mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
Ryan Yin
5088535ac3
The 2026-10-22 audit found the live socket on *:9835: #373 bound node/smartctl in monitoring.nix, but the nvidia exporter enabled in hardware-nvidia.nix kept the nixpkgs default, so the socket-level defence-in-depth layer never existed for 9835. Extend the security-exporters eval check to every enabled exporter's listenAddress so a future exporter without a bind fails the test. Assisted-by: DeepSeek Harness (gpt-6-astra)
105 lines
3.3 KiB
Nix
105 lines
3.3 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
myvars,
|
|
...
|
|
}:
|
|
{
|
|
# ===============================================================================================
|
|
# for Nvidia GPU
|
|
# https://wiki.nixos.org/wiki/NVIDIA
|
|
# https://wiki.hyprland.org/Nvidia/
|
|
#
|
|
# The RTX 4090 is the only GPU on this host: the i5-13600KF has no iGPU, so
|
|
# there is no PRIME offload to configure and nothing to keep the dGPU "free"
|
|
# for.
|
|
# ===============================================================================================
|
|
|
|
boot.kernelParams = [
|
|
# Since NVIDIA does not load kernel mode setting by default,
|
|
# enabling it is required to make Wayland compositors function properly.
|
|
"nvidia-drm.fbdev=1"
|
|
];
|
|
services.xserver.videoDrivers = [ "nvidia" ]; # will install nvidia-vaapi-driver by default
|
|
|
|
hardware.nvidia = {
|
|
# Open-source kernel modules are preferred over and planned to steadily replace proprietary modules
|
|
open = true;
|
|
nvidiaSettings = true;
|
|
|
|
# Optionally, you may need to select the appropriate driver version for your specific GPU.
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/nvidia-x11/default.nix
|
|
package = config.boot.kernelPackages.nvidiaPackages.production;
|
|
|
|
# required by most wayland compositors!
|
|
modesetting.enable = true;
|
|
powerManagement.enable = true;
|
|
};
|
|
|
|
# Bound the driver's free-buffer pool for niri only: it never returns freed
|
|
# vidmem, so niri's VRAM grows past 1 GiB (WA-039). Applies at niri's next start.
|
|
# https://github.com/niri-wm/niri/wiki/Nvidia#high-vram-usage-fix
|
|
environment.etc."nvidia/nvidia-application-profiles-rc.d/50-limit-free-buffer-pool-in-wayland-compositors.json".text =
|
|
builtins.toJSON {
|
|
rules = [
|
|
{
|
|
pattern = {
|
|
feature = "procname";
|
|
matches = "niri";
|
|
};
|
|
profile = "Limit Free Buffer Pool On Wayland Compositors";
|
|
}
|
|
];
|
|
profiles = [
|
|
{
|
|
name = "Limit Free Buffer Pool On Wayland Compositors";
|
|
settings = [
|
|
{
|
|
key = "GLVidHeapReuseRatio";
|
|
value = 0;
|
|
}
|
|
];
|
|
}
|
|
];
|
|
};
|
|
|
|
hardware.nvidia-container-toolkit.enable = true;
|
|
hardware.graphics = {
|
|
enable = true;
|
|
# needed by nvidia-docker
|
|
enable32Bit = true;
|
|
};
|
|
|
|
# GPU monitoring: CUDA btop, nvtop, and the community nvidia_gpu_exporter.
|
|
modules.btop.package = pkgs.btop-cuda;
|
|
environment.systemPackages = [ pkgs.nvtopPackages.full ];
|
|
# LAN-bound like node/smartctl in modules/nixos/base/monitoring.nix: the
|
|
# socket must not exist on tailscale0/br0 even if the firewall regresses.
|
|
services.prometheus.exporters.nvidia-gpu = {
|
|
enable = true;
|
|
listenAddress = myvars.networking.hostsAddr.ai.ipv4;
|
|
};
|
|
|
|
services.sunshine.settings = {
|
|
max_bitrate = 20000; # in Kbps
|
|
# No adapter_name: Sunshine picks the only adapter, the 4090.
|
|
nvenc_preset = 3;
|
|
nvenc_twopass = "full_res";
|
|
};
|
|
|
|
systemd.user.services.sunshine = {
|
|
after = [ "niri.service" ];
|
|
preStart = ''
|
|
for _ in {1..20}; do
|
|
if ${config.programs.niri.package}/bin/niri msg outputs | ${pkgs.gnugrep}/bin/grep -q '^Output '; then
|
|
exit 0
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
echo "Sunshine requires at least one Niri output" >&2
|
|
exit 1
|
|
'';
|
|
};
|
|
}
|