docs: warn operators about the traps that stop Mysterium and proxied copies from earning

docs/faq.md

@@ -38,10 +38,22 @@ If CashPilot cannot write the key to disk at all, because `/data` is unwritable
 
 **What about security?**
 
-Every service CashPilot deploys runs in its own container with every Linux capability dropped (a few services add back only the ones they declare) and `--security-opt no-new-privileges` set, so a process inside cannot gain privileges. Containers cannot see your host filesystem beyond the volumes a service declares. On a new install the worker also fences them off your LAN, the host, your tailnet and cloud metadata, so they reach the internet and nothing local ([LAN isolation](isolation.md)). On Podman the fence is not available: earners run on Podman's default network, which can reach your LAN, and the Fleet page says so ([LAN isolation](isolation.md) lists the options). An install upgraded from a release before 1.70 keeps its earners on Docker's default bridge, which can reach your LAN, until you click **Turn on isolation** on the Fleet page. The fence does not cover a service on host networking (Mysterium, today); [the isolation page](isolation.md) says what to do about those, and [Protecting Your Home Network](home-network-security.md) covers firewalling your own bridge instead. Service credentials are encrypted at rest using Fernet symmetric encryption. The UI has no Docker access. With the shipped compose files the worker is never given the raw Docker socket: it reaches Docker through `cashpilot-socket-proxy`, which refuses privileged containers and binds of `/` or the socket (unless you put one of them, or a folder above the socket, in `CASHPILOT_PROXY_BIND_MOUNTS` or `CASHPILOT_COMPOSE_DIR`: the proxy takes those as given), and limits the worker to containers, volumes and networks with its owner label ([security defaults](security-defaults.md)). The Unraid templates and the TrueNAS app still mount the raw socket in the worker, which is root on the host ([app stores](app-stores.md)).
+Every service CashPilot deploys runs in its own container with every Linux capability dropped (a few services add back only the ones they declare) and `--security-opt no-new-privileges` set, so a process inside cannot gain privileges. Containers cannot see your host filesystem beyond the volumes a service declares. On a new install the worker also fences them off your LAN, the host, your tailnet and cloud metadata, so they reach the internet and nothing local ([LAN isolation](isolation.md)). On Podman the fence is not available: earners run on Podman's default network, which can reach your LAN, and the Fleet page says so ([LAN isolation](isolation.md) lists the options). An install upgraded from a release before 1.70 keeps its earners on Docker's default bridge, which can reach your LAN, until you click **Turn on isolation** on the Fleet page. Since 2.0.7 Mysterium runs behind the fence too; a node deployed through 2.0.6 stays on the host's network until you redeploy it ([Moving your Mysterium node behind the fence](mysterium-fence.md)). [Protecting Your Home Network](home-network-security.md) covers firewalling your own bridge instead. Service credentials are encrypted at rest using Fernet symmetric encryption. The UI has no Docker access. With the shipped compose files the worker is never given the raw Docker socket: it reaches Docker through `cashpilot-socket-proxy`, which refuses privileged containers and binds of `/` or the socket (unless you put one of them, or a folder above the socket, in `CASHPILOT_PROXY_BIND_MOUNTS` or `CASHPILOT_COMPOSE_DIR`: the proxy takes those as given), and limits the worker to containers, volumes and networks with its owner label ([security defaults](security-defaults.md)). The Unraid templates and the TrueNAS app still mount the raw socket in the worker, which is root on the host ([app stores](app-stores.md)).
 
 That said, no setup is bulletproof. You are still running third-party software that routes external traffic through your network. Docker isolation significantly reduces the attack surface compared to running these services directly on your host, but it does not eliminate all risk. We recommend running CashPilot on a dedicated machine or VLAN, keeping Docker and your host OS up to date, and reviewing the open-source code of any service before deploying it.
 
 **What happens if a service container crashes?**
 
 CashPilot monitors container health continuously. If a service container exits unexpectedly, it is automatically restarted. The dashboard shows uptime and health status for every running service.
+
+**My Mysterium node will not start after a redeploy. Why?**
+
+The most common cause is a port in its UDP range that another program on the host already holds. Docker must reserve every port in the range, so one busy port stops the start. [Choosing the UDP port range](mysterium-fence.md#choosing-the-udp-port-range) explains how to pick a range that stays free.
+
+**My proxied copy is running but earns nothing. Why?**
+
+The proxy may refuse to connect to that earner's servers, or allow only ports 80 and 443. CashPilot's **Test** checks only that the proxy reaches the internet. [Probe an earner's servers through the proxy](proxies.md#probe-an-earners-servers-through-the-proxy) shows how to check the earner's own host and port.
+
+**Which services are heavy, and where should they run?**
+
+Storage nodes, relays and VPN exits, and GPU work use the most. [Budgeting a small box](fleet.md#budgeting-a-small-box) lists them and shows how to measure each container before you decide.

docs/fleet.md

@@ -196,6 +196,45 @@ The **Fleet** page lists every box:
 
 Starting, stopping, restarting and viewing logs happen on the **Dashboard**. There, a service running on several workers shows an expandable row with one sub-row per instance; the main row shows the average CPU and memory (prefixed with `~`), and each sub-row its own figures and buttons.
 
+## Budgeting a small box
+
+Earners differ a lot in what they use. Measure before you decide what runs
+where, rather than spreading every service over every box.
+
+**The usual heavy ones.** The catalog's memory caps (`docker.resources.mem_limit`
+in each `services/*/*.yml`) are limits, not usage, but they show the spread:
+
+| Kind | Examples | What it costs |
+|---|---|---|
+| Storage nodes | Sia (hostd), Storj | The highest memory caps (4 GB and 2 GB), steady disk I/O, a large data disk |
+| Relays and VPN exits | Anyone Protocol, Mysterium | Memory caps of 1.5 GB and 768 MB, CPU that rises with traffic. Mysterium's published UDP ports also run `docker-proxy` processes outside its container ([what each port costs](mysterium-fence.md#what-each-port-costs)) |
+| GPU compute | Salad, Vast.ai, io.net | The whole GPU, plus CPU and memory while a job runs |
+| Most bandwidth earners | Honeygain, EarnApp, Traffmonetizer, Repocket | Memory caps of 128 to 256 MB |
+
+A [proxied copy](proxies.md) adds a tunnel container next to each earner.
+
+**Measure on the box.** The **Dashboard** shows each container's CPU and
+memory, refreshed every few minutes, for the services it reports; earners
+you started outside CashPilot may not show there. For a snapshot of everything
+at once:
+
+```bash
+docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}'
+```
+
+It lists every running container, including earners you started outside
+CashPilot. CPU is per core: `100%` is one full core. Take a few snapshots at different
+times of day, since bandwidth earners and exits are busiest when someone is
+buying traffic. `docker stats` counts only what runs inside containers, so
+also look at the host as a whole (`free -m`, `uptime`) and at the CashPilot UI
+and worker themselves ([Memory](configuration.md#memory)).
+
+**Then decide.** Put storage nodes and GPU work on the machine with the disk
+or the card. Keep a small box to the light earners. When what you want from a
+small box at another site is its IP rather than its hardware, make it an exit
+node instead of a worker
+([A second site as an exit node](proxies.md#a-second-site-as-an-exit-node-instead-of-a-worker)).
+
 ## Cross-Subnet Workers
 
 If the worker and UI are on different subnets (e.g., connected via Tailscale):

docs/guides/mysterium.md

@@ -80,6 +80,13 @@ range. Create one rule on your router:
 | Internal ports | the same, 23000-23029 |
 | Internal IP | the LAN address of the machine running the node |
 
+Before you pick a range, read
+[Choosing the UDP port range](../mysterium-fence.md#choosing-the-udp-port-range):
+one port in it held by another program stops the node from starting, and a
+range inside Linux's ephemeral port range can be taken at random. Moving a
+node deployed through 2.0.6? Follow
+[Moving your Mysterium node behind the fence](../mysterium-fence.md).
+
 Give that machine a fixed LAN address (a DHCP reservation), or the rule points
 at the wrong host after a lease change. UPnP does not work: the node sits behind
 the LAN fence, which drops the router, so it cannot ask the router for a