> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cluster sizing

> Default Hybrid and External capacity guidance — a starting point you can right-size and fine-tune.

Chart defaults ship as a **sensible starting point** for evaluation and typical
production traffic. They are not a hard ceiling. **Right-size** and **fine-tune**
CPU, memory, replicas, and node pools to match your traffic, latency goals, and
budget.

The shapes below reflect the maintained `neuraltrust-platform` chart defaults
(in-cluster PostgreSQL and Redis; Firewall CPU workers when TrustGuard is on).
They do **not** include the node OS, kube-system, or your ingress controller —
leave headroom for those.

## Recommended worker profile

|                           | Hybrid (full products)                                                                   | External (self-hosted)                         |
| ------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------- |
| Approx. chart requests    | \~10 vCPU / \~28 GiB                                                                     | \~15 vCPU / \~38 GiB                           |
| Comfortable cluster shape | **3–4** workers at **8 vCPU / 16–32 GiB** each                                           | **4–5** workers at **8 vCPU / 16–32 GiB** each |
| Example cloud shapes      | AWS `m6i.2xlarge` × 3 · Azure `Standard_D8s_v5` × 3 · GCP `e2-standard-8` × 3 (regional) | Same SKU class with **one extra node**         |

Hybrid with fewer products (for example TrustGate only, without Firewall) needs
substantially less memory — Firewall CPU workers are the largest consumers.

External adds the product console, ClickHouse, ClickStack collector, DataCore,
and AlertEngine on top of the data path. See
[External (self-hosted)](/neuraltrust/deployment/external).

## What drives capacity

| Area                       | Notes                                                                                       |
| -------------------------- | ------------------------------------------------------------------------------------------- |
| Firewall CPU workers       | Largest memory footprint when TrustGuard is enabled                                         |
| Data-plane API             | Significant CPU/memory for evaluation / analytics                                           |
| ClickHouse (External only) | Keep headroom for analytics queries                                                         |
| PostgreSQL / Redis         | Prefer [managed stores](/neuraltrust/deployment/configuration#managed-stores) in production |

GPU Firewall workers need a separate GPU pool — see
[Firewall → GPU workers](/neuraltrust/deployment/firewall#gpu-workers).

## Tuning for your needs

Defaults are intentionally conservative and portable. Common adjustments:

* **Scale out** busy gateways and TrustGuard replicas as traffic grows, or turn
  on horizontal autoscaling when your cluster has metrics.
* **Right-size** Firewall workers if you run a subset of detectors, or move
  heavy workers to GPU.
* **Use managed PostgreSQL and Redis** so datastore capacity is independent of
  the Kubernetes node pool.
* **Pin workloads** to a dedicated pool when you want isolation from other
  cluster tenants.

There is no single “correct” size — start from the defaults, measure under your
workload, then tune.

## Related

* [Configuration](/neuraltrust/deployment/configuration) — managed store minimums
* [High availability](/neuraltrust/deployment/high-availability) — multi-region Hybrid
* [External](/neuraltrust/deployment/external) — self-hosted topology