From 885dabb49d62f5316e9e4de2672b895dd9594e58 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Sat, 3 Oct 2026 10:23:21 +0800 Subject: [PATCH] refactor: scope host tools, locate and mDNS by purpose (#356) --- lib/genMicrovmGuestModule.nix | 8 +++ modules/nixos/base/locate.nix | 37 ++++++++--- modules/nixos/base/networking/avahi.nix | 21 ------ modules/nixos/base/networking/mdns.nix | 43 +++++++++++++ modules/nixos/base/packages.nix | 85 ++++++++++++++++--------- modules/nixos/desktop.nix | 6 ++ modules/nixos/server/qemu-guest.nix | 3 + 7 files changed, 143 insertions(+), 60 deletions(-) delete mode 100644 modules/nixos/base/networking/avahi.nix create mode 100644 modules/nixos/base/networking/mdns.nix diff --git a/lib/genMicrovmGuestModule.nix b/lib/genMicrovmGuestModule.nix index ac07bb98..3db73995 100644 --- a/lib/genMicrovmGuestModule.nix +++ b/lib/genMicrovmGuestModule.nix @@ -126,4 +126,12 @@ in }; system.stateVersion = "26.05"; + + # MicroVM guests share the host's store and have no physical hardware to + # inspect, nothing to trace, no persisted /var/cache for a `locate` index, + # and nothing to advertise over mDNS. + modules.hardwareTools.enable = false; + modules.debugTools.enable = false; + modules.locate.enable = false; + modules.mdns.enable = false; } diff --git a/modules/nixos/base/locate.nix b/modules/nixos/base/locate.nix index 3a6f4741..69ce5617 100644 --- a/modules/nixos/base/locate.nix +++ b/modules/nixos/base/locate.nix @@ -1,13 +1,30 @@ -{ pkgs, ... }: { - # Whole-filesystem filename search (`locate`), backed by plocate. It complements - # `nix-index`/`nix-locate`, which only index the nix store. - # - # The database lives at /var/cache/locatedb. Hosts with an ephemeral root must - # persist /var/cache as a directory (see hosts/idols-ai/preservation.nix): plocate - # replaces the DB via a temp file + rename, which fails on a bind-mounted file. - services.locate = { - enable = true; - package = pkgs.plocate; + lib, + config, + pkgs, + ... +}: +let + cfg = config.modules.locate; +in +{ + options.modules.locate.enable = lib.mkEnableOption '' + Whole-filesystem filename search (`locate`), backed by plocate. It + complements `nix-index`/`nix-locate`, which only index the nix store. + + The database lives at /var/cache/locatedb. Hosts with an ephemeral root + must persist /var/cache as a directory (see hosts/idols-ai/preservation.nix): + plocate replaces the DB via a temp file + rename, which fails on a + bind-mounted file. + + Off by default: the daily `updatedb` scan is only worth it on hosts that + persist /var/cache and actually use `locate` (currently idols-ai). + ''; + + config = lib.mkIf cfg.enable { + services.locate = { + enable = true; + package = pkgs.plocate; + }; }; } diff --git a/modules/nixos/base/networking/avahi.nix b/modules/nixos/base/networking/avahi.nix deleted file mode 100644 index e1fe2ab2..00000000 --- a/modules/nixos/base/networking/avahi.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ - # Network discovery on a local network, mDNS - # With this enabled, you can access your machine at .local - # it's more convenient than using the IP address. - # https://avahi.org/ - services.avahi = { - enable = true; - nssmdns4 = true; - publish = { - enable = true; - domain = true; - userServices = true; - }; - }; - - # avahi and systemd-resolved both run an mDNS responder, which makes mDNS - # unreliable ("Detected another IPv4/IPv6 mDNS stack running on this host"). - # Keep avahi (needed for DNS-SD, e.g. CUPS printer discovery) and turn off - # resolved's own mDNS. - services.resolved.settings.Resolve.MulticastDNS = false; -} diff --git a/modules/nixos/base/networking/mdns.nix b/modules/nixos/base/networking/mdns.nix new file mode 100644 index 00000000..287bd6e3 --- /dev/null +++ b/modules/nixos/base/networking/mdns.nix @@ -0,0 +1,43 @@ +{ + lib, + config, + ... +}: +let + cfg = config.modules.mdns; +in +{ + options.modules.mdns.enable = + lib.mkEnableOption '' + mDNS/DNS-SD responder, backed by avahi: `.local` access and CUPS + printer discovery. + + On by default for physical hosts; MicroVM guests turn it off since they + have nothing to advertise. + '' + // { + default = true; + }; + + config = lib.mkIf cfg.enable { + # Network discovery on a local network, mDNS + # With this enabled, you can access your machine at .local + # it's more convenient than using the IP address. + # https://avahi.org/ + services.avahi = { + enable = true; + nssmdns4 = true; + publish = { + enable = true; + domain = true; + userServices = true; + }; + }; + + # avahi and systemd-resolved both run an mDNS responder, which makes mDNS + # unreliable ("Detected another IPv4/IPv6 mDNS stack running on this host"). + # Keep avahi (needed for DNS-SD, e.g. CUPS printer discovery) and turn off + # resolved's own mDNS. + services.resolved.settings.Resolve.MulticastDNS = false; + }; +} diff --git a/modules/nixos/base/packages.nix b/modules/nixos/base/packages.nix index 0ad80e22..06690166 100644 --- a/modules/nixos/base/packages.nix +++ b/modules/nixos/base/packages.nix @@ -1,35 +1,62 @@ -{ pkgs, ... }: { - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - # system call monitoring - strace # system call monitoring - lsof # list open files + lib, + config, + pkgs, + ... +}: +let + inherit (config.modules) hardwareTools debugTools; +in +{ + options.modules.hardwareTools.enable = + lib.mkEnableOption '' + Basic hardware and disk introspection tools (lm_sensors, pciutils, + usbutils, dmidecode, parted, smartmontools, nvme-cli). - # ebpf related tools - # https://github.com/bpftrace/bpftrace - bpftrace # powerful tracing tool + On by default for physical hosts; MicroVM guests turn it off since they + share the host's store and cannot use any of it. + '' + // { + default = true; + }; - # system monitoring - sysstat - iotop-c - sysbench - pv # pipe view + options.modules.debugTools.enable = lib.mkEnableOption '' + Tracing and benchmarking tools (strace, bpftrace, sysstat, iotop-c, + sysbench and the BCC tools). - # system tools - psmisc # killall/pstree/prtstat/fuser/... - lm_sensors # for `sensors` command - ethtool - pciutils # lspci - usbutils # lsusb - dmidecode # a tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard - parted - smartmontools # smartctl -a /dev/nvme0n1 - nvme-cli - ]; + Off by default: opt in on hosts where you actually profile with them + (currently idols-ai). + ''; - # BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more - # https://github.com/iovisor/bcc - programs.bcc.enable = true; + config = { + environment.systemPackages = + with pkgs; + [ + # broadly useful on every host + lsof # list open files + psmisc # killall/pstree/prtstat/fuser/... + ethtool + pv # pipe view + ] + ++ lib.optionals hardwareTools.enable [ + lm_sensors # `sensors` command + pciutils # lspci + usbutils # lsusb + dmidecode # SMBIOS/DMI hardware info (from the BIOS) + parted + smartmontools # smartctl -a /dev/nvme0n1 + nvme-cli + ] + ++ lib.optionals debugTools.enable [ + strace # system call tracing + bpftrace # eBPF tracing, https://github.com/bpftrace/bpftrace + sysstat + iotop-c + sysbench + ]; + + # BCC - tools for BPF-based IO/network analysis/monitoring + # https://github.com/iovisor/bcc + programs.bcc.enable = debugTools.enable; + }; } diff --git a/modules/nixos/desktop.nix b/modules/nixos/desktop.nix index c0d1f3ef..f98c6444 100644 --- a/modules/nixos/desktop.nix +++ b/modules/nixos/desktop.nix @@ -27,6 +27,12 @@ in # Mesa userspace (OpenGL/Vulkan) for every GUI host. { hardware.graphics.enable = true; + + # Desktops opt in to the tracing/benchmark tooling and the + # whole-filesystem `locate` index (both off by default; see + # modules/nixos/base/{packages,locate}.nix). + modules.debugTools.enable = true; + modules.locate.enable = true; } (mkIf cfgWayland.enable { diff --git a/modules/nixos/server/qemu-guest.nix b/modules/nixos/server/qemu-guest.nix index 8d9b90e5..27eb56b3 100644 --- a/modules/nixos/server/qemu-guest.nix +++ b/modules/nixos/server/qemu-guest.nix @@ -22,6 +22,9 @@ # disable backups in the VM modules.btrbk.enable = lib.mkForce false; + # VM guest: no physical hardware to inspect. + modules.hardwareTools.enable = lib.mkForce false; + boot.growPartition = true; boot.kernelParams = [ "console=ttyS0" ]; boot.loader.grub.device = "/dev/vda";