ifstate: configure sysctl on all hosts

hosts/ixp-as11201/configuration.nix

@@ -1,3 +1,5 @@
+{ config, ... }:
+
 {
   dd-ix = {
     useFpx = true;
@@ -19,38 +21,8 @@
   }];
 
   networking.ifstate.settings.namespaces.ixp-peering = {
-    options.sysctl =
-      let
-        options = {
-          ipv6 = {
-            # this machine should not participate in SLAAC
-            accept_ra = 0;
-            autoconf = 0;
-            # no redirects nor evil RH0
-            accept_redirects = 0;
-            accept_source_route = 0;
-            # no forwarding
-            forwarding = 0;
-          };
-          ipv4 = {
-            # no redirects nor source route
-            accept_redirects = 0;
-            send_redirects = 0;
-            accept_source_route = 0;
-            # handle arp requests strict
-            arp_ignore = 1;
-            arp_notify = 1;
-            # do strict rp filtering
-            rp_filter = 1;
-            # no forwarding
-            forwarding = 0;
-          };
-        };
-      in
-      {
-        all = options;
-        default = options;
-      };
+    # copy sysctl from default netns
+    options.sysctl = config.networking.ifstate.settings.options.sysctl;
     interfaces = [
       {
         name = "any112";

modules/dd-ix/default.nix

@@ -12,5 +12,6 @@
     ./mariadb.nix
     ./monitoring.nix
     ./redis.nix
+    ./sysctl.nix
   ];
 }

modules/dd-ix/sysctl.nix

@@ -0,0 +1,46 @@
+{
+  networking.ifstate.settings.options.sysctl =
+    let
+      options = {
+        ipv6 = {
+          # this machine should not participate in SLAAC
+          autoconf = 0;
+          # nor accept router advertisements
+          accept_ra = 0;
+          # no redirects nor evil RH0
+          accept_redirects = 0;
+          accept_source_route = 0;
+          # no forwarding
+          forwarding = 0;
+          # unsolicited neighbour advertisements
+          ndisc_notify = 1;
+        };
+        ipv4 = {
+          # no redirects
+          accept_redirects = 0;
+          send_redirects = 0;
+          accept_source_route = 0;
+          # handle arp requests strict
+          arp_ignore = 1;
+          arp_notify = 1;
+          # do strict rp filtering
+          rp_filter = 1;
+          # no forwarding
+          forwarding = 0;
+        };
+      };
+    in
+    {
+      all = options;
+      default = options;
+      net.core = {
+        # Bufferbloat: fair queuing controlled delay
+        default_qdisc = "cake";
+        # tune SoftIRQ packet handling (5x)
+        netdev_budget_usecs = 10000;
+        netdev_budget = 1500;
+        dev_weight = 320;
+        netdev_max_backlog = 5000;
+      };
+    };
+}

modules/management/nextcloud.nix

@@ -3,27 +3,30 @@ let
   domain = "cloud.${config.dd-ix.domain}";
 in
 {
-  sops.secrets."cloud_admin_pw" = {
-    sopsFile = self + "/secrets/management/cloud.yaml";
-    owner = config.systemd.services.nextcloud-setup.serviceConfig.User;
-  };
+  sops.secrets = {
+    "cloud_admin_pw" = {
+      sopsFile = self + "/secrets/management/cloud.yaml";
+      owner = config.systemd.services.nextcloud-setup.serviceConfig.User;
+    };
 
-  sops.secrets."cloud_db_pw" = {
-    sopsFile = self + "/secrets/management/cloud.yaml";
-    owner = config.systemd.services.nextcloud-setup.serviceConfig.User;
-  };
+    "cloud_db_pw" = {
+      sopsFile = self + "/secrets/management/cloud.yaml";
+      owner = config.systemd.services.nextcloud-setup.serviceConfig.User;
+    };
 
-  sops.secrets."office_env" = {
-    sopsFile = self + "/secrets/management/cloud.yaml";
-    owner = "root";
+    "office_env" = {
+      sopsFile = self + "/secrets/management/cloud.yaml";
+      owner = "root";
+    };
   };
 
-  systemd.services.nextcloud-setup.after = [ "network.target" ];
+  systemd.services.nextcloud-setup = {
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+  };
 
   services = {
-    postgresql = {
-      enable = lib.mkForce false;
-    };
+    postgresql.enable = lib.mkForce false;
     nextcloud = {
       enable = true;
       hostName = domain;
@@ -100,10 +103,10 @@ in
     image = "onlyoffice/documentserver:8.3.0.1";
     imageFile = pkgs.dockerTools.pullImage {
       imageName = "onlyoffice/documentserver";
-      imageDigest = "sha256:7bf6a672e1743d62002aa518ea880f486f642c238ee93aa6d572f899a05da486";
-      sha256 = "1f26jhczd9p0g17y7r4fl1pnhsj9bisfaggcm2pyfjnqlcyzgdgl";
+      imageDigest = "sha256:9c76330ee4be00623e204c5305b20f8868c37e0e90c88e351c27feb148aada80";
+      sha256 = "0kxx21ax4y8j5jlhfi6qfrv2iahnsfxc0pzspbp483l4x45fi2vg";
       finalImageName = "onlyoffice/documentserver";
-      finalImageTag = "8.3.0.1";
+      finalImageTag = "8.3.2.1";
     };
     environmentFiles = [ config.sops.secrets."office_env".path ];
     extraOptions = [ "--network=host" ];