pyrox.dev
1{ config, lib, ... }:
2
3with lib;
4
5let
6
7 sysctlOption = mkOptionType {
8 name = "sysctl option value";
9 check = val:
10 let
11 checkType = x: isBool x || isString x || isInt x || x == null;
12 in
13 checkType val || (val._type or "" == "override" && checkType val.content);
14 merge = loc: defs: mergeOneOption loc (filterOverrides defs);
15 };
16
17in
18
19{
20
21 options = {
22
23 boot.kernel.sysctl = mkOption {
24 type = let
25 highestValueType = types.ints.unsigned // {
26 merge = loc: defs:
27 foldl
28 (a: b: if b.value == null then null else lib.max a b.value)
29 0
30 (filterOverrides defs);
31 };
32 in types.submodule {
33 freeformType = types.attrsOf sysctlOption;
34 options = {
35 "net.core.rmem_max" = mkOption {
36 type = types.nullOr highestValueType;
37 default = null;
38 description = "The maximum receive socket buffer size in bytes. In case of conflicting values, the highest will be used.";
39 };
40
41 "net.core.wmem_max" = mkOption {
42 type = types.nullOr highestValueType;
43 default = null;
44 description = "The maximum send socket buffer size in bytes. In case of conflicting values, the highest will be used.";
45 };
46 };
47 };
48 default = {};
49 example = literalExpression ''
50 { "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
51 '';
52 description = ''
53 Runtime parameters of the Linux kernel, as set by
54 {manpage}`sysctl(8)`. Note that sysctl
55 parameters names must be enclosed in quotes
56 (e.g. `"vm.swappiness"` instead of
57 `vm.swappiness`). The value of each
58 parameter may be a string, integer, boolean, or null
59 (signifying the option will not appear at all).
60 '';
61
62 };
63
64 };
65
66 config = {
67
68 environment.etc."sysctl.d/60-nixos.conf".text =
69 concatStrings (mapAttrsToList (n: v:
70 optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
71 ) config.boot.kernel.sysctl);
72
73 systemd.services.systemd-sysctl =
74 { wantedBy = [ "multi-user.target" ];
75 restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
76 };
77
78 # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
79 # users as these make it easier to exploit kernel vulnerabilities.
80 boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
81
82 # Improve compatibility with applications that allocate
83 # a lot of memory, like modern games
84 boot.kernel.sysctl."vm.max_map_count" = mkDefault 1048576;
85 };
86}