From dd2b551bde5944d98cf4e22cb9a8e192750c484d Mon Sep 17 00:00:00 2001 From: xmm16 Date: Thu, 12 Dec 2024 14:30:03 -0300 Subject: [PATCH] sysctl nightmare --- hosts/micronix/config/performance.conf | 34 -------------- hosts/micronix/config/sysctl.d/hardening.nix | 45 +++++++++++++++++++ .../micronix/config/sysctl.d/performance.nix | 38 ++++++++++++++++ hosts/micronix/system.nix | 7 ++- 4 files changed, 88 insertions(+), 36 deletions(-) delete mode 100644 hosts/micronix/config/performance.conf create mode 100644 hosts/micronix/config/sysctl.d/hardening.nix create mode 100644 hosts/micronix/config/sysctl.d/performance.nix diff --git a/hosts/micronix/config/performance.conf b/hosts/micronix/config/performance.conf deleted file mode 100644 index f98763a..0000000 --- a/hosts/micronix/config/performance.conf +++ /dev/null @@ -1,34 +0,0 @@ -"vm.dirty_ratio = 20" -"vm.dirty_background_ratio = 10" -"vm.vfs_cache_pressure = 50" -"net.core.default_qdisc = cake" -"net.ipv4.tcp_congestion_control = bbr" -"vm.page-cluster = 1" -"kernel.nmi_watchdog = 0" -"vm.swappiness = 200" -"vm.max_map_count = 2147483642" -"vm.watermark_boost_factor = 1" -"vm.watermark_scale_factor = 1000" -"vm.nr_hugepages = 512" -"hugetlb_optimize_vmemmap = 1" -"net.core.netdev_max_backlog = 32768" -"net.core.somaxconn = 16384" -"net.core.rmem_default = 1048576" -"net.core.rmem_max = 16777216" -"net.core.wmem_default = 1048576" -"net.core.wmem_max = 16777216" -"net.core.optmem_max = 65536" -"net.ipv4.tcp_rmem = '4096 1048576 2097152'" -"net.ipv4.tcp_wmem = '4096 65536 16777216'" -"net.ipv4.udp_rmem_min = 16384" -"net.ipv4.udp_wmem_min = 16384" -"net.ipv4.tcp_fastopen = 3" -"net.ipv4.tcp_max_syn_backlog = 32768" -"net.ipv4.tcp_max_tw_buckets = 2000000" -"net.ipv4.tcp_fin_timeout = 10" -"net.ipv4.tcp_slow_start_after_idle = 0" -"net.ipv4.tcp_keepalive_time = 60" -"net.ipv4.tcp_keepalive_intvl = 10" -"net.ipv4.tcp_keepalive_probes = 6" -"net.ipv4.tcp_mtu_probing = 1" -"net.ipv4.ip_local_port_range = '30000 65535'" diff --git a/hosts/micronix/config/sysctl.d/hardening.nix b/hosts/micronix/config/sysctl.d/hardening.nix new file mode 100644 index 0000000..1c412f4 --- /dev/null +++ b/hosts/micronix/config/sysctl.d/hardening.nix @@ -0,0 +1,45 @@ +{...}: { + boot.kernel.sysctl = { + "dev.tty.ldisc_autoload" = "0"; + "fs.protected_fifos" = "2"; + "fs.protected_hardlinks" = "1"; + "fs.protected_regular" = "2"; + "fs.protected_symlinks" = "1"; + "kernel.dmesg_restrict" = "1"; + "kernel.kexec_load_disabled" = "1"; + "kernel.kptr_restrict" = "2"; + "kernel.perf_event_paranoid" = "-1"; + "kernel.printk" = "3 3 3 3"; + "kernel.sysrq" = "4"; + "kernel.unprivileged_bpf_disabled" = "1"; + "kernel.yama.ptrace_scope " = " 0"; + "net.core.bpf_jit_harden" = "2"; + "net.ipv4.conf.all.accept_redirects" = "0"; + "net.ipv4.conf.all.accept_source_route" = "0"; + "net.ipv4.conf.all.rp_filter" = "1"; + "net.ipv4.conf.all.secure_redirects" = "0"; + "net.ipv4.conf.all.send_redirects" = "0"; + "net.ipv4.conf.default.accept_redirects" = "0"; + "net.ipv4.conf.default.accept_source_route" = "0"; + "net.ipv4.conf.default.rp_filter" = "1"; + "net.ipv4.conf.default.secure_redirects" = "0"; + "net.ipv4.conf.default.send_redirects" = "0"; + "net.ipv4.icmp_echo_ignore_all" = "1"; + "net.ipv4.tcp_dsack" = "0"; + "net.ipv4.tcp_fack" = "0"; + "net.ipv4.tcp_rfc1337" = "1"; + "net.ipv4.tcp_sack" = "0"; + "net.ipv4.tcp_syncookies" = "1"; + "net.ipv4.tcp_timestamps" = "0"; + "net.ipv6.conf.all.accept_ra" = "0"; + "net.ipv6.conf.all.accept_redirects" = "0"; + "net.ipv6.conf.all.accept_source_route" = "0"; + "net.ipv6.conf.all.use_tempaddr" = "2"; + "net.ipv6.conf.default.accept_ra" = "0"; + "net.ipv6.conf.default.accept_redirects" = "0"; + "net.ipv6.conf.default.accept_source_route" = "0"; + "vm.mmap_rnd_bits" = "32"; + "vm.mmap_rnd_compat_bits" = "16"; + "vm.unprivileged_userfaultfd" = "0"; + }; +} diff --git a/hosts/micronix/config/sysctl.d/performance.nix b/hosts/micronix/config/sysctl.d/performance.nix new file mode 100644 index 0000000..7cb71c4 --- /dev/null +++ b/hosts/micronix/config/sysctl.d/performance.nix @@ -0,0 +1,38 @@ +{...}: { + boot.kernel.sysctl = { + "vm.dirty_ratio" = 20; + "vm.dirty_background_ratio" = 10; + "vm.vfs_cache_pressure" = 25; + "net.core.default_qdisc" = "cake"; + "net.ipv4.tcp_congestion_control" = "bbr"; + "vm.page-cluster" = 1; + "kernel.nmi_watchdog" = 0; + "vm.swappiness" = 200; + "vm.max_map_count" = 2147483642; + "vm.watermark_boost_factor" = 1; + "vm.watermark_scale_factor" = 1000; + "vm.nr_hugepages" = 512; + "vm.hugetlb_optimize_vmemmap" = 1; + "net.core.netdev_max_backlog" = 32768; + "net.core.somaxconn" = 16384; + "net.core.rmem_default" = 1048576; + "net.core.rmem_max" = 16777216; + "net.core.wmem_default" = 1048576; + "net.core.wmem_max" = 16777216; + "net.core.optmem_max" = 65536; + "net.ipv4.tcp_rmem" = "4096 1048576 2097152"; + "net.ipv4.tcp_wmem" = "4096 65536 16777216"; + "net.ipv4.udp_rmem_min" = 16384; + "net.ipv4.udp_wmem_min" = 16384; + "net.ipv4.tcp_fastopen" = 3; + "net.ipv4.tcp_max_syn_backlog" = 32768; + "net.ipv4.tcp_max_tw_buckets" = 2000000; + "net.ipv4.tcp_fin_timeout" = 10; + "net.ipv4.tcp_slow_start_after_idle" = 0; + "net.ipv4.tcp_keepalive_time" = 60; + "net.ipv4.tcp_keepalive_intvl" = 10; + "net.ipv4.tcp_keepalive_probes" = 6; + "net.ipv4.tcp_mtu_probing" = 1; + "net.ipv4.ip_local_port_range" = "30000 65535"; + }; +} diff --git a/hosts/micronix/system.nix b/hosts/micronix/system.nix index f2ecb55..ff53a03 100644 --- a/hosts/micronix/system.nix +++ b/hosts/micronix/system.nix @@ -2,6 +2,11 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). {pkgs, ...}: { + imports = [ + ./config/sysctl.d/performance.nix + ./config/sysctl.d/hardening.nix + ]; + boot.initrd.systemd = { enable = true; tpm2 = {enable = true;}; @@ -15,8 +20,6 @@ "hugepagesz=1G" ]; - boot.kernel.sysctl = [(builtins.readFile ./config/sysctl.d/performance.conf)]; - services.scx = { enable = true; scheduler = "scx_lavd";