Server commands

hf-agent is the administrator's command on the server. Log in over SSH and run it as root (or with sudo). hf-agent help prints the list of commands.

sudo hf-agent help

Note: hf-agent is the only name of the command (older names are removed on update). An unknown command prints the help and exits with status 1.

Summary

Admin logins

setup-code

hf-agent setup-code

Prints a new setup link, https://<server IP>:8443/setup?code=XXXX-XXXX, for a panel that has no admin login yet. Open it to add the licence and create the admin login. The link works once, for 24 hours; a new one stops the old one working. Once an admin login exists, the command says so and does nothing.

While the install itself is still waiting in the browser (the setup page from curl -fsSL https://cdn.hostfog.com/latest | bash), it makes a new link for that page instead (and starts the page again if it stopped after a day without visits); the other commands are not there yet until the install has run.

create-admin

hf-agent create-admin

Asks for an Admin username (3–32 characters: a letter first, then letters, numbers, _, . or -), an Admin email and a password (twice). A typing mistake asks again, up to five times. The new login is a full administrator and signs in to Server Admin.

The first admin login is normally made in the browser, from the setup link the install shows. Run this command instead from a script, or to add another administrator. Server Admin › Accounts › Staff logins also adds administrator logins, including read-only ones.

reset-password

hf-agent reset-password sarahbakes

Asks for a new password (twice) for any panel login: administrator, reseller or customer. Failed sign-in attempts are forgotten, so a locked-out login can sign in again at once. The account's SFTP password does not change.

reset-2fa

hf-agent reset-2fa sarahbakes

Switches off two-factor login for a login whose phone is lost, and forgets failed sign-in attempts. The person signs in with their password and can switch two-factor login on again.

list

hf-agent list

Lists every panel login, sorted by role: username, role (admin, reseller, client), status and email.

Control panel data

The panel's own data — accounts, packages, invoices, settings, tickets — is in one database. A copy is made every night and kept on the server in /var/lib/hostfog/panel-backups/ (and sent off the server when off-server backups are on). These commands work with those copies. They don't touch websites, mail or databases.

panel-backups

hf-agent panel-backups

Lists the copies, newest first, with their name (for example panel-20261024-032001.sqlite.gz), size and date.

panel-backup

hf-agent panel-backup

Makes a copy now and prints its file name. Make one before a big change or an update.

panel-restore

hf-agent panel-restore panel-20261024-032001.sqlite.gz
hf-agent panel-restore panel-20261024-032001.sqlite.gz --yes   # don't ask

Puts a copy back. Give a name from panel-backups, or a full path to a copy.

1. The copy is unpacked and checked, and the command shows when and on which server it was made, by which version, and how many logins it has.
2. It asks you to type yes. Everything changed in the panel since the copy was made is lost.
3. The current data is kept as /var/lib/hostfog/hostfog.before-restore-<date>.sqlite, then the copy takes its place and the database is brought up to the installed version.

If the settings file was different when the copy was made, the old one is saved as /var/lib/hostfog/panel-backups/config.from-backup.json. Copy it over /etc/hostfog/config.json if saved passwords or keys don't work after the restore.

Run it as root.

backup-panel

sudo hf-agent backup-panel
sudo hf-agent backup-panel-list

backup-panel makes the encrypted panel backup now, as the nightly job does, and copies it to the backup storage chosen on the Panel backup screen. It needs the passphrase set there. backup-panel-list lists the files kept on this server.

restore-panel

sudo hf-agent restore-panel panel-full-20261024-020000.hfpa
sudo hf-agent restore-panel remote --host old-server --system

Puts an encrypted panel backup back on a fresh install: the database, the settings file and the server key, and with --system the files in /etc/hostfog and the nginx configs. Give a file name from backup-panel-list, a full path, or remote to fetch the newest copy from the backup storage.

The current database is kept as hostfog.before-restore-<date>.sqlite and the replaced files in /var/backups/hostfog-config. Run it as root, then restore the customers' accounts from their own backups. The full procedure is on Panel backup.

DNS and mail

dns-setup

hf-agent dns-setup           # the list
hf-agent dns-setup --check   # also look each record up in public DNS

Prints the DNS records the server's own domain needs: A records for the domain itself, the mail server's name and the nameservers, CNAMEs to the domain for the panels, the apps, smtp., imap. and FTP; SPF, DKIM, DMARC and TLS reporting; the glue records to register at your registrar; and the reverse DNS (PTR) to set at your server provider. It also writes them as a zone file you can import, /etc/hostfog/dns-setup.zone.

--check looks up each record in public DNS, marks it as fine, ADD or UPDATE, and exits with status 1 while anything is missing. See DNS setup.

mail-name

hf-agent mail-name mail2.yourdomain.com

Uses another name for the mail server: the MX of every hosted domain, the name it greets other servers with, and the name the reverse DNS must have. The default is mail.yourdomain.com. The server switches to the new name by itself once its DNS points at the server. Then change the reverse DNS (PTR) at your server provider to match.

mail-autoconfig

hf-agent mail-autoconfig

Creates (again) the files mail apps read to set themselves up: Outlook, Thunderbird and phones find their settings from just the email address and password.

company-mail apply

hf-agent company-mail apply
hf-agent company-mail apply /root/my-company-mail.conf

Creates the mailboxes and forwarders listed in a company mail file on the server's own domain, when they are missing. The default file is /usr/local/hostfog/company-mail.conf. Addresses that already exist are kept as they are. Each new mailbox's password is shown once and added to /root/hostfog-mailboxes.txt.

ssl-now

hf-agent ssl-now

Gets or renews the panel's Let's Encrypt certificate now, instead of waiting for the next check (every 5 minutes). The certificate covers every server name whose DNS points at the server. Use it after fixing DNS.

Separate panels

portals

hf-agent portals                         # show them
hf-agent portals on                      # switch them on with the default names
hf-agent portals on --admin admin.yourdomain.com --customer my.yourdomain.com --reseller partners.yourdomain.com
hf-agent portals off                     # back to one panel for everyone

With no argument, shows a table of the separate panels and apps: each one's address, whether its DNS points at the server (ok or add A) and whether it has SSL (ok or after DNS).

A name that doesn't point at the server yet gets SSL by itself within 5 minutes of its A record being added.

status-page

hf-agent status-page on                       # at status.yourdomain.com
hf-agent status-page on uptime.yourdomain.com # at a name you choose
hf-agent status-page off                      # only at https://<panel>/status

Puts the public status page on its own address.

files-portal

hf-agent files-portal on [NAME]   # default fm.yourdomain.com
hf-agent files-portal off         # only at https://cp.yourdomain.com:8443/files/

Puts Files, the File Manager, on its own address, or takes it off.

db-portal

hf-agent db-portal on [NAME]   # default dbs.yourdomain.com
hf-agent db-portal off         # only at https://cp.yourdomain.com:8443/studio/

Puts DB Studio, the database app, on its own address, or takes it off.

cloud-portal, deploy-portal

hf-agent cloud-portal on [NAME]    # default cld.yourdomain.com
hf-agent cloud-portal off
hf-agent deploy-portal on [NAME]   # default dep.yourdomain.com
hf-agent deploy-portal off

Puts HF Cloud or HF Deploy on its own address, or takes it off (the panels then show no link to it).

api-portal

hf-agent api-portal on [NAME]   # https://api.yourdomain.com/v1
hf-agent api-portal off         # only at https://cp.yourdomain.com:8443/api/v1

Puts the API on its own address, or takes it off. The API is for programs: a browser gets "403 Forbidden".

pay-portal

hf-agent pay-portal on [NAME]   # https://pay.yourdomain.com/order
hf-agent pay-portal off         # only at https://cp.yourdomain.com:8443/order

Puts the public billing pages on their own address on port 443, or takes it off: the order page, paying an invoice, the PayPal return page and the licence shop. Nothing else answers there (every other page is "404 Not found"), so the panels' sign-in is never on this address. Invoice links and the order page's links use it once it is set.

hook-portal

hf-agent hook-portal on [NAME]  # https://hook.yourdomain.com/stripe and /paypal
hf-agent hook-portal off        # only on the API's address and the panel's port

Puts the payment webhooks on their own address on port 443, or takes it off. Only Stripe's and PayPal's webhooks answer there, and each event must carry the provider's valid signature. The Billing screen then shows the new address to give Stripe and PayPal (without it, they are on the API's own address).

Repairs

company-account

hf-agent company-account
hf-agent company-account mycompany office@example.com

Makes the company's own domain — the panel's domain, example.com for srv.example.com — a hosting account, so its website files, databases and email are managed in the Control Panel like any account's: File Manager, FTP, Git, DB Studio, Email and backups. It:

• creates the account (default username: the domain's first word, or that word with web after it when it is a reserved name; contact email webmaster@ the domain) on the package Company (no limits, no price), or uses the account that already has the domain;
• makes the domain's server mailboxes and forwarders (admin@ …) the account's: same addresses, passwords and mail, now listed on the account's Email screen;
• moves the website into the account's folder (/home/USER/web/DOMAIN/public_html) when it is the publisher's website on this server — nginx is tested first, and if it refuses, everything stays as it was. Later releases are published there too.

It prints the Control Panel's address and the account's password (once). The DNS zone keeps the panel's own names. Safe to run again.

super-portal

hf-agent super-portal on [hq.example.com]
hf-agent super-portal off

The official edition only: puts HQ — the licence business — on its own address (hq. the panel's domain, on the panel's port), with its own sign-in for administrators who use two-step sign-in. off puts its screens back in Server Admin.

autofix

hf-agent autofix
hf-agent autofix /var/log/hostfog-install.log

Repairs what stops an installation or an update. The installer and update.sh run the same checks by themselves; this command runs them on demand. It fixes:

With a log file it also reads the error at the end of the log and applies the matching fix. It never removes a package source someone else set up. Each fix is listed on screen and in /var/log/hostfog-autofix.log; when there is nothing to fix it says so.

health

hf-agent health

Checks the whole server: services, configuration, disk, memory, SSL, the clock and the mail queue. Each line shows a green tick (ok), a yellow ! (warning) or a red cross (problem); lines that the panel can fix say "(fix in the panel: Server health)". It ends with a count of what is ok, the warnings and the problems. Server Admin › Server › Server health also checks DNS, SSL and backups, with one-click fixes.

apache-fix

hf-agent apache-fix

Repairs and starts Apache: a port clash, missing log folders, leftover sites. If Apache still can't start, it prints Apache's own error.

cgroups-v2

hf-agent cgroups-v2

Makes the server boot with cgroups v2, which resource limits and the usage charts need. Rocky Linux 8 and AlmaLinux 8 start with cgroups v1. The command adds systemd.unified_cgroup_hierarchy=1 to every installed kernel's boot arguments and says so; nothing changes until you restart the server. It does nothing on a server that already runs cgroups v2. On CloudLinux it changes nothing, because LVE manages the accounts' limits there.

php-versions

hf-agent php-versions

Lists the PHP versions this server can install. Install them under Server Admin › System › PHP & Node.js. On CloudLinux it also lists the alt-php versions installed on the server; HF Panel doesn't manage them.

php-repo

hf-agent php-repo

Adds the extra PHP versions repository, if it supports this system's release.

Licence plan

licence features

hf-agent licence features

Shows the features your licence's plan includes (from the panel's last licence check) and the features this server's software is set up for. The two differ until the next sync after a plan change.

licence sync

hf-agent licence sync
hf-agent licence sync --if-changed   # only when the plan changed (the daily run)

Asks the licence server now, then makes the server match your plan. It prints each added (+) and removed (-) feature, every change it makes, and a count at the end.

When your plan loses a feature, the sync stops and switches off its services (they no longer start at boot), closes its firewall ports and removes its own address. The panel hides the feature's screens.

Important: data is never deleted. Mailboxes, DNS zones, databases, Docker images and apps' files stay on the server, and come back when the feature is in your plan again.

HF Tunnel is not part of any plan (it runs only on HostFog Ltd's own server): on a server that had it switched on, the sync and every update keep the tunnel server stopped. Its tunnels, keys and settings stay on the server.

Every step checks first, so the sync can run any number of times. A part you left out with an installer option (--no-mail, --no-dns, --no-portals) is never added. Root's daily scheduled job runs hf-agent licence sync --if-changed, so a plan change reaches the server within a day; Check now on Server Admin › Billing › Licence checks the licence straight away. The official edition includes every feature, so the sync has nothing to do there.

More servers

node-enable

hf-agent node-enable 203.0.113.10
hf-agent node-enable 203.0.113.10 --new   # a new join code

Run this on an extra server, with the IP address of the main HF Panel server (several addresses may be given, separated by commas or spaces). The extra server then accepts commands from the main one, and prints a join code. Paste the code on the main server under Server Admin › Accounts › Servers › Add server.

The code stays the same each time you run the command; --new makes a new one. Keep it secret: it lets that panel manage this server.

node-disable

hf-agent node-disable

Stops accepting commands from a main panel.

Install, update, remove

Install or update

cd /home && curl -o latest -L https://cdn.hostfog.com/latest && sudo bash latest [options]

Installs HF Panel, or updates an installed one. Options:

See Customise the installation and Updating.

uninstall

hf-agent uninstall          # remove HF Panel and everything it set up: accounts, websites, databases, mail, software

It asks you to type DELETE EVERYTHING; nothing is saved, except the SSL certificates archive (/root/hostfog-certificates.tgz), which the next install reuses. --yes skips the Continue? question (the words are still needed). See Uninstalling.

Other commands for administrators

Related

• Settings
• Troubleshooting
• Logs