first commit

serv-01-baselinux/files/etc/sysctl.d/999-tweaks.conf

@@ -0,0 +1,90 @@
+
+# ===== Memory Management =====
+
+# Reduce swappiness to avoid swapping until really necessary
+vm.swappiness = 10
+
+# Increase max read/write I/O requests (helps with I/O-heavy VMs)
+vm.max_map_count = 262144
+
+# Don't overcommit memory aggressively
+vm.overcommit_memory = 1
+vm.overcommit_ratio = 80
+
+# Enable process memory reclaiming
+vm.dirty_ratio = 15
+vm.dirty_background_ratio = 5
+
+# ===== File System & Descriptors =====
+
+# Allow more open file handles (important for services handling many files/connections)
+fs.file-max = 2097152
+
+# ===== Networking: Buffers =====
+
+# Increase network buffer space (for high-throughput applications)
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+net.core.rmem_default = 262144
+net.core.wmem_default = 262144
+
+# Increase backlog queues
+net.core.netdev_max_backlog = 5000
+net.core.somaxconn = 1024
+
+# ===== Networking: TCP Tweaks =====
+
+# Enable TCP SYN cookies to prevent SYN flood DoS attacks
+net.ipv4.tcp_syncookies = 1
+
+# Reduce FIN timeout to clean up closed connections faster
+net.ipv4.tcp_fin_timeout = 15
+
+# Enable TCP keepalive probes more aggressively
+net.ipv4.tcp_keepalive_time = 300
+net.ipv4.tcp_keepalive_intvl = 60
+net.ipv4.tcp_keepalive_probes = 5
+
+# Reduce time-wait connections held
+net.ipv4.tcp_max_tw_buckets = 2000000
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_tw_recycle = 0
+
+# Increase TCP buffer limits
+net.ipv4.tcp_rmem = 4096 87380 16777216
+net.ipv4.tcp_wmem = 4096 65536 16777216
+
+# ===== Networking: Connection Tracking =====
+
+# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections)
+net.netfilter.nf_conntrack_max = 262144
+
+# ===== Security & Routing =====
+
+# Disable IP source routing
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+# Disable ICMP redirects (security & performance)
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+
+# Do not send ICMP redirects (we are not a router)
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
+# Enable Reverse Path Filterin
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+
+# ===== Performance =====
+
+# Avoid using swap too eagerly under memory pressure
+vm.min_free_kbytes = 65536
+
+# ===== IPv6 Tuning (disable if unused) =====
+
+# Uncomment if IPv6 is not used
+# net.ipv6.conf.all.disable_ipv6 = 1
+# net.ipv6.conf.default.disable_ipv6 = 1
+