The site-admin panel
admin.<DOMAIN> is a separate application for whoever runs the instance, not a section of the dashboard. It manages the platform: every account, every organization, registration invitations and the announcement banners.
Getting in
Sign in the same way you sign in to the dashboard — password, GitHub or a passkey (one passkey works on both sites). What gates the panel is not a separate login but whether your account is a site admin: either the is_admin flag on your account, or your address being listed in the instance's ROOT_ADMIN_EMAILS. The environment list is the bootstrap seed — signing in promotes it to the flag.
Anyone else who reaches the URL gets "Admins only".
Four pages: Users, Organizations, Invitations, Announcements.
Users
Every registered account on the instance, with badges for Admin and MFA and a count of the organizations they belong to. Opening a user lists those organizations and their role in each.
Invite user emails a one-time signup link, locked to that address.
Delete user erases the account immediately — there is no grace period here. That is deliberate: an admin removing a spammer or serving an erasure request should not have to wait, and it is the escape hatch if the scheduled machinery jams. The self-service path on the dashboard schedules instead; see Deleting your account for what erasure actually does and does not remove.
Organizations
Every organization, with its plan, member count and how many quota overrides it carries. Opening one gives you:
| Card | What you can change |
|---|---|
| Settings | Name, description, icon, and the branding theme. |
| Plan | Which plan the organization is on. On a self-hosted instance the plan is stored but not enforced, and the card says so. |
| Quota overrides & usage | Per-organization limits, shown against current usage. Blank inherits the plan default; a number sets a limit. |
| Data retention | How long messages and activity-log rows are kept. Blank inherits the plan window; keep forever exempts the organization from pruning. |
| Members | Add, remove and re-role members. |
The system organization is different
The organization badged System is the platform's own — it owns the mail Notifyzr sends about itself. Its name cannot be changed, it cannot be deleted, and its plan and quota overrides are refused: its plan is fixed so platform mail is never throttled. The panel hides that card for it entirely.
Its retention overrides are allowed, and are the only way to stop platform mail accumulating forever. Its membership is manageable too — but as admin or member only; the system organization never gains a human owner.
Its templates and forms are fixed at install time and are not editable through any interface.
Invitations
People who have been invited but have not registered yet, with the signup link shown once at creation. Delete an invitation to stop its link working.
What an invitation is worth depends on the instance's registration mode, and the page says which one is in force:
REGISTRATION_MODE | Effect |
|---|---|
open (default) | Anyone may register. An invite is a shortcut past the signup form rather than the way in. |
invite | Only an invited address may register. |
closed | Nobody may register. New invitations are refused, and outstanding ones cannot be redeemed. |
The mode gates account creation only. Signing in, accepting an organization invitation and linking a GitHub identity to an existing account are untouched.
Announcements
Banners shown under the navbar to every signed-in dashboard user, on every page — announcements, maintenance windows, incidents.
This is the one platform feature with no organization behind it: an announcement is the platform addressing everyone at once.
An announcement has a message, a severity (Info, Warning, Critical), an optional link — text and URL, both or neither, http(s) only — a window, whether readers may dismiss it, and an Active switch.
The window is what makes it self-managing
Whether a banner is on screen is derived, never stored: it is active, and now is inside [starts at, ends at), either bound optional. So a maintenance notice can be written days ahead and expires by itself, with nothing to remember to switch off. The list shows the resulting state — Live, Scheduled, Expired or Off — alongside the schedule and the author.
Times you type are read in your local time zone; leave a field empty for no bound on that side.
What readers see
A thinner shape than this panel does: the message, severity, link and whether it is dismissible. Nothing about scheduling or authorship reaches the browser. Dismissals are per device, and a non-dismissible banner ignores a stored dismissal.
Severity colours are fixed and do not follow an organization's branding — a platform-wide notice must not change colour based on whose organization happens to be open.