91 lines
2.4 KiB
Plaintext
91 lines
2.4 KiB
Plaintext
|
||
# ===== Memory Management =====
|
||
|
||
# Reduce swappiness to avoid swapping until really necessary
|
||
vm.swappiness = 10
|
||
|
||
# Increase max read/write I/O requests (helps with I/O-heavy VMs)
|
||
vm.max_map_count = 262144
|
||
|
||
# Don't overcommit memory aggressively
|
||
vm.overcommit_memory = 1
|
||
vm.overcommit_ratio = 80
|
||
|
||
# Enable process memory reclaiming
|
||
vm.dirty_ratio = 15
|
||
vm.dirty_background_ratio = 5
|
||
|
||
# ===== File System & Descriptors =====
|
||
|
||
# Allow more open file handles (important for services handling many files/connections)
|
||
fs.file-max = 2097152
|
||
|
||
# ===== Networking: Buffers =====
|
||
|
||
# Increase network buffer space (for high-throughput applications)
|
||
net.core.rmem_max = 16777216
|
||
net.core.wmem_max = 16777216
|
||
net.core.rmem_default = 262144
|
||
net.core.wmem_default = 262144
|
||
|
||
# Increase backlog queues
|
||
net.core.netdev_max_backlog = 5000
|
||
net.core.somaxconn = 1024
|
||
|
||
# ===== Networking: TCP Tweaks =====
|
||
|
||
# Enable TCP SYN cookies to prevent SYN flood DoS attacks
|
||
net.ipv4.tcp_syncookies = 1
|
||
|
||
# Reduce FIN timeout to clean up closed connections faster
|
||
net.ipv4.tcp_fin_timeout = 15
|
||
|
||
# Enable TCP keepalive probes more aggressively
|
||
net.ipv4.tcp_keepalive_time = 300
|
||
net.ipv4.tcp_keepalive_intvl = 60
|
||
net.ipv4.tcp_keepalive_probes = 5
|
||
|
||
# Reduce time-wait connections held
|
||
net.ipv4.tcp_max_tw_buckets = 2000000
|
||
net.ipv4.tcp_tw_reuse = 1
|
||
net.ipv4.tcp_tw_recycle = 0
|
||
|
||
# Increase TCP buffer limits
|
||
net.ipv4.tcp_rmem = 4096 87380 16777216
|
||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
||
|
||
# ===== Networking: Connection Tracking =====
|
||
|
||
# (if conntrack is involved, increase bucket sizes – useful for iptables/nftables with many connections)
|
||
net.netfilter.nf_conntrack_max = 262144
|
||
|
||
# ===== Security & Routing =====
|
||
|
||
# Disable IP source routing
|
||
net.ipv4.conf.all.accept_source_route = 0
|
||
net.ipv4.conf.default.accept_source_route = 0
|
||
|
||
# Disable ICMP redirects (security & performance)
|
||
net.ipv4.conf.all.accept_redirects = 0
|
||
net.ipv4.conf.default.accept_redirects = 0
|
||
|
||
# Do not send ICMP redirects (we are not a router)
|
||
net.ipv4.conf.all.send_redirects = 0
|
||
net.ipv4.conf.default.send_redirects = 0
|
||
|
||
# Enable Reverse Path Filterin
|
||
net.ipv4.conf.all.rp_filter = 1
|
||
net.ipv4.conf.default.rp_filter = 1
|
||
|
||
# ===== Performance =====
|
||
|
||
# Avoid using swap too eagerly under memory pressure
|
||
vm.min_free_kbytes = 65536
|
||
|
||
# ===== IPv6 Tuning (disable if unused) =====
|
||
|
||
# Uncomment if IPv6 is not used
|
||
# net.ipv6.conf.all.disable_ipv6 = 1
|
||
# net.ipv6.conf.default.disable_ipv6 = 1
|
||
|