Limits

Each account is capped on what it can use of the server. The caps are set per account, when it is created and at any time after, in the Limits section of the account's page (Edit) or with account:edit:

elpanctl account:edit <username> --<limit>=<value> [--<limit>=<value>]...

Each option sets one limit and leaves the others alone. The same fields, with the same defaults, are on the Create Account form. A terminated account is frozen: Edit is hidden and account:edit is refused until the account is restored or deleted.

The limits and their defaults

Limit (admin app)	account:edit option	Default	Notes
Storage limit	--disk-quota	unlimited	500M, 2G; unlimited or 0 for none.
Process limit	--process-limit	64	How many processes the account can run at once.
Memory limit	--memory-limit	the host's sizing profile; 2 GiB on the standard profile	512M, 2G; empty in the form for none.
CPU quota (%)	--cpu-quota	100	100 is one core, 200 two cores.
IO weight	--io-weight	100	10 to 1000. A relative weight against the other accounts, not an absolute rate.
Persistent services	--enable-persistent-services, --disable-persistent-services	off	Whether the account's app servers and containers run without a session.
AI cost budget	--ai-rate-limit	off	Empty, or disabled, bars the account from the AI features; default gives the panel's default budget.
Outgoing script-mail limit	--script-mail-rate-limit	100/PT1H/300	Always on. Empty, or default, uses the panel's default.
Mailing lists	--mailing-list-limit	100	Or unlimited.
Members per mailing list	--mailing-list-member-limit	10,000	Members whatever their status. Or unlimited.
Mailing list addresses at a time	--mailing-list-bulk-add-limit	1,000	1 to 1000: one Add Members or one API request.
Mailing list message size	--mailing-list-message-size	10 MB	10M; or unlimited, which leaves the mail server's own limit.
Webhook endpoints	--webhook-endpoint-limit	10	0 turns webhooks off for the account; or unlimited.
Webhook delivery limit	--outbound-rate-limit	60/PT1M,2000/PT1H	Deliveries over it wait; none is dropped. default, or unlimited.

What the account holder sees of these is in the account docs: Quotas and limits.

Resources

Storage counts everything in the account's home directory, its mail, its databases and its mailing list archives. The account's page and account:view show the usage against the limit, with the home directory, the databases and the archives apart.

Memory limit, CPU quota, IO weight and Process limit become the account's systemd slice (MemoryMax, CPUQuota, IOWeight and TasksMax), so they cap all of the account's processes together: app servers, containers, cron jobs, PHP and terminal sessions. At the memory or process cap a process fails to start or is stopped. A limit left empty is rendered as a finite value that amounts to the whole machine, because the web server refuses to run an account's PHP under a slice without limits.

The memory default and the sizing profile

The memory limit is the one default that depends on the server. Before the Sizing profiles, every account got 2 GiB; now a new account gets the profile's default, and 2 GiB is the standard and large profiles' value. Existing accounts keep their limit when the profile changes. To move them:

elpanctl account:apply-memory-default [--dry-run] [--from=<size>] [--all]

Without options it changes only the accounts still at 2 GiB, the old default, on the assumption that nobody set those by hand; --from names another value to move from; --all changes every account whose limit differs from the profile's default, uncapped accounts included. Accounts being deleted are left alone.

Persistent services

An account's app servers and containers run under the account's own systemd user manager. With Persistent services off, that manager runs only while the account has a session, so nothing of the account's runs on its own. With it on, the panel keeps the manager up (systemd's linger), and the account's app servers and containers start at boot and keep running without anyone signed in.

The AI cost budget

The account AI assistant spends money per request, so an account may use it only within a budget, in the rate-limiter notation with microdollars as tokens; a new account has none, and none means the assistant is off for the account. account:view shows the budget, how much of it is left and when the window resets. The budget's notation and default, --reset-ai-budget, the LLM proxy and disabling the assistant server-wide are in AI assistant.

Mail sent by scripts

The Outgoing script-mail limit caps the mail an account's programs hand to sendmail: PHP's mail(), a contact form, a cron job. Such mail has no mailbox sign-in, so the account's scripts and domains share one bucket. The default, 100/PT1H/300, is 100 messages an hour sustained with a burst of 300: generous for application mail, and a cap on a runaway script. Mail over the limit is refused, not queued; the account holder sees it under Sendmail Failures.

This limit is always on. An empty field, or default, means the panel's default, never unlimited. Mail sent from a mailbox is not under it: each mailbox and send-only address has a per-sender submission limit of its own, 1/PT1M/60 by default (one a minute, burst 60), which the account holder sets per address and service:mail:edit --rate-limit sets domain-wide (--enforce-rate-limit makes the domain's value binding).

Mailing lists

The four mailing list limits bound what one account's lists can do to the server's outgoing mail: how many lists, how many members in each, how many addresses one Add Members (or one API request) can hold, and the largest post a list accepts. A list sends one copy of a post to each member, so a 10 MB post to 1,000 members is 10 GB of mail; that is why a post has its own size limit, under the mail server's. The panel refuses what crosses a limit and tells the holder which one. See Mailing Lists in the account docs.

Webhooks

The account's webhooks notify the holder's own systems of events in the account. Webhook endpoints caps how many endpoints the account can register; 0 turns the feature off for the account. The Webhook delivery limit paces the deliveries to all of them, in rate-limiter notation: over it, deliveries wait their turn and none is dropped. See Webhooks in the account docs. The server's own outgoing webhooks are a different thing: Webhooks.

The rate-limiter notation

The AI budget, the script-mail limit and the webhook delivery limit share one notation, with the duration in ISO 8601 (PT1M one minute, PT1H one hour, P7D seven days):

Form	Policy	Example
<limit>/<duration>	Sliding window: at most this many in any such period.	60/PT1M
<limit>/<duration>/<burst>	Token bucket: this many per period sustained, up to the burst at once.	100/PT1H/300
fixed:<limit>/<duration>	Fixed window: the allowance refills when the period ends.	fixed:10000/PT24H
several, separated by commas	All of them apply together.	60/PT1M,2000/PT1H