedly is harmless) and nginx changes are validated with nginx -t before the reload.

Ordering

repair (no step) runs the chain in the correct order (e.g. SSL before the vhosts, so listen 443 is rendered with a real certificate). If a step aborts on an infrastructural error (e.g. agent unreachable), the chain stops — fix the cause and run it again.

Reset an admin password — emergency access¶

When you can no longer sign in to the web interface:

$ sudo enconfctl admin reset-password admin@example.com
✔ Password for admin@example.com set — all existing sessions were invalidated.
   New password: qMegHdAXE4i9JNDU

Without -p, a secure password is generated and shown.
With -p <password> you set your own: … reset-password admin@example.com -p MyPassword.
All existing sessions become invalid (the password version is bumped); open browser tabs must sign in again.

reset-password only affects admin accounts. For customer accounts, use the web interface.

Create a new admin¶

$ sudo enconfctl admin create second-admin@example.com
✔ Admin second-admin@example.com created (id 7).
   Password: 7hFqm2KpQ9wUxbLe

Here too you can set your own password with -p <password>. If the email already exists, the command aborts.

Lists for scripting¶

user list, customer list and site list print tables. When piped, the colour codes are automatically dropped — ideal for grep/awk:

$ sudo enconfctl site list | grep staging
$ sudo enconfctl customer list | wc -l