c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

public-access-proxy: bump nfconntrack table size, loda module even earlier

This commit is contained in:
Sandro - 2024-03-14 19:02:43 +01:00
parent 5560deef4c
commit 626f7a1d38
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/public-access-proxy/default.nix
View File

@ -6,6 +6,12 @@
./stats.nix
];
boot.kernel.sysctl = {
# table overflow causing packets from nginx to the service to drop
# nf_conntrack: nf_conntrack: table full, dropping packet
"net.netfilter.nf_conntrack_max" = toString (4096*32);
};
c3d2.deployment.server = "server10";
networking.hostName = "public-access-proxy";

10
modules/microvm-defaults.nix
View File

@ -9,6 +9,10 @@
boot = {
loader.grub.enable = false;
initrd.kernelModules = [
# required for net.netfilter.nf_conntrack_max appearing in sysfs early at boot
"nf_conntrack"
];
kernel.sysctl =
let
mem = if (config?microvm) then config.microvm.mem else config.deployment.mem;
@ -16,12 +20,8 @@
lib.optionalAttrs (mem <= 2*1024) {
# table overflow causing packets from nginx to the service to drop
# nf_conntrack: nf_conntrack: table full, dropping packet
"net.netfilter.nf_conntrack_max" = "65536";
"net.netfilter.nf_conntrack_max" = lib.mkDefault "65536";
};
kernelModules = [
# required for net.netfilter.nf_conntrack_max appearing in sysfs early at boot
"nf_conntrack"
];
kernelParams = [
"preempt=none"
# No server/router runs any untrusted user code