# Unattended-buildbox failsafe. Nobody can press reset on these machines.
# Installed to /etc/sysctl.d/99-buildbox-failsafe.conf by host-config/apply.sh.

# A panicked kernel must reboot itself, not sit at a dead console.
kernel.panic = 20

# An oops leaves the kernel in an undefined state; on a headless box that is a
# slow wedge. Turn it into the reboot above.
kernel.panic_on_oops = 1

# The OOM killer must keep shedding load. Panicking on OOM would turn every
# capped-cgroup kill into a reboot.
vm.panic_on_oom = 0

# Full sysrq: bit 0x40 (signal/oom-kill a process) and 0x80 (sync+reboot) are the
# last-resort rescue path from a session that still has a shell.
kernel.sysrq = 1

# Swap is the wedge. Reclaim anonymous pages late.
vm.swappiness = 10

# sshd binds ListenAddress <tailnet-ip>, and tailscale0 does not exist yet when
# ssh.service starts on a cold boot — the bind fails and the box comes up with no
# rescue path at all. Non-local bind lets sshd claim the address before the
# interface carries it, which is what keepalived and HAProxy do with a VIP.
net.ipv4.ip_nonlocal_bind = 1
net.ipv6.ip_nonlocal_bind = 1
