Mirror/nix-git
Mirror/nix-git
1
0
Fork 0
mirror of https://codeberg.org/privacy1st/nix-git synced 2025-02-22 10:15:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

MDS

Browse Source
This commit is contained in:
Daniel Langbein 2025-02-15 23:37:39 +01:00
parent d3fc85eb35
commit c91ff0b5e7
Signed by: langfingaz
GPG Key ID: 6C47C753F0823002
8 changed files with 28 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/yodaHedgehog/configuration.nix
View File

@ -43,7 +43,11 @@
# Note: dualstack lite -> No A record for that subdomain! # Note: dualstack lite -> No A record for that subdomain!
yoda.netcup-dns = ../../secrets/netcup-dns-hedgehog.json; yoda.netcup-dns = ../../secrets/netcup-dns-hedgehog.json;
boot.kernelParams = []; boot.kernelParams = [
# If the CPU is vulnerable, enable all available mitigations
# except `nosmt` as we don't run any VMs on this machine.
"mds=full"
];
boot.kernelPackages = pkgs.linuxPackages; boot.kernelPackages = pkgs.linuxPackages;
# Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release. # Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release.

2
hosts/yodaNas/configuration.nix
View File

@ -48,6 +48,8 @@
yoda.netcup-dns = ../../secrets/netcup-dns-nas.json; yoda.netcup-dns = ../../secrets/netcup-dns-nas.json;
boot.kernelParams = [ boot.kernelParams = [
# If the CPU is vulnerable, enable all available mitigations.
#
# Microarchitectural Data Sampling (MDS), see https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#mitigation-control-on-the-kernel-command-line # Microarchitectural Data Sampling (MDS), see https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#mitigation-control-on-the-kernel-command-line
"mds=full,nosmt" "mds=full,nosmt"
]; ];

12
hosts/yodaTab/configuration.nix
View File

@ -35,7 +35,7 @@
../../modules/uni-vpn.nix ../../modules/uni-vpn.nix
#../../modules/epa.nix #../../modules/epa.nix
../../modules/autostart.nix #../../modules/autostart.nix
# #
# Development # Development
@ -50,11 +50,6 @@
#../../modules/vscodium.nix #../../modules/vscodium.nix
#../../modules/android.nix #../../modules/android.nix
#../../modules/pmbootstrap.nix #../../modules/pmbootstrap.nix
#../../modules/boxes.nix
#../../modules/virtualbox.nix
../../modules/docker.nix
#../../modules/docker-pushrm.nix
]; ];
networking.hostName = "yodaTab"; networking.hostName = "yodaTab";
@ -73,6 +68,11 @@
# Motivation behind bare bones systemd-based initrd: https://github.com/NixOS/nixpkgs/pull/164943 # Motivation behind bare bones systemd-based initrd: https://github.com/NixOS/nixpkgs/pull/164943
#boot.initrd.systemd.enable = true; #boot.initrd.systemd.enable = true;
boot.kernelParams = [
# If the CPU is vulnerable, enable all available mitigations
# except `nosmt` as we don't run any VMs on this machine.
"mds=full"
];
boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelPackages = pkgs.linuxPackages_latest;
# Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release. # Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release.

13
hosts/yodaTux/host-specific.nix
View File

@ -5,9 +5,16 @@
yoda.btrfsFileSystems = ["/"]; yoda.btrfsFileSystems = ["/"];
#yoda.btrfsMounts = yoda.btrfsFileSystems; #yoda.btrfsMounts = yoda.btrfsFileSystems;
# Systemd Journal entry: boot.kernelParams = [
# S Sat Sep 23 16:11:52 2023 p4 kernel: TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. # If the CPU is vulnerable, enable all available mitigations.
boot.kernelParams = [ "tsc=unstable" ]; #
# Microarchitectural Data Sampling (MDS), see https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#mitigation-control-on-the-kernel-command-line
"mds=full,nosmt"
# Systemd Journal entry:
# TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'.
#"tsc=unstable"
];
# Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release. # Most users should never change this value after the initial install, for any reason, even if you've upgraded your system to a new NixOS release.
system.stateVersion = "23.05"; system.stateVersion = "23.05";

4
hosts/yodaTuxHeadless/configuration.nix
View File

@ -1,8 +1,8 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ {
imports = [ imports = [
./hardware-configuration.nix ../yodaTux/hardware-configuration.nix
./host-specific.nix ../yodaTux/host-specific.nix
#../../modules/tuxedo-rs.nix #../../modules/tuxedo-rs.nix
#../../modules/gpu-amd.nix #../../modules/gpu-amd.nix

1
hosts/yodaTuxHeadless/hardware-configuration.nix
View File

@ -1 +0,0 @@
../yodaTux/hardware-configuration.nix

1
hosts/yodaTuxHeadless/host-specific.nix
View File

@ -1 +0,0 @@
../yodaTux/host-specific.nix

5
hosts/yodaYoga/configuration.nix
View File

@ -26,8 +26,9 @@
#yoda.btrfsMounts = yoda.btrfsFileSystems; #yoda.btrfsMounts = yoda.btrfsFileSystems;
boot.kernelParams = [ boot.kernelParams = [
# Microarchitectural Data Sampling (MDS), see https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#mitigation-control-on-the-kernel-command-line # If the CPU is vulnerable, enable all available mitigations
"mds=full,nosmt" # except `nosmt` as we don't run any VMs on this machine.
"mds=full"
]; ];
boot.kernelPackages = pkgs.linuxPackages; boot.kernelPackages = pkgs.linuxPackages;