49 lines
1.3 KiB
Nix
49 lines
1.3 KiB
Nix
# No MicroVM settings but some defaults that enable evaulating NixOS
|
|
# configurations that are destined to be used on Skyflake
|
|
|
|
{ config, lib, ... }:
|
|
|
|
{
|
|
# autoupdates do not make sense inside MicroVMs with read-only /nix/store
|
|
c3d2.autoUpdate = false;
|
|
|
|
boot = {
|
|
loader.grub.enable = false;
|
|
kernel.sysctl = lib.optionalAttrs (config.microvm.mem <= 1024) {
|
|
# table overflow causing packets from nginx to the service to drop
|
|
# nf_conntrack: nf_conntrack: table full, dropping packet
|
|
"net.netfilter.nf_conntrack_max" = "65536";
|
|
};
|
|
kernelParams = [
|
|
"preempt=none"
|
|
# No server/router runs any untrusted user code
|
|
"mitigations=off"
|
|
];
|
|
};
|
|
|
|
fileSystems."/" = lib.mkDefault {
|
|
fsType = "tmpfs";
|
|
};
|
|
|
|
hardware.enableRedistributableFirmware = false;
|
|
|
|
# required that sysctl contains net.netfilter.nf_conntrack_max on boot
|
|
networking.firewall.autoLoadConntrackHelpers = true;
|
|
|
|
# nix store is mounted read only
|
|
nix.gc.automatic = false;
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /home/root 0700 root root -" # createHome does not create it
|
|
];
|
|
|
|
users = {
|
|
mutableUsers = false;
|
|
# store root users files persistent, especially .bash_history
|
|
users."root" = {
|
|
createHome = true;
|
|
home = lib.mkForce "/home/root";
|
|
};
|
|
};
|
|
}
|