<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>NAS on Jacob's Thoughts</title><link>https://weixiang.github.io/tags/nas/</link><description>Recent content in NAS on Jacob's Thoughts</description><generator>Hugo -- 0.152.2</generator><language>zh</language><copyright>©2017-2024 Jacob&amp;rsquo;s Thoughts</copyright><lastBuildDate>Wed, 14 Aug 2024 15:26:32 +0800</lastBuildDate><atom:link href="https://weixiang.github.io/tags/nas/index.xml" rel="self" type="application/rss+xml"/><item><title>Tailscale 内网穿透与 Derper 中继节点搭建</title><link>https://weixiang.github.io/posts/tailscale-intranet-penetration-and-derper-construction/</link><pubDate>Wed, 14 Aug 2024 15:26:32 +0800</pubDate><guid>https://weixiang.github.io/posts/tailscale-intranet-penetration-and-derper-construction/</guid><description>Tailscale 是一种基于 Wireguard 的多地组网的软件，他能够实现将多地主机，都聚合在一个虚拟的局域网中，让这些设备之间能够相互访问。所有的节点都直接使用 P 2 P 连接，在一些情况下，速度也很可观。</description><content:encoded><![CDATA[<h2 id="tailscale-部署">Tailscale 部署</h2>
<p>这个没什么好说的，按着官方手册正常进行就好了，有很方便的一键安装程序，安装完之后登录同一个账户即可。</p>
<p><a href="https://tailscale.com/kb/1347/installation">Install Tailscale · Tailscale Docs</a></p>
<p>Linux 使用这个命令即可一键安装：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">curl -fsSL https://tailscale.com/install.sh <span class="p">|</span> sh
</span></span></code></pre></div><p>群晖 DSM 直接进套件中心搜索 Tailscale 即可安装。</p>
<p><img alt="Tailscale 套件" loading="lazy" src="https://jacob-1256058189.cos.ap-guangzhou.myqcloud.com/md/2024/08/4acbdd0e6021ee26dd409edf2ea19fcb.webp"></p>
<p>这里唯一需要注意的地方是，若在国内使用，账号登陆要选择国内可以直连的平台，例如微软或苹果，使用谷歌账号登陆会导致终端无法正常上线，除非可以解决网络问题。</p>
<h2 id="derper-中继节点">Derper 中继节点</h2>
<p>某些网络不佳的情况下，P2P 无法打洞成功，流量将通过 Tailscale 的中继节点，也称为 Derper，进行流量的转发。</p>
<p>但由于 Tailscale 在中国大陆境内并没有中继节点，会导致速度非常缓慢，影响使用体验。</p>
<p>可以通过自己搭建 Derper 节点来解决这个问题。</p>
<p>官方提供也提供了操作手册：</p>
<p><a href="https://tailscale.com/kb/1118/custom-derp-servers/">Custom DERP Servers · Tailscale Docs</a></p>
<h2 id="docker-部署-derper">Docker 部署 Derper</h2>
<p>官方提供的操作手册步骤较为复杂，幸运的是，已经有大佬打包好了 Docker 镜像。</p>
<p><a href="https://github.com/fredliang44/derper-docker">GitHub - fredliang44/derper-docker: tailscale‘s selfhosted derp-server docker image</a></p>
<p>根据文档，我的 Docker 容器配置如下：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="s1">&#39;3.8&#39;</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"></span><span class="nt">services</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">  </span><span class="nt">derper</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">fredliang/derper</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">container_name</span><span class="p">:</span><span class="w"> </span><span class="l">derper</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">restart</span><span class="p">:</span><span class="w"> </span><span class="l">always</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">environment</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_CERT_MODE=manual </span><span class="w"> </span><span class="c"># 手动设置证书</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_ADDR=:13477 </span><span class="w"> </span><span class="c"># 中转端口</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_HTTP_PORT=13476 </span><span class="w"> </span><span class="c"># 用不到也可以填入 -1 关闭 HTTP 服务</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_STUN_PORT=13478 </span><span class="w"> </span><span class="c"># STUN 打洞端口</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_DOMAIN=derper.example.com </span><span class="w"> </span><span class="c"># 服务器域名</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">DERP_VERIFY_CLIENTS=true </span><span class="w"> </span><span class="c"># 验证客户端身份，防止白嫖</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">ports</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="s2">&#34;13477:13477&#34;</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="s2">&#34;13478:13478/udp&#34;</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">volumes</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">/var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock </span><span class="w"> </span><span class="c"># tailscale 客户端进程，用于验证客户端身份</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">./certs:/app/certs </span><span class="w"> </span><span class="c"># SSL 证书存放地址</span><span class="w">
</span></span></span></code></pre></div><p>以下是各变量功能的翻译：</p>
<table>
  <thead>
      <tr>
          <th>环境变量</th>
          <th>是否必需</th>
          <th>描述</th>
          <th>默认值</th>
      </tr>
  </thead>
  <tbody>
      <tr>
          <td>DERP_DOMAIN</td>
          <td>是</td>
          <td>DERP 服务器的主机名</td>
          <td>your-hostname.com</td>
      </tr>
      <tr>
          <td>DERP_CERT_DIR</td>
          <td>否</td>
          <td>存储 LetsEncrypt 证书的目录（如果地址的端口是:443）</td>
          <td>/app/certs</td>
      </tr>
      <tr>
          <td>DERP_CERT_MODE</td>
          <td>否</td>
          <td>获取证书的模式，可选项：manual（手动），letsencrypt</td>
          <td>letsencrypt</td>
      </tr>
      <tr>
          <td>DERP_ADDR</td>
          <td>否</td>
          <td>监听服务器地址</td>
          <td>:443</td>
      </tr>
      <tr>
          <td>DERP_STUN</td>
          <td>否</td>
          <td>也运行一个 STUN 服务器</td>
          <td>true</td>
      </tr>
      <tr>
          <td>DERP_STUN_PORT</td>
          <td>否</td>
          <td>提供 STUN 服务的 UDP 端口</td>
          <td>3478</td>
      </tr>
      <tr>
          <td>DERP_HTTP_PORT</td>
          <td>否</td>
          <td>提供 HTTP 服务的端口，设置为 -1 可禁用</td>
          <td>80</td>
      </tr>
      <tr>
          <td>DERP_VERIFY_CLIENTS</td>
          <td>否</td>
          <td>通过本地的 tailscaled 实例验证连接到此 DERP 服务器的客户端</td>
          <td>false</td>
      </tr>
      <tr>
          <td>DERP_VERIFY_CLIENT_URL</td>
          <td>否</td>
          <td>如果非空，指定允许客户端连接的准入控制器 URL</td>
          <td>&quot;&quot;</td>
      </tr>
  </tbody>
</table>
<p>如果不喜欢 compose，也有配置一样的命令版：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">docker run -dit <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--name derper <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--restart always <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v ./certs:/app/certs <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_CERT_MODE</span><span class="o">=</span>manual <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_ADDR</span><span class="o">=</span>:13477 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_HTTP_PORT</span><span class="o">=</span><span class="m">13476</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_STUN_PORT</span><span class="o">=</span><span class="m">13478</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_DOMAIN</span><span class="o">=</span>derper.example.com <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-e <span class="nv">DERP_VERIFY_CLIENTS</span><span class="o">=</span><span class="nb">true</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-p 13477:13477 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-p 13478:13478/udp <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>fredliang/derper
</span></span></code></pre></div><p>为了防止自己搭建的 Derper 被白嫖，这里选择开启 <code>DERP_VERIFY_CLIENTS</code> 客户端验证功能，服务器将通过本地的 Tailscale 客户端，验证使用 Derper 的是否为本账号下的客户端。</p>
<p>需要提前在服务器内运行一个 Tailscale 客户端，参考上面的客户端部署方法即可。</p>
<h2 id="添加-nginx-反向代理--并不需要"><del>添加 Nginx 反向代理</del>  (并不需要)</h2>
<p><del>宝塔面板 - 网站 - 反向代理中，添加一个项目，使用 <code>derper.example.com</code> 域名，配置自动申请 Let&rsquo;s Encrypt 证书。</del> （最后只用到了自动申请证书的功能）</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-nginx" data-lang="nginx"><span class="line"><span class="cl"><span class="k">location</span> <span class="s">^~</span> <span class="s">/</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_pass</span> <span class="s">http://127.0.0.1:13476</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">Host</span> <span class="nv">$http_host</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">X-Real-IP</span> <span class="nv">$remote_addr</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">X-Real-Port</span> <span class="nv">$remote_port</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">X-Forwarded-For</span> <span class="nv">$proxy_add_x_forwarded_for</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">REMOTE-HOST</span> <span class="nv">$remote_addr</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_connect_timeout</span> <span class="s">60s</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_send_timeout</span> <span class="s">600s</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_read_timeout</span> <span class="s">600s</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_http_version</span> <span class="mi">1</span><span class="s">.1</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">Upgrade</span> <span class="nv">$http_upgrade</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">  <span class="kn">proxy_set_header</span> <span class="s">Connection</span> <span class="nv">$connection_upgrade</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><h2 id="证书部署">证书部署</h2>
<p>证书命名格式为 <code>derper.example.com.crt</code> 和 <code>derper.example.com.key</code>，放置在执行目录下的 <code>certs</code> 文件夹内即可。</p>
<p>我这里使用了 Let&rsquo;s Encrypt 的证书，通过宝塔面板自动申请，通过计划任务每天自动更新一份到目录下：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl"><span class="cp">#!/bin/bash
</span></span></span><span class="line"><span class="cl"><span class="cp"></span>
</span></span><span class="line"><span class="cl"><span class="nv">source_crt</span><span class="o">=</span><span class="s2">&#34;/www/server/panel/vhost/cert/derper.example.com/fullchain.pem&#34;</span>
</span></span><span class="line"><span class="cl"><span class="nv">target_crt</span><span class="o">=</span><span class="s2">&#34;/docker/derper/certs/derper.example.com.crt&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="nv">source_key</span><span class="o">=</span><span class="s2">&#34;/www/server/panel/vhost/cert/derper.example.com/privkey.pem&#34;</span>
</span></span><span class="line"><span class="cl"><span class="nv">target_key</span><span class="o">=</span><span class="s2">&#34;/docker/derper/certs/derper.example.com.key&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 检查文件是否相同</span>
</span></span><span class="line"><span class="cl"><span class="k">if</span> diff -q <span class="s2">&#34;</span><span class="nv">$source_crt</span><span class="s2">&#34;</span> <span class="s2">&#34;</span><span class="nv">$target_crt</span><span class="s2">&#34;</span> <span class="p">&amp;</span>&gt; /dev/null<span class="p">;</span> <span class="k">then</span>
</span></span><span class="line"><span class="cl">    <span class="nb">echo</span> <span class="s2">&#34;文件内容相同，无需复制。&#34;</span>
</span></span><span class="line"><span class="cl"><span class="k">else</span>
</span></span><span class="line"><span class="cl">    cp <span class="s2">&#34;</span><span class="nv">$source_crt</span><span class="s2">&#34;</span> <span class="s2">&#34;</span><span class="nv">$target_crt</span><span class="s2">&#34;</span>
</span></span><span class="line"><span class="cl">    cp <span class="s2">&#34;</span><span class="nv">$source_key</span><span class="s2">&#34;</span> <span class="s2">&#34;</span><span class="nv">$target_key</span><span class="s2">&#34;</span>
</span></span><span class="line"><span class="cl">    <span class="nb">echo</span> <span class="s2">&#34;文件已复制。&#34;</span>
</span></span><span class="line"><span class="cl"><span class="k">fi</span>
</span></span></code></pre></div><h2 id="添加-access-controls-规则">添加 Access Controls 规则</h2>
<p>进入 Tailscale 后台，选择 Access Controls 配置。</p>
<p><a href="https://login.tailscale.com/admin/acls/file">https://login.tailscale.com/admin/acls/file</a></p>
<p>在下面的配置文件中，在最后添加自己的 Derper。</p>
<p>我的配置如下：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="c1">// Example/default ACLs for unrestricted connections.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span><span class="p">{</span>
</span></span><span class="line"><span class="cl"> <span class="c1">// Declare static groups of users. Use autogroups for all users or users with a specific role.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// &#34;groups&#34;: {
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//   &#34;group:example&#34;: [&#34;alice@example.com&#34;, &#34;bob@example.com&#34;],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// },
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>
</span></span><span class="line"><span class="cl"> <span class="c1">// Define the tags which can be applied to devices and by which users.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// &#34;tagOwners&#34;: {
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//   &#34;tag:example&#34;: [&#34;autogroup:admin&#34;],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// },
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>
</span></span><span class="line"><span class="cl"> <span class="c1">// Define access control lists for users, groups, autogroups, tags,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// Tailscale IP addresses, and subnet ranges.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="nt">&#34;acls&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">  <span class="c1">// Allow all connections.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="c1">// Comment this section out if you want to define specific restrictions.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="p">{</span><span class="nt">&#34;action&#34;</span><span class="p">:</span> <span class="s2">&#34;accept&#34;</span><span class="p">,</span> <span class="nt">&#34;src&#34;</span><span class="p">:</span> <span class="p">[</span><span class="s2">&#34;*&#34;</span><span class="p">],</span> <span class="nt">&#34;dst&#34;</span><span class="p">:</span> <span class="p">[</span><span class="s2">&#34;*:*&#34;</span><span class="p">]},</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">  <span class="c1">// Allow users in &#34;group:example&#34; to access &#34;tag:example&#34;, but only from
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="c1">// devices that are running macOS and have enabled Tailscale client auto-updating.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="c1">// {&#34;action&#34;: &#34;accept&#34;, &#34;src&#34;: [&#34;group:example&#34;], &#34;dst&#34;: [&#34;tag:example:*&#34;], &#34;srcPosture&#34;:[&#34;posture:autoUpdateMac&#34;]},
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="p">],</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"> <span class="c1">// Define postures that will be applied to all rules without any specific
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// srcPosture definition.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// &#34;defaultSrcPosture&#34;: [
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;posture:anyMac&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// ],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>
</span></span><span class="line"><span class="cl"> <span class="c1">// Define device posture rules requiring devices to meet
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// certain criteria to access parts of your system.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// &#34;postures&#34;: {
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      // Require devices running macOS, a stable Tailscale
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      // version and auto update enabled for Tailscale.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//  &#34;posture:autoUpdateMac&#34;: [
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;node:os == &#39;macos&#39;&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;node:tsReleaseTrack == &#39;stable&#39;&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;node:tsAutoUpdate&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//  ],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      // Require devices running macOS and a stable
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      // Tailscale version.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//  &#34;posture:anyMac&#34;: [
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;node:os == &#39;macos&#39;&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//      &#34;node:tsReleaseTrack == &#39;stable&#39;&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//  ],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// },
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>
</span></span><span class="line"><span class="cl"> <span class="c1">// Define users and devices that can use Tailscale SSH.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="nt">&#34;ssh&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">  <span class="c1">// Allow all users to SSH into their own devices in check mode.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="c1">// Comment this section out if you want to define specific restrictions.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span>  <span class="p">{</span>
</span></span><span class="line"><span class="cl">   <span class="nt">&#34;action&#34;</span><span class="p">:</span> <span class="s2">&#34;check&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">   <span class="nt">&#34;src&#34;</span><span class="p">:</span>    <span class="p">[</span><span class="s2">&#34;autogroup:member&#34;</span><span class="p">],</span>
</span></span><span class="line"><span class="cl">   <span class="nt">&#34;dst&#34;</span><span class="p">:</span>    <span class="p">[</span><span class="s2">&#34;autogroup:self&#34;</span><span class="p">],</span>
</span></span><span class="line"><span class="cl">   <span class="nt">&#34;users&#34;</span><span class="p">:</span>  <span class="p">[</span><span class="s2">&#34;autogroup:nonroot&#34;</span><span class="p">,</span> <span class="s2">&#34;root&#34;</span><span class="p">],</span>
</span></span><span class="line"><span class="cl">  <span class="p">},</span>
</span></span><span class="line"><span class="cl"> <span class="p">],</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"> <span class="c1">// Test access rules every time they&#39;re saved.
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// &#34;tests&#34;: [
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//   {
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//    &#34;src&#34;: &#34;alice@example.com&#34;,
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//    &#34;accept&#34;: [&#34;tag:example&#34;],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//    &#34;deny&#34;: [&#34;100.101.102.103:443&#34;],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">//   },
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="c1">// ],
</span></span></span><span class="line"><span class="cl"><span class="c1"></span> <span class="nt">&#34;derpMap&#34;</span><span class="p">:</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">  <span class="nt">&#34;OmitDefaultRegions&#34;</span><span class="p">:</span> <span class="kc">false</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">  <span class="nt">&#34;Regions&#34;</span><span class="p">:</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">   <span class="nt">&#34;900&#34;</span><span class="p">:</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;RegionID&#34;</span><span class="p">:</span>   <span class="mi">900</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;RegionCode&#34;</span><span class="p">:</span> <span class="s2">&#34;myderp&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;RegionName&#34;</span><span class="p">:</span> <span class="s2">&#34;Guangzhou&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;Nodes&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">     <span class="p">{</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;Name&#34;</span><span class="p">:</span>     <span class="s2">&#34;1&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;RegionID&#34;</span><span class="p">:</span> <span class="mi">900</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;HostName&#34;</span><span class="p">:</span> <span class="s2">&#34;derper.example.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;DERPPort&#34;</span><span class="p">:</span> <span class="mi">13477</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;STUNPort&#34;</span><span class="p">:</span> <span class="mi">13478</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">      <span class="nt">&#34;STUNOnly&#34;</span><span class="p">:</span> <span class="kc">false</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">     <span class="p">},</span>
</span></span><span class="line"><span class="cl">    <span class="p">],</span>
</span></span><span class="line"><span class="cl">   <span class="p">},</span>
</span></span><span class="line"><span class="cl">  <span class="p">},</span>
</span></span><span class="line"><span class="cl"> <span class="p">},</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><h2 id="测试-derper">测试 Derper</h2>
<p>在客户端的终端中，输入</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="n">tailscale</span> <span class="n">netcheck</span>
</span></span><span class="line"><span class="cl"><span class="n">tailscale</span> <span class="n">ping</span> <span class="n">客户端名称</span>
</span></span></code></pre></div><p>即可查看连接情况。</p>
<p>输出如下：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-powershell" data-lang="powershell"><span class="line"><span class="cl"><span class="n">PowerShell</span> <span class="mf">7.4</span><span class="p">.</span><span class="py">4</span>
</span></span><span class="line"><span class="cl"><span class="nb">PS </span><span class="n">C:</span><span class="p">\</span><span class="n">Users</span><span class="p">\</span><span class="n">jacob</span><span class="p">&gt;</span> <span class="n">tailscale</span> <span class="n">netcheck</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="n">Report</span><span class="err">:</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">UDP</span><span class="err">:</span> <span class="n">true</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">IPv4</span><span class="err">:</span> <span class="n">yes</span><span class="p">,</span> <span class="mf">183.233</span><span class="p">.</span><span class="py">233</span><span class="p">.</span><span class="mf">159</span><span class="err">:</span><span class="mf">11451</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">IPv6</span><span class="err">:</span> <span class="n">no</span><span class="p">,</span> <span class="n">but</span> <span class="n">OS</span> <span class="n">has</span> <span class="n">support</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">MappingVariesByDestIP</span><span class="err">:</span> <span class="n">true</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">PortMapping</span><span class="err">:</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">CaptivePortal</span><span class="err">:</span> <span class="n">false</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">Nearest</span> <span class="n">DERP</span><span class="err">:</span> <span class="n">Guangzhou</span>
</span></span><span class="line"><span class="cl">        <span class="p">*</span> <span class="n">DERP</span> <span class="n">latency</span><span class="err">:</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">myderp</span><span class="err">:</span> <span class="n">18ms</span>    <span class="p">(</span><span class="n">Guangzhou</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">blr</span><span class="err">:</span> <span class="mf">133</span><span class="p">.</span><span class="py">9ms</span> <span class="p">(</span><span class="n">Bangalore</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">lax</span><span class="err">:</span> <span class="mf">159</span><span class="p">.</span><span class="py">3ms</span> <span class="p">(</span><span class="n">Los</span> <span class="n">Angeles</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">sea</span><span class="err">:</span> <span class="mf">175</span><span class="p">.</span><span class="py">3ms</span> <span class="p">(</span><span class="n">Seattle</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">sfo</span><span class="err">:</span> <span class="mf">185</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">San</span> <span class="n">Francisco</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">dfw</span><span class="err">:</span> <span class="mf">190</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Dallas</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">den</span><span class="err">:</span> <span class="mf">195</span><span class="p">.</span><span class="py">6ms</span> <span class="p">(</span><span class="n">Denver</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">tor</span><span class="err">:</span> <span class="mf">215</span><span class="p">.</span><span class="py">7ms</span> <span class="p">(</span><span class="n">Toronto</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">fra</span><span class="err">:</span> <span class="n">222ms</span>   <span class="p">(</span><span class="n">Frankfurt</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">par</span><span class="err">:</span> <span class="n">222ms</span>   <span class="p">(</span><span class="n">Paris</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">lhr</span><span class="err">:</span> <span class="mf">225</span><span class="p">.</span><span class="py">6ms</span> <span class="p">(</span><span class="n">London</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">mia</span><span class="err">:</span> <span class="mf">227</span><span class="p">.</span><span class="py">3ms</span> <span class="p">(</span><span class="n">Miami</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">nyc</span><span class="err">:</span> <span class="mf">228</span><span class="p">.</span><span class="py">9ms</span> <span class="p">(</span><span class="n">New</span> <span class="n">York</span> <span class="n">City</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">ord</span><span class="err">:</span> <span class="mf">234</span><span class="p">.</span><span class="py">2ms</span> <span class="p">(</span><span class="n">Chicago</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">ams</span><span class="err">:</span> <span class="mf">236</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Amsterdam</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">waw</span><span class="err">:</span> <span class="mf">241</span><span class="p">.</span><span class="py">5ms</span> <span class="p">(</span><span class="n">Warsaw</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">hnl</span><span class="err">:</span> <span class="mf">243</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Honolulu</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">tok</span><span class="err">:</span> <span class="mf">244</span><span class="p">.</span><span class="py">1ms</span> <span class="p">(</span><span class="n">Tokyo</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">mad</span><span class="err">:</span> <span class="mf">255</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Madrid</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">hkg</span><span class="err">:</span> <span class="mf">283</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Hong</span> <span class="n">Kong</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">sin</span><span class="err">:</span> <span class="mf">302</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Singapore</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">dbi</span><span class="err">:</span> <span class="mf">330</span><span class="p">.</span><span class="py">3ms</span> <span class="p">(</span><span class="n">Dubai</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">nai</span><span class="err">:</span> <span class="mf">415</span><span class="p">.</span><span class="py">9ms</span> <span class="p">(</span><span class="n">Nairobi</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">jnb</span><span class="err">:</span> <span class="mf">432</span><span class="p">.</span><span class="py">4ms</span> <span class="p">(</span><span class="n">Johannesburg</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">sao</span><span class="err">:</span> <span class="mf">432</span><span class="p">.</span><span class="py">8ms</span> <span class="p">(</span><span class="n">São</span> <span class="n">Paulo</span><span class="p">)</span>
</span></span><span class="line"><span class="cl">                <span class="p">-</span> <span class="n">syd</span><span class="err">:</span> <span class="mf">547</span><span class="p">.</span><span class="py">2ms</span> <span class="p">(</span><span class="n">Sydney</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="nb">PS </span><span class="n">C:</span><span class="p">\</span><span class="n">Users</span><span class="p">\</span><span class="n">jacob</span><span class="p">&gt;</span> <span class="n">tailscale</span> <span class="n">ping</span> <span class="n">diskstation</span>
</span></span><span class="line"><span class="cl"><span class="n">pong</span> <span class="n">from</span> <span class="n">diskstation</span> <span class="p">(</span><span class="mf">100.233</span><span class="p">.</span><span class="py">64</span><span class="p">.</span><span class="mf">44</span><span class="p">)</span> <span class="n">via</span> <span class="mf">192.233</span><span class="p">.</span><span class="py">1</span><span class="p">.</span><span class="mf">2</span><span class="err">:</span><span class="mf">41641</span> <span class="k">in</span> <span class="n">755ms</span>
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<ul>
<li><a href="https://xz.aliyun.com/t/12151">Tailscale 在内网渗透中利用的研究 - 先知社区</a></li>
<li><a href="https://tailscale.com/kb/1347/installation">Install Tailscale · Tailscale Docs</a></li>
<li><a href="https://tailscale.com/kb/1118/custom-derp-servers/">Custom DERP Servers · Tailscale Docs</a></li>
<li><a href="https://github.com/fredliang44/derper-docker">GitHub - fredliang44/derper-docker: tailscale‘s selfhosted derp-server docker image</a></li>
<li><a href="https://always200.com/tailscale-derper-docker">我的服务器系列：tailscale 使用自定义 derper 服务器（docker 部署） - 且炼时光</a></li>
</ul>
]]></content:encoded></item><item><title>PVE LXC Debian 12 容器安装 Jellyfin</title><link>https://weixiang.github.io/posts/install-jellyfin-in-pve-lxc-debian-12-container/</link><pubDate>Tue, 26 Dec 2023 09:25:59 +0800</pubDate><guid>https://weixiang.github.io/posts/install-jellyfin-in-pve-lxc-debian-12-container/</guid><description>本文记录了如何在 PVE LXC 容器中使用 Docker 安装 Jellyfin。Jellyfin 是一套多媒体应用程序软件套装，旨在组织、管理和共享数字媒体文件。</description><content:encoded><![CDATA[<h2 id="pve-配置">PVE 配置</h2>
<p>开启硬件直通：BIOS 中打开硬件直通相关选项（VT-d &amp; VMX）
编辑 Grub</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano /etc/default/grub
</span></span></code></pre></div><p>注释原条目，并增加开启参数</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl"><span class="nv">GRUB_CMDLINE_LINUX_DEFAULT</span><span class="o">=</span><span class="s2">&#34;quiet intel_iommu=on&#34;</span>
</span></span></code></pre></div><p>如果你的 pcie 设备分组有问题也可以换成这一行对分组拆分（直通遇到问题都可以尝试这个）</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl"><span class="nv">GRUB_CMDLINE_LINUX_DEFAULT</span><span class="o">=</span><span class="s2">&#34;quiet intel_iommu=on pcie_acs_override=downstream&#34;</span>
</span></span></code></pre></div><p>更新 grub</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">update-grub
</span></span></code></pre></div><p>上传启动镜像：将镜像 img 扩展名修改为 iso，直接通过 PVE 后台上传
创建虚拟机并设置直通：修改配置文件命令</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano /etc/pve/qemu-server/<span class="o">[</span>虚拟机编号<span class="o">]</span>.conf
</span></span></code></pre></div><h2 id="lxc-容器配置">LXC 容器配置</h2>
<p>为容器加入渲染器硬件，并关闭 AppArmor（部分显卡可能需要更新内核才能找到渲染器）</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano /etc/pve/lxc/<span class="o">[</span>CT_ID<span class="o">]</span>.conf
</span></span></code></pre></div><p>加入硬件参数：（可先用<code>ls -l /dev/dri</code>查询）</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">lxc.cgroup2.devices.allow: c 226:0 rwm
</span></span><span class="line"><span class="cl">lxc.cgroup2.devices.allow: c 226:128 rwm
</span></span><span class="line"><span class="cl">lxc.cgroup2.devices.allow: c 29:0 rwm
</span></span><span class="line"><span class="cl">lxc.mount.entry: /dev/dri dev/dri none bind,optional,create<span class="o">=</span>dir
</span></span><span class="line"><span class="cl">lxc.mount.entry: /dev/fb0 dev/fb0 none bind,optional,create<span class="o">=</span>file
</span></span><span class="line"><span class="cl">lxc.apparmor.profile: unconfined
</span></span></code></pre></div><h2 id="挂载-smb-目录">挂载 SMB 目录</h2>
<p>安装 SMB 组件并创建共享目录（目录可自定义）</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">apt install cifs-utils -y
</span></span><span class="line"><span class="cl">mkdir /mnt/nas/video
</span></span></code></pre></div><p>创建密码文件（注意保护文件，此处为明文密码）：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano ~/.smbcredentials
</span></span></code></pre></div><p>设置 SMB 登录密码，自行替换：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl"><span class="nv">username</span><span class="o">=</span>jellyfin
</span></span><span class="line"><span class="cl"><span class="nv">password</span><span class="o">=</span>share_password
</span></span></code></pre></div><p>修改自动挂载文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano /etc/fstab
</span></span></code></pre></div><p>加入挂载位置，自行替换</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">//192.168.1.3/video /mnt/nas/video cifs <span class="nv">credentials</span><span class="o">=</span>/root/.smbcredentials,iocharset<span class="o">=</span>utf8 <span class="m">0</span> <span class="m">0</span>
</span></span></code></pre></div><p>验证
通过指定挂载点来挂载共享：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">mount /mnt/nas/video
</span></span></code></pre></div><p>查看</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">df -h
</span></span></code></pre></div><h2 id="安装-jellyfin">安装 Jellyfin</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -v /volume1/docker/jellyfin/config:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -v /volume1/docker/jellyfin/cache:/cache <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -e <span class="nv">HTTP_PROXY</span><span class="o">=</span>http://192.168.1.5:7890/ <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -e <span class="nv">HTTPS_PROXY</span><span class="o">=</span>http://192.168.1.5:7890/ <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> -e <span class="nv">NO_PROXY</span><span class="o">=</span>localhost,192.168.1.5,.example.com <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --name jellyfin <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --user 0:0 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --net<span class="o">=</span>host <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --device<span class="o">=</span>/dev/dri:/dev/dri <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --mount <span class="nv">type</span><span class="o">=</span>bind,source<span class="o">=</span>/mnt/nas,target<span class="o">=</span>/media <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> --restart<span class="o">=</span>unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span> nyanmisaka/jellyfin
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<p><a href="https://gitee.com/spoto/PVE_Generic_AIO/tree/master/1%E3%80%81%E5%88%9B%E5%BB%BA%E5%9F%BA%E4%BA%8ELXC%E7%9A%84Docker%E5%AE%B9%E5%99%A8_%EF%BC%88%E6%9C%AA%E5%AE%8C%E6%88%90%EF%BC%89">https://gitee.com/spoto/PVE_Generic_AIO/tree/master/1%E3%80%81%E5%88%9B%E5%BB%BA%E5%9F%BA%E4%BA%8ELXC%E7%9A%84Docker%E5%AE%B9%E5%99%A8_%EF%BC%88%E6%9C%AA%E5%AE%8C%E6%88%90%EF%BC%89</a></p>
<p><a href="https://access.redhat.com/documentation/zh-cn/red_hat_enterprise_linux/8/html/managing_file_systems/proc_mounting-an-smb-share-automatically-when-the-system-boots_assembly_mounting-an-smb-share-on-red-hat-enterprise-linux">https://access.redhat.com/documentation/zh-cn/red_hat_enterprise_linux/8/html/managing_file_systems/proc_mounting-an-smb-share-automatically-when-the-system-boots_assembly_mounting-an-smb-share-on-red-hat-enterprise-linux</a></p>
]]></content:encoded></item><item><title>PVE LXC Debian 12 容器换源与安装 Docker</title><link>https://weixiang.github.io/posts/pve-lxc-debian-12-container-source-change-and-installation-docker/</link><pubDate>Tue, 26 Dec 2023 09:17:12 +0800</pubDate><guid>https://weixiang.github.io/posts/pve-lxc-debian-12-container-source-change-and-installation-docker/</guid><description>本文记录了 PVE LXC Debian 12 容器环境下 Docker 的换源与安装，包含代理设置等本地特色内容，Docker 是一个开放源代码的开放平台软件，用于开发应用、交付应用和运行应用。</description><content:encoded><![CDATA[<h2 id="创建-lxc">创建 LXC</h2>
<p>创建容器时<strong>取消勾选无特权容器！</strong></p>
<p>创建容器时<strong>取消勾选无特权容器！</strong></p>
<p>创建容器时<strong>取消勾选无特权容器！</strong></p>
<p>创建完毕后在 PVE Host 内执行</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">cat &gt;&gt; /etc/pve/lxc/<span class="o">[</span>LXC_ID<span class="o">]</span>.conf <span class="s">&lt;&lt; EOL
</span></span></span><span class="line"><span class="cl"><span class="s">lxc.apparmor.profile: unconfined
</span></span></span><span class="line"><span class="cl"><span class="s">EOL</span>
</span></span></code></pre></div><h2 id="换源">换源</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sed -i <span class="s1">&#39;s/deb.debian.org/mirrors.ustc.edu.cn/g&#39;</span> /etc/apt/sources.list
</span></span><span class="line"><span class="cl">sed -i <span class="s1">&#39;s/deb.debian.org/mirrors.ustc.edu.cn/g&#39;</span> /etc/apt/sources.list.d/debian.sources
</span></span><span class="line"><span class="cl">sed -i <span class="s1">&#39;s|security.debian.org/debian-security|mirrors.ustc.edu.cn/debian-security|g&#39;</span> /etc/apt/sources.list
</span></span></code></pre></div><p>更新</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">apt update <span class="o">&amp;&amp;</span> apt upgrade -y
</span></span></code></pre></div><h2 id="魔法">魔法</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nv">HTTP_PROXY</span><span class="o">=</span>http://192.168.1.5:7890/
</span></span><span class="line"><span class="cl"><span class="nv">HTTPS_PROXY</span><span class="o">=</span>http://192.168.1.5:7890/
</span></span><span class="line"><span class="cl"><span class="nv">NO_PROXY</span><span class="o">=</span>localhost,192.168.1.5,.example.com
</span></span></code></pre></div><h2 id="安装-docker">安装 Docker</h2>
<p>安装 Docker</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">apt install curl -y
</span></span><span class="line"><span class="cl">curl -sSL https://get.daocloud.io/docker <span class="p">|</span> sh
</span></span></code></pre></div><h2 id="设置镜像源和容器网段">设置镜像源和容器网段</h2>
<p>编辑<code>daemon.json</code>文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">nano /etc/docker/daemon.json
</span></span></code></pre></div><p>填入</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl"><span class="nt">&#34;registry-mirrors&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span>
</span></span><span class="line"><span class="cl">    <span class="p">],</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;bip&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.10.1/24&#34;</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><p>重启 Docker 生效</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">systemctl restart docker
</span></span></code></pre></div><h2 id="安装-portainer-ce">安装 Portainer CE</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart<span class="o">=</span>always -v /var/run/docker.sock:/var/run/docker.sock -v /volume1/docker/portainer:/data portainer/portainer-ce:latest
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<p><a href="https://ihnic.com/index.php/archives/12/">https://ihnic.com/index.php/archives/12/</a></p>
<p><a href="https://docs.portainer.io/start/install-ce/server/docker/linux">https://docs.portainer.io/start/install-ce/server/docker/linux</a></p>
<p><a href="https://mirrors.ustc.edu.cn/help/debian.html">https://mirrors.ustc.edu.cn/help/debian.html</a></p>
]]></content:encoded></item><item><title>群晖 DSM 研究笔记</title><link>https://weixiang.github.io/posts/synology-dsm-research-notes/</link><pubDate>Sat, 28 Oct 2023 11:38:05 +0800</pubDate><guid>https://weixiang.github.io/posts/synology-dsm-research-notes/</guid><description>本文记录了一些群晖 DSM 上的小技巧。Synology DiskStation Manager (DSM) 是专为 Synology NAS 打造的人性化操作系统，直观的图形管理界面、精简的操作流程，让您轻轻松松就能存储、管理和备份数据。</description><content:encoded><![CDATA[<h2 id="安装">安装</h2>
<h2 id="编译-tinycore-redpill-引导">编译 tinycore-redpill 引导</h2>
<h3 id="dsm-安装完成后无限重启">DSM 安装完成后无限重启？</h3>
<p>引导与 pat 版本不一致导致的，断网安装可以避免安装过程中自动更新。</p>
<h2 id="使用">使用</h2>
<h3 id="指定源拉取镜像">指定源拉取镜像</h3>
<p>使用 SSH 进入终端，用命令手动从加速地址拉取</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo docker pull z7cqdx7o.mirror.aliyuncs.com/homeassistant/home-assistant
</span></span></code></pre></div><h3 id="国内加速地址">国内加速地址</h3>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl">  <span class="s2">&#34;registry-mirrors&#34;</span><span class="err">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://z7cqdx7o.mirror.aliyuncs.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://registry.docker-cn.com&#34;</span>
</span></span><span class="line"><span class="cl">  <span class="p">]</span>
</span></span></code></pre></div><h3 id="docker-配置文件位置">Docker 配置文件位置</h3>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo vi /var/packages/Docker/etc/dockerd.json
</span></span></code></pre></div><ol>
<li>（vi 进入文件后）在命令模式下，先执行 gg (跳转光标至文件首行)；</li>
<li>再执行 dG，这样就清空了整个文件。</li>
</ol>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;bip&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.100.1/24&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;data-root&#34;</span><span class="p">:</span> <span class="s2">&#34;/var/packages/Docker/var/docker&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;log-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;db&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;registry-mirrors&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://z7cqdx7o.mirror.aliyuncs.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://registry.docker-cn.com&#34;</span>
</span></span><span class="line"><span class="cl">    <span class="p">],</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;storage-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;btrfs&#34;</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><h3 id="重启-docker">重启 Docker</h3>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">systemctl daemon-reload
</span></span><span class="line"><span class="cl">systemctl restart pkgctl-Docker
</span></span></code></pre></div><h2 id="docker-服务">Docker 服务</h2>
<h3 id="家庭助理">家庭助理</h3>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name homeassistant <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --privileged <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart<span class="o">=</span>unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/homeassistant:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --network<span class="o">=</span>host <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  ghcr.io/home-assistant/home-assistant:stable
</span></span></code></pre></div><h3 id="广告过滤">广告过滤</h3>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run --name adguardhome<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --restart unless-stopped<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/work:/opt/adguardhome/work<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/conf:/opt/adguardhome/conf<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 53:53/tcp -p 53:53/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 67:67/udp -p 68:68/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 80:80/tcp -p 443:443/tcp -p 443:443/udp -p 3000:3000/tcp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 853:853/tcp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 784:784/udp -p 853:853/udp -p 8853:8853/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 5443:5443/tcp -p 5443:5443/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -d adguard/adguardhome
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<p><a href="https://community.synology.com/enu/forum/17/post/107492">https://community.synology.com/enu/forum/17/post/107492</a></p>
<p><a href="https://support.hyperglance.com/knowledge/changing-the-default-docker-subnet">https://support.hyperglance.com/knowledge/changing-the-default-docker-subnet</a></p>
<p><a href="https://github.com/whyour/qinglong">https://github.com/whyour/qinglong</a></p>
<p><a href="https://www.synoforum.com/threads/docker-restart-on-cli.4678/">https://www.synoforum.com/threads/docker-restart-on-cli.4678/</a></p>
<p><a href="https://gist.github.com/styblope/dc55e0ad2a9848f2cc3307d4819d819f">https://gist.github.com/styblope/dc55e0ad2a9848f2cc3307d4819d819f</a></p>
]]></content:encoded></item><item><title>群晖 DSM Docker 更改 Bridge 网段及配置镜像源</title><link>https://weixiang.github.io/posts/changing-dockers-bridge-segment-in-dsm-and-configuring-the-mirror-source/</link><pubDate>Sat, 28 Oct 2023 03:57:20 +0800</pubDate><guid>https://weixiang.github.io/posts/changing-dockers-bridge-segment-in-dsm-and-configuring-the-mirror-source/</guid><description>由于群晖 Docker 套件的 Bridge 网桥默认的网段很容易和现有网段冲突，需要避开才可正常通信。本文记录了如何更改 Container Manager 的网段和配置国内加速镜像源。</description><content:encoded><![CDATA[<h2 id="前言">前言</h2>
<p>2024 年 8 月 8 日更新：</p>
<p>由于某些众所周知的原因，国内 Docker 镜像已经成为历史，本文已不具有可行性，仅供参考。</p>
<hr>
<p>由于群晖 Docker 套件，其 Bridge 网桥默认的网段为 172 段，很容易和现有网段冲突，导致发包错误，需要避开才可正常通信。</p>
<h2 id="docker-配置文件位置">Docker 配置文件位置</h2>
<p>先开启 DSM 的 SSH 登录，然后通过 SSH 连接到 DSM。</p>
<p>DSM7.2 前，使用以下命令。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">sudo vim /var/packages/Docker/etc/dockerd.json
</span></span></code></pre></div><p>DSM7.2 后 Docker 更名为 Container Manager，并升级了 UI 以便于更新和清理容器。因此路径也需要更改。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">sudo vim /var/packages/ContainerManager/etc/dockerd.json
</span></span></code></pre></div><p>清空内容小技巧：</p>
<ol>
<li>（vi 进入文件后）在命令模式下，先执行 gg(跳转光标至文件首行)；</li>
<li>再执行 dG，这样就清空了整个文件。</li>
</ol>
<h2 id="修改配置文件">修改配置文件</h2>
<p>DSM7.2 前，使用以下配置。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;data-root&#34;</span><span class="p">:</span> <span class="s2">&#34;/var/packages/Docker/var/docker&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;log-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;db&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;storage-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;btrfs&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;registry-mirrors&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://registry.docker-cn.com&#34;</span>
</span></span><span class="line"><span class="cl">    <span class="p">],</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;bip&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.10.1/24&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;default-address-pools&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="p">{</span>
</span></span><span class="line"><span class="cl">            <span class="nt">&#34;base&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.10.0/24&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">            <span class="nt">&#34;size&#34;</span><span class="p">:</span> <span class="mi">24</span>
</span></span><span class="line"><span class="cl">        <span class="p">}</span>
</span></span><span class="line"><span class="cl">    <span class="p">]</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><p>DSM7.2 后，使用以下配置。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;data-root&#34;</span><span class="p">:</span> <span class="s2">&#34;/var/packages/ContainerManager/var/docker&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;log-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;db&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;storage-driver&#34;</span><span class="p">:</span> <span class="s2">&#34;btrfs&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;registry-mirrors&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">        <span class="s2">&#34;https://registry.docker-cn.com&#34;</span>
</span></span><span class="line"><span class="cl">    <span class="p">],</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;bip&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.10.1/24&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="nt">&#34;default-address-pools&#34;</span><span class="p">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">        <span class="p">{</span>
</span></span><span class="line"><span class="cl">            <span class="nt">&#34;base&#34;</span><span class="p">:</span> <span class="s2">&#34;192.168.10.0/24&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">            <span class="nt">&#34;size&#34;</span><span class="p">:</span> <span class="mi">24</span>
</span></span><span class="line"><span class="cl">        <span class="p">}</span>
</span></span><span class="line"><span class="cl">    <span class="p">]</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><p>提醒：配置不可省略 data-root 路径，否则配置不生效。</p>
<h2 id="重启-docker">重启 Docker</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">systemctl daemon-reload
</span></span><span class="line"><span class="cl">systemctl restart pkgctl-Docker <span class="c1"># DSM7.2前</span>
</span></span><span class="line"><span class="cl">systemctl restart pkgctl-ContainerManager <span class="c1"># DSM7.2后</span>
</span></span></code></pre></div><h2 id="附录常见国内加速镜像源">附录：常见国内加速镜像源</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl">  <span class="s2">&#34;registry-mirrors&#34;</span><span class="err">:</span> <span class="p">[</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://docker.mirrors.ustc.edu.cn&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://hub-mirror.c.163.com&#34;</span><span class="p">,</span>
</span></span><span class="line"><span class="cl">    <span class="s2">&#34;https://registry.docker-cn.com&#34;</span>
</span></span><span class="line"><span class="cl">  <span class="p">]</span>
</span></span></code></pre></div><p>阿里云镜像加速器获取：<a href="https://help.aliyun.com/zh/acr/user-guide/accelerate-the-pulls-of-docker-official-images">https://help.aliyun.com/zh/acr/user-guide/accelerate-the-pulls-of-docker-official-images</a></p>
<h2 id="参考文献">参考文献</h2>
<p><a href="https://www.ithome.com/0/680/524.htm">https://www.ithome.com/0/680/524.htm</a>
<a href="https://cr.console.aliyun.com">https://cr.console.aliyun.com</a>
<a href="https://help.aliyun.com/zh/acr/user-guide/accelerate-the-pulls-of-docker-official-images">https://help.aliyun.com/zh/acr/user-guide/accelerate-the-pulls-of-docker-official-images</a>
<a href="https://community.synology.com/enu/forum/17/post/107492">https://community.synology.com/enu/forum/17/post/107492</a>
<a href="https://support.hyperglance.com/knowledge/changing-the-default-docker-subnet">https://support.hyperglance.com/knowledge/changing-the-default-docker-subnet</a>
<a href="https://www.synoforum.com/threads/docker-restart-on-cli.4678/">https://www.synoforum.com/threads/docker-restart-on-cli.4678/</a>
<a href="https://gist.github.com/styblope/dc55e0ad2a9848f2cc3307d4819d819f">https://gist.github.com/styblope/dc55e0ad2a9848f2cc3307d4819d819f</a></p>
]]></content:encoded></item><item><title>HomeLab 搭建笔记</title><link>https://weixiang.github.io/posts/homelab-deployment-record/</link><pubDate>Thu, 27 Jul 2023 13:12:04 +0800</pubDate><guid>https://weixiang.github.io/posts/homelab-deployment-record/</guid><description>Homelab 是指可在家中搭建的实验（折腾）环境，用于进行实验和学习。本文记录了一次 HomeLab 的搭建过程，包含多个服务的配置，主要使用 Docker 和群晖 DSM 构成。</description><content:encoded><![CDATA[<h2 id="adguard-home">AdGuard Home</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run --name adguardhome<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --restart unless-stopped<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --network host<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/adguardhome/work:/opt/adguardhome/work<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/adguardhome/conf:/opt/adguardhome/conf<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -d adguard/adguardhome
</span></span></code></pre></div><p>或者</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run --name adguardhome<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --restart unless-stopped<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/adguardhome/work:/opt/adguardhome/work<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/adguardhome/conf:/opt/adguardhome/conf<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 53:53/tcp -p 53:53/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 67:67/udp -p 68:68/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 80:80/tcp -p 443:443/tcp -p 443:443/udp -p 3000:3000/tcp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 853:853/tcp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 784:784/udp -p 853:853/udp -p 8853:8853/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 5443:5443/tcp -p 5443:5443/udp<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -d adguard/adguardhome
</span></span></code></pre></div><p>添加过滤列表</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">https://ghproxy.com/https://raw.githubusercontent.com/217heidai/adblockfilters/main/rules/adblockfilters.txt
</span></span></code></pre></div><h2 id="clash--yacd">Clash &amp; Yacd</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run --name clash<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --restart unless-stopped<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --network host<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -v /volume1/docker/clash:/root/.config/clash<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -d dreamacro/clash
</span></span></code></pre></div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run --name yacd<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    --restart unless-stopped<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -p 7891:80<span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>    -d haishanh/yacd
</span></span></code></pre></div><h2 id="home-assistant">Home Assistant</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name homeassistant <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --privileged <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart<span class="o">=</span>unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/homeassistant:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --network<span class="o">=</span>host <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  ghcr.io/home-assistant/home-assistant:stable
</span></span></code></pre></div><p>更新</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># if this returns &#34;Image is up to date&#34; then you can stop here</span>
</span></span><span class="line"><span class="cl">docker pull ghcr.io/home-assistant/home-assistant:stable
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># stop the running container</span>
</span></span><span class="line"><span class="cl">docker stop homeassistant
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># remove it from Docker&#39;s list of containers</span>
</span></span><span class="line"><span class="cl">docker rm homeassistant
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># finally, start a new one</span>
</span></span><span class="line"><span class="cl">docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name homeassistant <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart<span class="o">=</span>unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --privileged <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/homeassistant:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --network<span class="o">=</span>host <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  ghcr.io/home-assistant/home-assistant:stable
</span></span></code></pre></div><h2 id="esphome">ESPHome</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name esphome <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --privileged <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart<span class="o">=</span>unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/esphome:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --network<span class="o">=</span>host <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  ghcr.io/esphome/esphome
</span></span></code></pre></div><h2 id="青龙面板">青龙面板</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -dit <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/qinglong:/ql/data <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -p 5700:5700 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --hostname qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  whyour/qinglong:latest
</span></span></code></pre></div><p>安装依赖</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -fsSL https://ghproxy.com/https://raw.githubusercontent.com/shufflewzc/QLDependency/main/Shell/QLOneKeyDependency.sh <span class="p">|</span> sh
</span></span></code></pre></div><h2 id="heimdall">Heimdall</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -d <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --name<span class="o">=</span>heimdall <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">PUID</span><span class="o">=</span><span class="m">1000</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">PGID</span><span class="o">=</span><span class="m">1000</span> <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -e <span class="nv">TZ</span><span class="o">=</span>Asia/Shanghai <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -p 8080:80 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -p 8443:443 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  -v /volume1/docker/heimdall:/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  --restart unless-stopped <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>  lscr.io/linuxserver/heimdall:latest
</span></span></code></pre></div><h2 id="xray">Xray</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -d -p 9000:9000 --name xray --restart<span class="o">=</span>unless-stopped -v /volume1/docker/xray:/etc/xray teddysun/xray
</span></span></code></pre></div><h2 id="nodered">NodeRED</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -it -p 1880:1880 -v /volume1/docker/NodeRED:/data --name mynodered nodered/node-red
</span></span></code></pre></div><h2 id="chinesesubfinder">ChineseSubFinder</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;3&#34;</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w"></span><span class="nt">services</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">  </span><span class="nt">chinesesubfinder</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">allanpk716/ChineseSubFinder:latest</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">volumes</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">/volume1/docker/chinesesubfinder/config:/config </span><span class="w"> </span><span class="c"># 冒号左边请修改为你想在主机上保存配置、日志等文件的路径</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">/volume1/video:/media   </span><span class="w"> </span><span class="c"># 请修改为你的媒体目录，冒号右边可以改成你方便记忆的目录，多个媒体目录需要分别映射进来</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">/volume1/docker/chinesesubfinder/browser:/root/.cache/rod/browser   </span><span class="w"> </span><span class="c"># 容器重启后无需再次下载 chrome，除非 go-rod 更新</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">environment</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">PUID=1026        </span><span class="w"> </span><span class="c"># uid</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">PGID=100         </span><span class="w"> </span><span class="c"># gid</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">PERMS=true       </span><span class="w"> </span><span class="c"># 是否重设/media 权限</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">TZ=Asia/Shanghai </span><span class="w"> </span><span class="c"># 时区</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="l">UMASK=022        </span><span class="w"> </span><span class="c"># 权限掩码</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">restart</span><span class="p">:</span><span class="w"> </span><span class="l">unless-stopped</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">network_mode</span><span class="p">:</span><span class="w"> </span><span class="l">bridge</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">hostname</span><span class="p">:</span><span class="w"> </span><span class="l">chinesesubfinder</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">container_name</span><span class="p">:</span><span class="w"> </span><span class="l">chinesesubfinder</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">ports</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="m">19035</span><span class="p">:</span><span class="m">19035</span><span class="w">  </span><span class="c"># 从 0.20.0 版本开始，通过 webui 来设置</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">      </span>- <span class="m">19037</span><span class="p">:</span><span class="m">19037</span><span class="w">  </span><span class="c"># webui 的视频列表读取图片用，务必设置不要暴露到外网</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">    </span><span class="nt">logging</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">        </span><span class="nt">driver</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;json-file&#34;</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">        </span><span class="nt">options</span><span class="p">:</span><span class="w">
</span></span></span><span class="line"><span class="cl"><span class="w">          </span><span class="nt">max-size</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;100m&#34;</span><span class="w"> </span><span class="c"># 限制 docker 控制台日志大小，可自行调整</span><span class="w">
</span></span></span></code></pre></div>]]></content:encoded></item><item><title>使用群晖 Web Station 搭建 Heimdall 导航页</title><link>https://weixiang.github.io/posts/use-synology-web-station-to-build-heimdall-navigation-page/</link><pubDate>Wed, 19 Jul 2023 16:19:43 +0800</pubDate><guid>https://weixiang.github.io/posts/use-synology-web-station-to-build-heimdall-navigation-page/</guid><description>Heimdall 是一个专为组织网页应用而设计的仪表盘，你可以将任意链接添加到其中。它简洁优雅，避免了链接被书签淹没的情况，还可以作为浏览器的起始页，支持通过 Google、Bing 或 DuckDuckGo 搜索。</description><content:encoded><![CDATA[<h2 id="安装环境">安装环境</h2>
<p>在套件中心安装 Web Station，随后选择安装 PHP 7.4，Nginx 默认已经安装。</p>
<h2 id="创建网站">创建网站</h2>
<p>在 Web Station 中新建一个虚拟主机，在 web 中新建一个文件夹作为文档根目录，PHP 选择 PHP 7.4。</p>
<p>在 <a href="https://github.com/linuxserver/Heimdall/releases">https://github.com/linuxserver/Heimdall/releases</a> 下载最新源码，解压放入文档根目录中。</p>
<h2 id="安装网站">安装网站</h2>
<p>SSH 登录到群晖中，定位到 heimdall 的文件夹</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nb">cd</span> /volume1/web/heimdall/
</span></span></code></pre></div><p>复制 env 文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">cp .env.example .env
</span></span></code></pre></div><p>生成 key</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">/volume1/@appstore/PHP7.4/usr/local/bin/php74 artisan key:generate
</span></span></code></pre></div><p>提示 <code>Application key set successfully.</code> 即成功。</p>
<h2 id="添加伪静态规则">添加伪静态规则</h2>
<p>切换到 root</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo -i
</span></span></code></pre></div><p>查看网站配置目录</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">cat /usr/local/etc/nginx/sites-enabled/server.webstation-vhost.conf
</span></span></code></pre></div><p>类似这样</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-nginx" data-lang="nginx"><span class="line"><span class="cl"><span class="k">server</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">listen</span>      <span class="mi">1010</span> <span class="s">default_server</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">    <span class="kn">listen</span>      <span class="s">[::]:1010</span> <span class="s">default_server</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">server_name</span> <span class="s">_</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">include</span> <span class="s">conf.d/.webstation.error_page.default.conf*</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">include</span> <span class="s">conf.d/.webstation.error_page.default.resource.conf*</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">root</span>    <span class="s">&#34;/volume1/web/heimdall&#34;</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">    <span class="kn">index</span>    <span class="s">index.html</span>  <span class="s">index.htm</span>  <span class="s">index.cgi</span>  <span class="s">index.php</span>  <span class="s">index.php5</span> <span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">location</span> <span class="p">~</span><span class="sr">*</span> <span class="s">\.(php[345]?|phtml)</span>$ <span class="p">{</span>
</span></span><span class="line"><span class="cl">        <span class="kn">fastcgi_pass</span> <span class="s">unix:/run/php-fpm/php-182b445b-6caf-469f-acaa-a763582ba8db.sock</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">        <span class="kn">include</span> <span class="s">fastcgi.conf</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">    <span class="p">}</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">    <span class="kn">include</span> <span class="s">/usr/local/etc/nginx/conf.d/fd25cdf2-2438-4855-b10d-1db7450c9e8b/user.conf*</span><span class="p">;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><p>可知目录在 <code>/usr/local/etc/nginx/conf.d/fd25cdf2-2438-4855-b10d-1db7450c9e8b</code></p>
<p>定位到目录</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl"><span class="nb">cd</span> /usr/local/etc/nginx/conf.d/fd25cdf2-2438-4855-b10d-1db7450c9e8b
</span></span></code></pre></div><p>创建并编辑用户配置</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">touch user.conf
</span></span><span class="line"><span class="cl">vim user.conf
</span></span></code></pre></div><p>在其中写入配置</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-nginx" data-lang="nginx"><span class="line"><span class="cl"><span class="k">location</span> <span class="s">/</span> <span class="p">{</span>
</span></span><span class="line"><span class="cl">    <span class="kn">try_files</span> <span class="nv">$uri</span> <span class="nv">$uri/</span> <span class="s">/index.php?</span><span class="nv">$query_string</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"><span class="p">}</span>
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<p><a href="https://github.com/linuxserver/Heimdall">https://github.com/linuxserver/Heimdall</a></p>
<p><a href="https://post.smzdm.com/p/a07mx329/">https://post.smzdm.com/p/a07mx329/</a></p>
<p><a href="https://www.simaek.com/archives/298/">https://www.simaek.com/archives/298/</a></p>
]]></content:encoded></item><item><title>使用 SakuraFrp 内网穿透 DSM</title><link>https://weixiang.github.io/posts/use-sakurafrp-to-penetrate-dsm-through-the-intranet/</link><pubDate>Wed, 19 Jul 2023 16:19:16 +0800</pubDate><guid>https://weixiang.github.io/posts/use-sakurafrp-to-penetrate-dsm-through-the-intranet/</guid><description>使用 SakuraFrp 内网穿透 DSM 和 HomeAssistant。SakuraFrp 是免费的内网穿透服务。SakuraFrp 是由 KasuganoSora 开发、维护的一个共享内网穿透管理平台，长期提供免费的内网穿透服务。</description><content:encoded><![CDATA[<h2 id="docker-部署-sakurafrp-客户端">Docker 部署 SakuraFrp 客户端</h2>
<p>参考官方文档：<a href="https://doc.natfrp.com/app/synology.html">https://doc.natfrp.com/app/synology.html</a></p>
<ol>
<li>安装 Docker 套件</li>
<li>拉取镜像：<strong>natfrp/frpc</strong></li>
<li>在打开 Docker 套件的 <strong>网络</strong> 页面，查看 <code>bridge</code> 网络的 <strong>子网</strong>，把 <strong>最后一个</strong> <code>0</code> 换成 <code>1</code> 作为 <strong>本地 IP</strong>。举个例子，子网 <code>172.17.0.0/16</code> 对应的 <strong>本地 IP</strong> 就是 <code>172.17.0.1</code>。</li>
<li>前往 Sakura Frp 管理面板使用之前获取到的信息创建一条 <strong>TCP 隧道</strong>，本地 IP 填写上面获取到的 IP，例如<code>172.17.0.1</code>，端口选择 5001，即 DSM 的 HTTPS 端口。</li>
<li>在隧道列表中点击刚才创建的隧道右边三个点，选择 <strong>配置文件</strong> 并在弹出的对话框中复制隧道的 <strong>启动参数</strong>，类似于这样的<code>-f 6i862oypc561ipo5ku9uz895o40jh73:7605087</code>。</li>
<li>新建容器，镜像选择<strong>natfrp/frpc</strong>，选择开机自启。</li>
<li>转到 <strong>环境</strong> 标签，在 <strong>命令</strong> 处粘贴 <strong>启动参数</strong>，然后点击上面的 <strong>新增</strong> 按钮分别填写 <code>LANG</code> 和 <code>en_US.UTF-8</code></li>
<li>启动后可以在日志中看到访问 URL。</li>
</ol>
<h2 id="启动多个隧道">启动多个隧道</h2>
<p>使用以下参数即可启动多个隧道，参考 <a href="https://doc.natfrp.com/faq/frpc.html">https://doc.natfrp.com/faq/frpc.html</a></p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">-f &lt;访问密钥&gt;:&lt;隧道ID&gt;,&lt;另外一个隧道ID&gt;,&lt;更多隧道ID&gt;,n&lt;节点ID&gt;,n&lt;另外一个节点ID&gt;,...
</span></span></code></pre></div><p>例如</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">-f 6i862oypc561ipo5ku9uz895o40jh73:7605087,7605086,7605085
</span></span></code></pre></div><h2 id="ssl-证书配置">SSL 证书配置</h2>
<blockquote>
<p>官方文档有说明：<a href="https://doc.natfrp.com/frpc/ssl.html">https://doc.natfrp.com/frpc/ssl.html</a></p>
</blockquote>
<p>但尝试过后发现无法使用，原因未知（浪费 5 个小时</p>
<p>最后使用 DSM 自带的反向代理解决。</p>
<p>首先，准备一个域名，使用 CNAME 解析到 SakuraFrp 的节点地址，参考 <a href="https://doc.natfrp.com/app/http.html#setup-dns">https://doc.natfrp.com/app/http.html#setup-dns</a></p>
<p>接着给域名申请一个 SSL 证书，格式选择 Nginx，下载保存。</p>
<h3 id="dsm">DSM</h3>
<p>直接在 DSM 的安全设置中，选择添加证书，选择刚刚自己申请的证书，并且设为默认证书，替代原有自签证书即可。</p>
<p>SakuraFrp 面板穿透配置：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">本地 IP：172.17.0.1  # 根据自己 Docker 网卡设置
</span></span><span class="line"><span class="cl">本地端口：5001
</span></span><span class="line"><span class="cl">自动 HTTPS：禁用
</span></span></code></pre></div><p>就可以使用<code>https://自己域名地址:穿透后端口号</code>访问了。</p>
<h3 id="home-assistant">Home Assistant</h3>
<p>在 DSM 的登录门户设置中，选择高级 - 反向代理服务器，添加一个反向代理。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">来源：
</span></span><span class="line"><span class="cl">协议：HTTPS
</span></span><span class="line"><span class="cl">主机名：*
</span></span><span class="line"><span class="cl">端口：8124
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">目的地：
</span></span><span class="line"><span class="cl">协议：HTTP
</span></span><span class="line"><span class="cl">主机名：127.0.0.1
</span></span><span class="line"><span class="cl">端口：8123
</span></span></code></pre></div><p>SakuraFrp 面板穿透配置：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">本地 IP：172.17.0.1  # 根据自己 Docker 网卡设置
</span></span><span class="line"><span class="cl">本地端口：8124
</span></span><span class="line"><span class="cl">自动 HTTPS：禁用
</span></span></code></pre></div><p>Home Assistant App 配置：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">内部 URL：http://NAS 局域网 IP 地址:8123
</span></span><span class="line"><span class="cl">外部 URL：https://自己域名地址：穿透后端口号
</span></span></code></pre></div><h2 id="参考文献">参考文献</h2>
<p><a href="https://doc.natfrp.com/app/synology.html">https://doc.natfrp.com/app/synology.html</a></p>
]]></content:encoded></item><item><title>ZeroTier-One 私有 MOON 节点搭建</title><link>https://weixiang.github.io/posts/deploy-zerotier-one-private-moon-node/</link><pubDate>Wed, 19 Jul 2023 16:18:31 +0800</pubDate><guid>https://weixiang.github.io/posts/deploy-zerotier-one-private-moon-node/</guid><description>由于 ZeroTier 在国内并没有中转节点，导致速度非常缓慢，可以通过自己搭建 Moon 节点来提升使用体验。ZeroTier 是一款非常简单易用的内网穿透工具，不需要配置，就能实现虚拟局域网的组建，让你可以在外也能连回家中、学校、办公室的电脑获取资料，数据。</description><content:encoded><![CDATA[<h2 id="安装">安装</h2>
<p>登录到服务器，一键安装</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -s https://install.zerotier.com/ <span class="p">|</span> sudo bash
</span></span></code></pre></div><p>启动服务</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo systemctl start zerotier-one.service
</span></span></code></pre></div><p>添加自启动</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo systemctl <span class="nb">enable</span> zerotier-one.service
</span></span></code></pre></div><h2 id="moon-配置">MOON 配置</h2>
<p>加入网络，执行完后去管理页面把 Auth 打勾允许加入</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo zerotier-cli join 1d71939404759fc5
</span></span></code></pre></div><p>生成 moon 配置文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nb">cd</span> /var/lib/zerotier-one/
</span></span><span class="line"><span class="cl">sudo zerotier-idtool initmoon identity.public &gt; moon.json
</span></span></code></pre></div><p>编辑配置文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">vi moon.json
</span></span></code></pre></div><p>填入 IP 地址</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="s2">&#34;stableEndpoints&#34;</span>: <span class="o">[</span><span class="s2">&#34;47.242.224.64/9993&#34;</span><span class="o">]</span>
</span></span></code></pre></div><p>执行签名</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">zerotier-idtool genmoon moon.json
</span></span></code></pre></div><p>创建 moon 文件夹，将生成的签名文件移动进去</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo mkdir moons.d
</span></span><span class="line"><span class="cl">sudo mv 0000004c725ecec8.moon moons.d/
</span></span></code></pre></div><p>重启服务</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo systemctl restart zerotier-one
</span></span></code></pre></div><h2 id="客户端配置">客户端配置</h2>
<p>添加 MOON</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">zerotier-cli orbit 4c725ecec8 4c725ecec8
</span></span></code></pre></div><p>查看状态</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">zerotier-cli listpeers
</span></span></code></pre></div>]]></content:encoded></item><item><title>群晖部署青龙面板</title><link>https://weixiang.github.io/posts/synology-deploys-qinglong-panel/</link><pubDate>Wed, 19 Jul 2023 16:18:18 +0800</pubDate><guid>https://weixiang.github.io/posts/synology-deploys-qinglong-panel/</guid><description>本文记录在群晖 DSM 上使用 Docker 部署青龙面板。青龙，又名苍龙，在中国传统文化中是四象之一、天之四灵之一。青龙面板是支持 Python3、JavaScript、Shell、Typescript 的定时任务管理平台</description><content:encoded><![CDATA[<h2 id="启动容器">启动容器</h2>
<p>Docker 镜像可能更新有延迟，可以通过将 <code>latest</code> 替换为版本号，来指定拉取最新版本。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -dit <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/config:/ql/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/log:/ql/log <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/db:/ql/db <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-p 5600:5600 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--name qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--hostname qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--restart always <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>whyour/qinglong:latest
</span></span></code></pre></div><p>指定版本</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">docker run -dit <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/config:/ql/config <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/log:/ql/log <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-v <span class="nv">$PWD</span>/ql/db:/ql/db <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>-p 5600:5600 <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--name qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--hostname qinglong <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>--restart always <span class="se">\
</span></span></span><span class="line"><span class="cl"><span class="se"></span>whyour/qinglong:2.15.1
</span></span></code></pre></div><h2 id="修改配置文件">修改配置文件</h2>
<p>修改 <code>config.sh</code></p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1">## 代理地址，支持HTTP/SOCK5，例如 http://127.0.0.1:7890</span>
</span></span><span class="line"><span class="cl"><span class="nv">ProxyUrl</span><span class="o">=</span><span class="s2">&#34;http://192.168.31.166:7890&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1">## 3. Telegram</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 下方填写自己申请@BotFather的Token，如10xxx4:AAFcqxxxxgER5uw</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">TG_BOT_TOKEN</span><span class="o">=</span><span class="s2">&#34;**********:******************************&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 下方填写 @getuseridbot 中获取到的纯数字ID</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">TG_USER_ID</span><span class="o">=</span><span class="s2">&#34;**********&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1">## Telegram 代理IP（选填）</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 下方填写代理IP地址，代理类型为 http，比如您代理是 http://127.0.0.1:1080，则填写 &#34;127.0.0.1&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 如需使用，请自行解除下一行的注释</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">TG_PROXY_HOST</span><span class="o">=</span><span class="s2">&#34;192.168.31.166&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1">## Telegram 代理端口（选填）</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 下方填写代理端口号，代理类型为 http，比如您代理是 http://127.0.0.1:1080，则填写 &#34;1080&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1">## 如需使用，请自行解除下一行的注释</span>
</span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">TG_PROXY_PORT</span><span class="o">=</span><span class="s2">&#34;7890&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1">## ql repo命令拉取脚本时需要拉取的文件后缀，直接写文件后缀名即可</span>
</span></span><span class="line"><span class="cl"><span class="nv">RepoFileExtensions</span><span class="o">=</span><span class="s2">&#34;js py sh&#34;</span>
</span></span></code></pre></div><h2 id="安装常用依赖">安装常用依赖</h2>
<p>进入容器执行：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -fsSL https://ghproxy.com/https://raw.githubusercontent.com/FlechazoPh/QLDependency/main/Shell/QLOneKeyDependency.sh <span class="p">|</span> sh
</span></span></code></pre></div><p>完成后重启容器</p>
<h2 id="开始使用">开始使用</h2>
<h3 id="京东">京东</h3>
<h4 id="拉取脚本">拉取脚本</h4>
<p>任务定时建议 <code>50 7-23/2 * * *</code></p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># KingRan/KR（集合库）</span>
</span></span><span class="line"><span class="cl">ql repo https://github.com/KingRan/KR.git <span class="s2">&#34;jd_|jx_|jdCookie&#34;</span> <span class="s2">&#34;activity|backUp&#34;</span> <span class="s2">&#34;^jd[^_]|USER|utils|function|sign|sendNotify|ql|JDJR&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># 6dylan6/jdpro（集合库）</span>
</span></span><span class="line"><span class="cl">ql repo https://github.com/6dylan6/jdpro.git <span class="s2">&#34;jd_|jx_|jddj_&#34;</span> <span class="s2">&#34;backUp&#34;</span> <span class="s2">&#34;^jd[^_]|USER|JD|function|sendNotify&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># gys619/Absinthe（集合库）</span>
</span></span><span class="line"><span class="cl">ql repo https://github.com/gys619/Absinthe.git <span class="s2">&#34;jd_|jx_|jddj_|gua_|getJDCookie|wskey&#34;</span> <span class="s2">&#34;activity|backUp&#34;</span> <span class="s2">&#34;^jd[^_]|USER|utils|ZooFaker_Necklace|JDJRValidator_|sign_graphics_validate|jddj_cookie|function|ql|magic|JDJR|JD&#34;</span> <span class="s2">&#34;main&#34;</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># zero205/JD_tencent_scf</span>
</span></span><span class="line"><span class="cl">ql repo https://github.com/zero205/JD_tencent_scf.git <span class="s2">&#34;jd_|jx_|jdCookie&#34;</span> <span class="s2">&#34;backUp|icon&#34;</span> <span class="s2">&#34;^jd[^_]|USER|sendNotify|sign_graphics_validate|JDJR|JDSign|ql&#34;</span> <span class="s2">&#34;main&#34;</span>
</span></span></code></pre></div><h4 id="获取-cookie">获取 Cookie</h4>
<p>前往京东手机版登录 <a href="https://m.jd.com">https://m.jd.com</a></p>
<p>使用开发者工具查看 Network 即可获取到 Cookie：</p>
<p>其中只需要 <code>pt_key</code> 与 <code>pt_pin</code> 两个，分号不可少：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">pt_key=AAJjiW4IADB_2Pgyapctjm8mnz3OvE8Jv-****************************************; pt_pin=**********;
</span></span></code></pre></div><p>将其添加到环境变量，命名为 <code>JD_COOKIE</code></p>
<h3 id="b-站">B 站</h3>
<h4 id="安装环境">安装环境</h4>
<p>进入容器执行，完成后重启容器</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 安装 dotnet 环境</span>
</span></span><span class="line"><span class="cl">curl -sSL https://ghproxy.com/https://raw.githubusercontent.com/RayWangQvQ/BiliBiliToolPro/main/qinglong/ray-dotnet-install.sh <span class="p">|</span> bash /dev/stdin
</span></span></code></pre></div><h4 id="拉取脚本-1">拉取脚本</h4>
<p>添加订阅</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">名称：Bilibili
</span></span><span class="line"><span class="cl">类型：公开仓库
</span></span><span class="line"><span class="cl">链接：https://github.com/RayWangQvQ/BiliBiliToolPro.git
</span></span><span class="line"><span class="cl">定时类型：crontab
</span></span><span class="line"><span class="cl">定时规则：2 2 28 * *
</span></span><span class="line"><span class="cl">白名单：bili_task_.+\.sh
</span></span><span class="line"><span class="cl">文件后缀：sh
</span></span></code></pre></div><h4 id="获取-cookie-1">获取 Cookie</h4>
<p>使用 <strong>隐私窗口</strong> 登录 B 站，后打开 <a href="https://api.bilibili.com/x/web-interface/nav">https://api.bilibili.com/x/web-interface/nav</a> 获取 Cookie</p>
<p>保存到环境变量，命名为 <code>Ray_BiliBiliCookies__1</code></p>
<h4 id="配置推送">配置推送</h4>
<p>Telegram：添加以下环境变量</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Ray_Serilog__WriteTo__3__Args__botToken
</span></span><span class="line"><span class="cl">Ray_Serilog__WriteTo__3__Args__chatId
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">Ray_Serilog__WriteTo__3__Args__proxy
</span></span><span class="line"><span class="cl"># 代理格式为 user:password@host:port
</span></span></code></pre></div><h3 id="原神国际版">原神国际版</h3>
<h4 id="拉取脚本-2">拉取脚本</h4>
<p>订阅添加</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">地址：https://github.com/Ethiner/hoyolab_daily_login
</span></span><span class="line"><span class="cl">文件后缀：py
</span></span></code></pre></div><h4 id="获取-cookie-2">获取 Cookie</h4>
<p>打开 <a href="http://hoyolab.com/">http://hoyolab.com/</a> 登录获取</p>
<p>其中只用到</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">ltoken=dTpY78eoKW5SbvLocxdI33********************; ltuid=**********;
</span></span></code></pre></div><p>分别填入环境变量，名为 <code>LTOKEN</code> 和 <code>LTUID</code></p>
<h2 id="参考文献">参考文献</h2>
<p><a href="https://www.dujin.org/18884.html">https://www.dujin.org/18884.html</a></p>
<p><a href="https://github.com/RayWangQvQ/BiliBiliToolPro">https://github.com/RayWangQvQ/BiliBiliToolPro</a></p>
<p><a href="https://github.com/FlechazoPh/QLDependency">https://github.com/FlechazoPh/QLDependency</a></p>
<p><a href="https://github.com/Ethiner/hoyolab_daily_login">https://github.com/Ethiner/hoyolab_daily_login</a></p>
]]></content:encoded></item><item><title>解决华擎 J3455 主板 DSM 兼容性问题</title><link>https://weixiang.github.io/posts/solve-the-dsm-compatibility-issue-of-asrock-j3455-motherboard/</link><pubDate>Tue, 16 Aug 2022 14:06:57 +0800</pubDate><guid>https://weixiang.github.io/posts/solve-the-dsm-compatibility-issue-of-asrock-j3455-motherboard/</guid><description>通过 AmiSetupWriter 修改隐藏的 BIOS 选项，解决了华擎 J3455 主板安装 DSM 黑群晖的兼容性问题。</description><content:encoded><![CDATA[<p>原本华擎 J3455 是最接近 DS918 原厂配置的主板，乃黑群晖之上品，但却因为华擎的骚操作，导致这款主板安装 DSM 时会出现各种奇奇怪怪的问题，启动慢，传输速度慢等等。在距离这款主板发布五年有余的 2022 年，终于水落石出。问题就出在华擎在 BIOS 中隐藏了 OS 兼容性的选项。</p>
<h2 id="破题">破题</h2>
<p>参考其他主板的 BIOS</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">0x193E1                 One Of: OS Selection, VarStoreInfo (VarOffset/VarName): 0x494, VarStore: 0x1, QuestionId: 0x272A, Size: 1, Min: 0x0, Max 0x4, Step: 0x0 {05 91 9C 01 9D 01 2A 27 01 00 94 04 14 10 00 04 00}
</span></span><span class="line"><span class="cl">0x193F2                         One Of Option: Windows, Value (8 bit): 0x0 (default) {09 07 9E 01 30 00 00}
</span></span><span class="line"><span class="cl">0x193F9                         One Of Option: Android, Value (8 bit): 0x1 {09 07 9F 01 00 00 01}
</span></span><span class="line"><span class="cl">0x19400                         One Of Option: Win7, Value (8 bit): 0x2 {09 07 A0 01 00 00 02}
</span></span><span class="line"><span class="cl">0x19407                         One Of Option: Intel Linux, Value (8 bit): 0x3 {09 07 A2 01 00 00 03}
</span></span><span class="line"><span class="cl">0x1940E                         One Of Option: MSDOS, Value (8 bit): 0x4 {09 07 A1 01 00 00 04}
</span></span><span class="line"><span class="cl">0x19415                 End One Of {29 02}
</span></span></code></pre></div><p>下面是华擎的 BIOS</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">0x19C71                 One Of: OS Selection, VarStoreInfo (VarOffset/VarName): 0x48A, VarStore: 0x1, QuestionId: 0x273E, Size: 1, Min: 0x0, Max 0x4, Step: 0x0 {05 91 E0 01 E1 01 3E 27 01 00 8A 04 14 10 00 04 00}
</span></span><span class="line"><span class="cl">0x19C82                         One Of Option: Windows, Value (8 bit): 0x0 (default) {09 07 E2 01 30 00 00}
</span></span><span class="line"><span class="cl">0x19C89                         One Of Option: Android, Value (8 bit): 0x1 {09 07 E3 01 00 00 01}
</span></span><span class="line"><span class="cl">0x19C90                         One Of Option: Win7, Value (8 bit): 0x2 {09 07 E4 01 00 00 02}
</span></span><span class="line"><span class="cl">0x19C97                         One Of Option: MSDOS, Value (8 bit): 0x4 {09 07 E5 01 00 00 04}
</span></span><span class="line"><span class="cl">0x19C9E                 End One Of {29 02}
</span></span></code></pre></div><p>可以发现缺少了一项</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">0x19407                         One Of Option: Intel Linux, Value (8 bit): 0x3 {09 07 A2 01 00 00 03}
</span></span></code></pre></div><p>这就是问题所在。</p>
<h2 id="升级-bios">升级 BIOS</h2>
<p>解决这个问题，首先要将 BIOS 升级到最新的 1.8 版本，若原版本过旧，需要先升级到 1.7 再升级为 1.8。</p>
<p>前往华擎官网下载即可：<a href="https://www.asrock.com/mb/Intel/J3455-ITX/index.cn.asp#BIOS">https://www.asrock.com/mb/Intel/J3455-ITX/index.cn.asp#BIOS</a></p>
<p>下载 BIOS 时，通过 <code>中国</code> 无法下载时，可以开代理，选择 <code>全球</code> 会更快一些。</p>
<p>华擎 J3455 P1.8 BIOS 下载地址：<a href="https://download.asrock.com/BIOS/CPU/J3455-ITX%281.80%29ROM.zip">https://download.asrock.com/BIOS/CPU/J3455-ITX(1.80)ROM.zip</a></p>
<p>下载后 <strong>解压</strong> 到 U 盘，重启按住 F6 即可进入升级界面（图文不符）。</p>
<p>具体可参考：<a href="https://www.asrock.com/support/BIOSIG.cn.asp?cat=BIOS8">https://www.asrock.com/support/BIOSIG.cn.asp?cat=BIOS8</a></p>
<p><img loading="lazy" src="https://www.asrock.com/support/images/BIOSUI-BIOS8-4.jpg"></p>
<h2 id="制作-amisetupwriter-启动盘">制作 AmiSetupWriter 启动盘</h2>
<p>首先建议选择 UEFI 进行引导。</p>
<p>下载 <code>AmiSetupWriter</code>，解压到一个 <strong>FAT32</strong> 的空白 U 盘的根目录。</p>
<p>此工具可以在互联网上找到，常见用途是强行给 10 代以上的主板装 Windows 7（奇怪的要求
这里放一个两个下载链接，若失效可自行搜索下载。</p>
<p><a href="https://mega.nz/folder/NC5CXLQS#YNCi_9IDn18y7axbdNyRMQ">https://mega.nz/folder/NC5CXLQS#YNCi_9IDn18y7axbdNyRMQ</a></p>
<p><a href="https://pan.baidu.com/wap/init?surl=H4suGj8pwVPw2oAZsCn1dA">https://pan.baidu.com/wap/init?surl=H4suGj8pwVPw2oAZsCn1dA</a> （提取码：jzhu）</p>
<h2 id="修改-bios">修改 BIOS</h2>
<p>将启动盘插入目标设备，启动时按 F11，选择从 U 盘启动。</p>
<p>会出现一个终端 <code>Shell&gt;</code>，大概长这样（图文不符）：</p>
<p><img alt="image.png" loading="lazy" src="https://winraid.level1techs.com/uploads/default/original/3X/0/5/05fae3e1ad38a4754b749860e17b9af19598d7f2.jpeg"></p>
<p>输入命令：</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">amisetupwriter 0x4E2 0x3
</span></span></code></pre></div><p>然后输入 <code>exit</code> 退出，重启完工。
实测 DSM7 效果，开机一分半左右，传输速度基本达到千兆水平。</p>
<h2 id="参考文献">参考文献</h2>
<p><a href="http://www.gebi1.com/thread-302113-1-1.html">http://www.gebi1.com/thread-302113-1-1.html</a></p>
<p><a href="https://www.asrock.com/support/BIOSIG.cn.asp?cat=BIOS8">https://www.asrock.com/support/BIOSIG.cn.asp?cat=BIOS8</a></p>
<p><a href="https://winraid.level1techs.com/t/tool-guide-ami-setup-ifr-extractor-amisetupwriter/32801">https://winraid.level1techs.com/t/tool-guide-ami-setup-ifr-extractor-amisetupwriter/32801</a></p>
<h2 id="版权声明">版权声明</h2>
<p><img alt="知识共享许可协议" loading="lazy" src="https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png">
本文由 <a href="https://weixiang.github.io">Jacob</a> 采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0">知识共享署名 - 非商业性使用 - 相同方式共享 4.0 国际许可协议</a> 进行许可，发布于 <a href="https://weixiang.github.io">weixiang.github.io</a> 。</p>
]]></content:encoded></item><item><title>自己动手编译 DSM7 引导</title><link>https://weixiang.github.io/posts/compile-your-own-dsm7-boot/</link><pubDate>Fri, 12 Aug 2022 08:45:41 +0800</pubDate><guid>https://weixiang.github.io/posts/compile-your-own-dsm7-boot/</guid><description>使用 tinycore-redpill 自己动手编译黑群晖 Synology DSM7 的引导镜像，以华擎 J3455 为例。</description><content:encoded><![CDATA[<h2 id="引子">引子</h2>
<p>假期给家里组了一台 NAS，万由 401 机箱 + 华擎 J3455。</p>
<p>没想到过程比预想中要曲折许多，买了才知道，华擎 J3455 是著名的“妖板”。</p>
<p>安装各种出错，启动时间巨长（至少十分钟），网速飘忽不定，还有 DSM 中各种奇奇怪怪的 Bug……</p>
<p>总之，敢碰华擎 J3455 的都是勇士。</p>
<p>听说是驱动问题造成的，自己编译引导可以一定程度上缓解这些问题。</p>
<p>于是就有了下面的笔记。</p>
<blockquote>
<p>事实证明确实靠谱，比用通用引导稳定了不少，目前已经平稳运行两周有余。感谢 pocopico 和 llm-y2k 两位开发者。</p>
</blockquote>
<h2 id="制作-tinycore-redpill-启动盘">制作 tinycore-redpill 启动盘</h2>
<p>前往项目：<a href="https://github.com/llm-y2k/tinycore-redpill">https://github.com/llm-y2k/tinycore-redpill</a>
这里采用了 llm-y2k 修改的换源版镜像：</p>
<blockquote>
<p>pocopico 发布的<a href="https://github.com/pocopico/tinycore-redpill">Tinycore-redpill</a>实现编译 DSM7 引导的自动化，省去繁琐的手工操作部分，造福了广大玩家。但由于众所周知的原因，</p>
</blockquote>
<p>Tinycore-redpill 在国内网络基本无法使用，U 盘引导 NAS 实体机编译时几乎无法完成，遂修改部分代码以适应国内网络环境，目前已可正常使用。</p>
<p>下载镜像文件，根据设备情况选择不同的引导镜像，我这里选用了<code>[tinycore-redpill-uefi.v0.8.0.0.img.gz](https://github.com/llm-y2k/tinycore-redpill/blob/cn/tinycore-redpill-uefi.v0.8.0.0.img.gz)</code>。</p>
<p>使用任意引导盘制作工具，如 Rufus，烧录进 U 盘即可。</p>
<h2 id="启动-tinycore-redpill">启动 tinycore-redpill</h2>
<p>将烧写完成的 U 盘插入目标设备，选择从 U 盘启动即可进入系统，点击下图图标进入终端。</p>
<p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIK9e.md.jpg"></p>
<p>使用<code>ifconfig</code>命令查看设备 IP 地址</p>
<p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIM1H.jpg"></p>
<p>使用任意 SSH 工具连接到上面的 IP，账号为<code>tc</code>，密码为<code>P@ssw0rd</code></p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">ssh tc@192.168.0.243
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAI3nI.jpg"></p>
<h2 id="更新脚本">更新脚本</h2>
<p>首先更新脚本</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo curl https://raw.0z.gs/llm-y2k/tinycore-redpill/main/rploader-cn.sh<span class="p">|</span>bash -s fullupgrade
</span></span></code></pre></div><p>授予执行权限</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo chmod <span class="m">777</span> *.sh
</span></span></code></pre></div><h2 id="生成配置">生成配置</h2>
<p>输入如下命令开始配置编译文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo ./rploader-cn.sh serialgen DS918+ now
</span></span><span class="line"><span class="cl">或者
</span></span><span class="line"><span class="cl">sudo ./rploader-cn.sh serialgen DS3615xs now
</span></span><span class="line"><span class="cl">这里设置nas机型，推荐选择918和3615两种中的一种
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIGHP.jpg"></p>
<p>配置盘序文件</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo ./rploader-cn.sh satamap now
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIYAf.jpg"></p>
<p>生成 U 盘 VID、PID 信息</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo ./rploader-cn.sh identifyusb now
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAItN8.jpg"></p>
<h2 id="开始编译">开始编译</h2>
<p>配置完成后，正式开始编译，根据机器和网络速度，耗时可能会比较长，耐心等待即可。
建议上游做好代理设置，跑起来会比较顺利。</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 根据前面所选机型输入编译命令</span>
</span></span><span class="line"><span class="cl">918：
</span></span><span class="line"><span class="cl">sudo ./rploader-cn.sh build apollolake-7.0.1-42218
</span></span><span class="line"><span class="cl">3615：
</span></span><span class="line"><span class="cl">sudo ./rploader-cn.sh build bromolow-7.0.1-42218
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIN4S.jpg"></p>
<p>curl 35 错误不妨休息一下，过会再试，curl 60 错误不妨检查下 Nas 机器本地时间是否正确。
由于网络原因，可能个别驱动下载失败，别慌，重新再次编译即可。</p>
<p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAId3Q.jpg"></p>
<p>编译成功！切换到 winscp 去下载生成的文件</p>
<p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIa9g.jpg"></p>
<h2 id="备份引导">备份引导</h2>
<p>下载引导镜像文件，做好备份有备无患，此引导镜像相当于为此设备定制。</p>
<p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAI0js.md.jpg"></p>
<p>最后回到 putty，正式存盘，一定要存盘！一定要存盘！一定要存盘！</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo filetool.sh -b
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIDun.jpg"></p>
<p>最后重启设备</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo reboot
</span></span></code></pre></div><p><img loading="lazy" src="https://s1.ax1x.com/2022/03/19/qAIrBq.jpg"></p>
<p>理论上会自动引导进入 DSM 的安装界面，如果没有，可以将上面备份的镜像写入 U 盘，再进行引导。接下来就是常规的 DSM 安装流程了。</p>
<h2 id="参考文献">参考文献</h2>
<p><a href="https://www.openos.org/threads/0-8-0-3dsm7tinycore-redpill.4050/">https://www.openos.org/threads/0-8-0-3dsm7tinycore-redpill.4050/</a></p>
<p><a href="https://github.com/llm-y2k/tinycore-redpill">https://github.com/llm-y2k/tinycore-redpill</a></p>
<p><a href="https://github.com/pocopico/tinycore-redpill">https://github.com/pocopico/tinycore-redpill</a></p>
<h2 id="版权声明">版权声明</h2>
<p><img alt="知识共享许可协议" loading="lazy" src="https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png">
本文由 <a href="https://weixiang.github.io">Jacob</a> 采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0">知识共享署名 - 非商业性使用 - 相同方式共享 4.0 国际许可协议</a> 进行许可，发布于 <a href="https://weixiang.github.io">weixiang.github.io</a> 。</p>
]]></content:encoded></item></channel></rss>