nixos/profiles/networking.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   hostName,
   6   ...
   7 }:
   8 with lib;
   9 {
  10   imports = [
  11     networking/nftables.nix
  12   ];
  13
  14   boot.kernel.sysctl = {
  15     # Improve MTU detection
  16     # This can thaw TCP connections stalled by a host
  17     # requiring a lower MTU along the path,
  18     # though it would do so after a little delay
  19     # so it's better to set a low MTU when possible.
  20     "net/ipv4/tcp_mtu_probing" = 1;
  21
  22     # Use TCP BBR to significantly increase throughput
  23     # and reduce latency for connections.
  24     "net/ipv4/tcp_congestion_control" = mkDefault "bbr";
  25
  26     # BBR must be used with the fq or fq_codel qdisc with pacing enabled,
  27     # since pacing is integral to the BBR design and implementation.
  28     # BBR without pacing would not function properly,
  29     # and may incur unnecessary high packet loss rates.
  30     #
  31     # See https://github.com/systemd/systemd/issues/9725#issuecomment-412287161
  32     # See https://github.com/systemd/systemd/issues/9725#issuecomment-413796842
  33     # > The best all-round general purpose default for linux remains fq_codel.
  34     "net/core/default_qdisc" = mkDefault "fq_codel";
  35
  36     # Request Explicit Congestion Notification (ECN)
  37     # only for incoming connections (not outgoing).
  38     # See https://github.com/systemd/systemd/issues/9748#issuecomment-1261352478
  39     # > My answer to the ECN situation remains - turn it on
  40     # > - see if it works - don't inflict your decision on others.
  41     # > $ sysctl -w net.ipv4.tcp_ecn=1
  42     # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub ecn' \
  43     # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
  44     # > $ sysctl -w net.ipv4.tcp_ecn=2
  45     # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub noecn' \
  46     # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
  47     # > you can then use flent-gui *.flent.gz to generate a variety of plots,
  48     # > especially comparison plots.
  49     "net/ipv4/tcp_ecn" = mkDefault 2;
  50   };
  51
  52   networking = {
  53     inherit hostName;
  54     domain = mkDefault "sp";
  55     #search = [ "sourcephile.fr" ];
  56     firewall = {
  57       enable = mkDefault true;
  58       allowPing = mkDefault true;
  59     };
  60     networkmanager = {
  61       #dhcp = "dhcpcd";
  62       logLevel = mkDefault "INFO";
  63       wifi = {
  64         #backend = "iwd";
  65         #backend = "wpa_supplicant";
  66         powersave = mkDefault false;
  67       };
  68     };
  69     usePredictableInterfaceNames = true;
  70   };
  71
  72   programs.mtr.enable = true;
  73   programs.traceroute.enable = mkDefault true;
  74   programs.usbtop.enable = true;
  75
  76   services.openssh.enable = mkDefault true;
  77
  78   # Fix https://github.com/NixOS/nixpkgs/issues/180175 by removing -s (aka. --wait-for-startup)
  79   systemd.services.NetworkManager-wait-online = lib.mkIf config.networking.networkmanager.enable {
  80     unitConfig.StartLimitIntervalSec = 0;
  81     serviceConfig = {
  82       ExecStart = [
  83         ""
  84         "${pkgs.networkmanager}/bin/nm-online -q"
  85       ];
  86       Restart = "on-failure";
  87       RestartSec = 1;
  88     };
  89   };
  90   environment.etc."NetworkManager/dispatcher.d/congctl" = {
  91     mode = "700";
  92     source = pkgs.writeShellScript "congctl" ''
  93       case $NM_DISPATCHER_ACTION in
  94         up)
  95           case $DEVICE_IP_IFACE in
  96             # WLAN or WWAN
  97             # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
  98             wl*|ww*)
  99               ip route show dev $DEVICE_IP_IFACE |
 100               while read -r route; do
 101                 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
 102               done
 103             ;;
 104           esac
 105         ;;
 106       esac
 107     '';
 108   };
 109
 110   # The notion of "online" is a broken concept
 111   #systemd.services.NetworkManager-wait-online.enable = false;
 112   #systemd.network.wait-online.enable = false;
 113
 114   # Do not take down the network for too long when upgrading,
 115   # This also prevents failures of services that are restarted instead of stopped.
 116   # It will use `systemctl restart` rather than stopping it with `systemctl stop`
 117   # followed by a delayed `systemctl start`.
 118   systemd.services.systemd-networkd.stopIfChanged = false;
 119
 120   # Services that are only restarted might be not able
 121   # to resolve when resolved is stopped before.
 122   systemd.services.systemd-resolved.stopIfChanged = false;
 123 }