From 28efe6189bc2aa09927285c2eae869188edadca8 Mon Sep 17 00:00:00 2001
From: gigirassy <gigirassy@noreply.codeberg.org>
Date: Sun, 16 Nov 2025 20:22:03 +0100
Subject: [PATCH] Update nixos/configuration.nix

---
 nixos/configuration.nix | 88 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 74 insertions(+), 14 deletions(-)

diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index 8e3c42b..041cb70 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -1,10 +1,13 @@
 { config, pkgs, lib, ... }: {
 
+  boot.kernel.sysctl."net.core.rmem_max" = 16777216;
+  boot.kernel.sysctl."net.core.wmem_max" = 16777216;
+
   imports = [
     ./hardware-configuration.nix
     ./networking.nix # generated at runtime by nixos-infect
-    ./modules/smart-ipv6-rotator.nix # ipv6 rotator
-    ./modules/watchdog.nix # anubis watchdog to auto-report to abuseipdb
+    ./modules/smart-ipv6-rotator.nix
+    ./modules/watchdog.nix
   ];
 
   environment.systemPackages = with pkgs; [
@@ -43,6 +46,8 @@
 
   programs.starship.enable = true;
 
+  environment.memoryAllocator.provider = "jemalloc";
+
   # enable sudo; keep password requirement by default
   security.sudo.enable = true;
   security.sudo.wheelNeedsPassword = true;
@@ -52,6 +57,7 @@
     capacity = 50;
   };
 
+  services.irqbalance.enable = true;
 
   services.yggdrasil = {
     enable = true;
@@ -82,7 +88,7 @@
     enableIPv4 = true;
     port = 35252;
     address = "91.98.126.143" ;
-    enableIPv6 = true;    # if you don't have IPv6, leave false
+    enableIPv6 = true;    # if you don’t have IPv6, leave false
     ifname = "eth0";       # change to your interface
     bandwidth = 1000;       # limit to 500 KB/s (≈ 4 Mb/s)
     share = 50;            # allocate 50% of that to transit
@@ -105,14 +111,52 @@
     sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
   };
 
-  services.cron = {
-    enable = true;
-    systemCronJobs = [
-      "* * * * * /root/trafficgen.sh >> /var/log/generate_traffic_png.log 2>&1"
-      "0 */6 * * *  docker restart instafix_proxy"
-      "0 */12 * * *  docker system prune -a -f"
-      "0 */1 * * * /bin/bash -lc 'for i in {1..10}; do [ -d /srv/arti$i/cache/dir_blobs ] && find /srv/arti$i/cache/dir_blobs -mindepth 1 -maxdepth 1 -exec rm -rf {} +; done'" # clear redlib cache
-    ];
+
+  systemd.services.ipfs_restart = {
+    description = "Restart ipfs docker container";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.docker}/bin/docker restart ipfs-ipfs-1";
+    };
+  };
+
+  systemd.timers.ipfs_restart = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      # run roughly every 6 hours after previous run
+      OnUnitActiveSec = "6h";
+      Persistent = true;
+    };
+  };
+
+  systemd.services.instafix_proxy_restart = {
+    description = "Restart instafix_proxy docker container";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.docker}/bin/docker restart instafix_proxy";
+    };
+  };
+
+  systemd.timers.instafix_proxy_restart = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      # run roughly every 6 hours after previous run
+      OnUnitActiveSec = "6h";
+      Persistent = true;
+    };
+  };
+
+  systemd.services.docker_system_prune = {
+    description = "Prune docker system";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.docker}/bin/docker system prune -a -f";
+    };
+  };
+
+  systemd.timers.docker_system_prune = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = { OnUnitActiveSec = "12h"; Persistent = true; };
   };
 
   services.caddy = {
@@ -131,6 +175,9 @@
     virtualHosts."small.blitzw.in".extraConfig = ''
       reverse_proxy localhost:5084
     '';
+    virtualHosts."rimgo.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:43000
+    '';
     virtualHosts."pinata.blitzw.in".extraConfig = ''
       reverse_proxy localhost:4100
     '';
@@ -171,7 +218,7 @@
      }
     '';
     virtualHosts."pin.blitzw.in".extraConfig= ''
-      reverse_proxy localhost:6600
+      redir https://pinata.blitzw.in
     '';
     virtualHosts."search.blitzw.in".extraConfig = ''
       reverse_proxy localhost:24999
@@ -180,7 +227,7 @@
       reverse_proxy localhost:8109
     '';
     virtualHosts."twitch.blitzw.in".extraConfig = ''
-      reverse_proxy localhost:5600
+      respond "404 Not Found" 404
     '';
     virtualHosts."moz.blitzw.in".extraConfig = ''
       reverse_proxy localhost:3012
@@ -261,9 +308,22 @@ services.journald.extraConfig = ''
 '';
 
 # ensure journals are flushed from /run to /var on shutdown so persistence works
-systemd.services.systemd-journal-flush.enable = true;
+  systemd.services.systemd-journal-flush.enable = true;
 
   virtualisation.docker.enable = true;
+
+  virtualisation.docker.daemon.settings = {
+    ipv6 = true;
+    # Pick an IPv6 subnet for your containers; e.g. fd00::/80 or something from your network
+    fixed-cidr-v6 = "fd00:dead:beef::/80";
+    # Optionally, configure default address pools to include both IPv4 and IPv6
+    default-address-pools = [
+      { base = "172.17.0.0/12"; size = 24; }            # IPv4 pool
+      { base = "10.10.0.0/16"; size = 24; }      # optional extra pool (more /24s)
+      { base = "fd00:dead:beef::/48"; size = 64; }       # IPv6 pool — adjust prefix & size as needed
+    ];
+  };
+
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
   networking.hostName = "hooligan";