Full client setup workflow
# 1. Create client (SFTP key, MariaDB DB, 2GB quota, resource slice) cx1-add-client.sh acme # 2. Add domain (Apache vhost with /webmail + /phpmyadmin built in) cx1-add-domain.sh acme acme.co.uk # 3. Generate client connection-info page and send to client cx1-generate-client-page.sh acme # → http://SERVER_IP/guides/client-acme.html # Delete after sending: rm /var/www/html/guides/client-acme.html # 4. Enable HTTPS (DNS must be live first) cx1-add-ssl.sh acme.co.uk # 5. Enable DKIM signing — add the DNS TXT record shown cx1-add-dkim.sh acme.co.uk # 6. Create mailboxes cx1-add-mailbox.sh hello@acme.co.uk
Client endpoints (per domain)
| Service | URL | Notes |
|---|---|---|
| Website | https://acme.co.uk | Client webroot at /public_html/ |
| Webmail | https://acme.co.uk/webmail | Roundcube — full email address as username |
| phpMyAdmin | https://acme.co.uk/phpmyadmin | Login with cx1_acme DB credentials |
| SFTP | acme.co.uk port 22 | Key auth, chrooted to /var/www/clients/acme/ |
| IMAP | mail.acme.co.uk port 993 | SSL/TLS |
| SMTP | mail.acme.co.uk port 587 | STARTTLS |
Generating the client info page
# Generates a styled HTML page with all connection details cx1-generate-client-page.sh acme # Output: /var/www/html/guides/client-acme.html # Access: http://SERVER_IP/guides/client-acme.html # Re-run any time (e.g. after adding a domain or changing credentials) # Delete after sending to client — it contains credentials
✅ A blank template showing URL patterns (no real credentials) is always at
/guides/client-template.html
Client isolation model
| Resource | Isolation |
|---|---|
| Web files | SFTP chroot — cannot see other clients or the filesystem |
| PHP | Dedicated FPM pool as client OS user. open_basedir enforced |
| Database | Separate MariaDB user scoped to cx1_acme only |
| Disk | OS quota: 2GB default — adjust with cx1-set-quota.sh acme 5G |
| RAM/CPU | systemd slice: 512MB RAM max, 50% CPU quota |
| Virtual mailboxes — no filesystem cross-access |
SFTP details
# Host : SERVER_IP Port : 22 # User : acme Auth : SSH private key # Root : / (chrooted — webroot is /public_html/) # Download key to your local machine: scp root@SERVER_IP:/root/cx1-sftp-keys/acme_sftp_ed25519 ./acme.key # Replace or regenerate key: cx1-sftp-key.sh acme # generate new cx1-sftp-key.sh acme /path/to/key.pub # use existing
Other operations
cx1-set-quota.sh acme 5G # increase disk quota cx1-traffic-report.sh acme # generate GoAccess report cx1-add-alias.sh info@acme.co.uk hello@acme.co.uk cx1-list-clients.sh # list all clients
Remove a client
⚠️ Permanently deletes all web files, database, and SFTP access. Cannot be undone.
cx1-remove-client.sh acme