Hosting packages

A hosting package is a named set of limits and settings you give hosting accounts, for example Basic: 5 GB, 10 mailboxes of 1 GB, 3 databases, 1 addon domain, unlimited subdomains, jailed shell. Reqad checks the limits whenever something is created, and applies the settings to every account that has the package.

Limits

Each limit is a number. 0 means none are allowed, and an empty field means unlimited.

The check runs wherever something is created: in the panel, on the command line, through the API and by AI assistants. When an account has reached a limit, the creation is refused with the reason, for example "bob has 3 of the 3 databases its package Basic allows." Nothing that already exists is ever removed. An account that has more than its package allows, because it got a smaller package or the package was lowered, keeps everything and cannot add more. The Needs attention card lists such accounts.

Disk quotas

A package's disk space is enforced with user quotas on the filesystem that holds /home. The Disk space limits card on the Packages page shows whether they are on, and turns them on or off (this asks for your password again).

• What counts: every file the account owns on that filesystem: its sites, its mail and its temporary files. Databases belong to MySQL and are not counted.
• At the limit writes fail: uploads, cache files, new mail, which waits in the queue and is retried until it bounces. Accounts without a package, or whose package has no disk space limit, stay unlimited.
• ext4 turns them on at once: Reqad adds usrquota to /etc/fstab, remounts, counts what each account uses and sets the limits.
• XFS (the default on Rocky Linux, AlmaLinux and RHEL) takes its quota mode only when it is mounted, so a reboot is needed. For the root filesystem Reqad adds the kernel option rootflags=uquota; for a separate /home, uquota in /etc/fstab. Nothing changes until you reboot. After it, Reqad sets every account's limit within the hour, and the first boot with quotas checks the filesystem, which can take a minute on large disks.
• Changing a package, giving an account another one or removing it updates the account's limit at once. An hourly job keeps every limit in step with its package.

reqad package quota          # on or off, and each account's use and limit
reqad package quota on       # ext4: at once; XFS: at the next reboot
reqad package quota off
reqad package quota sync     # set every account's limit from its package now

Mailbox sizes

A package's Mailbox size is the size of each of the account's mailboxes. In Email > Email Accounts the Edit dialog can give one mailbox a smaller size, and Create a new email account can too. Leave the field empty to use the package's size. For an account without a package, any size can be given, and a mailbox without one is unlimited. With mailbox quotas on, the list's Usage column shows each mailbox against its size, for example 1 MB (50% of 2 MB).

The Mailbox size limits card on the Packages page turns mailbox quotas on or off. It takes effect at once, with no reboot, and asks for your password again. When they are on:

• A full mailbox refuses new mail. Senders are told while they are still connected (552 5.2.2 Mailbox is full), so the message goes back to them from their own server and your server sends no bounce.
• The mailbox owner is warned by a mail at 90% and another when it is full. The warnings are delivered even to a full mailbox, and each is sent once, until the mailbox is below 85% again. Mail clients and webmail show how full the mailbox is.
• The dashboard's Needs attention card lists mailboxes at 90% and full ones.
• Changing a package's mailbox size, giving an account another package or removing it updates its mailboxes' limits at once. An account with no package keeps only the sizes given to its mailboxes themselves.
• A mailbox already over a new, smaller size keeps its mail and refuses new mail until there is room.

Mail is also counted in the account's disk quota, since the mailboxes are in its home directory. Mailbox quotas need Dovecot 2.4, which Reqad installs. Turning them on adds Dovecot's quota settings in /etc/dovecot/conf.d/90-reqad-quota.conf and a check to Exim's recipient rules, then reloads both. Turning them off removes both and the limits; the sizes stay in the panel for the next time. Removing the add-on turns them off too.

reqad package edit Basic --mailbox-size=2G
reqad package mail                             # on or off, and each mailbox's size and use
reqad package mail on                          # or: off
reqad package mail set office@example.com 500M # its own size; default = the package's again
reqad email create sales@example.com --size=1G --generate-password
reqad package mail sync                        # limits and warning mails now (cron: hourly)

Bandwidth

Reqad counts each account's bandwidth from its sites' access logs every hour: the bytes sent in each request, for the main domain and the addon domains (aliases and mail.<domain> share their domain's log). The count starts again on the 1st of each month, and 13 months are kept. When the add-on is installed, it reads the current month's rotated logs too, so the first numbers already cover the whole month.

At 90% of the limit the dashboard's Needs attention card shows a note, and over the limit a warning. What else happens over the limit is the package's Over the bandwidth setting:

• Warn only (the default): the sites keep working, and you decide what to do (a bigger package, or a word with the customer).
• Slow its sites down: every site of the account (main and addon domains, apps too) is sent at the slowed-down speed, per visitor connection. The sites stay up, just slower.
• Suspend the account: the account is suspended.

Either is checked every hour, after the count. It is lifted by itself on the 1st of the month, and at once when you raise the limit, switch the setting back to warn only, or give the account another package (or none). You get an email when an account is slowed down or suspended, if the panel has a sending method (Settings) and your admin account an email address. A suspension you lift by hand stays lifted until the end of the month, even if the account is still over. Accounts > Manage shows the month so far and what the limit did, and reqad package bandwidth lists every account.

Suspending an account

Accounts > Manage > Suspend account (with an optional reason, for your records) suspends a hosting account. The bandwidth limit can do it too. While an account is suspended:

• its sites (main and addon domains, aliases, apps) answer every request with a short This site is suspended page (HTTP 503). Let's Encrypt can still check the domains, so certificates keep renewing;
• SSH, SFTP, its cron jobs and the web terminal are refused;
• its mailboxes cannot log in: IMAP, POP3, SMTP and webmail are refused. Mail for them is still received, so nothing is lost;
• its Node.js and Python apps are stopped, and Git deploys are refused;
• files, databases, mailboxes and settings are left as they are.

The accounts list shows Suspended in the status column, and the dashboard's Needs attention card lists suspended accounts. Lift the suspension in Accounts > Manage gives everything back: the apps that were running start again. Removing the add-on lifts every suspension and slow-down first.

Settings

A package can also set these. For each one you can choose Leave each account's own, and then the package does not touch it.

The settings are applied when an account gets the package, and again for every account that has it whenever you save the package. A setting changed for one account by hand, for example under Advanced settings, is overwritten the next time its package is saved or given again. If a setting could not be applied, the account's Manage dialog and the Needs attention card say why.

Giving accounts a package

• New accounts: Create a new account has a Hosting package choice. The default package (set at the bottom of the Packages tab) is preselected there. It is also used by reqad account create and the API when they are not given a package. When the package sets the shell access, the shell choice of the form follows it.
• Existing accounts: Accounts > Manage has the same Hosting package choice, with the account's usage against each limit; Save changes applies the package. The accounts list has a Package column, and reqad package usage lists every account with its usage.
• No package: the limits go away. Session limits and database connections set by the package go back to the server defaults. The shell access stays as it is, so it is never widened without you choosing it.

Each package has a color, chosen from the panel's own badge colors. Its badge in the accounts list and on the Packages page uses it, so the theme and dark mode keep it readable.

A package that accounts have cannot be deleted. Give them another package first.

On the command line

# a package, and make it the default for new accounts
reqad package create Basic --disk=5G --mailboxes=10 --databases=3 --addons=1 --subdomains=unlimited \
    --session=custom --cpu=100 --memory=1G --processes=256 --shell=jailed
reqad package default Basic

reqad package list
reqad package show Basic
reqad package edit Basic --databases=5            # applied to its accounts at once
reqad package assign bob Basic                    # or: reqad package assign bob none
reqad account create shop shop.example.com --package=Basic --generate-password
reqad package usage --over                        # accounts above a limit
reqad package bandwidth                           # this month's bandwidth per account
reqad package bandwidth --collect --month=2026-09 # read the new log lines first; another month
reqad package edit Basic --over-bandwidth=throttle --throttle=128   # or: --over-bandwidth=suspend
reqad account suspend bob --reason="Unpaid invoice"
reqad account unsuspend bob
reqad account suspended                           # every suspended account
reqad account can-create bob database             # exit 0, or 1 with the reason

Limits take a number, 0 or unlimited; --disk and --mailbox-size also take 5G, --bandwidth GB or 2T. --over-bandwidth takes warn, throttle or suspend, and --throttle a speed in KB/s. --session, --db-connections and --shell also take leave. reqad package --help lists every option.

API and AI assistants

With a whole-server token: GET /api/v1/packages, GET /api/v1/packages/<name> (with the accounts and their usage), POST /api/v1/packages, PATCH /api/v1/packages/<name>, DELETE /api/v1/packages/<name>, and POST /api/v1/accounts/<user>/package with {"package": "Basic"} (or "none"). GET /api/v1/mailbox-sizes lists every mailbox with its size and use. Packages take bandwidth_action (warn, throttle, suspend) and throttle_kbps. POST /api/v1/accounts/<user>/suspend (with an optional reason) and POST /api/v1/accounts/<user>/unsuspend suspend and lift, and GET /api/v1/suspensions lists the suspended accounts. POST /api/v1/mailboxes and PATCH /api/v1/mailboxes/<email> take size ("500M", "2G", or "default" for the package's), also with the account's own token, never more than its package allows. POST /api/v1/accounts takes package, and GET /api/v1/accounts/<user> shows the account's package and usage, also with that account's own token.

AI assistants get the same operations as the tools packages_list, package_show, package_create, package_edit, package_delete (confirmed in a second call), account_package_set, mailbox_sizes_list, suspensions_list, account_suspend and account_unsuspend, and mailbox_create / mailbox_edit take a size. Try asking "Which accounts are over their package limits?"

Need a hand? Create a free account or contact us.