Sovran Contributor
09d4cc9b83
Nextcloud 35's Database checks flag three Performance issues out of the box: buffer cache hit ratio ~96% (wants 99%+), 100k+ dead tuples, and million-plus sequential scans on oc_mail_tags / oc_guests_users. Root causes in Sovran: stock 128MB shared_buffers, stock 60s autovacuum naptime, APCu file locking, and db:add-missing-indices running exactly once at install time (never on upgrades or app installs). Size Postgres for the README's Server + Desktop recommendation (32 GB RAM, NVMe): 2GB shared_buffers, 12GB effective_cache_size, 512MB maintenance_work_mem, 32MB work_mem, 4GB max_wal_size, 30s autovacuum naptime with 4 workers. shared_buffers stays below the 25% rule because Postgres shares the box with bitcoind, Electrs, LND, MariaDB and PHP-FPM. Scope the aggressive autovacuum to nextclouddb via ALTER DATABASE so the shared matrix-synapse DB keeps the milder cluster defaults. Add a local Redis (127.0.0.1:6379, Nextcloud only) and move memcache.distributed/locking to Redis; migrate existing installs with a one-shot since nextcloud-init never re-runs. Add a weekly nextcloud-db-maintenance timer (VACUUM ANALYZE + db:add-missing-*) so upgrades and later app installs can't regress the checks again. Note: shared_buffers needs one 'systemctl restart postgresql', which briefly takes down both Nextcloud and Matrix. Everything else is reload-only or scoped to nextclouddb.
244 lines
9.9 KiB
Nix
244 lines
9.9 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./modules/modules.nix
|
|
];
|
|
|
|
# ── Boot ────────────────────────────────────────────────────
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
boot.kernelParams = [ "quiet" "loglevel=3" "rd.systemd.show_status=false" "udev.log_level=3" ];
|
|
boot.blacklistedKernelModules = [ "rxrpc" ];
|
|
|
|
# ── Filesystems ─────────────────────────────────────────────
|
|
fileSystems."/run/media/Second_Drive" = {
|
|
device = "LABEL=BTCEcoandBackup";
|
|
fsType = "ext4";
|
|
options = [ "nofail" ];
|
|
};
|
|
|
|
fileSystems."/boot/efi".options = [ "umask=0077" "defaults" ];
|
|
|
|
# ── Nix Settings ────────────────────────────────────────────
|
|
nix.settings = {
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
download-buffer-size = 524288000;
|
|
|
|
# Network resilience for cache.nixos.org (Fastly) flakiness.
|
|
connect-timeout = 10; # fail-fast on dead TCP connects (default: 0 = unlimited)
|
|
stalled-download-timeout = 90; # default 300s; retry sooner on stalled transfers
|
|
download-attempts = 7; # default 5
|
|
http-connections = 25; # cap concurrency (helps MTU/middlebox paths)
|
|
fallback = true; # build locally if a substitute can't be fetched
|
|
};
|
|
|
|
# ── Networking ──────────────────────────────────────────────
|
|
networking.hostName = "nixos";
|
|
networking.networkmanager.enable = true;
|
|
networking.firewall.enable = true;
|
|
networking.firewall.allowedUDPPorts = [ 5353 ];
|
|
|
|
# ── Avahi (mDNS) ───────────────────────────────────────────
|
|
services.avahi = {
|
|
enable = true;
|
|
hostName = "sovransystemsos";
|
|
nssmdns4 = true;
|
|
publish = { enable = true; addresses = true; };
|
|
};
|
|
|
|
# ── Locale / Time ──────────────────────────────────────────
|
|
time.timeZone = null;
|
|
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
|
i18n.supportedLocales = [
|
|
"en_US.UTF-8/UTF-8"
|
|
"en_GB.UTF-8/UTF-8"
|
|
"es_ES.UTF-8/UTF-8"
|
|
"fr_FR.UTF-8/UTF-8"
|
|
"de_DE.UTF-8/UTF-8"
|
|
"pt_BR.UTF-8/UTF-8"
|
|
"ja_JP.UTF-8/UTF-8"
|
|
"zh_CN.UTF-8/UTF-8"
|
|
"ko_KR.UTF-8/UTF-8"
|
|
"ru_RU.UTF-8/UTF-8"
|
|
"ar_SA.UTF-8/UTF-8"
|
|
"hi_IN/UTF-8"
|
|
];
|
|
|
|
# ── Desktop ────────────────────────────────────────────────
|
|
services.displayManager.gdm.enable = true;
|
|
services.displayManager.gdm.autoSuspend = false;
|
|
services.desktopManager.gnome.enable = true;
|
|
services.printing.enable = true;
|
|
systemd.enableEmergencyMode = false;
|
|
environment.gnome.excludePackages = [ pkgs.gnome-tour ];
|
|
security.pam.services.gdm-password.enableGnomeKeyring = true;
|
|
security.pam.services.gdm-autologin.enableGnomeKeyring = true;
|
|
|
|
# Declaratively guarantee the GNOME Keyring default pointer exists.
|
|
# Defining the full path ensures root doesn't accidentally lock the user out of .local
|
|
systemd.tmpfiles.rules = [
|
|
"d /home/free/.local 0700 free users -"
|
|
"d /home/free/.local/share 0700 free users -"
|
|
"d /home/free/.local/share/keyrings 0700 free users -"
|
|
"f /home/free/.local/share/keyrings/default 0600 free users - login\n"
|
|
];
|
|
|
|
|
|
# ── Audio ──────────────────────────────────────────────────
|
|
services.pulseaudio.enable = false;
|
|
security.rtkit.enable = true;
|
|
services.pipewire = {
|
|
enable = true;
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
pulse.enable = true;
|
|
};
|
|
|
|
# ── Users ──────────────────────────────────────────────────
|
|
users.users.free = {
|
|
isNormalUser = true;
|
|
description = "free";
|
|
extraGroups = [ "networkmanager" ];
|
|
};
|
|
|
|
services.displayManager.autoLogin.enable = false;
|
|
|
|
# ── Flatpak ────────────────────────────────────────────────
|
|
services.flatpak.enable = true;
|
|
systemd.services.flatpak-repo = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" "nss-lookup.target" ];
|
|
wants = [ "network-online.target" "nss-lookup.target" ];
|
|
path = [ pkgs.flatpak ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
Restart = "on-failure";
|
|
RestartSec = "15s";
|
|
};
|
|
unitConfig = {
|
|
StartLimitIntervalSec = 120;
|
|
StartLimitBurst = 5;
|
|
};
|
|
script = ''
|
|
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
|
|
'';
|
|
};
|
|
|
|
# ── Packages ───────────────────────────────────────────────
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
nftables
|
|
git wget fish htop btop
|
|
gnomeExtensions.transparent-top-bar-adjustable-transparency
|
|
gnomeExtensions.dash-to-dock
|
|
gnomeExtensions.vitals
|
|
gnomeExtensions.pop-shell
|
|
gnomeExtensions.just-perfection
|
|
gnomeExtensions.appindicator
|
|
gnomeExtensions.date-menu-formatter
|
|
gnome-tweaks papirus-icon-theme
|
|
ranger fastfetch gedit openssl pwgen
|
|
aspell aspellDicts.en lm_sensors
|
|
hunspell hunspellDicts.en_US
|
|
synadm brave-origin dua
|
|
gparted pv unzip parted screen zenity
|
|
libargon2 gnome-terminal libreoffice-stable
|
|
dig firefox wp-cli axel
|
|
lk-jwt-service livekit-libwebrtc livekit
|
|
matrix-synapse age onlyoffice-desktopeditors
|
|
tor-browser
|
|
];
|
|
|
|
# ── Shell ──────────────────────────────────────────────────
|
|
programs.nixvim = {
|
|
enable = true;
|
|
colorschemes.catppuccin.enable = true;
|
|
plugins.lualine.enable = true;
|
|
};
|
|
|
|
programs.bash.promptInit = "fish";
|
|
programs.fish = { enable = true; promptInit = "fastfetch"; };
|
|
|
|
# ── PostgreSQL base ────────────────────────────────────────
|
|
# Shared cluster for Nextcloud (nextclouddb) + Matrix Synapse.
|
|
# Sized for the README's Server + Desktop recommendation (32 GB RAM,
|
|
# 500 GB NVMe OS + 2 TB NVMe timechain). Postgres shares the box with
|
|
# Bitcoin Core, Electrs, LND, MariaDB, PHP-FPM and GNOME, so
|
|
# shared_buffers stays below the 25%-of-RAM dedicated-server rule.
|
|
# Fixes Nextcloud 35 Database checks (pg.cache_hit_ratio,
|
|
# pg.dead_tuples). Override in custom.nix for other hosts, e.g.:
|
|
# services.postgresql.settings.shared_buffers = lib.mkForce "512MB";
|
|
services.postgresql = {
|
|
enable = true;
|
|
authentication = lib.mkForce ''
|
|
local all all trust
|
|
host all all 127.0.0.1/32 trust
|
|
host all all ::1/128 trust
|
|
'';
|
|
settings = {
|
|
# Memory — fixes low buffer cache hit ratio (stock default is
|
|
# 128MB shared_buffers). effective_cache_size is only a planner
|
|
# hint, not an allocation, so it can be generous.
|
|
# NOTE: changing shared_buffers requires a Postgres restart.
|
|
shared_buffers = "2GB";
|
|
effective_cache_size = "12GB";
|
|
maintenance_work_mem = "512MB";
|
|
work_mem = "32MB";
|
|
wal_buffers = "64MB";
|
|
|
|
# Checkpoints — spread write bursts out on NVMe. Reload-only.
|
|
min_wal_size = "1GB";
|
|
max_wal_size = "4GB";
|
|
checkpoint_completion_target = 0.9;
|
|
|
|
# Autovacuum — the stock 60s naptime can't keep up with
|
|
# Nextcloud's and Synapse's write-heavy tables (filecache,
|
|
# activity, jobs, state). Reload-only.
|
|
autovacuum_naptime = "30s";
|
|
autovacuum_vacuum_scale_factor = 0.05;
|
|
autovacuum_analyze_scale_factor = 0.025;
|
|
autovacuum_max_workers = 4;
|
|
|
|
# NVMe planner assumptions (README: NVMe OS + data disks).
|
|
random_page_cost = "1.1";
|
|
effective_io_concurrency = 200;
|
|
};
|
|
};
|
|
|
|
# ── Backups ────────────────────────────────────────────────
|
|
services.rsnapshot = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
snapshot_root /run/media/Second_Drive/BTCEcoandBackup/NixOS_Snapshot_Backup
|
|
retain hourly 5
|
|
retain daily 5
|
|
backup /home/ localhost/
|
|
backup /var/lib/ localhost/
|
|
backup /etc/nixos/ localhost/
|
|
backup /etc/nix-bitcoin-secrets/ localhost/
|
|
'';
|
|
cronIntervals = {
|
|
daily = "50 21 * * *";
|
|
hourly = "0 * * * *";
|
|
};
|
|
};
|
|
|
|
# ── Cron ───────────────────────────────────────────────────
|
|
# The legacy njalla.sh root cron job has been replaced by the systemd timer
|
|
# defined in modules/core/njalla.nix (sovran-ddns-update.timer). Cron is
|
|
# retained so that rsnapshot and other module-defined cron jobs continue to run.
|
|
|
|
# ── Tor ────────────────────────────────────────────────────
|
|
services.tor = { enable = true; client.enable = true; torsocks.enable = true; };
|
|
|
|
# ── Garbage Collection ─────────────────────────────────────
|
|
nix.gc = { automatic = true; dates = "weekly"; options = "--delete-older-than 7d"; };
|
|
|
|
system.stateVersion = "22.05";
|
|
}
|