limits.nix

{ # Limits
  # We increase to inotify limits since the defaults are easily exceeded.
  boot.kernel.sysctl = {
    "fs.inotify.max_user_instances" = 4096;
    "fs.inotify.max_user_watches" = 524288;
  };

  # Be very generous with resource restrictions.
  # Should be lower than the value defined in /proc/sys/fs/file-max.
  # The domain * excludes root, so we need repeat it for root.
  security.pam.loginLimits =
    flip concatMap [ "*" "root" ] (domain:
    flip concatMap [ "nproc" "nofile" ] (item:
    flip       map [ "soft" "hard" ] (type:
      { inherit domain; inherit item; inherit type; value = "65536"; }
    )));
}