amadaluzia/alqueva
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sysctl nightmare

Browse source
This commit is contained in:
xmm16 2024-12-12 14:30:03 -03:00
commit dd2b551bde
No known key found for this signature in database
4 changed files with 88 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

34
hosts/micronix/config/performance.conf
View file

@ -1,34 +0,0 @@
"vm.dirty_ratio = 20"
"vm.dirty_background_ratio = 10"
"vm.vfs_cache_pressure = 50"
"net.core.default_qdisc = cake"
"net.ipv4.tcp_congestion_control = bbr"
"vm.page-cluster = 1"
"kernel.nmi_watchdog = 0"
"vm.swappiness = 200"
"vm.max_map_count = 2147483642"
"vm.watermark_boost_factor = 1"
"vm.watermark_scale_factor = 1000"
"vm.nr_hugepages = 512"
"hugetlb_optimize_vmemmap = 1"
"net.core.netdev_max_backlog = 32768"
"net.core.somaxconn = 16384"
"net.core.rmem_default = 1048576"
"net.core.rmem_max = 16777216"
"net.core.wmem_default = 1048576"
"net.core.wmem_max = 16777216"
"net.core.optmem_max = 65536"
"net.ipv4.tcp_rmem = '4096 1048576 2097152'"
"net.ipv4.tcp_wmem = '4096 65536 16777216'"
"net.ipv4.udp_rmem_min = 16384"
"net.ipv4.udp_wmem_min = 16384"
"net.ipv4.tcp_fastopen = 3"
"net.ipv4.tcp_max_syn_backlog = 32768"
"net.ipv4.tcp_max_tw_buckets = 2000000"
"net.ipv4.tcp_fin_timeout = 10"
"net.ipv4.tcp_slow_start_after_idle = 0"
"net.ipv4.tcp_keepalive_time = 60"
"net.ipv4.tcp_keepalive_intvl = 10"
"net.ipv4.tcp_keepalive_probes = 6"
"net.ipv4.tcp_mtu_probing = 1"
"net.ipv4.ip_local_port_range = '30000 65535'"

45
hosts/micronix/config/sysctl.d/hardening.nix Normal file
View file

@ -0,0 +1,45 @@
{...}: {
boot.kernel.sysctl = {
"dev.tty.ldisc_autoload" = "0";
"fs.protected_fifos" = "2";
"fs.protected_hardlinks" = "1";
"fs.protected_regular" = "2";
"fs.protected_symlinks" = "1";
"kernel.dmesg_restrict" = "1";
"kernel.kexec_load_disabled" = "1";
"kernel.kptr_restrict" = "2";
"kernel.perf_event_paranoid" = "-1";
"kernel.printk" = "3 3 3 3";
"kernel.sysrq" = "4";
"kernel.unprivileged_bpf_disabled" = "1";
"kernel.yama.ptrace_scope " = " 0";
"net.core.bpf_jit_harden" = "2";
"net.ipv4.conf.all.accept_redirects" = "0";
"net.ipv4.conf.all.accept_source_route" = "0";
"net.ipv4.conf.all.rp_filter" = "1";
"net.ipv4.conf.all.secure_redirects" = "0";
"net.ipv4.conf.all.send_redirects" = "0";
"net.ipv4.conf.default.accept_redirects" = "0";
"net.ipv4.conf.default.accept_source_route" = "0";
"net.ipv4.conf.default.rp_filter" = "1";
"net.ipv4.conf.default.secure_redirects" = "0";
"net.ipv4.conf.default.send_redirects" = "0";
"net.ipv4.icmp_echo_ignore_all" = "1";
"net.ipv4.tcp_dsack" = "0";
"net.ipv4.tcp_fack" = "0";
"net.ipv4.tcp_rfc1337" = "1";
"net.ipv4.tcp_sack" = "0";
"net.ipv4.tcp_syncookies" = "1";
"net.ipv4.tcp_timestamps" = "0";
"net.ipv6.conf.all.accept_ra" = "0";
"net.ipv6.conf.all.accept_redirects" = "0";
"net.ipv6.conf.all.accept_source_route" = "0";
"net.ipv6.conf.all.use_tempaddr" = "2";
"net.ipv6.conf.default.accept_ra" = "0";
"net.ipv6.conf.default.accept_redirects" = "0";
"net.ipv6.conf.default.accept_source_route" = "0";
"vm.mmap_rnd_bits" = "32";
"vm.mmap_rnd_compat_bits" = "16";
"vm.unprivileged_userfaultfd" = "0";
};
}

38
hosts/micronix/config/sysctl.d/performance.nix Normal file
View file

@ -0,0 +1,38 @@
{...}: {
boot.kernel.sysctl = {
"vm.dirty_ratio" = 20;
"vm.dirty_background_ratio" = 10;
"vm.vfs_cache_pressure" = 25;
"net.core.default_qdisc" = "cake";
"net.ipv4.tcp_congestion_control" = "bbr";
"vm.page-cluster" = 1;
"kernel.nmi_watchdog" = 0;
"vm.swappiness" = 200;
"vm.max_map_count" = 2147483642;
"vm.watermark_boost_factor" = 1;
"vm.watermark_scale_factor" = 1000;
"vm.nr_hugepages" = 512;
"vm.hugetlb_optimize_vmemmap" = 1;
"net.core.netdev_max_backlog" = 32768;
"net.core.somaxconn" = 16384;
"net.core.rmem_default" = 1048576;
"net.core.rmem_max" = 16777216;
"net.core.wmem_default" = 1048576;
"net.core.wmem_max" = 16777216;
"net.core.optmem_max" = 65536;
"net.ipv4.tcp_rmem" = "4096 1048576 2097152";
"net.ipv4.tcp_wmem" = "4096 65536 16777216";
"net.ipv4.udp_rmem_min" = 16384;
"net.ipv4.udp_wmem_min" = 16384;
"net.ipv4.tcp_fastopen" = 3;
"net.ipv4.tcp_max_syn_backlog" = 32768;
"net.ipv4.tcp_max_tw_buckets" = 2000000;
"net.ipv4.tcp_fin_timeout" = 10;
"net.ipv4.tcp_slow_start_after_idle" = 0;
"net.ipv4.tcp_keepalive_time" = 60;
"net.ipv4.tcp_keepalive_intvl" = 10;
"net.ipv4.tcp_keepalive_probes" = 6;
"net.ipv4.tcp_mtu_probing" = 1;
"net.ipv4.ip_local_port_range" = "30000 65535";
};
}