profiles/cgroups.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

# Stolen from https://git.lix.systems/the-distro/infra/src/branch/main/common/cgroups.nix
# Relatively inspired by fbtax2:
# https://facebookmicrosites.github.io/cgroup2/docs/fbtax-results.html
{ ... }:
let
  systemCriticalSliceConfig = {
    ManagedOOMMemoryPressure = "kill";

    # guarantee availability of memory
    MemoryMin = "192M";
    # default 100
    IOWeight = 1000;
    # default 100
    CPUWeight = 1000;
  };
in
{
  systemd.oomd = {
    enable = true;
    enableRootSlice = true;
    enableSystemSlice = true;
    enableUserSlices = true;
  };

  systemd.services.nix-daemon = {
    serviceConfig = {
      CPUWeight = 10;
      IOWeight = 10;
    };
  };

  systemd.slices.hostcritical = {
    description = "Ensures that services to keep the system alive remain alive";

    unitConfig = {
      # required to avoid a dependency cycle on systemd-oomd. systemd will
      # actually guess this right but we should fix it anyway.
      DefaultDependencies = false;
    };

    sliceConfig = systemCriticalSliceConfig;
  };

  # make root logins higher priority for resources
  systemd.slices."user-0" = {
    sliceConfig = systemCriticalSliceConfig;
  };

  systemd.slices.system = {
    sliceConfig = {
      ManagedOOMMemoryPressure = "kill";
      ManagedOOMMemoryPressureLimit = "50%";

      IOWeight = 100;
    };
  };

  systemd.services.sshd = {
    serviceConfig = {
      Slice = "hostcritical.slice";
    };
  };

  systemd.services.systemd-oomd = {
    serviceConfig = {
      Slice = "hostcritical.slice";
    };
  };

  systemd.services.systemd-journald = {
    serviceConfig = {
      Slice = "hostcritical.slice";
    };
  };
}