Skip to main content

Storage Policies & Limits

Trellilume lets the Server Owner decide whether to place product limits on a self-hosted server. Ordinary self-hosted installations start with product quotas set to Unlimited and the storage policy set to Observe.

Product quotas are different from operational safeguards. A Server Owner may leave product quotas unlimited, but finite upload and low-disk protections remain active to protect the server.

Product quota terminology​

Per-account quota​

The per-account quota is the default maximum logical media usage for each account. An account without a specific override inherits this value.

Per-account override​

A per-account override replaces the default quota for one selected account. It can provide that account with a higher, lower, or unlimited quota without changing the default for everyone else.

A disposable test-user override is not a separate production setting. It is simply a deliberately small per-account override applied to a disposable QA account so an administrator can safely verify quota behavior without filling the server or affecting real users.

Server logical quota​

The server logical quota is the maximum combined logical media usage across all accounts. An upload must fit within both the uploading account's quota and the server-wide quota when enforcement is enabled.

Logical usage tracks Trellilume-owned user media and active upload reservations. It includes media in Trash until that media is permanently deleted and its physical cleanup succeeds. Replaceable thumbnails, caches, and generated derivatives do not normally count unless they become durable user-visible media.

Logical usage is not the same as the amount of disk space occupied. Temporary files and generated data can consume physical storage without counting toward a product quota, which is why Trellilume also maintains low-disk safeguards.

Account limit​

The account limit, also called the cohort limit, is the maximum number of real, non-deleted accounts that the server may contain. It is useful for a private family server or a bounded test group.

Lowering this limit does not disable existing accounts. It blocks creating or restoring another account until the server is below the limit or the Server Owner changes the policy.

Observe and Enforce​

The policy mode controls whether product quotas block growth.

Observe​

In Observe mode, Trellilume calculates logical usage, maintains reservations, reports policy health, and records what the configured product limits would mean, but those product quotas do not reject uploads or new accounts.

Observe is the safer mode after an installation, migration, or restoration. It lets the Server Owner verify accounting before making product limits authoritative.

Observe does not turn off operational safeguards. Maximum file size, request and chunk bounds, upload concurrency, reservation expiry, and minimum free storage continue to protect the server.

Enforce​

In Enforce mode, the configured per-account quota, server logical quota, and account limit become authoritative. Trellilume rejects new growth that would cross an applicable limit and returns recovery guidance to the app.

Changing to Enforce does not delete or modify existing media. If current usage already exceeds a newly lowered quota, the existing data remains available, but additional growth is rejected until usage falls or the policy changes.

Switching back to Observe is the supported way to stop product-quota blocking while retaining the server's operational safeguards.

Operational safeguards​

These controls protect availability and cannot be made unlimited:

  • Maximum file limits the size of one uploaded file. The app policy may be stricter than the server deployment ceiling, but cannot safely exceed it.
  • Concurrent uploads per account prevents one account from consuming every upload slot.
  • Concurrent uploads server-wide bounds total upload work across the server.
  • Minimum free storage preserves both a byte amount and a percentage of disk capacity for the database, logs, migrations, cleanup, and host stability.
  • Upload reservations claim expected bytes before meaningful writes and expire safely when abandoned, preventing simultaneous uploads from spending the same remaining capacity.

Choosing Unlimited for product quotas never disables these safeguards.

Changing the policy​

Only the current Server Owner can change storage policy or per-account overrides.

  1. Open Settings > Server > Storage & limits.
  2. Review current logical usage, capacity health, and accounting status.
  3. Choose Observe or Enforce and configure the desired product quotas and operational safeguards.
  4. Select Review to see the exact effect of the proposed policy.
  5. Complete recent authentication and explicitly confirm the change.

Trellilume rechecks the policy revision before applying a change and records a privacy-safe audit event. If the policy changed in another session, reload the current values and review the proposal again.

Before enabling Enforce on a populated or restored server, complete a verified backup and confirm that storage accounting and reconciliation are healthy.