Skip to content

Resellers & Tenancy

PteroCloud inherits Pterodactyl's user model. This page describes how ownership and authorization work for multi-tenant operators.

Ownership

  • A cloud instance belongs to exactly one panel user (its owner).
  • Entitlements cap how many instances a user may hold and which resources they may request.
  • API access is scoped to the authenticated user; a user cannot read or mutate another user's instance. Existence is never leaked: a foreign resource answers 404, not 403.

Support bundle authorization

Support bundles are the highest-risk data path, so authorization is explicit on every generation:

  • A customer may generate a bundle for an instance they own only. The bundle contains their instance data and no provider or hypervisor internals.
  • A reseller (a user with delegated authority over a subtree) may generate bundles for instances in their own subtree only.
  • Global search across all tenants is admin-only.

A bundle is always redacted. Cross-tenant data is never included, and the final secret scan is fail-closed: if a secret survives redaction, generation fails and the artifact is deleted.

Diagnostics

Diagnostics are read-only by default. A customer-facing diagnostic is scoped to the requesting user's resources; the full control-plane scope is an admin operation.

Resource add-ons

Resource-only add-ons: no money, price or currency. Billing is deferred to Paymenter/WHMCS.

Model

  • ResourceAddonDefinition — admin-defined dimension (code, resource_type, amount, resizable, is_active).
  • TenantAddonEntitlement — the quantity a tenant may assign; a reseller is bounded by the parent pool.
  • InstanceAddonAssignment — an add-on applied to an instance.

Types

CPU, MEMORY, DISK, IPV4, IPV6, BANDWIDTH_QUOTA, BANDWIDTH_SPEED, BACKUP_QUOTA, FLOATING_IP, DEDICATED_COMPUTE, NESTED_VIRTUALIZATION, CUSTOM_CAPABILITY.

Resolution and removal

A single resolver (base plan + active add-ons) is the source of truth used by the scheduler, provider configuration, quota checks and the UI.

  • Disk never shrinks. Removing a disk add-on retires it as GRANDFATHERED; the effective disk keeps the add-on so no downward provider resize is attempted.
  • Non-disk add-ons are released (removed).
  • Assignment is admin-only and counts toward the tenant's entitlement (ADDON_QUOTA_EXCEEDED).

Error codes

ADDON_ADMIN_REQUIRED, ADDON_INACTIVE, ADDON_NOT_RESIZABLE, ADDON_QUOTA_EXCEEDED.

Not yet implemented

There is no separate "reseller" role or billing hierarchy in the current build. Delegated subtree authority is expressed through the existing permission model; Paymenter/WHMCS integration is deferred. There is no dedicated reseller UI page.