What do you change from the default?

1

This is inspired by this comment. I’m wondering what everyone changes from the defaults in their NixOS configurations.

For those who didn’t look at the link, I’m thinking about stuff like changing out systemd-timesyncd for chrony because it is a better alternative.

For me, something else that springs to mind is changing the dbus implementation to dbus-broker:

services.dbus.implementation = "broker";

As many other distros have made the switch (for example, Arch: announcement, RFC, and Fedora).

3 Likes
2

Relevant: Use dbus broker per default · Issue #299476 · NixOS/nixpkgs · GitHub

I also use chrony and earlyoom.

4 Likes
3

My complete server configs are visible here: https://git.sr.ht/~zackw/server-configs/tree/nix-and-guix/item/nix

Here’s a few highlights that might be good for general use:

# I could argue that all of these should be set by default
boot.tmp.useTmpfs = true;
nix.settings.auto-optimise-store = true;
nix.gc.automatic = true;
security.sudo.enable = false;

# AIUI this is the best current choice for SSDs
hardware.block.defaultScheduler = "kyber";

# lazy binding is a net security lose
# ideally all programs would be built with -fPIE -z relro -z now
# but that's a much bigger project
environment.variables.LD_BIND_NOW = "t";

boot.kernel.sysctl = {
    # I conjecture that the bulk of Linux's problems with swap
    # thrashing are caused by the huge amount of RAM that's
    # allowed to be consumed by dirty pages by default.
    # These would ideally be tuned based on the speed at which
    # the system's persistent storage can sink random-offset writes.
    "vm.dirty_background_bytes"                   = 1048576; # 0x100000 = 1M
    "vm.dirty_bytes"                              = 2097152; # 0x200000 = 2M
    "vm.admin_reserve_kbytes"                     = 131072;  # 0x20000 = 128k

    "vm.overcommit_memory"                        = 2;
    "vm.overcommit_ratio"                         = 90;

    # Ideally, this would be set to 2**32, to ensure that pointers
    # that get truncated to 32 bits are trapped.  However, fixed-
    # position executables are linked with a base address of 0x400000;
    # if we go any higher than that, they won't load.  I'd like to
    # enforce "all executables must be position-independent" as well,
    # but that's presently infeasible.  And finally, patchelf (as
    # currently implemented) sometimes creates a one-page segment
    # just below 0x400000 to give itself more space to work with.
    "vm.mmap_min_addr"                            = 4190208;  # 0x3FF000

    "vm.mmap_rnd_bits"                            = 32;
  };
}

The common/coredumps.nix, services/monitoring.nix, and services/serial-console.nix mini-modules might also be useful to people running servers.

6 Likes
4

I set networking.nftables.enable = true as well as enabling unbound with a custom setup.

3 Likes