docs: machine requirements from load, every option, 768 MB with the spam filter

Owner, 2026-10-19: "Мы рассмотрели все комбинации опций поставки? Почему со
спамом нужна машина с 1 ГБ ОЗУ? 768 МБ не хватит? 512 МБ не хватит?" The
first version measured one configuration at rest and set the host column by
estimate. Now:

- The options and how they combine: 587 (no cost at rest), port 25 (one
  listener for the relay and DMARC), the rspamd sidecar (needs port 25; an
  external rspamd costs nothing here), the proxy (host program or a
  deploy/ container).
- Measured under load on the test server (dev/server/loadmem.sh, nothing
  delivered): SelfPost 60 MB at rest, 123 MB with 20 SMTP sessions to port
  25 held open; rspamd 118 MB at rest, 153 MB scanning ten 100 KB messages
  at once, 232 MB one 25 MiB message, 424 MB three at once, 139 MB after.
  Caddy 10 MB, nginx 3 MB, Traefik 21 MB at rest (images 92/280/231 MB).
- The host column: SelfPost's peak, rspamd's for the case, and a stated
  300 MB allowance for the system and Docker (not measured on a fresh
  host). With the spam filter 768 MB when port-25 messages are small or
  rarely large, 1 GB for several 25 MiB at once; 512 MB is not enough
  (about 480 MB at rest with the allowance, +100 MB a large message).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -10,8 +10,10 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 - **Machine requirements by what is switched on** (guide § Installation,
   README § Requirements), measured on the test installation instead of the
   old unmeasured "1 vCPU, 512 MB-1 GB, 8-10 GB": 512 MB of host memory for
-  outbound mail with or without port 25, 1 GB with the spam filter; one
-  vCPU. Building the image needs 1.5 GB of memory - a build held to 1 GB was
+  outbound mail with or without port 25; with the spam filter 768 MB when
+  port-25 messages are kept small and 1 GB for several 25 MiB messages at
+  once (rspamd measured at 118 MB at rest, 232 MB on one 25 MiB message,
+  424 MB on three); the proxy containers' own; one vCPU. Building the image needs 1.5 GB of memory - a build held to 1 GB was
   killed in the Go compiler - and about 3 GB of free disk. The send log
   grows about 2-3 KB a message for its retention.
 

README.md

@@ -67,8 +67,12 @@ missing PTR record for you. Details: [Operator guide](docs/guide.md).
 
   | Switched on | Host memory, at least | Images on disk |
   |---|---|---|
-  | Outbound only (465/587), or with port 25 (inbound relay, DMARC reports) | 512 MB | 315 MB |
-  | With the spam filter (rspamd sidecar) | 1 GB | 626 MB |
+  | Outbound only (465/587), with or without port 25 (inbound relay, DMARC reports) | 512 MB | 315 MB |
+  | With the spam filter (rspamd sidecar), port-25 messages kept small | 768 MB | 626 MB |
+  | With the spam filter and 25 MiB messages, several at once | 1 GB | 626 MB |
+
+  rspamd takes about 100 MB more for each large message it scans; a reverse
+  proxy in a container adds its own few megabytes.
 
   One vCPU is enough. **Building the image needs 1.5 GB of memory and about
   3 GB of free disk** (the Go compiler: a 1 GB build was killed) - on a

docs/guide.md

@@ -59,30 +59,51 @@ changed (see the CHANGELOG, *Removed*).
 
 ### Machine requirements
 
-What SelfPost needs of the host depends on what is switched on. The figures
-were measured on the test installation on 2026-10-19 - SelfPost 2.16.0 with
-the inbound relay and the spam filter on, a host of 2 vCPU and 4 GB - and,
-for the build, in a container held to a given memory and one CPU. What is
-worked out from them rather than measured says so.
+What SelfPost needs of the host depends on what is switched on. The options
+that change it are independent of each other: port 587 costs nothing until a
+client uses it; port 25 is one listener whether the inbound relay, DMARC
+reports or both open it; the spam filter is a second container, which
+needs port 25 (an rspamd elsewhere, given by `INBOUND_ANTISPAM_MILTER`,
+costs this host nothing); and the reverse proxy is either a program on the
+host or one of the containers under `deploy/`. The figures were measured on
+the test installation on 2026-10-19 - SelfPost 2.16.0, a host of 2 vCPU and
+4 GB - at rest, under load made for the purpose (SMTP sessions to port 25
+held open; messages given to rspamd to scan, nothing delivered), and, for
+the build, in a container held to a given memory and one CPU.
 
-**Running**
+**Running.** What each part uses, measured:
 
-| Switched on | What it uses (measured) | Host memory, at least | Images on disk |
-|---|---|---|---|
-| Outbound only: 465, and 587 if enabled | 55 MB at rest, 80 MB the most seen: the panel about 30 MB, supervisord 30 MB, Postfix's daemons 6-12 MB each, most of that shared libraries | 512 MB | 315 MB, the SelfPost image |
-| Port 25: the inbound relay and/or DMARC reports | the same at rest; each SMTP connection being served is one more Postfix `smtpd`, of the size of its resident siblings (6 MB, mostly shared) | 512 MB | the same |
-| The spam filter: the rspamd sidecar, `deploy/antispam/` | 120 MB more, rspamd's five processes | 1 GB | 311 MB more, the rspamd image |
+| Part | At rest | Under load |
+|---|---|---|
+| SelfPost: the panel, Postfix, supervisord | 55-60 MB (the panel and supervisord about 30 MB each, Postfix's daemons 6-12 MB each, mostly shared libraries) | 123 MB with 20 SMTP sessions open at once - about 3 MB a session |
+| The spam filter: rspamd, five processes | 118 MB | 153 MB scanning ten 100 KB messages at once; 232 MB scanning one 25 MiB message; 424 MB scanning three of them at once |
+| A reverse-proxy container from `deploy/` | Caddy 10 MB, nginx 3 MB, Traefik 21 MB | not measured |
 
-The host's own system and Docker come on top of what SelfPost uses, and
-are what the third column leaves room for. Docker's daemon grows with the
-images and the build cache it keeps: on the test server, after a week of
-builds for three projects, `dockerd` held 600 MB - prune what you do not
-need (below).
+rspamd sees only mail on port 25, and a message there may be as large as
+`INBOUND_MESSAGE_SIZE_LIMIT` (25 MiB by default): each such message rspamd
+is scanning adds about 100 MB while it does. That, not SelfPost, is what
+sets the memory a host with the spam filter needs.
+
+The host's own system and Docker come on top. They were not measured on a
+fresh host, and the table below allows them 300 MB; on the test server
+`systemd-journald` and `containerd` took about 120 MB, and Docker's daemon
+had grown to 600 MB after a week of image builds for three projects - prune
+the build cache (below) and it stays smaller.
+
+| Switched on | Host memory, at least | Images on disk |
+|---|---|---|
+| Outbound only (465, and 587 if enabled), with or without port 25 | **512 MB**: SelfPost's 123 MB under load and the allowance | 315 MB |
+| With the spam filter, messages on port 25 kept small (`INBOUND_MESSAGE_SIZE_LIMIT` of a few MiB) or rarely large | **768 MB**: 123 + 153 MB under load and the allowance, with room for one large message (+100 MB) | 626 MB |
+| With the spam filter and the default 25 MiB, several large messages at once | **1 GB**: 123 + 424 MB and the allowance | 626 MB |
+| A reverse proxy as a container | the proxy's own (3-21 MB at rest) on top | Caddy 92 MB, nginx 280 MB, Traefik 231 MB |
+
+512 MB is not enough with the spam filter: at rest SelfPost, rspamd and the
+allowance come to about 480 MB, and one large message is another 100 MB.
+Without swap the kernel then kills a process - the panel, Postfix or rspamd.
 
 One vCPU is enough to run it: at rest SelfPost and rspamd use under 0.1 % of
-a CPU. The
-image is built and run on `amd64` and `arm64`; rspamd's image is published
-for both.
+a CPU. The image is built and run on `amd64` and `arm64`; rspamd's image is
+published for both.
 
 **Building the image.** As long as no 2.x image is published (see [Fixed
 image tag](#fixed-image-tag)), every installation builds its own, and the