pyrox.dev
1{ config, lib, ... }:
2
3with lib;
4
5let
6
7 sysctlOption = mkOptionType {
8 name = "sysctl option value";
9 check = val:
10 let
11 checkType = x: isBool x || isString x || isInt x || x == null;
12 in
13 checkType val || (val._type or "" == "override" && checkType val.content);
14 merge = loc: defs: mergeOneOption loc (filterOverrides defs);
15 };
16
17in
18
19{
20
21 options = {
22
23 boot.kernel.sysctl = mkOption {
24 type = types.submodule {
25 freeformType = types.attrsOf sysctlOption;
26 options."net.core.rmem_max" = mkOption {
27 type = types.nullOr types.ints.unsigned // {
28 merge = loc: defs:
29 foldl
30 (a: b: if b.value == null then null else lib.max a b.value)
31 0
32 (filterOverrides defs);
33 };
34 default = null;
35 description = lib.mdDoc "The maximum socket receive buffer size. In case of conflicting values, the highest will be used.";
36 };
37 };
38 default = {};
39 example = literalExpression ''
40 { "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
41 '';
42 description = lib.mdDoc ''
43 Runtime parameters of the Linux kernel, as set by
44 {manpage}`sysctl(8)`. Note that sysctl
45 parameters names must be enclosed in quotes
46 (e.g. `"vm.swappiness"` instead of
47 `vm.swappiness`). The value of each
48 parameter may be a string, integer, boolean, or null
49 (signifying the option will not appear at all).
50 '';
51
52 };
53
54 };
55
56 config = {
57
58 environment.etc."sysctl.d/60-nixos.conf".text =
59 concatStrings (mapAttrsToList (n: v:
60 optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
61 ) config.boot.kernel.sysctl);
62
63 systemd.services.systemd-sysctl =
64 { wantedBy = [ "multi-user.target" ];
65 restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
66 };
67
68 # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
69 # users as these make it easier to exploit kernel vulnerabilities.
70 boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
71
72 # Disable YAMA by default to allow easy debugging.
73 boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
74
75 };
76}