Shepherd's Blog

在 VMWare 中安装 OpenWrt

发表于 2024-09-26 分类于 openwrt

在安装之前需要准备以下相关文件或软件：

VMWare Workstation
openwrt 固件 (本文使用 DHDAXCW 大佬固件)
StarWind V2V Converter 或其他 P2V 磁盘转换工具

此次安装的目的为使 VMWare 中的虚拟机不用再手动配置魔法，使用 openwrt 网关作到 免配置科学上网 。

阅读全文 »

搭建自托管短链服务

发表于 2024-09-02 更新于 2024-09-26

使用 CloudFlare Pages 替换 Shlink 短链

Logrotate 配置失效

发表于 2024-08-30 更新于 2024-09-26

在使用 logrotate 时，不要将日志文件放在 /usr 路径下，否则定时任务执行时会出现异常，并且在手动执行 logrotate -f 时不会出发该异常。

➜  journalctl -u logrotate.service --since '7 days ago'
Aug 24 00:00:06 local systemd[1]: Starting logrotate.service - Rotate log files...
Aug 24 00:00:06 local logrotate[1975731]: error: error creating output file /usr/local/docker/nginx/log/nginx.log.20240823.gz: Read-only file system
Aug 24 00:00:06 local systemd[1]: logrotate.service: Main process exited, code=exited, status=1/FAILURE
Aug 24 00:00:06 local systemd[1]: logrotate.service: Failed with result 'exit-code'.
Aug 24 00:00:06 local systemd[1]: Failed to start logrotate.service - Rotate log files.
Aug 25 00:00:11 local systemd[1]: Starting logrotate.service - Rotate log files...
Aug 25 00:00:11 local logrotate[2016378]: error: error creating output file /usr/local/docker/nginx/log/nginx.log.20240823.gz: Read-only file system
Aug 25 00:00:11 local systemd[1]: logrotate.service: Main process exited, code=exited, status=1/FAILURE
Aug 25 00:00:11 local systemd[1]: logrotate.service: Failed with result 'exit-code'.
Aug 25 00:00:11 local systemd[1]: Failed to start logrotate.service - Rotate log files.
Aug 26 00:00:19 local systemd[1]: Starting logrotate.service - Rotate log files...
Aug 26 00:00:20 local logrotate[2056792]: error: error creating output file /usr/local/docker/nginx/log/nginx.log.20240823.gz: Read-only file system
Aug 26 00:00:20 local systemd[1]: logrotate.service: Main process exited, code=exited, status=1/FAILURE
Aug 26 00:00:20 local systemd[1]: logrotate.service: Failed with result 'exit-code'.
Aug 26 00:00:20 local systemd[1]: Failed to start logrotate.service - Rotate log files.

logrotate succeeds when manually run as root, but fails with “Read-only file system” when run by logrotate.service

Takes a boolean argument or the special values “full” or “strict”. If true, mounts the /usr and the boot loader directories (/boot and /efi) read-only for processes invoked by this unit. If set to “full”, the /etc directory is mounted read-only, too. If set to “strict” the entire file system hierarchy is mounted read-only, except for the API file system subtrees /dev, /proc and /sys (protect these directories using PrivateDevices=, ProtectKernelTunables=, ProtectControlGroups=). This setting ensures that any modification of the vendor-supplied operating system (and optionally its configuration, and local mounts) is prohibited for the service. It is recommended to enable this setting for all long-running services, unless they are involved with system updates or need to modify the operating system in other ways. If this option is used, ReadWritePaths= may be used to exclude specific directories from being made read-only. This setting is implied if DynamicUser= is set. This setting cannot ensure protection in all cases. In general it has the same limitations as ReadOnlyPaths=, see below. Defaults to off.

TLS 下的 docker 远程连接

发表于 2024-03-18 更新于 2024-09-26 分类于 docker

由于需要使用 docker 远程调试一些程序，所以我开启了云服务器上的远程连接及其端口。因为是处于临时使用，所以我并没有对其进行任何安全加固，于是我在调试完成之后理所当然的忘记了关闭这个端口。我是在几天之后收到云服务商将服务器挖矿的邮件时才恍然大悟，哦，我好像没有关掉 docker 的远程连接，所以在这一段时间，服务器上的 docker 近似处在一种“裸奔”的状态。算起来这是我第二次被攻击，第一次被攻击的是没有密码的 MySQL 。

阅读全文 »

Docker 代理

发表于 2023-11-24 更新于 2024-09-26 分类于 linux ， docker

/etc/docker/daemon.json

{
  "proxies": {
    "http-proxy": "http://proxy.example.com:3128",
    "https-proxy": "https://proxy.example.com:3129",
    "no-proxy": "localhost,127.0.0.0/8,1"
  }
}

Debian 全局代理

发表于 2023-11-24 更新于 2024-09-26 分类于 linux

Linux 的代理主要是依靠 HTTP_PROXY HTTPS_PROXY 等几个全局变量实现。

在 /etc/profile.d 目录下新建 proxy.sh ，开机时会自动运行该目录下文件。

MY_PROXY_URL="<protocol>://<username>:<password>@<address>:<port>"

HTTP_PROXY=$MY_PROXY_URL
HTTPS_PROXY=$MY_PROXY_URL
FTP_PROXY=$MY_PROXY_URL
NO_PROXY=localhost,127.0.0.0/8,10.0.0.0/8,192.168.0.0/16
http_proxy=$MY_PROXY_URL
https_proxy=$MY_PROXY_URL
ftp_proxy=$MY_PROXY_URL
no_proxy=$NO_PROXY

export HTTP_PROXY HTTPS_PROXY FTP_PROXY NO_PROXY http_proxy https_proxy ftp_proxy no_proxy