# System Administration — Configuration Templates

## Kernel Parameters (`/etc/sysctl.d/99-hermes.conf`)
```
vm.swappiness=10          # Reduce swap thrashing (server workload)
vm.vfs_cache_pressure=50  # Prefer caching dentries/inodes
vm.dirty_ratio=10         # Write back dirty pages earlier
vm.dirty_background_ratio=5
net.core.somaxconn=65535  # Better connection handling
vm.max_map_count=1048576  # Required for LLM model loading
vm.overcommit_memory=1    # Required for llama.cpp mmap
```
Apply: `sudo sysctl -p /etc/sysctl.d/99-hermes.conf`

**CachyOS note:** ZRAM with swappiness=150 is intentional — don't reset to 10.

## NVMe Scheduler
```bash
echo none | sudo tee /sys/block/nvme0n1/queue/scheduler
# Persist:
echo 'ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none"' | sudo tee /etc/udev/rules.d/60-iosched.rules
```

## Journal Log Limits (`/etc/systemd/journald.conf`)
```
SystemMaxUse=100M
MaxRetentionSec=7day
```
Apply: `sudo systemctl restart systemd-journald`

## Docker Daemon Hardening (`/etc/docker/daemon.json`)
```json
{
    "live-restore": true,
    "no-new-privileges": true,
    "icc": false,
    "userland-proxy": false,
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "10m",
        "max-file": "3"
    }
}
```

## PostgreSQL Tuning (64GB RAM)
```
shared_buffers = 16GB
effective_cache_size = 48GB
maintenance_work_mem = 2GB
random_page_cost = 1.1     # NVMe
effective_io_concurrency = 200
work_mem = 32MB
```
Write to `/etc/postgresql/<version>/main/conf.d/pgtune.conf`.

## Redis Tuning
```
maxmemory 4gb
maxmemory-policy allkeys-lru
```

## Nginx Security Headers
```nginx
add_header X-Frame-Options 'SAMEORIGIN' always;
add_header X-Content-Type-Options 'nosniff' always;
add_header X-XSS-Protection '1; mode=block' always;
add_header Referrer-Policy 'no-referrer' always;
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains' always;
```

## Firewall (UFW)
```bash
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP (if needed)
sudo ufw --force enable
```

For a server behind Tailscale:
```bash
sudo ufw allow in on lo
sudo ufw allow in on tailscale0
sudo ufw allow from 192.168.1.0/24
```

## SSH Hardening
```bash
sudo sed -i 's/^#\?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl reload sshd
```

## Fail2ban
```bash
sudo fail2ban-client set sshd enable
sudo systemctl enable fail2ban
```

## Unused Drive Detection
```bash
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT,LABEL,MODEL
sudo fdisk -l /dev/nvme1n1 2>/dev/null
sudo blkid /dev/nvme1n1* 2>/dev/null
```