Your settings
Your own account, reached from the user menu: who the engine writes to about your VMs, who else to reach about them, and how long a sign-in lasts.
Everything here saves itself as you change it.
Signed in as
The account you are using. An engine linked to the registry may know you by the same name on more than one engine.
Switching accounts
When you have been given other accounts to act as, they are listed at the top of the user menu, with a tick by the one you are acting as and you by your own. Choosing one opens Keal again, on Home, as that account; choosing your own brings you back. Signing out does too.
While you act as another account you can do what you were given there - use it, or only look - and the button's tooltip says who really signed in. An administrator gives accounts on the Users tab.
Role
What this account may do - administrator, manager, user or read-only. Only an administrator can change anyone's role, on the Users tab.
Full name
The person behind the account, shown wherever something names its owner.
Where the engine writes to you: monitoring alerts, backup failures, quota warnings. Left empty, your account name is used where it looks like an address.
Phone
A number for whoever has to reach you about this account. The engine never dials it; it is there for the person reading the alert.
Operations contact
Who to reach about the VMs on this account when that is somebody else: the team running the application rather than the person who created it. A system can carry its own contact too, which overrides this one.
Alerts
Where alerts go, when that should not be your own address - a shared mailbox, or whoever is on duty. Several addresses may be given, separated by commas; each of them gets every alert. Left empty, they go to your email above.
Reset stacks and VMs
A stack or a VM can have contacts of its own, set in its pane on the Stacks or VMs tab. This clears them all, so every stack and VM you own takes the contacts above again.
Account security
Who may sign in as you, from where, and for how long.
Password
Your own password on this engine, typed twice. It takes effect immediately, and sessions already signed in stay signed in until they lapse.
An account that signs in through a linked registry has its password there rather than here.
Allow sign-in from
Where this account may sign in from, as a comma-separated list of addresses,
networks or two-letter country codes - 10.0.0.0/8, DK. Empty allows anywhere,
which is the default.
A sign-in from anywhere else is refused before the password is even considered, so this is worth setting on an account that only ever signs in from one place - and worth thinking twice about on your own.
Last signed in
When this account last signed in, and the address it came from. Worth a glance: a sign-in you do not recognise is the thing this section exists to notice.
Sign-in
A sign-in has two limits. It ends after a few hours of not being used, and using Keal pushes that out - which means a browser left open on a page keeps the session alive, because the page itself keeps asking the engine for things.
The cap is the other limit: the longest a sign-in may last however much it is used, measured from when you signed in and carried through every renewal. Zero turns it off and leaves only the idle timeout.
It belongs to the whole engine rather than to your account, so only an administrator can change it, and it takes effect for everyone the next time their session is checked.
API access
Whether a VM on this account may ask the engine about itself - which network it is on, what its system holds, what the storage pools are.
A stack's management interface makes those calls while it renders, authenticated by the address they come from rather than by a password, so they only work for an account that allows them. Turn it off and a stack's own page stops working; nothing else does.
Which calls those are, and at which paths, is in Compatibility paths.