kat/nixfiles
1
0
Fork 0
mirror of https://github.com/kittywitch/nixfiles.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity

feat: move to wivrn, vencord

Browse source
This commit is contained in:
Kat Inskip 2025-08-22 00:43:54 -07:00
parent 5c7dc38a13
commit 62a07510f9
Signed by: kat
GPG key ID: 465E64DECEA8CF0F
18 changed files with 321 additions and 171 deletions
Download patch file Download diff file Expand all files Collapse all files

47
nixos/microvm/default.nix
View file

@ -1,6 +1,7 @@
{
config,
lib,
pkgs,
...
}: let
inherit (lib.modules) mkDefault;
@ -13,7 +14,6 @@ in {
vcpu = 2;
mem = 2048;
initialBalloonMem = 256;
balloon = true;
volumes = [
{
autoCreate = true;
@ -34,6 +34,28 @@ in {
boot = {
loader.grub.enable = false;
loader.systemd-boot.enable = false;
initrd.kernelModules = [
# required for net.netfilter.nf_conntrack_max appearing in sysfs early at boot
"nf_conntrack"
];
kernel.sysctl = let
limit = 2 * 1024;
mem =
if (config?microvm)
then config.microvm.mem
else limit;
in
lib.optionalAttrs (mem <= limit) {
# table overflow causing packets from nginx to the service to drop
# nf_conntrack: nf_conntrack: table full, dropping packet
"net.netfilter.nf_conntrack_max" = lib.mkDefault "65536";
};
kernelParams = [
# mitigations which cost the most performance and are the least real world relevant
# NOTE: keep in sync with baremetal.nix
"retbleed=off"
"gather_data_sampling=off" # Downfall
];
};
fileSystems = {
@ -48,29 +70,6 @@ in {
};
hardware.enableRedistributableFirmware = false;
initrd.kernelModules = [
# required for net.netfilter.nf_conntrack_max appearing in sysfs early at boot
"nf_conntrack"
];
kernel.sysctl = let
limit = 2 * 1024;
mem =
if (config?microvm)
then config.microvm.mem
else limit;
in
lib.optionalAttrs (mem <= limit) {
# table overflow causing packets from nginx to the service to drop
# nf_conntrack: nf_conntrack: table full, dropping packet
"net.netfilter.nf_conntrack_max" = lib.mkDefault "65536";
};
kernelParams = [
# mitigations which cost the most performance and are the least real world relevant
# NOTE: keep in sync with baremetal.nix
"retbleed=off"
"gather_data_sampling=off" # Downfall
];
system.build.installBootLoader = getExe' pkgs.coreutils "true";
systemd.tmpfiles.rules = [