build: prune common configuration
- Remove hard dependency on coretemp - Remove graphics workaround for old environment at TU Delft - Update available system packages for better workability - Group options logically and sort them from low-level to high-level - Remove bespoke /tmpfiles option, nixpkgs has its own with 10d cleanup - Remove builder specific config (KSM, build users, login limits) - Remove cron email config leftover, we don't use cron timers anymore
Martin Weinelt committed
Dec 10, 2024 at 18:41 UTC
6a83addd3a18f8b8675579e2b9cd914baa32f2b4
1 file changed
+54
-74
build/common.nix
+54
-74
@@ -1,12 +1,9 @@
1
{
2
- config,
2
pkgs,
3
lib,
4
...
5
}:
6
8
-with lib;
9
-
7
{
8
imports = [
9
./diffoscope.nix
@@ -17,61 +14,71 @@ with lib;
14
15
nixpkgs.config.allowUnfree = true;
16
20
- services.openssh.authorizedKeysFiles = mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
21
-
22
- boot.kernelModules = [ "coretemp" ];
23
-
24
- # Prevent "out of sync" errors on the KVM switch.
25
- boot.vesa = false;
26
- boot.blacklistedKernelModules = [
27
- "radeonfb"
28
- "radeon"
29
- "i915"
30
- ];
31
- boot.kernelParams = [ "nomodeset" ];
32
-
17
hardware.enableAllFirmware = true;
18
hardware.cpu.amd.updateMicrocode = true;
19
hardware.cpu.intel.updateMicrocode = true;
20
37
- environment.systemPackages = [
38
- pkgs.emacs
39
- pkgs.sysstat
40
- pkgs.hdparm
41
- pkgs.sdparm # pkgs.lsiutil
42
- pkgs.htop
43
- pkgs.sqlite
44
- pkgs.iotop
45
- pkgs.lm_sensors
46
- pkgs.hwloc
47
- pkgs.lsof
48
- pkgs.numactl
49
- pkgs.gcc
50
- pkgs.smartmontools
51
- pkgs.tcpdump
52
- pkgs.gdb
53
- pkgs.elfutils
54
- ];
21
+ boot.kernel.sysctl = {
22
+ # reboot on kernel panic
23
+ "kernel.panic" = 60;
24
+ "kernel.panic_on_oops" = 1;
25
+ };
26
56
- services.openssh.enable = true;
27
+ documentation.nixos.enable = false;
28
58
- boot.kernel.sysctl."kernel.panic" = 60;
59
- boot.kernel.sysctl."kernel.panic_on_oops" = 1;
29
+ environment = {
30
+ enableDebugInfo = true;
31
+ systemPackages = with pkgs; [
32
+ # debugging
33
+ gdb
34
+ lsof
35
+ sqlite-interactive
36
+
37
+ # editors
38
+ emacs
39
+ helix
40
+ neovim
41
+
42
+ # utilities
43
+ ripgrep
44
+ fd
45
+
46
+ # system introspection
47
+ hdparm
48
+ htop
49
+ iotop
50
+ lm_sensors
51
+ nvme-cli
52
+ smartmontools
53
+ sysstat
54
+ tcpdump
55
+ tmux
56
+ ];
57
+ };
58
61
- nix.nrBuildUsers = 100;
59
+ services.openssh = {
60
+ enable = true;
61
+ authorizedKeysFiles = lib.mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
62
+ };
63
64
nix.extraOptions = ''
65
allowed-impure-host-deps = /etc/protocols /etc/services /etc/nsswitch.conf
66
allowed-uris = https://github.com/ https://git.savannah.gnu.org/ github:
67
'';
68
69
+ # we use networkd
70
networking.useDHCP = false;
71
70
- networking.firewall.enable = true;
71
- networking.firewall.rejectPackets = true;
72
- networking.firewall.allowPing = true;
73
- networking.firewall.allowedTCPPorts = [ 10050 ];
74
- networking.firewall.logRefusedConnections = false;
72
+ networking.firewall = {
73
+ enable = true;
74
+
75
+ # be a good network citizen and allow some debugging interactions
76
+ rejectPackets = true;
77
+ allowPing = true;
78
+
79
+ # prevent firewall log spam from rotating the kernel rinbuffer
80
+ logRefusedConnections = false;
81
+ };
82
83
services.resolved = {
84
enable = true;
@@ -84,37 +91,10 @@ with lib;
91
];
92
};
93
87
- # Bump the open files limit so that non-root users can run NixOS VM
88
- # tests (Samba opens lot of files).
89
- security.pam.loginLimits = [
90
- {
91
- domain = "*";
92
- item = "nofile";
93
- type = "-";
94
- value = "16384";
95
- }
96
- ];
97
-
98
- # Enable Kernel Samepage Merging (reduces memory footprint of VMs).
99
- hardware.ksm.enable = true;
100
-
101
- # Disable the systemd-journald watchdog. The default timeout (1min)
102
- # can easily be triggered on our slow, heavily-loaded disks. And
103
- # that may cause services writing to the journal to fail until
104
- # they're restarted.
105
- systemd.services.systemd-journald.serviceConfig.WatchdogSec = 0;
106
-
107
- environment.enableDebugInfo = true;
108
-
109
- systemd.tmpfiles.rules = [ "d /tmp 1777 root root 7d" ];
110
-
111
- # Disable sending email from cron.
112
- services.cron.mailto = "";
113
-
114
- documentation.nixos.enable = false;
115
-
116
- security.acme.acceptTerms = true;
117
- security.acme.defaults.email = "infra@nixos.org";
94
+ security.acme = {
95
+ acceptTerms = true;
96
+ defaults.email = "infra@nixos.org";
97
+ };
98
99
services.zfs.autoScrub.enable = true;
100
}