julm: aubergine: yt-dlp: format-sort: +res~720p

[julm/julm-nix.git] / nixos / profiles / networking.nix

diff --git a/nixos/profiles/networking.nix b/nixos/profiles/networking.nix
index 20a63350d901d2dd5dcae44c9c30d35a21d836d2..5ca3eeb4bd6300b6550b1cf9b1cbab97e759eacc 100644 (file)
--- a/nixos/profiles/networking.nix
+++ b/nixos/profiles/networking.nix
@@ -1,48 +1,84 @@
 { config, pkgs, lib, hostName, ... }:
+with lib;
 {
   imports = [
     networking/nftables.nix
   ];
+
+  boot.kernel.sysctl = {
+    # Improve MTU detection
+    # This can thaw TCP connections stalled by a host
+    # requiring a lower MTU along the path,
+    # though it would do so after a little delay
+    # so it's better to set a low MTU when possible.
+    "net/ipv4/tcp_mtu_probing" = 1;
+
+    # Use TCP BBR to significantly increase throughput
+    # and reduce latency for connections.
+    "net/ipv4/tcp_congestion_control" = mkDefault "bbr";
+
+    # BBR must be used with the fq or fq_codel qdisc with pacing enabled,
+    # since pacing is integral to the BBR design and implementation.
+    # BBR without pacing would not function properly,
+    # and may incur unnecessary high packet loss rates.
+    #
+    # See https://github.com/systemd/systemd/issues/9725#issuecomment-412287161
+    # See https://github.com/systemd/systemd/issues/9725#issuecomment-413796842
+    # > The best all-round general purpose default for linux remains fq_codel.
+    "net/core/default_qdisc" = mkDefault "fq_codel";
+
+    # Request Explicit Congestion Notification (ECN)
+    # only for incoming connections (not outgoing).
+    # See https://github.com/systemd/systemd/issues/9748#issuecomment-1261352478
+    # > My answer to the ECN situation remains - turn it on
+    # > - see if it works - don't inflict your decision on others.
+    # > $ sysctl -w net.ipv4.tcp_ecn=1
+    # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub ecn' \
+    # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
+    # > $ sysctl -w net.ipv4.tcp_ecn=2
+    # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub noecn' \
+    # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
+    # > you can then use flent-gui *.flent.gz to generate a variety of plots,
+    # > especially comparison plots.
+    "net/ipv4/tcp_ecn" = mkDefault 2;
+  };
+
   networking = {
     inherit hostName;
-    domain = lib.mkDefault "wg";
+    domain = mkDefault "sp";
     #search = [ "sourcephile.fr" ];
     firewall = {
-      enable = lib.mkDefault true;
-      allowPing = lib.mkDefault true;
+      enable = mkDefault true;
+      allowPing = mkDefault true;
     };
     networkmanager = {
-      enable = lib.mkDefault config.services.xserver.enable;
       #dhcp = "dhcpcd";
-      logLevel = lib.mkDefault "INFO";
+      logLevel = mkDefault "INFO";
       wifi = {
         #backend = "iwd";
         #backend = "wpa_supplicant";
-        powersave = lib.mkDefault false;
+        powersave = mkDefault false;
       };
     };
     usePredictableInterfaceNames = true;
   };
 
   programs.mtr.enable = true;
+  programs.traceroute.enable = mkDefault true;
   programs.usbtop.enable = true;
-  environment.systemPackages = [
-    pkgs.iperf
-  ];
 
   services.avahi = {
-    enable = lib.mkDefault true;
-    nssmdns = lib.mkDefault true;
-    openFirewall = lib.mkDefault false;
-    publish.enable = lib.mkDefault false;
+    nssmdns4 = mkDefault true;
+    openFirewall = mkDefault false;
+    publish.enable = mkDefault false;
   };
-  networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
+  networking.nftables.ruleset = mkIf config.services.avahi.enable (''
     table inet filter {
       chain output-lan {
         skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
       }
     }
-  '' + lib.optionalString config.services.avahi.openFirewall ''
+  '' + optionalString config.services.avahi.openFirewall ''
     table inet filter {
       chain input-lan {
         udp dport mdns comment "avahi: multicast DNS"
@@ -50,17 +86,17 @@
     }
   '');
 
-  services.openssh = {
-    enable = lib.mkDefault true;
-    forwardX11 = lib.mkDefault true;
-    openFirewall = lib.mkDefault false;
-    # Enable to switch-to-configuration
-    # with the same ssh call remotely and locally
-    listenAddresses = [
-      { addr = "127.0.0.1"; port = 22; }
-    ];
-  };
+  services.openssh.enable = mkDefault true;
 
+  # Fix https://github.com/NixOS/nixpkgs/issues/180175 by removing -s (aka. --wait-for-startup)
+  systemd.services.NetworkManager-wait-online = lib.mkIf config.networking.networkmanager.enable {
+    unitConfig.StartLimitIntervalSec = 0;
+    serviceConfig = {
+      ExecStart = [ "" "${pkgs.networkmanager}/bin/nm-online -q" ];
+      Restart = "on-failure";
+      RestartSec = 1;
+    };
+  };
   environment.etc."NetworkManager/dispatcher.d/congctl" = {
     mode = "700";
     source = pkgs.writeShellScript "congctl" ''
@@ -74,11 +110,24 @@
               while read -r route; do
                 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
               done
-              ip r >>/tmp/log
             ;;
           esac
         ;;
       esac
     '';
   };
+
+  # The notion of "online" is a broken concept
+  #systemd.services.NetworkManager-wait-online.enable = false;
+  #systemd.network.wait-online.enable = false;
+
+  # Do not take down the network for too long when upgrading,
+  # This also prevents failures of services that are restarted instead of stopped.
+  # It will use `systemctl restart` rather than stopping it with `systemctl stop`
+  # followed by a delayed `systemctl start`.
+  systemd.services.systemd-networkd.stopIfChanged = false;
+
+  # Services that are only restarted might be not able
+  # to resolve when resolved is stopped before.
+  systemd.services.systemd-resolved.stopIfChanged = false;
 }