Hardware Sizing Guide
Surface Security scales from a single mini PC to a multi-node Kubernetes cluster serving 60,000+ browser extensions. Choose the tier that matches your endpoint count. All storage estimates assume ClickHouse TTLs are configured correctly (see Data Retention).
Pricing verified February 2026 from Minisforum store, Amazon, Newegg, B&H Photo, Getic, and manufacturer sites. Configured prices include RAM and NVMe storage. Switch and cable costs included in kit totals.
Tier 1 -- Up to 1,000 Endpoints
Single mini PC, Docker Compose, no Kubernetes.
| Component | Spec | Verified Price |
|---|---|---|
| Device | Minisforum UM790 Pro (Ryzen 9 7940HS, 8c/16t) | -- |
| RAM | 64 GB DDR5 (2x32GB) | -- |
| Storage | 1 TB NVMe + 1 TB NVMe (local backup) | -- |
| Network | 2.5 GbE (built-in) | -- |
| Configured | 64GB/1TB from Minisforum store | ~$600 |
| Runtime | docker-compose.prod.yml | -- |
All services on one box -- PostgreSQL, ClickHouse, Redpanda, MinIO, API, ingestion, frontend, Envoy. ClickHouse steady-state storage ~30 GB. No redundancy -- if the box fails, restore from the second NVMe or off-site backup.
| Node Layout | Services |
|---|---|
| Single node | All services (Docker Compose) |
Tradeoff: No HA. Suitable for organizations that can tolerate a few hours of downtime during hardware failure.
Tier 2 -- 1,000 to 5,000 Endpoints
Single high-spec mini PC, Docker Compose, no Kubernetes.
| Component | Spec | Verified Price |
|---|---|---|
| Device | Minisforum MS-A2 (Ryzen 9 9955HX, 16c/32t) | -- |
| RAM | 96 GB DDR5 (2x48GB) | -- |
| Storage | 2 TB NVMe + 2 TB NVMe (local backup) | -- |
| Network | Dual 10G SFP+ + 2x 2.5G RJ45 (built-in) | -- |
| Configured | 96GB/2TB from Minisforum store / Newegg | ~$1,295 |
| Runtime | docker-compose.prod.yml | -- |
Same single-node Docker Compose stack. 16 cores and 96 GB give plenty of headroom -- ClickHouse ~32 GB, PostgreSQL ~8 GB, Redpanda ~8 GB. ClickHouse steady-state storage ~150 GB. At 5,000 endpoints you generate ~200 events/second peak.
| Node Layout | Services |
|---|---|
| Single node | All services (Docker Compose) |
Tradeoff: Single point of failure. For clients requiring HA at this scale, use Tier 3.
Tier 3 -- 5,000 to 10,000 Endpoints
3-node k3s cluster with HA.
| Component | Per Node | Kit Total | Verified Price |
|---|---|---|---|
| Device | Minisforum MS-A2 (16c/32t) | 3x MS-A2 | 3 x $1,295 = $3,885 |
| RAM | 96 GB DDR5 | 288 GB | (included) |
| Storage | 2 TB NVMe | 6 TB | (included) |
| Switch | MikroTik CRS305-1G-4S+IN (4x 10G SFP+) | 1x | ~$130 |
| Cables | 10G SFP+ DAC 1m (10Gtek 4-pack, Amazon) | 1x 4-pack | ~$30 |
| Kit Total | ~$4,050 |
ClickHouse steady-state storage ~300 GB. Longhorn replicates critical volumes. If any node fails, the cluster continues serving (degraded).
| Node | Role | Workloads |
|---|---|---|
| Node 1 | k3s control plane + data | PostgreSQL, ClickHouse primary, API (2 pods) |
| Node 2 | k3s worker + data | Redpanda, MinIO, ingestion (3 pods), API (2 pods) |
| Node 3 | k3s worker + frontend | Frontend (2 pods), ingestion (2 pods), API (2 pods) |
Tier 4 -- 10,000 to 25,000 Endpoints
5-node k3s cluster with dedicated database nodes.
| Component | Per Node | Kit Total | Verified Price |
|---|---|---|---|
| Device | Minisforum MS-A2 (16c/32t) | 5x MS-A2 | 5 x $1,295 = $6,475 |
| RAM | 96 GB DDR5 | 480 GB | (included) |
| Storage | 2 TB NVMe | 10 TB | (included) |
| Switch | MikroTik CRS310-8G+2S+IN (8x2.5G + 2x10G SFP+) | 1x | ~$175 |
| Cables | 10G SFP+ DAC 1m (10Gtek) | 6x individual | ~$50 |
| Kit Total | ~$6,700 |
ClickHouse steady-state storage ~750 GB. Dedicating Node 4 to ClickHouse eliminates CPU/memory contention between analytics queries and event ingestion.
| Node | Role | Workloads |
|---|---|---|
| Node 1 | k3s control plane | API (3 pods), frontend (2 pods), Envoy |
| Node 2 | k3s worker -- compute | API (3 pods), ingestion (4 pods) |
| Node 3 | k3s worker -- compute | API (3 pods), ingestion (4 pods) |
| Node 4 | Dedicated -- ClickHouse | ClickHouse only (64 GB RAM allocated) |
| Node 5 | Dedicated -- PostgreSQL + Redpanda | PostgreSQL + Redpanda (low contention) |
Tier 5 -- 25,000 to 60,000 Endpoints
At this scale companies generally have existing infrastructure or cloud environments. If not, this is the minimum hardware needed to support 25k--60k endpoints with good performance and reliability.
5-node high-performance cluster with ECC memory and 25G fabric.
| Component | Per Node | Kit Total | Verified Price |
|---|---|---|---|
| Device | Minisforum MS-02 Ultra (Core Ultra 9 285HX, 24c) | 5x MS-02 Ultra | 5 x |
| RAM | 192 GB DDR5 ECC | 960 GB | (included) |
| Storage | 4 TB NVMe | 20 TB | (included) |
| Switch | MikroTik CRS504-4XQ-IN (4x QSFP28, breakout to 25G) | 1x | ~$700 |
| Cables | QSFP28-to-4xSFP28 breakout cables + 25G SFP28 DAC | -- | ~$150 |
| Kit Total | ~$15,350 |
At 60k endpoints you sustain ~2,000--3,000 events/second with bursts to 5,000+. 25 GbE fabric and ECC memory are required at this scale. ClickHouse steady-state storage ~1.8 TB.
| Node | Role | Workloads |
|---|---|---|
| Node 1 | k3s control plane | API (5 pods), frontend (2 pods), Envoy |
| Node 2 | k3s worker -- compute | API (5 pods), ingestion (5 pods) |
| Node 3 | k3s worker -- compute | API (5 pods), ingestion (5 pods) |
| Node 4 | Dedicated -- ClickHouse | ClickHouse only (128 GB RAM, ~1.8 TB data) |
| Node 5 | Dedicated -- PostgreSQL + Redpanda | PostgreSQL (64 GB), Redpanda (64 GB) |
Alternative (enterprise-grade with vendor support):
| Component | Per Node | Kit Total | Verified Price |
|---|---|---|---|
| Device | HPE ProLiant MicroServer Gen11 (Xeon E-2434, 4c/8t) | 7x MicroServer | 7 x |
| RAM | Up to 128 GB DDR5 ECC UDIMM | 896 GB | (configured) |
| Storage | M.2 NVMe + 4x LFF SATA bays per node | 28+ TB | -- |
| Network | 4x 1 GbE + PCIe 10G NIC add-in (~$150 each) | 10G inter-node | ~$1,050 |
| Management | HPE iLO 6, TPM 2.0 | Headless ops | -- |
| Kit Total | ~$15,000--$18,000 |
Choose HPE for vendor support contracts, iLO remote management, or TPM-based secrets encryption. Same logical layout but spread across 7 nodes for lower per-node load.
Summary
| Tier | Endpoints | Device | Nodes | Runtime | Network | Verified Kit Cost |
|---|---|---|---|---|---|---|
| 1 | Up to 1k | UM790 Pro (64 GB) | 1 | Docker Compose | 2.5 GbE | ~$600 |
| 2 | 1k--5k | MS-A2 (96 GB) | 1 | Docker Compose | 10G SFP+ | ~$1,295 |
| 3 | 5k--10k | MS-A2 (96 GB) x 3 | 3 | k3s + Helm | 10G SFP+ | ~$4,050 |
| 4 | 10k--25k | MS-A2 (96 GB) x 5 | 5 | k3s + Helm | 10G SFP+ | ~$6,700 |
| 5 | 25k--60k | MS-02 Ultra (192 GB ECC) x 5 | 5 | k3s + Helm | 25 GbE | ~$15,350 |
| 5-alt | 25k--60k | HPE MicroServer Gen11 x 7 | 7 | k3s + Helm | 10G (add-in) | ~$15k--$18k |
Price Sources
| Item | Source | Verified Price |
|---|---|---|
| Minisforum UM790 Pro (64GB/1TB) | Minisforum Store | ~$600 configured |
| Minisforum MS-A2 (96GB/2TB) | Minisforum Store, Newegg | $1,295 |
| Minisforum MS-02 Ultra (192GB ECC) | Minisforum Store, Amazon | $2,860--$2,999 |
| MikroTik CRS305-1G-4S+IN | MikroTik, Amazon | $120--$150 |
| MikroTik CRS310-8G+2S+IN | MikroTik, Amazon | $150--$200 |
| MikroTik CRS504-4XQ-IN | MikroTik, B&H | $600--$750 |
| HPE MicroServer Gen11 (E-2434) | HPE Store, Amazon | ~$1,639 base |
| 10G SFP+ DAC 1m 4-pack | Amazon (10Gtek) | $25--$40 |
| 25G SFP28 DAC 1m | FS.com, Amazon (10Gtek) | $14--$25 each |
See Cloud Deployment -- AWS/Azure for cloud-hosted alternatives.
Software Requirements
- Docker 25+ with Docker Compose v2
- Kubernetes 1.27+ (for production clusters)
- Node.js 22+ (for frontend build)
- Go 1.25+ (for backend build)