# ---------------------------------------------------------
# General System & Kernel Settings
# ---------------------------------------------------------
# Reboot 10 seconds after a kernel panic
kernel.panic = 10
# Randomize stack, virtual dynamic shared object (VDSO) page, and shared memory region
kernel.randomize_va_space = 2
# Restrict access to kernel logs
kernel.dmesg_restrict = 1

# ---------------------------------------------------------
# Networking: Security and Hardening
# ---------------------------------------------------------
# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1
# Disable IP source routing (prevents spoofing)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Enable Reverse Path Filtering (prevents IP spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Log suspicious packets (spoofed, source routed, redirects)
net.ipv4.conf.all.log_martians = 1
# Disable ICMP redirects (prevents MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# ---------------------------------------------------------
# Networking: Performance Tuning
# ---------------------------------------------------------
# Increase maximum number of open files
fs.file-max = 2097152
# Increase the maximum number of connections tracked
net.core.somaxconn = 4096
# Increase TCP buffer sizes for high-speed networks
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
# Enable BBR congestion control (improves throughput on lossy links)
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# ---------------------------------------------------------
# Virtual Memory (VM) Tuning
# ---------------------------------------------------------
# Reduce swap usage (default is often 60)
vm.swappiness = 10
# Minimum free RAM to keep available
vm.min_free_kbytes = 65536