qos-profiles/README.md

qos-profiles

Default qdisc and TCP congestion control per machine role, plus optional per-interface qdiscs (cake, with ifb for inbound traffic).

Roles

Install exactly one role subpackage:

Subpackage	default_qdisc	congestion control	cake NAT	Use for
qos-profiles-server	fq	bbr	no	bare-metal servers without guests, VM guests
qos-profiles-vmhost	fq_codel	bbr	no	hypervisors, container hosts
qos-profiles-router	fq_codel	cubic	yes	routers
qos-profiles-desktop	fq_codel	cubic	no	workstations

The sysctl file is /usr/lib/sysctl.d/60-qos-profiles-<role>.conf; override it in /etc/sysctl.d/. default_qdisc only applies to interfaces created after it is set, so reboot after installing or switching roles. Congestion control is system-wide (or per route), not per interface.

Per-interface qdiscs

Needs the qos-profiles package; the role packages don't pull it in. Create /etc/qos-profiles/<iface>.conf, see /usr/share/qos-profiles/example.conf for all variables and /usr/share/qos-profiles/examples/ for ready-made setups:

Example	Setup
defaults.conf	site-wide /etc/qos-profiles/defaults.conf
vmhost-routed-uplink.conf	VM host, guests routed via the host uplink (EVPN)
vmhost-egress-only.conf	VM host, outbound fairness only at NIC line rate
vmhost-nat-guests.conf	VM/container host with masqueraded guests
ovh-public.conf	dual-NIC dedicated server, public NIC
ovh-vrack-private.conf	private NIC capped by the provider, outbound only
dc-router-transit.conf	datacenter router, transit uplink, no NAT
router-ftth.conf	fibre with Ethernet handoff, NAT
router-vdsl-pppoe.conf	VDSL2 with PPPoE on ppp0, NAT, ACK filtering
router-docsis.conf	cable, NAT, ACK filtering
backup-nic-raw.conf	raw fq qdisc with a per-flow cap instead of cake

Minimal example:

LINK_RATE=1gbit

This shapes both directions to 95% of the link rate with cake. Outbound, traffic is shared per source host and DiffServ classes are applied (diffserv4). Inbound, traffic is shared per destination host, DSCP marks are ignored (besteffort) and cleared (wash), since they come from the internet. EGRESS_SHAPE_PERCENT and INGRESS_SHAPE_PERCENT set the percentage per direction.

Configuration is read in order, later overriding earlier:

1. /usr/lib/qos-profiles/role-<role>.conf — installed role package
2. /etc/qos-profiles/defaults.conf — site-wide
3. /etc/qos-profiles/<iface>.conf — the interface

It is applied by either:

• qos-profiles-networkmanager (installed automatically with NetworkManager) when NetworkManager brings the interface up, or
• systemctl enable --now qos-profiles@<iface> for interfaces NetworkManager doesn't manage. It runs whenever the device appears.

Both may be active; they're serialised and idempotent. To apply changes run systemctl restart qos-profiles@<iface> or /usr/libexec/qos-profiles/qos-apply start <iface>. Stopping restores the default qdisc and removes the ifb device.

Inbound shaping replaces any existing clsact qdisc on the interface (and its tc/BPF filters).

DiffServ

diffserv4 sorts outbound packets by DSCP into bulk (CS1), best effort, video (AF4x, CS3, ...) and voice (EF, CS6, ...). Higher classes get priority only up to a share of the rate, so they can't starve the others. Marking backup or replication traffic CS1 (e.g. nftables ip dscp set cs1) makes it yield to everything else.

Topologies

• VM host, VMs routed via the host uplink (EVPN anycast gateway): cake on the uplink NIC gives each guest an equal share. VXLAN-encapsulated traffic on the same NIC is seen by its outer header (the VTEP address), so it shares as a single host.
• VM host, VMs bridged to a switch, routing elsewhere: the WAN bottleneck is at the router; put cake on the router WAN (qos-profiles-router). The host only needs the role package.
• Host with separate public and private NICs: configure the public NIC only.
• Bond or VLAN uplink: these devices have no queue of their own; put cake on the physical NIC, or set a rate explicitly.