docs: correct hardware requirements to match enforced container limits

[NotYuSheng]

Closes #597

Summary

The documented 4 GB minimum RAM sits below the default stack's own enforced deploy.resources.limits (~4.4 GB, ~5.4 GB with the Keycloak auth overlay) — before host OS and Docker. A 4 GB host cannot start TracePcap at default settings.

Changes to README.md and docs/getting-started/prerequisites.rst:

• Minimum raised to 6 GB (with SURICATA_ENABLED=false), CPU promoted from Recommended into the minimum tier
• New Comfortable tier — 16 GB / 8 cores / 100 GB+ SSD, for Suricata enabled on large captures, with the .env overrides to match. The shipped APP_MEMORY_MB=2048 caps uploads at 512 MB, since max upload is 25% of the backend budget (backend/docker-entrypoint.sh:73)
• All tiers now say they size the stack only — AI features disabled, or LLM_BASE_URL pointed at a self- or LAN-hosted inference server
• GPU position stated: TracePcap never uses one. Packet dissection (tshark, nDPI) and threat detection (Suricata) are CPU-bound, and no container requests a GPU device — verified by grep across compose files, Dockerfiles, Java, and shell. A GPU is the LLM server's requirement, not TracePcap's
• Cross-reference to the per-service breakdown in production-hardening.rst

Review follow-ups (8cf6289)

Two findings from the CodeRabbit review, both addressed:

• LLM endpoint scope — "an LLM server on another machine" did not exclude a cloud endpoint, which conflicts with the offline requirement. Both files now say a separate inference server on the same local network, with an explicit statement that LLM_BASE_URL must not reference a public or internet-hosted API. Related and outside the flagged scope: the prerequisites table in README.md listed OpenAI as an example provider, contradicting the same requirement — removed, and the row now reads "self- or LAN-hosted".
• Comfortable-tier Suricata — the tier is sized for Suricata enabled, but neither override block set it, and the Minimum tier above recommends SURICATA_ENABLED=false. Anyone stepping up from Minimum would have carried false forward. Added SURICATA_ENABLED=true to both blocks.

Verification

• Per-service table in docs/operations/production-hardening.rst checked line-by-line against docker-compose.yml and docker-compose.prod.yml — every default matches. No changes needed there; the drift was confined to the two getting-started pages
• The 25% upload rule and the 50% JVM heap split confirmed in backend/docker-entrypoint.sh and nginx/docker-entrypoint.sh
• python3 -m sphinx -b html builds with no warnings from prerequisites.rst

Note on the numbers

The corrected tiers are operational recommendations, not measured benchmarks. The 6 GB minimum is derived from ~4.4 GB of enforced limits plus host headroom; the Comfortable tier from the ops doc's own guidance (4 GB+ for the backend alone with Suricata on captures over 100 MB), with headroom for the rest of the stack. Neither has been validated by booting the stack on a host of that size — worth doing once if a defensible figure is wanted. The RST labels the Comfortable tier as such so the doc does not overclaim. LLM VRAM figures are standard quantised-model sizing, not measured against TracePcap's prompts.

Test plan

• Docs build clean (cd docs && python3 -m sphinx -b html . _build)
• Rendered prerequisites page reads correctly and the :doc: cross-reference to production-hardening resolves
• Optional: boot the stack on a 6 GB host with SURICATA_ENABLED=false to confirm the stated minimum

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

The README and prerequisite documentation replace the former 4 GB guidance with tiered TracePcap hardware requirements, container memory and upload-limit details, Suricata-specific sizing, and clarifications about external or self-hosted LLM resources.

Changes

Hardware Requirements Documentation

Layer / File(s)	Summary
Hardware sizing tiers README.md, docs/getting-started/prerequisites.rst	Defines TracePcap-scoped sizing assumptions and updates the Minimum and Recommended RAM, CPU, and storage guidance.
Container limits and comfortable tier docs/getting-started/prerequisites.rst	Adds a Suricata-enabled Comfortable tier, APP_MEMORY_MB tuning guidance, disk usage notes, and enforced container memory-limit details.
GPU and LLM resource scope docs/getting-started/prerequisites.rst	Clarifies that TracePcap processing is CPU-bound and that GPU, VRAM, and additional storage apply only to self-hosted LLMs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NotYuSheng/TracePcap#454: Updates related upload-limit documentation based on APP_MEMORY_MB.
• NotYuSheng/TracePcap#586: Overlaps with the APP_MEMORY_MB sizing model and resource-limit documentation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The docs updates address #597 by raising the minimum RAM, adding CPU guidance, and clarifying LLM and GPU scope without touching production-hardening.
Out of Scope Changes check	✅ Passed	The changes stay within the documented prerequisites updates and related cross-reference, with no unrelated code or scope creep.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating documentation to correct hardware requirements against container limits.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/getting-started/prerequisites.rst`:
- Around line 44-58: Add SURICATA_ENABLED=true to the Comfortable-tier override
blocks in docs/getting-started/prerequisites.rst lines 44-58 and README.md lines
89-98, ensuring users upgrading from the Minimum configuration explicitly enable
Suricata in both documented configurations.
- Around line 27-30: Update the LLM deployment wording in
docs/getting-started/prerequisites.rst lines 27-30 to explicitly allow only
local or LAN-hosted inference servers and exclude public or external endpoints.
Update README.md lines 80-81 to clarify that “another machine” means a server on
the local network; preserve the configurable LLM_BASE_URL guidance while stating
that the application must not make external API calls.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff292aa6-b255-4dd3-af3d-18038831c045

📥 Commits

Reviewing files that changed from the base of the PR and between 5953d89 and 238f333.

📒 Files selected for processing (2)

• README.md
• docs/getting-started/prerequisites.rst