What this panel needs to run

The numbers below are measured, not estimated. They come from a server running the full stack — panel, admin, three web servers, MariaDB, PostgreSQL, BIND, Postfix, Dovecot, rspamd, ClamAV, a search engine and twelve PHP-FPM masters — and from what those processes actually hold in memory.

Supported operating systems​

The installer refuses anything else rather than getting halfway and leaving a broken machine. That includes an Ubuntu release newer than 26.04 until it has been tested: the PHP, nginx, OpenLiteSpeed and MongoDB repositories publish a new release weeks or months after it ships. --skip-requirements installs on it anyway, and then any third-party repository that does not publish the release yet is left out.

Third-party repositories​

Before adding a vendor's package repository, the installer checks that the repository publishes your release. When it does not, the installer uses the distribution's own package instead, or leaves that component out and says so. It never leaves a repository in apt's lists that would fail every later apt-get update.

On Ubuntu 26.04 and Debian 13:

• Mail runs on Dovecot 2.4, which reads a different configuration language from 2.3. The installer writes Dovecot's settings for the version installed, and every update rewrites them, so a server upgraded from Ubuntu 24.04 or Debian 12 keeps its mailboxes, passwords, quotas and filters. After upgrading a server's release in place, run hitechcloudcli mail apply-config and then hitechcloudcli mail sync straight away (hitechcloudcli update --repair runs both): Dovecot 2.4 does not start on 2.3's settings, and mailbox limits apply again only once the sync has rewritten them.
• Node.js comes from Ubuntu itself on 26.04, which ships Node 22, so no third-party Node.js repository is added there.
• Microsoft SQL Server is not offered on Ubuntu 26.04. Microsoft publishes no SQL Server repository for it.
• MongoDB 8.0 is refused at install time with the reason. Its repository for these releases holds MongoDB's tools but no server yet.
• OpenResty is not offered. Its project publishes no packages for these releases.
• The H2O and Cherokee WebEngines cannot be installed: neither release packages H2O, and the package mirror has no build of either for them yet.

AlmaLinux and RHEL 10​

AlmaLinux, Rocky and RHEL 10 install like any other supported release, with these differences:

• PHP 5.6 is not offered. The PHP repository publishes no 5.6 build for release 10, so the installer skips it with one warning and the App Store shows it as not available on this operating system. PHP 7.4 to 8.6 are installed as usual.
• Search uses Elasticsearch. The key OpenSearch signs its repository with is rejected by the release's crypto policy. The installer then installs Elasticsearch, which provides the same search feature, and removes the rejected repository so later dnf commands keep working.
• WireGuard needs a reboot after a kernel update. The VPN's NAT rule needs the netfilter masquerade module of the running kernel. When a newer kernel has been installed since boot, hitechcloudcli vpn status says so; reboot, then run hitechcloudcli vpn repair.
• Microsoft SQL Server needs openldap-compat (for liblber-2.4.so.2), which hitechcloudcli sqlserver install adds.
• SRS for forwarded mail (postsrsd) is not packaged for release 10, and the admin panel says so instead of starting an install that cannot succeed.
• FTP works; the distribution's pure-ftpd-init unit fails on release 10, so the installer makes pure-ftpd's certificate itself and leaves that unit out.

Minimums​

There is no single number, because the panel installs services you may not want. Pick the row that matches what you will actually run.

Disk is for the system and the panel. Customer data is on top of it, and it is the number that grows.

Where the memory actually goes​

Measured on a server carrying 5 accounts, 2 websites and 2 mailboxes — which is to say, almost nothing. 6.1 GB of 12 GB was in use:

Two things worth reading off that table before you size a server:

The mail scanners cost more than everything else combined. ClamAV, rspamd, Amavis and SpamAssassin together are about 3.5 GB, and that is with two mailboxes. If you are not hosting mail, you do not need most of this machine.

The search engine is a JVM. It reserves its heap whether or not anything uses it. If no customer needs Elasticsearch or OpenSearch, leaving it out is the single largest saving available.

Swap​

The installer creates a swap file of 2–4 GB when the machine has none, and leaves existing swap alone.

This is not a substitute for RAM. It is there because a machine with 2 GB and no swap gets through the install and then meets the OOM killer the first time a customer runs a WordPress import next to a database and a search engine — and what the OOM killer chooses to end is not usually the thing that caused it.

Ports​

Reachable from the internet: 80, 443 (websites), 2083 (panel), 2087 (admin), 2096 (webmail), 8888 (phpMyAdmin), 53 (DNS), 25, 465, 587 (mail), 110, 143, 993, 995 (mailbox access), 20, 21 and the passive range (FTP), your SSH port, and 2091, 2092, 2093 for the customer portals that are switched on.

Loopback only, never exposed: 8188/8288, 8189/8289, 8190/8290 — nginx, Apache and OpenLiteSpeed behind the front end — and 2094, the portal API.

The server's own firewall (CSF) is installed switched off. Turn it on with hitechcloudcli firewall on once you can reach the server; it opens the ports above. If a firewall in front of the server (a cloud security group) filters traffic, open the same ports there. See hitechcloudcli firewall.

One thing that is not a requirement, and matters more than any of them​

A PTR record for your server's IP, matching the name it announces. It is set by whoever owns the address range — your provider — and nothing on this server can set it for you. Without it a large share of your customers' mail will be treated as suspicious no matter how correct SPF, DKIM and DMARC are.

Ask for it before you migrate anybody.