SilverSight/deploy/netcup-rs1000/configuration.nix

{ config, pkgs, lib, ... }:

{
  imports = [ ./hardware-configuration.nix ];

  ### ——————————————————————————————————
  # BOOT: GRUB for DOS/MBR (no UEFI)
  ### ——————————————————————————————————
  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/vda";
  boot.loader.timeout = 3;

  ### ——————————————————————————————————
  # KERNEL — EPYC Turin (Zen 5) tuning
  ### ——————————————————————————————————
  boot.kernelParams = [
    # AMD active-state power management (Zen 4/5 native driver)
    "amd_pstate=active"
    # Limit C-states for lower-latency compute (C1 is fine; C6+ hurts)
    "processor.max_cstate=1"
    # No NUMA balancing — single NUMA node, pure overhead
    "numa_balancing=disable"
    # Use halt for idle (consistent with max_cstate=1)
    "idle=halt"
    # 512 × 2MB hugepages = 1GB pre-allocated for Lean/Numerics
    "hugepages=512"
  ];
  # Force performance governor across all CPUs
  powerManagement.cpuFreqGovernor = "performance";
  # Disable CPU turbo control (let amd_pstate manage it)
  powerManagement.cpufreq.max = null;

  ### ——————————————————————————————————
  # FILESYSTEM — BTRFS tuning
  ### ——————————————————————————————————
  fileSystems."/" = {
    device = "/dev/disk/by-uuid/56d4ce73-8a85-4bcb-ad93-d2fd23a29c0a";
    fsType = "btrfs";
    options = [ "noatime" "compress=zstd:3" "discard=async" "space_cache=v2" ];
  };
  fileSystems."/home" = {
    device = "/dev/disk/by-uuid/56d4ce73-8a85-4bcb-ad93-d2fd23a29c0a";
    fsType = "btrfs";
    options = [ "noatime" "compress=zstd:3" "subvol=home" ];
  };
  fileSystems."/nix" = {
    device = "/dev/disk/by-uuid/56d4ce73-8a85-4bcb-ad93-d2fd23a29c0a";
    fsType = "btrfs";
    options = [ "noatime" "compress=zstd:3" "subvol=nix" ];
  };

  ### ——————————————————————————————————
  # VM / MEMORY tuning
  ### ——————————————————————————————————
  boot.kernel.sysctl = {
    # Swappiness near zero — we have 8GB RAM for compute; avoid swap
    "vm.swappiness" = 10;
    # Keep more dentries/inodes in cache
    "vm.vfs_cache_pressure" = 50;
    # Reduce dirty page writeback latency (250ms → 50ms)
    "vm.dirty_expire_centisecs" = 500;
    # Background dirty ratio — start writeback at 5%
    "vm.dirty_background_ratio" = 5;
    # Max dirty before blocking writers
    "vm.dirty_ratio" = 30;
  };

  ### ——————————————————————————————————
  # HARDWARE ACCELERATION — virtio-gpu / Vulkan / DMA
  ### ——————————————————————————————————
  hardware.opengl = {
    enable = true;
    driSupport = true;
    extraPackets = with pkgs; [ vaapiVirtio ];
  };
  hardware.amdgpu.amdvlk = false;  # no discrete AMD GPU; use Mesa
  # Vulkan ICDs for virtio-gpu + software fallback
  environment.sessionVariables = {
    VK_ICD_FILENAMES = "/run/opengl-driver/share/vulkan/icd.d/virtio_icd.x86_64.json:/run/opengl-driver/share/vulkan/icd.d/lvp_icd.x86_64.json";
  };

  ### ——————————————————————————————————
  # NETWORKING
  ### ——————————————————————————————————
  networking.hostName = "neon-rs1000";
  networking.useDHCP = true;
  # Tailscale mesh
  services.tailscale.enable = true;

  ### ——————————————————————————————————
  # SSH
  ### ——————————————————————————————————
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      PasswordAuthentication = true;
      KbdInteractiveAuthentication = true;
    };
  };

  ### ——————————————————————————————————
  # USERS
  ### ——————————————————————————————————
  users.users.allaun = {
    isNormalUser = true;
    extraGroups = [ "wheel" "video" "render" "dialout" ];
    hashedPassword = "$y$j9T$qu04kyhkEnkRx7oUsmAn01$u/lRdw24udCtKLn3HKKT1H1P3TUGjZuQ/ShO7F3hHK4";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMSxu9u0cJUbDQ/mhOPzaLunWp90pK/ZFteUsK/Z+dn neon-rs1000-deploy"
    ];
  };
  users.mutableUsers = false;  # purely declarative users
  security.sudo.wheelNeedsPassword = false;

  ### ——————————————————————————————————
  # NIX BUILD OPTIMIZATION
  ### ——————————————————————————————————
  nix = {
    settings = {
      max-jobs = 4;
      cores = 4;
      min-free = 1 * 1024 * 1024 * 1024;  # 1 GB free disk minimum
      keep-derivations = true;
      keep-outputs = true;
      experimental-features = [ "nix-command" "flakes" ];
    };
    # Optimize Nix store for EPYC — use all cores for builds
    extraOptions = ''
      builders-use-substitutes = true
    '';
  };

  ### ——————————————————————————————————
  # SYSTEM PACKAGES — EPYC-optimized toolchain
  ### ——————————————————————————————————
  environment.systemPackages = with pkgs; [
    # Core tools
    vim git curl wget htop iotop btop ripgrep fd jq gnused
    # C/C++ toolchain (GCC 14 with znver5 support)
    gcc14 gnumake cmake pkg-config
    gcc14.cc.lib  # libgcc_s
    # Rust toolchain
    rustup cargo
    # Python data stack
    python3Full python3Packages.pip python3Packages.numpy python3Packages.scipy
    python3Packages.numba python3Packages.rich
    # Julia
    julia-bin
    # R
    R
    # Lean 4
    z3
    # Performance analysis
    perf-tools linuxPackages.perf cpuid numactl
    # GPU / Vulkan stack (virtio-gpu DMA path)
    mesa vulkan-tools vulkan-loader libva vaapiVirtio
    virglrenderer
    # Compression (zstd already installed)
    lz4 xz bzip2 gzip pigz pbzip2
  ];

  ### ——————————————————————————————————
  # ENVIRONMENT — EPYC-optimized defaults
  ### ——————————————————————————————————
  environment.variables = {
    # GCC optimization for AMD Zen 5
    CFLAGS = "-march=znver5 -O3 -flto -funroll-loops";
    CXXFLAGS = "-march=znver5 -O3 -flto -funroll-loops";
    FFLAGS = "-march=znver5 -O3 -flto -funroll-loops";
    FCFLAGS = "-march=znver5 -O3 -flto -funroll-loops";
    LDFLAGS = "-flto";
    # Rust: use all native features
    RUSTFLAGS = "-C target-cpu=native -C opt-level=3 -C lto=fat";
    # Julia: use all threads
    JULIA_NUM_THREADS = "4";
    # OpenMP
    OMP_NUM_THREADS = "4";
    OMP_PROC_BIND = "true";
    OMP_PLACES = "cores";
    # Malloc tuning for EPYC
    GLIBC_TUNABLES = "glibc.cpu.optimized_memset=true:glibc.cpu.optimized_memcpy=true:glibc.pthread.rseq=1";
  };

  system.stateVersion = "24.11";
}