pyrox.dev
1{ config, lib, ... }:
2let
3
4 sysctlOption = lib.mkOptionType {
5 name = "sysctl option value";
6 check =
7 val:
8 let
9 checkType = x: lib.isBool x || lib.isString x || lib.isInt x || x == null;
10 in
11 checkType val || (val._type or "" == "override" && checkType val.content);
12 merge = loc: defs: lib.mergeOneOption loc defs;
13 };
14
15in
16
17{
18
19 options = {
20
21 boot.kernel.sysctl = lib.mkOption {
22 type =
23 let
24 highestValueType = lib.types.ints.unsigned // {
25 merge = loc: defs: lib.foldl (a: b: if b.value == null then null else lib.max a b.value) 0 defs;
26 };
27 in
28 lib.types.submodule {
29 freeformType = lib.types.attrsOf sysctlOption;
30 options = {
31 "net.core.rmem_max" = lib.mkOption {
32 type = lib.types.nullOr highestValueType;
33 default = null;
34 description = "The maximum receive socket buffer size in bytes. In case of conflicting values, the highest will be used.";
35 };
36
37 "net.core.wmem_max" = lib.mkOption {
38 type = lib.types.nullOr highestValueType;
39 default = null;
40 description = "The maximum send socket buffer size in bytes. In case of conflicting values, the highest will be used.";
41 };
42 };
43 };
44 default = { };
45 example = lib.literalExpression ''
46 { "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
47 '';
48 description = ''
49 Runtime parameters of the Linux kernel, as set by
50 {manpage}`sysctl(8)`. Note that sysctl
51 parameters names must be enclosed in quotes
52 (e.g. `"vm.swappiness"` instead of
53 `vm.swappiness`). The value of each
54 parameter may be a string, integer, boolean, or null
55 (signifying the option will not appear at all).
56 '';
57
58 };
59
60 };
61
62 config = {
63
64 environment.etc."sysctl.d/60-nixos.conf".text = lib.concatStrings (
65 lib.mapAttrsToList (
66 n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
67 ) config.boot.kernel.sysctl
68 );
69
70 systemd.services.systemd-sysctl = {
71 wantedBy = [ "multi-user.target" ];
72 restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
73 };
74
75 # NixOS wide defaults
76 boot.kernel.sysctl = {
77 # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
78 # users as these make it easier to exploit kernel vulnerabilities.
79 "kernel.kptr_restrict" = lib.mkDefault 1;
80
81 # Improve compatibility with applications that allocate
82 # a lot of memory, like modern games
83 "vm.max_map_count" = lib.mkDefault 1048576;
84
85 # The default max inotify watches is 8192.
86 # Nowadays most apps require a good number of inotify watches,
87 # the value below is used by default on several other distros.
88 "fs.inotify.max_user_instances" = lib.mkDefault 524288;
89 "fs.inotify.max_user_watches" = lib.mkDefault 524288;
90 };
91 };
92}