fix(power): pin the tuned profile per host, cap the VM hosts (#458)

Assisted-by: DeepSeek Harness (deepseek-flash)

hosts/12kingdoms-shoukei/default.nix

@@ -21,8 +21,11 @@ in
 
   # disable sunshine for security
   services.sunshine.enable = lib.mkForce false;
-  # battery-first: override the profile default
-  services.tuned.ppdSettings.main.default = lib.mkForce "power-saver";
+  # battery-first: pin the low-power profile. apple-cpufreq exposes no EPP or
+  # platform_profile, so the only thing this changes is cpufreq boost.
+  services.tuned.recommend = {
+    powersave = { };
+  };
 
   # Laptop joins untrusted networks and is never scraped (see youko's
   # `offlineHosts`); don't expose :9100, and don't keep the smartctl exporter

hosts/idols-ai/default.nix

@@ -58,7 +58,10 @@ in
   };
 
   services.sunshine.enable = true;
-  services.tuned.ppdSettings.main.default = lib.mkForce "performance";
+  # desktop PC: keep the CPU pinned to the performance profile
+  services.tuned.recommend = {
+    throughput-performance = { };
+  };
 
   modules.btrbk.enable = true;
 

lib/genVmHostModule.nix

@@ -10,6 +10,14 @@ let
   ipv4WithMask = "${ipv4}/24";
 in
 {
+  # Physical machines only: these three always-on mini PCs hold their CPU at
+  # TuneD's power-saving profile (EPP biased to power, cpufreq boost off). A
+  # MicroVM guest has no EPP or boost of its own, so it never imports this module.
+  imports = [ ../modules/nixos/power.nix ];
+  services.tuned.recommend = {
+    powersave = { };
+  };
+
   # supported file systems, so we can mount any removable disks with these filesystems
   boot.supportedFilesystems = [
     "ext4"

modules/nixos/desktop/default.nix

@@ -1,4 +1,4 @@
 { mylib, ... }:
 {
-  imports = mylib.scanPaths ./.;
+  imports = mylib.scanPaths ./. ++ [ ../power.nix ];
 }

modules/nixos/desktop/power.nix

@@ -1,17 +0,0 @@
-{ ... }:
-{
-  # TuneD - Tuning Profile Delivery Mechanism for Linux
-  # A modern replacement for PPD(power-profiles-daemon)
-  services.tuned = {
-    enable = true;
-    settings.dynamic_tuning = true;
-    ppdSupport = true; # translation of power-profiles-daemon API calls to TuneD
-    ppdSettings.main.default = "balanced"; # balanced / performance / power-saver
-  };
-  # DBus service that provides power management support to applications
-  # Required by `tuned-ppd` for handling power supply changes
-  services.upower.enable = true;
-
-  services.power-profiles-daemon.enable = false; # conflicts with tuned
-  services.tlp.enable = false; # conflicts with tuned
-}

modules/nixos/power.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  # TuneD - Tuning Profile Delivery Mechanism for Linux
+  # A modern replacement for PPD(power-profiles-daemon), and the only power manager
+  # here: nixpkgs' tuned module already disables power-profiles-daemon and fails
+  # the build if TLP, auto-cpufreq or system76-power is enabled as well.
+  services.tuned = {
+    enable = true;
+    settings.dynamic_tuning = true;
+
+    # Hosts pin their profile with `services.tuned.recommend` (an empty rule
+    # matches any host): TuneD reads /etc/tuned/recommend.conf in its automatic
+    # profile mode on every boot. `ppdSettings.main.default` looks like it does
+    # the same, but never wins -- tuned-ppd restores the base profile it saved in
+    # /etc/tuned/ppd_base_profile, or TuneD's own recommendation, first. Nothing
+    # here uses the PPD D-Bus API, so tuned-ppd stays off instead of overwriting
+    # the pinned profile at startup.
+    ppdSupport = false;
+  };
+
+  # Battery/AC state, used by the desktops; tuned-ppd was the other consumer.
+  services.upower.enable = true;
+}