liminix

commit d538e8f6cf96dbe8d94e1ed0d4ef2da1767c6abb
parent 8646677eadf6879387482a2316b14b100829d0f9
Author: Daniel Barlow <dan@telent.net>
Date:   Tue, 11 Nov 2025 20:52:58 +0000

add options for setting sysctl parameters at boot time

Diffstat:
M
modules/base.nix
 | 
1
+
A
modules/early/default.nix
 | 
37
+++++++++++++++++++++++++++++++++++++
M
modules/s6/scripts/rc.init
 | 
2
++
M
pkgs/default.nix
 | 
12
++++++++++++

4 files changed, 52 insertions(+), 0 deletions(-)
diff --git a/modules/base.nix b/modules/base.nix
@@ -113,6 +113,7 @@ in
       };
     };
   };
+  imports = [ ./early ];
   config = {
     defaultProfile.packages = with pkgs; [
       s6
diff --git a/modules/early/default.nix b/modules/early/default.nix
@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  inherit (pkgs.pseudofile) dir symlink;
+in
+{
+  options = {
+    early = with types; {
+      sysctl = mkOption {
+        type = attrsOf anything;
+        description = "sysctl definitions to set at early boot";
+        example = {
+          vm.overcommit_memory = 0;
+          user.max_cgroup_namespaces = 62933;
+          net.ipv6.route.gc_timeout = 60;
+        };
+      };
+    };
+  };
+  config.filesystem = dir {
+    etc =
+      let
+        sysctls = pkgs.writeAshScript "sysctls" { } ''
+          cd /proc/sys
+          ${pkgs.liminix.writeSysctls config.early.sysctl}
+        '';
+      in
+      dir {
+        "sysctl.sh" = symlink sysctls;
+      };
+  };
+}
diff --git a/modules/s6/scripts/rc.init b/modules/s6/scripts/rc.init
@@ -27,6 +27,8 @@ if test -c /dev/pmsg0 ; then
     (cat /sys/fs/pstore/* && rm  /sys/fs/pstore/*) > /run/log/previous-boot
 fi
 
+/etc/sysctl.sh
+
 mkdir -m 0751 -p /run/services/outputs
 chgrp system /run/services/outputs
 
diff --git a/pkgs/default.nix b/pkgs/default.nix
@@ -22,6 +22,18 @@ in
       uimage = callPackage ./kernel/uimage.nix { };
       kernel = callPackage ./kernel { };
     };
+    writeSysctls =
+      let
+        inherit (lib) concatStringsSep collect mapAttrsRecursive;
+      in
+      s:
+      concatStringsSep "\n" (
+        collect (x: !builtins.isAttrs x) (
+          mapAttrsRecursive (
+            p: v: "echo ${builtins.toJSON (builtins.toString v)} > ${concatStringsSep "/" p}"
+          ) s
+        )
+      );
     outputRef =
       service: path:
       let