c3d2/nix-config
c3d2
/
nix-config
23
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

Fix conntrack issues in microvm 

due to bad scaling with lower RAM
This commit is contained in:
Sandro - 2023-01-05 22:13:59 +01:00
parent fc105bb0d9
commit ca6fe29106
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
2 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/hedgedoc/default.nix
View File

@ -5,12 +5,6 @@
microvm.mem = 1024; microvm.mem = 1024;
boot.kernel.sysctl = {
# table overflow causing packets from nginx to hedgedoc to drop
# nf_conntrack: nf_conntrack: table full, dropping packet
"net.netfilter.nf_conntrack_max" = "65536";
};
networking.hostName = "hedgedoc"; networking.hostName = "hedgedoc";
services = { services = {

22
modules/microvm.nix
View File

@ -72,11 +72,18 @@ in
# autoupdates do not make sense inside MicroVMs with read-only /nix/store # autoupdates do not make sense inside MicroVMs with read-only /nix/store
c3d2.autoUpdate = false; c3d2.autoUpdate = false;
boot.kernelParams = [ boot = {
"preempt=none" kernel.sysctl = lib.optionalAttrs (config.microvm.mem <= 1024) {
# No server/router runs any untrusted user code # table overflow causing packets from nginx to the service to drop
"mitigations=off" # nf_conntrack: nf_conntrack: table full, dropping packet
]; "net.netfilter.nf_conntrack_max" = "65536";
};
kernelParams = [
"preempt=none"
# No server/router runs any untrusted user code
"mitigations=off"
];
};
hardware.enableRedistributableFirmware = false; hardware.enableRedistributableFirmware = false;
@ -114,7 +121,10 @@ in
}) config.c3d2.deployment.mounts; }) config.c3d2.deployment.mounts;
}; };
networking = lib.mkIf config.c3d2.deployment.autoNetSetup { networking = {
# required that sysctl contains net.netfilter.nf_conntrack_max on boot
firewall.autoLoadConntrackHelpers = true;
} // lib.optionalAttrs config.c3d2.deployment.autoNetSetup {
useDHCP = false; useDHCP = false;
dhcpcd.enable = false; dhcpcd.enable = false;
useNetworkd = true; useNetworkd = true;