From 485b06a37613b0a070eca9eac5573210bc3cc54a Mon Sep 17 00:00:00 2001
From: DavHau <hsngrmpf+github@gmail.com>
Date: Tue, 17 Jun 2025 18:44:41 +0700
Subject: [PATCH] nixos/sysctl: sane inotify defaults globally

Currently, sane inotify limits are only set when graphical-desktop is enabled, but inotify is also used on servers by non-graphical applications
---
 nixos/modules/config/sysctl.nix               | 21 +++++++++++++------
 .../services/misc/graphical-desktop.nix       |  8 -------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index 6489b406b2c7..a45fe8d88d56 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -72,12 +72,21 @@ in
       restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
     };
 
-    # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
-    # users as these make it easier to exploit kernel vulnerabilities.
-    boot.kernel.sysctl."kernel.kptr_restrict" = lib.mkDefault 1;
+    # NixOS wide defaults
+    boot.kernel.sysctl = {
+      # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
+      # users as these make it easier to exploit kernel vulnerabilities.
+      "kernel.kptr_restrict" = lib.mkDefault 1;
 
-    # Improve compatibility with applications that allocate
-    # a lot of memory, like modern games
-    boot.kernel.sysctl."vm.max_map_count" = lib.mkDefault 1048576;
+      # Improve compatibility with applications that allocate
+      # a lot of memory, like modern games
+      "vm.max_map_count" = lib.mkDefault 1048576;
+
+      # The default max inotify watches is 8192.
+      # Nowadays most apps require a good number of inotify watches,
+      # the value below is used by default on several other distros.
+      "fs.inotify.max_user_instances" = lib.mkDefault 524288;
+      "fs.inotify.max_user_watches" = lib.mkDefault 524288;
+    };
   };
 }
diff --git a/nixos/modules/services/misc/graphical-desktop.nix b/nixos/modules/services/misc/graphical-desktop.nix
index 7f1e9b39210c..e26050c123de 100644
--- a/nixos/modules/services/misc/graphical-desktop.nix
+++ b/nixos/modules/services/misc/graphical-desktop.nix
@@ -21,14 +21,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    # The default max inotify watches is 8192.
-    # Nowadays most apps require a good number of inotify watches,
-    # the value below is used by default on several other distros.
-    boot.kernel.sysctl = {
-      "fs.inotify.max_user_instances" = lib.mkDefault 524288;
-      "fs.inotify.max_user_watches" = lib.mkDefault 524288;
-    };
-
     environment = {
       # localectl looks into 00-keyboard.conf
       etc."X11/xorg.conf.d/00-keyboard.conf".text = ''