# ===== Memory Management =====

# Reduce swappiness to avoid swapping until really necessary
vm.swappiness = 10

# Increase max read/write I/O requests (helps with I/O-heavy VMs)
vm.max_map_count = 262144

# Don't overcommit memory aggressively
vm.overcommit_memory = 1
vm.overcommit_ratio = 80

# Enable process memory reclaiming
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# ===== File System & Descriptors =====

# Allow more open file handles (important for services handling many files/connections)
fs.file-max = 2097152

# ===== Networking: Buffers =====

# Increase network buffer space (for high-throughput applications)
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144

# Increase backlog queues
net.core.netdev_max_backlog = 5000
net.core.somaxconn = 1024

# ===== Networking: TCP Tweaks =====

# Enable TCP SYN cookies to prevent SYN flood DoS attacks
net.ipv4.tcp_syncookies = 1

# Reduce FIN timeout to clean up closed connections faster
net.ipv4.tcp_fin_timeout = 15

# Enable TCP keepalive probes more aggressively
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 5

# Reduce time-wait connections held
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0

# Increase TCP buffer limits
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# ===== Networking: Connection Tracking =====

# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections)
net.netfilter.nf_conntrack_max = 262144

# ===== Security & Routing =====

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Disable ICMP redirects (security & performance)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable Reverse Path Filterin
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# ===== Performance =====

# Avoid using swap too eagerly under memory pressure
vm.min_free_kbytes = 65536

# ===== IPv6 Tuning (disable if unused) =====

# Uncomment if IPv6 is not used
# net.ipv6.conf.all.disable_ipv6 = 1
# net.ipv6.conf.default.disable_ipv6 = 1