From 2c55af7fab606c86bb36e35265e2f715ebd954a3 Mon Sep 17 00:00:00 2001
From: GitHub <noreply@github.com>
Date: Sun, 21 Jul 2024 22:17:42 +0000
Subject: [PATCH] Auto deploy from GitHub Actions build 438

[addb95e] taoky: faq/nginx: lua module
---
 faq/nginx/index.html     | 95 +++++++++++++++++++++++++++++++++++++---
 search/search_index.json |  2 +-
 2 files changed, 90 insertions(+), 7 deletions(-)

diff --git a/faq/nginx/index.html b/faq/nginx/index.html
index c12e3363..8dc3446e 100644
--- a/faq/nginx/index.html
+++ b/faq/nginx/index.html
@@ -2425,11 +2425,11 @@
         <li class="md-nav__item">
   <a href="#openresty" class="md-nav__link">
     <span class="md-ellipsis">
-      Openresty
+      OpenResty
     </span>
   </a>
   
-    <nav class="md-nav" aria-label="Openresty">
+    <nav class="md-nav" aria-label="OpenResty">
       <ul class="md-nav__list">
         
           <li class="md-nav__item">
@@ -2467,6 +2467,24 @@
     </span>
   </a>
   
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#_2" class="md-nav__link">
+    <span class="md-ellipsis">
+      模块管理
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#_3" class="md-nav__link">
+    <span class="md-ellipsis">
+      代码复用与模块编写
+    </span>
+  </a>
+  
 </li>
         
       </ul>
@@ -2635,11 +2653,11 @@
         <li class="md-nav__item">
   <a href="#openresty" class="md-nav__link">
     <span class="md-ellipsis">
-      Openresty
+      OpenResty
     </span>
   </a>
   
-    <nav class="md-nav" aria-label="Openresty">
+    <nav class="md-nav" aria-label="OpenResty">
       <ul class="md-nav__list">
         
           <li class="md-nav__item">
@@ -2677,6 +2695,24 @@
     </span>
   </a>
   
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#_2" class="md-nav__link">
+    <span class="md-ellipsis">
+      模块管理
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#_3" class="md-nav__link">
+    <span class="md-ellipsis">
+      代码复用与模块编写
+    </span>
+  </a>
+  
 </li>
         
       </ul>
@@ -2738,7 +2774,7 @@ <h2 id="gateway-tmpmem">关于 gateway 配置中的 <code>/tmp/mem</code> 路径
 <p class="admonition-title">fstab 与 systemd</p>
 <p>调整 fstab 之后，需要执行 <code>systemctl daemon-reload</code>，否则 systemd 可能会在第二日凌晨挂载已被注释的磁盘项。</p>
 </div>
-<h2 id="openresty">Openresty<a class="headerlink" href="#openresty" title="Permanent link">&para;</a></h2>
+<h2 id="openresty">OpenResty<a class="headerlink" href="#openresty" title="Permanent link">&para;</a></h2>
 <h3 id="lua">Lua 相关<a class="headerlink" href="#lua" title="Permanent link">&para;</a></h3>
 <p><img alt="Order of Lua Nginx Module Directives" src="https://cloud.githubusercontent.com/assets/2137369/15272097/77d1c09e-1a37-11e6-97ef-d9767035fc3e.png" /></p>
 <p>这里关注三个相关的步骤：<code>access_by</code>, <code>log_by</code> 和 <code>header_filter_by</code>，以及 <code>ngx.ctx</code> 和 <code>ngx.var</code> 的注意事项。</p>
@@ -2839,7 +2875,54 @@ <h4 id="ngxvar"><code>ngx.var</code><a class="headerlink" href="#ngxvar" title="
 <li>只能赋值数字或者字符串，赋值 table 可能不会直接报错，但是实际上不工作。</li>
 </ul>
 <p>但是相比于 <code>ngx.ctx</code>，最大的优势就是即使经过了 internal redirection，<code>ngx.var</code> 的内容也会保留。</p>
-<p>由于 <code>ngx.var</code> 其本身<strong>不</strong>适合存储复杂的结构，第三方模块 (<a href="https://github.com/tokers/lua-resty-ctxdump/">lua-resty-ctxdump</a>) 处理这个问题的做法是：将实际内容保存在模块内部的 memo 表中，而需要存储在 ngx.var 里面的只是 memo 表的 key（数字）。</p>
+<p>由于 <code>ngx.var</code> 其本身<strong>不</strong>适合存储复杂的结构，第三方模块 (<a href="https://github.com/tokers/lua-resty-ctxdump/">lua-resty-ctxdump</a>, 2-clause BSD license) 处理这个问题的做法是：将实际内容保存在模块内部的 memo 表中，而需要存储在 ngx.var 里面的只是 memo 表的 key（数字）。</p>
+<h4 id="_2">模块管理<a class="headerlink" href="#_2" title="Permanent link">&para;</a></h4>
+<p>OpenResty 官方推荐使用 opm (<code>openresty-opm</code>) 管理模块。手动维护模块的话需要自行处理配置，对应的是 <a href="https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#lua_package_path"><code>lua_package_path</code></a>（<code>http</code> 块内，分号分割路径，最后 <code>;;</code> 代表内置的原始路径）。</p>
+<p>例如：</p>
+<div class="highlight"><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="k">lua_package_path</span><span class="w"> </span><span class="s">&quot;/etc/nginx/lua/module/?.lua</span><span class="p">;</span>;<span class="k">&quot;</span><span class="p">;</span>
+</code></pre></div>
+<p>以 <a href="https://github.com/tokers/lua-resty-ctxdump/blob/master/lib/resty/ctxdump.lua">https://github.com/tokers/lua-resty-ctxdump/blob/master/lib/resty/ctxdump.lua</a> 为例，下载到 <code>/etc/nginx/lua/module/</code> 下之后，就可以在其他 lua 文件内使用了：</p>
+<div class="highlight"><span class="filename">/etc/nginx/lua/access.lua</span><pre><span></span><code><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a><span class="kd">local</span> <span class="n">ctxdump</span> <span class="o">=</span> <span class="nb">require</span> <span class="s2">&quot;ctxdump&quot;</span>
+<a id="__codelineno-8-2" name="__codelineno-8-2" href="#__codelineno-8-2"></a><span class="kd">local</span> <span class="n">ctx</span> <span class="o">=</span> <span class="n">ngx</span><span class="p">.</span><span class="n">ctx</span>
+<a id="__codelineno-8-3" name="__codelineno-8-3" href="#__codelineno-8-3"></a><span class="n">ctx</span><span class="p">.</span><span class="n">testvar</span> <span class="o">=</span> <span class="p">{</span><span class="n">foo</span> <span class="o">=</span> <span class="s2">&quot;bar&quot;</span><span class="p">,</span> <span class="n">num</span> <span class="o">=</span> <span class="mi">42</span><span class="p">}</span>
+<a id="__codelineno-8-4" name="__codelineno-8-4" href="#__codelineno-8-4"></a><span class="c1">-- 需要 set $ctx_ref &quot;&quot;;</span>
+<a id="__codelineno-8-5" name="__codelineno-8-5" href="#__codelineno-8-5"></a><span class="n">ngx</span><span class="p">.</span><span class="n">var</span><span class="p">.</span><span class="n">ctx_ref</span> <span class="o">=</span> <span class="n">ctxdump</span><span class="p">.</span><span class="n">stash_ngx_ctx</span><span class="p">()</span>
+<a id="__codelineno-8-6" name="__codelineno-8-6" href="#__codelineno-8-6"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;ctx foo &quot;</span><span class="p">,</span> <span class="n">ctx</span><span class="p">.</span><span class="n">testvar</span><span class="p">.</span><span class="n">foo</span><span class="p">)</span>
+<a id="__codelineno-8-7" name="__codelineno-8-7" href="#__codelineno-8-7"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;ctx num &quot;</span><span class="p">,</span> <span class="n">ctx</span><span class="p">.</span><span class="n">testvar</span><span class="p">.</span><span class="n">num</span><span class="p">)</span>
+<a id="__codelineno-8-8" name="__codelineno-8-8" href="#__codelineno-8-8"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;var ctx_ref &quot;</span><span class="p">,</span> <span class="n">ngx</span><span class="p">.</span><span class="n">var</span><span class="p">.</span><span class="n">ctx_ref</span><span class="p">)</span>
+</code></pre></div>
+<div class="highlight"><span class="filename">/etc/nginx/lua/log.lua</span><pre><span></span><code><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="kd">local</span> <span class="n">ctxdump</span> <span class="o">=</span> <span class="nb">require</span> <span class="s2">&quot;ctxdump&quot;</span>
+<a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;var ctx_ref &quot;</span><span class="p">,</span> <span class="n">ngx</span><span class="p">.</span><span class="n">var</span><span class="p">.</span><span class="n">ctx_ref</span><span class="p">)</span>
+<a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="n">ngx</span><span class="p">.</span><span class="n">ctx</span> <span class="o">=</span> <span class="n">ctxdump</span><span class="p">.</span><span class="n">apply_ngx_ctx</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">var</span><span class="p">.</span><span class="n">ctx_ref</span><span class="p">)</span>
+<a id="__codelineno-9-4" name="__codelineno-9-4" href="#__codelineno-9-4"></a><span class="kd">local</span> <span class="n">ctx</span> <span class="o">=</span> <span class="n">ngx</span><span class="p">.</span><span class="n">ctx</span>
+<a id="__codelineno-9-5" name="__codelineno-9-5" href="#__codelineno-9-5"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;ctx foo &quot;</span><span class="p">,</span> <span class="n">ctx</span><span class="p">.</span><span class="n">testvar</span><span class="p">.</span><span class="n">foo</span><span class="p">)</span>
+<a id="__codelineno-9-6" name="__codelineno-9-6" href="#__codelineno-9-6"></a><span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;ctx num &quot;</span><span class="p">,</span> <span class="n">ctx</span><span class="p">.</span><span class="n">testvar</span><span class="p">.</span><span class="n">num</span><span class="p">)</span>
+</code></pre></div>
+<p>如果没有找到文件，报错信息中会包含所有尝试过的路径。</p>
+<h4 id="_3">代码复用与模块编写<a class="headerlink" href="#_3" title="Permanent link">&para;</a></h4>
+<p>最简单的代码复用的方法是使用 <code>loadfile()</code> 函数，这样几乎不需要修改代码内容。</p>
+<div class="highlight"><pre><span></span><code><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="kd">local</span> <span class="n">f</span> <span class="o">=</span> <span class="nb">loadfile</span><span class="p">(</span><span class="s2">&quot;/etc/nginx/lua/somefile.lua&quot;</span><span class="p">)</span>
+<a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a><span class="kr">if</span> <span class="n">f</span> <span class="kr">then</span>
+<a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a>    <span class="n">f</span><span class="p">()</span>
+<a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a><span class="kr">else</span>
+<a id="__codelineno-10-5" name="__codelineno-10-5" href="#__codelineno-10-5"></a>    <span class="n">ngx</span><span class="p">.</span><span class="n">log</span><span class="p">(</span><span class="n">ngx</span><span class="p">.</span><span class="n">ERR</span><span class="p">,</span> <span class="s2">&quot;failed to load somefile.lua&quot;</span><span class="p">)</span>
+<a id="__codelineno-10-6" name="__codelineno-10-6" href="#__codelineno-10-6"></a><span class="kr">end</span>
+</code></pre></div>
+<p>但是这么做是没有 JIT 缓存的，意味着每个请求都需要整个加载一遍对应的原始 lua 代码。一个基本的模块类似于下面这样：</p>
+<div class="highlight"><pre><span></span><code><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="kd">local</span> <span class="n">_M</span> <span class="o">=</span> <span class="p">{}</span>
+<a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a>
+<a id="__codelineno-11-3" name="__codelineno-11-3" href="#__codelineno-11-3"></a><span class="kd">local</span> <span class="kr">function</span> <span class="nf">some_internal_func</span><span class="p">(</span><span class="n">a</span><span class="p">)</span>
+<a id="__codelineno-11-4" name="__codelineno-11-4" href="#__codelineno-11-4"></a>    <span class="kr">return</span> <span class="n">a</span> <span class="o">+</span> <span class="n">a</span>
+<a id="__codelineno-11-5" name="__codelineno-11-5" href="#__codelineno-11-5"></a><span class="kr">end</span>
+<a id="__codelineno-11-6" name="__codelineno-11-6" href="#__codelineno-11-6"></a>
+<a id="__codelineno-11-7" name="__codelineno-11-7" href="#__codelineno-11-7"></a><span class="kr">function</span> <span class="nc">_M</span><span class="p">.</span><span class="nf">f1</span><span class="p">(</span><span class="n">a</span><span class="p">,</span> <span class="n">b</span><span class="p">)</span>
+<a id="__codelineno-11-8" name="__codelineno-11-8" href="#__codelineno-11-8"></a>    <span class="kd">local</span> <span class="n">aa</span> <span class="o">=</span> <span class="n">some_internal_func</span><span class="p">(</span><span class="n">a</span><span class="p">)</span>
+<a id="__codelineno-11-9" name="__codelineno-11-9" href="#__codelineno-11-9"></a>    <span class="kd">local</span> <span class="n">bb</span> <span class="o">=</span> <span class="n">some_internal_func</span><span class="p">(</span><span class="n">b</span><span class="p">)</span>
+<a id="__codelineno-11-10" name="__codelineno-11-10" href="#__codelineno-11-10"></a>    <span class="kr">return</span> <span class="n">aa</span> <span class="o">+</span> <span class="n">bb</span>
+<a id="__codelineno-11-11" name="__codelineno-11-11" href="#__codelineno-11-11"></a><span class="kr">end</span>
+<a id="__codelineno-11-12" name="__codelineno-11-12" href="#__codelineno-11-12"></a>
+<a id="__codelineno-11-13" name="__codelineno-11-13" href="#__codelineno-11-13"></a><span class="kr">return</span> <span class="n">_M</span>
+</code></pre></div>
 
 
 
diff --git a/search/search_index.json b/search/search_index.json
index b3e32818..367e66da 100644
--- a/search/search_index.json
+++ b/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"LUG @ USTC Documentation","text":"<p>Documentation for LUG @ USTC technical infrastructure.</p>"},{"location":"#layout","title":"Layout","text":"<p>Our documentation is divided into these sections, as laid out on the left navigation menu:</p> <ul> <li>The Workflow section provides guidance to (a few) common maintenance tasks.</li> <li>The Infrastructure section describes our infrastructure, as well as common configurations across different servers (networking, firewalls, security, monitoring, etc.).</li> <li>The Services section documents specific configurations on individual servers and service units (software and/or Docker containers).</li> <li>The Common Issues (a.k.a. FAQ) section records our troubleshooting experiences and serves partially as a \"notebook\" for known traps and workarounds.</li> </ul>"},{"location":"#links","title":"References","text":"<ul> <li>LUG @ USTC homepage</li> <li>sparanoid/chinese-copywriting-guidelines: Chinese copywriting guidelines for better written communication / \u4e2d\u6587\u6587\u6848\u6392\u7248\u6307\u5317 (Try to follow any guidelines in this repository)</li> <li>Material for MkDocs</li> <li>This repository (click the icon on the top-right)</li> </ul>"},{"location":"faq/dns/","title":"DNS \u57df\u540d\u89e3\u6790\u95ee\u9898","text":""},{"location":"faq/dns/#wrong-dns-result","title":"\u9519\u8bef\u7684\u89e3\u6790\u7ed3\u679c","text":"<p>\u6211\u4eec\u7684 DNS \u662f\u5206\u6821\u5185\u5916\u3001\u5206 ISP \u89e3\u6790\u7684\u3002\u6709\u65f6\u5019\u4f1a\u9047\u5230\u6821\u5185\u8bbf\u95ee\u89e3\u6790\u5230\u6821\u5916\uff0c\u53ef\u80fd\u7684\u539f\u56e0\u662f</p> <p><code>/etc/resolv.conf</code> \u987a\u5e8f\u4e0d\u5bf9</p> <p>iBug \u5728 2020 \u5e74 5 \u6708 21 \u65e5\u4fee\u4e86 gw-el \u548c mirrors2\uff0c\u8fd9\u4e24\u4e2a\u673a\u5668\u4e0a\u539f\u5148\u6392\u5728\u6700\u524d\u9762\u7684 nameserver \u5c31\u662f 8.8.4.4 \u6216\u8005 1.1.1.1 \u4e4b\u7c7b\u7684</p> <p>\u6211\u4eec\u7684\u6743\u5a01\u670d\u52a1\u5668\u4e24\u4e2a\u5728\u6821\u5185\u4e00\u4e2a\u5728\u56fd\u5185\uff0c\u56e0\u6b64\u6821\u5185\u673a\u5668\u5e94\u8be5\u4f18\u5148\u4ece\u6821\u5185\u89e3\u6790\u3002\u628a 202.38.64.1 / 2001:da8:d800::1\uff08\u5b66\u6821\u7684 DNS\uff09\u653e\u6700\u524d\u9762\u80af\u5b9a\u6ca1\u9519</p> <p>\u5982\u679c IPv4 \u89e3\u6790\u6b63\u786e\u4f46\u662f IPv6 \u8fd8\u662f\u89e3\u6790\u5230\u6821\u5916\u7684\u8bdd\uff0c</p> <p><code>/etc/resolv.conf</code> \u7f3a\u5c11 IPv6 \u6761\u76ee</p> <p>taoky \u5728 2020 \u5e74 5 \u6708 29 \u65e5\u53d1\u73b0\u7684\uff0cmirrors2 \u4e0a\u8bbf\u95ee servers.ustclug.org \u8fd4\u56de Cloudflare \u7684 522 \u9519\u8bef\u9875\u9762\uff08\u6b64\u65f6\u65e5\u672c\u53cd\u4ee3\u6302\u6389\u4e86\uff09\uff0c\u7ecf\u67e5\u5c3d\u7ba1 IPv4 \u6b63\u786e\u89e3\u6790\u5230\u4e86 gw-el \u4e0a\uff0c\u4f46\u662f IPv6 \u8fd8\u662f\u89e3\u6790\u5230\u4e86 Cloudflare \u4e0a\uff0c\u4e14 nslookup \u548c dig \u7b49\u5de5\u5177\u8f93\u51fa\u770b\u8d77\u6765\u90fd\u662f\u5bf9\u7684\u3002</p> <p>\u6392\u67e5\u53d1\u73b0 <code>/etc/resolv.conf</code> \u91cc\u6ca1\u6709 IPv6 \u7684\u670d\u52a1\u5668\u6761\u76ee\uff0c\u5728\u9760\u524d\u7684\u4f4d\u7f6e\u63d2\u5165 <code>nameserver 2001:da8:d800::1</code> \u540e\u89e3\u51b3\u3002</p> <p>\u624b\u52a8\u6e05\u7a7a\u672c\u673a\u7684 DNS \u7f13\u5b58\uff1a<code>nscd -i hosts</code></p> <p>\u6709\u65f6\u5019\u53ef\u80fd\u4f1a\u5728 DNS \u66f4\u65b0\u540e\u968f\u673a\u89e3\u6790\u51fa\u65b0\u65e7\u7ed3\u679c\uff0c\u53ef\u80fd\u7684\u539f\u56e0\u662f</p> <p>ns-a \u6ca1\u66f4\u65b0</p> <p>ns-a \u673a\u5668\u6bd4\u8f83\u8001\u65e7\uff0c\u7f51\u7edc\u53ef\u80fd\u4e0d\u987a\u7545\uff0c\u624b\u52a8\u628a ns-a \u66f4\u65b0\u4e00\u4e0b\u5c31\u884c\u4e86\uff08</p>"},{"location":"faq/docker/","title":"Docker \u76f8\u5173\u95ee\u9898","text":""},{"location":"faq/docker/#debian-11-aufs","title":"Debian 11 \u4e2d\u4e0d\u518d\u652f\u6301 aufs","text":"<p>\u4ece Debian 10 \u5347\u7ea7\u5230 Debian 11 \u65f6\uff0c<code>aufs-dkms</code> \u4e0d\u518d\u5305\u542b\u5728\u65b0\u5185\u6838\u4e2d\uff1a</p> <p>aufs-dkms \u8f6f\u4ef6\u5305\u5c06\u4e0d\u4f5c\u4e3a bullseye \u7684\u4e00\u90e8\u5206\u51fa\u73b0\u3002\u5927\u591a\u6570 aufs-dkms \u7528\u6237\u5e94\u5f53\u5207\u6362\u81f3 overlayfs\uff0c\u540e\u8005\u63d0\u4f9b\u4e86\u76f8\u4f3c\u7684\u529f\u80fd\u4e14\u5177\u6709\u5185\u6838\u7684\u652f\u6301\u3002\u7136\u800c\uff0c\u67d0\u4e9b Debian \u5b89\u88c5\u5b9e\u4f8b\u53ef\u80fd\u4f7f\u7528\u4e86\u4e0d\u517c\u5bb9 overlayfs \u7684\u6587\u4ef6\u7cfb\u7edf\uff0c\u5982\u4e0d\u5e26\u6709 d_type \u7684 xfs\u3002\u6211\u4eec\u5efa\u8bae\u9700\u8981\u4f7f\u7528 aufs-dkms \u7684\u7528\u6237\u5728\u5347\u7ea7\u81f3 bullseye \u4e4b\u524d\u5148\u8fdb\u884c\u8fc1\u79fb\u3002</p> <p>(https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.zh-cn.html)</p> <p>\u5bf9\u4e8e\u8001\u673a\u5668\u6765\u8bf4\u9700\u8981\u63d0\u524d\u786e\u8ba4 Docker \u7684 storage driver\uff1a</p> <pre><code>$ sudo docker info\n// ...\nServer:\n // ...\n Storage Driver: overlay2\n  Backing Filesystem: extfs\n  Supports d_type: true\n  Native Overlay Diff: true\n  userxattr: false\n</code></pre> <p>\u8fd9\u91cc\u5982\u679c\u662f overlay2 \u90a3\u4e48\u5c31\u6ca1\u95ee\u9898\uff0c\u5982\u679c\u662f aufs \u7684\u8bdd\u5c31\u9700\u8981\u63d0\u524d\u786e\u8ba4\uff0c\u56e0\u4e3a\u5207\u6362\u5230 overlay2 \u4e4b\u540e\u73b0\u6709\u7684\u5bb9\u5668\u548c\u5bb9\u5668\u955c\u50cf\u90fd\u4f1a\u4e22\u5931\uff0c\u9700\u8981\u91cd\u65b0\u521b\u5efa\u3002\u6240\u4ee5\u9700\u8981\u786e\u4fdd\u5bb9\u5668\uff08container\uff09\u548c\u955c\u50cf\uff08image\uff09\u662f\u53ef\u590d\u73b0\u7684\u3002</p> <p>\u5728\u5347\u7ea7\u7cfb\u7edf\u540e\uff0c\u7f16\u8f91 <code>/etc/docker/daemon.json</code>\uff0c\u52a0\u4e0a\uff1a</p> <pre><code>\"storage-driver\": \"overlay2\"\n</code></pre> <p>\u7136\u540e\u542f\u52a8 docker\uff0c\u91cd\u65b0\u521b\u5efa\u5bb9\u5668\u3002</p>"},{"location":"faq/ldap/","title":"LDAP \u5957\u4ef6\u95ee\u9898","text":""},{"location":"faq/ldap/#gosa","title":"GOsa \u95ee\u9898","text":"<p>User \u754c\u9762\u6253\u5f00\u65f6\u62a5\u9519</p> <p>\u5982\u679c\u5728 GOsa \u4e2d\u521b\u5efa\u4e86\u4e00\u4e2a\u65b0\u7528\u6237\uff0c\u5374\u6ca1\u6709\u5728\u6700\u540e\u4e3a\u4ed6\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5c31\u4f1a\u51fa\u73b0\u6b64\u95ee\u9898\uff0c\u6253\u5f00 User \u754c\u9762\u540e\u4f1a\u6709\u62a5\u9519\uff1a</p> <pre><code>Fatal error: Uncaught ArgumentCountError: Too few arguments to function userManagement::filterLockLabel(), 0 passed in /usr/share/gosa/include/class_listing.inc on line 856 and exactly 1 expected in /usr/share/gosa/plugins/admin/users/class_userManagement.inc:856\nStack trace:\n#0 /usr/share/gosa/include/class_listing.inc(856): userManagement::filterLockLabel()\n#1 /usr/share/gosa/include/class_listing.inc(980): listing-&gt;processElementFilter('%{filter:lockLa...', Array, 50)\n#2 /usr/share/gosa/include/class_listing.inc(853): listing-&gt;filterActions('cn=...,ou=...', 50, Array)\n#3 /usr/share/gosa/include/class_listing.inc(764): listing-&gt;processElementFilter('%{filter:action...', Array, 50)\n#4 /usr/share/gosa/include/class_listing.inc(407): listing-&gt;renderCell('%{filter:action...', Array, 50)\n#5 /usr/share/gosa/include/class_management.inc(233): listing-&gt;render()\n#6 /usr/share/gosa/include/class_management.inc(222): management-&gt;renderList()\n#7 /usr/share/gosa/plugins/admin/users/main.inc(44): management-&gt;execute()\n#8 /usr/sh in /usr/share/gosa/plugins/admin/users/class_userManagement.inc on line 856\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a GOsa \u65e0\u6cd5\u8bfb\u53d6\u5230\u7528\u6237\u5bc6\u7801\u7684 Hash\uff0c\u800c LDAP \u5374\u5141\u8bb8\u7528\u6237\u6ca1\u6709\u5bc6\u7801\u3002 \u53ea\u9700\u4e3a\u65b0\u7684\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\u6216\u5220\u9664\u65b0\u7684\u7528\u6237\u5373\u53ef\u3002</p>"},{"location":"faq/ldap/#slapd","title":"Slapd","text":"<p>Slapd \u662f openldap \u7684\u670d\u52a1\u7aef daemon\u3002\u6b63\u5e38\u60c5\u51b5\u4e0b\u4e0d\u9700\u8981\u78b0\uff0c\u4f46\u662f\u5982\u679c\u8981\u78b0\u7684\u65f6\u5019\uff0c\u4f60\u4f1a\u53d1\u73b0\u5b83\u7684\u914d\u7f6e\u6781\u5176\u590d\u6742\u9ebb\u70e6\u3002</p> <p>\u4fee\u6539\u524d\u4e00\u5b9a\u8981\u5148\u6253\u865a\u62df\u673a\u5feb\u7167\uff01\uff01\uff01</p> <p>\u5c0f\u5fc3\u5ef6\u6bd5</p>"},{"location":"faq/ldap/#migrate-hdb-to-mdb","title":"Migrate hdb to mdb","text":"<p><code>slapd-hdb</code> \u5728 Debian 11 \u5373\u5c06\u88ab deprecate\uff0c\u6240\u4ee5\u5728 2021/08/15 \u7ec4\u7ec7\u4e86\u4e00\u6b21 migrate\u3002</p> <p>\u7f51\u4e0a\u8d44\u6599\u5f88\u5c11\uff0c\u53c2\u8003\u4e86\uff1a</p> <ol> <li>https://github.com/osixia/docker-openldap/issues/97</li> <li>https://gist.github.com/wenzhixin/4705697206cdbf61bc88</li> </ol> <p>\u6b65\u9aa4\uff1a</p> <ol> <li>\u865a\u62df\u673a\u5feb\u7167\u6253\u597d\u3002</li> <li>\u5907\u4efd\u6570\u636e\u5e93\uff1a<code>slapcat -v -l dump.ldif</code></li> <li>\u5907\u4efd <code>/etc/ldap</code> \u4ee5\u53ca <code>/var/lib/ldap</code></li> <li>\u628a <code>/etc/ldap/slapd.d</code> \u4ee5\u53ca <code>/var/lib/ldap</code> \u5220\u6389\uff08\u6216\u8005\u6539\u540d\uff09</li> <li>\u8fd0\u884c <code>dpkg-reconfigure slapd</code></li> <li>\u521b\u5efa <code>/tmp/ldapconvert</code> \u76ee\u5f55\uff0c\u8fd0\u884c <code>slaptest -f /etc/ldap/convert.conf -F /tmp/ldapconvert</code></li> <li>\u6e05\u7a7a <code>/etc/ldap/slapd.d/cn=config/cn=schema/</code> \u4e0b\u7684\u6587\u4ef6\uff0c\u5c06 <code>/tmp/ldapconvert/slapd.d/cn=config/cn=schema/</code> \u4e0b\u7684\u6587\u4ef6\u590d\u5236\u5230 <code>/etc/ldap/slapd.d/cn=config/cn=schema/</code> \u5c06 slapd.d \u5907\u4efd\u4e2d <code>cn=config/cn=schema/</code> \u7684\u6587\u4ef6\u590d\u5236\u5230\u65b0\u7684 <code>slapd.d</code> \u5bf9\u5e94\u7684\u76ee\u5f55\u4e0b\uff0c\u5e76\u4e14\u4fee\u6539 owner \u4e3a <code>openldap:openldap</code></li> <li>\u91cd\u542f <code>slapd</code>\uff0c\u5982\u679c\u542f\u52a8\u5931\u8d25\uff0c\u770b <code>systemctl status slapd</code> \u7684\u65e5\u5fd7\u8f93\u51fa debug\u3002</li> <li>\u6062\u590d\u6570\u636e\u5e93\uff1a<code>slapadd -l dump.ldif</code>\u3002\u6ce8\u610f\uff0cmdb \u6ca1\u6709\u4e8b\u52a1\uff01\u5982\u679c\u4e2d\u95f4\u51fa\u9519\u4e86\uff0c\u6392\u67e5\u95ee\u9898\u540e\uff0c\u6e05\u7a7a <code>/var/lib/ldap</code>\uff0c\u91cd\u542f <code>slapd</code> \u91cd\u6765\u3002</li> </ol> <p>\u6062\u590d\u6210\u529f\u540e\uff0c\u6709\u4e9b\u914d\u7f6e\u9700\u8981\u624b\u52a8\u8bbe\u7f6e\uff1a</p> <ol> <li> <p>TLS/SSL</p> <pre><code># ldapmodify -H ldapi:/// -Y EXTERNAL &lt;&lt; EOF\n&gt; dn: cn=config\n&gt; changetype: modify\n&gt; replace: olcTLSCertificateFile\n&gt; olcTLSCertificateFile: /etc/ldap/ssl/slapd-server.crt\n&gt; -\n&gt; replace: olcTLSCACertificateFile\n&gt; olcTLSCACertificateFile: /etc/ldap/ssl/slapd-ca-cert.pem\n&gt; -\n&gt; replace: olcTLSCertificateKeyFile\n&gt; olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd-server.key\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u52a0\u8f7d pw-sha2.la\uff08\u82e5\u4f7f\u7528 ssha512/256 \u5219\u9700\u8981\u52a0\u8f7d\uff09</p> <pre><code># ldapmodify -H ldapi:/// -Y EXTERNAL &lt;&lt; EOF\n&gt; dn: cn=module,cn=config\n&gt; cn: module\n&gt; objectClass: olcModuleList\n&gt; olcModulePath: /usr/lib/ldap/\n&gt; olcModuleLoad: pw-sha2.la\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u4e3a sudoUser \u8bbe\u7f6e index</p> <pre><code># ldapadd -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={1}mdb,cn=config\n&gt; changetype: modify\n&gt; add: olcDbIndex\n&gt; olcDbIndex: sudoUser eq,sub\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u66f4\u6539\u9ed8\u8ba4\u5bc6\u7801\u5b58\u50a8\u9009\u9879\uff08\u53ef\u9009\uff09</p> <p>\u66f4\u6539\u4e3a crypt/yescrypt</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; add: olcPasswordHash\n&gt; olcPasswordHash: {CRYPT}\n&gt; \n&gt; dn: cn=config\n&gt; add: olcPasswordCryptSaltFormat\n&gt; olcPasswordCryptSaltFormat: $y$j9T$%s\n</code></pre> <p>\u66f4\u6539\u4e3a ssha512\uff08\u9700\u8981 pw-sha2.la\uff0c\u4e5f\u53ef\u53c2\u7167\u4e0a\u8ff0 yescrypt \u7684\u914d\u7f6e\u66f4\u6539\u4e3a crypt/ssha512\uff09</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; add: olcPasswordHash\n&gt; olcPasswordHash: {SSHA512}\n</code></pre> <p>\u5982\u679c\u62a5\u9519\u5df2\u7ecf\u5b58\u5728\uff0c\u53ef\u4ee5\u7528 replace \u9009\u9879\uff0c\u4ee5 crypt/yescrypt \u4e3a\u4f8b\uff1a</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; changetype: modify\n&gt; replace: olcPasswordHash\n&gt; olcPasswordHash: {CRYPT}\n&gt; \n&gt; dn: cn=config\n&gt; changetype: modify\n&gt; replace: olcPasswordCryptSaltFormat\n&gt; olcPasswordCryptSaltFormat: $y$j9T$%s\n</code></pre> <p>\u6ce8\u610f\u5728\u4f7f\u7528\u4e0a\u8ff0 hash \u65b9\u5f0f\u7684\u65f6\u5019\u8fdb\u5165 gosa \u7528\u6237\u9875\u9762\u65f6\u53ef\u80fd\u4f1a\u62a5\u9519 Cannot find a suitable password method for the current hash</p> </li> </ol>"},{"location":"faq/nginx/","title":"Nginx \u76f8\u5173\u914d\u7f6e","text":""},{"location":"faq/nginx/#git-host-specific","title":"\u4f7f\u7528 Git \u540c\u6b65\u914d\u7f6e\uff0c\u4f46\u9700\u8981 host-specific \u7684\u914d\u7f6e","text":"<ol> <li>Nginx \u81ea\u5e26\u4e00\u4e2a\u53d8\u91cf <code>$hostname</code> \u53ef\u4ee5\u5728\u5408\u9002\u7684\u5730\u65b9\u7528\u6765 if \u6216\u8005 map\uff0c\u4f46\u662f\u5728\u8fd9\u4e2a\u529e\u6cd5\u4e0d\u9876\u7528\u7684\u65f6\u5019\uff08\u4f8b\u5982\uff0c<code>resolver</code> \u4e0d\u652f\u6301\u53d8\u91cf\uff09\u5c31\u53ea\u80fd\u7528\u4e0b\u9762\u8fd9\u4e2a\u7b28\u529e\u6cd5\u4e86\u3002</li> <li>\u628a\u9700\u8981 host-specific \u7684\u90a3\u4e2a\u6587\u4ef6\u52a0\u5165 <code>.gitignore</code>\uff0c\u7136\u540e\u5728\u5408\u9002\u7684\u4f4d\u7f6e\u7559\u4e0b\u4e00\u4e2a README\u3002</li> </ol>"},{"location":"faq/nginx/#_1","title":"\u6587\u4ef6\u6253\u5f00\u6570\u5927\u5c0f\u9650\u5236","text":"<p>\u5728\u9ed8\u8ba4\u8bbe\u7f6e\u4e2d\uff0cnginx \u7684\u6700\u5927\u6587\u4ef6\u6253\u5f00\u6570\u4e0a\u9650\u5e76\u4e0d\u5927\u3002\u5f53\u6709\u5927\u91cf\u8bbf\u95ee\u65f6\uff0c\u6587\u4ef6\u6253\u5f00\u6570\u53ef\u80fd\u4f1a\u8d85\u8fc7\u9650\u989d\uff0c\u5bfc\u81f4\u7f51\u7ad9\u54cd\u5e94\u7f13\u6162\u3002\u5728\u65b0\u914d\u7f6e\u670d\u52a1\u5668\u65f6\uff0c\u8fd9\u4e00\u9879\u8bbe\u7f6e\u5f88\u5bb9\u6613\u88ab\u5ffd\u7565\u6389\u3002</p> <p>\u89e3\u51b3\u65b9\u6cd5\uff1a</p> <ol> <li><code>sudo systemctl edit nginx.service</code>\uff08\u90e8\u5206\u673a\u5668\u4e0a\u7684\u670d\u52a1\u540d\u53ef\u80fd\u4e3a <code>openresty.service</code>\uff09</li> <li>\u5728\u6253\u5f00\u7684 override \u6587\u4ef6\u7684 <code>[Service]</code> \u4e0b\u65b9\u6dfb\u52a0 <code>LimitNOFILE=524288</code>\uff08\u89c6\u60c5\u51b5\u8fd9\u4e2a\u503c\u53ef\u4ee5\u76f8\u5e94\u8c03\u6574\uff09</li> </ol>"},{"location":"faq/nginx/#gateway-tmpmem","title":"\u5173\u4e8e gateway \u914d\u7f6e\u4e2d\u7684 <code>/tmp/mem</code> \u8def\u5f84","text":"<p>\u66f4\u65b0</p> <p>\u6211\u4eec\u5df2\u4e0d\u518d\u5728 nginx.conf \u91cc\u4f7f\u7528 <code>/tmp/mem</code> \u4e86\uff0c\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u5b58\u6863\u3002</p> <p>\u9519\u8bef\u8868\u73b0\u662f <code>systemctl start nginx.service</code> \u5931\u8d25\uff0c\u4f7f\u7528 status \u6216 journalctl \u53ef\u4ee5\u770b\u5230\u4ee5\u4e0b\u4fe1\u606f\uff1a</p> <pre><code>[emerg] mkdir() \"/tmp/mem/nginx_temp\" failed (2: No such file or directory)\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a\u6211\u4eec\u7684 <code>nginx.conf</code> \u4e2d\u94a6\u70b9\u4e86 <code>proxy_temp /tmp/mem/nginx_temp</code>\uff0c\u800c <code>/tmp/mem</code> \u662f\u6211\u4eec\u81ea\u5df1\u5efa\u7684\u4e00\u4e2a tmpfs \u6302\u8f7d\u70b9\uff0c\u5b83\u4e0d\u662f\u4efb\u4f55\u53d1\u884c\u7248\u7684\u9ed8\u8ba4\u914d\u7f6e\uff0c\u6240\u4ee5\u65b0\u88c5\u7684\u7cfb\u7edf\u5982\u679c\u76f4\u63a5 pull \u4e86\u8fd9\u4efd nginx config \u5c31\u4f1a\u62a5\u4ee5\u4e0a\u9519\u8bef\u3002</p> <p>\uff08\u4f7f\u7528 <code>/tmp/mem</code> \u7684\u539f\u56e0\u662f\uff0c\u7531\u4e8e nginx \u53cd\u4ee3\u9700\u8981\u9891\u7e41\u8bfb\u5199\u4e34\u65f6\u6587\u4ef6\uff0c\u4e3a\u4e86\u51cf\u5c11\u78c1\u76d8 IO \u5360\u7528\uff0c\u6545\u5c06\u5176\u4e34\u65f6\u6587\u4ef6\u653e\u5165\u5185\u5b58\u4e2d\uff09</p> <p>\u6b63\u786e\u7684\u89e3\u51b3\u65b9\u6cd5\u662f\u8865\u4e0a\u5bf9\u5e94\u7684 fstab \u884c\uff1a</p> <pre><code>tmpfs   /tmp/mem    tmpfs   0   0\n</code></pre> <p>\u5982\u679c\u521b\u5efa/\u6302\u8f7d\u4e86 /tmp/mem \u540e\uff0c\u542f\u52a8\u4ecd\u7136\u51fa\u9519\uff0c\u5219\u9700\u8981\u68c0\u67e5 openresty.service/nginx.service \u6587\u4ef6\u4e2d\u662f\u5426\u5305\u542b <code>PrivateTmp=yes</code>\u3002\u5982\u679c\u5305\u542b\uff0c\u5219\u9700\u8981 <code>systemctl edit</code>\uff0c\u5c06\u6b64\u9879\u8bbe\u7f6e\u4e3a <code>false</code>\u3002</p> <p>fstab \u4e0e systemd</p> <p>\u8c03\u6574 fstab \u4e4b\u540e\uff0c\u9700\u8981\u6267\u884c <code>systemctl daemon-reload</code>\uff0c\u5426\u5219 systemd \u53ef\u80fd\u4f1a\u5728\u7b2c\u4e8c\u65e5\u51cc\u6668\u6302\u8f7d\u5df2\u88ab\u6ce8\u91ca\u7684\u78c1\u76d8\u9879\u3002</p>"},{"location":"faq/nginx/#openresty","title":"Openresty","text":""},{"location":"faq/nginx/#lua","title":"Lua \u76f8\u5173","text":"<p>\u8fd9\u91cc\u5173\u6ce8\u4e09\u4e2a\u76f8\u5173\u7684\u6b65\u9aa4\uff1a<code>access_by</code>, <code>log_by</code> \u548c <code>header_filter_by</code>\uff0c\u4ee5\u53ca <code>ngx.ctx</code> \u548c <code>ngx.var</code> \u7684\u6ce8\u610f\u4e8b\u9879\u3002</p> <p>\u6d4b\u8bd5\u7528 server \u5757\uff1a</p> <pre><code>server {\n    listen 80 default_server;\n    listen [::]:80 default_server;\n\n    root /var/www/html;\n\n    index index.html index.htm index.nginx-debian.html;\n\n    server_name _;\n\n    set $testvar \"\";\n    access_by_lua_file /etc/nginx/lua/access.lua;\n    header_filter_by_lua_file /etc/nginx/lua/header_filter.lua;\n    log_by_lua_file /etc/nginx/lua/log.lua;\n\n    location / {\n        try_files $uri $uri/ =404;\n    }\n\n    location /lua-test0 {\n        return 302 /lua-test1;\n    }\n\n    location /lua-test1 {\n        return 200;\n    }\n\n    location /lua-test2 {\n        try_files $uri $uri/ @internal1;\n    }\n\n    location @internal1 {\n        return 418;\n    }\n}\n</code></pre> <p>\u4e09\u4e2a lua:</p> /etc/nginx/lua/access.lua<pre><code>local ctx = ngx.ctx\nctx.testvar = \"testvar\"\nngx.var.testvar = \"testvar\"\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre> /etc/nginx/lua/header_filter.lua<pre><code>local ctx = ngx.ctx\n\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre> /etc/nginx/lua/log.lua<pre><code>local ctx = ngx.ctx\n\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre>"},{"location":"faq/nginx/#rewritereturn-access_by","title":"rewrite/return \u4e0e access_by","text":"<p>\u8bbf\u95ee localhost/lua-test0 \u6216\u8005 localhost/lua-test1\uff0c\u6ca1\u6709 access.lua \u7684\u8f93\u51fa\uff1a</p> <pre><code>2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] header_filter.lua:3: ctx nil, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] header_filter.lua:4: var nil, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] log.lua:3: ctx nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] log.lua:4: var nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u5982\u679c\u8bbf\u95ee localhost/somefile\uff0c\u662f\u6709\u8f93\u51fa\u7684\uff1a</p> <pre><code>2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] access.lua:4: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] access.lua:5: var testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] header_filter.lua:3: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] header_filter.lua:4: var testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] log.lua:3: ctx testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] log.lua:4: var testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a <code>return</code> \u8bed\u53e5\u53d1\u751f\u5728 <code>rewrite</code> \u9636\u6bb5\uff0c\u56e0\u6b64\u8df3\u8fc7\u4e86 <code>access</code> \u9636\u6bb5\uff0c<code>access_by_lua_block</code> \u5c31\u6ca1\u6709\u88ab\u6267\u884c\u3002\u56e0\u6b64 Content phase \u4e2d\u7684\u7a0b\u5e8f\u4e0d\u80fd\u5047\u8bbe access_by \u80af\u5b9a\u88ab\u6267\u884c\u4e86\u3002</p>"},{"location":"faq/nginx/#ngxctx","title":"<code>ngx.ctx</code>","text":"<p>https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxctx</p> <p>\u652f\u6301\u4efb\u610f lua \u6570\u636e\u7ed3\u6784\u7684\uff0c\u4e0e\u5355\u72ec request \u7ed1\u5b9a\u7684\u72b6\u6001\u53d8\u91cf\u3002\u540c\u65f6\u4e5f\u4e0d\u9700\u8981\u50cf <code>ngx.var</code> \u4e00\u6837\u63d0\u524d <code>set</code>\u3002</p> <p>\u5c0f\u5fc3\u5185\u90e8\u8df3\u8f6c</p> <p>Internal redirects (triggered by nginx configuration directives like <code>error_page</code>, <code>try_files</code>, <code>index</code> and etc) will destroy the original request <code>ngx.ctx</code> data (if any) and the new request will have an empty ngx.ctx table.</p> <p>\u8bbf\u95ee localhost/lua-test2\uff08\u5047\u8bbe\u524d\u9762\u7684 <code>try_files</code> \u5931\u8d25\uff09\uff1a</p> <pre><code>2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] access.lua:4: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] access.lua:5: var testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] header_filter.lua:3: ctx nil, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] header_filter.lua:4: var testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] log.lua:3: ctx nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] log.lua:4: var testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u8fd9\u4e2a\u95ee\u9898\u5bf9\u4e00\u4e9b\u9700\u8981\u5728 access \u4e2d\u505a\u4e00\u4e9b\u4e8b\u60c5\uff0c\u5c06\u72b6\u6001\u5b58\u50a8\u5728 <code>ngx.ctx</code> \u4e2d\uff0c\u7136\u540e\u5728 header_filter \u6216\u8005 log \u4e2d\u53d6\u6d88\u5bf9\u5e94\u6548\u679c\u7684\u903b\u8f91\uff08\u4f8b\u5982 resty.limit.conn \u5728\u8bbf\u95ee\u7684\u6587\u4ef6\u5f53\u524d\u4e0d\u5b58\u5728\u7684\u60c5\u51b5\u4e0b\uff09\u6765\u8bf4\u662f\u81f4\u547d\u7684\u3002</p>"},{"location":"faq/nginx/#ngxvar","title":"<code>ngx.var</code>","text":"<p>https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxvarvariable</p> <p>\u4f7f\u7528\u6709\u4e00\u4e9b\u9ebb\u70e6\uff1a</p> <ul> <li>\u6027\u80fd\u76f8\u6bd4\u4e8e <code>ngx.ctx</code> \u6765\u8bf4\u4f4e\u4e00\u4e9b\uff0c\u5b98\u65b9\u6587\u6863\u4e0d\u5efa\u8bae\u5c06 <code>ngx.var</code> \u4f7f\u7528\u5230\u5173\u952e\u8def\u5f84\u4e0a\u3002</li> <li>\u9700\u8981\u63d0\u524d\u5b9a\u4e49\u53d8\u91cf\u3002</li> <li>\u53ea\u80fd\u8d4b\u503c\u6570\u5b57\u6216\u8005\u5b57\u7b26\u4e32\uff0c\u8d4b\u503c table \u53ef\u80fd\u4e0d\u4f1a\u76f4\u63a5\u62a5\u9519\uff0c\u4f46\u662f\u5b9e\u9645\u4e0a\u4e0d\u5de5\u4f5c\u3002</li> </ul> <p>\u4f46\u662f\u76f8\u6bd4\u4e8e <code>ngx.ctx</code>\uff0c\u6700\u5927\u7684\u4f18\u52bf\u5c31\u662f\u5373\u4f7f\u7ecf\u8fc7\u4e86 internal redirection\uff0c<code>ngx.var</code> \u7684\u5185\u5bb9\u4e5f\u4f1a\u4fdd\u7559\u3002</p> <p>\u7531\u4e8e <code>ngx.var</code> \u5176\u672c\u8eab\u4e0d\u9002\u5408\u5b58\u50a8\u590d\u6742\u7684\u7ed3\u6784\uff0c\u7b2c\u4e09\u65b9\u6a21\u5757 (lua-resty-ctxdump) \u5904\u7406\u8fd9\u4e2a\u95ee\u9898\u7684\u505a\u6cd5\u662f\uff1a\u5c06\u5b9e\u9645\u5185\u5bb9\u4fdd\u5b58\u5728\u6a21\u5757\u5185\u90e8\u7684 memo \u8868\u4e2d\uff0c\u800c\u9700\u8981\u5b58\u50a8\u5728 ngx.var \u91cc\u9762\u7684\u53ea\u662f memo \u8868\u7684 key\uff08\u6570\u5b57\uff09\u3002</p>"},{"location":"faq/ssd/","title":"SSD \u56fa\u4ef6","text":"<p>\u6570\u636e\u4e2d\u5fc3\u76d8\u7684 SSD \u8fd1\u5e74\u6765\u6709\u591a\u8d77\u56e0\u4e3a\u56fa\u4ef6\u95ee\u9898\u5bfc\u81f4\u4f7f\u7528\u65f6\u95f4\u8fc7\u957f\uff08\u51e0\u4e07\u5c0f\u65f6\uff09\u540e\u76d8\u574f\u6389\u7684\u65b0\u95fb\u3002 \u8fd9\u7c7b\u4e8b\u4ef6\u4e00\u65e6\u53d1\u751f\uff0c\u540e\u679c\u6781\u5176\u4e25\u91cd\uff0c\u56e0\u4e3a\u914d\u7f6e\u65b0\u670d\u52a1\u5668\u65f6\uff0c\u4e00\u822c\u4f7f\u7528\u7684\u76d8\u578b\u53f7\u662f\u4e00\u6837\u7684\uff0c\u5e76\u4e14\u5f00\u673a\u65f6\u95f4\u4e5f\u662f\u4e00\u6837\u7684\uff0c \u56e0\u6b64\u51fa\u73b0\u95ee\u9898\u4e4b\u540e\uff0c\u6240\u6709\u76d8\u90fd\u4f1a\u5728\u77ed\u65f6\u95f4\u5185\u574f\u6389\uff0cRAID \u6839\u672c\u65e0\u529b\u56de\u5929\u3002 \u56e0\u6b64\u4ee5\u4e0b\u8bb0\u5f55\u4e00\u4e9b\u56fa\u4ef6\u5347\u7ea7\u7684\u65b9\u6cd5\u3002</p>"},{"location":"faq/ssd/#intel","title":"Intel","text":""},{"location":"faq/ssd/#_1","title":"\u80cc\u666f","text":"<p>2024 \u5e74 1 \u6708 12 \u65e5\u51cc\u6668\uff0c\u5728\u53d1\u73b0\u4e24\u5757 Intel SSD S4510/S4610 \u51fa\u73b0 SMART \u9519\u8bef\u5e76\u4e14 ZFS \u63d0\u793a\u8bfb\u53d6\u9519\u8bef\u4e4b\u540e\u7d27\u6025\u8fdb\u884c\u4e86\u56fa\u4ef6\u5347\u7ea7\uff08\u5426\u5219\u8fd8\u6709 8 \u5757\u76d8\u4e5f\u4f1a\u5f88\u5feb\u56e0\u4e3a\u7c7b\u4f3c\u95ee\u9898\u635f\u574f\uff09\u3002\u7531\u4e8e\u7f3a\u5c11\u76f8\u5173\u8d44\u6599\uff0c\u5e76\u4e14 Intel \u4e0b\u67b6\u4e86\u5927\u91cf\u4fe1\u606f\uff0c\u56e0\u6b64\u82b1\u8d39\u4e86\u5f88\u591a\u65f6\u95f4\uff0c\u81f3\u51cc\u6668\u4e03\u70b9\u5b8c\u6210\u5347\u7ea7\u3002</p> Timeline <p>2024/01/11 04:21 - \u6536\u5230 smartd \u90ae\u4ef6\u79f0 <code>/dev/sdi</code> \u51fa\u73b0 <code>End-to-End_Error_Count</code> \u9519\u8bef\u3002</p> <p>\u4e4b\u540e\u672a\u6000\u7591\u662f\u56fa\u4ef6\u95ee\u9898\uff0c\u53ea\u8ba4\u4e3a\u662f\u5076\u53d1\u7684\u9519\u8bef\uff0c\u5e76\u4e14 SSD \u4ecd\u53ef\u6b63\u5e38\u8bfb\u53d6\uff0cZFS \u6b63\u5e38\u7ea0\u9519\uff0c\u56e0\u6b64\u5f53\u5929\u5f00\u59cb\u51c6\u5907\u91c7\u8d2d\u65b0 SSD\uff0c\u672a\u8fdb\u884c\u5176\u4ed6\u64cd\u4f5c\u3002</p> <p>2024/01/12 02:51 - \u6536\u5230 smartd \u90ae\u4ef6\u79f0 <code>/dev/sdh</code> \u51fa\u73b0 <code>End-to-End_Error_Count</code> \u9519\u8bef\u3002</p> <p>\u4e4b\u540e\u6000\u7591\u662f\u56fa\u4ef6\u95ee\u9898\uff0c\u5e76\u4ece\u6d6a\u6f6e\u7684\u7f51\u7ad9\u786e\u8ba4\u4e86\u8fd9\u4e00\u70b9\u3002 Dell \u63d0\u4f9b\u4e86\u4fee\u590d\u5305\uff0c\u4f46\u662f\u65e0\u6cd5\u5728 Debian \u4e0b\u5b89\u88c5\u3002Intel/Solidigm \u63d0\u4f9b\u7684\u5347\u7ea7\u5de5\u5177\u6709\u8bb8\u591a\u4e0d\u540c\u7248\u672c\uff0c\u5176\u4e2d isdct \u4e0e sst \u63d0\u793a\u5347\u7ea7\u5931\u8d25\uff0cintelmas \u63d0\u793a\u5f53\u524d\u4ea7\u54c1\u5df2\u4e0d\u518d\u652f\u6301\u3002</p> <p>\u5728\u8fc1\u79fb\u90e8\u5206\u91cd\u8981\u865a\u62df\u673a\uff0c\u5e76\u786e\u8ba4\u5907\u4efd\u6b63\u5e38\u540e\uff08\u5927\u81f4\u82b1\u8d39\u4e86 2 \u5230 2.5 \u5c0f\u65f6\uff09\uff0c\u91cd\u542f\u5bf9\u5e94\u670d\u52a1\u5668\uff0c\u5c1d\u8bd5\u4f7f\u7528 Solidigm \u63d0\u4f9b\u7684\u300c\u5347\u7ea7\u542f\u52a8\u76d8\u300d\u5347\u7ea7\uff0c\u63d0\u793a\u627e\u4e0d\u5230 SSD \u800c\u5931\u8d25\u3002 \u4e4b\u540e\u4ece Solidigm \u8bba\u575b\u4e86\u89e3\u5230\u9700\u8981\u5173\u95ed\u76f4\u901a\u8bbe\u7f6e\u3002\u5148\u5bf9 <code>/dev/sdi</code> \u8fdb\u884c\u4e86\u6d4b\u8bd5\uff08\u8be5\u76d8\u6709 SMART \u9519\u8bef\uff0c\u4f46\u662f\u4ecd\u53ef\u8bfb\u5199\uff09\uff0c\u5347\u7ea7\u6210\u529f\u3002\u4e4b\u540e\u5347\u7ea7\u4e86\u5168\u90e8 Intel SSD\u3002</p> <p>\u76f8\u5173\u6d89\u95ee\u9898\u56fa\u4ef6\u7248\u672c\u4e3a XCV10100\u3002XCV10110 \u53ca\u4ee5\u4e0a\u4fee\u590d\u4e86\u95ee\u9898\u3002</p>"},{"location":"faq/ssd/#_2","title":"\u5347\u7ea7\u65b9\u6cd5","text":"<p>Intel \u7684\u5b58\u50a8\u4e1a\u52a1\u5df2\u7ecf\u88ab SK Hynix \u5b50\u516c\u53f8 Solidigm \u6536\u8d2d\u3002\u5176\u63d0\u4f9b\u4e86\u76f8\u5173\u5de5\u5177\u8fdb\u884c\u5347\u7ea7\u3002</p> <p>https://www.solidigm.com/us/en/support-page/product-doc-cert/ka-00099.html \u63d0\u4f9b\u4e86 Solidigm \u5de5\u5177\u652f\u6301\u7684\u4ea7\u54c1\u5217\u8868\u3002\u4e0b\u8f7d\u6700\u65b0\u7248\u672c Solidigm\u2122 Storage Tool \u4e4b\u540e\uff08\u652f\u6301 Debian/Ubuntu\uff09\uff0c\u4f7f\u7528\u4ee5\u4e0b\u65b9\u6cd5\u68c0\u67e5\u6240\u6709 SSD \u7684\u4fe1\u606f\uff1a</p> <pre><code>sst show -ssd\n</code></pre> <p>\u5173\u6ce8\u6bcf\u4e2a SSD \u7684 <code>FirmwareUpdateAvailable</code> \u4e00\u884c\u662f\u5426\u6709\u66f4\u65b0\u4fe1\u606f\u3002</p> <p>\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5347\u7ea7\uff1a</p> <pre><code>sst load -ssd &lt;SSD \u7684\u7f16\u53f7&gt;\n</code></pre> <p>\u8bf7\u6ce8\u610f\uff0c\u8be5\u5de5\u5177\u4e0d\u652f\u6301 RAID \u5361\u7684\u76f4\u901a\u6a21\u5f0f\u3002\u5bf9\u4e8e Dell \u670d\u52a1\u5668\u6765\u8bf4\uff0c\u9700\u8981\u8bbe\u7f6e\u5982\u4e0b\uff1a</p> <ol> <li>\u542f\u7528 LSI \u652f\u6301\uff1a<code>sst set -system EnableLSIAdapter=True</code></li> <li>\u91cd\u542f\u8fdb\u5165 BIOS\uff0c\u5c06 RAID \u5361\u4ece HBA \u6a21\u5f0f\u5207\u6362\u4e3a RAID \u6a21\u5f0f\uff08\u5982\u679c\u662f\u7684\u8bdd\uff09</li> <li>\u5c06\u9700\u8981\u5347\u7ea7\u7684\u76d8\u4ece Non-RAID \u6a21\u5f0f\u5207\u6362\u4e3a RAID-Capable\uff08\u6ce8\u610f\u4e0d\u8981\u70b9\u6210\u6e05\u7a7a\u6240\u6709\u6570\u636e\uff01\uff09</li> <li>\u91cd\u542f\u8fdb\u5165 recovery \u6a21\u5f0f\uff0c\u4f7f\u7528 <code>sst</code> \u8fdb\u884c\u5347\u7ea7\u3002</li> <li>\u5347\u7ea7\u5b8c\u6210\u540e\u91cd\u542f\uff0c\u8fdb\u5165 BIOS \u6062\u590d\u4e4b\u524d\u7684\u8bbe\u7f6e\uff08\u540c\u6837\u6ce8\u610f\u4e0d\u8981\u70b9\u9519\uff01\uff09</li> </ol>"},{"location":"faq/systemd-timer/","title":"Systemd-timer \u53c2\u8003\u6a21\u677f","text":"<p>Systemd-timer \u4f5c\u4e3a crontab \u7684\u66ff\u4ee3\u54c1\uff0c\u6709\u4e00\u7cfb\u5217\u7684\u4f18\u70b9\uff1a</p> <ul> <li>\u786e\u4fdd\u76f8\u540c\u7684\u4efb\u52a1\u672a\u5b8c\u6210\u65f6\u4e0d\u4f1a\u88ab\u91cd\u590d\u6267\u884c\u3002</li> <li>\u6613\u4e8e\u8c03\u8bd5\u3001\u7ba1\u7406\u3002</li> </ul> <p>\u5f53\u7136\u76f8\u6bd4\u4e8e crontab\uff0c\u7f3a\u70b9\u4e5f\u5f88\u660e\u663e\uff1a</p> <ul> <li>\u5570\u55e6\u3001\u96be\u5199\u3002</li> </ul> <p>\u6240\u4ee5\u4ee5\u4e0b\u7ed9\u51fa\u4e00\u4e2a\u6a21\u677f\uff0c\u65b9\u4fbf\u5728\u521b\u5efa\u65b0\u5b9a\u65f6\u4efb\u52a1\u7684\u65f6\u5019\u4f7f\u7528\u3002\u8fd9\u91cc\u7684\u4f8b\u5b50\u662f mirrors2 \u4ece mirrors4 \u83b7\u53d6\u538b\u7f29\u540e\u7684\u65e5\u5fd7\u3002\u4ee5\u4e0b\u6587\u4ef6\u5747\u653e\u5728 <code>/etc/systemd/system</code>\u3002</p> m4log.service<pre><code>[Unit]\nDescription=Mirrors4 log backup\nDocumentation=man:rsync(1)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nUser=mirror\nGroup=mirror\nExecStart=rsync -rltpv --include=*/ --include=*.xz --exclude=* m4log:/ /var/m4log/\nRestart=on-failure\nRestartSec=3\n</code></pre> m4log.timer<pre><code>[Unit]\nDescription=Mirrors4 log backup timer\nDocumentation=man:rsync(1)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Timer]\nOnCalendar=*-*-* 7:13:00\nRandomizedDelaySec=60s\nPersistent=true\nUnit=m4log.service\n\n[Install]\nWantedBy=timer.target\n</code></pre> <p>\u5173\u4e8e OnCalendar \u7684\u89e6\u53d1\u65f6\u95f4\uff0c\u53ef\u4ee5\u53c2\u8003 systemd \u7684 Calendar Events \u8bf4\u660e\uff0c\u5e76\u7528 <code>systemd-analyze calendar</code> \u6765\u68c0\u9a8c\u6b63\u786e\u6027\uff0c\u4e5f\u53ef\u4ee5\u7528 <code>systemctl list-timers</code> \u89c2\u5bdf Timer \u4e0b\u6b21\u89e6\u53d1\u7684\u65f6\u95f4\u662f\u5426\u7b26\u5408\u9884\u671f\u3002</p> <p>\u4e0b\u9762\u662f\u4e00\u4e9b\u5e38\u7528\u547d\u4ee4\uff1a</p> <ul> <li>\u5f00\u673a\u542f\u7528\u8ba1\u65f6\u5668\uff1a<code>systemctl enable m4log.timer</code></li> <li>\u6fc0\u6d3b\u8ba1\u65f6\u5668\uff1a<code>systemctl start m4log.timer</code></li> <li>\u624b\u52a8\u8fd0\u884c\u670d\u52a1\uff1a<code>systemctl start m4log.service</code></li> <li>\u67e5\u770b\u670d\u52a1\u72b6\u6001\uff1a<code>systemctl status m4log.service</code></li> </ul>"},{"location":"faq/vm/","title":"\u865a\u62df\u5316\u76f8\u5173","text":""},{"location":"faq/vm/#_2","title":"\u6269\u76d8","text":"<p>\u6269\u5927\u865a\u62df\u78c1\u76d8\u7684\u5927\u5c0f\u540e\uff0c\u53ef\u4ee5\u91c7\u7528\u4ee5\u4e0b\u76f8\u5bf9\u7b80\u5355\u7684\u65b9\u5f0f\u6269\u5c55\u5206\u533a\u5927\u5c0f\uff1a</p> <p>\u8bf7\u786e\u4fdd\u7406\u89e3\u547d\u4ee4\u540e\u518d\u6267\u884c</p> <pre><code>$ # \u5b89\u88c5 growpart\n$ sudo apt install cloud-guest-utils\n$ # \u6269\u5c55 /dev/sdb1\n$ sudo growpart /dev/sdb 1\n$ # \u73b0\u5728\u5206\u533a\u8868\u4ee5\u53ca\u5206\u533a\u6269\u5c55\u4e86\uff0c\u4f46\u662f\u5206\u533a\u91cc\u9762\u7684\u6587\u4ef6\u7cfb\u7edf\u7684\u5927\u5c0f\u8fd8\u6ca1\u6709\u6269\u5c55\n$ # \u4ee5 ext4 \u4e3a\u4f8b\n$ sudo resize2fs /dev/sdb1\n</code></pre>"},{"location":"infrastructure/auth-dns/","title":"Authoritative DNS","text":"<p>Services (Servers):</p> <ul> <li>ns-a.ustclug.org (ns-a.s.ustclug.org)</li> <li>ns-b.ustclug.org (ns-b.s.ustclug.org)</li> <li>ns-c.ustclug.org (something else)</li> </ul> <p>All three servers are dedicated to DNS service and run no other services.</p>"},{"location":"infrastructure/auth-dns/#deploy","title":"Deploy","text":"<ul> <li>Bind configuration:  https://github.com/ustclug/auth-dns</li> <li>Bind Dockerfile:   https://github.com/zhsj/dockerfile/tree/master/bind9</li> </ul> <p>The bind configuration repository is only visible to admins because private key is included.</p> <pre><code># copy the ssh key https://github.com/ustclug/auth-dns/blob/master/git_pull_key\n# to ~/.ssh/id_ed25519\n\n# now get the conf\ngit clone git@github.com:ustclug/auth-dns.git /var/lib/bind\n\n# delete the ssh key\nrm ~/.ssh/id_ed25519\n</code></pre> <pre><code>docker run --restart=always -v /var/lib/bind/:/etc/bind \\\n       --net host -it -d --name=auth-dns zhusj/bind9\n</code></pre>"},{"location":"infrastructure/auth-dns/#update-dns-record","title":"Update DNS Record","text":"<p>Just commit your changes to the configuration repository. More details can be found in the repository.</p>"},{"location":"infrastructure/auth-dns/#webhook","title":"Webhook","text":"<p>Please add a webhook in the configuration repository, so that the DNS record can be automatically updated when commits are pushed.</p> <p>The webhook endpoint is <code>http://&lt;server_ip&gt;:9000/hooks/bind</code>, see https://github.com/ustclug/auth-dns/settings/hooks for examples.</p>"},{"location":"infrastructure/dockerhub/","title":"Docker Hub","text":""},{"location":"infrastructure/dockerhub/#dsos","title":"Docker-Sponsored Open-Source program (DSOS) application","text":"Item Reference response First Name Jiawei (Use your own name) Last Name Fu (Use your own name) Email Address redacted (Use your own email address) Role Tech Lead (or anything that makes sense) Company or Organization Name Linux User Group of University of Science and Technology of China Country (Select) China What is the name of your project? Various: USTC Open Source Software Mirror, USTC Network Boot Service, etc. Please link the public repository of your OSS organization (github, gitlab, etc.) https://github.com/ustclug Please provide a link to your project website. https://lug.ustc.edu.cn/ Enter your user Docker ID (aka username). ibugone (Use your own Docker ID) Do you have an existing Organization? (Select) Yes Enter the existing Docker ID for your organization on Docker Hub. ustclug What is the goal of this project? Ease the use of many Linux distros and open-source software, as well as advocate the spirit of Free Software What types of user(s) benefit from this project? Linux users and developers in mainland China What is the code distribution license for your OSS project? (Select) MIT License To what industry does your project or organization belong? (Select) Academic/research To what industry does your project or organization belong? 6 (Adjust as needed) Please list all sponsors for this project (patreon and other microdonations can be listed as one). USTC Network Information Center, USTC Library Does this project have a pathway to commercialization? ... (Select) No If approved, do you agree to the ...? (Tick the checkbox) Press Submit"},{"location":"infrastructure/dockerhub/#notes","title":"Notes","text":"<p>The first application on October 25, 2023 was declined with the following reason (emphasis mine):</p> <p>During our review of your application for Various (USTC Open Source Soft<sup>[sic]</sup>, we determined that while your project meets most of the program requirements, there is a lack of documentation in one or more of your repositories on Docker Hub.</p> <p>Before resubmitting the application, I deleted a few obsolete repositories and filled in the \"Repository overview\" for the rest, asking ChatGPT to produce it when needed. Afterwards, the second submission was approved in just 3 hours.</p>"},{"location":"infrastructure/github/","title":"GitHub Organization","text":"<p>ustclug @ GitHub</p>"},{"location":"infrastructure/github/#github-actions","title":"GitHub Actions","text":"<p>GitHub Actions \u5bf9\u516c\u5f00\u4ed3\u5e93\u514d\u8d39\uff0c\u5bf9\u79c1\u6709\u4ed3\u5e93\u6bcf\u6708\u6709 3000 \u5206\u949f\u7684\u9650\u989d\uff08\u6ce8\uff1a\u6211\u4eec\u662f\u5b66\u6821\u5e2e\u5fd9\u7533\u8bf7\u7684 GitHub Education\uff0c\u6240\u4ee5\u6211\u4eec\u5728\u529f\u80fd\u4e0a\u76f8\u5f53\u4e8e\u4ed8\u8d39\u7684 GitHub Team\uff09\u3002\u76ee\u524d\u6211\u4eec\u6709\u591a\u4e2a\u9879\u76ee\u4f7f\u7528 GitHub Actions \u90e8\u7f72\uff0c\u4f8b\u5982 Linux 101 \u7684\u8bb2\u4e49\u3002</p> <p>\u6211\u4eec\u66fe\u7ecf\u4f7f\u7528 Travis CI\uff08\u73b0\u5728\u4e5f\u5728\u90e8\u5206\u516c\u5f00\u4ed3\u5e93\u4e2d\u4f7f\u7528\uff09\uff0c\u56e0\u4e3a\uff08\u4e0d\u4f1a\u5b9a\u671f\u91cd\u7f6e\u7684\uff09\u6570\u91cf\u9650\u5236\u800c\u5c06\u79c1\u6709\u4ed3\u5e93\u5168\u90e8\u8fc1\u51fa\uff0c\u8ba8\u8bba\u89c1 Discussion #308.</p>"},{"location":"infrastructure/github/#2fa","title":"\u4e24\u6b65\u8ba4\u8bc1\uff082FA\uff09","text":"<p>\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u52a0\u5165 ustclug \u7ec4\u7ec7\u7684\u7528\u6237\u4e3a\u81ea\u5df1\u7684 GitHub \u8d26\u53f7\u914d\u7f6e\u4e24\u6b65\u8ba4\u8bc1\uff1a</p> <ul> <li>GitHub \u4e0d\u652f\u6301 +86 \u624b\u673a\u53f7\u8ba4\u8bc1\uff0c\u4f46\u662f\u53ef\u80fd\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539\u524d\u7aef\u7ed5\u8fc7\u9650\u5236\uff08\u4e0d\u63a8\u8350\uff09</li> <li>\u4f7f\u7528 Authenticator\uff1a\u5357\u5927\u7684 Yao Ge \u8001\u5e08\u6574\u7406\u4e86\u5728\u79fb\u52a8\u8bbe\u5907\uff08iOS \u4e0e Android\uff09\u53ef\u4ee5\u4f7f\u7528\u7684 TOTP \u5ba2\u6237\u7aef\uff0c\u5185\u5bb9\u53c2\u89c1 https://doc.nju.edu.cn/books/efe93/page/b1a59\u3002<ul> <li>iOS \u8bbe\u5907\u53ef\u4ee5\u4f7f\u7528 Google Authenticator \u6216 Microsoft Authenticator\uff0cAndroid \u8bbe\u5907\u4e5f\u53ef\u4ee5\u4ece Google Play \u5546\u5e97\u83b7\u53d6\u8fd9\u4e24\u4e2a\u5e94\u7528\uff1b</li> <li>\u65e0\u6cd5\u8bbf\u95ee Google Play \u7684 Android \u8bbe\u5907\u4e5f\u53ef\u4ee5\u4f7f\u7528 FreeOTP Plus, andOTP, Aegis Authenticator, Red Hat FreeOTP, OTP Authenticator\u3002</li> </ul> </li> </ul>"},{"location":"infrastructure/google/","title":"G Suite","text":"<p>\u7531\u4e8e G Suite \u81ea 2022 \u5e74 7 \u6708\u8d77\u4e0d\u518d\u63d0\u4f9b\u514d\u8d39\u7684 Teams\uff0c\u4e14\u5df2\u6709\u7684\u514d\u8d39 Teams \u4e5f\u5c06\u505c\u6b62\u670d\u52a1\uff0c\u6211\u4eec\u5df2\u4e8e 2022 \u5e74 3 \u6708\u5168\u9762\u8fc1\u79fb\u81f3 Office 365\u3002</p> <p>\u8003\u8651\u5230\u6b64\u9875\u9762\u7684 URL \u8fd8\u6709\u4e00\u5b9a\u6570\u91cf\u7684\u5916\u94fe\uff0c\u6211\u4eec\u628a\u672c\u9875\u6587\u6863\u91cd\u65b0\u52a0\u4e86\u56de\u6765\uff0c\u4f46\u662f\u6240\u6709\u6709\u610f\u4e49\u7684\u5185\u5bb9\u90fd\u5df2\u7ecf\u79fb\u52a8\u5230\u4e86 Office 365 \u9875\u9762\u4e2d\u3002</p>"},{"location":"infrastructure/ldap/","title":"LDAP \u670d\u52a1\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e","text":"<p>LDAP \u662f\u8f7b\u91cf\u76ee\u5f55\u8bbf\u95ee\u534f\u8bae\uff0c\u6211\u4eec\u7528\u7684\u8f6f\u4ef6\u662f OpenLDAP\u3002</p> <p>LDAP \u7684\u914d\u7f6e\u5f88\u9ebb\u70e6\uff0c\u6240\u4ee5\u88c5\u4e86\u4e00\u4e2a\u7f51\u9875\u524d\u7aef\u6765\u914d\u7f6e\u5b83\uff0c\u7f51\u9875\u524d\u7aef\u662f GOsa\u00b2\u3002</p>"},{"location":"infrastructure/ldap/#_1","title":"\u5bc6\u7801\u4fee\u6539","text":"<p>\u767b\u5f55\u4efb\u610f\u4e00\u53f0\u670d\u52a1\u5668\u4f7f\u7528 <code>passwd</code> \u5c31\u53ef\u4ee5\u4fee\u6539\u5bc6\u7801\uff0c\u4fee\u6539\u7684\u5bc6\u7801\u5728\u6240\u6709\u673a\u5668\u4e0a\u5b9e\u65f6\u751f\u6548\uff08\u56e0\u4e3a\u5b9e\u9645\u662f\u5b58\u5728 LDAP \u6570\u636e\u5e93\u91cc\u7684\uff09\u3002</p>"},{"location":"infrastructure/ldap/#gosa","title":"GOsa \u4f7f\u7528","text":"<p>\u7f51\u9875\u754c\u9762\u4f4d\u4e8e ldap.lug.ustc.edu.cn\u3002</p> <p>\u7528\u4f60\u7684\u8d26\u53f7\u767b\u5f55\u8fdb\u53bb\u4e4b\u540e\uff0c\u53ef\u4ee5\u5728\u53f3\u4e0a\u89d2\u9000\u51fa\uff0c\u53f3\u4e0a\u89d2\u8fd8\u6709\u4e24\u4e2a\u6309\u94ae\u5206\u522b\u662f\u4fee\u6539\u8d26\u53f7\u4fe1\u606f\u548c\u4fee\u6539\u5bc6\u7801\u3002\u8d26\u53f7\u4fe1\u606f\u7b2c\u4e00\u9875\u5927\u90e8\u5206\u662f\u6ca1\u7528\u7684\uff0c\u53ea\u6709\u4e00\u4e2a\u767b\u5f55\u540d\u662f\u6709\u7528\u7684\uff0c\u8fd9\u662f\u4f60\u767b\u5f55\u4efb\u4f55\u5730\u65b9\u7684\u7528\u6237\u540d\u3002</p>"},{"location":"infrastructure/ldap/#ldap-users-and-groups","title":"Users \u548c Groups","text":"<p>Users \u662f\u7528\u6765\u6dfb\u52a0\u548c\u914d\u7f6e\u7528\u6237\u4fe1\u606f\u7684\u5730\u65b9\u3002\u6700\u4e3b\u8981\u7684\u529f\u80fd\u4f4d\u4e8e\u6bcf\u4e2a User \u7684\u7b2c\u4e8c\u9875 POSIX\uff0c\u8fd9\u91cc\u53ef\u4ee5\u8bbe\u7f6e\u7528\u6237\u7684\u5bb6\u76ee\u5f55\uff0cUID\uff0cGID\uff0c\u4ee5\u53ca\u6240\u5c5e\u7684\u7528\u6237\u7ec4\u3002\u8fd9\u91cc\u9700\u8981\u6ce8\u610f\u7684\u5730\u65b9\u5982\u4e0b\uff1a</p> <ul> <li> <p>UID\uff0cGID \u4ece 2000 \u5f00\u59cb\u8ba1\u6570\uff0c\u7531\u4e8e gosa \u4e0d\u80fd\u5bf9 UID \u81ea\u52a8\u589e\u957f\uff0c\u6240\u4ee5\u7ba1\u7406\u5458\u9700\u8981\u4eba\u5de5\u589e\u957f\u3002\u65b9\u6cd5\u662f\u767b\u5f55\u4efb\u610f\u4e00\u53f0\u673a\u5668\uff0c\u8fd0\u884c <code>getent passwd</code> \u5e76\u89c2\u5bdf\u8f93\u51fa\uff0c\u53d6\u6700\u5927\u7684 UID + 1 \u5c31\u884c\u4e86\u3002</p> <p>\u5751</p> <p>\u5c0f\u5fc3\u8f93\u51fa\u7684\u987a\u5e8f\uff0c\u6700\u5927\u7684 UID \u4e0d\u4e00\u5b9a\u662f\u6700\u540e\u4e00\u4e2a\uff08\u800c\u4e14\u4e8b\u5b9e\u4e0a\u7ecf\u5e38\u4e0d\u662f\uff09\uff0c\u5efa\u8bae\u914d\u5408 sed, awk, sort \u4e4b\u7c7b\u7684\u547d\u4ee4\u59a5\u5584\u5904\u7406\uff0c\u4f8b\u5982</p> <pre><code>getent -s ldap passwd | cut -d: -f3 | sort -n\n</code></pre> <p>\u540c\u65f6\u8fd8\u6709\u82e5\u5e72 UID \u5f88\u5927\u4f46\u662f\u79bb\u6563\u7684\u7279\u6b8a\u8d26\u53f7\uff0c\u5f88\u5bb9\u6613\u5206\u8fa8\u3002\u663e\u7136\u65b0 UID \u662f 2000 \u5f00\u59cb\u8fde\u7eed\u7684\u6700\u5927 UID + 1.</p> <p>GID \u5efa\u8bae\u4e0d\u8981\u6bcf\u4eba\u4e00\u4e2a\uff0c\u6211\u4eec\u5efa\u4e00\u4e2a group\uff0c\u7ed9\u5927\u5bb6\u90fd\u52a0\u8fdb\u6765\uff0c\u8fd9\u6837\u5c31\u53ea\u9700\u8981\u8003\u8651 UID \u7684\u589e\u957f\u4e86\u3002\u76ee\u524d\u8be5 group \u4e3a <code>ldap_users</code>\uff0cGID \u4e3a 2001\u3002</p> </li> <li> <p>\u5efa\u8d26\u53f7\u4e4b\u524d\u5148\u6ce8\u610f\u4e00\u4e0b\u5404\u4e2a\u670d\u52a1\u5668\u4e0a\u6709\u6ca1\u6709\u76f8\u540c\u7684\u7528\u6237\u540d\uff0c\u6709\u7684\u8bdd\u628a\u539f\u5bb6\u76ee\u5f55 chown \u5230\u65b0\u7684 UID GID\uff0c\u5220\u9664\u540c\u540d\u7528\u6237\u3002</p> </li> </ul> <p>Groups \u4e2d\u4ee5 ssh \u5f00\u5934\u7684\u7ec4\u63a7\u5236\u5bf9\u5e94\u673a\u5668\u7684 ssh \u6743\u9650\uff0csudo \u5f00\u5934\u540c\u7406\u3002super_maneger \u7ec4\u5305\u542b\u6240\u6709\u673a\u5668\u7684\u6743\u9650\uff0c\u4ee5\u53ca LDAP \u7684 admin \u8eab\u4efd\u3002\u52a0\u5165\u5bf9\u5e94\u7684\u7ec4\u5373\u6388\u4e88\u76f8\u5e94\u6743\u9650\u3002\u5df2\u77e5\u7684 GID</p>"},{"location":"infrastructure/ldap/#access-control","title":"Access Control","text":"<p>\u8fd9\u91cc\u53ef\u4ee5\u914d\u7f6e GOsa \u7684\u7f16\u8f91\u6743\u9650\uff0c\u73b0\u5728\u8fd9\u91cc\u9762\u53ea\u6709\u4e00\u4e2a\u7ec4\uff0c\u662f\u5b8c\u5168\u6743\u9650\u7684\u3002\u53e6\u5916\uff0c\u6bcf\u4e2a\u9879\u53ef\u4ee5\u8bbe\u7f6e\u4e13\u95e8\u9488\u5bf9\u8fd9\u4e2a\u9879\u7684 ACL\u3002</p>"},{"location":"infrastructure/ldap/#sudo-rules","title":"Sudo rules","text":"<p>\u8fd9\u91cc\u914d\u7f6e sudo \u6743\u9650\u3002\u8fd9\u91cc\u7684\u8bed\u6cd5\u548c sudoers \u4e00\u6837\uff08\u8bf7\u65e0\u89c6 System trust\uff09\u3002\u7279\u522b\u8981\u8bf4\u7684\u4e00\u70b9\u662f\u901a\u8fc7\u5728 System \u4e2d\u52a0\u5165\u4e3b\u673a\u540d\u53ef\u4ee5\u9488\u5bf9\u6bcf\u4e2a\u4e3b\u673a\u914d\u7f6e\u6743\u9650\uff0c\u8fd9\u91cc\u8981\u586b\u7684\u662f\u4e3b\u673a\u540d\u800c\u4e0d\u662f\u57df\u540d\uff0c\u5177\u4f53\u8303\u4f8b\u8bf7\u770b\u91cc\u9762\u7684 lugsu wikimanager \u7b49\u9879\u3002</p> <p>\u5176\u5b83\u6211\u6ca1\u63d0\u5230\u7684\u9879\u6211\u4e5f\u6ca1\u641e\u660e\u767d\u600e\u4e48\u7528\u3002\u3002\u3002</p> <p>gosa \u7684\u914d\u7f6e\u6587\u4ef6\u5728 <code>/etc/gosa/gosa.conf</code>\uff0c\u5b83\u662f\u5728\u7b2c\u4e00\u6b21\u8fd0\u884c gosa \u65f6\u5019\u81ea\u52a8\u751f\u6210\u7684\uff0c\u4f46\u5728\u4e4b\u540e\u5c31\u53ea\u80fd\u901a\u8fc7\u624b\u52a8\u7f16\u8f91\u6765\u4fee\u6539\u3002\u7531\u4e8e\u914d\u7f6e\u6587\u4ef6\u51e0\u4e4e\u6ca1\u6709\u6587\u6863\uff0c\u5b98\u65b9\u7684 FAQ \u6709\u597d\u591a\u662f\u9519\u7684\uff0c\u6240\u4ee5\u6211\u57fa\u672c\u6ca1\u52a8:-D\u3002</p>"},{"location":"infrastructure/ldap/#_2","title":"\u7ef4\u62a4\u5907\u6ce8","text":"<p>\u5982\u679c\u53d1\u73b0\u66f4\u65b0 GOsa \u4e4b\u540e\uff0c<code>/gosa</code> \u6ca1\u6709\u6b63\u5e38\u5de5\u4f5c\uff08\u6bd4\u5982\u8bf4\u76f4\u63a5\u663e\u793a\u4e86 PHP \u7684\u6e90\u4ee3\u7801\uff09\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u5220\u9664 <code>/var/spool/gosa/</code> \u4e2d\u7684\u6240\u6709\u6587\u4ef6\uff0c\u8be6\u89c1 Gosa broken in Debian stretch\u3002</p>"},{"location":"infrastructure/ldap/#ldap_1","title":"LDAP \u5ba2\u6237\u7aef\u914d\u7f6e","text":""},{"location":"infrastructure/ldap/#debian","title":"Debian \u914d\u7f6e\u65b9\u6cd5","text":""},{"location":"infrastructure/ldap/#_3","title":"\u8f6f\u4ef6\u5305\u5b89\u88c5","text":"<p>Debian 7 \u4ee5\u4e0a\u7cfb\u7edf\u5b89\u88c5 <code>libnss-ldapd</code>\u3001<code>libpam-ldapd</code>\u3001<code>sudo-ldap</code></p> <p>Note</p> <p>\u66f4\u65b0\u8fd9\u4e9b\u8f6f\u4ef6\u5305\u65f6\uff0c\u6ce8\u610f\u4fdd\u7559\u4e00\u4e2a root \u7ec8\u7aef\uff0c\u66f4\u65b0\u540e\u53ef\u80fd\u9700\u8981\u91cd\u542f daemon \u8fdb\u7a0b</p> <p>\u5728\u5b89\u88c5\u8fc7\u7a0b\u4e2d\u4f1a\u88ab\u95ee\u4e00\u4e9b\u95ee\u9898\uff08\u4e0d\u540c\u7248\u672c\u7684 Debian \u7684\u95ee\u9898\u53ef\u80fd\u4e0d\u540c\uff09\uff1a</p> <ul> <li>LDAP \u670d\u52a1\u5668\u5730\u5740\u662f <code>ldaps://ldap.lug.ustc.edu.cn</code></li> <li>Base DN \u4e3a <code>dc=lug,dc=ustc,dc=edu,dc=cn</code></li> <li>\u534f\u8bae\u4e3a\u7248\u672c 3</li> <li>\u914d\u7f6e libnss-ldapd \u65f6\u6709\u4e2a\u9009 Name services to configure \u7684\uff0c\u5168\u90e8\u9009\u4e0a</li> </ul>"},{"location":"infrastructure/ldap/#etcldapldapconf","title":"/etc/ldap/ldap.conf","text":"<p>\u7f16\u8f91\u5185\u5bb9\u5982\u4e0b\uff1a</p> /etc/ldap/ldap.conf<pre><code>BASE dc=lug,dc=ustc,dc=edu,dc=cn\nURI ldaps://ldap.lug.ustc.edu.cn\nSSL yes\nTLS_CACERT /etc/ldap/slapd-ca-cert.pem\nTLS_REQCERT demand\nSUDOERS_BASE ou=sudoers,dc=lug,dc=ustc,dc=edu,dc=cn\n</code></pre> <p>\u4e3a\u4e86\u5b89\u5168\u6027\u8003\u8651\uff0c\u8981\u4ee5 ldaps \u7684\u65b9\u5f0f\u8fde\u63a5 ldap \u670d\u52a1\u5668\uff0c\u540c\u65f6\u5e94\u914d\u7f6e\u597d\u8bc1\u4e66 (<code>/etc/ldap/slapd-ca-cert.pem</code>, \u4ece\u5176\u5b83\u670d\u52a1\u5668\u590d\u5236\u4e00\u4e2a)</p>"},{"location":"infrastructure/ldap/#etcsudo-ldapconf","title":"/etc/sudo-ldap.conf","text":"<p>\u8fd9\u4e2a\u6587\u4ef6\u5e94\u8be5\u76f4\u63a5\u8f6f\u94fe\u63a5\u5230 <code>/etc/ldap/ldap.conf</code>\uff0c\u901a\u5e38 dpkg \u5df2\u7ecf\u4e3a\u4f60\u521b\u5efa\u597d\u4e86\u3002</p>"},{"location":"infrastructure/ldap/#etcnslcdconf","title":"/etc/nslcd.conf","text":"<p>\u6ce8\u610f\u68c0\u67e5\u4e00\u4e0b\u6b64\u914d\u7f6e\u6587\u4ef6\u662f\u5426\u4e0e <code>/etc/ldap/ldap.conf</code> \u4e0b\u7684\u5185\u5bb9\u76f8\u4e00\u81f4\uff0c\u5982</p> /etc/nslcd.conf<pre><code>uid nslcd\ngid nslcd\nuri ldaps://ldap.lug.ustc.edu.cn\nbase dc=lug,dc=ustc,dc=edu,dc=cn\nssl on\ntls_reqcert demand\ntls_cacertfile /etc/ldap/slapd-ca-cert.pem\n</code></pre>"},{"location":"infrastructure/ldap/#etcnsswitchconf","title":"/etc/nsswitch.conf","text":"<p>\u5b89\u88c5\u8f6f\u4ef6\u5305\u65f6\uff0c\u5b89\u88c5\u811a\u672c\u5df2\u7ecf\u5904\u7406\u8fc7\u8be5\u6587\u4ef6\u3002\u68c0\u67e5\u4e00\u4e0b\u5185\u5bb9\uff0c\u5927\u81f4\u4e3a\uff1a</p> <pre><code>passwd:         compat ldap\ngroup:          compat ldap\nshadow:         compat ldap\n......\nsudoers:        files ldap\n</code></pre> <p>\u6ce8\u610f\u6bcf\u4e00\u9879\u540e\u9762\u7684 <code>ldap</code>\uff0c\u5982\u679c\u6ca1\u6709\u8981\u624b\u52a8\u52a0\u4e0a\u3002\u4e0d\u592a\u6e05\u695a\u5177\u4f53\u542b\u4e49\uff0c\u53cd\u6b63\u7ed9\u6bcf\u4e00\u9879\u90fd\u52a0\u4e0a <code>ldap</code> \u662f\u6ca1\u6709\u95ee\u9898\u7684\u3002</p> <p>Debian 10 \u8981\u6539\u4e00\u4e0b sudoers \u90a3\u4e00\u884c</p> <p>\u628a ldap \u653e\u524d\u9762\uff0c\u540c\u65f6\u52a0\u4e0a <code>[SUCCESS=return]</code> \u5e94\u8be5\u50cf\u4e0b\u9762\u8fd9\u6837\uff1a</p> <pre><code>sudoers:        ldap [SUCCESS=return] files\n</code></pre> <p>\u91cd\u542f\u4e00\u4e0b <code>nscd</code> \u548c <code>nslcd</code> \u670d\u52a1\uff0c\u6b64\u65f6\u8fd0\u884c <code>getent passwd</code>\uff0c\u5e94\u8be5\u53ef\u4ee5\u770b\u5230\u6bd4 <code>/etc/passwd</code> \u66f4\u591a\u7684\u5185\u5bb9\uff0c\u8fd9\u5c31\u8bf4\u660e\u914d\u7f6e\u6b63\u786e\u4e86\u3002</p>"},{"location":"infrastructure/ldap/#pam","title":"PAM \u914d\u7f6e","text":"<p>\u5982\u679c PAM \u914d\u7f6e\u9519\u8bef\uff0c\u53ef\u80fd\u5bfc\u81f4\u7528\u6237\u65e0\u6cd5\u4f7f\u7528 SSH \u767b\u5f55\uff0c\u751a\u81f3\u8fde sudo \u4e5f\u53ef\u80fd\u6302\u6389\u3002\u6240\u4ee5\u4fee\u6539 PAM \u914d\u7f6e\u65f6\uff1a</p> <ol> <li>\u8bf7\u505a\u597d\u6587\u4ef6\u5907\u4efd\uff1b</li> <li>\u8bf7\u53e6\u5f00\u4e00\u4e2a root \u7ec8\u7aef\u4ee5\u9632\u4e07\u4e00\u3002</li> </ol> <p>\u5bf9\u4e8e Debian 7+\uff0c\u53ea\u9700\u8bbe\u7f6e\u4e00\u5904\u3002\u4e3a\u4e86\u767b\u5f55\u65f6\u81ea\u52a8\u521b\u5efa\u5bb6\u76ee\u5f55\uff0c\u5728 <code>/etc/pam.d/common-session</code> \u4e2d\u6dfb\u52a0\u4e0b\u9762\u8fd9\u53e5\uff1a</p> <pre><code>session required    pam_mkhomedir.so skel=/etc/skel umask=0022\n</code></pre> <p>\u5bf9\u4e8e Debian 5\uff0c\u8bf7\u67e5\u9605\u672c\u6587\u6863\u7684 Git \u8bb0\u5f55\u3002</p>"},{"location":"infrastructure/ldap/#centos","title":"CentOS \u914d\u7f6e\u65b9\u6cd5","text":"<p>\u901a\u8fc7 yum \u5b89\u88c5 openldap openldap-clients nss_ldap nss-pam-ldap</p> <p>\u4ee5 root \u8eab\u4efd\u6267\u884c</p> <pre><code>authconfig --enablecache \\\n       --enableldap \\\n       --enableldapauth \\\n       --ldapserver=\"ldaps://ldap.lug.ustc.edu.cn/\" \\\n       --ldapbasedn=\"dc=lug,dc=ustc,dc=edu,dc=cn\" \\\n       --enableshadow \\\n       --enablemkhomedir \\\n       --enablelocauthorize \\\n       --update\n</code></pre> <p>\u6ce8\u610f\uff0c\u7531\u4e8e authconfig \u7684 bug\uff0c\u4e0a\u4e00\u6761\u547d\u4ee4\u7684\u6267\u884c\u73af\u5883\u5fc5\u987b\u662f <code>LC_ALL=en_US.UTF-8</code></p> <p>Sudo \u7684\u914d\u7f6e\u662f\u901a\u8fc7 sssd \u5b9e\u73b0\u7684\uff0c\u53c2\u8003 https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sssd-ldap-sudo.html</p> <p>\u5b89\u88c5 sssd libsss_sudo \u5c06 <code>/usr/share/doc/sssd-common/sssd-example.conf</code> \u590d\u5236\u5230 <code>/etc/sssd/sssd.conf</code> \u5e76\u4fee\u6539\u6743\u9650\u4e3a 600\u3002</p> <pre><code>[taoky@gateway-nic ~]$ sudo diff /usr/share/doc/sssd-common/sssd-example.conf /etc/sssd/sssd.conf\n3c3\n&lt; services = nss, pam\n---\n&gt; services = nss, pam, sudo\n8c8\n&lt; ; domains = LDAP\n---\n&gt; domains = LDAP\n13a14,15\n&gt; [sudo]\n&gt;\n15,17c17,19\n&lt; ; [domain/LDAP]\n&lt; ; id_provider = ldap\n&lt; ; auth_provider = ldap\n---\n&gt; [domain/LDAP]\n&gt; id_provider = ldap\n&gt; auth_provider = ldap\n22,24c24,27\n&lt; ; ldap_schema = rfc2307\n&lt; ; ldap_uri = ldap://ldap.mydomain.org\n&lt; ; ldap_search_base = dc=mydomain,dc=org\n---\n&gt; ldap_schema = rfc2307\n&gt; ldap_uri = ldaps://ldap.lug.ustc.edu.cn\n&gt; ldap_search_base = dc=lug,dc=ustc,dc=edu,dc=cn\n&gt; ldap_sudo_search_base = ou=sudoers,dc=lug,dc=ustc,dc=edu,dc=cn\n30c33\n&lt; ; cache_credentials = true\n---\n&gt; cache_credentials = true\n35c38\n&lt; # you must install Microsoft Services For UNIX and map LDAP attributes onto\n---\n&gt; # you must install Microsoft Services For Unix and map LDAP attributes onto\n</code></pre> <p>\u5751</p> <p>\u9700\u8981\u52a0\u4e0a <code>[sudo]</code>\uff0c\u5426\u5219 sudo \u914d\u7f6e\u4f3c\u4e4e\u4e0d\u4f1a\u751f\u6548\uff0c\u8fd9\u4e2a\u914d\u7f6e\u95ee\u9898\u5bfc\u81f4\u4e86\u4fee\u6539\u524d\u5728 gateway-nic \u4e0a\u7528\u6237\u65e0\u6cd5\u4f7f\u7528 sudo\u3002</p> <p>\u53e6\u5916\u8bb0\u5f97\u50cf\u524d\u9762\u5728 Debian \u4e2d\u5b89\u88c5\u4ecb\u7ecd\u5230\u7684\u90a3\u6837\u4fee\u6539 <code>/etc/nsswitch.conf</code> \u4ee5\u53ca <code>/etc/nslcd.conf</code>.</p>"},{"location":"infrastructure/ldap/#nscd","title":"NSCD \u4f7f\u7528\u8bf4\u660e","text":"<p>NSCD \u662f\u7528\u4e8e LDAP \u7f13\u5b58\u7684\u670d\u52a1\uff0c\u76ee\u524d\u5728 mirrors \u4e0a\u7684\u914d\u7f6e\u662f\u4fdd\u6301 30 \u5929\u3002\u8fd9\u5bfc\u81f4\u7684\u95ee\u9898\u662f\u6bcf\u5f53 ldap \u670d\u52a1\u5668\u4e0a\u505a\u51fa\u4fee\u6539\u7684\u65f6\u5019\u9700\u8981\u5728 mirrors \u4e0a\u6267\u884c\uff0c\u6e05\u9664\u6307\u5b9a\u7c7b\u578b\u7684\u7f13\u5b58(\u76ee\u524d mirrors \u670d\u52a1\u5668\u6682\u672a\u914d\u7f6e LDAP \u8ba4\u8bc1\u3002)</p> <pre><code>nscd -i passwd\nnscd -i group\n</code></pre> <p>\u53c2\u8003\uff1ahttps://wiki.debian.org/LDAP/NSS</p>"},{"location":"infrastructure/ldap/#ldap-cli","title":"LDAP CLI \u5de5\u5177\u4f7f\u7528\u8bf4\u660e","text":"<p>\u8fd9\u91cc\u4ee5 <code>ldappasswd</code> \u4e3a\u4f8b\uff0c\u5176\u4f59 ldap \u7cfb\u5217\u6307\u4ee4\u4e0e\u5176\u5927\u81f4\u76f8\u540c\uff1a</p> <p>LDAP \u5229\u7528 dn \u6765\u5b9a\u4f4d\u4e00\u4e2a\u7528\u6237\uff0c\u4ee5\u4e0b\u6307\u4ee4\u53ef\u4ee5\u5217\u51fa\u6240\u6709\u7528\u6237\u53ca\u5176 dn\uff1a</p> <pre><code>ldapsearch -x -LLL uid=* uid\n</code></pre> <p><code>-x</code> \u6307\u5b9a\u4f7f\u7528 Simple authentication\uff0c\u5373\u4f7f\u7528\u5bc6\u7801\u8ba4\u8bc1\u3002</p> <p>\u5982\u679c\u8981\u4fee\u6539\u4e00\u4e2a\u7528\u6237\u7684\u5bc6\u7801\uff0c\u4f7f\u7528\uff1a</p> <pre><code>ldappasswd -x -D '&lt;executor dn&gt;' -W -S '&lt;target user dn&gt;'\n</code></pre> <p><code>-D '&lt;executor dn&gt;'</code> \u6307\u5b9a\u4e86\u6267\u884c\u8005\u7684\u8eab\u4efd\uff0c<code>-W</code>/<code>-S</code> \u6307\u5b9a\u4e86\u63a5\u4e0b\u6765\u8be2\u95ee\u6267\u884c\u8005/\u76ee\u6807\u7528\u6237\u7684\u5bc6\u7801/\u65e7\u5bc6\u7801\u3002</p> <p>\u9700\u8981\u989d\u5916\u6ce8\u610f\u7684\u662f\uff0c\u5728 CLI \u4e2d\u6dfb\u52a0/\u5220\u9664\u7528\u6237\u6216\u66f4\u6539\u7528\u6237\u5bc6\u7801\u65f6\u9700\u8981\u4ee5 LDAP admin \u6267\u884c\uff0c\u5426\u5219\u4f1a\u6709\u62a5\u9519\uff1a</p> <pre><code>Insufficient access (50) additional info: no write access to parent\n</code></pre> <p>\u6216\u662f\u5176\u4ed6\u7684\u6743\u9650\u4e0d\u8db3\u7684\u9519\u8bef\u3002</p>"},{"location":"infrastructure/ldap/#_4","title":"\u90e8\u7f72\u60c5\u51b5","text":"<p>\u76ee\u524d\u6240\u6709\u670d\u52a1\u5668\u5747\u5df2\u90e8\u7f72 LDAP</p>"},{"location":"infrastructure/ldap/#ldap-known-gids","title":"\u5df2\u77e5\u7684 GID","text":"<p>GID \u4fe1\u606f\u5df2\u8fc7\u65f6\uff0c\u4ee5 LDAP \u5b9e\u9645\u914d\u7f6e\u4e3a\u51c6\u3002</p> GID \u540d\u79f0 \u8bf4\u660e 2001 ldap_users \u6240\u6709\u7528\u6237\u90fd\u5728\u8fd9\u4e2a\u7ec4\u91cc 1001 ssh_docker2 - 2013 ssh_bbs - 2014 ssh_linode - 2101 ssh_ldap - 2102 ssh_blog - 2103 ssh_dns - 2104 ssh_gitlab - 2105 ssh_lug - 2106 ssh_vpn - 2107 ssh_mirrors - 2108 ssh_pxe - 2109 ssh_freeshell - 2110 ssh_backup - 2112 ssh_vmnfs - 2113 ssh_homepage - 2201 sudo_ldap - 2202 sudo_blog - 2203 sudo_dns - 2204 sudo_gitlab - 2205 sudo_lug - 2206 sudo_vpn - 2207 sudo_mirrors - 2208 sudo_pxe - 2209 sudo_freeshell - 2210 sudo_backup - 2212 sudo_vmnfs - 2213 sudo_homepage - 2000 super_manager - 2999 nologin \u4e0d\u786e\u5b9a\u8fd9\u4e2a\u7ec4\u6709\u6ca1\u6709\u7528 <ul> <li>\u4ece\u4e0a\u6587\u7684\u89c4\u8303\u6765\u8bb2\uff0c\u5e94\u8be5\u4ece 2000 \u5f00\u59cb\u7f16\u53f7 GID\uff0c\u4f46\u6709\u4e9b\u7ec4\u53ef\u80fd\u521b\u5efa\u8005\u6ca1\u6ce8\u610f\uff0c\u4e0d\u8fc7\u540e\u671f\u518d\u6539\u5c31\u4e0d\u65b9\u4fbf\u4e86\u3002</li> <li>ssh_* \u8fd9\u4e9b\u7ec4\uff0c\u662f\u5728\u6bcf\u4e2a\u4e3b\u673a\u7684 sshd_config \u91cc\u53ea\u5141\u8bb8\u76f8\u5e94\u7684\u7ec4\u767b\u9646\u3002</li> <li>sudo_* \u8fd9\u4e9b\u7ec4\uff0c\u662f\u5728 LDAP sudo rules \u91cc\u5141\u8bb8\u4e86\u76f8\u5e94\u7684\u7ec4\u3002</li> </ul> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>LDAP \u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u52a1\u5fc5\u786e\u8ba4 sshd_config \u5df2\u7ecf\u9650\u5236\u4e86\u516c\u7f51\u767b\u5f55\u3002</p> <p>\u672c\u6587\u6863\u539f\u59cb\u7248\u672c\u590d\u5236\u81ea LUG wiki\uff0c\u7531\u5f20\u5149\u5b87\u3001\u5d14\u704f\u3001\u6731\u665f\u83c1\u3001\u5de6\u683c\u975e\u64b0\u5199\u3002</p>"},{"location":"infrastructure/mail/","title":"Mail Agent","text":"<p>\u53ef\u4ee5\u914d\u7f6e\u673a\u5668\u901a\u8fc7 mail.ustclug.org \u53d1\u4ef6\uff0c\u5b9e\u73b0\u8b66\u62a5\u7684\u90ae\u4ef6\u63d0\u9192\uff08\u6536\u4ef6\u4eba\u8bbe\u7f6e\u4e3a alert AT ustclug DOT org\uff09\u3002\u914d\u7f6e\u65f6\u9700\u8981\u5728 mail.s.ustclug.org \u4e0a\u8bbe\u7f6e postfix \u767d\u540d\u5355\u3002</p>"},{"location":"infrastructure/mail/#_1","title":"\u5e38\u7528\u547d\u4ee4","text":"<p>\u4ece\u961f\u5217\u4e2d\u5220\u9664\u90ae\u4ef6\uff1a<code>sudo postsuper -d &lt;\u90ae\u4ef6 ID&gt;</code>\uff08\u90ae\u4ef6 ID \u53ef\u4ee5\u65e5\u5fd7\u4e2d\u770b\u5230\uff09</p> <p>\u66f4\u65b0 <code>virtual</code> \u8868\u6620\u5c04\uff1a<code>sudo postmap /etc/postfix/virtual</code> \u540e\u91cd\u542f <code>postfix</code> \u670d\u52a1\u3002</p>"},{"location":"infrastructure/mail/#mailustclugorg-dkim","title":"mail.ustclug.org \u7684 DKIM \u7b7e\u540d","text":"<p>\u7f16\u8f91 <code>/etc/opendkim/TrustedHosts</code>\uff0c\u6dfb\u52a0\u5185\u90e8\u670d\u52a1\u5bf9\u5e94\u7684 IP\uff08\u6bb5\uff09\u5230\u5176\u4e2d\uff0c\u5e76 reload <code>opendkim</code> \u5373\u53ef\u3002</p>"},{"location":"infrastructure/monitor/","title":"\u76d1\u63a7\u7cfb\u7edf\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e","text":"<p>\u76d1\u63a7\u7cfb\u7edf\u7531\u4ee5\u4e0b\u51e0\u4e2a\u7ec4\u4ef6\u7ec4\u6210\uff1a</p> <ul> <li>Telegraf: agent\uff0c\u8fd0\u884c\u5728\u6bcf\u4e2a\u88ab\u76d1\u63a7\u7684\u673a\u5668\u4e0a</li> <li>InfluxDB: \u6570\u636e\u5e93\uff0c\u8fd0\u884c\u5728 influxdb.ustclug.org (docker2.s.ustclug.org)</li> <li>Grafana: \u53ef\u89c6\u5316\u5de5\u5177\uff0c\u76d1\u63a7\u62a5\u8b66\uff0c\u5730\u5740\uff1amonitor.ustclug.org (docker2.s.ustclug.org)</li> </ul>"},{"location":"infrastructure/monitor/#configure-influxdb","title":"Configure InfluxDB","text":"<p>\u7279\u522b\u6ce8\u610f \uff1aInfluxDB \u9ed8\u8ba4\u6ca1\u6709\u5f00\u542f\u8ba4\u8bc1\u3002</p> <p>\u9996\u6b21\u8fd0\u884c\u65f6\uff0c\u521b\u5efa\u597d\u7ba1\u7406\u8d26\u53f7\uff08<code>admin</code>\uff09\uff0c\u53ea\u8bfb\u8d26\u53f7\uff08<code>grafana</code>\uff09\u548c\u5199\u5165\u8d26\u53f7\uff08<code>telegraf</code>\uff09\u3002</p> <p>\u7136\u540e\u4fee\u6539\u4f4d\u4e8e <code>/srv/docker/influxdb/conf/influxdb.conf</code> \u7684\u914d\u7f6e\uff0c\u4fee\u6539\u4ee5\u542f\u7528\u8ba4\u8bc1\uff1a</p> /srv/docker/influxdb/conf/influxdb.conf<pre><code>[http]\n# ...\n# Determines whether HTTP authentication is enabled.\nauth-enabled = true\n</code></pre> <p>\u6b64\u5916\uff0c\u53c2\u8003 https://docs.influxdata.com/influxdb/v1.8/administration/authentication_and_authorization/#set-up-authentication\uff0c\u8003\u8651\u5173\u95ed\u90e8\u5206\u529f\u80fd\uff1a</p> /srv/docker/influxdb/conf/influxdb.conf<pre><code>[http]\n# Determines whether the pprof endpoint is enabled.  This endpoint is used for\n# troubleshooting and monitoring.\npprof-enabled = false\n</code></pre>"},{"location":"infrastructure/monitor/#install-telegraf","title":"Install telegraf","text":"<p>\u5b98\u65b9\u6587\u6863\u89c1 https://docs.influxdata.com/telegraf/v1/install/</p> <p>\u5178\u578b\u7684\u5b89\u88c5\u65b9\u5f0f\u662f\u4ece APT \u6e90\u5b89\u88c5\uff1a</p> <pre><code>wget -O /etc/apt/trusted.gpg.d/influxdb.asc https://repos.influxdata.com/influxdata-archive_compat.key\necho \"deb https://mirrors.ustc.edu.cn/influxdata/debian bullseye stable\" &gt; /etc/apt/sources.list.d/influxdb.list\napt update\napt install --no-install-recommends telegraf\n</code></pre> \u624b\u52a8\u5b89\u88c5\u65b9\u5f0f\uff08\u4e0d\u63a8\u8350\uff09 <pre><code>wget https://dl.influxdata.com/telegraf/releases/telegraf_1.28.2-1_amd64.deb\nsudo dpkg -i telegraf_1.28.2-1_amd64.deb\n</code></pre>"},{"location":"infrastructure/monitor/#configure-telegraf","title":"Configure telegraf","text":"<p>\u914d\u7f6e\u6587\u4ef6\u5728 ustclug/telegraf-config \u4ed3\u5e93\u4e2d\u7ba1\u7406\uff0c\u4f7f\u7528\u65b9\u6cd5\u5982\u4e0b\uff1a</p> <ul> <li>\u6e05\u7a7a <code>/etc/telegraf/telegraf.conf</code>\uff08\u4f8b\u5982 <code>truncate -s 0</code> \u6216\u8005 <code>:&gt;</code>\uff09</li> <li> <p>\u628a\u4ed3\u5e93 clone \u5230 <code>/etc/telegraf/repo</code>\uff0c\u4f8b\u5982\uff1a</p> <pre><code>mkdir /etc/telegraf/repo\ncd /etc/telegraf/repo\ngit init\ngit branch -M master\n\nssh-keygen -f .git/id_ed25519 -t ed25519 -N ''\ncat .git/id_ed25519.pub\n# Upload the output to https://github.com/ustclug/telegraf-config/settings/keys\ngit config core.sshCommand 'ssh -i .git/id_ed25519'\ngit remote add origin git@github.com:ustclug/telegraf-config.git\ngit pull origin master\ngit branch --set-upstream-to=origin/master master\n</code></pre> </li> <li> <p>\u56de\u5230 <code>/etc/telegraf/telegraf.d</code>\uff0c\u4ece <code>../repo/*.conf</code> \u4e2d\u6309\u9700 symlink \u6587\u4ef6\u8fc7\u6765</p> </li> </ul> <p>\u914d\u7f6e\u5b8c\u6210\u4e4b\u540e\uff0c\u91cd\u542f telegraf \u670d\u52a1\uff0c\u5e76\u786e\u4fdd\u670d\u52a1\u8fd0\u884c\u6b63\u5e38\u3002</p> <pre><code>sudo systemctl restart telegraf\nsudo systemctl status telegraf\n</code></pre> <p>Tip</p> <p>\u5efa\u8bae\u5728\u88ab\u76d1\u63a7\u673a\u5668\u4e0a\u914d\u7f6e NTP\uff08\u53ef\u4ee5\u4f7f\u7528 <code>systemd-timesyncd</code>\uff0c\u8bbe\u7f6e NTP \u670d\u52a1\u5668\u4e3a time.ustc.edu.cn\uff09\uff0c\u4ee5\u907f\u514d\u65f6\u95f4\u4e0d\u540c\u6b65\u53ef\u80fd\u5e26\u6765\u7684\u95ee\u9898\u3002</p>"},{"location":"infrastructure/monitor/#web","title":"Web","text":"<p>Web \u7aef\u76d1\u63a7\u4f4d\u4e8e https://monitor.ustclug.org\uff0c\u8d26\u53f7\u7cfb\u7edf\u4f7f\u7528 LDAP\uff0c\u53ef\u4ee5\u5728\u8fd9\u91cc\u8bbe\u7f6e\u9884\u8b66\u63d0\u793a\u7b49\u3002</p> <p>Warning</p> <p>\u914d\u7f6e InfluxDB \u6570\u636e\u6e90\u65f6\uff0c\u53ea\u80fd\u4f7f\u7528\u53ea\u8bfb\u8d26\u53f7\uff0c\u5426\u5219\u4f1a\u5e26\u6765\u4e25\u91cd\u7684\u5b89\u5168\u95ee\u9898\u3002</p>"},{"location":"infrastructure/monitor/#_2","title":"\u66f4\u65b0\u8bb0\u5f55","text":""},{"location":"infrastructure/monitor/#unified-alerting","title":"\u8fc1\u79fb\u5230 Unified Alerting","text":"<p>Grafana 11 \u8d77\u5c06\u5b8c\u5168\u5220\u9664\u65e7\u7684\u62a5\u8b66\u7cfb\u7edf\uff0c\u5168\u9762\u4f7f\u7528\u65b0\u7684\uff08\u96be\u7528\u7684\uff09Unified Alerting\u3002</p> <p>\u5916\u5356\u539f\u5148\u8fd0\u884c\u7684\u662f Grafana 9.3.8\uff0c\u6839\u636e\u66f4\u65b0\u8bb0\u5f55\uff0c\u53d1\u73b0 v10.4 \u63d0\u4f9b\u4e86\u4e00\u4e2a\u8fc1\u79fb\u5de5\u5177\uff0c\u53ef\u4ee5\u5c06\u539f\u5148\u7684\u62a5\u8b66\u8fc1\u79fb\u5230\u65b0\u7684 Unified Alerting \u7cfb\u7edf\uff0c\u56e0\u6b64\u5148\u5c06 Grafana \u66f4\u65b0\u5230 10.4.3\uff0c\u51c6\u5907\u8fc1\u79fb\u3002</p> <p></p> <p>\u5728 Alerting (legacy) \u83dc\u5355\u4e0b\u6709\u4e2a Upgrade rules \u754c\u9762\uff0c\u70b9\u8fdb\u53bb\u5c31\u53ef\u4ee5\u4f7f\u7528\u8fc1\u79fb\u5411\u5bfc\u3002\u9996\u5148\u8fc1\u79fb\u6211\u4eec\u552f\u4e00\u7684\u4e00\u4e2a Notification Channel\uff0c\u53d8\u6210\u4e00\u4e2a Contact Point\u3002\u7531\u4e8e  \u5783\u573e\u7684\u65b0 alerting \u65b9\u6848\u6ca1\u6709\u63d0\u4f9b\u9ed8\u8ba4\u7684\u6d88\u606f\u6a21\u677f\uff0c\u56e0\u6b64\u6211\u4eec\u9700\u8981\u81ea\u5df1\u5199\u4e00\u4e2a\uff08\u6587\u6863\u4e5f\u6666\u6da9\u96be\u61c2\uff09\u3002</p> Notification template <code>telegram.message</code> <pre><code>{{ define \"alert_list\" -}}\n{{ range . }}[{{ .Labels.alertname }}] {{ .Annotations.description }}\n{{ if or (gt (len .GeneratorURL) 0) (gt (len .SilenceURL) 0) (gt (len .DashboardURL) 0) (gt (len .PanelURL) 0) }}|{{- end }}\n{{- if gt (len .GeneratorURL) 0 }} &lt;a href=\"{{ .GeneratorURL }}\"&gt;Source&lt;/a&gt; | {{- end }}\n{{- if gt (len .SilenceURL) 0 }} &lt;a href=\"{{ .SilenceURL }}\"&gt;Silence&lt;/a&gt; | {{- end }}\n{{- if gt (len .DashboardURL) 0 }} &lt;a href=\"{{ .DashboardURL }}\"&gt;Dashboard&lt;/a&gt; | {{- end }}\n{{- if gt (len .PanelURL) 0 }} &lt;a href=\"{{ .PanelURL }}\"&gt;Panel&lt;/a&gt; | {{- end }}\n{{ end }}\n{{ end }}\n\n{{- define \"telegram.message\" }}\n{{- if gt (len .Alerts.Firing) 0 }}&lt;strong&gt;Firing&lt;/strong&gt;\n{{ template \"alert_list\" .Alerts.Firing }}\n{{ if gt (len .Alerts.Resolved) 0 }}\n{{ end }}\n{{- end }}\n\n{{- if gt (len .Alerts.Resolved) 0 }}&lt;strong&gt;Resolved&lt;/strong&gt;\n{{ template \"alert_list\" .Alerts.Resolved }}\n{{ end }}\n{{- end }}\n</code></pre> <p>\u7136\u540e\u56de\u5230 Contact point \u7f16\u8f91\uff0c\u5c55\u5f00 Optional Telegram settings\uff0c\u5728 Message \u4e2d\u586b\u5165 <code>{{ template \"telegram. Message\" . }}</code> \u6765\u5f15\u7528\u6211\u4eec\u521a\u521a\u5199\u7684\u6a21\u677f\uff0c\u5e76\u5c06 Parse mode \u8bbe\u4e3a HTML\u3002</p> <p>\u63a5\u4e0b\u6765\u56de\u5230\u8fc1\u79fb Alerting \u7684\u5730\u65b9\uff0c\u9010\u4e2a\u8fc1\u79fb Alerting\uff1a</p> <ul> <li>\u70b9\u51fb\u53f3\u8fb9\u7684\u52a0\u53f7\uff0c\u7136\u540e\u70b9\u51fb New alert rule \u4e0b\u9762\u5bf9\u5e94\u7684\u65b0 rule\uff0c\u8fdb\u5165\u7f16\u8f91\u754c\u9762\uff08\u5982\u56fe\uff09\u3002</li> <li>\u68c0\u67e5\u8868\u8fbe\u5f0f A\uff08\u5e94\u8be5\u662f\u4e00\u4e2a InfluxDB query\uff09\uff0c\u786e\u4fdd\u5185\u5bb9\u6b63\u5e38\uff08\u4e00\u822c\u4e0d\u9700\u8981\u4fee\u6539\uff09\u3002<ul> <li>\u53ef\u9009\uff1a\u5c06 query \u7684 Min interval \u8bbe\u7f6e\u4e3a 10s \u6216\u66f4\u957f\u3002</li> </ul> </li> <li>\u89c2\u5bdf\u8868\u8fbe\u5f0f B\uff08\u5e94\u8be5\u662f\u4e00\u4e2a Classic condition\uff09\u7684\u5185\u5bb9\u548c\u53c2\u6570\uff08\u4e00\u822c\u662f <code>avg()</code> \u548c\u4e00\u4e2a\u6570\u503c\uff09\uff0c\u7136\u540e\u628a\u5b83\u5220\u6389</li> <li>\u65b0\u5efa B \u4e3a\u4e00\u4e2a Reduce\uff0c\u9009\u62e9 Input = A\uff0cFunction = Mean\uff08\u6216\u8005 Last\uff0c\u770b\u4e0a\u9762\u539f\u6765\u7684\u51fd\u6570\uff09\uff0cMode \u5927\u591a\u6570\u65f6\u5019\u9700\u8981\u6539\u6210 Drop Non-numeric Values\u3002</li> <li>\u65b0\u5efa C \u4e3a\u4e00\u4e2a Threshold\uff0c\u9009\u62e9 Input = B\uff0c\u5176\u4ed6\u7ee7\u7eed\u53c2\u8003\u539f\u6765\u7684\u8bbe\u7f6e\u3002</li> <li>\u5c06 C \"Set as alert condition\"\uff0c\u5982\u56fe</li> <li>\u5728\u4e0b\u9762\u7684 Evaluation behavior \u4e2d\u628a Folder \u548c Evaluation group \u90fd\u6362\u6210\u9ed8\u8ba4\u503c\uff0c\u5220\u6389\u90a3\u4e2a\u5947\u602a\u7684 label</li> <li>\u5728 Description \u4e2d\u586b\u5165\u4e00\u4e2a\u5408\u9002\u7684\u6a21\u677f\uff08\u89c1\u4e0b\uff09\uff0c\u7136\u540e\u5220\u6389\u90a3\u4e2a\u7a7a\u7684 Custom annotation\uff0c\u4fdd\u5b58\u5373\u53ef</li> </ul> Description \u6a21\u677f <p>\u5728 Go template \u4e2d\u53ef\u7528\u7684\u5e2e\u52a9\u51fd\u6570\u53c2\u89c1 https://grafana.com/docs/grafana/latest/alerting/alerting-rules/templating-labels-annotations/\u3002</p> <pre><code>{{ index $labels \"host\" }}: {{ humanize (index $values \"B\").Value }}\n\n{{ index $labels \"host\" }}: {{ humanizePercentage (index $values \"D\").Value }}\n\n{{ index $labels \"host\" }}: {{ humanizeDuration (index $values \"B\").Value }}\n</code></pre> <p>\u5176\u4e2d <code>index $labels</code> \u540e\u9762\u7684\u53c2\u6570\u53ef\u4ee5\u662f\u524d\u9762 InfluxDB query \u4e2d GROUP BY \u7684 tag\uff0c\u53ef\u4ee5\u7075\u6d3b\u4f7f\u7528\u3002</p> <p>\u624b\u5de5\u5904\u7406\u5b8c\u5168\u90e8 18 \u4e2a alert rules \u4e4b\u540e\uff08\u7d2f\u6b7b\u6211\u4e86\uff09\uff0c\u5c31\u53ef\u4ee5\u5f00\u59cb\u6d4b\u8bd5\u4e86\u3002</p> <p>\u5148\u542f\u7528\u65b0\u7684 unified alerting\uff1a</p> /srv/docker/grafana/conf/grafana.ini<pre><code>[alerting]\nenabled = false\n\n[unified_alerting]\nenabled = true\n\n[unified_alerting.screenshots]\ncapture = true\n</code></pre> <p>\u7136\u540e\u627e\u4e2a\u673a\u5668\u91cd\u542f\u4e00\u4e0b\uff0c\u89e6\u53d1 Reboot alert\uff0c\u53bb Telegram \u7fa4\u91cc\u770b\u6d88\u606f\u548c\u56fe\u7247\u90fd\u6b63\u786e\u5192\u51fa\u6765\u4e86\uff0c\u5c31\u8bf4\u660e\u8fc1\u79fb\u6210\u529f\u4e86\u3002</p> <p>Test alert \u4e0d\u4f1a\u89e6\u53d1\u622a\u56fe\uff0c\u5373\u4f7f\u8bbe\u7f6e\u4e86 Link dashboard and panel \u4e5f\u6ca1\u7528</p>"},{"location":"infrastructure/office/","title":"Office 365","text":""},{"location":"infrastructure/office/#application","title":"\u7533\u8bf7\u65b9\u5f0f","text":"<p>\u7406\u8bba\u4e0a\u4efb\u4f55\u793e\u56e2\u8d1f\u8d23\u4eba\u6216\u8005\u5728\u793e\u56e2\u4e2d\u8d1f\u8d23\u91cd\u8981\u9879\u76ee\u7684\u4eba\u5458\u90fd\u53ef\u4ee5\u7533\u8bf7\uff0c\u539f\u5219\u662f\u6309\u9700\u5206\u914d\uff0c\u56e0\u4e3a\u90ae\u7bb1\u662f\u5de5\u4f5c\u5de5\u5177\uff0c\u800c\u4e0d\u662f\u798f\u5229\u8d44\u6e90\u3002</p> <p>\u540c\u7406\uff0c\u4e0d\u518d\u62c5\u4efb\u8d1f\u8d23\u4eba\u4e14\u4e0d\u518d\u5904\u7406\u4e8b\u52a1\u7684\u540c\u5b66\u4f7f\u7528\u7684\u90ae\u7bb1\u5e94\u8be5\u6536\u56de\uff08\u89c1\u4e0b\u65b9 \u9ed8\u8ba4\u5730\u5740 \u4e00\u8282\uff09\u3002</p>"},{"location":"infrastructure/office/#email-etiquette","title":"\u90ae\u4ef6\u793c\u4eea","text":"<p>CC\uff08\u6284\u9001\uff09\u548c\u8bbe\u7f6e\u56de\u590d\u5730\u5740\u7684\u76ee\u7684\u90fd\u662f\u4e3a\u4e86\u8ba9\u6240\u6709 LUG \u8d1f\u8d23\u7684\u540c\u5b66\u53ef\u4ee5\u770b\u5230\u4e8b\u4ef6\u6700\u65b0\u7684\u8fdb\u5c55</p> <p>\u6284\u9001\u4f1a\u628a\u4f60\u53d1\u7684\u90ae\u4ef6\u7ed9\u6240\u6709\u7684\u8d1f\u8d23\u4eba\uff1b\u56de\u590d\u5730\u5740\uff08Reply-To\uff09\u8bbe\u7f6e\u4e4b\u540e\uff0c\u5bf9\u65b9\u5c31\u77e5\u9053\u8fd9\u662f\u4f60\u4ee3\u8868 LUG \u5199\u7684\u90ae\u4ef6\uff0c\u5e76\u4e14\u9ed8\u8ba4\u56de\u590d\u90ae\u4ef6\u7684\u65f6\u5019\u5730\u5740\u5c31\u662f\u6240\u6709\u8d1f\u8d23\u4eba\u7684\u90ae\u4ef6\u5217\u8868\u3002\u6240\u4ee5\u4e0b\u6587\u4e2d\u8981\u6c42\u8bbe\u7f6e\u8fd9\u4e9b\u5185\u5bb9\u3002</p> <p>\u5982\u679c\u9047\u5230\u9700\u8981\u4ee5\u79c1\u4eba\u8eab\u4efd\uff0c\u6216\u8005\u4ee5\u5176\u4ed6\u975e LUG \u4ee3\u8868\u8d1f\u8d23\u4eba\u7684\u8eab\u4efd\u56de\u590d\u90ae\u4ef6\u7684\u573a\u5408\uff0c\u8bf7\u4fee\u6539\u56de\u590d\u5730\u5740\u4fe1\u606f\u3002\u56e0\u4e3a Outlook \u7f51\u9875\u7248\u4e0d\u4fbf\u4e8e\u4fee\u6539\u8fd9\u4e9b\u5185\u5bb9\uff0c\u5efa\u8bae\u4f7f\u7528\u90ae\u4ef6\u5ba2\u6237\u7aef\u5904\u7406\u3002\uff08\u4e2a\u4eba\u63a8\u8350 ThunderBird\uff09\u3002</p> <p>\u5bf9\u4e8e\u9700\u8981\u5411\u975e\u90ae\u4ef6\u5217\u8868\u7684\u4e0d\u7279\u5b9a\u7fa4\u4f53\u7fa4\u53d1\u7684\u90ae\u4ef6\uff08\u4f8b\u5982\u901a\u77e5\u7c7b\u6d88\u606f\uff09\uff0c\u8bf7\u6ce8\u610f\u4e0d\u8981\u5c06\u6240\u6709\u90ae\u7bb1\u90fd\u653e\u5728\u6536\u4ef6\u4eba\u91cc\uff0c\u5426\u5219\u6240\u6709\u6536\u5230\u90ae\u4ef6\u7684\u4eba\u90fd\u80fd\u770b\u5230\u5176\u4ed6\u6536\u4ef6\u4eba\u7684\u90ae\u7bb1\uff08\u9690\u79c1\u95ee\u9898\uff09\uff1b\u5e76\u4e14\u6536\u4ef6\u4eba\u5982\u679c\u56de\u590d\u90ae\u4ef6\u4e0d\u5f53\uff0c\u5176\u4ed6\u7684\u6536\u4ef6\u4eba\u4e5f\u4f1a\u6536\u5230\u5176\u56de\u590d\u3002\u4e00\u79cd\u65b9\u4fbf\u7684\u505a\u6cd5\u662f\uff1a\u5c06\u6240\u6709\u9700\u8981\u6536\u5230\u901a\u77e5\u7684\u6536\u4ef6\u4eba\u653e\u5728\u5bc6\u9001 (BCC)\u4e00\u680f\u4e2d\uff0c\u6536\u4ef6\u4eba\u586b\u5199\u539f\u6284\u9001\u5730\u5740\u3002</p> <p>\u6211\u4eec\u52a0\u5165\u4e86\u5f88\u591a\u90ae\u4ef6\u5217\u8868\uff0c\u5176\u4e2d\u7ecf\u5e38\u6709\u5404\u79cd\u5f80\u6765\u90ae\u4ef6\uff08\u7279\u522b\u662f CentOS mirror announcement \u8fd9\u4e2a\u5217\u8868\uff0c\u5df2\u9000\uff09\uff0c\u5b83\u4eec\u5927\u591a\u6570\u4e0d\u9700\u8981\u6211\u4eec\u7406\u4f1a\u3002</p> <p>\u603b\u4e4b\uff0c\u4e0d\u77e5\u9053\u600e\u4e48\u5904\u7406\u7684\u90ae\u4ef6\u4e0d\u8981\u8d38\u7136\u56de\u590d\u3002\u5982\u679c\u4f60\u8ba4\u4e3a\u67d0\u4e00\u5c01\u90ae\u4ef6\u9700\u8981\u6211\u4eec\u5904\u7406\u4f46\u4e0d\u77e5\u9053\u600e\u4e48\u5904\u7406\uff0c\u8bf7\u8f6c\u544a\u7ed9\u5176\u4ed6\u76f8\u5173\u540c\u5b66\u3002</p> <p>\u4ee5\u4e0b\u5185\u5bb9\u4ece Hypercube \u7f16\u5199\u7684\u5185\u5bb9\u4e2d\u622a\u53d6\uff1a</p> <p>\u56de\u590d\u4efb\u4f55\u90ae\u4ef6\u65f6\uff0c\u8bf7\u6284\u9001 / CC\uff08\u4e0d\u662f\u5bc6\u9001 / BCC\uff09\u7ed9\u539f\u90ae\u4ef6\u7684\u6536\u4ef6\u5730\u5740\uff01\uff08\u6bd4\u5982\u522b\u4eba\u53d1\u5230 <code>lug A ustc.edu.cn</code>\uff0c\u56de\u590d\u65f6\u4e5f\u8bf7 CC \u5230 <code>lug A ustc.edu.cn</code>\uff09</p> <p>\u8bf7\u4e0d\u8981\u201c\u53ea\u56de\u590d\u90ae\u4ef6\u201d\u3002\u5982\u679c\u5728\u56de\u590d\u4e2d\u8bf4\u201c\u6211\u4eec\u4f1a\u505a\u67d0\u67d0\u4e8b\u201d\uff0c\u8bf7\u6ce8\u610f\u9664\u975e\u4f60\u660e\u786e\u8f6c\u4ea4\u7ed9\u4e86\u522b\u4eba\uff0c\u8fd9\u4ef6\u4e8b\u5e94\u5f53\u7531\u4f60\u6765\u5b8c\u6210\u3002</p>"},{"location":"infrastructure/office/#email-signature","title":"\u90ae\u4ef6\u7b7e\u540d","text":"<p>Outlook \u65e0\u6cd5\u76f4\u63a5\u901a\u8fc7\u7f51\u9875\u7aef\u6dfb\u52a0\u53d1\u4ef6\u4eba\u540d\u79f0\u3001\u8bbe\u7f6e\u56de\u590d\u5730\u5740\uff0c\u56e0\u6b64\u53ea\u80fd\u901a\u8fc7\u90ae\u4ef6\u5ba2\u6237\u7aef\u8fdb\u884c\u4f7f\u7528\u3002\u5728\u4e0b\u4e00\u7ae0\u8282\u7684 Thunderbird \u4e2d\u8fdb\u884c\u8be6\u7ec6\u9610\u8ff0\u3002</p>"},{"location":"infrastructure/office/#thunderbird","title":"Thunderbird \u914d\u7f6e","text":""},{"location":"infrastructure/office/#tb-login","title":"\u767b\u5f55","text":"<p>\u5728\u767b\u5f55\u65f6\uff0c\u8f93\u5165\u4e86\u7528\u6237\u540d\u3001\u5bc6\u7801\u540e\uff0c\u4f1a\u663e\u793a\u65e0\u6cd5\u627e\u5230\u5bf9\u5e94\u7684\u90ae\u7bb1\u914d\u7f6e</p> <p></p> <p>\u8fdb\u884c\u5982\u4e0b\u7684\u624b\u52a8\u914d\u7f6e\uff1a</p> <ul> <li>Incoming Server<ul> <li>Hostname: <code>outlook.office365.com</code></li> <li>Port: 993</li> <li>Connection security: SSL/TLS</li> <li>Authentication: Autodetect</li> </ul> </li> <li>Outgoing server<ul> <li>Hostname: <code>smtp.office365.com</code></li> <li>Port: 587</li> <li>Connection security: STARTTLS</li> <li>Authentication: Autodetect</li> </ul> </li> </ul> <p>\u5982\u4e0b\u56fe\uff1a</p> <p></p> <p>\u7136\u540e\u70b9\u5de6\u4e0b\u89d2\u7684 Re-test\uff0c\u91cd\u65b0\u641c\u7d22\u5230\u914d\u7f6e\u540e\uff0c\u5728\u4e24\u4e2a Authentication method \u4e2d\u5747\u9009\u62e9 OAuth2\u3002</p> <p></p> <p>\u7136\u540e\u70b9 Done\u3002\u5728\u5f39\u51fa\u7684\u7a97\u53e3\u4e2d\u5b8c\u6210\u8ba4\u8bc1\u3002</p>"},{"location":"infrastructure/office/#tb-signature","title":"\u7b7e\u540d\u4e0e\u53d1\u4ef6\u8eab\u4efd","text":"<p>\u5728\u53f3\u4e0a\u89d2\u4e2d\u9009\u62e9\u8d26\u6237\u8bbe\u7f6e\uff0c\u5728\u9ed8\u8ba4\u8eab\u4efd\u4e2d</p> <ul> <li>\u4fee\u6539 Your Name (\u60a8\u7684\u59d3\u540d) \u4e3a <code>Zeyu Gao on behalf of USTC LUG</code>\uff08\u8bf7\u6362\u6210\u81ea\u5df1\u7684\u540d\u5b57\uff09</li> <li>\u4fee\u6539 Reply-to Address (\u56de\u590d\u5730\u5740) \u4e3a <code>lug@ustc.edu.cn</code></li> <li> <p>\u4fee\u6539 Signature text (\u7b7e\u540d\u6587\u5b57) \u4e3a\uff08\u6700\u540e\u4e00\u884c\u6362\u6210\u81ea\u5df1\u7684\u4fe1\u606f\uff09</p> <pre><code>Linux User Group\nUniversity of Science and Technology of China\nHomepage: https://lug.ustc.edu.cn/\nE-Mail: lug@ustc.edu.cn\nZeyu Gao (\u9ad8\u6cfd\u8c6b) &lt;zeyugao@ustclug.org&gt;\n</code></pre> </li> </ul> <p>\u7ed3\u679c\u5982\u56fe\uff1a</p> <p></p>"},{"location":"infrastructure/office/#tb-cc","title":"\u6284\u9001\u8bbe\u7f6e","text":"<p>\u5728\u8d26\u6237\u8bbe\u7f6e\u4e2d\uff0c\u9009\u62e9\u8eab\u4efd\u7ba1\u7406\uff0c\u70b9\u51fb\u7f16\u8f91\uff0c\u9009\u62e9 Copies and Folders, \u542f\u7528 Cc these email addresses, \u5e76\u8f93\u5165\u9ed8\u8ba4\u6284\u9001\u5730\u5740 <code>lug A ustc.edu.cn</code></p> <p></p>"},{"location":"infrastructure/office/#html","title":"HTML\u4e0e\u7eaf\u6587\u672c","text":"<p>\u90ae\u4ef6\u53ef\u4ee5\u4ee5 HTML \u65b9\u5f0f\u7f16\u5199\uff0c\u4e5f\u53ef\u4ee5\u53ea\u662f\u7eaf\u6587\u672c\u5185\u5bb9\u3002\u4e3a\u4e86\u964d\u4f4e\u5bf9\u65b9\u9605\u8bfb\u51fa\u73b0\u9ebb\u70e6\u7684\u53ef\u80fd\u6027\uff0c\u5efa\u8bae\u4f7f\u7528\u7eaf\u6587\u672c\u6d88\u606f\u3002\u4f7f\u7528\u7eaf\u6587\u672c\u6d88\u606f\u7684\u65b9\u6cd5\u662f\uff1a\u6253\u5f00 Thunderbird \u8bbe\u7f6e \uff0c\u6253\u5f00 Account Settings \uff0c\u6253\u5f00\u5bf9\u5e94\u90ae\u4ef6\u5730\u5740\u4e0b\u7684 Composition &amp; Addressing \u9875\u9762\uff0c\u5728 Composition \u8282\u4e0b\u627e\u5230 Compose messages in HTML format \uff0c\u5c06\u5176\u590d\u9009\u6846\u53bb\u9664\u52fe\u9009\u5373\u53ef\u3002</p> <p></p>"},{"location":"infrastructure/office/#tb-folders","title":"\u6587\u4ef6\u5939","text":"<p>Thunderbird \u7ef4\u62a4\u4e86\u81ea\u5df1\u7684\u6587\u4ef6\u5939\uff0c\u5982\u679c\u9700\u8981\u4e0e\u4e91\u7aef\u7684\u6587\u4ef6\u5939\u540c\u6b65\uff0c\u53ef\u4ee5\u8fdb\u884c\u5982\u4e0b\u64cd\u4f5c</p> <p>\u5728\u8d26\u6237\u4e0a\u53f3\u952e\uff0c\u5728\u5f39\u51fa\u7684\u83dc\u5355\u4e2d\u70b9\u51fb Subscribe\u3002\u5f39\u51fa\u7684\u7a97\u53e3\u4e2d\u5305\u542b\u4e86\u4e91\u7aef\u7684\u6587\u4ef6\u5939\uff0c\u7531\u4e8e Thunderbird \u4f1a\u81ea\u884c\u7ef4\u62a4\u5783\u573e\u7bb1\u548c\u5df2\u53d1\u90ae\u4ef6\uff0c\u56e0\u6b64\u53ef\u80fd\u4f1a\u6709\u4e24\u4e2a\u5783\u573e\u7bb1\uff0cDeleted Items \u548c Trash\uff0c\u53ef\u4ee5\u5728\u7f51\u9875\u7aef\u5220\u9664\u4e0d\u9700\u8981\u7684\u6587\u4ef6\u5939\uff0c\u5e76\u5728 Thunderbird \u4e2d\u9009\u62e9\u9700\u8981\u7684\u3002</p> <p></p> <p>\u7136\u540e\u6253\u5f00\u8d26\u6237\u8bbe\u7f6e\uff0c\u8fdb\u884c\u5982\u4e0b\u4fee\u6539</p> <ol> <li> <p>\u5728 Server Settings \u4e0b\uff0c\u4fee\u6539 When I delete a message \u4e3a Move it to this folder: Deleted Items</p> <p></p> </li> <li> <p>\u5728 Copies &amp; Folders \u4e0b\uff0c\u4fee\u6539 Place a copy\u3001Keep message archives in\u3001Keep draft messages in \u4e3a\u5bf9\u5e94\u7684\u8fdc\u7aef\u670d\u52a1\u5668\u6587\u4ef6\u5939</p> <p></p> </li> </ol>"},{"location":"infrastructure/office/#tb-junk","title":"\u5783\u573e\u90ae\u4ef6","text":"<p>Outlook \u4e91\u7aef\u5df2\u7ecf\u5e26\u6709\u4e86\u5783\u573e\u90ae\u4ef6\u5206\u7c7b\u529f\u80fd\uff0c\u4e0d\u9700\u8981 Thunderbird \u81ea\u5df1\u7684\u5783\u573e\u90ae\u4ef6\u5206\u7c7b\u529f\u80fd\u3002</p> <p>\u5728\u8d26\u6237\u8bbe\u7f6e\u7684 Local Folders \u4e0b\u7684 Junk Settings \u4e2d\uff0c\u53d6\u6d88\u9009\u4e2d Enable adaptive junk mail controls for this account\u3002</p> <p>\u8bf7\u5728\u4e0a\u9762\u7684 Subscribe \u4e2d\u5c06\u5783\u573e\u90ae\u4ef6\u9009\u4e2d\u4ee5\u540c\u6b65\u3002\u6b64\u5916\uff0c\u7531\u4e8e Outlook \u76ee\u524d\u4f1a\u5c06\u51e0\u4e4e\u6240\u6709\u90ae\u4ef6\u90fd\u6254\u8fdb\u5783\u573e\u90ae\u4ef6\u7bb1\uff08\u539f\u56e0\u4f3c\u4e4e\u662f M365 \u7684\u673a\u5668\u5b66\u4e60\u6a21\u578b\u4f1a\u628a\u6240\u6709\u79d1\u5927\u7684\u90ae\u4ef6\u6254\u8fdb\u5783\u573e\u7bb1\uff09\uff0c\u56e0\u6b64\u8bbe\u7f6e\u62c9\u53d6\u90ae\u4ef6\u65f6\u603b\u662f\u68c0\u67e5\u5783\u573e\u90ae\u4ef6\u7bb1\u3002\u8bbe\u7f6e\u65b9\u6cd5\u4e3a\u5728\u5783\u573e\u90ae\u4ef6\u76ee\u5f55\u4e0a\u70b9\u51fb\u53f3\u952e \u2192 \u5c5e\u6027\uff0c\u7136\u540e\u9009\u62e9\u8fd9\u91cc\u7b2c\u4e8c\u4e2a\u52fe\uff1a</p> <p></p> <p>\u6ce8\u610f</p> <p>\u4e0d\u8981\u67e5\u770b\u5783\u573e\u90ae\u4ef6\u7684\u8fdc\u7a0b\u5185\u5bb9\u3002\u4e0d\u8981\u56de\u590d\u5783\u573e\u90ae\u4ef6\u3002\u6b63\u5e38\u90ae\u4ef6\u9700\u8981\u624b\u52a8\u79fb\u52a8\u5230\u6536\u4ef6\u7bb1\u3002</p>"},{"location":"infrastructure/office/#tb-profiles","title":"\u4f7f\u7528 Thunderbird \u914d\u7f6e\u4e0d\u540c\u7684\u8eab\u4efd","text":"<p>(written by taoky)</p> <p>\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u9700\u8981\u8bbe\u7f6e\u65b0\u7684\u53d1\u4ef6\u4eba\u540d\u79f0\u548c\u56de\u590d\u5730\u5740\uff08\u4f8b\u5982 hackergame staff \u9700\u8981\u4e00\u5957\u4e0d\u540c\u7684\u8bbe\u7f6e\uff09\u3002\u7531\u4e8e Gmail \u7f51\u9875\u7aef\u4fee\u6539\u914d\u7f6e\u5f88\u9ebb\u70e6\uff08\u800c\u4e14\u5f88\u5bb9\u6613\u5fd8\u8bb0\u6539\u56de\u6765\uff09\uff0c\u5f3a\u70c8\u5efa\u8bae\u4f7f\u7528\u90ae\u4ef6\u5ba2\u6237\u7aef\u3002\u4e2a\u4eba\u4f7f\u7528\u7684\u662f Thunderbird\uff0c\u4e0b\u9762\u4e5f\u4ee5\u5b83\u4e3a\u4f8b\u5b50\u3002</p> <p>\u5728\u8d26\u53f7\u52a0\u4e0a\u90ae\u7bb1\u4e4b\u540e\uff0c\u70b9\u51fb\u53f3\u952e \u2192 \u5c5e\u6027\uff0c\u9ed8\u8ba4\u914d\u7f6e\uff08LUG Staff\uff09\u5982\u56fe\uff1a</p> <p></p> <p>\u9700\u8981\u6dfb\u52a0\u65b0\u8eab\u4efd\u65f6\uff0c\u70b9\u51fb\u53f3\u4e0b\u89d2\u300c\u7ba1\u7406\u6807\u8bc6\u300d\uff0c\u6dfb\u52a0\u5bf9\u5e94\u7684\u6807\u8bc6\u3002\u5bf9\u4e8e hackergame\uff0c\u53ef\u4ee5\u914d\u7f6e\u5982\u4e0b\uff1a</p> <p></p> <p>\u5e76\u53c2\u8003\u6284\u9001\u8bbe\u7f6e \u914d\u7f6e\u9ed8\u8ba4\u6284\u9001\u5730\u5740 (<code>hackergame A ustclug.org</code>)</p> <p>\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u5728\u7f16\u5199\u90ae\u4ef6\u65f6\uff0c\u5c31\u53ef\u4ee5\u9009\u62e9\u65b0\u7684\u6807\u8bc6\u4e86\uff0c\u5e76\u4e14\u53d1\u4ef6\u4eba\u540d\u79f0\u3001\u56de\u590d\u5730\u5740\u548c\u7b7e\u540d\u90fd\u4f1a\u81ea\u52a8\u8bbe\u7f6e\u597d\u3002</p> \u4f7f\u7528 Thunderbird \u914d\u7f6e\u5b66\u6821\u90ae\u7bb1\u9700\u8981\u7684\u989d\u5916\u8bbe\u7f6e <p>james: \"thunderbird\u67d0\u6b21\u5347\u7ea7\u540e\u51fa\u4e86\u4e00\u4e2abug\uff0c\u8fde\u63a5\u65f6\u670d\u52a1\u5668\u8fd4\u56de\u652f\u6301utf8\uff0ctb\u53d1\u4e86\u4e00\u4e2a\u547d\u4ee4enable utf8\uff0c\u670d\u52a1\u5668\u6b63\u5e38\u8fd4\u56de\u540e\uff0ctb\u6709bug\u8ba4\u4e3a\u4e00\u76f4\u5728\u7b49\u670d\u52a1\u5668\u5e94\u7b54\u3002\"</p> <p>\u6240\u4ee5\u5982\u679c\u9700\u8981\u4f7f\u7528 Thunderbird \u4ece mail.ustc.edu.cn \u6536\u53d1\u90ae\u4ef6\uff0c\u9700\u8981\u505a\u4ee5\u4e0b\u7684\u914d\u7f6e\uff1aEdit -&gt; Settings\uff0c\u5728 \"General\" \u4e2d\u62d6\u5230\u6700\u4e0b\u9762\u9009\u62e9 \"Config Editor...\"\u3002\u5728\u65b0\u5f39\u51fa\u7684\u9ad8\u7ea7\u914d\u7f6e\u7684\u6807\u7b7e\u4e2d\u8f93\u5165 utf8\uff0c\u5c06 <code>mail.server.default.allow_utf8_accept</code> \u7684\u503c\u4ece true \u6539\u6210 false\u3002\u8fd9\u4e2a\u8bbe\u7f6e\u4e0d\u4f1a\u5f71\u54cd\u5176\u4ed6\u90ae\u7bb1\u7684\u4f7f\u7528\u3002</p>"},{"location":"infrastructure/office/#gmail","title":"Gmail","text":"<p>Warning</p> <p>\u7531\u4e8e Google \u5c06 G Suite \u5168\u9762\u8f6c\u5411\u4ed8\u8d39\u670d\u52a1\uff0c\u6211\u4eec\u5df2\u5728 2022 \u5e74 3 \u6708 31 \u65e5\u540e\u505c\u6b62\u4f7f\u7528 G Suite \u76f8\u5173\u670d\u52a1\u3002\u8f6c\u5411 Office 365 \u63d0\u4f9b\u7684\u670d\u52a1\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u4e3a\u5b58\u6863\u4e0e\u53c2\u8003</p> <p>\u4ee5\u4e0b\u539f\u6587\u7531 Hypercube \u7f16\u5199</p> <p>\u5927\u5bb6\u597d\uff0c</p> <p>\u8bf7\u5404\u4f4d\u9605\u8bfb\u4e0b\u65b9\u5185\u5bb9\uff0c\u5e76\u6309\u6307\u793a\u914d\u7f6e\u81ea\u5df1\u7684\u90ae\u7bb1\uff1a</p> <p>\u767b\u5f55\u7f51\u9875\u7248 Gmail\uff0c\u5728\u53f3\u4e0a\u89d2\u70b9\u5f00\u8bbe\u7f6e\uff0c\u4e8e\u201c\u5e38\u89c4\u201d\u6807\u7b7e\u9875\u4e2d\u8bbe\u7f6e\u201c\u7b7e\u540d\u201d\u4e3a\u7eaf\u6587\u672c\u5982\u4e0b\u5185\u5bb9\uff08\u5171 5 \u884c\uff0c\u5c06\u6700\u540e\u4e00\u884c\u6362\u6210\u81ea\u5df1\u7684\u4fe1\u606f\uff09\uff1a</p> <p>Linux User Group University of Science and Technology of China Homepage: https://lug.ustc.edu.cn/ E-Mail: lug@ustc.edu.cn Zibo Wang (\u738b\u5b50\u535a) &lt;example@ustclug.org&gt;</p> <p>\u4e8e\u201c\u8d26\u53f7\u201d\u6807\u7b7e\u9875\u4e2d\u201c\u7528\u8fd9\u4e2a\u5730\u5740\u53d1\u9001\u90ae\u4ef6\u201d\u5185\u70b9\u201c\u4fee\u6539\u4fe1\u606f\u201d\uff0c\u5728\u5f39\u51fa\u7a97\u53e3\u4e2d\u8f93\u5165\u540d\u79f0\u201cZibo Wang on behalf of USTC LUG\u201d\uff08\u8bf7\u6362\u6210\u81ea\u5df1\u7684\u540d\u5b57\uff09\uff0c\u8f93\u5165\u56de\u590d\u5730\u5740\u201c<code>lug@ustc.edu.cn</code>\u201d\u3002</p> <p>\u8fd8\u53ef\u4ee5\u89c6\u81ea\u5df1\u9700\u8981\u5728\u201c\u8f6c\u53d1\u548c POP / IMAP\u201d\u6807\u7b7e\u9875\u4e2d\u914d\u7f6e\u81ea\u52a8\u8f6c\u53d1\uff0c\u4f46\u8bf7\u6ce8\u610f\uff0c\u5982\u679c\u4f60\u914d\u7f6e\u4e86\u8f6c\u53d1\u5230\u81ea\u5df1\u7684\u5e38\u7528\u90ae\u7bb1\uff0c\u8bf7\u4e0d\u8981\u76f4\u63a5\u4ece\u5e38\u7528\u90ae\u7bb1\u56de\u590d\u90ae\u4ef6\uff0c\u800c\u5e94\u8be5\u767b\u5f55 LUG \u90ae\u7bb1\u56de\u590d\u3002 \u56de\u590d\u4efb\u4f55\u90ae\u4ef6\u65f6\uff0c\u8bf7\u6284\u9001 / CC\uff08\u4e0d\u662f\u5bc6\u9001 / BCC\uff09\u7ed9\u539f\u90ae\u4ef6\u7684\u6536\u4ef6\u5730\u5740\uff01\uff08\u6bd4\u5982\u522b\u4eba\u53d1\u5230 lug A ustc.edu.cn \uff0c\u56de\u590d\u65f6\u4e5f\u8bf7 CC \u5230 lug A ustc.edu.cn\uff09</p> <p>\u8bf7\u4e0d\u8981\u201c\u53ea\u56de\u590d\u90ae\u4ef6\u201d\u3002\u5982\u679c\u5728\u56de\u590d\u4e2d\u8bf4\u201c\u6211\u4eec\u4f1a\u505a\u67d0\u67d0\u4e8b\u201d\uff0c\u8bf7\u6ce8\u610f\u9664\u975e\u4f60\u660e\u786e\u8f6c\u4ea4\u7ed9\u4e86\u522b\u4eba\uff0c\u8fd9\u4ef6\u4e8b\u5e94\u5f53\u7531\u4f60\u6765\u5b8c\u6210\u3002</p> <p>\u5728\u6dfb\u52a0\u4e86\u7b7e\u540d\u540e\uff0c\u5728\u4e0b\u9762\u7684\u201c\u9ed8\u8ba4\u7b7e\u540d\u8bbe\u7f6e\u201d\u4e2d\uff0c\u5c06\u201c\u7528\u4e8e\u65b0\u7535\u5b50\u90ae\u4ef6\u201d\u4ee5\u53ca\u201c\u7528\u4e8e\u56de\u590d/\u8f6c\u53d1\u201d\u5747\u9009\u62e9\u4e3a\u4e0a\u9762\u6dfb\u52a0\u7684\u7b7e\u540d\u3002</p> <p>\u8bb0\u5f97\u6eda\u52a8\u5230\u9875\u9762\u6700\u4e0b\u65b9\u70b9\u51fb\u201c\u4fdd\u5b58\u9875\u9762\u201d\uff01</p>"},{"location":"infrastructure/office/#lug-ustc-mailing-list","title":"\u52a0\u5165 lug @ ustc \u5217\u8868","text":"<p>\u672c\u8282\u5199\u7684\u662f G Suite \u7528\u6cd5\uff0c\u9700\u8981\u66f4\u65b0\u6210 Office 365</p> <p>\u82e5\u8981\u6536\u5230\u53d1\u5f80 lug A ustc.edu.cn \u7684\u90ae\u4ef6\uff0c\u9700\u8981\u5728 \u7fa4\u7ec4\u7ba1\u7406 \u8fd9\u91cc\u5c06\u7528\u6237\u52a0\u5165 USTC LUG Staff \u7ec4\u3002\u8fd9\u4e2a\u7fa4\u7ec4\u5c31\u662f lug \u548c mirrors \u5728\u5b66\u6821\u90ae\u7bb1\u8bbe\u7f6e\u7684\u8f6c\u53d1\u76ee\u6807\u3002</p>"},{"location":"infrastructure/office/#default-route","title":"\u8bbe\u7f6e\u9ed8\u8ba4\u5730\u5740","text":"<p>\u672c\u8282\u5199\u7684\u662f G Suite \u7528\u6cd5\uff0c\u9700\u8981\u66f4\u65b0\u6210 Office 365</p> <p>G Suite \u652f\u6301\u5c06\u5355\u4e2a\u5730\u5740\u8bbe\u4e3a\u201c\u9ed8\u8ba4\u5730\u5740\u201d\uff0c\u7528\u4e8e\u63a5\u53d7\u53d1\u5f80\u4e0d\u5b58\u5728\u7684\u5730\u5740\u7684\u90ae\u4ef6\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1ahttps://support.google.com/a/answer/2368153</p> <p>\u5bf9\u4e8e\u4e2d\u6587\u754c\u9762\uff0c\u5e94\u8be5\u4ece Google Admin \u63a7\u5236\u53f0\u6309\u987a\u5e8f\u9009\u62e9 \u5e94\u7528 \u2192 G Suite \u2192 Gmail \u2192 \u9ad8\u7ea7\u8bbe\u7f6e\uff0c\u5176\u4e2d\u7684 \u65e0\u9650\u522b\u540d\u5730\u5740 \u5c31\u662f\u8fd9\u4e2a\u9009\u9879\uff0c\u4e00\u822c\u53d1\u7ed9\u4f1a\u957f\u6216 CTO\u3002</p>"},{"location":"infrastructure/raid/","title":"RAID","text":""},{"location":"infrastructure/raid/#megaraid","title":"MegaRAID \u5e38\u7528\u547d\u4ee4","text":"<p>MegaRAID \u6e90\u91cc\u6ca1\u6709\uff0c\u9700\u8981\u4ece\u5b98\u7f51\u4e0b\u8f7d RPM \u5305\u540e\u624b\u52a8\u89e3\u538b\u3002Debian 10 \u5b89\u88c5 libncurses5 \u540e\u53ef\u4f7f\u7528\u3002</p> <pre><code>sudo /opt/MegaRAID/MegaCli/MegaCli64 -adpallinfo -aAll  # \u67e5\u770b\u6240\u6709\u4fe1\u606f\nsudo /opt/MegaRAID/MegaCli/MegaCli64 -pdlist -aall  # \u67e5\u770b\u7269\u7406\u76d8\u4fe1\u606f\n</code></pre>"},{"location":"infrastructure/raid/#_1","title":"\u76d1\u63a7","text":"<p>\u73b0\u5728\u90e8\u7f72\u7684\u65b9\u6848\u662f\u7531 telegraf \u6267\u884c\u89e3\u6790\u811a\u672c\uff0c\u5c06\u6570\u636e\u53d1\u9001\u5230 influxdb\uff0c\u7531 grafana \u62a5\u8b66\u3002</p> <p>\u811a\u672c\uff1a</p> <ul> <li>\u89e3\u6790 megacli &amp; storcli https://github.com/taoky/raid-telegraf</li> <li>\u89e3\u6790 zpool https://github.com/taoky/telegraf-exec-zpool-status/releases</li> </ul>"},{"location":"infrastructure/raid/#esxi","title":"ESXi","text":"<p>https://docs.broadcom.com/docs-and-downloads/raid-controllers/raid-controllers-common-files/8-07-07_MegaCLI.zip</p> <p>ESXi 5 \u7684 binary \u548c ESXi 6.0 \u517c\u5bb9\u3002</p> <pre><code>esxcli software vib install -v=/tmp/vmware-esx-MegaCli-8.07.07.vib --no-sig-check\n</code></pre> <p>\u7136\u540e\u8fdb\u5165 <code>/opt/lsi/MegaCLI</code> \u76ee\u5f55\u6267\u884c <code>MegaCli</code>.</p>"},{"location":"infrastructure/raid/#ssacli-hpe-smart-array","title":"ssacli (HPE Smart Array)","text":"<p>pve-6 \u7684 RAID \u65b9\u6848\u662f HPE Smart Array\u3002\u5bf9\u5e94\u4f7f\u7528\u65b9\u6cd5\u53ef\u4ee5\u53c2\u8003 https://gist.github.com/mrpeardotnet/a9ce41da99936c0175600f484fa20d03\u3002</p> <p>\u5bf9\u5e94\u4e3b\u673a\u9700\u8981\u5b89\u88c5 https://downloads.linux.hpe.com/SDR/repo/mcp/Debian/pool/non-free/ssacli-5.30-6.0_amd64.deb\uff08HPE \u6e90\u5b9e\u5728\u592a\u6162\u4e86\uff09\u3002</p>"},{"location":"infrastructure/sshca/","title":"SSH Certificate Authentication","text":"<p>Discussion: SSH \u5347\u7ea7\u5230\u8bc1\u4e66\u767b\u9646\u65b9\u6848\u8ba8\u8bba</p> <p>Usage: SSH \u8bc1\u4e66\u8ba4\u8bc1\u7684\u4f7f\u7528\u65b9\u6cd5 (See also: iBug's blog)</p>"},{"location":"infrastructure/sshca/#introduction","title":"Introduction","text":"<p>An SSH Certificate Authority (CA) is a trusted key pair that issues certificates. It has the same format as a regular SSH private-public key pair (it is, in fact). </p> <p>Certificates can be used for authentication on both the server side and the client side. But certificates cannot issue new certificates (i.e. no chains), it is the very difference from X.509 certificate system.</p>"},{"location":"infrastructure/sshca/#server-setup","title":"Server setup","text":""},{"location":"infrastructure/sshca/#trustedusercakeys","title":"Configure server to accept client certificates","text":"<p>First drop our public key to <code>/etc/ssh/ssh_user_ca</code>:</p> /etc/ssh/ssh_user_ca<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Bxw9AXoZvc9HTe5o4f7/qOROcmzvlcO5oofoF3pewtRnhNpcd/DwmxSblqpj/cjLYkE32mSCzMYY8X0CRFyMJsgSIDC4i4LXDNU0e8PbB2NIQAAeyfJEU5m/Dn1tPw9WvPtPqHCRvgSwnRfzYngMVWROgV2Qe6pOqTTgetEYfb5gkDc2i1M7yfTp3H3ExfrDKwOKPc/9UYOADMFU6u1fJN+4epLETilHC1ubtBeVi23pn1K+LDy06Gwhq1MLljCM7gFBMrmv894HrOHU4WrzLUlfkiDt2cyXLb4qPWYqilBFLUjU92kjmiI/EwB/8pR1WmdU7FoYpdgBHNr3NT53 LUG-CA\n</code></pre> <p>Then add the following line to sshd config (Debian 11+):</p> /etc/ssh/sshd_config.d/ustclug.conf<pre><code>TrustedUserCAKeys /etc/ssh/ssh_user_ca\n</code></pre> <p>Old version config (&lt;= Debian 10)</p> <p>On Debian 10 (buster) or older, <code>sshd_config</code> does not support the <code>Include</code> directive. Thus any extra setting must be added in the main <code>sshd_config</code> file directly.</p>"},{"location":"infrastructure/sshca/#issue-a-server-certificate","title":"Issue a server certificate","text":"<p>Warning</p> <p>When signing certificates using OpenSSH &lt;= 8.1, add <code>-t rsa-sha2-512</code> to the <code>ssh-keygen</code> command. More details can be found here: https://ibug.io/p/35</p> <p>Note</p> <p>Some of our servers may still be running Debian Jessie, which has OpenSSH 6.7 that does not support SHA-2 certificate algorithms (OpenSSH 7.2 required). Sign with <code>-t ssh-rsa</code> instead if you want to log in to such servers.</p> <p>January 2022 update: We believe we have got rid of all Jessie systems, so this should no longer be the case. </p> <p>Copy the file <code>/etc/ssh/ssh_host_rsa_key.pub</code> from target server.</p> <p>Then, run <code>ssh-keygen</code> to issue a public key. For example:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca \\\n           -I blog \\\n           -h \\\n           -n blog.s.ustclug.org,blog.p.ustclug.org,10.254.0.15,202.141.176.98,202.141.160.98 \\\n           ssh_host_rsa_key.pub\n</code></pre> <p>Then, copy the certificate file <code>ssh_host_rsa_key-cert.pub</code> back to target server.</p> <p>At last, add the following lines to sshd config:</p> /etc/ssh/sshd_config.d/ustclug.conf<pre><code>HostKey /etc/ssh/ssh_host_rsa_key\nHostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub\n</code></pre> <p>Warning</p> <p>See the same warning block above.</p> <p>Certificate will take effect after SSH daemon is reloaded (<code>systemctl reload ssh</code>).</p>"},{"location":"infrastructure/sshca/#client-setup","title":"Client setup","text":"<p>Add the following line to your <code>known_hosts</code>:</p> ~/.ssh/known_hosts<pre><code>@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Bxw9AXoZvc9HTe5o4f7/qOROcmzvlcO5oofoF3pewtRnhNpcd/DwmxSblqpj/cjLYkE32mSCzMYY8X0CRFyMJsgSIDC4i4LXDNU0e8PbB2NIQAAeyfJEU5m/Dn1tPw9WvPtPqHCRvgSwnRfzYngMVWROgV2Qe6pOqTTgetEYfb5gkDc2i1M7yfTp3H3ExfrDKwOKPc/9UYOADMFU6u1fJN+4epLETilHC1ubtBeVi23pn1K+LDy06Gwhq1MLljCM7gFBMrmv894HrOHU4WrzLUlfkiDt2cyXLb4qPWYqilBFLUjU92kjmiI/EwB/8pR1WmdU7FoYpdgBHNr3NT53 LUG-CA\n</code></pre> <p>And when you log in to a LUG server, it is automatically trusted. If you find a machine that does not support this setup, report it to CTO.</p>"},{"location":"infrastructure/sshca/#issue-a-client-certificate","title":"Issue a client certificate","text":"<pre><code>ssh-keygen -s /path/to/ssh_ca \\\n           -I certificate_identity \\\n           -n principals \\\n          [-O options] \\\n          [-V validity_interval] \\\n           public_key_file\n</code></pre> <p>For example:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca -I \"Yifan Gao\" -n yifan -V -5m:+365d yifan.pub\n</code></pre> <p>In general, certificate_identity is the user's full name, and principals is the system username. The certificate identity is used to identify certificates and is logged in system logs. In addition, one certificate can carry multiply principals, like:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca -I \"Yifan Gao\" -n yifan,root,liims -V -5m:+365d yifan.pub\n</code></pre> <p>It authorizes the certificate owner to login to any server as <code>yifan</code>, <code>root</code> or <code>liims</code> user.</p> <p>Note</p> <p>The <code>liims</code> principal is used to log into library inquiry machines.</p> <p>Tip</p> <p>The validity interval by default starts at the current system time. Using <code>-5m:+365d</code> creates a certificate valid from 5 minutes ago to make up for offset times on other systems. Otherwise it's not much useful to have a validity period starting from a long time ago.</p> <p>For security purposes, avoid creating certificates without a defined validity period. It's also recommended to keep validity periods as short as necessary.</p>"},{"location":"infrastructure/ssl/","title":"SSL Certificates","text":"<p>Discussion: #224</p> <p>Our SSL certificates are automatically renewed on GitHub ustclug/ssl-cert ( Private).</p> <p>We delegate the subdomain <code>ssl-digitalocean.ustclug.org</code> to DigitalOcean DNS hosting, and use acme.sh DNS alias mode to issue certificates. For this to work, we have the following CNAME records in place:</p> <pre><code>_acme-challenge.lug.ustc.edu.cn    -&gt;  lug.ssl-digitalocean.ustclug.org\n_acme-challenge.ustclug.org        -&gt;  lug.ssl-digitalocean.ustclug.org\n_acme-challenge.proxy.ustclug.org  -&gt;  lug.ssl-digitalocean.ustclug.org\n\n_acme-challenge.vpn.lug.ustc.edu.cn  -&gt;  lugvpn.ssl-digitalocean.ustclug.org\n_acme-challenge.vpn.ustclug.org      -&gt;  lugvpn.ssl-digitalocean.ustclug.org\n\n_acme-challenge.mirrors.ustc.edu.cn  -&gt;  mirrors.ssl-digitalocean.ustclug.org\n</code></pre> <p>Individual machines that use SSL certificates should pull from the said repository (branch <code>cert</code>). Certificates may be loaded via symbolic links (for processes running on the host system directly), or copied around from within the updater script (when there are path constraints, e.g. in a Docker container). The update task is managed by cron.</p> <p>Update script for reference:</p> /etc/ssl/private/.git/update.sh<pre><code>#!/bin/sh\n\ncd \"/etc/ssl/private\"\n\ngit fetch -q\nif [ \"$(git rev-parse HEAD)\" = \"$(git rev-parse '@{u}')\" ]; then\n  exit 0\nfi\ngit reset --hard '@{u}'\n\n# Display certificate dates. This section is optional\nif command -v openssl &gt;/dev/null 2&gt;&amp;1; then\n  echo \"Cert has been updated. New expiry:\"\n  for f in */cert.pem; do\n    echo \"$f:\"\n    openssl x509 -in \"$f\" -noout -dates\n  done\nelse\n  echo \"Cert has been updated.\"\nfi\n\nsystemctl reload openresty.service\n# Other `cp -a` or `docker restart` commands, etc.\n</code></pre> <p>The DigitalOcean account we use is owned by iBug and has nothing else running.</p> <p>Plan B</p> <p>Hurricane Electric provides hosted DNS zones for free, which is also supported by <code>acme.sh</code>. This makes HE DNS a feasible alternative should our current dependency (DigitalOcean) fails.</p>"},{"location":"infrastructure/ssl/#exceptions","title":"Exceptions","text":"<p>PXE manages its own certificates with <code>acme.sh</code> and validates via HTTP-01 challenge. The certificates are stored in <code>/etc/acme.sh/pxe.ustc.edu.cn/</code>.</p>"},{"location":"infrastructure/tinc/","title":"Tinc VPN \u914d\u7f6e\u8bf4\u660e","text":"<p>Tinc VPN \u662f LUG \u5185\u7f51\u7684\u4e3b\u8981\u6784\u6210\u8f6f\u4ef6\uff0cLDAP \u9700\u8981\u7528\u5230\u5b83\uff08\u56e0\u4e3a ldap \u670d\u52a1\u5668\u662f\u4e2a\u5185\u7f51\u670d\u52a1\u5668\uff09</p>"},{"location":"infrastructure/tinc/#_1","title":"\u5b89\u88c5","text":"<p>Debian 9+ \u53ef\u4ee5\u76f4\u63a5\u4ece apt \u6e90\u5b89\u88c5 <code>tinc</code> \u5305\u3002</p> <p>\u4e0d\u65e9\u8bf4\u8fd9\u73a9\u610f\u6709\u4e2a Git \u4ed3\u5e93\uff1f\uff1fhttps://git.lug.ustc.edu.cn/ustclug/tinc-configure</p> <p>\u65e2\u7136\u6709\u4ed3\u5e93\u6240\u4ee5\u8981\u505a\u7684\u4e8b\u60c5\u6bd4\u8f83\u7b80\u5355\uff0c\u8fdb\u5165 <code>/etc/tinc</code> \u76ee\u5f55\u51c6\u5907\u548c Git \u4ed3\u5e93\u540c\u6b65\u914d\u7f6e\uff1a</p> <pre><code>git init\ngit remote add origin https://git.lug.ustc.edu.cn/ustclug/tinc-configure.git\ngit fetch origin master\ngit reset --hard FETCH_HEAD\n</code></pre> <p>\u6ce8\u610f <code>git reset</code> \u4f1a\u8986\u76d6\u90e8\u5206\u6587\u4ef6\uff0c\u5efa\u8bae\u5728\u5168\u65b0\u5b89\u88c5 <code>tinc</code> \u4e4b\u540e\u8fdb\u884c\u540c\u6b65\u914d\u7f6e\u3002</p> <p>\u914d\u7f6e\u5b8c\u6210\u540e\u6267\u884c <code>systemctl enable tinc@ustclug.service</code> \u4f7f tinc \u80fd\u591f\u5f00\u673a\u542f\u52a8\u3002</p>"},{"location":"infrastructure/tinc/#_2","title":"\u52a0\u5165\u4e3b\u673a","text":"<p>\u9996\u5148\u9700\u8981\u5728\u65b0\u4e3b\u673a\u4e0a\u751f\u6210\u5bc6\u94a5\uff1a</p> <pre><code>tincd -n ustclug -K\n</code></pre> <p>\u7136\u540e\u5728 <code>/etc/tinc/ustclug/hosts/$HOST</code> \u6700\u540e\u8865\u4e0a\u4e00\u884c\uff1a</p> <pre><code>Address = [\u8fd9\u53f0\u673a\u5668\u7684\u516c\u7f51IP]\n</code></pre> <p>\u628a\u65b0\u589e\u7684\u8fd9\u4e2a\u6587\u4ef6\u63d0\u4ea4\u8fdb Git \u4ed3\u5e93\uff0c\u5e76\u5728 <code>{ldap,board,gateway-el,gateway-nic}.s.ustclug.org</code> \u7b49\u591a\u53f0\u673a\u5668\u4e0a\u901a\u8fc7 <code>git pull</code> \u66f4\u65b0\uff0c\u5e76 <code>systemctl reload tinc@ustclug.service</code>\u3002</p>"},{"location":"infrastructure/tinc/#ip","title":"\u5185\u7f51 IP","text":"<p>\u6d4b\u8bd5\u7684\u65f6\u5019\uff0c\u4f60\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7 <code>ifconfig</code> \u7b49\u65b9\u5f0f\u6307\u5b9a\u4e00\u4e2a\u4e34\u65f6\u7684 IP\uff0c\u6ce8\u610f\u4e0d\u8981\u4e0e\u5df2\u6709\u7684\u5185\u7f51 IP \u51b2\u7a81\uff1a</p> <pre><code>ifconfig 10.254.0.xxx/21 ustclug\n</code></pre> <p>\u8fd9\u65f6\u5019\u5e94\u8be5\u80fd\u4ece\u5176\u4ed6\u673a\u5668 ping \u901a\u8fd9\u4e2a IP\u3002</p> <p>\u6307\u5b9a\u9759\u6001\u5185\u7f51 IP \u7684\u6b63\u786e\u65b9\u6cd5\u662f\u5728 DNS \u4e2d\u6dfb\u52a0\u4e00\u6761\u8fd9\u6837\u7684\u8bb0\u5f55\uff1a</p> <pre><code>$ORIGIN s.ustclug.org\n&lt;HOST&gt;  600     IN A    &lt;Intranet IP&gt;\n</code></pre> <p>\u7136\u540e\u5728\u673a\u5668\u4e0a\u91cd\u542f <code>systemctl restart tinc@ustclug.service</code> \u5c31\u80fd\u81ea\u52a8\u83b7\u53d6\u4e86\u3002</p>"},{"location":"infrastructure/tinc/#ssh","title":"\u914d\u7f6e SSH \u4fa6\u542c\u5185\u7f51\u5730\u5740","text":"<p>Tip</p> <p>\u5bf9\u4e8e Debian 11+ \u7684\u7cfb\u7edf\uff0c\u5efa\u8bae\u4fdd\u6301 <code>sshd_config</code> \u4e0d\u52a8\uff0c\u5c06\u81ea\u5b9a\u4e49\u7684\u914d\u7f6e\u5199\u5165 <code>sshd_config.d/ustclug.conf</code>\uff0c\u4ee5\u51cf\u5c11\u66f4\u65b0 ssh \u8f6f\u4ef6\u5305\u65f6\u7684\u914d\u7f6e\u6587\u4ef6\u51b2\u7a81\u3002\u6ce8\u610f\u5982\u679c\u8fd9\u4e48\u505a\u7684\u8bdd\u9700\u8981\u628a\u914d\u7f6e\u6587\u4ef6\u91cc\u7684 <code>Subsystem sftp</code> \u5220\u6389\uff0c\u5426\u5219 sshd \u4f1a\u62a5\u9519\u201c\u91cd\u590d\u6307\u5b9a\u4e86 Subsystem sshd\u201d\u3002</p> <p>\u4ee5\u4e0b\u914d\u7f6e\u4f9b\u53c2\u8003\uff0c\u590d\u5236\u65f6\u6ce8\u610f\u4fee\u6539 <code>Match LocalAddress</code> \u540e\u9762\u7684\u5185\u5bb9\uff08\u5185\u7f51\u5730\u5740\u548c AllowGroups \u6700\u540e\u7684\u540d\u79f0\uff09\uff1a</p> /etc/ssh/sshd_config<pre><code>AddressFamily inet\nUseDNS no\n\nHostKey /etc/ssh/ssh_host_rsa_key\nHostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub\nTrustedUserCAKeys /etc/ssh/ssh_user_ca\nRevokedKeys /etc/ssh/ssh_revoked_keys\n\nPasswordAuthentication no\nPubkeyAuthentication no\nChallengeResponseAuthentication no\nUsePAM yes # LDAP for Debian\n\nAcceptEnv LANG LC_*\nX11Forwarding yes\nPrintLastLog no\nPrintMotd no\nSubsystem sftp /usr/lib/openssh/sftp-server\n\nMatch LocalAddress 10.254.0.0\n    AllowGroups ssh_local super_manager ssh_groupname\n    PasswordAuthentication yes\n    PubkeyAuthentication yes\n\n# Public IP access = root-only\nMatch LocalAddress 202.38.95.110,202.141.160.110,202.141.176.110,218.104.71.170\n    AllowUsers root\n    PubkeyAuthentication yes\n    AuthorizedKeysFile none  # \u5c4f\u853d\u516c\u94a5\uff0c\u4ec5\u5141\u8bb8\u8bc1\u4e66\u767b\u5f55\n\n# For SSH Push trigger\nMatch User mirror\n    AllowUsers mirror\n    AuthenticationMethods publickey\n    PermitTTY no\n    PermitTunnel no\n    X11Forwarding no\n\nMatch All #(1)\n</code></pre> <ol> <li>OpenSSH 6.5p1 \u4ee5\u4e0a\u53ef\u4ee5\u4f7f\u7528 <code>Match All</code> \u6765\u7ed3\u675f\u4e0a\u9762\u7684 Match \u5757\u3002\u7531\u4e8e <code>Include</code> \u6307\u4ee4\u51fa\u73b0\u5728 <code>/etc/ssh/sshd_config</code> \u7684\u6700\u4e0a\u9762\uff0c\u800c\u63a5\u4e0b\u6765\u7684\u5185\u5bb9\u90fd\u662f\u5168\u5c40\u8bbe\u7f6e\uff0c\u56e0\u6b64\u4f7f\u7528 <code>Match All</code> \u4fdd\u8bc1\u539f\u5148\u7684\u5185\u5bb9\u7ee7\u7eed\u4f5c\u7528\u4e8e\u5168\u5c40\uff0c\u800c\u4e0d\u662f\u50cf\u4e0a\u9762\u8fd9\u4e2a\u4f8b\u5b50\u4e00\u6837\u53d8\u6210 <code>Match User mirror</code> \u7684\u8bbe\u7f6e\u3002</li> </ol> <p>\u6ce8\u610f HostCertificate, TrustedUserCAKeys \u548c RevokedKeys \u8fd9\u4e09\u4e2a\u6587\u4ef6\u5fc5\u987b\u5b58\u5728\uff0c\u5426\u5219 SSH \u4f1a\u51fa\u4e00\u4e9b\u95ee\u9898\uff0c\u4f8b\u5982\u4e0d\u80fd\u5bc6\u94a5\u767b\u5f55\u53ea\u80fd\u5bc6\u7801\u767b\u5f55\u3002</p> <p>HostCertificate \u9700\u8981\u624b\u52a8\u7b7e\u53d1\u4e00\u4e2a\uff0c\u53e6\u5916\u4e24\u4e2a\u6587\u4ef6\u4ece\u522b\u7684\u673a\u5668\u4e0a\u590d\u5236\u5c31\u884c\u3002</p>"},{"location":"infrastructure/discontinued/","title":"\u4e0d\u518d\u4f7f\u7528\u7684\u57fa\u7840\u8bbe\u65bd","text":"<p>Warning</p> <p>Content under this section is not necessarily up-to-date.</p>"},{"location":"infrastructure/discontinued/#saltstack","title":"SaltStack","text":"<p>\u76ee\u524d\u4e0d\u77e5 SaltStack \u4f55\u65f6\u5f00\u59cb\u4f7f\u7528\uff0c\u4f46\u662f\u6211\u4eec\u6ca1\u6709\u4efb\u4f55\u4f9d\u8d56\u4e8e salt \u7684\u914d\u7f6e\u3002\u51fa\u4e8e\u8003\u8651\u5230 salt \u51fa\u73b0\u8fc7\u975e\u5e38\u4e25\u91cd\u7684 CVE\uff0csaltstack \u5df2\u4e0d\u518d\u8003\u8651\u4f7f\u7528\uff0c\u4e14\u5728\u5df2\u77e5\u7684\u673a\u5668\u4e0a\u90fd\u5df2\u5220\u9664\u3002\u5982\u679c\u4f60\u53d1\u73b0\u67d0\u53f0 lug \u7684\u673a\u5668\u4e0a\u5b89\u88c5\u4e86 salt\uff0c\u8bf7\u901a\u77e5 CTO \u4ee5\u5c06\u5176\u5220\u9664\u3002</p> <p>\u5728\u81ea\u52a8\u5316\u8fd0\u7ef4\u65b9\u9762\uff0c\u672a\u6765\u4f1a\u8c03\u7814 ansible\u3002</p>"},{"location":"infrastructure/discontinued/#vsphere","title":"vSphere \u96c6\u7fa4","text":"<p>\u6211\u4eec\u4ece 2015 \u5e74\uff08\u6216\u66f4\u65e9\uff09\u5f00\u59cb\u4f7f\u7528 vSphere \u5e73\u53f0\uff08ESXi + vCenter\uff09\u8fd0\u884c\u865a\u62df\u673a\u3002\u7531\u4e8e VMware \u4e13\u6709\u5e73\u53f0\u7684\u590d\u6742\u6027\u96be\u4ee5\u7ef4\u62a4\uff0c\u6211\u4eec\u5df2\u4e8e 2022 \u5e74 1 \u6708\u5168\u9762\u8fc1\u79fb\u81f3\u5f00\u6e90\u7684\u3001\u57fa\u4e8e Debian GNU/Linux \u7684\u865a\u62df\u5316\u5e73\u53f0 Proxmox VE\u3002</p>"},{"location":"infrastructure/discontinued/#pve-2-pve-4","title":"pve-2, pve-4","text":"<p>pve-2 \u548c pve-4 \u4e5f\u4f4d\u4e8e\u4e1c\u56fe\uff0c\u662f\u4e24\u53f0\u672a\u77e5\u54c1\u724c\u3001\u672a\u77e5\u578b\u53f7\u7684\u65e7\u673a\u5668\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5420 (Very old 4C4T, 2.50 GHz), 16 GB \u5185\u5b58\uff08DDR2 667 MHz\uff09\u548c\u4e00\u5757 16 GB \u7684 SanDisk SSD\u3002\u8be5\u578b\u53f7\u673a\u5668\u6ca1\u6709 IPMI\u3002</p> <p>\u7531\u4e8e\u914d\u7f6e\u4f4e\u4e0b\uff0c\u6211\u4eec\u624b\u52a8\u5b89\u88c5\u4e86 Proxmox VE\uff0c\u6ca1\u6709\u4f7f\u7528 LVM\uff0c\u5206\u914d\u4e86 1 GB \u7684 swap\uff0c\u5269\u4e0b\u5168\u90e8\u7ed9 rootfs\u3002</p> <p>\u673a\u5668\u7684\u7f51\u5361\u6709\u4e24\u4e2a 1 Gbps \u7684\u63a5\u53e3\uff0c\u4e0e pve-6 \u76f8\u540c\uff0c\u90fd\u63a5\u5728\u540c\u4e00\u4e2a\u4ea4\u6362\u673a\u4e0a\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/","title":"ESXi","text":"<p>\u73b0\u5f79\u7684 ESXi \u6709 3 \u53f0\uff1aesxi-2 \u548c esxi-6 \u4f4d\u4e8e\u4e1c\u56fe\u673a\u623f\uff0cesxi-5 \u4f4d\u4e8e\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u673a\u623f\u3002</p> <p>esxi-2 \u4e0a\u8fd0\u884c\u4e1c\u56fe\u7f51\u5173\u7b49\u670d\u52a1\uff0cesxi-6 \u4e0a\u8fd0\u884c ustclug gitlab\u3002esxi-5 \u4e0a\u8fd0\u884c\u8bf8\u5982 vcenter, \u90ae\u4ef6\u7f51\u5173, ldap, \u5907\u7528\u7f51\u5173, vSphereDataProtection \u5907\u4efd\u670d\u52a1\u7b49\u3002</p> <p>\u76ee\u524d\uff0c\u6709\u8ba1\u5212\u5c06\u865a\u62df\u5316\u65b9\u6848\u66f4\u6539\u4e3a Proxmox Virtual Environment\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/#about-snapshot","title":"\u5173\u4e8e\u5feb\u7167","text":"<p>Best practices: https://kb.vmware.com/s/article/1025279\uff0c\u7ba1\u7406\u865a\u62df\u673a\u524d\u52a1\u5fc5\u9605\u8bfb\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/#_1","title":"\u673a\u5668\u914d\u7f6e\u7ec6\u8282","text":""},{"location":"infrastructure/discontinued/vsphere/esxi/#esxi-5","title":"esxi-5","text":"<p>esxi-5 \u4e0a\u4e8e 2021/8 \u53d1\u73b0\u81ea\u5e26\u9635\u5217\u6709\u4e24\u5757\u574f\u76d8\uff0c\u5728\u66f4\u6362\u540e\u53d1\u73b0 storage \"root\"\uff08\u5b58\u653e vcenter \u865a\u62df\u673a\uff0c\u7ec4 RAID 1 \u540e\u5927\u5c0f 1.8TB\uff09\u65e0\u6cd5\u6b63\u5e38 rebuild\uff0c\u5e76\u4e14 vcenter \u865a\u62df\u673a\u7684 vmdk \u6587\u4ef6\u6709 4 \u4e2a\u51fa\u73b0 I/O error\u3002\u76ee\u524d vcenter \u865a\u62df\u673a\u5df2\u7ecf\u8fc1\u79fb\u5230 storage \"data\" (RAID10, 7.2 TB)\uff0c\u5de5\u4f5c\u6b63\u5e38\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/vcenter/","title":"vCenter","text":"<p>vCenter \u4e3a\u7ef4\u62a4\u4eba\u5458\u63d0\u4f9b\u4e86\u65b9\u4fbf\u7684\u7ba1\u7406\u6240\u6709 ESXi \u670d\u52a1\u5668\u7684\u754c\u9762\u3002\u9700\u8981\u6ce8\u610f\uff1a</p> <ul> <li>HTML5 \u7248\u53ef\u4ee5\u5b8c\u6210\u5927\u591a\u6570\u4efb\u52a1\uff0c\u4f46\u662f\u8bf8\u5982\u914d\u7f6e\u8b66\u62a5\uff08\u53ef\u914d\u7f6e\u90ae\u4ef6\u8b66\u544a\uff09\u3001\u67e5\u770b VDP \u5907\u4efd\u60c5\u51b5\u7b49\u9700\u8981 Flash \u7248\u672c\u3002</li> <li>\u5982\u679c\u67d0\u4e2a\u540c\u5b66\u53ea\u6709\u7ba1\u7406\u67d0\u4e2a\u865a\u62df\u673a\u7684\u9700\u6c42\uff0c\u5efa\u8bae\u65b0\u5efa\u8d26\u6237\uff0c\u5355\u72ec\u914d\u7f6e\u6743\u9650\u3002</li> <li>vCenter \u672c\u8eab\u4e5f\u662f\u4e00\u4e2a\u865a\u62df\u673a\uff0c\u76ee\u524d\u8fd0\u884c\u5728 esxi-5 \u4e0a\u3002</li> </ul>"},{"location":"infrastructure/discontinued/vsphere/vcenter/#patch","title":"\u5b89\u88c5 patch","text":"<p>\u5f53\u51fa\u73b0\u4e25\u91cd\u7684 CVE \u4e14\u65e0\u6cd5\u7b80\u5355 workaround \u65f6\uff0c\u5efa\u8bae\u5b89\u88c5 patch\uff0c\u5927\u81f4\u65b9\u6cd5\uff1a</p> <ol> <li>\u6253\u5feb\u7167\uff0c\u6700\u597d\u80fd\u624b\u52a8\u5907\u4efd\u4e00\u4e0b\u3002</li> <li>\u524d\u5f80 https://my.vmware.com/group/vmware/patch \u4e0b\u8f7d\u6700\u65b0\u7248 patch ISO \u6587\u4ef6\uff08\u5206\u7c7b\u4e3a VC\uff0c\u9700\u8981\u6ce8\u518c\u514d\u8d39\u8d26\u53f7\uff09\uff1b</li> <li>\u4e0a\u4f20 ISO \u6587\u4ef6\u5230 esxi-5 \u67d0\u4e2a datastore \u4e2d\uff0c\u5c06 ISO \u6302\u8f7d\u5230 VMware vCenter Server Appliance \u865a\u62df\u673a\u4e2d\uff1b</li> <li>\u767b\u5f55 esxi-5 \u7ba1\u7406\u754c\u9762\uff08\u4e0d\u662f vcenter \u754c\u9762\uff0c\u56e0\u4e3a\u66f4\u65b0\u7684\u65f6\u5019 vcenter \u4f1a\u4e0b\u7ebf\uff09\uff0c\u8fdb\u5165 vcenter console\u3002</li> <li><code>software-packages stage --iso</code> \u52a0\u8f7d\u8865\u4e01\u6587\u4ef6\uff08\u5b9e\u8d28\u662f\u4e00\u5806 rpm\uff09\u3002</li> <li><code>software-packages install --iso</code> \u5b89\u88c5\u8865\u4e01\u6587\u4ef6\u3002</li> <li><code>shell</code> \u8fdb\u5165 bash\uff0c<code>reboot</code> \u91cd\u542f\u3002</li> <li>\u91cd\u542f\u540e\u5982\u679c\u8fdb\u5165 5480 \u7aef\u53e3\u53d1\u73b0\u670d\u52a1\u72b6\u6001\u4e3a\u672a\u77e5\uff0c\u624b\u52a8\u91cd\u542f\u6240\u6709\u670d\u52a1\uff1a<code>service-control --start --all</code></li> <li>\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\uff08\u6bd4\u8f83\u957f\uff09\uff0c\u671f\u95f4\u53ef\u80fd 503/\u663e\u793a\u670d\u52a1\u6b63\u5728\u52a0\u8f7d\u4e2d\uff0c\u7b49\u7b49\uff0c\u4e4b\u540e\u5c31\u5e94\u8be5\u6b63\u5e38\u4e86\u3002</li> <li>\u522b\u5fd8\u4e86\u624b\u52a8\u5907\u4efd\u3002</li> </ol> <p>\u5347\u7ea7\u65f6\u9047\u5230\u7684\u95ee\u9898\uff1a</p> <ol> <li>\u65e0\u6cd5\u8bc6\u522b ISO \u4e3a\u66f4\u65b0\u7684\u7248\u672c\uff1ahttps://kb.vmware.com/s/article/59659?lang=zh_CN</li> <li>\u300c\u73af\u5883\u5c1a\u672a\u51c6\u5907\u597d\u66f4\u65b0\u300d\uff1a\u4f7f\u7528 console \u7684 <code>software-packages</code> \u66f4\u65b0\uff0c\u67e5\u770b\u539f\u56e0\u3002\u5982\u679c\u662f root \u5bc6\u7801\u8fc7\u671f\uff0c\u8fdb\u5165 bash\uff0c\u4f7f\u7528 passwd \u5148\u91cd\u7f6e\u6210\u65b0\u7684\uff08\u7136\u540e\u518d\u6539\u56de\u6765\uff09\uff0c\u4f7f\u7528 <code>chage -I -1 -m 0 -M 99999 -E -1 root</code> \u8bbe\u7f6e\u6c38\u4e0d\u8fc7\u671f\u3002</li> </ol>"},{"location":"infrastructure/discontinued/vsphere/vdp/","title":"VDP","text":"<p>\u5f53\u6211\u4eec\u8bf4\u5230 VDP \u7684\u65f6\u5019\uff0c\u6211\u4eec\u5230\u5e95\u5728\u6307\u4ec0\u4e48\uff1f\u4e3a\u4e86\u907f\u514d\u6b67\u4e49\uff0c\u4ee5\u4e0b\u505a\u4e86\u4e00\u4e9b\u5b9a\u4e49\uff1a</p> <ul> <li>vdp -&gt; \u7279\u6307\u4f4d\u4e8e\u4e1c\u56fe\u7684 NFS \u670d\u52a1\u5668\u3002</li> <li>vdp2 -&gt; \u7279\u6307\u4f4d\u4e8e\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u7684\u865a\u62df\u673a\u5907\u4efd\u9635\u5217\u3002</li> <li>vdp \u5907\u4efd\u7a0b\u5e8f\u3001vdp \u5907\u4efd\u865a\u62df\u673a\u3001vSphereDataProtection -&gt; \u7279\u6307\u8fd0\u884c\u5728 esxi-5 \u4e0a\u7684 vdp \u5907\u4efd\u670d\u52a1\u3002</li> </ul> <p>vdp2 \u6302\u63a5\u5728 esxi-5 \u4e0a\uff0cesxi-5 \u6e90\u4e8e\u8001 mirrors\uff08mirrors2 \u4e4b\u524d\u7684\u4e00\u4ee3\u673a\u5668\uff09\u3002vSphereDataProtection \u7248\u672c\u4e3a 6.1.5\u3002</p> <p>\u5f53 vdp \u5907\u4efd\u7a0b\u5e8f\u51fa\u73b0\u5947\u602a\u7684\u95ee\u9898\u7684\u65f6\u5019\uff0c\u91cd\u542f vdp \u5907\u4efd\u865a\u62df\u673a\u7edd\u5927\u591a\u6570\u65f6\u5019\u80fd\u591f\u89e3\u51b3\u95ee\u9898\u3002\u91cd\u542f\u8017\u65f6\u975e\u5e38\u957f\uff0c\u9700\u8981\u505a\u597d\u5fc3\u7406\u51c6\u5907\u3002</p> <p>\u5907\u4efd\u65f6\uff0cvdp \u5907\u4efd\u7a0b\u5e8f\u4f1a\u4e3a\u865a\u62df\u673a\u65b0\u5efa\u4e00\u4e2a snapshot\uff0c\u4e4b\u540e\u4ece snapshot \u4f20\u8f93\u5907\u4efd\u3002\u5076\u5c14 snapshot \u4e0d\u4f1a\u88ab\u6b63\u5e38\u5220\u9664\uff0c\u800c\u5927\u91cf\u6216\u957f\u65f6\u95f4\u5b58\u653e\u7684 snapshot \u4f1a\u7ed9\u6027\u80fd\u5e26\u6765\u8d1f\u9762\u5f71\u54cd\uff0c\u6240\u4ee5\u5982\u679c\u53d1\u73b0\u6b64\u7c7b\u60c5\u51b5\uff0c\u5728\u786e\u8ba4\u5907\u4efd\u4e0d\u518d\u8fdb\u884c\u540e\uff0c\u9700\u8981\u5220\u9664 snapshot\uff0c\u540c\u65f6\u4fdd\u6301\u673a\u5668\u5728\u7ebf\uff08\u5728\u5173\u673a\u60c5\u51b5\u4e0b\u6574\u5408\u78c1\u76d8\u65f6\u65e0\u6cd5\u5f00\u673a\uff01\uff09\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1ahttps://docs.vmware.com/en/VMware-vSphere/6.5/rn/data-protection-615-release-notes.html</p> <p>VDP \u5907\u4efd\u865a\u62df\u673a\u5df2\u7ecf EOL\u3002\u8bbf\u95ee vcenter \u4e2d\u7684 VDP \u63d2\u4ef6\u9700\u8981\u4f7f\u7528 Adobe Flash\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/vdp/#_1","title":"\u5907\u4efd\u8ba1\u5212","text":"<p>\u76ee\u524d\u7684\u5907\u4efd\u8ba1\u5212\u5982\u4e0b\uff1a</p> <ul> <li>\u4e1c\u56fe\u9664 gitlab \u4ee5\u5916\u7684\u865a\u62df\u673a\uff0cesxi-5 \u6d3b\u8dc3\u7684\u865a\u62df\u673a\uff0c\u4ee5\u53ca hackergame web \u865a\u62df\u673a\u6bcf\u65e5\u5907\u4efd\u4e00\u6b21\u3002</li> <li>gitlab \u548c vcenter \u6bcf\u5468\u5907\u4efd\u4e00\u6b21\u3002\uff08\u56e0\u4e3a\u5b83\u4eec\u592a\u5927\u4e86\uff09</li> </ul>"},{"location":"infrastructure/discontinued/vsphere/vdp/#_2","title":"\u9ad8\u7ea7\u547d\u4ee4","text":"<p>\u67e5\u770b\u5f53\u524d\u4efb\u52a1\uff1a</p> <pre><code># mccli activity show | grep Running\n</code></pre> <p>\u67e5\u770b\u670d\u52a1\u60c5\u51b5\uff1a</p> <pre><code># dpnctl status\n# status.dpn\n</code></pre>"},{"location":"infrastructure/discontinued/vsphere/vdp/#vspheredataprotection-on-virtio-scsi","title":"vSphereDataProtection on VirtIO SCSI","text":"<p>vdp \u7684\u64cd\u4f5c\u7cfb\u7edf\u662f SLES 11 SP3\uff0c\u8fd9\u4e2a\u64cd\u4f5c\u9700\u8981\u7cfb\u7edf\u76d8\u7684\u524d\u4e24\u4e2a\u5206\u533a\uff08<code>/boot</code> \u548c <code>/</code>\uff09\u3002</p> <ol> <li>\u53c2\u8003 https://www.suse.com/support/kb/doc/?id=000016530\uff0c\u89e3\u538b initrd \u5230\u67d0\u4e2a\u76ee\u5f55\u3002</li> <li>\u4ece rootfs \u7684 <code>/lib/modules/3.0.101-0.47.99-default/kernel/drivers/</code> \u91cc\u53d6\u51fa virtio \u7684\u5185\u6838\u6a21\u5757\uff08<code>block</code> \u91cc\u9762\u4e00\u4e2a\uff0c<code>virtio</code> \u6574\u4e2a\u76ee\u5f55\uff0c\u4ee5\u53ca <code>scsi</code> \u91cc\u9762\u4e00\u4e2a\uff09\uff0c\u653e\u5728 initrd \u89e3\u538b\u540e\u7684\u5bf9\u5e94\u4f4d\u7f6e\u3002</li> <li>rootfs \u7684 <code>/lib/modules/3.0.101-0.47.99-default/modules.dep*</code> \u590d\u5236\u5230 initrd \u91cc\u3002</li> <li>\u4fee\u6539 initrd \u91cc\u7684 <code>config/start.sh</code> \u548c <code>run_all.sh</code>\uff0c\u5728 <code>RESOLVED_INITRD_MODULES</code> \u53d8\u91cf\u4e2d\u6dfb\u52a0 <code>virtio_pci virtio virtio_scsi virtio_blk</code>\uff08\u5373\u4fee\u6539\u4e3a <code>RESOLVED_INITRD_MODULES='virtio_pci virtio virtio_scsi virtio_blk cifs ext2 ext3 ext4 fat nfs reiserfs ufs xfs'</code>\uff09\u3002</li> <li>\u53c2\u8003 https://www.suse.com/support/kb/doc/?id=000016530 \u91cd\u65b0\u6253\u5305\uff0c\u653e\u5728\u7b2c\u4e00\u4e2a\u5206\u533a (<code>/boot</code>) \u91cc\u9762\uff0c\u5efa\u8bae\u4e0d\u8981\u8986\u76d6\u539f\u6765\u7684 initrd\u3002</li> <li>\u4fee\u6539\u7b2c\u4e00\u4e2a\u5206\u533a\u91cc <code>grub/menu.lst</code>\uff0c\u5c06 initrd \u4fee\u6539\u4e3a\u4f60\u6240\u6253\u5305\u7684\u6587\u4ef6\u540d\u3002</li> </ol>"},{"location":"infrastructure/intranet/","title":"Servers Intranet","text":"<p>Servers Intranet connects all the servers together, including physical servers and virtual machines.</p>"},{"location":"infrastructure/intranet/#network-topology","title":"Network Topology","text":"<p>\u4ee5\u4e0a\u67b6\u6784\u56fe\u7531 iBug \u5728 2023 \u5e74 11 \u6708\u66f4\u65b0\u3002</p> \u6b64\u5904\u662f\u4e00\u4e9b\u8fc7\u65f6\u7684\u4fe1\u606f\uff0c\u4e5f\u8bb8\u8fd8\u6709\u70b9\u53c2\u8003\u4ef7\u503c <p>The network contains three parts:</p> <ul> <li>Physical Switch in East Library Data Center</li> <li>Virtual Switch on vSphere host machine</li> <li>tincVPN</li> </ul> <p>tincVPN is a mesh VPN, which can be abstracted as a virtual Switch.</p> <p>vm-nfs.s.ustclug.org runs a layer 2 bridge, connecting tincVPN and SRW2024 (physical switch).</p> <p>It is obvious that vm-nfs is a single point of failure of communicating between tinc host and vSphere virtual machine. I had tried to add another bridge node, but resulted in a broadcast storm. Maybe we can fix it by MPLS (merged in mainline kernel 4.3). But it isn't a right timing at this time.</p>"},{"location":"infrastructure/intranet/#network-information","title":"Network information","text":"<p>The network contains one single subnet: 10.254.0.0/21</p> <p>Every server and service binds to one and only one IP address, used to communicate with each other.</p>"},{"location":"infrastructure/intranet/#address-planning","title":"Address planning","text":"<ul> <li>10.254.0.0/24: Physical servers and virtual machines</li> <li>10.254.1.0/24: Docker containers</li> <li>10.254.6.0/24: LUGi emergency entrypoint (via vpnstv.s, managed by yzf)</li> <li>10.254.7.0/24: LUGi entrypoint (via board.s)</li> <li>Others: not used yet.</li> </ul>"},{"location":"infrastructure/intranet/gateway/","title":"Intranet Gateway","text":"<p>We run gateways in each colocation to provide internet access to intranet-only hosts (VMs and containers).</p> <p>When configuring VMs and containers, set their gateway according to their colocation:</p> <ul> <li>East Campus Library (EL): gateway-el (10.254.0.254)</li> <li>Network Information Center (NIC): gateway-nic (10.254.0.245)</li> </ul> <p>Gateway-JP is mainly used for HTTP reverse proxy, so that we can provide HTTP services in compliance with PRC regulations.</p> <p>For server configuration on each gateway, refer to their corresponding documentation:</p> <ul> <li>Gateway EL</li> <li>Gateway NIC</li> <li>Gateway JP</li> </ul>"},{"location":"infrastructure/intranet/gateway/#tinc-workaround-1","title":"Tinc \"received packet on ustclug with own address as source address\" workaround","text":"<p>After migrating to PVE, we found that sometimes tinc works abnormally within gateway-el and gateway-nic, with following kernel log:</p> <pre><code>bridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nnet_ratelimit: 2 callbacks suppressed\n</code></pre> <p>We still don't know the source of this issue. To workaround that, following self-check timer is deployed now:</p> /opt/tinc-check.sh<pre><code>#!/bin/bash\n\nrestart() {\n  systemctl stop tinc@ustclug.service\n  sleep 3  # avoid race condition\n  systemctl start tinc@ustclug.service\n  echo \"tinc restarted\"\n}\n\ndmesg | tail -n 2 | grep 'received packet on ustclug with own address as source address' &amp;&amp; restart ||  echo \"tinc OK now\";\n</code></pre> /etc/systemd/system/tinc-check.service<pre><code>[Unit]\nDescription=Tinc Check and Auto-Restart\n\n[Service]\nType=oneshot\nExecStart=/opt/tinc-check.sh\n</code></pre> /etc/systemd/system/tinc-check.timer<pre><code>[Unit]\nDescription=Tinc Check and Auto-Restart Timer\n\n[Timer]\nOnCalendar=minutely\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n</code></pre>"},{"location":"infrastructure/intranet/lugivpn/","title":"LUG Intranet VPN","text":"<p>service: intranet.ustclug.org</p> <p>server: board.s.ustclug.org</p>"},{"location":"infrastructure/intranet/lugivpn/#introduction","title":"Introduction","text":"<p>Server intranet is a closed network, which cannot be accessed from Internet. LUGI VPN helps maintainer get access to intranet temporarily.</p> <p>LUGI VPN is running in Banana Pi Raspberry Pi 3B+, the only ARM architecture device we owned. Using OpenVPN protocal, authorizing via LDAP.</p> <p>The original Banana Pi was down in April 2021.</p>"},{"location":"infrastructure/intranet/lugivpn/#configuration","title":"Configuration","text":"<p>OpenVPN LDAP auth plugin config <code>/etc/openvpn/auth-ldap.conf</code>:</p> <pre><code>&lt;LDAP&gt;\n    URL             ldaps://ldap.ustclug.org\n    Timeout         15\n    FollowReferrals yes\n    TLSCACertFile   /etc/ldap/ssl/slapd-ca-cert.pem\n&lt;/LDAP&gt;\n\n&lt;Authorization&gt;\n    BaseDN          \"ou=people,dc=lug,dc=ustc,dc=edu,dc=cn\"\n    SearchFilter    \"(uid=%u)\"\n    RequireGroup    false\n&lt;/Authorization&gt;\n</code></pre> <p>In openvpn configuration:</p> <pre><code>...\nplugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth-ldap.conf\n</code></pre> <p>Servers intranet is a layer 2 network without default gateway. So NAT is needed:</p> <pre><code>iptables -t nat -A POSTROUTING -s 10.254.248.0/22 -d 10.254.0.0/21 -j MASQUERADE\n</code></pre>"},{"location":"infrastructure/proxmox/nfs/","title":"NFS","text":"<p>NFS \u670d\u52a1\u5668\uff08\"vdp\"\uff09\u662f\u4e1c\u56fe\u4e09\u4e2a PVE \u673a\u5668\u7684\u865a\u62df\u673a\u5b58\u50a8\uff0c\u578b\u53f7\u4e3a DELL PowerEdge R510\u3002\u78c1\u76d8\u9635\u5217\u7531\u4e8e\u5728 2021 \u5e74 3 \u6708\u521d\u635f\u574f\uff0c\u76ee\u524d\u5bb9\u91cf\u7f29\u51cf\u5230 8T\uff084 \u5757 4T \u84dd\u76d8 RAID10\uff09\u3002\u9664\u865a\u62df\u673a\u5916\uff0cNFS \u4e5f\u5b58\u50a8 LUG \u6210\u5458\u7684\u4e2a\u4eba\u6570\u636e\u53ca LUG FTP\u3002NFS \u670d\u52a1\u6062\u590d\u540e\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u6570\u636e\u5197\u4f59\u6027\uff0c\u4f7f\u7528<sub>~\u79d1\u5927 Office 365 A1 \u8d26\u53f7</sub>~\u5b66\u6821\u5bf9\u8c61\u5b58\u50a8\u548c Rclone \u6bcf\u5929\u589e\u91cf\u5907\u4efd LUG FTP \u548c LUG \u6210\u5458\u7684\u516c\u5f00\u6570\u636e\u3002</p> <p>vdp \u7684\u5185\u7f51\u8fde\u63a5\u4f9d\u8d56\u4e8e gateway-el\u3002</p> <p>\u53ef\u80fd\u7684\u7f51\u7edc\u95ee\u9898</p> <p>\u5728 2021 \u5e74\u4e5d\u6708\u4efd\u4e1c\u56fe\u7684 ESXi \u4e0e NFS \u8fde\u63a5\u4f1a\u51fa\u73b0\u4e0d\u7a33\u5b9a\u7684\u95ee\u9898\uff0c\u539f\u56e0\u76ee\u524d\u4e0d\u660e\u3002\u5728\u8fde\u63a5\u65b9\u5f0f\u4ece NFS 4.1 \u66f4\u6362\u5230 NFS 3 \u4e4b\u540e\uff0c\u8fde\u63a5\u7684\u4e0d\u7a33\u5b9a\u4e0d\u4f1a\u5bfc\u81f4\u865a\u62df\u673a\u88ab\u5173\u95ed\u3002</p> <p>2021/09/29 \u66f4\u65b0\uff1a\u8fd9\u4e24\u5929\u518d\u6b21\u51fa\u73b0\u4e86\u4e25\u91cd\u7684\u8fde\u63a5\u95ee\u9898\u3002\u8c03\u8bd5\u540e\u53d1\u73b0 192.168.93.0/24 \u7684\u7f51\u5173 192.168.93.254 (Cisco \u8bbe\u5907) \u4e22\u5305\u4e25\u91cd\uff0c\u800c NFS \u7684\u51fa\u53e3 IP \u9519\u8bef\u88ab\u8bbe\u7f6e\u5230\u4e86\u4e0e\u56fe\u4e66\u9986\u4ea4\u6362\u673a\u76f8\u8fde\u63a5\u7684 eno1\uff0c\u5bfc\u81f4\u8bf7\u6c42\u9700\u8981\u7ed5\u8def\u3002\u5c06\u6b64 IP \u79fb\u52a8\u81f3 eno2\uff0c\u4fee\u6539 sysctl \u8bbe\u7f6e ARP \u8fc7\u6ee4\u5e76\u91cd\u542f\u540e\uff0c\u76ee\u524d\u6682\u65f6\u89e3\u51b3\u4e86\u95ee\u9898\u3002</p> <p>Debian Bookworm \u5185\u6838\u95ee\u9898</p> <p>6.1.x \u5f00\u59cb\u7684\u5185\u6838\u7684 NFSv4 \u670d\u52a1\u5668\u5b9e\u73b0\u53ef\u80fd\u5b58\u5728\u6f5c\u5728\u7684\u95ee\u9898\uff0c\u5bfc\u81f4\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u6b7b\u9501\uff0c\u89c1 https://lore.kernel.org/all/50d62fc9-206b-4dbc-9a9b-335450656fd0@aixigo.com/T/\u3002\u4ece Buster \u5347\u7ea7\u5230 Bookworm \u4e4b\u540e\u88ab\u5751\u4e86\u4e00\u6b21\u3002</p> <p>\u7531\u4e8e\u8fd9\u4e2a\u95ee\u9898\u76ee\u524d\u5c1a\u672a\u89e3\u51b3\uff0c\u5728\u5347\u7ea7 Bookworm \u4e4b\u540e vdp \u4ecd\u4f7f\u7528 Bullseye \u7684\u5185\u6838\uff085.10.x\uff09\u3002</p> /etc/apt/preferences.d/linux-image-amd64<pre><code>Package: linux-image-amd64\nPin: release n=bullseye-security\nPin-Priority: 900\n</code></pre> <p>\u6211\u4eec\u521b\u5efa\u4e86\u5982\u4e0a\u6587\u4ef6\uff08\u4ee5\u4fbf\u80fd\u591f\u7ee7\u7eed\u4ece bullseye-security \u83b7\u5f97\u5185\u6838\u7684\u5b89\u5168\u66f4\u65b0\uff09\uff0c\u7136\u540e\u624b\u52a8\u5220\u6389\u4e86\u6240\u6709 6.1 \u7684\u5185\u6838\u5305\u3002</p>"},{"location":"infrastructure/proxmox/nfs/#pve","title":"PVE \u78c1\u76d8\u8def\u5f84\u4e0e\u6302\u8f7d\u53c2\u6570","text":"<p>\u5728 storage.cfg \u8bbe\u7f6e\u4e2d\uff0cNFS \u6302\u8f7d\u5230 <code>/mnt/nfs-el</code>\uff0c\u8bbe\u7f6e\u7684\u53c2\u6570\u4e3a <code>soft,noexec,nosuid,nodev</code>\u3002\u8bbe\u7f6e\u4e3a <code>hard</code> \u4f1a\u5bfc\u81f4 NFS \u4e0b\u7ebf\u65f6\u91cd\u8bd5\u65e0\u9650\u6b21\uff0c\u5927\u6982\u7387\u5bfc\u81f4\u7cfb\u7edf\u5361\u6b7b\uff0c\u5176\u4ed6\u51e0\u4e2a\u53c2\u6570\u4e3b\u8981\u662f\u4e3a\u4e86\u5b89\u5168\u3002</p> <p>\u5176\u4e2d\uff0c\u6839\u636e PVE \u7684\u8981\u6c42\uff0c\u865a\u62df\u673a\u78c1\u76d8\u6587\u4ef6\u9700\u8981\u653e\u5728 <code>images/&lt;vmid&gt;</code> \u76ee\u5f55\u4e0b\u624d\u4f1a\u88ab\u81ea\u52a8\u68c0\u6d4b\u5230\u3002\u82e5\u4e00\u5f00\u59cb\u6ca1\u6709\u6309\u8981\u6c42\u653e\u7f6e\u6587\u4ef6\u6216\u6dfb\u52a0\u4e86\u65b0\u6587\u4ef6\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>qm rescan</code> \u626b\u63cf\u65b0\u7684\u78c1\u76d8\u6587\u4ef6\u3002\u4e5f\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528 <code>qm set</code> \u547d\u4ee4\u6216\u624b\u52a8\u7f16\u8f91\u865a\u62df\u673a\u914d\u7f6e\u6587\u4ef6\u6307\u5b9a\u78c1\u76d8\u6587\u4ef6\u7684\u8def\u5f84\uff0c\u8fd9\u4e24\u79cd\u65b9\u6cd5\u6ca1\u6709\u6b64\u9650\u5236\u3002</p> <p>\u53e6\u5916\uff0c\u7531\u4e8e\u6574\u4e2a storage.cfg \u6587\u4ef6\u5728\u96c6\u7fa4\u4e2d\u5171\u4eab\uff0c\u9700\u8981\u624b\u52a8\u6307\u5b9a <code>nodes</code> \u4ee5\u514d NIC \u7684\u4e24\u53f0 PVE \u4e3b\u673a\u5c1d\u8bd5\u6302\u8f7d\u3002</p> /etc/pve/storage.cfg<pre><code>nfs: nfs-el\n        export /media/vdp/pve\n        path /mnt/nfs-el\n        server nfs-el.vm.ustclug.org\n        options soft,noexec,nosuid,nodev\n        content iso,images\n        nodes pve-2,pve-4,pve-6\n        shared 1\n        prune-backups keep-all=1\n</code></pre> <p>storage.cfg \u7684\u5168\u90e8\u914d\u7f6e\u5185\u5bb9\u53ef\u4ee5\u53c2\u8003 https://pve.proxmox.com/wiki/Storage\u3002</p>"},{"location":"infrastructure/proxmox/pbs/","title":"Proxmox Backup Server (PBS)","text":"<p>PBS \u73b0\u5728\u90e8\u7f72\u5728 esxi-5 \u4e0a\u9762\uff0c\u7528\u4f5c\u865a\u62df\u673a\u5907\u4efd\uff0cweb \u754c\u9762\u7684\u7aef\u53e3\u53f7\u4e3a 8007\uff08HTTPS only\uff09\u3002</p> <p>Info</p> <p>\u672c\u9875\u9762\u8bb0\u5f55 Proxmox Backup Server \u8f6f\u4ef6\u76f8\u5173\uff0c\u4ee5\u53ca Proxmox VE \u865a\u62df\u673a\u76f8\u5173\u7684\u8d44\u6599\u3002\u5173\u4e8e esxi-5 \u7684\u7cfb\u7edf\u914d\u7f6e\u4fe1\u606f\u8bb0\u5f55\u5728 Proxmox VE \u9875\u9762\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs","title":"\u5b89\u88c5 PBS","text":"<p>PBS \u53ef\u4ee5\u4f7f\u7528\u5b89\u88c5\u5149\u76d8 iso \u5b89\u88c5\u6216\u76f4\u63a5\u52a0\u88c5\u5728\u73b0\u6709\u7684\u5bf9\u5e94\u7248\u672c\u7684 Debian \u7cfb\u7edf\u4e0a\uff0c\u8fd9\u4e24\u79cd\u5b89\u88c5\u65b9\u5f0f\u90fd\u6709\u5b98\u65b9\u7684\u8bf4\u660e\u6587\u6863\u3002</p> <p>\u6211\u4eec\u7684 esxi-5 \u662f\u4f7f\u7528 PVE \u7684\u5b89\u88c5\u76d8\u5148\u88c5\u6210 PVE\uff0c\u518d\u5728\u4e0a\u9762\u989d\u5916\u52a0\u88c5 PBS \u7684\u3002\u7531\u4e8e PVE \u548c PBS \u5171\u4eab\u4e86\u5927\u91cf\u7ec4\u4ef6\uff0c\u56e0\u6b64\u5728 PVE \u4e0a\u52a0\u88c5 PBS \u5c31\u53ea\u5269\u4e0b\u5f88\u7b80\u5355\u7684\u4e00\u4e9b\u6b65\u9aa4\u4e86\uff1a</p> <pre><code>echo \"deb http://mirrors.ustc.edu.cn/proxmox/debian/pbs bullseye pbs-no-subscription\" &gt; /etc/apt/sources.list.d/pbs.list\napt update\napt install proxmox-backup\n</code></pre> <p>\u8be5\u8fc7\u7a0b\u4ec5\u5b89\u88c5\u4e86\u603b\u91cf\u4e3a 150+ MB \u7684 8 \u4e2a\u5305\uff0c\u5c31\u6709 PBS \u53ef\u7528\u4e86\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs-new-user","title":"\u521b\u5efa\u65b0\u7528\u6237","text":"<p>PBS \u81ea\u5df1\u7684\u8d26\u53f7\u4f53\u7cfb (Realm pbs) \u4e0e PVE (Realm pve) \u4e92\u76f8\u4e0d\u901a\uff0c\u5982\u679c\u9700\u8981\u521b\u5efa\u65b0\u7684 PBS \u7528\u6237\uff0c\u53ef\u4ee5\u901a\u8fc7 SSH \u767b\u5f55\uff0c\u7136\u540e\u53c2\u8003\u4ee5\u4e0b\u6b65\u9aa4\uff1a</p> <ol> <li><code>proxmox-backup-manager user create \u7528\u6237\u540d@pbs --email \u90ae\u7bb1\u5730\u5740@ustclug.org</code></li> <li><code>proxmox-backup-manager user update \u7528\u6237\u540d@pbs --password '\u4e00\u4e2a\u4e34\u65f6\u7684\u5bc6\u7801'</code></li> <li>\u4f7f\u7528\u8be5\u7528\u6237\u767b\u5f55 PBS\uff08\u6b64\u65f6\u7528\u6237\u65e0\u6743\u9650\uff09\uff0c\u4fee\u6539\u5bc6\u7801\uff1b</li> <li>\u8d4b\u4e88\u6743\u9650\u3002\u8d85\u7ea7\u7ba1\u7406\u5458\u5bf9\u5e94\u7684\u547d\u4ee4\u662f <code>proxmox-backup-manager acl update / Admin --auth-id \u7528\u6237\u540d@pbs</code></li> <li>\u4f7f\u7528 <code>proxmox-backup-manager acl list</code> \u786e\u8ba4\u6743\u9650\u5217\u8868\u3002</li> </ol> <p>\u53c2\u8003\uff1ahttps://pbs.proxmox.com/docs/user-management.html</p> <p>Tip</p> <p>\u5f53\u7136\uff0c\u4f60\u4e5f\u53ef\u4ee5 SSH \u767b\u5f55\u540e\u4fee\u6539 root \u5bc6\u7801\uff0c\u518d\u7528 root@pam \u7684\u8d26\u53f7\u767b\u5f55 web \u754c\u9762\u8fdb\u884c\u64cd\u4f5c\u3002\u8be5\u65b9\u6cd5\u540c\u65f6\u9002\u7528\u4e8e PVE \u548c PBS\u3002\u64cd\u4f5c\u5b8c\u6210\u540e\u8bf7\u6062\u590d root \u5bc6\u7801\uff08<code>passwd -d root</code>\uff09\u3002</p> <p>\u5982\u679c\u4f60\u9700\u8981\u7ecf\u5e38\u767b\u5f55 Web \u754c\u9762\u64cd\u4f5c\uff0c\u6700\u597d\u521b\u5efa\u4e00\u4e2a Realm pve/pbs \u800c\u4e0d\u662f\u4f9d\u8d56\u4e8e\u4f7f\u7528 root \u5bc6\u7801\u3002</p> <p>\u7279\u522b\u5730\uff0c\u7531\u4e8e PBS \u548c PVE \u540c\u65f6\u5b89\u88c5\u5728 esxi-5 \u4e0a\uff0c\u56e0\u6b64\u5b83\u4eec\u53ef\u4ee5\u5171\u4eab esxi-5 \u4e0a\u7684 Linux \u7528\u6237\uff08\u5373 Linux PAM standard authentication\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs-add-datastore","title":"\u8bbe\u7f6e Datastore","text":"<p>PBS \u4e0a\u7684\u865a\u62df\u673a\u5907\u4efd\u5355\u5143\u662f\u5c0f\u5757\u7684 chunk\uff0c\u4e5f\u4f9d\u8d56\u8fd9\u4e2a\u8bbe\u8ba1\u5b9e\u73b0\u589e\u91cf\u5907\u4efd\uff0c\u6240\u4ee5\u865a\u62df\u673a\u5907\u4efd\uff08Datastore\uff09\u7684\u540e\u7aef\u90fd\u662f\u76ee\u5f55\u3002\u6dfb\u52a0 Datastore \u53ea\u9700\u8981\u6307\u5b9a\u4e00\u4e2a\u76ee\u5f55\uff0c\u53d6\u4e00\u4e2a\uff08\u7b80\u77ed\u7684\uff09\u540d\u5b57\u5c31\u53ef\u4ee5\u4e86\u3002\u5efa\u8bae\u4e0d\u8981\u4f7f\u7528\u6587\u4ef6\u7cfb\u7edf\u7684\u6839\u76ee\u5f55\u4f5c\u4e3a Datastore\uff0c\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a <code>pbs</code> \u6587\u4ef6\u5939\u7528\u4f5c Datastore\uff0c\u53c2\u8003\u4e0b\u9762\u6240\u8ff0\u7684 esxi-5 \u4e0a\u7684\u914d\u7f6e\u3002</p> <p>\u76ee\u524d\u5728 esxi-5 \u4e0a\u914d\u7f6e\u4e86\u4ee5\u4e0b datastore\uff1a</p> <ul> <li><code>/mnt/raid1/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/raid1</code>\uff0c\u662f esxi-5 \u673a\u8eab\u7684\u4e24\u5757\u5feb\u8981\u574f\u6389\u7684 2 TB HDD RAID-1\uff0c\u5df2\u7ecf\u6302\u4e86\uff1b</li> <li><code>/mnt/data/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/data</code>\uff0c\u662f\u4e00\u4e2a\u5bb9\u91cf\u4e3a 7 TB \u7684\u673a\u8eab HDD \u9635\u5217\uff1b</li> <li><code>/mnt/vdp2/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/vdp2</code>\uff0c\u662f\u4e00\u4e2a\u5bb9\u91cf\u4e3a 14 TB \u7684 iSCSI \u5916\u7f6e HDD \u9635\u5217\uff0c\u662f\u6211\u4eec\u76ee\u524d\u5907\u4efd\u865a\u62df\u673a\u7684\u4e3b\u8981\u5b58\u50a8\u3002</li> </ul>"},{"location":"infrastructure/proxmox/pve/","title":"Proxmox Virtual Environment (PVE)","text":"<p>LUG \u76ee\u524d\u670d\u5f79\u7684 Proxmox VE \u4e3b\u673a\u6709\uff1a</p> <ul> <li>pve-5 \u662f james \u5728 2021 \u5e74\u5e95\u7ed9\u6211\u4eec\u7684\uff0c\u7528\u4e8e\u66ff\u6362\u5df2\u8fd0\u884c\u591a\u5e74\u7684 esxi-5\uff08\u56e0\u6b64\u547d\u540d\u4e3a pve-5\uff09</li> <li> <p>esxi-5 \u662f 2011 \u5e74\u7684 mirrors \u670d\u52a1\u5668\uff0c\u4e8e 2016 \u5e74\u9000\u5f79\u540e\u6539\u88c5\u4e3a ESXi\uff0c\u73b0\u5728\u5df2\u66ff\u6362\u4e3a Proxmox VE</p> <ul> <li>esxi-5 \u4e0a\u9762\u989d\u5916\u52a0\u88c5\u4e86 Proxmox Backup Server \u7528\u4e8e\u63d0\u4f9b\u5907\u4efd\u529f\u80fd\uff0c\u8be6\u60c5\u53c2\u89c1 Proxmox Backup Server</li> <li> <p>PVE \u7684 web \u7aef\u53e3\u4e3a 8006\uff0c\u800c PBS \u7684\u7aef\u53e3\u4e3a 8007\uff0c\u56e0\u6b64\u5728\u4e00\u53f0\u4e3b\u673a\u4e0a\u540c\u65f6\u5b89\u88c5 PVE \u548c PBS \u4e92\u4e0d\u51b2\u7a81\uff0c\u8bbf\u95ee\u65f6\u9700\u8981\u4f7f\u7528 HTTPS \u5e76\u6307\u5b9a\u7aef\u53e3\u3002</p> <p>PVE \u548c PBS \u7684\u7aef\u53e3\u90fd\u662f\u56fa\u5b9a\u7684\uff0c\u65e0\u6cd5\u66f4\u6539</p> </li> </ul> </li> <li> <p>pve-6 \u662f\u4e00\u53f0\u8f83\u8001\u7684\u670d\u52a1\u5668\uff0c\u5728\u6539\u88c5\u524d\u8fd0\u884c ESXi 6.0\uff0c\u56e0\u6b64\u4e3b\u673a\u540d\u66fe\u7ecf\u662f esxi-6\u3002</p> <p>pve-1 \u5230 pve-4 \u53bb\u54ea\u4e86\uff1f</p> <p>esxi-1 \u548c esxi-3 \u5df2\u7ecf\u574f\u6389\u5f88\u591a\u5e74\u4e86\uff0c\u540c\u6279\u6b21 5 \u53f0\u673a\u5668\u5df2\u7ecf\u574f\u6389\u4e86 3 \u53f0\uff08\u53e6\u5916\u4e00\u4e2a\u662f vm-nfs\uff0cesxi-6 \u4e0d\u5c5e\u4e8e\u8be5\u6279\u6b21\uff09\u3002</p> <p>pve-2 \u548c pve-4 \u7531 esxi-2 \u548c esxi-4 \u6539\u88c5\u800c\u6765\uff0c\u7531\u4e8e\u8fc7\u4e8e\u53e4\u8001\uff082007 \u5e74\uff09\uff0c\u5373\u4f7f\u6ca1\u574f\uff0c\u6211\u4eec\u4e5f\u5c06\u5b83\u4eec\u4e0b\u67b6\u5904\u7406\u6389\u4e86\u3002</p> </li> </ul> <p>\u8fd9\u4e9b PVE \u4e3b\u673a\u914d\u7f6e\u4e3a\u4e00\u4e2a\u96c6\u7fa4\uff0c\u53ef\u4ee5\u5171\u4eab\u4e00\u4e9b\u914d\u7f6e\u4fe1\u606f\u5e76\u4e92\u76f8\u8fc1\u79fb\u865a\u62df\u673a\u3002\u7279\u522b\u5730\uff0cProxmox VE Authentication Server\uff08Realm \u4e3a pve\uff09\u7684\u8d26\u53f7\u5728 PVE \u4e3b\u673a\u4e4b\u95f4\u662f\u5171\u4eab\u7684\uff0c\u5e76\u4e14\u6dfb\u52a0\u7684 PBS \u5b58\u50a8\u540e\u7aef\u4e5f\u662f\u5171\u4eab\u7684\uff0c\u5373\u5927\u5bb6\u90fd\u53ef\u4ee5\u5f80\u76f8\u540c\u7684 PBS \u4e0a\u5907\u4efd\u865a\u62df\u673a\u3002</p> <p>\u4e0d\u540c\u4e3b\u673a\u4e4b\u95f4\u7684 Linux PAM \u7528\u6237\u662f\u4e0d\u76f8\u901a\u7684</p> <p>\u6240\u6709 Proxmox \u4e3b\u673a\u7684\u4e3b\u673a\u540d\uff08hostname\uff09\u90fd\u8bbe\u4e3a <code>&lt;hostname&gt;.vm.ustclug.org</code>\uff0c\u5bf9\u5e94\u7684 IP \u5730\u5740\u8bb0\u5f55\u5728 DNS \u4e2d\u3002</p>"},{"location":"infrastructure/proxmox/pve/#common","title":"\u516c\u7528\u914d\u7f6e","text":""},{"location":"infrastructure/proxmox/pve/#root","title":"root \u8d26\u6237","text":"<p>\u5df2\u5e9f\u5f03\u7684\u5185\u5bb9</p> <p>\u4e3a\u4e86\u4fbf\u4e8e\u901a\u8fc7 IPMI \u7b49\u65b9\u5f0f\u7ef4\u62a4\uff0c\u6211\u4eec\u7ea6\u5b9a\u6240\u6709 Proxmox \u4e3b\u673a\u7684 root \u8d26\u6237\u5bc6\u7801\u4fdd\u6301\u4e3a\u7a7a\u3002\u82e5\u6709\u64cd\u4f5c\u9700\u8981\u4f7f\u7528 root \u5bc6\u7801\uff08\u5982\u521b\u5efa\u548c\u52a0\u5165\u96c6\u7fa4\u65f6\uff09\uff0c\u8bf7\u901a\u8fc7 SSH \u6216 IPMI \u767b\u5f55\uff0c\u4e34\u65f6\u8bbe\u7f6e\u4e00\u4e2a root \u5bc6\u7801\uff0c\u5e76\u5728\u4fee\u6539\u5b8c PVE / PBS \u7684\u914d\u7f6e\u540e\u5c06\u5bc6\u7801\u5220\u9664\uff08<code>passwd -d</code>\uff09\u3002PVE / PBS \u6ca1\u6709\u4f9d\u8d56\u4e8e\u56fa\u5b9a\u4e0d\u53d8\u7684 root \u5bc6\u7801\u624d\u80fd\u6b63\u5e38\u8fd0\u884c\u7684\u7ec4\u4ef6\uff0c\u56e0\u6b64\u8fd9\u6837\u505a\u5bf9 PVE / PBS \u6765\u8bf4\u662f\u6ca1\u95ee\u9898\u7684\u3002</p>"},{"location":"infrastructure/proxmox/pve/#networking","title":"\u7f51\u7edc\u914d\u7f6e","text":"<p>\u5b89\u5168\u8d77\u89c1\uff0cPVE / PBS \u4e3b\u673a\u4f7f\u7528 RFC 1918 \u6bb5\u7684\u6821\u56ed\u7f51 IP\uff0c\u4e0d\u8fde\u63a5\u516c\u7f51\u3002</p> <ul> <li>\u4e1c\u56fe\u53ef\u7528\u7684 IP \u6bb5\u4e3a 192.168.93.0/24\uff08\u7f51\u5173 93.254\uff09</li> <li>\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u53ef\u7528\u7684 IP \u6bb5\u4e3a 10.38.95.0/24\uff08\u7f51\u5173 95.254\uff09</li> </ul> <p>Debian \u548c Proxmox \u7684\u8f6f\u4ef6\u66f4\u65b0\u4f7f\u7528 mirrors.ustc.edu.cn \u5373\u53ef\uff0c\u82e5\u6709\u9700\u8981\u8bbf\u95ee\u6821\u5916\uff08\u5982 GitHub \u7b49\uff09\uff0c\u8bf7\u5199 hosts \u5e76\u914d\u7f6e\u8def\u7531\uff0c\u4ee5 GitHub \u4e3a\u4f8b\uff1a</p> <pre><code>echo \"20.205.243.166 github.com\" &gt;&gt; /etc/hosts\nip route replace 20.205.243.166 via (?) dev (?)\n</code></pre> <p>\u5176\u4e2d <code>via</code> \u9009\u62e9 gateway-el \u6216 gateway-nic \u7684\u5185\u7f51\u5730\u5740\uff0c<code>dev</code> \u9009\u62e9\u6865\u63a5\u5185\u7f51\u7684 vmbr\uff08\u89c1\u4e0b\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pve/#vmbr","title":"\u865a\u62df\u673a\u7f51\u6865","text":"<p>Proxmox VE \u8981\u6c42\u4e3a\u865a\u62df\u673a\u63a5\u5165\u7684\u7f51\u6865\u5fc5\u987b\u547d\u540d\u4e3a <code>vmbrN</code>\uff0c\u5176\u4e2d N \u662f 0-4094 \u4e4b\u95f4\u7684\u6574\u6570\u3002\u65b9\u4fbf\u8d77\u89c1\uff0c\u6211\u4eec\u5728\u4e24\u4e2a\u673a\u623f\u5206\u522b\u7edf\u4e00 vmbr \u7684\u7f16\u53f7\uff1a</p> \u7f16\u53f7 \u4e1c\u56fe \u7f51\u7edc\u4e2d\u5fc3 vmbr0 \u6821\u56ed\u7f51\uff08\u6559\u80b2\u7f51\uff09 \u6821\u56ed\u7f51\uff08\u6559\u80b2\u7f51\uff09 vmbr1 \u5185\u7f51 \u5185\u7f51 vmbr2 \u7535\u4fe1+\u79fb\u52a8 \u7535\u4fe1 vmbr3 - \u8054\u901a vmbr4 - \u79fb\u52a8 vmbr5 - \u7279\u6b8a\u7528\u9014 vmbr10 \u5907\u7528 -"},{"location":"infrastructure/proxmox/pve/#pve-firewall","title":"\u9632\u706b\u5899","text":"<p>\u6211\u4eec\u4e0d\u4f7f\u7528 Proxmox \u81ea\u5e26\u7684\u9632\u706b\u5899\u529f\u80fd\uff0c\u4f46 pve-firewall \u4ecd\u7136\u4f1a\u5c1d\u8bd5\u90e8\u7f72\u6216\u6062\u590d\u9632\u706b\u5899\u8bbe\u7f6e\uff0c\u56e0\u6b64\u9700\u8981\u7981\u7528\u76f8\u5173\u8bbe\u7f6e\u53ca\u670d\u52a1\uff1a</p> /etc/pve/nodes/$(hostname -s)/host.fw<pre><code>[OPTIONS]\nenable: 0\n</code></pre> <pre><code>systemctl stop pve-firewall.service\nsystemctl disable pve-firewall.service\nsystemctl mask pve-firewall.service\n</code></pre> <p>\u53ef\u9009\u5185\u5bb9\uff1a\u540c\u65f6\u5b89\u88c5 <code>iptables-persistent</code> \u8f6f\u4ef6\u5305\uff0c\u5e76\u5229\u7528 iptables \u5c06 443 \u7aef\u53e3\u8f6c\u53d1\u5230 8006 \u7aef\u53e3\u65b9\u4fbf\u4f7f\u7528\u3002</p> <pre><code>update-alternatives --set iptables /usr/sbin/iptables-nft\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-nft\n</code></pre> /etc/iptables/rules.v4<pre><code>*nat\nPREROUTING ACCEPT [0:0]\nINPUT ACCEPT [0:0]\nOUTPUT ACCEPT [0:0]\nPOSTROUTING ACCEPT [0:0]\n-A PREROUTING -p tcp --dport 443 -m addrtype --dst-type LOCAL -j REDIRECT --to-ports 8006\nCOMMIT\n</code></pre> <p>\u5220\u6389 <code>rules.v6</code> \u6587\u4ef6\uff0c\u7136\u540e\u8fd0\u884c <code>systemctl restart netfilter-persistent.service</code> \u8f7d\u5165 iptables \u89c4\u5219\u3002</p>"},{"location":"infrastructure/proxmox/pve/#ntp","title":"NTP \u65f6\u95f4","text":"<p>Proxmox \u9ed8\u8ba4\u4f7f\u7528 chrony \u8f6f\u4ef6\u548c Debian \u63d0\u4f9b\u7684 NTP pool\uff0c\u8fd9\u4e9b\u670d\u52a1\u5668\u90fd\u5728\u6821\u5916\uff0c\u4f7f\u7528\u6821\u56ed\u7f51 IP \u65e0\u6cd5\u8fde\u901a\uff0c\u9700\u8981\u6539\u6210\u6821\u56ed\u7f51\u7684 NTP \u670d\u52a1\u5668\uff1a</p> /etc/chrony/chrony.conf<pre><code># Use Debian vendor zone.\n#pool 2.debian.pool.ntp.org iburst\nserver time.ustc.edu.cn iburst\n</code></pre> <p>\u7136\u540e\u8fd0\u884c <code>systemctl restart chrony.service</code> \u91cd\u542f\u670d\u52a1\u3002</p>"},{"location":"infrastructure/proxmox/pve/#ssl","title":"SSL \u8bc1\u4e66","text":"<p>\u53c2\u89c1 SSL \u8bc1\u4e66\uff0c\u6b63\u597d vdp \u4e0a\u9762\u8fd0\u884c\u4e86 LUG FTP \u800c\u56e0\u6b64\u914d\u7f6e\u4e86\u8bc1\u4e66\u7684\u81ea\u52a8\u66f4\u65b0\uff0c\u5229\u7528 vdp \u63d0\u4f9b\u7684 NFS \u670d\u52a1\uff0c\u6211\u4eec\u5728 vdp \u4e0a\u7684\u8bc1\u4e66\u66f4\u65b0\u811a\u672c\u4e2d\u6dfb\u52a0\u4e86\u5c06 vm \u8bc1\u4e66\u590d\u5236\u5230 NFS \u76ee\u5f55\u7684\u529f\u80fd\uff0c\u7136\u540e\u7531 pve-6 \u90e8\u7f72\u5230\u5404\u4e2a\u4e3b\u673a\u4e0a\u3002</p> <p>\u4e0b\u9762\u662f pve-6 \u4e0a\u7684\u811a\u672c\uff1a</p> /etc/cron.daily/sync-cert<pre><code>#!/bin/bash -e\n\nSRC=\"/etc/pve/nodes/$(hostname -s)\"\nDSTROOT=\"/etc/pve/nodes\"\nCERTSRC=\"/mnt/nfs-el/cert\"\n\ncp -u \"$CERTSRC/privkey.pem\" \"$SRC/pveproxy-ssl.key\"\ncp -u \"$CERTSRC/fullchain.pem\" \"$SRC/pveproxy-ssl.pem\"\nsystemctl reload pveproxy.service\n\nfor DST in \"$DSTROOT\"/*; do\n  [ \"$DST\" = \"$SRC\" ] &amp;&amp; continue\n  node=\"$(basename \"$DST\")\"\n  cp \"$SRC/pveproxy-ssl.key\" \"$SRC/pveproxy-ssl.pem\" \"$DST/\"\n  ssh \"$node\" 'systemctl reload pveproxy.service' &amp;\ndone\nwait\n</code></pre> <p>\u7531\u4e8e PVE \u548c PBS \u7684\u6570\u636e\u4e0d\u4e92\u901a\uff0c\u56e0\u6b64 esxi-5 \u4e0a\u7684\u76f8\u540c\u4f4d\u7f6e\u6709\u53e6\u4e00\u4e2a\u811a\u672c\u4e3a PBS \u90e8\u7f72\u8bc1\u4e66\uff1a</p> /etc/cron.daily/sync-cert<pre><code>#!/bin/bash\n\nSRC=\"/etc/pve/nodes/$(hostname -s)\"\nDST=\"/etc/proxmox-backup\"\n\nif ! cmp -s \"$SRC/pveproxy-ssl.pem\" \"$DST/proxy.pem\"; then\n  cp \"$SRC/pveproxy-ssl.key\" \"$DST/proxy.key\"\n  cp \"$SRC/pveproxy-ssl.pem\" \"$DST/proxy.pem\"\n  systemctl reload proxmox-backup-proxy.service\nfi\nexit 0\n\n# Unreachable code, leaving here for reference\nif command -v openssl 2&gt;/dev/null; then\n  FP=\"$(openssl x509 -noout -fingerprint -sha256 -inform pem -in \"$DST/proxy.pem\")\"\n  FP=\"${FP##*=}\"\n  pvesm set esxi-5-data --finerprint \"$FP\"\n  pvesm set esxi-5-vdp2 --finerprint \"$FP\"\nfi\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#pve-5","title":"pve-5","text":"<p>pve-5 \u4f4d\u4e8e\u7f51\u7edc\u4e2d\u5fc3\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5-2603 v4 (Broadwell 6C6T, 1.70 GHz, no HT, no Turbo Boost) Xeon E5-2667 v4 (Broadwell 8C16T, 3.20 GHz, Max 3.60 GHz)\uff0c256 GB \u5185\u5b58\u548c\u4e00\u5927\u5806 SSD\uff082\u00d7 \u4e09\u661f 240 GB SATA + 10x Intel DC S4500 1.92 TB SATA\uff09\u3002\u6211\u4eec\u5c06\u4e24\u5757 240 GB \u7684\u76d8\u7ec4\u6210\u4e00\u4e2a LVM VG\uff0c\u5206\u914d 16 GB \u7684 rootfs\uff08LVM mirror\uff09\u548c 8 GB \u7684 swap\uff0c\u5176\u4f59\u7a7a\u95f4\u7ed9\u4e00\u4e2a thinpool\u3002\u5341\u5757 1.92 TB \u7684\u76d8\u7ec4\u6210\u4e00\u4e2a RAIDZ2 \u7684 zpool\uff0c\u7528\u4e8e\u5b58\u50a8\u865a\u62df\u673a\u7b49\u6570\u636e\u3002</p> <p>\u5176\u8fde\u63a5\u7684\u5355\u6839 10 Gbps \u7684\u5149\u7ea4\uff0c\u6865\u63a5\u51fa <code>vmbr0</code> \u81f3 <code>vmbr4</code> \u7b49\u7f51\u6865\uff08\u7ebf\u8def\u5b9a\u4e49\u89c1\u4e0a\uff09\u3002\u5176\u4e2d\u65e0\u5934\u7f51\u6865\u7528\u4e8e\u4ece gateway-nic \u6865\u63a5 Tinc\u3002</p> <p>\u786c\u76d8\u63a7\u5236\u5668\u4e0d\u8981\u4f7f\u7528 VirtIO SCSI Single \u6216 LSI \u5f00\u5934\u7684\u9009\u9879</p> <p>\u53ef\u80fd\u7531\u4e8e ZFS \u6a21\u5757\u7684 bug \u6216\u8005\u5185\u5b58\u6761\u6545\u969c\uff0c\u4f7f\u7528\u8fd9\u4e9b\u6a21\u5f0f\u5728\u865a\u62df\u673a\u91cd\u542f\u65f6\u4f1a\u5bfc\u81f4\u6574\u4e2a Proxmox VE \u4e3b\u673a\u5361\u4f4f\u800c\u4e0d\u5f97\u4e0d\u91cd\u542f\u3002\u8bf7\u4f7f\u7528 VirtIO SCSI\uff08\u4e0d\u5e26 Single\uff09\u3002\u540c\u6837\u539f\u56e0\u521b\u5efa\u865a\u62df\u673a\u786c\u76d8\u65f6\u4e5f\u4e0d\u8981\u52fe\u9009 iothread\u3002</p> <p>\u4e3b\u673a\u4f7f\u7528 ZFS\uff08Zvol\uff09\u4f5c\u4e3a\u865a\u62df\u673a\u7684\u865a\u62df\u786c\u76d8\uff0c\u5728\u865a\u62df\u673a\u4e2d\u542f\u7528 <code>fstrim.timer</code>\uff08systemd \u7684 fstrim \u5b9a\u65f6\u4efb\u52a1\uff0c\u7531 <code>util-linux</code> \u63d0\u4f9b\uff09\u53ef\u4ee5\u5b9a\u671f\u817e\u51fa\u4e0d\u7528\u7684\u7a7a\u95f4\uff0c\u5e2e\u52a9 ZFS \u66f4\u597d\u5730\u89c4\u5212\u7a7a\u95f4\u3002\u542f\u7528 fstrim \u7684\u865a\u62df\u786c\u76d8\u9700\u8981\u5728 PVE \u4e0a\u542f\u7528 <code>discard</code> \u9009\u9879\uff0c\u5426\u5219 fstrim \u4e0d\u8d77\u4f5c\u7528\u3002\u8be5\u7279\u6027\u662f\u7531\u4e8e ZFS \u662f CoW \u7684\uff0c\u4e0e ZFS \u5e95\u5c42\u4f7f\u7528 SSD \u6ca1\u6709\u592a\u5927\u5173\u8054\u3002</p>"},{"location":"infrastructure/proxmox/pve/#esxi-5","title":"esxi-5","text":"<p>esxi-5 \u4e5f\u4f4d\u4e8e\u7f51\u7edc\u4e2d\u5fc3\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5620\uff08Westmere-EP 4C8T, 2.40~2.66 GHz\uff09\uff0c48 GB \u5185\u5b58\uff0c\u4e24\u5757 240 GB SATA SSD \u548c\u4e00\u4e9b\u4e0d\u77e5\u9053\u574f\u4e86\u591a\u5c11\u7684 1 TB \u548c 2 TB HDD\uff08\u89c1\u4e0b\uff09\u3002\u7531\u4e8e\u673a\u8eab\u81ea\u5e26\u7684 RAID \u5361\u4e0d\u652f\u6301\u786c\u76d8\u76f4\u901a\uff08JBOD \u6a21\u5f0f\uff09\uff0c\u56e0\u6b64\u6211\u4eec\u5c06\u4e24\u5757 SSD \u5206\u522b\u505a\u6210\u5355\u76d8\u201c\u9635\u5217\u201d\u7136\u540e\u5728\u7cfb\u7edf\u91cc\u4f7f\u7528 LVM\uff08LVM \u89c4\u683c\u4e0e pve-5 \u76f8\u540c\uff09</p> <p>\u987e\u540d\u601d\u4e49\u672c\u673a\u5668\u66fe\u7ecf\u8fd0\u884c\u7684\u662f VMware ESXi\uff0c\u5728 2022 \u5e74 1 \u6708\u91cd\u88c5\u4e3a Proxmox VE 7.1\uff0c\u56e0\u4e3a\u54b1\u4eec\u90fd\u662f\u7ea0\u7ed3\u602a\u6240\u4ee5\u51b3\u5b9a\u4e0d\u6539\u540d\uff0c\u8fd8\u53eb esxi-5\u3002\u8003\u8651\u5230\u8be5\u673a\u5668\u914d\u7f6e\u4e86\u591a\u4e2a\u786c\u76d8\u9635\u5217\uff0c\u4e14\u9635\u5217\u7684\u53ef\u7528\u5bb9\u91cf\u6bd4 pve-5 \u7684\u786c\u76d8\u7684\u539f\u59cb\u5bb9\u91cf\u8fd8\u5927\uff0c\u6211\u4eec\u5728\u4e0a\u9762\u52a0\u88c5 Proxmox Backup Server \u8f6f\u4ef6\uff0c\u4e3b\u8981\u7528\u4f5c\u865a\u62df\u673a\u5907\u4efd\uff0c\u66ff\u4ee3\u539f\u5148\u8fd0\u884c\u5728 ESXi \u4e0a\u7684 vSphereDataProtection \u865a\u62df\u673a\u3002</p>"},{"location":"infrastructure/proxmox/pve/#_1","title":"\u7f51\u7edc","text":"<p>\u7f51\u7edc\u914d\u7f6e\u4e0e pve-5 \u76f8\u4f3c\uff0c\u5176\u4e0a\u6709\u4e24\u4e2a\u5343\u5146\u7f51\u5361 enp3s0 \u548c enp4s0\u3002enp3s0 \u8fde\u63a5\u7f51\u7edc\u4e2d\u5fc3\u7684\u4ea4\u6362\u673a\uff0c\u6865\u63a5\u4e0d\u540c\u7684 VLAN \u7f51\u7edc\u7ed9\u865a\u62df\u673a\uff0c\u5e76\u4e14\u5404 vmbrX \u7684\u6570\u5b57\u548c\u7aef\u53e3\u4e0e pve-5 \u4e00\u81f4\uff1b\u800c enp4s0 \u8fde\u63a5\u4e00\u4e2a\u5916\u90e8\u9635\u5217\uff08vdp2\uff09\uff0c\u4f7f\u7528 iSCSI \u8bbf\u95ee\u8be5\u9635\u5217\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u53ea\u6709\u4e00\u4e2a gateway-nic\uff0c\u800c pve-5 \u548c esxi-5 \u4e24\u4e2a\u4e3b\u673a\u90fd\u4f9d\u8d56 gw-nic \u6865\u63a5\u7684 tinc \u6765\u63a5\u5165\u5185\u7f51\uff0c\u56e0\u6b64\u6211\u4eec\u5728 pve-5 \u548c esxi-5 \u4e4b\u95f4\u62c9\u4e86\u4e00\u6761 GRETAP \u96a7\u9053\uff0c\u5e76\u5728\u4e24\u4e2a\u4e3b\u673a\u4e0a\u5206\u522b\u5c06 VTEP \u6865\u63a5\u5230 vmbr1\u3002</p> <p>\u53c2\u8003\u914d\u7f6e\uff1a</p> pve-5:/etc/network/interfaces<pre><code>auto gretap0esxi-5\niface gretap0esxi-5 inet manual\n    pre-up ip link add name $IFACE mtu $IF_MTU type gretap local 10.38.95.115 remote 10.38.95.111\n    post-down ip link delete $IFACE\n    mtu 1500\n\nauto vmbr1\niface vmbr1 inet static\n    address 10.254.0.240/21\n    bridge-ports gretap0esxi-5\n    bridge-stp off\n    bridge-fd 0\n</code></pre> <p>esxi-5 \u8fd9\u7aef\u7684\u914d\u7f6e\u5219\u5c06\u5bf9\u5e94\u7684 iface \u540d\u79f0\u548c IP \u5730\u5740\u7b49\u5168\u90e8\u5bf9\u6362\u5373\u53ef\u3002</p> <p>MTU \u95ee\u9898</p> <p>2022 \u5e74 2 \u6708\u5904\u7406\u5185\u7f51 tinc ARP \u95ee\u9898\u65f6\u53d1\u73b0 esxi-5 \u548c pve-5 \u7684 vmbr1 MTU \u90fd\u88ab\u8bbe\u7f6e\u6210\u4e86 1462\uff08GRETAP \u7684\u9ed8\u8ba4 MTU\uff09\u3002\u6211\u4eec\u4e0d\u786e\u5b9a MTU \u95ee\u9898\u4e0e tinc \u662f\u5426\u76f8\u5173\uff0c\u4f46\u4fdd\u9669\u8d77\u89c1\u6211\u4eec\u8fd8\u662f\u5c06\u8be5 GRETAP \u754c\u9762\u7684 MTU \u8bbe\u7f6e\u6210\u4e86 1500\uff08GRE \u5177\u6709\u5206\u7247\u529f\u80fd\uff09\u3002</p> <pre><code>-pre-up ip link add name $IFACE type gretap local 10.38.95.115 remote 10.38.95.111\n+pre-up ip link add name $IFACE mtu $IF_MTU type gretap local 10.38.95.115 remote 10.38.95.111\n post-down ip link delete $IFACE\n+mtu 1500\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#iscsi","title":"iSCSI","text":"<p>\u8bbe\u7f6e iSCSI \u5f00\u673a\u81ea\u52a8\u767b\u5f55\uff1a</p> <pre><code>iscsiadm -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 -o update -n node.startup -v automatic\niscsiadm -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 -o update -n node.conn[0].startup -v automatic\n</code></pre> <p>\u53c2\u8003\u94fe\u63a5\uff1ahttps://library.netapp.com/ecmdocs/ECMP1654943/html/GUID-8EC685B4-8CB6-40D8-A8D5-031A3899BCDC.html</p> \u8fc7\u65f6\u4fe1\u606f <p>\u7531\u4e8e\u6211\u4eec\u6ca1\u6709\u7814\u7a76\u6e05\u695a open-iscsi \u7684\u5f00\u673a\u81ea\u52a8\u6302\u8f7d\u673a\u5236\uff0c\u56e0\u6b64\u6211\u4eec\u9009\u62e9\u76f4\u63a5 override \u5bf9\u5e94\u7684 service \u6765\u5b8c\u6210\u8fd9\u4e2a\u4efb\u52a1\uff1a</p> $ systemctl edit open-iscsi.service<pre><code>[Service]\nExecStart=\nExecStart=/sbin/iscsiadm -d8 -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 --login\nExecStart=/lib/open-iscsi/activate-storage.sh\n</code></pre> <p>\u82e5 iSCSI \u8fde\u63a5\u6210\u529f\uff0c\u5e94\u8be5\u53ef\u4ee5\u5728\u7cfb\u7edf\u4e2d\u770b\u5230\u4e00\u4e2a\u65b0\u7684\u786c\u76d8\uff0c\u5bb9\u91cf\u4e3a 14.55 TiB\uff0c\u578b\u53f7\u663e\u793a\u4e3a RS-3116I-S42-6\u3002</p>"},{"location":"infrastructure/proxmox/pve/#rootfs-backup","title":"rootfs \u5907\u4efd","text":"<p>\u5c3d\u7ba1 esxi-5 \u7684 rootfs \u4e5f\u4f7f\u7528\u4e86 LVM mirror \u5728\u4e24\u5757 SSD \u4e0a\u955c\u50cf\uff0c\u4f46\u662f\u6211\u4eec\u4e0d\u592a\u4fe1\u4efb\u8fd9\u5757 RAID \u5361\uff0c\u56e0\u6b64\u6211\u4eec\u5c06 esxi-5 \u7684 rootfs \u6bcf\u5929\u5907\u4efd\u5230 vdp2 \u4e0a\u3002\u4e3a\u4e86\u907f\u514d\u5728 vdp2 \u6389\u7ebf\u7684\u65f6\u5019\u4e71\u201c\u5907\u4efd\u201d\uff0c\u6211\u4eec\u4f7f\u7528\u4e00\u4e2a systemd \u670d\u52a1\uff0c\u8bbe\u7f6e\u4e86 <code>RequiresMountsFor</code> \u4f9d\u8d56\uff1a</p> /etc/systemd/system/rootfs-backup.service<pre><code>[Unit]\nDescription=Backup rootfs to vdp2\nRequiresMountsFor=/mnt/vdp2\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/rsync -aHAXx --delete / /mnt/vdp2/rootfs/\n</code></pre> crontab<pre><code>21 4 * * * systemctl start rootfs-backup.service\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#esxi-5-others","title":"\u5176\u4ed6\u8bb0\u5f55","text":"<p>esxi-5 \u4e8e 2021/8 \u53d1\u73b0\u81ea\u5e26\u9635\u5217\u6709\u4e24\u5757\u574f\u76d8\uff0c\u5728\u66f4\u6362\u540e\u53d1\u73b0 storage \"root\"\uff08\u5b58\u653e vcenter \u865a\u62df\u673a\uff0c\u7ec4\u5efa RAID 1 \u540e\u5927\u5c0f 1.8 TB\uff09\u65e0\u6cd5\u6b63\u5e38 rebuild\uff0c\u5e76\u4e14 vcenter \u865a\u62df\u673a\u7684 vmdk \u6587\u4ef6\u6709 4 \u4e2a\u51fa\u73b0 I/O error\u3002\u6b64\u540e vcenter \u865a\u62df\u673a\u5df2\u7ecf\u8fc1\u79fb\u5230 storage \"data\" (RAID10, 7.2 TB) \u5e76\u6b63\u5e38\u5de5\u4f5c\u3002</p>"},{"location":"infrastructure/proxmox/pve/#records","title":"\u5de5\u4f5c\u8bb0\u5f55","text":""},{"location":"infrastructure/proxmox/pve/#migrate-docker2","title":"2021-12-31 \u8fc1\u79fb docker2","text":"<p>docker2 \u539f\u5148\u4f7f\u7528 QEMU \u76f4\u63a5\u8fd0\u884c\u5728 mirrors2 \u4e0a\uff0c\u4e0b\u5c42\u5b58\u50a8\u4e3a ZFS Zvol\uff08<code>pool0/qemu/docker2</code>\uff09\uff0c\u7531\u4e8e ZFS \u8c03\u53c2\u4e0d\u5f53\u4f7f\u5176\u5360\u7528\u4e86 3 \u500d\u7684\u786c\u76d8\u7a7a\u95f4\uff08\u89c1\u8fd9\u4e2a Reddit \u8d34\u5b50\uff09\uff0c\u52a0\u4e0a mirrors2 \u672c\u8eab\u5bf9\u5916\u63d0\u4f9b Rsync \u670d\u52a1\uff0c\u786c\u76d8\u8d1f\u8f7d\u6781\u9ad8\uff0c\u6240\u4ee5\u957f\u671f\u4ee5\u6765 docker2 \u7684 I/O \u6027\u80fd\u5341\u5206\u4f4e\u4e0b\u3002\u6b63\u597d\u501f\u8fd9\u6b21\u5168\u95ea\u7684\u65b0\u5bbf\u4e3b\u673a\u5c06\u5176\u8fc1\u79fb\u8fc7\u53bb\u3002</p> <p>\u8fc1\u79fb\u65f6\u9700\u8981\u4fdd\u8bc1\u5b8c\u6574\u6027\u7684\u4e3b\u8981\u5185\u5bb9\u5c31\u662f\u865a\u62df\u673a\u5185\u7684\u4e1a\u52a1\uff0c\u56e0\u6b64\u9700\u8981\u5728\u4e3b\u673a\u95f4\u4f20\u8f93\u7684\u5185\u5bb9\u5c31\u662f\u865a\u62df\u78c1\u76d8\uff0c\u5176\u4ed6\u914d\u7f6e\uff08CPU\u3001\u5185\u5b58\u3001\u7f51\u5361\u7b49\uff09\u90fd\u53ef\u4ee5\u76f4\u63a5\u5728\u65b0\u5e73\u53f0\u4e0a\u521b\u5efa\u65b0\u865a\u62df\u673a\u65f6\u4fee\u6539\u3002\u539f\u672c\u6211\u4eec\u6253\u7b97\u4f7f\u7528 rsync \u6216\u8005 dd \u7684\u65b9\u5f0f\u590d\u5236\u78c1\u76d8\uff0c\u4f46\u662f\u8003\u8651\u5230\u4e24\u8fb9\u90fd\u662f ZFS\uff0c\u4f7f\u7528 <code>zfs send</code> \u662f\u4e00\u4e2a\u66f4\u597d\u7684\u65b9\u6848\u3002</p> <p>\u6211\u4eec\u5728 pve-5 \u4e0a\u8fd0\u884c <code>nc -l -p 9999 &lt;/dev/null | pv | zfs recv rpool/data/docker2</code>\uff0c\u7136\u540e\u5728 mirrors2 \u4e0a\u5bf9 zvol \u5148\u6253\u4e2a\u5feb\u7167\uff0c\u8fd0\u884c <code>zfs send pool0/qemu/docker2@20211230 &gt; /dev/tcp/{pve-5}/9999</code> \u5c06\u5feb\u7167\u5185\u5bb9\u53d1\u9001\u5230 pve-5 \u4e0a\uff08300 GiB \u7684\u6570\u636e\u82b1\u8d39\u4e86 16 \u5c0f\u65f6\uff09\uff0c\u7136\u540e\u518d\u5c06 docker2 \u5173\u673a\u5e76\u589e\u91cf\u4f20\u8f93\uff0c<code>zfs send -i @20211230 pool0/qemu/docker2 &gt; /dev/tcp/{pve-5}/9999</code>\uff08\u589e\u91cf\u4f20\u8f93\u53ea\u53d1\u9001\u4e86 10 GB \u6570\u636e\uff09\u3002\u540c\u65f6\u6211\u4eec\u5728 Proxmox \u7684 web \u754c\u9762\u4e0a\u521b\u5efa\u4e00\u4e2a\u65b0\u865a\u62df\u673a\uff0c\u914d\u597d CPU \u5185\u5b58\u7f51\u5361\u7b49\uff0c\u5206\u914d 300 GiB \u7684\u786c\u76d8\u3002</p> <p>\u7531\u4e8e zfs send \u662f\u539f\u6837\u53d1\u9001\u7684\uff0c\u56e0\u6b64\u63a5\u6536\u5230\u7684 zvol \u786c\u76d8\u5360\u7528\u91cf\u4ecd\u7136\u6709 712 GB\u3002Proxmox \u65b0\u5efa\u7684 zvol \u53c2\u6570\u5c31\u6bd4\u8f83\u5408\u7406\uff08<code>volblocksize=16k</code>\uff09\uff0c\u6ca1\u6709\u4e25\u91cd\u653e\u5927\u7684\u95ee\u9898\uff0c\u56e0\u6b64\u6211\u4eec\u518d\u5c06\u63a5\u6536\u5230\u7684 zvol \u7ed9 dd \u8fdb\u65b0\u865a\u62df\u673a\u7684 zvol \u800c\u4e0d\u662f\u76f4\u63a5\u4f7f\u7528\u3002dd \u7ed3\u679c\u7ea6 345 GiB\uff08\u5341\u5206\u5408\u7406\uff09\uff0c\u5f00\u673a\u8fdb\u7cfb\u7edf\u8fd0\u884c fstrim \u4e4b\u540e\u5360\u7528\u91cf\u7ea6\u4e3a 240 GiB\uff08\u66f4\u52a0\u5408\u7406\u4e86\uff09\u3002</p> <p>\u8fc1\u79fb\u8fc7\u7a0b\u6ca1\u6709\u9047\u5230\u4efb\u4f55\u5751\uff0c\u4ec5\u6709\u7684\u6ce8\u610f\u4e8b\u9879\u5c31\u662f zvol \u8c03\u53c2\u9700\u8981\u91cd\u65b0 dd \u800c\u4e0d\u80fd\u76f4\u63a5\u6539\uff0c\u4ee5\u53ca\u521b\u5efa\u7f51\u5361\u7684\u987a\u5e8f\uff08\u4f1a\u5f71\u54cd\u865a\u62df\u673a\u5185\u90e8 eth0 \u548c eth1 \u7684\u987a\u5e8f\uff0c\u9664\u975e\u865a\u62df\u673a\u5185\u90e8\u4f7f\u7528 udev persistent net \u65b9\u5f0f\u6839\u636e MAC \u5730\u5740\u5c06\u7f51\u5361\u6539\u540d\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pve/#esxi-5-syslog-zfs-error-cannot-open-rpool-no-such-pool","title":"esxi-5 \u7684 syslog \u4e00\u76f4\u51fa\u73b0 zfs error: cannot open 'rpool': no such pool","text":"<p>\u8fd9\u662f\u56e0\u4e3a esxi-5 \u4e0a\u9762\u6839\u672c\u5c31\u6ca1\u6709\u4f7f\u7528 ZFS\uff0c\u800c\u52a0\u5165 pve-5 \u7684\u96c6\u7fa4\u65f6\u865a\u62df\u673a\u7684\u5b58\u50a8\u4fe1\u606f\uff08<code>/etc/pve/storage.cfg</code>\uff09\u4e5f\u4ece pve-5 \u540c\u6b65\u8fc7\u6765\u5408\u5e76\u4e86\uff0c\u56e0\u6b64 esxi-5 \u5728\u6839\u636e pve-5 \u7684\u914d\u7f6e\u5c1d\u8bd5\u542f\u7528 zfs \u5b58\u50a8\u3002</p> <p>\u89e3\u51b3\u529e\u6cd5\uff1a\u7531\u4e8e <code>/etc/pve</code> \u4e0b\u5927\u591a\u6570\u5185\u5bb9\u5728\u96c6\u7fa4\u95f4\u662f\u540c\u6b65\u7684\uff0c\u6253\u5f00 <code>storage.cfg</code>\uff0c\u5728 <code>zfspool: local-zfs</code> \u4e0b\u9762\u52a0\u5165\u4e00\u884c\uff0c\u7f29\u8fdb\u4e00\u4e2a Tab \u5e76\u52a0\u4e0a <code>nodes pve-5</code>\uff0c\u8868\u793a\u8fd9\u4e2a storage \u53ea\u5728 pve-5 \u4e0a\u4f7f\u7528\u3002</p>"},{"location":"infrastructure/proxmox/pve/#pve-6","title":"pve-6","text":"<p>pve-6 \u4f4d\u4e8e\u4e1c\u56fe\uff0c\u662f\u4e00\u53f0 HP DL380G6\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5620 (Westmere 4C8T, 2.50 GHz), 72 GB \u5185\u5b58\u548cl\u4e24\u5757 300 GB \u7684 SAS \u786c\u76d8\u3002\u66fe\u7ecf\u53eb\u505a esxi-6\uff0c\u5728 2022 \u5e74 1 \u6708\u7edf\u4e00\u66f4\u6362\u4e3a Proxmox VE\u3002</p> <p>\u673a\u5668\u6709\u4e24\u4e2a\u7f51\u5361\uff0c\u5171\u6709 4 \u4e2a 1 Gbps \u7684\u63a5\u53e3\uff0c\u5176\u4e2d 3 \u4e2a\u90fd\u63a5\u5728 VLAN \u4ea4\u6362\u673a\u4e0a\uff08\u53e6\u4e00\u4e2a\u4e0d\u77e5\u9053\u63a5\u4e86\u5565\uff09\uff0c\u901a\u8fc7 VLAN \u540c\u65f6\u8fde\u63a5\u56fe\u4e66\u9986\u7684\u4e24\u4e2a\u7f51\u6bb5\u4ee5\u53ca\u7ecf\u7531 gateway-el \u6865\u63a5\u7684\u5185\u7f51\uff0c\u4ee5\u53ca\u8fde\u63a5 vdp \u6302\u8f7d NFS\u3002</p> <p>HP Smart Array</p> <p>HP \u7684\u81ea\u5e26 RAID \u5361\u7ba1\u7406\u8f6f\u4ef6\u53ef\u4ee5\u5728 http://downloads.linux.hpe.com/SDR/repo/mcp/Debian/pool/non-free/ \u4e0b\u8f7d\uff0c\u5b89\u88c5 <code>ssacli</code> \u8f6f\u4ef6\u5305\u3002\u76f8\u5173\u4f7f\u7528\u65b9\u6cd5\u53ef\u4ee5\u53c2\u8003 https://sleeplessbeastie.eu/2017/03/06/how-to-use-hp-command-line-array-configuration-utility/\u3002</p>"},{"location":"services/","title":"LUG \u670d\u52a1\u603b\u89c8","text":"<p>\u6ce8\u610f</p> <p>LUG \u7684\u4e3b\u9875\u4e0a\u8fd8\u6709\u4e00\u4efd\u300a\u7f51\u7edc\u670d\u52a1\u5217\u8868\u300b \uff0c\u5982\u679c\u6709\u670d\u52a1\u72b6\u6001\u6539\u53d8\uff0c\u8bb0\u5f97\u540c\u6b65\u66f4\u65b0\u4e3b\u9875\u4e0a\u7684\u5217\u8868\u3002</p>"},{"location":"services/#mirrors","title":"Mirrors \u955c\u50cf\u7ad9","text":"<p>\u670d\u52a1\u5668\uff1a</p> <ul> <li>\u4e3b\uff1amirrors4<ul> <li>\u4e3b\u670d\u52a1\u5668\u5b58\u50a8\u7edd\u5927\u90e8\u5206\u4ed3\u5e93\uff0c\u5bf9\u5916\u63d0\u4f9b HTTP(S), git \u4e0e Rsync \u670d\u52a1\u3002<ul> <li>HTTP(S) \u5bf9\u5e94 nginx\uff0cRsync \u5bf9\u5e94 rsync-proxy\uff0c\u4e24\u8005\u5747\u652f\u6301\u53cd\u5411\u4ee3\u7406\uff08\u56e0\u6b64\u53ef\u4ee5\u5c06\u4ed3\u5e93\u653e\u5728\u522b\u7684\u673a\u5668\u4e0a\uff0c\u540c\u65f6\u5728 mirrors4 \u5411\u5916\u63d0\u4f9b\u5bf9\u5e94\u7684\u670d\u52a1\uff09\u3002</li> <li>\u63a5\u5165\u4e86\u5305\u62ec\u6559\u80b2\u7f51\u7b49\u5728\u5185\u7684\u591a\u4e2a ISP\u3002</li> </ul> </li> <li>\u72b6\u6001\u9875\u9762\u901a\u8fc7 SSH \u96a7\u9053\u4e0e mirrors[2-3] \u66b4\u9732 Yuki \u516c\u5f00 API\u3002</li> </ul> </li> <li>\u526f\uff1amirrors3<ul> <li>mirrors3 \u5b58\u50a8\u8f83\u5927\u7684\u5b58\u6863\u7c7b\u4ed3\u5e93\u3001\u6781\u51b7\u95e8\u4e14\u7a7a\u95f4\u6781\u5927\u4e0e\u6709\u9700\u8981\u4f46\u662f mirrors4 \u653e\u4e0d\u4e0b\u7684\u4ed3\u5e93\u3002</li> <li>\u622a\u81f3\u76ee\u524d\uff082023/11\uff09\uff0c\u6709 centos-vault, openeuler, percona, ubuntu-old-releases</li> <li>https://mirrors.ustc.edu.cn/status/mirrors3.html</li> <li>\u6ce8\u610f\uff1amirrors3 \u8fde\u63a5\u7684 SAN \u7684\u7ba1\u7406\u53e3\u5df2\u7ecf\u635f\u574f\uff0c\u9700\u8981\u5b9a\u671f\u68c0\u67e5\u78c1\u76d8\u72b6\u6001\u3002</li> </ul> </li> <li>\u526f\uff1amirrors2<ul> <li>mirrors2 \u5b58\u50a8\u7684\u5185\u5bb9\u662f mirrors4 \u7684\u5b50\u96c6\uff0c\u8d1f\u8d23\u5e2e\u52a9 mirrors4 \u627f\u62c5\u4e00\u90e8\u5206 rsync \u6d41\u91cf\u7684\u538b\u529b\u3002</li> <li>rsync \u76f8\u6bd4 http(s)\uff0c\u7ed9\u670d\u52a1\u5668\u5e26\u6765\u7684\u8d1f\u8f7d\u9ad8\u5f97\u591a\u3002</li> </ul> </li> <li>\u5df2\u5e9f\u5f03\uff1amirrors1</li> </ul> <p>\u955c\u50cf\u7ad9\u65e5\u5fd7\u4f1a\u5907\u4efd\u81f3 mirrorlog \u865a\u62df\u673a\u4e0a\u3002</p>"},{"location":"services/#auth-dns","title":"\u6743\u5a01 DNS","text":"<p>\u4ee5\u4e0b\u5185\u5bb9\u7531 GPT-4 \u751f\u6210</p> <p>User: \u5411\u65b0\u624b\u8fd0\u7ef4\u4ecb\u7ecd\u4ec0\u4e48\u662f\u6743\u5a01 DNS</p> <p>Bot: \u6743\u5a01DNS\uff08Authoritative DNS\uff09\u670d\u52a1\u662f\u56e0\u7279\u7f51\u57df\u540d\u7cfb\u7edf\uff08DNS\uff09\u7684\u4e00\u90e8\u5206\uff0c\u5b83\u8d1f\u8d23\u5904\u7406\u5173\u4e8e\u5176\u8d1f\u8d23\u7ba1\u7406\u7684\u4e00\u7ec4\u57df\u540d\u7684\u67e5\u8be2\u3002\u8fd9\u4e9bDNS\u670d\u52a1\u5668\u5e26\u6709\u5173\u4e8e\u4ed6\u4eec\u6240\u8d1f\u8d23\u57df\u7684\u6240\u6709\u5fc5\u8981\u6570\u636e\uff0c\u5e76\u4ece\u7ba1\u7406\u8be5\u57df\u7684\u4eba\u6216\u7ec4\u7ec7\u4e2d\u6536\u5230\u66f4\u65b0\u3002</p> <p>\u6bd4\u5982\uff0c\u5982\u679c\u4f60\u5728\u6d4f\u89c8\u5668\u4e2d\u8f93\u5165\u4e00\u4e2a\u7f51\u7ad9\u5730\u5740\uff0c\u4f60\u7684\u8bf7\u6c42\u9996\u5148\u53d1\u9001\u5230\u9012\u5f52DNS\u670d\u52a1\u5668\uff0c\u7136\u540e\u9012\u5f52\u670d\u52a1\u5668\u67e5\u8be2\u6743\u5a01DNS\u670d\u52a1\u5668\u6765\u83b7\u53d6\u5bf9\u5e94\u7684IP\u5730\u5740\u3002\u6743\u5a01\u670d\u52a1\u5668\u5c31\u662f\u201c\u6743\u5a01\u201d\u8d44\u6e90\uff0c\u80fd\u591f\u544a\u8bc9\u9012\u5f52\u670d\u52a1\u5668\u5bf9\u5e94\u7684IP\u5730\u5740\u662f\u4ec0\u4e48\u3002\u8fd9\u4e2a\u8fc7\u7a0b\u88ab\u79f0\u4e3aDNS\u89e3\u6790\u3002</p> <p>\u603b\u7684\u6765\u8bf4\uff0c\u6743\u5a01DNS\u670d\u52a1\u5668\u5c31\u662f\u5b58\u50a8\u3001\u7ba1\u7406\u5e76\u54cd\u5e94\u7279\u5b9a\u57df\u540d\u4fe1\u606f\u7684\u201c\u6743\u5a01\u201d\u6765\u6e90\u3002</p> <p>\u6211\u4eec\u7684\u6743\u5a01 DNS \u670d\u52a1\u5668\u63d0\u4f9b\u4e86\u4e0e LUG \u6709\u5173\u7684\u57df\u540d\u7684\u76f8\u5173\u89e3\u6790\u4fe1\u606f\uff0c\u540c\u65f6\u4e5f\u662f\u4e00\u4e2a\uff08\u901a\u8fc7\u57df\u540d\uff09\u53ef\u4ee5\u6982\u89c8 LUG \u66fe\u7ecf\u4e0e\u76ee\u524d\u6709\u7684\u670d\u52a1\u7684\u5730\u65b9\u3002</p>"},{"location":"services/#lug-ftp","title":"LUG FTP","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>vdp.s.ustclug.org</code>\uff0cSSH \u7aef\u53e3 2222\u3002\u5bf9\u5916\u63d0\u4f9b HTTP(S)\uff08\u6587\u4ef6\u5217\u8868\uff09\u4e0e FTP \u670d\u52a1\u3002\u540c\u65f6\u63a5\u5165 LDAP\uff0c\u6bcf\u4e2a LDAP \u7528\u6237\u90fd\u53ef\u4ee5\u4f7f\u7528 LUG FTP \u5b58\u50a8\u81ea\u5df1\u7684\u6587\u4ef6\u3002</p> <p>\u4e0e\u6b64\u540c\u65f6\uff0cvdp \u4e5f\u627f\u62c5\u4e86\u4f7f\u7528 NFS \u5411 PVE \u670d\u52a1\u5668\u63d0\u4f9b\u4e00\u90e8\u5206\u5b58\u50a8\u7684\u4efb\u52a1\u3002</p>"},{"location":"services/#gitlab","title":"LUG GitLab","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>gitlab.s.ustclug.org</code>\uff0cSSH \u7aef\u53e3 2222\u3002</p>"},{"location":"services/#revproxy","title":"\u4e3b\u9875\u53cd\u4ee3","text":"<p>\u662f\u591a\u4e2a HTTP \u670d\u52a1\u7684\u5165\u53e3\u3002</p> <p>\u7531\u4e8e\u653f\u7b56\u548c\u5408\u89c4\u6027\u539f\u56e0\uff0c\u6211\u4eec\u5bf9\u4f7f\u7528\u4e3b\u9875\u53cd\u4ee3\u7684\u57df\u540d\u91c7\u7528\u4e86\u5206\u7ebf\u8def\u89e3\u6790\u7684\u65b9\u6848\uff0c\u5176\u4e2d\u7edd\u5927\u90e8\u5206\u57df\u540d\u5728\u6821\u5916\u90fd\u89e3\u6790\u5230 gateway-jp\uff0c\u5728\u6821\u5185\u89e3\u6790\u5230 gateway-nic\u3002\u8fd9\u4e24\u53f0\u670d\u52a1\u5668\u5747\u63a5\u5165 tinc \u5185\u7f51\uff0c\u91c7\u7528\u540c\u4e00\u5957 Nginx \u914d\u7f6e\uff0c\u4e3a\u5185\u7f51\u670d\u52a1\u5668\u63d0\u4f9b HTTP \u53cd\u4ee3\u3002</p> <p>\u5b8c\u6574\u5217\u8868\u8bf7\u5728 auth-dns \u4ed3\u5e93\u5185\u5bfb\u627e CNAME \u5230 <code>gateway.cname.ustclug.org.</code> \u7684\u57df\u540d\u3002</p> <p>\u4e00\u4e9b\u4f8b\u5916\uff1a</p> <ul> <li>\u955c\u50cf\u7ad9\u3001LUG FTP\u3001GitLab \u548c PXE \u7f51\u7edc\u542f\u52a8\uff08\u5b83\u4eec\u5206\u522b\u5404\u81ea\u72ec\u7acb\u8fd0\u884c Nginx\uff09</li> <li>GOsa\u00b2\uff08\u8fd0\u884c\u5728 <code>ldap</code> \u670d\u52a1\u5668\u4e0a\uff0c\u5e76\u4e14\u4f7f\u7528 Apache2\uff0c\u5efa\u8bae\u522b\u52a8\uff09</li> <li>Light</li> <li>\u6280\u672f\u6587\u6863\u3001Linux 101 \u6587\u6863\u7684\u6d77\u5916\u7248\uff08https://101.ustclug.org\uff09\u548c\u5176\u4ed6\u6307\u5411 <code>*.cdn.cloudflare.net.</code> \u7684\u57df\u540d</li> <li>\u5176\u4ed6\u6307\u5411 <code>web-cf.cname.ustclug.org.</code> \u7684\u57df\u540d</li> </ul>"},{"location":"services/#homepage","title":"LUG \u4e3b\u9875","text":"<p>\u540e\u7aef\u662f docker2 \u4e0a\u7684 <code>website</code> \u5bb9\u5668\u3002</p> <p>\u89c1  ustclug/website \u4ed3\u5e93\u7684 README\u3002</p> <p>tky: planet \u73b0\u5728\u7f3a\u4e4f\u7ef4\u62a4\uff0c\u5e0c\u671b\u80fd\u6709\u4eba\u628a\u5b83\u641e\u8d77\u6765\u3002</p>"},{"location":"services/#linux-101","title":"Linux 101","text":"<p>\u540e\u7aef\u662f docker2 \u4e0a\u7684 <code>linux101</code> \u5bb9\u5668\u3002</p> <p>\u89c1  ustclug/Linux101-docs \u4ed3\u5e93\u7684 README\u3002</p>"},{"location":"services/#getvpn","title":"\u7533\u8bf7\u7cfb\u7edf","text":"<p>\u4e00\u4e2a\u4f7f\u7528 Flask \u7f16\u5199\u7684 web \u5e94\u7528\uff0c\u90e8\u7f72\u4e86\u4e24\u5957\uff0c\u5206\u522b\u63d0\u4f9b LUG VPN \u548c Light \u7684\u7533\u8bf7\u670d\u52a1\u3002\u5176\u4e2d\uff1a</p> <ul> <li>LUG VPN \u7684\u7533\u8bf7\u7cfb\u7edf\u8fd0\u884c\u5728 docker2 \u4e0a\uff08<code>lugvpn-web</code>\uff09\uff1b</li> <li>Light \u7684\u7533\u8bf7\u7cfb\u7edf\u8fd0\u884c\u5728 swarm \u4e0a\u3002</li> </ul>"},{"location":"services/#proxy","title":"\u5404\u8def\u53cd\u5411\u4ee3\u7406","text":"<p>\u57df\u540d\uff1a<code>*.proxy.ustclug.org</code></p> <p>\u4f5c\u4e3a\u955c\u50cf\u7ad9\u670d\u52a1\u7684\u4e00\u90e8\u5206\uff0cgateway-jp/nic \u4e5f\u5206\u522b\u4e3a\u6821\u5916\u5185\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u5217\u8868\u7684\u53cd\u5411\u4ee3\u7406\u670d\u52a1\u3002</p>"},{"location":"services/#qt-guide-opensuse-guide","title":"Qt Guide \u548c openSUSE Guide","text":"<p>\u7531 @winland0704 \u8d1f\u8d23\u7f16\u5199\u5185\u5bb9\uff0c\u6211\u4eec\u5e2e\u52a9\u6258\u7ba1\uff0c\u5e73\u65f6\u653e\u7740\u4e0d\u52a8\u5c31\u884c\u3002</p> <p>\u540e\u7aef\u662f docker2 \u4e0a\u7684\u4e24\u4e2a\u5bb9\u5668 <code>qtguide</code> \u548c <code>opensuse-guide</code>\u3002</p>"},{"location":"services/#_1","title":"\u670d\u52a1\u8fd0\u884c\u72b6\u6001\u670d\u52a1\u5668\u9ed1\u677f\u62a5","text":"<p>TODO: servers \u4e0e status \u7684\u5408\u5e76\u5de5\u4f5c\u3002</p>"},{"location":"services/#lug-vpn","title":"LUG VPN","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>vpnstv.s.ustclug.org</code>\uff08\u865a\u62df\u673a\uff0cNIC \u673a\u623f\uff09</p> <p>RADIUS \u8ba4\u8bc1\u670d\u52a1\u5668\uff1a<code>radius.s.ustclug.org</code>\uff0c\u540c\u65f6\u8fd0\u884c\u4e86 FreeRADIUS \u548c\u5b83\u7684 MySQL \u6570\u636e\u5e93\u3002</p> <p>\u53e6\u6709\u65e7\u7684 <code>vpn.s.ustclug.org</code> \u8fd0\u884c\u5728\u4e1c\u56fe\uff0c\u6682\u4e0d\u9700\u8981\u5173\u6ce8\u3002</p>"},{"location":"services/#hackergame","title":"Hackergame","text":"<p>\u76f8\u5173\u5185\u5bb9\u89c1 hackergame \u5185\u90e8\u6587\u6863\u3002</p>"},{"location":"services/#docker2","title":"\u5404\u7c7b Docker \u670d\u52a1","text":"<p>Docker2 \u662f\u4e13\u804c\u8d1f\u8d23\u8fd0\u884c\u5bb9\u5668\u7684\u673a\u5668\u3002</p>"},{"location":"services/#adrain","title":"Adrain","text":"<p>ustcflyer\uff08\u79d1\u5927\u98de\u8dc3\u624b\u518c\u7f51\u7ad9\uff09\u7684\u524d\u8eab\uff0c\u76ee\u524d\u4fdd\u6301\u8fd0\u884c\u3002</p> <p>tky: ustcflyer \u6ca1\u6709\u5b9e\u73b0\u7ed9 session \u5220\u5bf9\u5e94\u8bc4\u8bba\u7684\u529f\u80fd\uff0c\u6240\u4ee5 adrain \u6ca1\u6709\u4e0b\u7ebf\u3002</p>"},{"location":"services/#grafana","title":"Grafana","text":"<p>LUG \u7684\u76d1\u63a7\u7ad9\u70b9\u3002</p>"},{"location":"services/#ldap","title":"LDAP","text":""},{"location":"services/#mail","title":"Mail","text":"<p>\u4e3a\u670d\u52a1\u5668\u3001IPMI \u7b49\u63d0\u4f9b\u7684\u5185\u90e8\u90ae\u4ef6\u670d\u52a1\u3002</p> <p>[WIP]: \u9700\u8981\u8865\u5145</p>"},{"location":"services/#pve","title":"\u865a\u62df\u5316\uff1aPVE \u4e0e PBS","text":"<p>PVE: \u63d0\u4f9b\u865a\u62df\u5316\u652f\u6301\uff1bPBS: PVE \u7684\u865a\u62df\u673a\u5907\u4efd\u3002</p>"},{"location":"services/#pxe","title":"PXE","text":"<p>\u7f51\u7edc\u542f\u52a8\u670d\u52a1\uff0c\u8d1f\u8d23\u4e3a\u5168\u6821\u673a\u5668\u63d0\u4f9b\u63d2\u7f51\u53e3\u5373\u53ef\u5b89\u88c5\u7cfb\u7edf\u7684\u529f\u80fd\uff0c\u4ee5\u53ca\u4e3a\u56fe\u4e66\u9986\u67e5\u8be2\u673a\u63d0\u4f9b\u955c\u50cf\u3002</p>"},{"location":"services/#others","title":"\u5176\u4ed6","text":"<p>\u6b64\u5904\u6240\u5217\u51fa\u7684\u201c\u670d\u52a1\u201d\u6ca1\u6709\u4f7f\u7528\u6211\u4eec\u81ea\u5df1\u7684\u670d\u52a1\u5668\u8d44\u6e90\uff0c\u90fd\u6258\u7ba1\u5728\u5916\u90e8\u5e73\u53f0\u4e0a\uff0c\u4ec5\u57df\u540d\uff08\u5373 DNS\uff09\u7531\u6211\u4eec\u7ef4\u62a4\u3002</p>"},{"location":"services/#documentations","title":"\u6280\u672f\u6587\u6863","text":"<p>\u4e5f\u5c31\u662f\u672c\u6587\u6863\uff0c\u8fd0\u884c\u5728 Cloudflare Pages \u4e0a\u3002</p>"},{"location":"services/#ghauth","title":"GHAuth","text":"<p>https://ghauth.ustclug.org</p> <p>\u7528\u4e8e\u53cc\u5411\u9a8c\u8bc1 GitHub \u8d26\u53f7\u4e0e\u79d1\u5927\u5b66\u53f7\u7684\u670d\u52a1\uff08\u7c7b\u4f3c\u4e8e https://qq.ustc.life\uff09\uff0c\u76ee\u524d\u5904\u4e8e\u95f2\u7f6e\uff0c\u8fd0\u884c\u5728 iBug \u7684 AWS Lambda \u4e0a\u3002</p>"},{"location":"services/#discontinued","title":"\u5df2\u5e9f\u5f03\u670d\u52a1","text":""},{"location":"services/discontinued/","title":"Discontinued Services","text":"<p>\u672c\u9875\u9762\u8bb0\u8f7d\u66fe\u7ecf\u63d0\u4f9b\u7684\u670d\u52a1\uff0c\u4f46\u662f\u7531\u4e8e\u67b6\u6784\u6539\u53d8\u6216\u670d\u52a1\u8fc1\u79fb\uff0c\u8fd9\u4e9b\u670d\u52a1\u4e0d\u518d\u4ee5\u539f\u6765\u7684\u5f62\u5f0f\u63d0\u4f9b\uff0c\u5e76\u53ef\u80fd\u5728\u539f\u5904\u6709\u6b8b\u7559\u7684\u914d\u7f6e\u6587\u4ef6\u3002</p> <p>\u901a\u5e38\u60c5\u51b5\u4e0b\u6b8b\u7559\u7684\u914d\u7f6e\u6587\u4ef6\u53ef\u4ee5\u76f4\u63a5\u5220\u9664\uff0c\u4f46\u662f\u4fdd\u9669\u8d77\u89c1\uff0c\u4ecd\u7136\u5efa\u8bae\u5728 Internals \u7fa4\u91cc\u5148\u8be2\u95ee\u4e00\u4e0b\u518d\u5904\u7406\u3002</p>"},{"location":"services/discontinued/#docker-registry","title":"Docker Registry","text":"<p>\u66fe\u7ecf\u8fd0\u884c\u5728 docker2 \u4e0a\uff0c\u73b0\u5728 LUG \u7684 Docker \u955c\u50cf\u5df2\u8f6c\u79fb\u81f3 Docker Hub\u3002</p>"},{"location":"services/discontinued/#freeshell","title":"Freeshell","text":"<p>\uff08\u672a\u5b8c\u5f85\u7eed\uff0c\u914d\u7f6e\u6587\u4ef6\u5148\u4fdd\u7559\uff09</p>"},{"location":"services/discontinued/#ustc-blog","title":"USTC Blog","text":"<p>Refer to Gitlab Wiki.</p>"},{"location":"services/discontinued/#telegram-web","title":"Telegram Web","text":"<p>Service\uff1atelegram.ustclug.org</p> <p>Repository\uff1agithub.com/ustclug/telegram-web</p> <p>DockerHub\uff1austclug/telegram-web</p> <p>Deployment\uff1atelegram-web.sh</p> <p>Servers\uff1a</p> <ul> <li>swarm.s.ustclug.org\uff08Docker Container\uff09</li> <li>revproxy-el.s.ustclug.org\uff08reverse proxy\uff09</li> </ul> <p>Blog\uff1aadd-telegram-web-service</p>"},{"location":"services/discontinued/#ustc-life","title":"USTC Life","text":"<p>USTC Life is a navigation page, which included useful sites in USTC.</p> <p>Service: ustc.life</p> <p>2020-04-09 \u66f4\u65b0\u4fe1\u606f</p> <p>\u76ee\u524d\uff0cUSTC Life \u670d\u52a1\u6258\u7ba1\u5728 GitHub Pages \u4e0a\uff0c\u4ed3\u5e93\u4e5f\u5df2\u8f6c\u79fb\u81f3  SmartHypercube/ustclife\uff0c\u7531 Hypercube \u8d1f\u8d23\u7ef4\u62a4\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4e3a\u5386\u53f2\u8bb0\u5f55\u3002</p> <p>Git Repository: github.com/ustclug/ustclife</p> <p>DockerHub: ustclug/ustclife</p> <p>server: docker2.s.ustclug.org</p> <p>deploy: /srv/webhook/ustclife.sh</p> <p>webhook from DockerHub: /srv/webhook/hooks.json</p>"},{"location":"services/discontinued/#wordpress-based-serversustclugorg-planetustclugorg","title":"Wordpress-based servers.ustclug.org &amp; planet.ustclug.org","text":"<p>\u4e3a\u4e86\u51cf\u5c0f\u653b\u51fb\u9762\u4e0e\u7ef4\u62a4\u6210\u672c\uff0cservers.ustclug.org \u8fc1\u79fb\u5230\u4e86\u57fa\u4e8e Jekyll \u7684\u65b9\u6848\uff1bplanet.ustclug.org \u5728\u65e9\u524d\u5df2\u7ecf\u6574\u5408\u5230\u4e86 LUG \u4e3b\u7ad9\u4e2d\u3002</p>"},{"location":"services/docker2/","title":"Docker services","text":"<p>Server: docker2.s.ustclug.org</p> <p>Provides Docker container environment for other services. All non-system services should be run as Docker containers on this host.</p> <p>Methods to run individual containers are maintained in the  ustclug/docker-run-script repository.</p>"},{"location":"services/docker2/#special-configurations","title":"Special configurations","text":""},{"location":"services/docker2/#network-interfaces","title":"Network interfaces","text":"<p>We use udev rules to assign consistent names to network interfaces, identified by their MAC addresses.</p> /etc/udev/rules.d/70-persistent-net.rules<pre><code>SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:22\", NAME=\"Telecom\"\nSUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:5b\", NAME=\"Mobile\"\nSUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:5d\", NAME=\"ustclug\"\n</code></pre> <p>We then refer to these interfaces using their new names in <code>/etc/network/interfaces</code> to ensure consistent network configuration.</p> <p>2022 \u5e74 2 \u6708 21 \u65e5\u66f4\u65b0</p> <p>\u4eca\u65e5\u53d1\u73b0 docker2 \u65e0\u6cd5\u8fde\u63a5\u5bb9\u5668\u7f51\u7edc\uff0810.254.1.0/21\uff09\uff0c\u8c03\u8bd5\u540e\u53d1\u73b0\u4e3a Linux macvlan \u7f51\u7edc\u7279\u6027\uff08Stack Overflow\uff09\u3002\u4e3a\u4e86\u4fee\u590d\u8fde\u63a5\u95ee\u9898\uff0c\u8fdb\u884c\u4e86\u4ee5\u4e0b\u4fee\u6539\uff1a</p> <ol> <li>\u5c06 <code>/etc/udev/rules.d/70-persistent-net.rules</code> \u4e2d <code>Policy</code> \u66f4\u540d\u4e3a <code>ustclug</code>\uff1b</li> <li> <p>\u5728 <code>/etc/network/interfaces</code> \u4e2d\u8bbe\u7f6e <code>Policy</code> \u548c <code>ustclug</code> \u4e24\u4e2a interface \u7684\u76f8\u5173\u914d\u7f6e\u5982\u4e0b\uff1a</p> <pre><code>auto Policy\niface Policy inet static\n    address 10.254.0.16/21\n    pre-up ip link add $IFACE link ustclug type macvlan mode bridge\n    post-down ip link del $IFACE\n\nauto ustclug\niface ustclug inet manual\n</code></pre> </li> </ol>"},{"location":"services/docker2/#docker-daemon-service","title":"Docker daemon service","text":"<p>docker2 \u4e0a\u9762\u7684 Docker \u4f7f\u7528 macvlan \u6765\u5c06\u865a\u62df\u673a\u63a5\u5165 lugi \u5185\u7f51\uff0c\u56e0\u6b64\u5c06 macvlan \u7684\u4e3b\u7aef\u53e3 Policy \u914d\u7f6e\u4e3a <code>docker.service</code> \u7684\u5f3a\u4f9d\u8d56\u3002</p> systemctl edit docker.service<pre><code>[Unit]\nBindsTo=sys-subsystem-net-devices-Policy.device\nAfter=sys-subsystem-net-devices-Policy.device\n</code></pre> <p>\u5b9e\u9645\u4e0a <code>After=network-online.target</code> \u5c31\u591f\u4e86\uff0c\u4f46\u662f\u51fa\u4e8e\u5386\u53f2\u539f\u56e0\u4f7f\u7528\u4e86 <code>BindsTo</code> \u5f3a\u4f9d\u8d56\u5185\u7f51\u7aef\u53e3\uff0c\u8fd9\u662f\u56e0\u4e3a docker2 \u66fe\u7ecf\u5355\u72ec\u8fd0\u884c tinc \u63a5\u5165\u5185\u7f51\uff0c\u800c tinc \u7684\u7aef\u53e3\u53ea\u5728 tinc \u542f\u52a8\u540e\u624d\u4f1a\u51fa\u73b0\uff08\u624d\u80fd\u5206\u51fa macvlan \u5b50\u7aef\u53e3\uff09\uff0c\u56e0\u6b64\u4f7f\u7528 <code>BindsTo</code> \u4fdd\u8bc1 docker \u968f\u8be5\u7aef\u53e3\u7684\u51fa\u73b0\u548c\u6d88\u5931\u800c\u542f\u52a8/\u505c\u6b62\u3002</p> <p>2022 \u5e74 1 \u6708 15 \u65e5\u4ee5\u540e docker2 \u4e0e\u5176\u4ed6\u865a\u62df\u673a\u4e00\u6837\u901a\u8fc7 gateway-nic \u6865\u63a5\u7684 tinc \u63a5\u5165\u5185\u7f51\uff0c\u4e0d\u518d\u5355\u72ec\u8fd0\u884c tinc\u3002</p>"},{"location":"services/docker2/#opensuse-guide-qtguide","title":"opensuse-guide \u4e0e qtguide \u6bcf\u65e5\u66f4\u65b0","text":"<p>\u7531\u4e8e\u6ca1\u6709\u8bbe\u7f6e webhook\uff0c\u76ee\u524d\u914d\u7f6e\u4e86 systemd timer\uff0c\u6267\u884c <code>/srv/docker/guide</code> \u4e2d\u7684\u811a\u672c\uff0c\u4ee5\u5206\u522b\u5728\u6bcf\u65e5\u665a\u4e0a 23:15 \u548c 23:30 \u66f4\u65b0 opensuse-guide \u548c qtguide \u4e24\u4e2a\u5bb9\u5668\u7684 image \u5e76\u91cd\u542f\u5bb9\u5668\u3002</p> <p>\u8be6\u7ec6\u7684\u914d\u7f6e\u6587\u4ef6\u53ef\u67e5\u770b docker-run-script \u4e2d\u7684 opensuse-guide \u548c qtguide \u4e24\u4e2a\u6587\u4ef6\u5939\u3002</p>"},{"location":"services/docker2/#workflows-troubleshooting","title":"Workflows &amp; Troubleshooting","text":""},{"location":"services/docker2/#docker-pingd","title":"Docker \"pingd\"","text":"<p>\u66f4\u65b0</p> <p>\u95ee\u9898\u5df2\u7ecf\u67e5\u660e\u4e3a Debian \u7684 Linux \u5185\u6838 bug (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=952660)\uff0c\u5df2\u7ecf\u901a\u8fc7\u66f4\u65b0\u5185\u6838\u5e76\u91cd\u542f\u800c\u89e3\u51b3\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u5b58\u6863\u3002</p> <p>\u51fa\u4e8e\u672a\u77e5\u539f\u56e0\u6709\u65f6\u5019\u5916\u90e8\u4e3b\u673a\u4f1a\u65e0\u6cd5\u4e3b\u52a8\u8fde\u901a Docker \u5bb9\u5668\uff08\u53ef\u80fd\u4e0e ARP \u6709\u5173\uff09\uff0c\u4f46\u662f\u5982\u679c\u67d0\u4e2a\u5bb9\u5668\u5148 ping \u4e86\u4e00\u4e0b\u5916\u90e8\u4e3b\u673a\uff0c\u5c31\u80fd\u53cc\u5411\u8fde\u901a\u4e86\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u6682\u672a\u627e\u5230\u6b63\u5e38\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u56e0\u6b64\u4f7f\u7528 \u201cping daemon\u201d \u4f5c\u4e3a\u4e00\u4e2a workaround\uff0c\u5728\u5bb9\u5668\u4e2d\u8fd0\u884c ping \u4fdd\u6301\u5916\u90e8\u4e3b\u673a\u7684\u8fde\u901a\u6027\u3002</p> docker-pingd@.service<pre><code>[Unit]\nDescription=Docker pingd service %I\nDocumentation=man:ping(8)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nUser=root\nGroup=root\nExecStart=/bin/sh -c 'IVAR=\"%i\"; exec /usr/bin/docker exec \"$${IVAR%:*}\" ping -q -s 32 \"$${IVAR#*:}\"'\nExecStop=/bin/kill -s INT $MAINPID\nRestart=on-failure\nRestartSec=3\n\n[Install]\nWantedBy=multi-user.target\nAlias=docker-ping@.service\n</code></pre> <p>\u4f7f\u7528\u65b9\u5f0f\uff1a<code>systemctl enable docker-pingd@container:host.service</code>\uff0c<code>container</code> \u6362\u6210\u5bb9\u5668\u540d\uff0c<code>host</code> \u6362\u6210 ping \u7684\u76ee\u6807\u3002</p> <p>Trick \u4ecb\u7ecd\uff1aSystemd service \u914d\u7f6e\u6682\u4e0d\u652f\u6301\u591a\u4e2a\u6a21\u677f\u53c2\u6570 <code>%i</code>\uff0c\u56e0\u6b64\u8c03\u7528 shell \u6765\u89e3\u6790\u53c2\u6570\u3002Ref: https://github.com/systemd/systemd/issues/14895#issuecomment-612270690</p>"},{"location":"services/docker2/#wordpress","title":"WordPress \u5347\u7ea7","text":"<p>taoky</p> <p>\u5f88\u9ebb\u70e6\uff0c\u5efa\u8bae lug \u4ee5\u540e\u518d\u4e5f\u522b\u7528\uff08\u522b\u5f00\u65b0\u7684\uff09wordpress \u4e86\u3002</p> <p>servers \u4e0e\u65e7 planet \u4f7f\u7528 WordPress\uff0c\u6258\u7ba1\u5728 docker2 \u4e0a\u3002\u56e0\u4e3a docker2 \u73b0\u5728\u78c1\u76d8 IO \u5f88\u6162\uff0c\u6240\u4ee5\u53ef\u80fd\u4f1a\u51fa\u73b0\u4e00\u4e9b\u989d\u5916\u7684\u95ee\u9898\u3002</p> <p>\u63a8\u8350\u4f7f\u7528 https://wp-cli.org/#installing\u3002\u547d\u4ee4\uff1a</p> <pre><code>chmod +x wp-cli.phar\nmv wp-cli.phar /usr/local/bin/wp\ncd /var/www/public/\nsudo -u www-data -- wp core update --version=5.8.1 /tmp/wordpress-5.8.1.zip\n</code></pre> <p>\u5bb9\u5668\u91cc sudo \u8981\u624b\u52a8\u88c5\u3002</p> <p>\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f9b\u53c2\u8003\u3002</p> <p>\u5c1d\u8bd5\u5347\u7ea7\u65f6\u5982\u679c\u672a\u51fa\u73b0\u5347\u7ea7\u63d0\u793a\uff0c\u53ef\u4ee5\u4fee\u6539\uff1a</p> <ul> <li>\u6587\u4ef6 <code>wp-includes/update.php</code>\uff0c\u5c06\u51fd\u6570 <code>wp_version_check()</code> \u4e2d <code>$doing_cron ? 3 : 30</code> \u4fee\u6539\u4e3a <code>$doing_cron ? 30 : 30</code>\u3002</li> <li>\u6587\u4ef6 <code>wp-admin/includes/update.php</code>\uff0c\u5c06\u51fd\u6570 <code>get_core_checksums()</code> \u4e2d\u5bf9\u5e94\u7684\u90e8\u5206\u4fee\u6539\u4e3a <code>$doing_cron ? 30 : 30</code>\u3002</li> </ul> <p>\u5982\u679c\u51fa\u73b0\u300c\u53e6\u4e00\u66f4\u65b0\u6b63\u5728\u8fd0\u884c\u300d\uff0c\u4e14\u786e\u8ba4\u4e0d\u5728\u66f4\u65b0\uff0c\u53ef\u4ee5\u5728\u6570\u636e\u5e93\u7684 <code>wordpress</code> \u8868\u4e2d\u6267\u884c\uff1a</p> <pre><code>DELETE FROM wp_options WHERE option_name = 'core_updater.lock';\n</code></pre>"},{"location":"services/docker2/#docker","title":"\u770b\u8d77\u6765\u6b63\u5728\u8fd0\u884c\u4f46\u662f\u6ca1\u6709\u8fdb\u7a0b\u7684 Docker \u5bb9\u5668","text":"<p>2021/10/25 \u53d1\u73b0\u67d0\u5bb9\u5668\u663e\u793a\u6b63\u5728\u8fd0\u884c\uff0c\u4f46\u662f\u5b9e\u9645\u6ca1\u6709\u8fdb\u7a0b\u3002\u540e\u53d1\u73b0\u4e3a Docker \u7684 bug\uff0c\u5728\u5bb9\u5668\u8fdb\u7a0b\u88ab cgroups \u5e72\u6389\u4e4b\u540e\u53ef\u80fd\u4f1a\u51fa\u73b0\u6b64\u60c5\u51b5\u3002</p> <p>\u5bf9\u5e94 issue\uff1ahttps://github.com/moby/moby/issues/38501</p> <p>\u89e3\u51b3\u65b9\u6cd5\uff1a\u5c06\u5bb9\u5668 ID \u5bf9\u5e94\u7684 <code>containerd-shim</code> \u6740\u6b7b\u5373\u53ef\u8ba9 Docker \u66f4\u65b0\u5176\u72b6\u6001\u4e3a\u5df2\u505c\u6b62\uff0c\u7136\u540e\u91cd\u65b0\u5f00\u542f\u5373\u53ef\u3002</p>"},{"location":"services/documentations/","title":"LUG \u6587\u6863","text":""},{"location":"services/ftp/","title":"LUG FTP","text":"<p>Services: FTP/FTPS, SFTP, HTTP, HTTPS, AFP</p> <p>Git repository: ustclug/lugftp</p> <p>Docker Hub: ustclug/ftp</p> <p>Server: vdp.s.ustclug.org (management ssh port 2222)</p> <p>Theme: h5ai</p> <p>Deploy: ftp.sh</p>"},{"location":"services/ftp/#notes","title":"Notes","text":"<ol> <li>SSL cert is required when running LUG FTP.</li> <li><code>ssh-keygen -A</code> is required to be manually run when initializing.</li> <li>About directory permission:<ol> <li>It is strongly suggested to keep permission &amp; owner metadata when backing up/restoring.</li> <li>Public folder root: set owner <code>root:root</code> and permission 0755.</li> <li>Subfolders: set owner to <code>1000:1000</code>. <code>_h5ai</code> and <code>wp-content</code> needs to be set to a different owner (misconfigured?). And <code>Incoming</code> shall be set to 0775.</li> </ol> </li> <li>Do not use Google DNS in host, as China Mobile network may drop UDP packets to 8.8.8.8. A misconfigured DNS may lead to LDAP in container broken.</li> <li>Port 22 is delegated to the LUG FTP container for SFTP, and SSH access to the host has been reassigned to port 2222.</li> </ol>"},{"location":"services/gateway-el/","title":"Gateway: East Campus Library (<code>gateway-el</code>)","text":"<p>Todo</p> <p>Currently <code>systemctl restart networking</code> is required after a reboot to set up tunnel. This bug should be fixed.</p>"},{"location":"services/gateway-el/#configurations","title":"Configurations","text":""},{"location":"services/gateway-el/#ip-virtual-server","title":"IP Virtual Server","text":"<p>gateway-el uses IPVS to send requests from one port to other machines directly. IPVS is a Linux kernel feature. Use <code>ipvsadm -Ln</code> to get its status.</p>"},{"location":"services/gateway-el/#tunnelmonitor","title":"tunnelmonitor","text":"<p>The tunnels used by <code>gateway-el</code> is mainly maintained by tunnelmonitor. Its config files are in <code>/etc/tunnelmonitor</code>, service is <code>tunnelmonitor.service</code>, and log is <code>/var/log/tunnel_monitor.log</code>.</p> <p>When starting, <code>netfilter-persistent.service</code> should be run before <code>tunnelmonitor</code>. <code>tunnelmonitor</code> generates new mangle chains when starting, and pings all tunnels periodically and selects all available tunnels, and generates <code>statistc</code> rules.</p> <p>You check check <code>/var/log/tunnel_monitor.log</code> to see if one tunnel has been down. Currently (2021/09), only one tunnel is available among all tunnel settings in <code>/etc/tunnelmonitor/tunnel.ini</code>.</p>"},{"location":"services/gateway-el/#iptables-mangle-rt_tables-and-ip-rule","title":"iptables mangle, rt_tables and ip rule","text":"<p>The following example is for demonstration purposes only.</p> <p>You can get current status by <code>iptables -t mangle -S</code>. It is expected to see something like this:</p> <pre><code>-A DemonstrateManglePrerouting -m statistic --mode nth --every 1 --packet 0 -j MARK --set-xmark 0x12345/0xffffffff\n// ...\n-A PREOUT -m mark --mark 0x0 -j DemonstrateManglePrerouting\n</code></pre> <p>In this case, all packages to <code>DemonstrateManglePrerouting</code> chain will get <code>fwmark</code> <code>0x12345</code> (= <code>74565</code>).</p> <p>Check <code>ip rule</code> for that:</p> <pre><code>// ...\n10: from all fwmark 0x12345 lookup ExtraDemoTunnel\n// ...\n</code></pre> <p>You can get tunnel information in <code>ip a</code>:</p> <pre><code>29: ExtraDemoTunnel: &lt;POINTOPOINT,NOARP,UP,LOWER_UP&gt; mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000\n    link/none\n    inet 192.168.252.17 peer 192.168.253.17/32 brd 192.168.252.17 scope global ExtraDemoTunnel\n       valid_lft forever preferred_lft forever\n</code></pre> <p>Here <code>192.168.252.17</code> is the local server of tunnel, and <code>192.168.253.17</code> is the remote server.</p> <p>Let's check <code>/etc/network/interfaces.d</code>:</p> /etc/network/interfaces.d/03ExtraDemoTunnel<pre><code>auto ExtraDemoTunnel\niface ExtraDemoTunnel inet static\n    address 192.168.252.17\n    netmask 255.255.255.255\n    pre-up ip link add dev $IFACE type wireguard\n    post-down ip link del dev $IFACE\n    up wg set $IFACE listen-port 4601 private-key /etc/wireguard/privkey peer pkeypkeypkeypkeypkeypkeypkeypkeypkeypkeypkey endpoint 23.3.3.3:4600 allowed-ips 0.0.0.0/0\n    up ip route replace default dev $IFACE table $IFACE\n    up ip rule add from all fwmark 74565 table $IFACE prio 10\n    pointopoint 192.168.253.17\n</code></pre> <p>Here we know that this is a wireguard tunnel, and the endpoint is <code>23.3.3.3:4600</code>. The fwmark here is <code>74565</code> (in decimal).</p> <p>Why is <code>74565</code> set? Let's check <code>/etc/iproute2/rt_tables</code>!</p> <pre><code>// ...\n74565   ExtraDemoTunnel\n// ...\n</code></pre> <p>For wireguard, you can use <code>wg</code> to check status. If you find that the \"received\" is 0 in transferred, something is going wrong.</p>"},{"location":"services/gateway-el/#nginx","title":"Nginx","text":""},{"location":"services/gateway-el/#ustclugorg-issue","title":"ustclug.org issue","text":"<p>See Gateway-NIC</p>"},{"location":"services/gateway-el/#issues","title":"Issues &amp; resolution","text":""},{"location":"services/gateway-el/#ipvs-conntrack","title":"IPVS Conntrack","text":"<p>In early March 2022 we noticed Light connectivity issues from outside USTCnet, which was narrowed down to connections bypassing Linux Conntrack mechanism.</p> <p>Thanks to TUNA group we learned about <code>/proc/sys/net/ipv4/vs/conntrack</code>, which at the time the problem was located, was zero. Settings this to 1 solved the problem.</p> <p>However after writing <code>net.ipv4.vs.conntrack = 1</code> to <code>/etc/sysctl.d/10-ipvs-conntrack.conf</code> and rebooting, the problem returned. Checking <code>systemctl status systemd-sysctl.service</code> we noticed this:</p> <pre><code>Mar 05 00:00:00 gateway-el systemd-sysctl[218]: Couldn't write '0' to 'net/ipv4/vs/conntrack', ignoring: No such file or directory\n</code></pre> <p>Adding <code>ip_vs</code> to <code>/etc/modules</code> and rebooting again correctly fixed the problem.</p> <p>This is because the module was automatically loaded the first time <code>ipvsadm</code> is called (namely, <code>/etc/init.d/ipvsadm</code>), which happened at a very late stage. Adding to <code>/etc/modules</code> gets the module loaded earlier (and before <code>systemd-sysctl.service</code>) so it worked.</p>"},{"location":"services/gateway-el/#tinc-issue","title":"Tinc issue","text":"<p>See gateway</p>"},{"location":"services/gateway-jp/","title":"Gateway: Japan (<code>gateway-jp</code>)","text":"<p>This page is currently a stub.</p>"},{"location":"services/gateway-nic/","title":"Gateway: Network Information Center (<code>gateway-nic</code>)","text":"<p>Previously gateway-nic used CentOS 7 to 8 to Stream, to \"avoid putting all eggs in one basket\". This VM was replaced by a newly setup Debian Bullseye VM on January 2022 during migration from ESXi to Proxmox VE.</p> <p>The virtual disk of the old gateway-nic was copied onto pve-5, located at ZFS Zvol <code>rpool/data/gateway-nic</code>. The current VM uses <code>rpool/data/vm-200-disk-0</code> instead (Proxmox naming convention).</p>"},{"location":"services/gateway-nic/#config-file-management","title":"Config file management","text":"<p>Git repositories exist for these directories:</p> <pre><code>/etc/nginx\n/etc/systemd/network\n/etc/tinc\n</code></pre>"},{"location":"services/gateway-nic/#networking","title":"Networking","text":"<p>We use systemd-networkd to configure network on gateway-nic. This replaces both <code>ifupdown</code> (config file <code>/etc/network/interfaces</code>)</p> $ systemctl edit systemd-networkd.service<pre><code>[Service]\nExecStartPre=-/sbin/ip -4 rule flush\nExecStartPre=-/sbin/ip -6 rule flush\n\n[Install]\nAlias=networkd.service\n</code></pre> <p>The <code>ExecStartPre=</code> commands flush (clear) existing rules so that systemd-networkd can fully manage all rules. This is because <code>ManageForeignRoutingPolicyRules</code> is a new setting in systemd 249, while Debian Bullseye uses systemd 247, so we have to do this manually.</p> <p>We then load the regular \"main\" and \"default\" rules on the loopback interface (routing rules aren't bound to interfaces, but are added/removed when the configured interface is brought up/turned down).</p> /etc/systemd/network/00-lo.network<pre><code>[Match]\nName=lo\n\n# Route \"main\"\n[RoutingPolicyRule]\nFamily=both\nTable=254\nPriority=2\nSuppressPrefixLength=1\n\n# Route \"Special\"\n[RoutingPolicyRule]\nFamily=both\nTable=1000\nPriority=5\nSuppressPrefixLength=1\n\n# Route \"default\"\n[RoutingPolicyRule]\nFamily=both\nTable=253\nPriority=32767\n</code></pre>"},{"location":"services/gateway-nic/#interfaces","title":"Interfaces","text":"<p>Systemd-networkd has built-in capability to rename interfaces, so there's no need to use udev rules.</p> <p>For example, to assign a name for the cernet interface, we use:</p> /etc/systemd/network/12-Cernet.link<pre><code>[Match]\nPermanentMACAddress=00:50:56:a2:02:8c\n\n[Link]\nName=Cernet\n</code></pre> <p>We then configure addresses and routing rules for this interface:</p> /etc/systemd/network/12-Cernet.network <pre><code>[Match]\nName=Cernet\n\n[Network]\nAddress=202.38.95.102/25\nAddress=2001:da8:d800:95::102/64\nIPv6AcceptRA=no\n\n[Route]\nGateway=202.38.95.126\nTable=253\nMetric=2\n\n[Route]\nGateway=2001:da8:d800:95::1\nTable=253\nMetric=2\n\n[Route]\nGateway=202.38.95.126\nTable=1002\n\n[Route]\nGateway=2001:da8:d800:95::1\nTable=1002\n\n[RoutingPolicyRule]\nFrom=202.38.95.102\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFrom=2001:da8:d800:95::102\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFamily=both\nOutgoingInterface=Cernet\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFamily=both\nFirewallMark=0x2\nTable=1002\nPriority=4\n</code></pre> <p>This config file assigns one IPv4 and one IPv6 address to the interface, as well as one IPv4 route and one IPv6 route for both the default routing table and an interface-specific routing table. It then adds three routing rules in both IPv4 and IPv6 for replying on the same interface, for sockets bound to this interfaces, and for firewall mark routing.</p> <p>Other interfaces are configured similarly, so just refer to their configuration files for details.</p>"},{"location":"services/gateway-nic/#routes","title":"Routes","text":"<p>Outgoing connections are routed through different ISPs. We use ISP IP data from gaoyifan/china-operator-ip. Relevant files are located under <code>/usr/local/network_config</code>.</p> <p>The said repository (branch <code>ip-lists</code>) is cloned and we symlink select files to <code>iplist</code> directory for consumption. A custom script converts these IP data into additional systemd-networkd config files (under <code>/run/systemd</code>).</p> $ ls -l /usr/local/network_config/iplist/<pre><code>lrwxrwxrwx cernet.txt -&gt; ../china-operator-ip/cernet.txt\nlrwxrwxrwx cernet6.txt -&gt; ../china-operator-ip/cernet6.txt\nlrwxrwxrwx china.txt -&gt; ../china-operator-ip/china.txt\nlrwxrwxrwx china6.txt -&gt; ../china-operator-ip/china6.txt\nlrwxrwxrwx cstnet.txt -&gt; ../china-operator-ip/cstnet.txt\nlrwxrwxrwx cstnet6.txt -&gt; ../china-operator-ip/cstnet6.txt\nlrwxrwxrwx mobile.txt -&gt; ../china-operator-ip/cmcc.txt\nlrwxrwxrwx telecom.txt -&gt; ../china-operator-ip/chinanet.txt\nlrwxrwxrwx unicom.txt -&gt; ../china-operator-ip/unicom.txt\n-rw-r--r-- ustcnet.txt\n-rw-r--r-- ustcnet6.txt\n</code></pre> /usr/local/network_config/route-all.sh<pre><code>#!/bin/bash\n\n[ -n \"$BASH_VERSION\" ] || exit 1\n\nWD=\"$(dirname \"$0\")\"\nROOT_IP_LIST=\"$WD/iplist\"\nROOT_CONF=/etc/systemd/network\nROOT_RT=/run/systemd/network\n\ngen_route() {\n  local DEVFILE=\"$1\"\n  local DEV=\"$(awk -F = '/^Name=/{print $2; exit}' \"$ROOT_CONF/$DEVFILE.network\")\"\n  local GW=\"$2\" FAMILY=ipv4 V6\n  if [[ \"$GW\" =~ : ]]; then\n    FAMILY=ipv6\n    V6=\"-v6\"\n  fi\n  # Convert table to number\n  local TABLENAME=\"$3\"\n  local TABLE=\"$(awk 'substr($0, 1, 1) != \"#\" &amp;&amp; $2 == \"'\"$TABLENAME\"'\" { print $1 }' /etc/iproute2/rt_tables | head -1)\"\n  local PRIORITY=\"$4\"\n  shift 4\n\n  F=\"$ROOT_RT/$DEVFILE.network.d\"\n  mkdir -p \"$F\"\n  F=\"$F/route-${TABLENAME,,}${V6}.conf\"\n  echo -e \"[RoutingPolicyRule]\\nFamily=$FAMILY\\nTable=$TABLE\\nPriority=$PRIORITY\\n\" &gt; \"$F\"\n\n  awk '{ print \"[Route]\\nDestination=\" $1 \"\\nGateway='\"$GW\"'\\nTable='\"$TABLE\"'\\n\" }' \"${@/#/$ROOT_IP_LIST/}\" &gt;&gt; \"$F\"\n}\n\ngen_route 12-Cernet 202.38.95.126 ustcnet 5 ustcnet.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 ustcnet 5 ustcnet6.txt\ngen_route 12-Cernet 202.38.95.126 cernet 6 cernet.txt cstnet.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 cernet 6 cernet6.txt cstnet6.txt\ngen_route 13-Telecom 202.141.160.126 telecom 6 telecom.txt unicom.txt\ngen_route 14-Mobile 202.141.176.126 mobile 6 mobile.txt\ngen_route 12-Cernet 202.38.95.126 china 7 china.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 china 7 china6.txt\n</code></pre> <p>We then use a systemd service to ensure additional files for systemd-networkd are generated before it starts.</p> /etc/systemd/system/route-all.service<pre><code>[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\n#ExecStart=/usr/local/network_config/special.rb\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\n</code></pre> <p>Updating routes from upstream is easy:</p> /usr/local/network_config/update.sh<pre><code>#!/bin/sh\n\ncd \"$(dirname \"$0\")\"\n\ngit -C china-operator-ip pull\nsystemctl restart route-all.service\n</code></pre> <p>The resulting routing policies look like this:</p> $ ip rule<pre><code>0:      from all lookup local\n2:      from all lookup main suppress_prefixlength 1\n3:      from 172.16.0.2 lookup Warp\n3:      from all oif Warp lookup Warp\n3:      from 202.141.176.102 lookup Mobile\n3:      from all oif Mobile lookup Mobile\n3:      from 202.141.160.102 lookup Telecom\n3:      from all oif Telecom lookup Telecom\n3:      from 202.38.95.102 lookup Cernet\n3:      from all oif Cernet lookup Cernet\n4:      from all fwmark 0x5 lookup Warp\n4:      from all fwmark 0x4 lookup Mobile\n4:      from all fwmark 0x3 lookup Telecom\n4:      from all fwmark 0x2 lookup Cernet\n5:      from all lookup Special suppress_prefixlength 1\n5:      from all lookup Ustcnet\n6:      from all lookup mobile\n6:      from all lookup telecom\n6:      from all lookup cernet\n7:      from all lookup china\n32767:  from all lookup default\n</code></pre>"},{"location":"services/gateway-nic/#tinc-vpn","title":"Tinc VPN","text":"<p>Gateway-NIC connects to intranet with Tinc. There's no special Tinc configuration other than those described at the Tinc VPN page.</p> <p>Because Tinc now uses systemd services instead of System V <code>init.d</code> scripts, we need to <code>systemctl enable tinc@ustclug.service</code> to make it start on boot. Everything is managed through this templated systemd service.</p>"},{"location":"services/gateway-nic/#systemd-networkd-wait-onlineservice","title":"systemd-networkd-wait-online.service","text":"<p>We also override systemd-networkd's online detection for goodness' sake, so it doesn't block booting. Note that it may interfere with services depending on <code>network-online.target</code>, though we have yet to discover any issues.</p> $ systemctl edit systemd-networkd-wait-online.service<pre><code>[Service]\nExecStart=\nExecStart=/bin/sleep 1\n</code></pre>"},{"location":"services/gateway-nic/#iptables","title":"iptables","text":"<p>All iptables firewall rules are managed manually. We use <code>iptables-persistent</code> to automatically load firewall rules on boot.</p> <p>To change the rules, manually edit <code>/root/iptables/rules.v4</code> or <code>rules.v6</code> and then run <code>apply.sh</code> to apply the changes.</p>"},{"location":"services/gateway-nic/#fail2ban","title":"Fail2ban","text":"<p>We use fail2ban to stop SSH scanning and brute-force attempts.</p> <p>Because fail2ban relies on changing iptables to work, to improve its performance as well as minimize its tampering of iptables rules, we use ipsets for fail2ban.</p> <p>After stock installation of <code>fail2ban</code> package, remove <code>defaults-debian.conf</code> and add this file to secure SSH daemon:</p> /etc/fail2ban/jail.d/sshd.conf<pre><code>[sshd]\nenabled = true\nmode    = aggressive\nfilter  = sshd[mode=%(mode)s]\nlogpath = /var/log/auth.log\nbackend = pyinotify\naction  = iptables-ipset-proto6[chain=\"fail2ban\"]\n</code></pre> <p>We provide a pre-created empty chain named <code>fail2ban</code> for fail2ban to manipulate (see iptables above).</p> <p>To make sure fail2ban rules can be re-applied after reloading iptables manually, we override the systemd service so that fail2ban is restarted whenever the iptables service is restarted.</p> $ systemctl edit fail2ban.service<pre><code>[Unit]\nAfter=netfilter-persistent.service\nBindsTo=netfilter-persistent.service\n</code></pre> <p>For some servers where we want to manually start fail2ban, we use <code>Requires=</code> + <code>PartOf=</code>. This will propagate \"restart\" event from iptables to fail2ban, but not \"start\".</p> $ systemctl edit fail2ban.service<pre><code>[Unit]\nAfter=netfilter-persistent.service\nRequires=netfilter-persistent.service\nPartOf=netfilter-persistent.service\n</code></pre>"},{"location":"services/gateway-nic/#nginx","title":"Nginx","text":""},{"location":"services/gateway-nic/#unregistered-domain-traffic","title":"ustclug.org issue","text":"<p>To mitigate the issue of the complaints from ISPs and the regulation authorities caused by the gateways in USTCnet responding to the requests for <code>ustclug.org</code>, which is a unregistered domain in China MIIT, we make nginx listen on an alternative port 81/444 for HTTP and HTTPS respectively, to response to the requests for <code>lug.ustc.edu.cn</code> only, and rejecting the handshake for any other domain.</p> /etc/nginx/sites-available/default<pre><code>server {\n  listen 81 default_server;\n  listen [::]:81 default_server;\n  listen 444 ssl http2 default_server;\n  listen [::]:444 ssl http2 default_server;\n  server_name _;\n  ssl_reject_handshake on; \n  return 444;\n}\n</code></pre> <p>To whitelist any domain, add <code>listen 81</code> and <code>listen 444 http2 ssl</code> to corresponding site's server block.</p> <p>We use iptables to redirect any traffic from outside USTCnet whose destination is TCP port 80/443 on local machine to TCP port 81/444 respectively.</p> <pre><code>-A PREROUTING -m addrtype --dst-type LOCAL -j NGINX-REDIRECT\n-A NGINX-REDIRECT -i lo -j RETURN\n-A NGINX-REDIRECT -m set --match-set ustcnet src -j RETURN\n-A NGINX-REDIRECT -p tcp --dport 80 -j REDIRECT --to-port 81\n-A NGINX-REDIRECT -p tcp --dport 443 -j REDIRECT --to-port 444\n</code></pre>"},{"location":"services/generate-204/","title":"Generate 204","text":"<p>Service: 204.ustclug.org (HTTP / HTTPS)</p> <p>Server: (gateway)</p> <p>Blog: add-http-204-service</p>"},{"location":"services/generate-204/#configration","title":"Configration","text":"/etc/nginx/sites-available/204.ustclug.org<pre><code>server {\n    listen      80;\n    listen      [::]:80;\n    listen      443 ssl http2;\n    listen      [::]:443 ssl http2;\n    server_name 204.ustclug.org;\n    access_log  /var/log/nginx/204_access.log;\n    error_log   /var/log/nginx/204_error.log;\n    return 204;\n}\n</code></pre> <p>The authoritative copy is on LUG GitLab.</p>"},{"location":"services/gitlab/","title":"GitLab","text":"<p>Server: gitlab.s.ustclug.org (management ssh port 2222)</p> <p>Git Repository: gitlab-scripts</p>"},{"location":"services/gitlab/#gitlab-security","title":"GitLab &amp; Security","text":"<p>GitLab \u7ef4\u62a4\u8005\u9700\u8981\u8ba2\u9605\uff1a</p> <ol> <li>GitLab Security Notices \u90ae\u4ef6\u5217\u8868 (https://about.gitlab.com/company/contact/ \u53f3\u4fa7 \"Sign up for security notices\")</li> <li> sameersbn/docker-gitlab Releases (Watch \u2192 Custom \u2192 Releases)</li> </ol> <p>\u5728 GitLab \u6709 Security Release \u4e14 docker-gitlab \u53d1\u5e03\u65b0\u7248\u672c\u4e4b\u540e\u9700\u8981\u5b89\u6392\u65f6\u95f4\u66f4\u65b0\u3002\u5c24\u5176 Critical Security Release \u9700\u8981\u5c3d\u5feb\u627e\u65f6\u95f4\u66f4\u65b0\u3002</p>"},{"location":"services/gitlab/#_1","title":"\u66f4\u65b0","text":"<p>\uff08\u5efa\u8bae\u9605\u8bfb https://docs.gitlab.com/ee/update/index.html\uff0c\u4ee5\u53ca GitLab \u5b98\u65b9\u7684\u5347\u7ea7\u8def\u5f84\u5206\u6790\u5de5\u5177\uff1ahttps://gitlab-com.gitlab.io/support/toolbox/upgrade-path/\uff09</p> <p>GitLab 16.0 \u8d77\u79fb\u9664\u4e86\u5bf9 CAS3 \u7684\u652f\u6301\uff0c\u56e0\u6b64\u6211\u4eec\u5207\u6362\u5230\u4e86 OAuth2 \u6765\u5bf9\u63a5\u4e2d\u56fd\u79d1\u5b66\u6280\u672f\u5927\u5b66\u7edf\u4e00\u8eab\u4efd\u8ba4\u8bc1\u3002\u4e3a\u4e86\u5b9e\u73b0\u81ea\u5b9a\u4e49 OAuth2 \u767b\u5f55\u53c2\u6570\uff0c\u6211\u4eec fork \u4e86 sameersbn/docker-gitlab\uff0c\u4ed3\u5e93\u4f4d\u4e8e ustclug/docker-gitlab\u3002\u66f4\u65b0\u65f6\uff0c\u9700\u8981\u9996\u5148\u6309\u7167 ustclug/docker-gitlab \u7684 <code>README.md</code> \u6240\u8ff0\u7684\u6b65\u9aa4\u66f4\u65b0\u955c\u50cf\uff0c\u4e00\u822c\u53ea\u9700\u66f4\u6539\u6240\u8ff0\u7684\u4e24\u4e2a\u4f4d\u7f6e\u7684\u7248\u672c\u53f7\uff0c\u63a8\u9001\u5230\u4ed3\u5e93\u540e\uff0cGitHub Actions \u5c06\u81ea\u52a8\u5b8c\u6210\u955c\u50cf\u7684\u6784\u5efa\uff0c\u5e76\u4e0a\u4f20\u5230 ghcr.io\u3002\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u82e5\u4e0a\u6e38\u66f4\u65b0\u5305\u542b\u5bf9 <code>assets/runtime</code> \u76ee\u5f55\u7684\u53d8\u66f4\uff0c\u5219\u9700\u5148\u5c06\u4e0a\u6e38\u66f4\u65b0\u5408\u5e76\u5230\u6211\u4eec\u7684\u4ed3\u5e93\uff0c\u5426\u5219\u53ef\u80fd\u51fa\u73b0\u6784\u5efa\u6216\u8fd0\u884c\u65f6\u9519\u8bef\u3002</p> <p>\u7531\u4e8e\u5df2\u7ecf docker \u5316\uff0c\u56e0\u6b64\u6211\u4eec\u7684\u66f4\u65b0\u662f\u901a\u8fc7\u62c9\u53d6 ustclug/docker-gitlab \u7684 docker image\uff0c\u8fdb\u884c\u6570\u636e\u5e93\u51c6\u5907\u4ee5\u53ca\u542f\u52a8\u955c\u50cf\u5b9e\u4f8b\u6765\u8fdb\u884c\u66f4\u65b0\uff0cZack Zeng \u5b66\u957f\u5df2\u7ecf\u5199\u597d\u4e86\u4e00\u5957\u811a\u672c\u7cfb\u7edf\uff1agitlab-scripts\uff0c\u56e0\u6b64\u66f4\u65b0\u65f6\u53ea\u8981\u8dd1\u811a\u672c\u5c31\u53ef\u4ee5\u4e86\u3002</p> <p>\u7531\u4e8e\u66f4\u65b0\u9700\u8981\u505c\u6b62\u670d\u52a1\uff0c\u56e0\u6b64\u8bf7\u4e8e\u66f4\u65b0\u524d\u81f3\u5c11\u51e0\u5c0f\u65f6\u53d1\u5e03\u66f4\u65b0\u516c\u544a\uff08\u5305\u62ec\u5177\u4f53\u65f6\u95f4\u7b49\uff09\uff0c\u5e76\u68c0\u67e5 Admin -&gt; Monitoring -&gt; Background Migrations \u4e2d\u6240\u6709 migration \u662f\u5426\u90fd\u5df2\u7ecf\u6210\u529f\u5b8c\u6210\u3002</p> <p>\u66f4\u65b0\u524d\u8bf7\u5148\u63d0\u524d\u4e8e Proxmox VE \u4e0a\u5bf9\u865a\u62df\u673a\u6253\u5feb\u7167\uff08\u6253\u5feb\u7167\u65f6\u670d\u52a1\u4f1a\u6682\u65f6\u505c\u6b62\uff09</p> <p>\u6253\u5b8c\u5feb\u7167\u4e4b\u540e\u4f7f\u7528\u811a\u672c\u8fdb\u884c\u66f4\u65b0\uff08\u76ee\u524d\u811a\u672c\u4f4d\u4e8e <code>/home/sirius/gitlab-scripts</code>\uff09\uff0c\u9996\u5148\u4f7f\u7528 <code>./gitlab.sh db</code> \u8fdb\u884c\u6570\u636e\u5e93\u7684\u51c6\u5907\u5de5\u4f5c\u3002\u4e4b\u540e\u53ef\u4ee5\u901a\u8fc7 <code>./gitlab.sh run &lt;\u7248\u672c\u53f7&gt;</code> \u6765\u8fdb\u884c docker container \u7684\u66ff\u6362\u3002\u66f4\u6362\u524d\u811a\u672c\u4f1a\u81ea\u52a8\u62c9\u53d6\u76f8\u5e94\u7248\u672c\u53f7\u7684 docker \u955c\u50cf\uff0c\u5982\u679c\u62c5\u5fc3\u62c9\u53d6\u65f6\u95f4\u8fc7\u957f\u53ef\u4ee5\u5728\u6253\u5feb\u7167\u524d\u63d0\u524d\u901a\u8fc7 <code>docker pull ghcr.io/ustclug/docker-gitlab:&lt;\u7248\u672c\u53f7&gt;</code> \u6765\u62c9\u53d6\u76f8\u5e94\u7684\u955c\u50cf\u3002</p> <p>\u4e00\u822c\u60c5\u51b5\u4e0b\u7ecf\u4ee5\u4e0a\u64cd\u4f5c\u540e\u66f4\u65b0\u5c31\u6b63\u5e38\u7ed3\u675f\uff0c\u5982\u679c\u957f\u65f6\u95f4\u65e0\u6cd5\u542f\u52a8\uff0c\u53ef\u4ee5\u901a\u8fc7 <code>docker logs gitlab</code> \u67e5\u770b\u65e5\u5fd7\uff0c\u5982\u679c\u53d1\u73b0\u66f4\u65b0\u540e\u7684\u542f\u52a8\u51fa\u73b0\u95ee\u9898\uff0c\u53ef\u4ee5\u5230 sameersbn/docker-gitlab \u7684 issue \u533a\u7b49\u5730\u67e5\u770b\u76f8\u5173 issue\uff0c\u4ee5\u53ca\u901a\u8fc7\u5bf9\u51fa\u9519\u65e5\u5fd7\u8fdb\u884c Google \u53ef\u80fd\u4f1a\u53d1\u73b0\u662f gitlab \u4e0a\u6e38\u7b49\u51fa\u73b0\u7684\u95ee\u9898\u3002\u5982\u679c\u6709\u89e3\u51b3\u529e\u6cd5\uff0c\u53ef\u4ee5\u6309\u7167\u76f8\u5e94\u89e3\u51b3\u529e\u6cd5\u89e3\u51b3\uff0c\u5982\u679c\u6ca1\u6709\u3002\u53ef\u4ee5\u901a\u8fc7\u627e\u5230\u6709\u76f8\u5e94\u95ee\u9898\u524d\u7684\u6b63\u5e38\u7248\u672c\u53f7\uff0c\u56de\u6eda\u5feb\u7167\uff0c\u4e4b\u540e\u66f4\u5230\u8868\u73b0\u6b63\u5e38\u7684\u7248\u672c\u3002\uff08\u6700\u8fd1\u7684\u66f4\u65b0\u4f1a\u5728\u542f\u52a8\u4e4b\u540e\u77ed\u6682\u51fa\u73b0 502 \u7684\u60c5\u51b5\uff0c\u4f46\u5f88\u5feb\u5c31\u4f1a\u6062\u590d\uff0c\u9047\u5230\u8fd9\u79cd\u60c5\u51b5\u65f6\u4e0d\u8981\u60ca\u614c\uff09\u3002</p> <p>\u7531\u4e8e\u66f4\u65b0\u53ef\u80fd\u4f1a\u51fa\u73b0\u95ee\u9898\u5bfc\u81f4\u670d\u52a1\u4e0d\u53ef\u7528\uff0c\u56e0\u6b64\u4e0d\u5efa\u8bae\u901a\u8fc7 cron \u7b49\u65b9\u5f0f\u81ea\u52a8\u8fdb\u884c\u66f4\u65b0\u3002</p>"},{"location":"services/gitlab/#postgresql-redis","title":"postgresql \u4e0e redis \u7684\u66f4\u65b0","text":"<p>\u7531\u4e8e gitlab \u66f4\u65b0\u540e\u53ef\u80fd\u5bf9 postgresql \u4e0e redis \u7684\u7248\u672c\u6709\u8981\u6c42\uff0c\u56e0\u6b64\u6709\u53ef\u80fd\u9700\u8981\u5b9a\u671f\u66f4\u65b0 redis \u4e0e postgresql\u3002</p> <p>\u66f4\u65b0\u524d\u8bf7\u5148\u505c\u6b62 gitlab \u7684 container\u3002</p> <p>\u66f4\u65b0\u65f6\u53ef\u4ee5\u6309\u7167\u5b98\u7f51\u6559\u7a0b docker-postgresql \u8fdb\u884c\u66f4\u65b0\uff0c\u53ef\u4ee5\u901a\u8fc7\u62c9\u53d6 latest \u6807\u7b7e\u7684\u955c\u50cf\uff0c\u5220\u9664\u539f\u6765\u7684 container\uff0c\u518d\u901a\u8fc7\u811a\u672c <code>./gitlab.sh db</code> \u81ea\u52a8\u542f\u52a8\uff0c\u6570\u636e\u5e93\u66f4\u65b0\u65f6\u53ef\u80fd\u4f1a\u9700\u8981\u4e00\u5b9a\u65f6\u95f4\u6765\u8fc1\u79fb\u6570\u636e\uff0c\u8bf7\u901a\u8fc7 <code>docker logs -f gitlab-postgresql</code> \u547d\u4ee4\u6765\u67e5\u770b\u8fc1\u79fb\u8fdb\u5ea6\uff0c\u5f85\u8fc1\u79fb\u5b8c\u6210\u540e\u518d\u8fd0\u884c GitLab \u7684 container\u3002</p>"},{"location":"services/gitlab/#rails-console","title":"\u8bbf\u95ee Rails console","text":"<p>Rails console \u53ef\u4ee5\u5b8c\u6210\u4e00\u4e9b\u9ad8\u7ea7\u7684\u7ef4\u62a4\u4efb\u52a1\u3002\u5728 gitlab \u5bb9\u5668\u4e2d\u6267\u884c <code>bin/rails console</code> \u542f\u52a8\u3002\u6ce8\u610f console \u7684\u542f\u52a8\u65f6\u95f4\u5f88\u957f\uff08 1 \u5206\u949f\u4ee5\u4e0a\uff09\uff0c\u9700\u8981\u6709\u8010\u5fc3\u3002</p> <p>\u53ef\u4ee5\u6267\u884c\u7684\u547d\u4ee4\u53ef\u53c2\u8003 https://docs.gitlab.com/ee/administration/troubleshooting/gitlab_rails_cheat_sheet.html\u3002</p>"},{"location":"services/gitlab/#_2","title":"\u67e5\u8be2","text":""},{"location":"services/gitlab/#hashed-storage","title":"\u67e5\u8be2 Hashed storage \u4e0b\u4ed3\u5e93\u5bf9\u5e94\u7684\u9879\u76ee","text":"<pre><code>ProjectRepository.find_by(disk_path: '@hashed/23/33/2333333333333333333333333333333333333333333333333333333333333333').project\n</code></pre> <p>\u5982\u679c\u5b58\u5728\uff0c\u4f1a\u8fd4\u56de\u7c7b\u4f3c\u4ee5\u4e0b\u7684\u5185\u5bb9\uff1a</p> <pre><code>=&gt; #&lt;Project id:23333 username/project&gt;&gt;\n</code></pre>"},{"location":"services/gitlab/#sql-like","title":"\u67e5\u8be2\u65e0\u9879\u76ee\u4e14\u90ae\u7bb1\u6ee1\u8db3\u6761\u4ef6\u7684\u7528\u6237 (SQL <code>like</code>)","text":"<pre><code>users = User.where('id NOT IN (select distinct(user_id) from project_authorizations)')\nusers = users.where('email like ?', '%.ru')\nusers.count\n\nusers.each do |user|\n    puts user.last_activity_on\nend\n</code></pre>"},{"location":"services/gitlab/#_3","title":"\u5237\u65b0\u67d0\u4e2a\u9879\u76ee\u7684\u7edf\u8ba1\u4fe1\u606f","text":"<pre><code>p = Project.find_by_full_path('&lt;namespace&gt;/&lt;project&gt;')\npp p.statistics\np.statistics.refresh!\npp p.statistics\n</code></pre>"},{"location":"services/gitlab/#lfs-id","title":"\u83b7\u53d6\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee ID","text":"<pre><code>LfsObject.all.each do |lo|\n    puts LfsObjectsProject.find_by_lfs_object_id(lo.id).project_id\nend\n</code></pre> <p>\u8f93\u51fa\u8f83\u591a\u3002\u53ef\u4ee5\u4f7f\u7528 <code>rails r xxx.rb</code> \u8fd0\u884c\uff0c\u91cd\u5b9a\u5411\u5230\u6587\u4ef6\uff0c\u53bb\u91cd\u540e\u67e5\u770b\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee\u3002</p>"},{"location":"services/gitlab/#rake-tasks","title":"\u4f7f\u7528 Rake tasks","text":"<p>\u8be6\u89c1 https://github.com/sameersbn/docker-gitlab#rake-tasks\u3002\u548c Rails console \u4e00\u6837\uff0c\u521d\u59cb\u5316\u5f88\u6162\u3002</p> <p>\u5f53\u524d\u5b9e\u4f8b\u4fe1\u606f\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:env:info RAILS_ENV=production\n</code></pre>"},{"location":"services/gitlab/#_4","title":"\u6e05\u7406","text":"<p>\u53c2\u8003 https://github.com/gitlabhq/gitlabhq/blob/master/doc/raketasks/cleanup.md\u3002</p> <p>\u4e0d\u8fc7\u4f5c\u7528\u6709\u9650\u3002</p>"},{"location":"services/gitlab/#_5","title":"\u6e05\u7406\u4e0a\u4f20\u76ee\u5f55","text":"<p>\u67e5\u770b\u4f1a\u88ab\u6e05\u7406\u7684\u6587\u4ef6\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:project_uploads RAILS_ENV=production\n</code></pre> <p>\u6e05\u7406\uff08\u79fb\u52a8\u5230 /-/project-lost-found/\uff09\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:project_uploads RAILS_ENV=production DRY_RUN=false\n</code></pre>"},{"location":"services/gitlab/#artifact","title":"\u6e05\u7406\u672a\u88ab\u5f15\u7528\u7684 artifact \u6587\u4ef6","text":"<p>\u67e5\u770b\u4f1a\u88ab\u6e05\u7406\u7684 artifact \u6570\u91cf\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_job_artifact_files RAILS_ENV=production\n</code></pre> <p>\u6e05\u7406\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_job_artifact_files RAILS_ENV=production DRY_RUN=false\n</code></pre> <p>\u6ce8\u610f\uff0c\u65b0\u8bbe\u7f6e\u7684 expire \u671f\u9650\u4e0d\u4f1a\u5f71\u54cd\u4ee5\u524d\u7684 artifact\uff0c\u8fd9\u91cc\u7684\u547d\u4ee4\u4e5f\u65e0\u6cd5\u6e05\u7406\u3002</p>"},{"location":"services/gitlab/#lfs-reference","title":"\u6e05\u7406\u65e0\u6548\u7684 LFS reference","text":"<pre><code>for i in `cat projectid_lfs`; do docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_lfs_file_references PROJECT_ID=$i RAILS_ENV=production DRY_RUN=false; done\n</code></pre> <p><code>projectid_lfs</code> \u662f\u4e0a\u6587\u4e2d\u300c\u83b7\u53d6\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee ID\u300d\u7684\u53bb\u91cd\u540e\u7684\u8f93\u51fa\u3002</p> <p>\u65e0 reference \u7684 LFS \u6587\u4ef6\u6bcf\u65e5 GitLab \u4f1a\u81ea\u52a8\u6e05\u9664\u3002\u5982\u679c\u9700\u8981\u7acb\u523b\u5220\u9664\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>gitlab:cleanup:orphan_lfs_files</code>\u3002</p>"},{"location":"services/gitlab/#_6","title":"\u7d27\u6025\u64cd\u4f5c","text":""},{"location":"services/gitlab/#_7","title":"\u8bbe\u7f6e\u4e3a\u53ea\u8bfb","text":"<p>Ref: https://docs.gitlab.com/ee/administration/read_only_gitlab.html</p> <pre><code>docker exec --user git -it gitlab bin/rails console\n</code></pre> <p>\u4e4b\u540e\u6267\u884c</p> <pre><code>Project.all.find_each { |project| puts project.name; project.update!(repository_read_only: true) }\n</code></pre> <p>\u5c06\u6240\u6709\u4ed3\u5e93\u8bbe\u7f6e\u4e3a\u53ea\u8bfb\u3002\u5982\u679c\u4e2d\u95f4\u51fa\u73b0\u9519\u8bef\uff08\u7279\u6b8a\u7684\u9879\u76ee\u540d\u53ef\u80fd\u4f1a\u5bfc\u81f4\u8fd0\u884c\u4e2d\u65ad\uff09\uff0c\u91cd\u547d\u540d\u6700\u540e\u8f93\u51fa\u5bf9\u5e94\u7684\u9879\u76ee\u3002</p> <p>\u5728\u8bbe\u7f6e\u524d\uff0c\u9700\u8981\u6dfb\u52a0 Messages \u901a\u77e5\u7528\u6237\u3002</p> <p>\u6b64\u65f6\u6570\u636e\u5e93\u4ecd\u7136\u53ef\u5199\u5165\u3002\u5982\u679c\u9700\u8981\u6570\u636e\u5e93\u53ea\u8bfb\uff0c\u53c2\u8003\u4ee5\u4e0a\u94fe\u63a5\u914d\u7f6e\u3002</p>"},{"location":"services/light/","title":"Light Accelerator","text":"<p>Service: light.ustclug.org</p> <p>Git Repository:</p> <ul> <li>Server Daemon</li> <li>Web UI</li> <li>Accelerate list</li> <li>Documentation</li> </ul> <p>Docker Hub:</p> <ul> <li>ustclug/light-server</li> <li>ustclug/lug-vpn-web:light</li> </ul> <p>Mailing list: \u8f7b\u91cf\u7ea7\u7f51\u7edc\u52a0\u901f\u670d\u52a1</p> <p>Servers:</p> <ul> <li>swarm.s.ustclug.org (docker containers)<ul> <li>light-mysql</li> <li>light-freeradius</li> <li>light-server</li> <li>light-socks5</li> <li>light-web</li> </ul> </li> <li>gateway-el.s.ustclug.org (port mapping + reverse proxy)<ul> <li>29979 \u2192 light-server.d.ustclug.org:29979</li> <li>29980 \u2192 light-server.d.ustclug.org:29980</li> <li>light.ustclug.org \u2192 light-web.d.ustclug.org</li> </ul> </li> <li>vdp.s.ustclug.org<ul> <li>LUG FTP: https://ftp.lug.ustc.edu.cn/light/</li> </ul> </li> </ul>"},{"location":"services/light/#deploy","title":"Deploy","text":"<p>Deploy script:  docker-run-script/light</p> <p>Deploy order:</p> <ol> <li>mysql</li> <li>freeradius, light-web</li> <li>squid</li> </ol>"},{"location":"services/light/#add-new-domain","title":"Add new domain","text":"<pre><code>git clone https://github.com/ustclug/light-list\ncd accelerate-list\n./tools/add-domain.sh accelerate.list www.example.com\ngit commit -v -a\ngit push origin master\n</code></pre> <p>GitHub Actions will update PAC files in LUG FTP automatically.</p>"},{"location":"services/light/#database-maintenance","title":"Database maintenance","text":"<p>Example:</p> <pre><code>select count(*) from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ninsert into radacct_backup select * from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ndelete from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ndelete from radacct_backup where acctstoptime &lt; '2020-06-01 00:00:00';\noptimize table radacct;\noptimize table radacct_backup;\n</code></pre>"},{"location":"services/light/#shutdown","title":"Shutdown","text":"<ol> <li>Stop two containers: <code>light-server</code> &amp; <code>light-socks</code></li> <li>Set restart policy to <code>no</code> (See Docker Documentation)</li> </ol>"},{"location":"services/light/#logs","title":"Logs","text":"<p>Proxy related log is under <code>/srv/docker/light/log</code>. Container log (stdout &amp; stderr) is under <code>/srv/docker/docker/containers/&lt;container id&gt;/*.log*</code> (use <code>docker logs &lt;container&gt;</code> to view).</p> <p>Logrotate is configured to save logs for 180 days. Please manually backup logs when removing the container.</p>"},{"location":"services/mirrorz/","title":"MirrorZ CERNET server","text":"<p>MirrorZ \u9879\u76ee\u5728 CERNET \u5317\u4eac\u8282\u70b9\u6709\u4e00\u4e2a\u865a\u62df\u673a\uff0c\u901a\u8fc7 *.mirrors.cernet.edu.cn \u7684\u57df\u540d\u63d0\u4f9b 302 \u8df3\u8f6c\u548c\u5e2e\u52a9\u9875\u9762\u7b49\u670d\u52a1\u3002</p> <p>\u7531\u4e8e CentOS 7 \u5728 2024 \u5e74 6 \u6708\u7ed3\u675f\u652f\u6301\uff0ciBug \u548c taoky \u5728 2024 \u5e74 2 \u6708\u914d\u7f6e\u4e86\u4e00\u4e2a\u8fd0\u884c Debian 12 \u7684\u65b0\u865a\u62df\u673a\u3002\u65b0\u865a\u62df\u673a\u955c\u50cf\u57fa\u4e8e debian-cdimage \u63d0\u4f9b\u7684 <code>debian-12-genericcloud-amd64.qcow2</code>\u3002</p>"},{"location":"services/mirrorz/#system","title":"\u7cfb\u7edf\u914d\u7f6e","text":""},{"location":"services/mirrorz/#network","title":"\u7f51\u7edc","text":"<p>\u865a\u62df\u673a\u7684\u7f51\u7edc\u91c7\u7528 systemd-networkd \u914d\u7f6e\uff0c\u914d\u7f6e\u6587\u4ef6\u5728 <code>/etc/systemd/network</code> \u4e0b\uff0cv4/v6 \u5747\u4f7f\u7528\u9759\u6001 IP \u914d\u7f6e\u3002\u5176\u4e2d <code>[Match]</code> \u5757\u4f7f\u7528 <code>MACAddress=...</code> \u6765\u5339\u914d\u7f51\u5361\u3002</p>"},{"location":"services/mirrorz/#ssh","title":"SSH","text":"/etc/ssh/sshd_config.d/ibug.conf<pre><code>PasswordAuthentication no\nPermitRootLogin prohibit-password\n</code></pre>"},{"location":"services/mirrorz/#ntp","title":"NTP","text":"/etc/systemd/timesyncd.conf.d/ibug.conf<pre><code>[Time]\nNTP=ntp.tuna.tsinghua.edu.cn\n</code></pre>"},{"location":"services/mirrorz/#software","title":"\u8f6f\u4ef6","text":"<p>etckeeper\uff08\u4e0d\u77e5\u9053\u600e\u4e48\u914d\u7f6e\u7684\uff0c\u88c5\u597d\u5373\u7528\uff1f\uff09</p> <ul> <li>Nginx (\u4f7f\u7528 n.wtf \u7684\u7248\u672c)</li> <li>Node.js 18</li> <li>InfluxDB 2</li> <li>Grafana 9</li> </ul> <p>\u4ee5\u4e0a\u56db\u4e2a\u8f6f\u4ef6\u5206\u522b\u4ece\u56db\u4e2a\u4e0d\u540c\u7684 APT \u6e90\u5b89\u88c5\uff0c\u5bf9\u5e94\u7684 APT \u516c\u94a5\u90fd\u5b58\u5728 <code>/etc/apt/keyrings</code> \u4e2d\u3002</p> <p>APT \u6e90\u914d\u7f6e</p> /etc/apt/sources.list.d/docker.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://mirrors.ustc.edu.cn/docker-ce/linux/debian bookworm stable\n</code></pre> /etc/apt/sources.list.d/grafana.list<pre><code>deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://mirrors.tuna.tsinghua.edu.cn/grafana/apt stable main\n</code></pre> /etc/apt/sources.list.d/influxdata.list<pre><code>deb [signed-by=/etc/apt/keyrings/influxdata.asc] https://mirrors.ustc.edu.cn/influxdata/debian stable main\n</code></pre> /etc/apt/sources.list.d/nodesource.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_18.x nodistro main\n</code></pre> /etc/apt/sources.list.d/sb-nginx.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/sb-nginx.asc] https://mirror.xtom.com.hk/sb/nginx/ bookworm main\n</code></pre>"},{"location":"services/mirrorz/#go","title":"Go","text":"<p>\u4ece\u5b98\u65b9\u7f51\u7ad9\u4e0b\u8f7d\u6700\u65b0\u7684 tar.gz \u5e76\u89e3\u538b\u5230 <code>/usr/local/go</code>\uff0c\u7136\u540e\u5c06 <code>/usr/local/go/bin</code> \u4e2d\u7684\u4e24\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6\u8f6f\u94fe\u63a5\u5230 <code>/usr/local/bin</code>\u3002</p> <p>\u66f4\u65b0 Go \u7684\u5feb\u6377\u811a\u672c\u4f4d\u4e8e <code>/root/go/update.sh</code>\uff0c\u5185\u5bb9\u89c1 iBug/shGadgets\u3002</p>"},{"location":"services/mirrorz/#_1","title":"\u6570\u636e\u76ee\u5f55","text":"<p>MirrorZ \u4e3b\u9879\u76ee\u548c\u5e2e\u52a9\u9875\u9762\u7b49\u53ef\u4ee5\u901a\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee\u7684\u9875\u9762\u90fd\u5728 <code>/var/www</code> \u4e0b\u3002</p>"},{"location":"services/mirrorz/#_2","title":"\u81ea\u52a8\u66f4\u65b0","text":"<p>\u5229\u7528 GitHub \u7684 webhook \u529f\u80fd\uff0c\u90e8\u7f72\u4e86\u4e00\u4efd iBug/uniAPI\u3002\u76f8\u5173\u6587\u4ef6\u5982\u4e0b\uff1a</p> <pre><code>/usr/bin/uniAPI\n/etc/uniAPI.yml\n/etc/systemd/system/uniAPI.service\n</code></pre> <p>\u914d\u7f6e\u6837\u4f8b\u5982\u4e0b\uff1a</p> <pre><code>services:\n  uniAPI:\n    type: server\n    services:\n      mirrorz-json-legacy:\n        type: github.webhook\n        path: /home/mirrorz/mirrorz-org/mirrorz-json-legacy\n        branch: master\n        secret: # empty\n</code></pre> <pre><code>location ^~ /uniAPI {\n    proxy_pass http://127.0.1.1:1024;\n}\n</code></pre>"},{"location":"services/neat-dns/","title":"Neat DNS","text":"<p>Services: neatdns.ustclug.org (UDP, TCP, HTTPS, DNSCrypt)</p> <p>Server: docker2</p> <p>Deploy:  docker-run-script/neatdns</p>"},{"location":"services/neat-dns/#notes","title":"Notes","text":"<p>Previously all containers on docker2 had gateway-el as their gateway, which generated heavy load on the Tinc network. Docker2 has since been updated to use gateway-nic as gateway for containers, bypassing Tinc for most of the traffic. This, however, broke NAT-based service like Neat DNS, which required that reply traffic goes back through gateway-el (but now gateway-nic).</p> <p>What's worse, Docker doesn't support setting gateways for individual containers, nor can network config be changed from within the container (default setup). So we chose to selectively route traffic back to gateway-el on gateway-nic. This is accomplished with two parts:</p> <ul> <li> <p>Routing tables and routing rules:</p> /etc/systemd/network/11-Policy.network<pre><code>[RoutingPolicyRule]\nFrom=0.0.0.0/0\nFirewallMark=0x101/0x1ff\nTable=1101  # Ustclug_override\nPriority=1\n\n[Route]\nGateway=10.254.0.254  # gateway-el\nTable=1011\n</code></pre> <p>Using iproute2 <code>ip</code> command, this would be:</p> <pre><code>ip rule add fwmark 0x101/0x1ff table Ustclug_override prio 1\nip route replace default via 10.254.0.254 table Ustclug_override\n</code></pre> </li> <li> <p>And then we select traffic to redirect to gateway-el using iptables marks:</p> iptables -t mangle -S<pre><code>-A PREROUTING -s 10.254.1.5/32 -i Policy -p tcp -m multiport --sports 53,53443 -j MARK --set-xmark 0x101/0x1ff\n-A PREROUTING -s 10.254.1.5/32 -i Policy -p udp -m multiport --sports 53,53443 -j MARK --set-xmark 0x101/0x1ff\n</code></pre> <p>These two lines of iptables rules selects replying traffic originating from the neat-dns container and marks it appropriately, so it will be routed to gateway-el instead of exiting the intranet right from gateway-nic.</p> </li> </ul>"},{"location":"services/vpn/","title":"LUG VPN","text":""},{"location":"services/vpn/#iptables","title":"iptables \u9632\u706b\u5899\u7ba1\u7406","text":"<p>\u672c\u8282\u5185\u5bb9\u9002\u7528\u4e8e\u5305\u62ec VPN \u5728\u5185\u7684\u591a\u4e2a\u670d\u52a1\u5668</p> <ul> <li>mirrors2</li> <li>mirrors4</li> <li>gateway-el</li> <li>gateway-nic</li> </ul>"},{"location":"services/vpn/#tftp-helper","title":"TFTP helper","text":"<p>\u76ee\u524d\u4ec5\u5bf9 IPv4 \u542f\u7528\u3002</p> <pre><code>*raw\n:PREROUTING ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A PREROUTING -p udp --dport 69 -j CT --helper tftp\nCOMMIT\n</code></pre> /etc/modules<pre><code>nf_conntrack_tftp\nnf_nat_tftp\n</code></pre>"},{"location":"services/vpn/#ssl-certs","title":"SSL Certificates","text":"<p>The certificate for <code>*.vpn.lug.ustc.edu.cn</code> + <code>*.vpn.ustclug.org</code> is acquired with our certificate infrastructure and the vpn server runs <code>updater.sh</code> with cron.</p> <p>Two services running in Docker (strongswan and ocserv) use the certificate, so another cron job exists to copy the certificate files into the Docker volume (<code>vpn-certs</code>). The second updater script is listed below:</p> /usr/local/docker_sh/vpn-cert-updater.sh<pre><code>#!/bin/sh\n\n# outside, call docker\nif command -v docker &gt;/dev/null 2&gt;&amp;1; then\n  exec docker run --rm \\\n    --name=vpn-cert-updater \\\n    --net=none \\\n    -v \"$(realpath \"$0\")\":/update.sh:ro \\\n    -v vpn-certs:/vpn-certs \\\n    -v /etc/ssl/private:/ssl-certs:ro \\\n    alpine \\\n    /update.sh\n  exit 1 # exec failed\nfi\n\nset -eux\n\nSSL_CERTS=\"/ssl-certs\"\nVPN_CERTS=\"/vpn-certs\"\n\ncp -p \"${SSL_CERTS}/lugvpn/fullchain.pem\" \"${VPN_CERTS}/certs/vpn.ustclug.org.crt\"\ncp -p \"${SSL_CERTS}/lugvpn/privkey.pem\" \"${VPN_CERTS}/private/vpn.ustclug.org.key\"\necho \"Cert Update Complete\"\n</code></pre>"},{"location":"services/mirrors/","title":"\u5f00\u6e90\u955c\u50cf\u7ad9","text":""},{"location":"services/mirrors/#_2","title":"\u5386\u53f2","text":""},{"location":"services/mirrors/#debianustceducn","title":"debian.ustc.edu.cn","text":"<p>2000 \u5e74\u5de6\u53f3\uff0c\u79d1\u5927\u6821\u5185\u7684 Debian \u7231\u597d\u8005\u4f7f\u7528\u81ea\u5df1\u5b9e\u9a8c\u5ba4\u7684\u673a\u5668\u4e3a\u5927\u5bb6\u63d0\u4f9b Debian \u955c\u50cf\u670d\u52a1\u3002\u968f\u7740\u4e00\u5c4a\u5c4a\u5e08\u5144\u7684\u6bd5\u4e1a\uff0c\u670d\u52a1\u5668\u5728\u5404\u5b9e\u9a8c\u5ba4\u95f4\u63a5\u529b\u3002</p> <p>2002 \u5e74 5 \u6708\uff0cDebian \u955c\u50cf\u7ad9\u6709\u4e86\u81ea\u5df1\u7684\u57df\u540d debian.ustc.edu.cn\uff0c\u4f46\u670d\u52a1\u5668\u4ecd\u5728\u5b9e\u9a8c\u5ba4\u95f4\u8f97\u8f6c\u3002</p> <p>2002 \u5e74 6 \u6708 23 \u65e5\uff0c\u79d1\u5927Debian\u955c\u50cf\u7ad9\u5f00\u59cb\u63d0\u4f9b\u975e\u5b98\u65b9(UO)\u8f6f\u4ef6\u4ed3\u5e93\u30022004\u5e744\u670823\u65e5\uff0c\u63d0\u4f9b\u65b0\u7684UO\u4ed3\u5e93\u3002</p> <p>2005 \u5e74 6 \u6708 20 \u65e5\uff0c\u79d1\u5927 LUG \u53d1\u8d77\u4e3a\u79d1\u5927 Debian \u955c\u50cf\u7ad9\u6350\u6b3e\u7684\u5021\u8bae\uff0c\u622a\u81f3 10 \u6708 1 \u65e5\u52df\u6350\u6d3b\u52a8\u505c\u6b62\uff0cLUG \u5171\u6536\u5230 2922.05 \u5143\u6350\u6b3e\u300210 \u6708 6 \u65e5\u65b0\u673a\u5668\u5b89\u88c5\u914d\u7f6e\u5230\u4f4d\u3002\u5728\u5927\u5bb6\u7684\u9f50\u5fc3\u52aa\u529b\u4e4b\u4e0b\uff0c\u79d1\u5927 Debian \u955c\u50cf\u7ad9\u6709\u4e86\u4e00\u4e2a\u76f8\u5bf9\u56fa\u5b9a\u7684\u201c\u5bb6\u201d\u3002</p> <p>2009 \u5e74\u5e95\uff0cdebian.ustc \u843d\u6237\u56fe\u4e66\u9986\u6280\u672f\u90e8\u3002</p>"},{"location":"services/mirrors/#ossustceducn","title":"oss.ustc.edu.cn","text":"<p>2008 \u5e74 12 \u6708 25 \u65e5\uff0c\u79d1\u5927\u5f00\u6e90\u8f6f\u4ef6 (OSS) \u955c\u50cf\u7ad9\u6b63\u5f0f\u542f\u7528\u3002\u5176\u670d\u52a1\u5668\u7531\u5434\u5cf0\u5149\u5e08\u5144\u63d0\u4f9b\u3002Novell \u516c\u53f8\u4e3a\u6211\u4eec\u63d0\u4f9b\u4e86\u4e00\u57571.5T \u7684\u786c\u76d8\u3002</p> <p>2009 \u5e74 12 \u6708\uff0c\u5f20\u6210\u5e08\u5144\u4e3a OSS \u955c\u50cf\u7ad9\u63d0\u4f9b\u6350\u8d60 1T \u786c\u76d8\u3002</p> <p>2010 \u5e74 6 \u6708\uff0c\u79d1\u5927 LUG \u4f7f\u7528\u51fa\u552e\u7248\u886b\u4f59\u4e0b\u7684\u94b1\u4e3a OSS \u955c\u50cf\u7ad9\u6dfb\u7f6e\u4e86\u4e00\u5757 2T \u786c\u76d8\u3002</p>"},{"location":"services/mirrors/#mirrorsustceducn","title":"mirrors.ustc.edu.cn","text":"<p>2011 \u5e74 4 \u6708 8 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\uff0c\u5e76\u7533\u8bf7\u5230\u4e86 mirrors.ustc \u7684\u57df\u540d\u3002debian.ustc \u4e0e oss.ustc \u5f00\u59cb\u5411 mirrors.ustc \u8fc1\u79fb\u3002</p> <p>\u540c\u5e74 4 \u6708 15 \u65e5\uff0c\u51e0\u5927\u70ed\u95e8\u53d1\u884c\u7248\u955c\u50cf\u540c\u6b65\u5b8c\u6bd5\uff0cmirrors \u5f00\u59cb\u6b63\u5f0f\u5bf9\u5916\u63d0\u4f9b\u670d\u52a1\uff0c\u540c\u65f6 debian.ustc \u4e0e oss.ustc \u9000\u51fa\u4e86\u5386\u53f2\u821e\u53f0\u3002</p> <p>2013 \u5e74 1 \u6708 6 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u78c1\u76d8\u9635\u5217\uff0c\u5927\u5927\u7f13\u89e3\u4e86 mirrors \u56e0\u78c1\u76d8\u7a7a\u95f4\u4e0d\u8db3\u800c\u5e26\u6765\u7684\u538b\u529b\u3002</p> <p>2016 \u5e74 12 \u6708 29 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\u3002\u89e3\u51b3\u4e86\u8fd1\u4e00\u5e74\u6765\u7531\u4e8e\u670d\u52a1\u5668\u548c\u9635\u5217\u8001\u5316\u5e26\u6765\u7684\u7a33\u5b9a\u6027\u95ee\u9898\u3002</p> <p>2019 \u5e74 6 \u6708\uff0c\u79d1\u5927 LUG \u4ece\u56fe\u4e66\u9986\u6280\u672f\u90e8\u83b7\u5f97\u4e86\u4e00\u53f0\u65e7\u670d\u52a1\u5668\uff0c\u7f13\u89e3\u4e86 mirrors \u5bb9\u91cf\u7d27\u5f20\u7684\u95ee\u9898\u3002</p> <p>2020 \u5e74 3 \u6708 24 \u65e5\uff0c\u79d1\u5927 LUG \u518d\u6b21\u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\uff0c\u89e3\u51b3\u4e86\u591a\u5e74\u6765\u7531\u4e8e\u670d\u52a1\u5668\u5bb9\u91cf\u4e0d\u8db3\u548c\u8d1f\u8f7d\u8fc7\u5927\u5e26\u6765\u7684\u538b\u529b\u3002</p>"},{"location":"services/mirrors/#hardware","title":"\u786c\u4ef6\u914d\u7f6e","text":"<ul> <li>2020 \u5e74\u81f3\u4eca\uff1amirrors4</li> <li>2020 \u5e74\u81f3\u4eca\uff1amirrors3</li> <li>2016 \u5e74\u81f3\u4eca\uff1amirrors2</li> <li>2011 \u5e74\u81f3 2016 \u5e74\uff1amirrors1</li> </ul>"},{"location":"services/mirrors/docker/","title":"Docker","text":""},{"location":"services/mirrors/docker/#networking","title":"Networking","text":"<p>Docker \u9ed8\u8ba4\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a bridge \u7684\u7f51\u7edc\uff0c\u4e3b\u673a\u754c\u9762\u4e3a <code>docker0</code>\uff0cIP \u5730\u5740\u6bb5\u4e3a 172.17.0.0/16\u3002\u8fd9\u4e2a\u9ed8\u8ba4\u5730\u5740\u6bb5\u8fc7\u4e8e\u6d6a\u8d39\uff0c\u56e0\u6b64\u6211\u4eec\u7ed9\u5b83\u914d\u7f6e\u4e00\u4e2a\u66f4\u5c0f\u7684\u5730\u5740\u6bb5\uff1a</p> /etc/docker/daemon.json<pre><code>{\n  \"bip\": \"172.17.0.0/22\"\n}\n</code></pre> <p>\u6211\u4eec\u5c06 Docker Registry \u7684\u53cd\u4ee3\u6302\u5728\u53e6\u5916\u4e00\u4e2a\u5b50\u7f51\u4e0b\uff0c\u9700\u8981\u5148\u884c\u521b\u5efa\u3002</p> <pre><code>docker network create \\\n  --opt com.docker.network.bridge.name=docker1 \\\n  --subnet=172.18.0.0/24 \\\n  --gateway=172.18.0.1 \\\n  docker-registry\n</code></pre>"},{"location":"services/mirrors/docker/#routing","title":"Routing","text":"<p>\u4e00\u4e9b\u540c\u6b65\u7a0b\u5e8f\u4e0d\u652f\u6301 bindIP \u7684\u914d\u7f6e\uff0c\u5bf9\u4e8e\u8fd9\u4e9b\u540c\u6b65\u7a0b\u5e8f\uff0c\u6211\u4eec\u901a\u8fc7\u521b\u5efa\u591a\u4e2a Docker network\uff0c\u7136\u540e\u5728\u4e3b\u673a\u4e0a\u6839\u636e Docker network \u8fdb\u884c\u7b56\u7565\u8def\u7531\uff0c\u8fbe\u5230\u9009\u62e9\u51fa\u53e3\u7684\u6548\u679c\u3002</p> <p>\u521b\u5efa Docker network \u7684\u547d\u4ee4\u5982\u4e0b\uff1a</p> <pre><code>docker network create --driver=bridge --subnet=172.17.4.0/24 --gateway=172.17.4.1 -o \"com.docker.network.bridge.name=dockerC\" cernet\ndocker network create --driver=bridge --subnet=172.17.5.0/24 --gateway=172.17.5.1 -o \"com.docker.network.bridge.name=dockerT\" telecom\ndocker network create --driver=bridge --subnet=172.17.6.0/24 --gateway=172.17.6.1 -o \"com.docker.network.bridge.name=dockerM\" mobile\ndocker network create --driver=bridge --subnet=172.17.7.0/24 --gateway=172.17.7.1 -o \"com.docker.network.bridge.name=dockerU\" unicom\n\ndocker network create --driver=bridge --subnet=172.17.8.0/24 --gateway=172.17.8.1 \\\n  --ipv6 --subnet=fd00:6::/64 --gateway=fd00:6::1 \\\n  -o \"com.docker.network.bridge.name=dockerC6\" cernet6\n</code></pre> <p>\u5bf9\u5e94\u5730\uff0c\u4e3b\u673a\u4e0a\u4e5f\u914d\u7f6e\u597d\u4e86\u7b56\u7565\u8def\u7531\uff0c\u4f8b\u5982\uff1a</p> /etc/systemd/network/cernet.network<pre><code># Docker Cernet\n[RoutingPolicyRule]\nFrom=172.17.4.0/24\nTable=1011\nPriority=6\n[RoutingPolicyRule]\nFrom=172.17.8.0/24\nTable=1011\nPriority=6\n</code></pre> /etc/systemd/network/telecom.network<pre><code># Docker Telecom\n[RoutingPolicyRule]\nFrom=172.17.5.0/24\nTable=1012\nPriority=6\n</code></pre> <p><code>mobile.network</code> \u548c <code>unicom.network</code> \u4e5f\u7c7b\u4f3c\u3002</p> <p>\u9700\u8981\u4f7f\u7528\u8fd9\u79cd\u65b9\u5f0f\u8fdb\u884c\u8def\u7531\u7684\u540c\u6b65\u955c\u50cf\uff0c\u53ef\u4ee5\u5728 YAML \u4e2d\u6307\u5b9a <code>network</code>\uff0c\u4f8b\u5982\uff1a</p> adoptium.yum.yaml<pre><code>network: telecom\n</code></pre>"},{"location":"services/mirrors/ipmi/","title":"IPMI","text":""},{"location":"services/mirrors/ipmi/#mirrors4","title":"Mirrors4","text":"<p>\u8fd9\u53f0\u673a\u5668\u7684 IPMI \u6709 HTML5 KVM\uff0c\u53ef\u4ee5\u76f4\u63a5\u7f51\u9875\u4f7f\u7528\uff0c\u6bd4\u8f83\u65b9\u4fbf\u3002</p>"},{"location":"services/mirrors/ipmi/#mirrors23","title":"Mirrors2/3","text":"<p>\u767b\u5f55 IPMI \u540e\uff0c\u4e3a\u4e86\u4f7f\u7528\u8fdc\u7a0b Shell\uff0c\u9700\u8981\u8fd0\u884c\u4e00\u4e2a jnlp \u6587\u4ef6\u3002 \u6b64\u6587\u4ef6\u4e0b\u8f7d\u65f6\u4f1a\u88ab Chrome \u62e6\u622a\uff0c\u9700\u8981\u989d\u5916\u5141\u8bb8\u4e00\u4e0b\u3002</p> <p>\u6b64 jnlp \u6587\u4ef6\u9700\u8981 Oracle JDK 7 \u8fd0\u884c\uff0cOpenJDK 7 \u65e0\u6cd5\u8fd0\u884c\u3002 \u6307\u4ee4\u7528 <code>javaws a.jnlp</code> \u5373\u53ef\u3002</p> <p>Java 8 \u53ca\u4e4b\u524d Java \u7684\u5404\u4e2a\u5de5\u5177\u662f\u6253\u5305\u5728 JDK \u4e2d\u7684\uff0c\u5305\u62ec Java Web Starter\uff0c\u5373\u6211\u4eec\u7528\u7684 <code>javaws</code>\u3002 \u6240\u4ee5\u53ea\u9700\u8981\u5b89\u88c5 Oracle JDK 7 \u5373\u53ef\uff0c\u65e0\u9700\u5b89\u88c5\u5176\u4ed6\u7684\u3001\u9488\u5bf9 Java 9 \u53ca\u4e4b\u540e\u7248\u672c\u7684\u5176\u4ed6\u5de5\u5177\u3002</p>"},{"location":"services/mirrors/limiter/","title":"\u9650\u5236\u7b56\u7565","text":"<p>\u7531\u4e8e mirrors \u5c5e\u4e8e I/O\u3001\u7f51\u7edc\u5bc6\u96c6\u578b\u670d\u52a1\uff0c\u5728\u90e8\u5206\u7684\u8d1f\u8f7d\u573a\u666f\u4e0b\u6781\u6613\u51fa\u73b0 I/O \u6216\u7f51\u7edc\u8fc7\u8f7d\u3002\u9650\u5236\u7b56\u7565\u4e3b\u8981\u662f\u4e3a\u4e86\u51cf\u5f31\u4ee5\u4e0b\u51e0\u7c7b\u8bf7\u6c42\u5bf9 mirrors \u6574\u4f53\u670d\u52a1\u8d28\u91cf\u7684\u5f71\u54cd\uff1a</p> <ol> <li>\u7a81\u53d1\u6027\u7684\u9ad8\u5e76\u53d1\u8bf7\u6c42</li> <li>\u722c\u866b\u7c7b\u6d41\u91cf</li> <li>\u4e0d\u5408\u7406\u7684\u8bf7\u6c42\uff08\u5982\uff1a\u6781\u5c11\u6570\u7528\u6237\u7684\u5927\u91cf\u8bf7\u6c42\uff09</li> </ol>"},{"location":"services/mirrors/limiter/#whitelists","title":"\u767d\u540d\u5355","text":"<p>\u4e00\u822c\u800c\u8a00\uff0c\u79d1\u5927\u6821\u5185\u7684\u5730\u5740\u4f4d\u4e8e\u9650\u5236\u89c4\u5219\u7684\u767d\u540d\u5355\u4e2d\uff0c\u4e0d\u53d7\u5230\u9650\u5236\u7b56\u7565\u7684\u5f71\u54cd\u3002\u5982\u679c\u6ca1\u6709\u7279\u6b8a\u8bf4\u660e\uff0c\u79d1\u5927\u5730\u5740\u9ed8\u8ba4\u4e0d\u53d7\u9650\u5236\u3002</p> <p>\u767d\u540d\u5355\u4f4d\u4e8e\uff1a</p> <ul> <li><code>/usr/local/network_config/iptables/ipset</code></li> <li><code>/etc/nginx/conf.d/geo-ustcnet.conf</code></li> </ul>"},{"location":"services/mirrors/limiter/#firewall","title":"\u9632\u706b\u5899\u7ea7\u522b\u9650\u5236","text":"<p>\u9632\u706b\u5899 (iptables) \u76ee\u524d\u53ea\u8d1f\u8d23\u9650\u5236\u5355 IP \u7684\u5e76\u53d1\u94fe\u63a5\u6570\u3002\u8fd9\u662f\u4e3a\u4e86\u9632\u6b62\u540c\u65f6\u6d8c\u5165\u5927\u91cf\u5e76\u53d1\u8fde\u63a5\uff0c\u5bfc\u81f4\u540e\u7aef\u5e94\u7528\u8017\u8d39\u5927\u91cf CPU \u548c I/O \u8d44\u6e90\u5904\u7406\u8fd9\u4e9b\u4e0d\u5408\u5e38\u7406\u7684\u8bf7\u6c42\u3002</p> \u5e8f\u53f7 \u7aef\u53e3 \u670d\u52a1 \u6700\u5927\u8fde\u63a5\u6570 IPv4 CIDR IPv6 CIDR 1 80,443 HTTP/HTTPS 12 29 64 2 20,21,50100:50200 FTP 4* 32 64 3 873 Rsync 5* 32 64 4 9418 Git 10 32 64 <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u8fde\u63a5\u6570\u9650\u5236\u4ec5\u9650\u5236\u77ac\u65f6\u5e76\u53d1\uff08connlimit\uff09\u3002</p> <p>\u8bf7\u6ce8\u610f\uff0c\u540c\u7ec4\u5185\u7684\u8fde\u63a5\u5171\u4eab\u8fde\u63a5\u6570\u914d\u989d\u3002\u5982\uff1a</p> <ul> <li>10.0.0.1 \u4e0e 10.0.0.2 \u5171\u4eab HTTP \u9650\u989d</li> <li>1.1.1.1 \u53d1\u8d77\u7684 HTTP \u4e0e HTTPS \u8fde\u63a5\u5171\u4eab 12 \u4e2a\u8fde\u63a5\u6570\u9650\u989d</li> </ul> <p>\u8d85\u8fc7\u914d\u989d\u7684\u8fde\u63a5\u4f1a\u8fd4\u56de TCP Reset\u3002</p> <p>* FTP \u670d\u52a1\u5df2\u505c\u6b62\u63d0\u4f9b\uff0cRsync \u4ec5\u4ece mirrors2 \u63d0\u4f9b\uff0cmirrors4 \u4e0a\u7684 Rsync \u7aef\u53e3\u9650\u5236\u53ea\u80fd\u4ece mirrors2 \u4e0a\u8bbf\u95ee\u3002</p>"},{"location":"services/mirrors/limiter/#application","title":"\u5e94\u7528\u7ea7\u522b\u9650\u5236","text":"<p>\u6b64\u7c7b\u9650\u5236\u89c4\u5219\u4f4d\u4e8e\u5e94\u7528\u7a0b\u5e8f\u5185\u3002\u7531\u4e8e\u5728\u7528\u6237\u6001\u7a0b\u5e8f\u4e2d\u5b9e\u73b0\uff0c\u56e0\u6b64\u66f4\u52a0\u7075\u6d3b\u3002</p>"},{"location":"services/mirrors/limiter/#nginx-mod-lua","title":"Nginx LUA \u7ec4\u4ef6","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/lua/access.lua</p> <p>\u76ee\u524d\u4f7f\u7528\u4e86 Nginx \u7684 lua \u8bed\u8a00\u6269\u5c55\u5b9e\u73b0\u5bf9\u8bf7\u6c42\u7684\u9650\u5236\u3002\u4e3b\u8981\u6709\u4ee5\u4e0b\u4e09\u7c7b\u9650\u5236\u65b9\u5f0f\uff1a</p> <ol> <li>\u6309\u8fde\u63a5\u6570\u9650\u5236\uff08\u5373\uff1a\u5e76\u53d1\u8bf7\u6c42\u6570\uff09</li> <li>\u6309\u8bf7\u6c42\u901f\u7387\u9650\u5236</li> <li>\u6309\u7d2f\u8ba1\u8bf7\u6c42\u6570\u9650\u5236\uff08\u5468\u671f\u6027\u91cd\u7f6e\u8ba1\u6570\u5668\uff09</li> </ol> <p>\u76ee\u524d\uff0c\u955c\u50cf\u7ad9\u914d\u7f6e\u4e86\u4ee5\u4e0b\u51e0\u79cd\u529f\u80fd\u7684\u9650\u5236\u5668\uff1a</p> <ol> <li>\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u6240\u6709\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u5168\u5c40\u8bf7\u6c42\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u6240\u6709\u8bf7\u6c42\uff0c\u68c0\u6d4b\u5355 IP \u5728\u4e00\u5929\u5185\u7684\u7d2f\u8ba1\u8bf7\u6c42\u6570\u3002\u8d85\u8fc7\u9608\u503c\u540e\uff0c\u964d\u4f4e\u8be5 IP \u7684\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u7684\u9608\u503c\u3002</li> <li>HEAD \u8bf7\u6c42\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e HTTP Method == HEAD \u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u68c0\u6d4b\u5355 IP \u5728\u4e00\u5929\u5185\u7684\u7d2f\u8ba1\u8bf7\u6c42\u6570\u3002\u8d85\u8fc7\u9608\u503c\u540e\uff0c\u5f00\u542f HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u3002</li> <li>HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e HTTP Method == HEAD \u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002\u8be5\u9650\u5236\u5668\u9ed8\u8ba4\u5173\u95ed\u3002</li> <li>\u65ad\u70b9\u7eed\u4f20\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u65ad\u70b9\u7eed\u4f20\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u65ad\u70b9\u7eed\u4f20\u8fde\u63a5\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u65ad\u70b9\u7eed\u4f20\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u5355 URI \u7684\u8fde\u63a5\u6570\u3002</li> <li>\u76ee\u5f55\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u5217\u76ee\u5f55\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u975e\u76ee\u5f55\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355\u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u3002\u5373\uff1a\u6240\u6709\u7528\u6237\u4e4b\u95f4\u5171\u4eab\u540c\u4e00\u4e2a\u914d\u989d\u3002</li> </ol> <p>\u5907\u6ce8\uff1a</p> <ul> <li>\u4f8b\u5916\uff1a</li> <li>apt/yum \u4ed3\u5e93\u7684\u7d22\u5f15\u6587\u4ef6\u4e0d\u53d7\u9650\u5236\u3002</li> <li>AOSP \u4ed3\u5e93\u4e0d\u9650\u5236\u5168\u5c40\u8bf7\u6c42\u6570\uff08git objects \u592a\u591a\u4e86\uff0c\u7528\u6237\u53cd\u9988\u89c1  Issue 397\uff09\u3002</li> <li>\u6848\u4f8b\uff1a\u66fe\u9047\u5230\u8fc7\u653b\u51fb\u8005\u5206\u5e03\u5f0f\u8bf7\u6c42\u540c\u4e00\u4e2a\u5927\u6587\u4ef6\uff0c\u5bfc\u81f4 IO\u3001\u7f51\u7edc\u540c\u65f6\u8fc7\u8f7d\u3002\u57fa\u4e8e IP \u5730\u5740\u7684\u9650\u5236\u63aa\u65bd\u5bf9\u4e8e\u6e90\u5730\u5740\u6c60\u5f88\u5927\u7684\u653b\u51fb\u5f80\u5f80\u6ca1\u6709\u6548\u679c\uff0c\u9650\u5236\u5355\u6587\u4ef6\u7684\u8bf7\u6c42\u901f\u7387\u80fd\u591f\u6709\u6548\u7f13\u89e3\u8fd9\u7c7b\u653b\u51fb\u3002</li> </ul> <p>\u5177\u4f53\u53c2\u6570\u53c2\u8003\u4e0b\u8868\uff1a</p> \u9650\u5236\u5668\u540d\u79f0\u4e0e\u4ee3\u53f7 \u9608\u503c\u5355\u4f4d \u9608\u503c \u7a81\u53d1\u91cf \u8ba1\u6570\u5668\u91cd\u7f6e\u5468\u671f \u52a8\u4f5c \u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Main-Req</code> \u6b21/\u79d2 40 100 / \u8fd4\u56de 429 \u9519\u8bef \u5168\u5c40\u8bf7\u6c42\u6570\u9650\u5236\u5668 <code>Main-Count</code> \u6b21 15000 / 1 \u5929 \u8bbe\u7f6e\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u9608\u503c\u4e3a 0.2 \u6b21/\u79d2 HEAD \u8bf7\u6c42\u6570\u9650\u5236\u5668 <code>Head-Count</code> \u6b21 300 / 1 \u5929 \u5f00\u542f HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Head-Req</code> \u6b21/\u79d2 0.05 5 / \u8fd4\u56de 429 \u9519\u8bef \u65ad\u70b9\u7eed\u4f20\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Partial-Req</code> \u6b21/\u79d2 1 10 / \u8fd4\u56de 429 \u9519\u8bef \u65ad\u70b9\u7eed\u4f20\u8fde\u63a5\u6570\u9650\u5236\u5668 <code>Partial-Conn</code> \u6761 1 0 / \u8fd4\u56de 429 \u9519\u8bef \u76ee\u5f55\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Ls-Req</code> \u6b21/\u79d2 0.5 10 / \u8fd4\u56de 429 \u9519\u8bef \u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>File-Req</code> \u6b21/\u79d2 5 25 / \u8fd4\u56de 429 \u9519\u8bef \u6587\u4ef6\u8bf7\u6c42\u8fde\u63a5\u6570\u9650\u5236\u5668 <code>File-Conn</code> \u6761 100 0 / \u8fd4\u56de 429 \u9519\u8bef How lua-resty-limit-traffic works <p>\u9650\u5236\u5668\u903b\u8f91\u4f7f\u7528 https://github.com/openresty/lua-resty-limit-traffic \u5b9e\u73b0\uff0c\u5176\u4e2d\u4e0a\u8868\u4ee3\u53f7\u5206\u522b\u5bf9\u5e94\u5176 <code>req</code>, <code>count</code>, <code>conn</code> \u4e09\u79cd\u5b9e\u73b0\uff0c<code>traffic</code> \u5219 aggregate \u4e86 <code>count</code> \u4e4b\u5916\u7684\u9650\u5236\u5668\uff0c\u8fd4\u56de\u6700\u5927\u7684\u5ef6\u8fdf\u3002</p> <p><code>req</code> \u7684\u6838\u5fc3\u516c\u5f0f\u662f\uff1a<code>excess = max(excess - rate * elapsed / 1000 + 1000, 0)</code>\uff0c\u5176\u4e2d\u65f6\u95f4\u5355\u4f4d\u662f\u6beb\u79d2\uff08<code>rate</code> \u548c <code>burst</code> \u53c2\u6570\u8ba1\u7b97\u65f6\u90fd\u9700\u8981\u4e58\u4ee5 1000\uff09\u3002<code>excess</code> \u4f1a\u5148\u548c <code>burst</code> \u6bd4\u8f83\uff08\u5982\u679c\u8d85\u51fa\uff0c\u5219 reject\uff09\uff0c\u5982\u679c\u6ca1\u6709\u8d85\u51fa\uff0c\u5219 delay <code>excess / rate</code> \u79d2\u3002</p> <p>\u5f53 elapsed = 1000/rate \u65f6\uff0c\u6070\u597d\u4e0d\u4f1a\u589e\u52a0 <code>excess</code> \u7684\u503c\uff0c\u6b64\u65f6 1 \u79d2\u5185\u6070\u597d\u53ef\u4ee5\u5bb9\u7eb3 rate \u4e2a\u8bf7\u6c42\uff1b\u5f53 elapsed = 1000/(rate+burst) \u65f6\uff0c<code>excess</code> \u589e\u91cf\u4e3a 1000(1-r/(r+b))\uff0c\u6b64\u65f6 1 \u79d2\u5185\u6070\u597d\u6709 (rate+burst) \u4e2a\u8bf7\u6c42\u4e0d\u4f1a\u88ab reject\u3002</p> <p>\u7406\u60f3\u60c5\u51b5\u4e0b\u7684\u4f8b\u5b50\uff1a\u5982\u679c rate = 40r/s = 40 * 1000 r/ms\uff0c\u5219 elapsed \u9700\u8981\u81f3\u5c11\u4e3a 1/40 \u79d2\uff0825 \u6beb\u79d2\uff09\uff0c\u624d\u80fd\u548c\u540e\u9762\u7684 <code>+ 1000</code> \u62b5\u6d88\uff0c\u5426\u5219 <code>excess</code> \u4f1a\u4e00\u76f4\u589e\u52a0\u3002\u5982\u679c burst = 100r/s = 100 * 1000 r/ms\uff0c\u90a3\u4e48\u5047\u8bbe\u6709\u7528\u6237\u6bcf 1/140 \u79d2\uff087.1 \u6beb\u79d2\uff09\u8bbf\u95ee\u4e00\u6b21\uff0c\u90a3\u4e48 <code>excess</code> \u6bcf\u6b21\u4f1a\u589e\u52a0 714.28\uff0c\u5982\u679c\u6709 140 \u4e2a\u8fd9\u6837\u7684\u8bf7\u6c42\uff0c\u90a3\u4e48 <code>excess</code> \u7684\u503c\u5219\u6070\u597d\u662f <code>burst</code> \u7684\u503c\u3002</p> <p><code>count</code> \u7684\u903b\u8f91\u7b80\u5355\u5f88\u591a\uff0c\u4f7f\u7528 lua-nginx-module \u5e26\u7684 https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxshareddictincr \u4e3a\u6bcf\u6b21\u81ea\u589e\u8bbe\u7f6e TTL \u5373\u53ef\u3002</p> <p><code>conn</code> \u4f7f\u7528\u5b57\u5178\u8ba1\u6570\u5668\u7edf\u8ba1\u5f53\u524d\u8fde\u63a5\u6570\uff0c\u5982\u679c\u8d85\u8fc7\u4e86 <code>max + burst</code>\uff0c\u5219 reject\u3002\u5426\u5219\u5982\u679c\u8d85\u8fc7\u4e86 <code>max</code> \u5219\u5ef6\u8fdf <code>unit_delay * floor((conn - 1) / max)</code> \u79d2\u3002<code>unit_delay</code> \u8d77\u59cb\u4e3a\u7528\u6237\u7ed9\u5b9a\u7684\u503c\uff0c\u5728\u4e4b\u540e\u4f1a\u6309\u7167 <code>unit_delay = (req_latency + unit_delay) / 2</code> \u5b9a\u65f6\u8c03\u6574\u3002</p> <p>\u5230\u8fbe\u9608\u503c\u540e\u4f1a\u53d1\u751f\u4ec0\u4e48\uff1f</p> <ul> <li>\u5f53\u8bf7\u6c42\u901f\u7387\u8d85\u8fc7\u9608\u503c\uff0c\u4f46\u672a\u8d85\u8fc7\u7a81\u53d1\u91cf\u65f6\uff0c\u9650\u5236\u5668\u4f1a\u8ba1\u7b97\u51fa\u4e00\u4e2a\u6ee1\u8db3\u9608\u503c\u6761\u4ef6\u7684\u6700\u5c0f\u7b49\u5f85\u65f6\u95f4\u3002\u8fde\u63a5\u4f1a\u88ab\u4e22\u5165\u7b49\u5f85\u6c60\uff0c\u5230\u8fbe\u7b49\u5f85\u65f6\u95f4\u540e\u518d\u88ab\u5904\u7406\u3002</li> <li>\u5f53\u8bf7\u6c42\u901f\u7387\u8d85\u8fc7\u9608\u503c\uff0c\u4e14\u8d85\u8fc7\u7a81\u53d1\u8bf7\u6c42\u91cf\u65f6\uff0c\u5c06\u4f1a\u5728\u7b49\u5f85 5 \u79d2\u540e\u8fd4\u56de HTTP 429 \u9519\u8bef\u3002</li> </ul> <p>\u9650\u5236\u5668\u4e4b\u95f4\u76f8\u4e92\u72ec\u7acb\uff0c\u5f53\u88ab\u89e6\u53d1\u7684\u6240\u6709\u9650\u5236\u5668\u4ea7\u751f\u4e0d\u4e00\u81f4\u7684\u7b49\u5f85\u65f6\u95f4\u65f6\uff0c\u5e94\u7528\u6700\u957f\u7684\u7b49\u5f85\u65f6\u95f4\u3002</p>"},{"location":"services/mirrors/limiter/#large-files","title":"\u5927\u6587\u4ef6\u4e0b\u8f7d\u901f\u5ea6\u9650\u5236","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/lua/header_filter.lua</p> <p>\u9488\u5bf9\u5927\u6587\u4ef6\u4e0b\u8f7d\uff0c\u9650\u5236\u6bcf\u4e2a\u6587\u4ef6\u7684\u603b\u5e26\u5bbd\u4e3a 1Gbps\uff0c\u4ee5\u907f\u514d\u5927\u6587\u4ef6\u6d41\u91cf\u5360\u6ee1\u603b\u5e26\u5bbd\u3002</p> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u5982\u679c\u6709\u591a\u4e2a\u6587\u4ef6\u9762\u4e34\u9ad8\u538b\u529b\u8bbf\u95ee\uff0c\u603b\u5e26\u5bbd\u4f9d\u7136\u53ef\u80fd\u88ab\u5360\u6ee1</p> <p>\u5177\u4f53\u505a\u6cd5\u4e3a\uff0c\u8bbe\u7f6e\u4e0b\u8f7d\u901f\u5ea6\u9608\u503c = 1Gbps / (\u8be5\u5927\u6587\u4ef6\u7684\u540c\u65f6\u8fde\u63a5\u6570 +1)</p> <p>\u5f53\u4e0b\u8f7d\u7684\u6587\u4ef6\u65e0\u7a77\u5927\u65f6\uff0c\u5c06\u51fa\u73b0\u6700\u5dee\u60c5\u5f62\uff0c\u5373\u7528\u6237\u88ab\u5206\u914d\u5230\u7684\u4e0b\u8f7d\u901f\u7387\u670d\u4ece\u7c7b\u8c03\u548c\u7ea7\u6570\uff0c\u51fd\u6570\u53d1\u6563\u3002\u5b9e\u9645\u60c5\u51b5\u4e0b\uff0c\u65e9\u671f\u7528\u6237\u4e0b\u8f7d\u5b8c\u6210\u540e\u8fde\u63a5\u91ca\u653e\uff0c\u6700\u7ec8\u5e26\u5bbd\u5c06\u6536\u655b\u5230 1Gbps\u3002</p> <p>\u6ce8\uff1a\u5927\u6587\u4ef6\u5b9a\u4e49\u53c2\u7167\u76ee\u524d\u7684 lua \u811a\u672c\u914d\u7f6e\u3002</p>"},{"location":"services/mirrors/limiter/#nginx-js-challenge","title":"Nginx JavaScript \u6311\u6218","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/sites-available/iso.mirrors.ustc.edu.cn</p> <p>\u4e3a\u4e86\u62b5\u6297\u201c\u8fc5\u96f7\u653b\u51fb\u201d\u3002\u5bf9\u4e8e\u7279\u5b9a\u7c7b\u578b\u7684\u6587\u4ef6\uff0c\u5f00\u542f\u4e86 JS \u6311\u6218\u3002\u5982\u679c\u5ba2\u6237\u7aef User-Agent \u4e3a Mozilla\uff08\u5373\u6d4f\u89c8\u5668\uff09\uff0c\u5219\u53d1\u9001\u4e00\u6bb5\u5305\u542b JS \u811a\u672c\u7684\u9875\u9762\uff0c\u68c0\u9a8c\u8fd0\u884c\u7684\u7ed3\u679c\u3002\u5982\u679c\u6311\u6218\u5931\u8d25\uff0c\u5219\u8fd4\u56de\u9519\u8bef\u3002</p> <p>\u88ab\u4fdd\u62a4\u7684\u6587\u4ef6\u7c7b\u578b\u6709\uff1a</p> <ul> <li>iso</li> <li>exe</li> <li>dmg</li> <li>run</li> <li>zip</li> <li>tar</li> </ul>"},{"location":"services/mirrors/limiter/#robots","title":"\u722c\u866b\u9650\u5236","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/snippets/robots</p> <p>\u5982\u679c\u5ba2\u6237\u7aef User-Agent \u5305\u542b Spider\u3001Robot \u5173\u952e\u5b57\uff0c\u5219\u7981\u6b62\u5176\u8bbf\u95ee\u4ed3\u5e93\u5185\u5bb9\u3002\u907f\u514d\u7531\u4e8e\u9891\u7e41\u5217\u76ee\u5f55\u5e26\u6765\u5927\u91cf IO \u8d1f\u8f7d\u3002</p>"},{"location":"services/mirrors/limiter/#rsync-connections","title":"Rsync \u603b\u8fde\u63a5\u6570\u9650\u5236","text":"<p>Rsync \u670d\u52a1\u8bbe\u7f6e\u4e86\u603b\u8fde\u63a5\u6570\u9650\u5236\u3002\u5373\uff1a\u5f53\u5efa\u7acb\u7684\u8fde\u63a5\u6570\u5230\u8fbe\u67d0\u4e2a\u9608\u503c\u540e\uff0c\u62d2\u7edd\u4e4b\u540e\u6536\u5230\u7684\u8fde\u63a5\u3002</p> <p>\u5386\u53f2\u8bb0\u5f55</p> <p>\u4ee5\u524d HTTP \u548c Rsync \u670d\u52a1\u7531\u540c\u4e00\u53f0\u670d\u52a1\u5668\u63d0\u4f9b\uff0c\u7531\u4e8e\u767d\u5929 HTTP \u8bbf\u95ee\u538b\u529b\u8f83\u5927\uff0c\u591c\u665a HTTP \u8bbf\u95ee\u91cf\u8f83\u5c0f\uff0c\u4e3a\u4e86\u5b9e\u73b0\u9519\u5cf0\u540c\u6b65\uff0c\u4fdd\u8bc1\u767d\u5929 HTTP \u7684\u670d\u52a1\u8d28\u91cf\uff0c\u56e0\u6b64\u9488\u5bf9\u4e0d\u540c\u65f6\u6bb5\u8bbe\u7f6e\u4e86\u4e0d\u540c\u7684\u9608\u503c\uff0c\u5177\u4f53\u5982\u4e0b\uff1a</p> <ul> <li>23:00 ~ 8:00\uff1a\u6700\u591a 60 \u4e2a\u8fde\u63a5</li> <li>8:00 ~ 23:00\uff1a\u6700\u591a 30 \u4e2a\u8fde\u63a5</li> </ul> <p>\u5728 2020 \u5e74 8 \u6708 25 \u65e5\u540e\uff0c\u7531\u4e8e\u66f4\u6362\u4e86\u65b0\u670d\u52a1\u5668\uff0cRsync \u7531\u5355\u72ec\u673a\u5668\u63d0\u4f9b\u670d\u52a1\uff0c\u603b\u8fde\u63a5\u6570\u63d0\u5347\u5230\u4e86\u5168\u5929 60 \u4e2a\u8fde\u63a5\u3002</p> <p>\u7279\u522b\u7684\uff0c\u79d1\u5927\u6821\u5185 IP \u5730\u5740\u53d7\u5230 rsync \u8fde\u63a5\u6570\u9650\u5236\u3002</p>"},{"location":"services/mirrors/limiter/#interface-limit","title":"\u7f51\u7edc\u63a5\u53e3\u7ea7\u522b\u9650\u5236","text":"<p>mirrors \u5e38\u6001\u4e0b\u6ca1\u6709\u7f51\u7edc\u63a5\u53e3\u9650\u5236\uff0c\u4f46\u5728\u9700\u8981\u4e34\u65f6\u5bf9\u67d0\u4e00\u63a5\u53e3\u8fdb\u884c\u9650\u5236\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528 tc \u6765\u5b8c\u6210\u3002</p> <p>\u4f8b\u5982\u53ef\u4ee5\u53c2\u8003\u8fd9\u4efd\u56de\u7b54\uff1aiptables - Limiting interface bandwidth with tc under Linux - Server Fault\uff0c\u4f7f\u7528\u5982\u4e0b\u6307\u4ee4\u9650\u5236\u67d0\u4e00\u63a5\u53e3\u7684\u7f51\u7edc\u901f\u7387\u4e3a 1.5Gbps\uff1a</p> <pre><code>tc qdisc add dev &lt;interface&gt; root handle 1: tbf rate 1500Mbit burst 750K latency 14ms\n</code></pre> <p>\u8fd9\u91cc\u4f7f\u7528\u4e86 TBF\uff08\u4ee4\u724c\u6876\uff09\u7b97\u6cd5\uff0c\u540e\u9762\u7684 burst \u548c latency \u53c2\u6570\u610f\u4e49\u53ef\u4ee5\u53c2\u89c1 <code>man tc-tbf</code>\u3002 \u5177\u4f53\u800c\u8a00\uff0clatency \u6ca1\u6709\u63a8\u8350\u503c\uff0c\u4f46 burst \u8981\u6c42\u81f3\u5c11\u4e3a <code>rate / HZ</code>\uff0cHZ = 100 \u65f6 10Mbps \u81f3\u5c11\u7ea6 10MB\u3002 HZ \u7684\u503c\u9700\u8981\u4ece\u5185\u6838\u7684\u7f16\u8bd1\u53c2\u6570\u4e2d\u67e5\u770b\uff1a<code>egrep '^CONFIG_HZ_[0-9]+' /boot/config-`uname -r`</code>\u3002\u73b0\u4ee3\u53d1\u884c\u7248\u63d0\u4f9b\u7684\u5185\u6838\u4e2d\u8fd9\u4e2a\u503c\u4e00\u822c\u4e3a 250\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1aBucket size in tbf</p> <p>\u76ee\u524d\u90e8\u7f72\u7684\u9650\u5236\u6709\uff1a</p> <ul> <li>unicom 1500Mbit\uff08\u5b66\u6821\u51fa\u53e3\u5e26\u5bbd 2 Gbps\uff09</li> <li>telecom 2500Mbit\uff08\u5b66\u6821\u51fa\u53e3\u5e26\u5bbd 5 Gbps\uff09</li> </ul> <p>\u5728 mirrors4 \u4e0a\u8be5\u914d\u7f6e\u7684\u5f00\u673a\u81ea\u542f\u5206\u522b\u4f4d\u4e8e <code>tc-unicom.service</code> \u548c <code>tc-telecom.service</code> \u4e24\u4e2a\u670d\u52a1\u4e2d\uff0c\u5176\u4e2d <code>tc-unicom.service</code> \u914d\u7f6e\u5982\u4e0b\uff1a</p> <pre><code>[Unit]\nDescription=Rate Limiting for Unicom Interface\n\n[Service]\nType=oneshot\nRemainAfterExit=true\nExecStart=/usr/sbin/tc qdisc replace dev unicom root handle 1: tbf rate 1500Mbit burst 750K latency 14ms\nExecStop=/usr/sbin/tc qdisc delete dev unicom root handle 1\n\n[Install]\nWantedBy=sys-subsystem-net-devices-unicom.device\n</code></pre> <p>Install \u90e8\u5206\u7684 WantedBy \u4f7f\u7528\u8fd9\u79cd\u5199\u6cd5\u53ef\u4ee5\u4f7f\u8be5\u670d\u52a1\u4f9d\u8d56\u4e8e\u540d\u4e3a <code>unicom</code> \u7684\u7f51\u53e3\uff0c\u8be6\u7ec6\u56de\u7b54\u53ef\u4ee5\u770b What is the systemd-networkd equivalent of post-up?\u3002</p>"},{"location":"services/mirrors/limiter/#blacklists","title":"IP \u9ed1\u540d\u5355\u9650\u5236","text":"<p>\u5bf9\u4e8e\u6ee5\u7528\u7684 IP \u6bb5\uff0c\u53ef\u4ee5\u4f7f\u7528 ipset \u548c iptables \u5b9e\u73b0\u9ed1\u540d\u5355\u9650\u5236\u3002 ipset \u5c06\u67d0\u4e2a IP \u5339\u914d\u5230\u4e00\u4e2a\u96c6\u5408\u4e2d\uff0ciptables \u518d\u9488\u5bf9\u67d0\u4e00\u96c6\u5408\u8fdb\u884c\u9650\u5236\u3002</p> <p>ipset \u548c iptables \u7684\u4f7f\u7528\u53ef\u4ee5\u53c2\u8003\uff1aIpset - Arch Wiki \u3002</p> <p>\u6211\u4eec\u5df2\u5728 mirrors4 \u4e0a\u914d\u7f6e\u4e86 <code>blacklist</code> \u548c <code>blacklist6</code> \u96c6\u5408\uff0c\u82e5\u8981\u5c01\u7981\u67d0\u4e2a IP \u6216\u7f51\u6bb5\uff0c\u53ef\u4ee5\u76f4\u63a5\u5c06\u8be5\u7f51\u6bb5\u52a0\u5165\u96c6\u5408\uff0c\u4f8b\u5982\uff1a</p> <pre><code>ipset add blacklist 192.0.2.0/24\nipset add blacklist6 2001:db8:114:514::/64\n</code></pre> <p>\u4e0e iptables \u7c7b\u4f3c\uff0cipset \u4e5f\u9700\u8981\u6301\u4e45\u5316\u3002\u5c01\u7981\u540d\u5355\u7684\u6587\u4ef6\u4f4d\u4e8e\uff08mirrors4\uff09<code>/usr/local/network_config/iptables/blacklist.list</code>\uff0c\u4fee\u6539\u6b64\u6587\u4ef6\u589e\u51cf\u6761\u76ee\u540e\u8fd0\u884c\u8be5\u76ee\u5f55\u4e0b\u7684 <code>apply.sh</code> \u5373\u53ef\u3002</p> <p>\u7531\u4e8e\u5c01\u7981\u4ec5\u5bf9\u65b0\u5efa\u7acb\u7684\u8fde\u63a5\u6709\u6548\uff0c\u8bf7\u5728\u4fee\u6539\u5c01\u7981\u540d\u5355\u540e\uff0c\u4f7f\u7528 <code>ss -K dst \u5bf9\u5e94\u7684\u7f51\u6bb5</code> \u5173\u95ed\u5df2\u7ecf\u5efa\u7acb\u7684\u8fde\u63a5\uff08\u4f8b\u5982\u5bf9\u4e8e\u4ee5\u4e0a\u4e24\u884c\u89c4\u5219\uff0c\u547d\u4ee4\u5206\u522b\u4e3a <code>ss -K dst 192.0.2.0/24</code> \u4e0e <code>ss -K dst 2001:db8:114:514::/64</code>\uff09\u3002</p>"},{"location":"services/mirrors/limiter/#ipset-persistent","title":"ipset \u6301\u4e45\u5316","text":"<p>\u6211\u4eec\u4f7f\u7528\u8f6f\u4ef6\u6e90\u91cc\u7684 <code>ipset-persistent</code> \u5305\u6765\u5e2e\u52a9 ipset \u5728\u5f00\u673a\u65f6\u81ea\u52a8\u6062\u590d\uff0c\u8be5\u8f6f\u4ef6\u5305\u4f1a\u5728\u5f00\u673a\u52a0\u8f7d iptables \u524d\u5148\u4ece <code>/etc/iptables/ipsets</code> \u4e2d\u6062\u590d ipset \u4ee5\u786e\u4fdd iptables \u4e2d\u7684\u5f15\u7528\u80fd\u6b63\u786e\u5904\u7406\u3002</p> <p>\u56e0\u4e3a ipset-persistent \u5728\u5f00\u673a\u65f6\u81ea\u52a8\u52a0\u8f7d\uff0c\u6211\u4eec\u9009\u62e9\u4ec5\u52a0\u8f7d\u4e00\u4e2a\u8f83\u5c0f\u7684\u5b50\u96c6\uff0c\u5305\u542b\u5fc5\u8981\u914d\u7f6e\uff08create set\uff09\u548c\u8f83\u5c11\u53d1\u751f\u53d8\u5316\u7684\u5185\u5bb9\uff08\u5982 ustcnet \u7684\u7f51\u6bb5\uff09\u3002\u76ee\u524d <code>/etc/iptables/ipsets</code> \u5305\u542b\u4ee5\u4e0b\u5185\u5bb9\uff1a</p> <pre><code>create ustcnet hash:net family inet hashsize 1024 maxelem 65536\ncreate f2b-sshd hash:ip family inet hashsize 1024 maxelem 65536 timeout 3600\ncreate blacklist hash:net family inet hashsize 1024 maxelem 65536\ncreate blacklist6 hash:net family inet6 hashsize 1024 maxelem 65536\n\nadd ustcnet 202.38.64.0/19\n# more ustcnet entries...\n</code></pre>"},{"location":"services/mirrors/limiter/#403","title":"403 \u9875\u9762","text":"<p>\u76ee\u524d mirrors4 \u5c06\u6765\u6e90 IP \u5c5e\u4e8e <code>blacklist</code> \u6216 <code>blacklist6</code> \u96c6\u5408\u4e14\u76ee\u6807\u7aef\u53e3\u4e3a 80 \u6216 443 \u7684\u8fde\u63a5\u91cd\u5b9a\u5411\u81f3 403 \u7aef\u53e3\u3002403 \u9875\u9762\u4f4d\u4e8e <code>/var/www/html/403.html</code>\u3002</p> <p>\u76f8\u5173 nginx \u914d\u7f6e\u4f4d\u4e8e /etc/nginx/sites-available/mirrors.ustc.edu.cn-403\u3002</p> <p>\u6211\u4eec\u4f7f\u7528 <code>ip{,6}tables</code> \u5c06\u5bf9 80 \u6216 443 \u7aef\u53e3\u7684\u8bbf\u95ee\u91cd\u5b9a\u5411\u81f3 403 \u7aef\u53e3\uff0c\u5728 <code>nat</code> \u8868\u7684 <code>PREROUTING</code> \u94fe\u6dfb\u52a0\u89c4\u5219\uff1a</p> <pre><code>-A PREROUTING -m set --match-set blacklist src -p tcp -m multiport --dports 80,443 -j REDIRECT --to-port 403\n</code></pre> <p>\u5e76\u5728 <code>filter</code> \u8868 <code>BLACKLIST</code> \u94fe\u653e\u884c\u5df2\u5efa\u7acb\u8fde\u63a5\uff0c\u5bf9 403 \u7aef\u53e3\u9650\u901f\uff1a</p> <pre><code>-A BLACKLIST -m conntrack --ctstate ESTABLISHED -j RETURN\n-A BLACKLIST -p tcp --dport 403 -m hashlimit --hashlimit-upto 60/min --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-srcmask 64 --hashlimit-name nginx-403 --hashlimit-htable-expire 60000 -j RETURN\n-A BLACKLIST -j DROP\n</code></pre>"},{"location":"services/mirrors/mail-list/","title":"Mail List","text":"<p>Warning</p> <p>This no longer works since servers.ustclug.org has been migrated to Jekyll.</p> <p>Plugin Email Subscribers &amp; Newsletters on servers.ustclug.org sends a mail to Google Group when a new article posted on mirrors catalogue.</p> <p>The mails are sent from servers@ustclug.org, which is a member of Google Group with write permission.</p> <p>Google Group: ustc-mirrors@googlegroups.com</p>"},{"location":"services/mirrors/monitor/","title":"Mirrors-specific monitoring","text":""},{"location":"services/mirrors/monitor/#connections-users-online","title":"Connections (Users online)","text":"/etc/telegraf/telegraf.d/exec.conf<pre><code>[[inputs.exec]]\n  commands = [\n    \"/opt/monitor/telegraf/connection.sh 21:80:443:873:9418\",\n    \"/opt/monitor/telegraf/nfacct.sh\",\n    \"/opt/monitor/telegraf/process.sh\",\n  ]\n  timeout = \"5s\"\n  data_format = \"influx\"\n</code></pre> /opt/monitor/telegraf/connection.sh<pre><code>#!/bin/bash\n\nport_list_input=${1//:/|}\nport_list=${port_list_input:-\"80|443\"}\nnetstat -ntW | gawk '{print tolower($6),gensub(/^(.+):([^:]+)$/,\"\\\\1 \\\\2\",\"g\",$4)}' | grep -P \" ($port_list)\\$\" | sort | uniq -c | sort -k 4 -k 3 | awk \"{printf(\\\"connection,protocol=tcp,port=%s,address=%s %s=%s\\n\\\",\\$4,\\$3,\\$2,\\$1)}\"\nnetstat -ntW | gawk '{print tolower($6),gensub(/^(.+):([^:]+)$/,\"\\\\2\",\"g\",$4)}' | grep -P \" ($port_list)\\$\" | sort | uniq -c | sort -k 3 | awk \"{printf(\\\"connection,protocol=tcp,port=%s,address=any %s=%s\\n\\\",\\$3,\\$2,\\$1)}\"\n</code></pre> /opt/monitor/telegraf/nfacct.sh<pre><code>#!/bin/bash\n\nsudo nfacct list | awk '-F[ ,;]' \"{printf(\\\"nfacct,object=%s bytes=%i,pkgs=%i\\n\\\",\\$11,\\$8,\\$4)}\"\n</code></pre> /opt/monitor/telegraf/process.sh<pre><code>#!/bin/sh\n\nps -e -o s= -o comm= |\n  grep -v '^[SI] ' |\n  sed 's|/.*$|/|g' |\n  sort | uniq -c |\n  awk '{printf(\"process,state=%s,name=%s count=%ii\\n\",$2,$3,$1)}'\n</code></pre>"},{"location":"services/mirrors/rsync/","title":"Rsync","text":""},{"location":"services/mirrors/rsync/#rsync-huai","title":"rsync-huai","text":"<p>rsync-huai \u662f\u574f\u4eba\u7684\u5143\u6570\u636e\u52a0\u901f\u7248\u7684 rsync\uff0c\u539f\u59cb\u4ee3\u7801\u5728 https://github.com/tuna/rsync\u3002</p> <p>\u7531\u4e8e TUNA \u73b0\u5728\u4f7f\u7528\u5168\u95ea\u7684\u65b9\u6848\uff0c\u4e0d\u518d\u9700\u8981\u8fd9\u4e2a patch \u4e86\uff0c\u56e0\u6b64\u6211\u4eec\u81ea\u5df1\u7ef4\u62a4\u5bf9\u5e94\u7684\u7248\u672c\uff1ahttps://github.com/ustclug/rsync/tree/rsync-3.2.7\u3002</p> <p>\u7279\u522b\u5730\uff0c<code>/etc/systemd/system/rsyncd-huai@.service</code> \u5185\u5bb9\u5982\u4e0b\uff1a</p> <pre><code>[Unit]\nDescription=fast remote file copy program daemon\nConditionPathExists=/etc/rsyncd/rsyncd-%i.conf\nAfter=network.target network-online.target\n\n[Service]\nType=simple\nPIDFile=/run/rsyncd-%i.pid\nExecStart=/usr/bin/rsync-huai --daemon --no-detach --config=/etc/rsyncd/rsyncd-%i.conf\nIOSchedulingClass=best-effort\nIOSchedulingPriority=7\nIOAccounting=true\n\n[Install]\nWantedBy=multi-user.target\n</code></pre>"},{"location":"services/mirrors/rsync/#rsync-proxy","title":"rsync-proxy","text":"<p>\u8be6\u53c2 https://github.com/ustclug/rsync-proxy\u3002\u4e3a\u4e86\u8ba9\u670d\u52a1\u5668\u80fd\u591f\u8bb0\u5f55 IP \u4e0e\u8bbf\u95ee\u8def\u5f84\u7684\u5173\u7cfb\uff0c\u6211\u4eec\u6253\u5f00\u4e86 proxy protocol \u7279\u6027\u3002</p>"},{"location":"services/mirrors/services/","title":"\u955c\u50cf\u670d\u52a1","text":""},{"location":"services/mirrors/services/#_2","title":"\u9996\u9875\u751f\u6210","text":"<p>\u955c\u50cf\u7ad9\u4e3b\u9875\u662f\u9759\u6001\u7684\uff0c\u7531 https://git.lug.ustc.edu.cn/mirrors/mirrors-index \u811a\u672c\u751f\u6210\u3002</p> <p>crontab \u4f1a\u5b9a\u65f6\u8fd0\u884c\u8be5\u811a\u672c\uff0c\u751f\u6210\u9996\u9875\u548c mirrorz \u9879\u76ee\u9700\u8981\u7684\u6570\u636e\u3002</p> <p>\u5728\u9996\u9875\u5c55\u793a\u7684\u300c\u83b7\u53d6\u5b89\u88c5\u955c\u50cf\u300d\u3001\u300c\u83b7\u53d6\u5f00\u6e90\u8f6f\u4ef6\u300d\u3001\u300c\u53cd\u5411\u4ee3\u7406\u5217\u8868\u300d\u5206\u522b\u7531 config \u5185\u914d\u7f6e\u6307\u5b9a\uff0c\u300c\u6587\u4ef6\u5217\u8868\u300d\u5185\u5bb9\u5219\u4f1a\u4ece\u540c\u6b65\u7a0b\u5e8f yuki \u7684 api \u4e2d\u83b7\u53d6\u3002</p>"},{"location":"services/mirrors/services/#http","title":"HTTP \u670d\u52a1","text":"<p>Mirrors \u4f7f\u7528 OpenResty\uff08\u4e00\u4e2a\u6253\u5305 Nginx \u548c\u4e00\u5806\u6709\u7528\u7684 Lua \u6a21\u5757\u7684\u8f6f\u4ef6\u5305\uff09\u63d0\u4f9b HTTP \u670d\u52a1\u3002</p> <p>\u914d\u7f6e\u6587\u4ef6\u4f4d\u4e8e LUG GitLab \u4e0a\uff1ahttps://git.lug.ustc.edu.cn/mirrors/nginx-config\uff0c\u6b64\u4ed3\u5e93\u5bf9\u5e94 mirrors \u4e0a\u7684 <code>/etc/nginx</code> \u76ee\u5f55\u3002</p>"},{"location":"services/mirrors/services/#_3","title":"\u8bf7\u6c42\u9650\u5236\u7b56\u7565","text":"<p>\u89c1\u9650\u5236\u7b56\u7565\u3002</p>"},{"location":"services/mirrors/services/#rsync","title":"Rsync \u670d\u52a1","text":"<p>\u672a\u5b8c\u5f85\u7eed\u3002</p>"},{"location":"services/mirrors/services/#_4","title":"\u53cd\u5411\u4ee3\u7406\u670d\u52a1","text":"<p>\u672a\u5b8c\u5f85\u7eed\u3002</p>"},{"location":"services/mirrors/services/#ftp","title":"FTP \u670d\u52a1\uff08\u5df2\u5e9f\u5f03\uff09","text":"<p>Mirrors \u66fe\u7ecf\u63d0\u4f9b FTP \u670d\u52a1\uff0c\u7531 vsftpd \u63d0\u4f9b\u3002\u5728\u5c06\u4e3b\u529b\u670d\u52a1\u5668\u4ece mirrors2 \u8fc1\u79fb\u81f3 mirrors4 \u65f6\u5e9f\u5f03\uff0c\u5373 mirrors4 \u4e0a\u4ece\u672a\u5b89\u88c5\u914d\u7f6e\u8fc7 vsftpd\uff08\u4f46 mirrors2 \u4e0a\u8fd8\u7559\u5b58\u6709\u914d\u7f6e\u6587\u4ef6\uff09\u3002</p> <p>\u7531\u4e8e\u5e74\u4ee3\u4e45\u8fdc\u4e14\u6211\u4eec\u4e0d\u518d\u6253\u7b97\u6062\u590d FTP \u670d\u52a1\uff0c\u8fd9\u90e8\u5206\u6587\u6863\u4e5f\u5c31\u5495\u5495\u5495\u4e86\u3002</p>"},{"location":"services/mirrors/zfs/","title":"ZFS","text":""},{"location":"services/mirrors/zfs/#configuration","title":"Configuration","text":""},{"location":"services/mirrors/zfs/#pool-setup-mirrors2","title":"Pool setup (mirrors2)","text":"<pre><code>zpool create pool0 \\\n  -O canmount=off \\\n  -O xattr=sa \\\n  -O relatime=on \\\n  -O compress=zstd \\\n  raidz2 \\\n  ata-HGST_HUS726060ALE610_K1GKVAAD \\\n  ata-HGST_HUS726060ALE610_K1GHTLND \\\n  ata-HGST_HUS726060ALE610_K1GHTVWD \\\n  ata-HGST_HUS726060ALE610_K1GKNJUD \\\n  ata-HGST_HUS726060ALE610_K1GK5KND \\\n  ata-HGST_HUS726060ALE610_K1GK9GXD \\\n  raidz2 \\\n  ata-HGST_HUS726060ALE610_NCH13D2V \\\n  ata-HGST_HUS726T6TALE6L4_V9KWJ1PL \\\n  ata-HGST_HUS726T6TALE6L4_V9HU810L \\\n  ata-HGST_HUS726060ALE610_NCH141WV \\\n  ata-HGST_HUS726060ALE610_K1GKPDSD \\\n  ata-HGST_HUS726T6TALE6L4_V9KTTT5L \\\n  cache nvme0n1\n</code></pre> <p>Note</p> <p>The <code>-O</code> option applies to the root dataset.</p> Create ZFS (2016) <pre><code>zpool create -f pool0 \\\n  raidz3 \\\n  ata-HGST_HUS726060ALE610_K1GHTLND \\\n  ata-HGST_HUS726060ALE610_K1GHTVWD \\\n  ata-HGST_HUS726060ALE610_K1GK5KND \\\n  ata-HGST_HUS726060ALE610_K1GK9GXD \\\n  ata-HGST_HUS726060ALE610_K1GKNJUD \\\n  ata-HGST_HUS726060ALE610_K1GKNP5D \\\n  ata-HGST_HUS726060ALE610_K1GKNR6D \\\n  ata-HGST_HUS726060ALE610_K1GKPDSD \\\n  ata-HGST_HUS726060ALE610_K1GKVAAD \\\n  ata-HGST_HUS726060ALE610_NCH04T5V \\\n  ata-HGST_HUS726060ALE610_NCH13D2V \\\n  spare \\\n  ata-HGST_HUS726060ALE610_NCH141WV \\\n  log mirror \\\n  ata-INTEL_SSDSC2BB240G6_PHWA64410400240AGN-part1 \\\n  ata-INTEL_SSDSC2BB240G6_PHWA6441041N240AGN-part1 \\\n  cache \\\n  ata-INTEL_SSDSC2BB240G6_PHWA64410400240AGN-part2 \\\n  ata-INTEL_SSDSC2BB240G6_PHWA6441041N240AGN-part2\n</code></pre>"},{"location":"services/mirrors/zfs/#zfs-kernel-module","title":"ZFS kernel module","text":"<p>For OpenZFS 2.2:</p> /etc/modprobe.d/zfs.conf<pre><code># Set ARC size to 160-200 GiB\noptions zfs zfs_arc_max=214748364800\noptions zfs zfs_arc_min=171798691840\noptions zfs zfs_arc_sys_free=17179869184\n\n# Allow up to 80% of ARC to be used for dnodes\noptions zfs zfs_arc_dnode_limit_percent=80\n\n# Allow every block to be written to ZIL\noptions zfs zfs_immediate_write_sz=16777216\n\n# See man page section \"ZFS I/O Scheduler\"\noptions zfs zfs_vdev_async_read_max_active=8\noptions zfs zfs_vdev_async_read_min_active=2\noptions zfs zfs_vdev_scrub_max_active=5\noptions zfs zfs_vdev_max_active=20000\n\n# Never throttle the ARC\noptions zfs zfs_arc_lotsfree_percent=0\n\n# Tune L2ARC\noptions zfs l2arc_headroom=8\noptions zfs l2arc_write_max=67108864\noptions zfs l2arc_noprefetch=0\n</code></pre> <p>Refer to <code>zfs(4)</code>.</p> <p>Note</p> <p><code>zfs_dmu_offset_next_sync</code> is 1 by default since OpenZFS v2.1.5, so it's omitted in the configuration.</p>"},{"location":"services/mirrors/zfs/#dataset-properties","title":"Dataset properties","text":"<p>On mirrors2:</p> <pre><code>zfs create -o compress=zstd-8 -o recordsize=1M -o atime=off pool0/backup\n\nzfs create pool0/backup/rootfs # inherit everything\nzfs create -o acltype=posix pool0/backup/oldlog\n\nzfs create \\\n  -o mountpoint=/srv/repo \\\n  -o recordsize=1M \\\n  -o xattr=off \\\n  -o atime=off \\\n  -o setuid=off \\\n  -o exec=off \\\n  -o devices=off \\\n  -o sync=disabled \\\n  -o secondarycache=metadata \\\n  -o redundant_metadata=some \\\n  pool0/repo\n</code></pre> <p>Refer to <code>zfsprops(7)</code>.</p>"},{"location":"services/mirrors/zfs/#considerations","title":"Considerations","text":"<code>mountpoint</code> <p>Self-explanatory.</p> <code>recordsize=1M</code> <p>This is the \"block size\" for ZFS, i.e. how large files are split into blocks. Each block (record) is stored contiguously on disk and is read/written as a whole.</p> <p>Since the typical read pattern on mirror sites is whole-file sequential read, it makes sense to set <code>recordsize</code> to the maximum value permitted<sup>1</sup>. Larger <code>recordsize</code> allows the compression algorithm to exploit more opportunities, while also reducing I/O count for large files.</p> <p>Note that files under a single <code>recordsize</code> will not be padded up and will be stored as a single block, so no space is wasted.</p> <code>compression=zstd</code> (inherited from <code>pool0</code>) <p>Enable compression so anything will be tried to compress. The default algorithm (i.e. <code>compression=on</code>) is LZ4, which is very fast but not as effective. Zstd is a modern multi-threaded algorithm that is also very fast but compresses better. The default compression level is 3 (i.e. <code>zstd</code> = <code>zstd-3</code>).</p> <p>Since OpenZFS 2.2, there's an \"early-abort\" mechanism for Zstd level 3 or up: Every block is first tried with LZ4, then Zstd-1, and if and only if both algorithms suggest that the data block would compress well, the actual algorithm will be applied and the compressed result will be written to disk. This early-abort mechanism ensures minimal CPU wasted for incompressible data.</p> <code>xattr=off</code> <p>Apparently mirror data do not need extended attributes.</p> <code>atime=off</code>, <code>setuid=off</code>, <code>exec=off</code>, <code>devices=off</code> <p>These simply maps to the <code>noatime</code>, <code>nosuid</code>, <code>noexec</code>, and <code>nodev</code> mount options respectively. It's safe to assume we don't need these features for mirror data.</p> <code>sync=disabled</code> <p>Disable any \"synchronous write\" semantics. This means files will not respond to <code>open(O_SYNC)</code> and <code>sync(2)</code> calls. Pending writes will only be committed to disk after <code>zfs_txg_timeout</code> seconds (default 5) or when the write buffer is full.</p> <p>While normally this is a bad idea as it goes against data integrity (namely, the \"D\" in ACID), for mirror data that can be easily regenerated, this improves write performance and reduces fragmentation (also note that <code>zfs_dmu_offset_next_sync</code> is enabled by default).</p> <code>secondarycache=metadata</code> <p>As mirrors2 only serves Rsync requests, caching file content provides little benefit. Instead, we cache metadata only to reduce the number of disk seeks.</p> <code>redundant_metadata=some</code> <p>(Just read <code>zfsprops(7)</code> and you'll be able to reason about this.)</p>"},{"location":"services/mirrors/zfs/#common-operations","title":"Common Operations","text":"Get zpool status<pre><code>zpool status\n</code></pre> Get IO status<pre><code>zpool iostat -v 1\n</code></pre> Replace Disk<pre><code>zpool replace pool0 old-disk new-disk\n</code></pre> New ZFS file system<pre><code>zfs create [-o option=value ...] &lt;filesystem&gt;\n\n# Example\nzfs create pool0/repo/debian\n</code></pre> <p>If <code>mountpoint</code> is not specified, then it's inherited from the parent with a subpath appended. E.g. when <code>pool0/example</code> is mounted on <code>/mnt/haha</code> then <code>pool0/example/test</code> will by default mount on <code>/mnt/haha/test</code>.</p> Destory ZFS file system<pre><code>zfs destroy &lt;filesystem&gt;\n\n# Example\nzfs destroy pool0/repo/debian\n</code></pre>"},{"location":"services/mirrors/zfs/#traps","title":"Traps","text":"<p>Do NOT install <code>zfs-dkms</code> and related packages from Debian backports repositories. They'll easily break when upgrading.</p> <p>As of Debian Buster the ZFS packages from the mainstream repository is stable and new enough for our use.</p> <p>\u4ecd\u7136\u5efa\u8bae\u5b89\u88c5 Backports \u7248\u672c\u7684 ZFS\u3002\u300cStable \u8d8a\u5f80\u540e\uff08\u5bf9 ZFS \u76f8\u5173\u8f6f\u4ef6\u5305\u7684\uff09\u7ef4\u62a4\u8d8a\u5f31\u300d\uff0c\u4ece\u800c\u5bfc\u81f4 stable \u7684 ZFS \u53cd\u800c\u8d28\u91cf\u4e0d\u5982 backports \u7248\u672c\u7684\u3002</p> <ol> <li> <p>Actually, there's the <code>zfs_max_recordsize</code> module parameter which can be increased to up to 16 MiB. There's a reason this is set to 1 MiB by default, so we're not going to blindly aim for the maximum.\u00a0\u21a9</p> </li> </ol>"},{"location":"services/mirrors/1/","title":"mirrors1","text":"<p>mirrors1 \u662f 2011 \u5e74\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u63d0\u4f9b\u7ed9 LUG \u7528\u4f5c\u521d\u4ee3 mirrors.ustc.edu.cn \u670d\u52a1\u7684\u673a\u5668\uff0c\u662f\u4e00\u53f0\u66d9\u5149 i620r-G</p> \u53c2\u6570 \u914d\u7f6e CPU Intel(R) Xeon(R) CPU E5620 @ 2.40GHz x 2 \u5185\u5b58 48 GB \u5b58\u50a8 LSI Logic MegaRAID SAS 8708EM2 x 2 DFT RS-3016I-S/D30 \u78c1\u76d8\u9635\u5217 \u7f51\u7edc Ethernet Intel 82574L Gigabit x 2 <p>\u7528\u6237\u624b\u518c</p> <p>\u7531\u4e8e\u672c\u6587\u7f16\u5199\u65f6\uff082020 \u5e74\uff09\u8be5\u670d\u52a1\u5668\u65e9\u5df2\u4e0d\u518d\u7528\u4f5c mirrors\uff08\u73b0\u5728\u662f esxi-5\uff09\uff0c\u56e0\u6b64\u66f4\u591a\u7684\u4fe1\u606f\u6682\u65e0\u4ece\u8003\u5bdf\u3002</p>"},{"location":"services/mirrors/2/","title":"mirrors2","text":"<p>2016 \u5e74\u5e95\u4ece\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u83b7\u5f97\u7684\u65b0\u673a\u5668\uff0c\u8fd0\u884c\u81f3\u4eca\uff0c\u627f\u62c5\u4e86\u76ee\u524d mirrors \u7684 rsync \u6d41\u91cf\u3002</p> \u53c2\u6570 \u914d\u7f6e CPU \u53cc\u8def E5-2620 v4 \u5185\u5b58 256 GB DDR4 \u5b58\u50a8 6 TB * 12 (HDD), 250 GB *2 (SSD) \u7f51\u7edc 1 Gbps * 2 <p>\u66d9\u5149 I620-G20 \u5bfc\u822a\u5149\u76d8</p>"},{"location":"services/mirrors/2/#networking","title":"Networking","text":"<p>mirrors2 \u4e0a\u7684\u7f51\u7edc\u914d\u7f6e\u81ea 2024-07-19 \u7ef4\u62a4\u540e\u4e5f\u5207\u6362\u5230\u4e86 systemd-networkd \u65b9\u6848\uff0c\u6587\u6863\u53ef\u4ee5\u53c2\u8003 mirrors4\u3002</p> Old info <p>mirrors2 \u4e0a\u7684\u7f51\u7edc\u4f7f\u7528\u9ed8\u8ba4\u7684 ifupdown \u914d\u7f6e\u3002</p> <p>\u5728 <code>/etc/network/interfaces.d</code> \u4e2d\u5b58\u653e\u7740\u63a5\u53e3\u914d\u7f6e\uff0c\u4f7f\u7528 <code>ifup</code>/<code>ifdown</code> \u6765\u542f\u7528/\u505c\u7528\u67d0\u4e00\u63a5\u53e3\u3002</p> <p>\u91cd\u542f\u6240\u6709\u7f51\u7edc\u63a5\u53e3</p> <p>\u5728\u67d0\u6b21 mirrors2 \u79bb\u7ebf\u6545\u969c\u4e2d\uff0c\u8bef\u64cd\u4f5c\u7684 <code>systemctl restart networking</code> \u8fd4\u56de\u4e86\u5931\u8d25\u7684\u7ed3\u679c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86 mirrors2 \u4ece\u67d0\u4e00\u7f51\u7edc\u63a5\u53e3\u65ad\u5f00\uff08\u731c\u6d4b\uff09\uff08\u5b9e\u9645\u539f\u56e0\u89c1\u4e0b\uff09\uff0c\u91cd\u542f\u6240\u6709\u63a5\u53e3\u4fee\u590d\u4e86\u95ee\u9898\uff1a<code>ifdown -a &amp;&amp; ifup -a</code></p> <p>\u5b9e\u9645\u539f\u56e0\u662f bridge interface \u8fde\u63a5\u7684\u90a3\u4e2a interface \u5728 ifupdown \u7684 config \u91cc\u7684\u914d\u7f6e\u65b9\u5f0f\u662f <code>static</code> \u7684\uff0c\u5728\u542f\u7528 bridge interface \u65f6\u4f1a\u81ea\u52a8\u66f4\u6539\u914d\u7f6e\u5bfc\u81f4 offline\u3002\u6539\u6210 <code>manual</code> \u7981\u6b62\u5b83\u7684\u81ea\u52a8\u884c\u4e3a\u4e4b\u540e\u5c31\u6ca1\u4e8b\u4e86\u3002</p>"},{"location":"services/mirrors/3/","title":"mirrors3","text":"<p>2020 \u5e74\u521d\u4ece\u56fe\u4e66\u9986\u6280\u672f\u90e8\u83b7\u5f97\u7684\u4e00\u53f0\u65e7\u670d\u52a1\u5668\uff0c\u4e3a\u6234\u5c14 PowerEdge R510\uff0c\u8d1f\u8f7d\u6bd4\u8f83\u6742\u4e71,\u4e3b\u8981\u662f\u4e00\u4e9b\u65e2\u51b7\u95e8\u53c8\u5927\u7684\u4ed3\u5e93\u7684 HTTP + rsync \u6d41\u91cf\u3002</p> \u53c2\u6570 \u914d\u7f6e CPU \u53cc\u8def\u81f3\u5f3a E5620 \u5185\u5b58 32 GB DDR3 \u5b58\u50a8 1 TB*2 (HDD), 2 TB*5 (HDD), 3 TB*1 (HDD)  1 TB (SAS HDD), 1.8 TB * 3 (SATA HDD), 1 TB (SATA HDD)  \u540c\u53cb iSCSI \u9635\u5217\uff0c4 TB * 16 (HDD) \u7f51\u7edc 1 Gbps * 2 <p>\u5b58\u50a8\u7ed3\u6784\uff1a</p> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u7531\u4e8e PERC 6/i \u9635\u5217\u5361\u7684\u9650\u5236\uff0c\u7269\u7406\u78c1\u76d8\u5927\u5c0f\u6700\u5927\u652f\u6301 2TB\uff08SAS 4TB \u76d8\u65e0\u6cd5\u8bc6\u522b\u5927\u5c0f\uff09\u3002\u5728\u5c06 SAS \u574f\u76d8\u79fb\u9664\u540e\uff0c\u76ee\u524d\uff082022/5/10\uff09rootfs VD \u5904\u4e8e degraded \u72b6\u6001\u3002</p> <p>PERC H700 \u9635\u5217\u5361\u7531\u4e8e\u7f3a\u5c11\u4e24\u6839 SAS \u8f6c\u63a5\u7ebf\uff0c\u5e76\u4e14 mirrors3 \u673a\u67b6\u524d\u53f3\u4fa7\u8f68\u9053\u5904\u65e0\u6cd5\u89e3\u9664\u9501\u5b9a\uff0c\u4e14\u66f4\u6362\u9635\u5217\u5361\u9700\u8981\u5c06\u5176\u4ed6\u6269\u5c55\u5361\u5168\u90e8\u79fb\u9664\uff08\u53c2\u89c1 PowerEdge R510 \u786c\u4ef6\u7528\u6237\u624b\u518c\uff09\uff0c\u7ed9\u65b0\u9635\u5217\u5361\u5b89\u88c5\u5e26\u6765\u4e86\u5f88\u5927\u7684\u96be\u5ea6\u3002</p> 1 TB * 2 <p>\u4f4d\u4e8e\u673a\u8eab\uff0c\u7ec4\u6210 RAID1 \u5b89\u88c5\u64cd\u4f5c\u7cfb\u7edf\uff0c\u6302\u8f7d\u4e3a rootfs</p> 2 TB * 5 + 3 TB * 1 <p>\u540c\u6837\u4f4d\u4e8e\u673a\u8eab\uff0c\u7ec4\u6210 RAID6 \u5b58\u653e\u8d44\u6599\uff08\u6240\u4ee5\u552f\u4e00\u4e00\u5757 3 TB \u7684\u786c\u76d8\u5b9e\u9645\u4e0a\u5f53\u505a 2 TB \u7684\u6765\u7528\uff09</p> \u5916\u90e8\u9635\u5217\uff0c4 TB * 16 <p>\u901a\u8fc7 SFP+ \u5149\u7ea4\u6302\u8f7d\u4e3a iSCSI \u8bbe\u5907\uff0c\u5206\u4e3a\u4e24\u7ec4 RAID60\uff08\u53ef\u7528\u5bb9\u91cf\u4e3a 12 \u5757\u76d8\uff09\u5b58\u50a8\u8d44\u6599</p>"},{"location":"services/mirrors/4/","title":"mirrors4","text":"<p>mirrors4 \u662f 2020 \u5e74 3 \u6708 24 \u65e5\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u63d0\u4f9b\u7ed9 LUG \u7684\u65b0\u673a\u5668\uff0c\u662f\u4e00\u53f0\u6d6a\u6f6e NF5280M5\u3002</p>"},{"location":"services/mirrors/4/#_1","title":"\u786c\u4ef6\u914d\u7f6e","text":"CPU <p>\u53cc\u8def Intel Xeon Gold 6230</p> \u5185\u5b58 <p>256 GB DDR4 2933 (8 * 32 GB SKHynix)</p> \u786c\u76d8 <p>\u4e00\u5757\u4e09\u661f PM883 2TB</p> <p>12 \u5757 HGST HUH721010AL (10 TB)</p> <p>\u4e24\u4e2a\u786c\u76d8\u63a7\u5236\u5668 MegaRAID SAS-3 3108</p> <p>\u786c\u76d8\u63a7\u5236\u5668</p> <p>\u7531\u4e8e\u4e0d\u80fd\u8de8\u63a7\u5236\u5668\u7ec4 RAID \u6216 LUN\uff0c\u4e14\u6bcf\u4e2a\u63a7\u5236\u5668\u53ea\u6709 8 \u4e2a\u63d2\u69fd\uff0c\u56e0\u6b64\u5c06 12 \u5757 HDD \u5206\u4e3a 6 \u5757\u4e00\u7ec4\u63d2\u5728\u4e24\u4e2a\u63a7\u5236\u5668\u4e0a\u7ec4\u6210 RAID6\uff0c\u4ee5\u4e24\u4e2a\u903b\u8f91\u5377\u5448\u73b0\u7ed9\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4e0a\u5c42\u7528 LVM \u5904\u7406\u3002SSD \u5355\u72ec\u521b\u5efa\u4e00\u4e2a\u903b\u8f91\u5377\u7ed9\u64cd\u4f5c\u7cfb\u7edf\u3002</p> \u7f51\u5361 <p>\u677f\u8f7d Intel X722 GbE (4 \u4e2a\u5343\u5146\u7f51\u53e3)</p> <p>PCI-e \u6269\u5c55\u5361\uff1aIntel X520 (82599ES) SFP+ (2 \u4e2a\u4e07\u5146\u5149\u53e3)</p>"},{"location":"services/mirrors/4/repos/","title":"Repositories","text":"<p>mirrors4 \u4e0a\u7684\u4ed3\u5e93\u548c mirrors2/3 \u4e00\u6837\uff0c\u4f4d\u4e8e <code>/srv/repo</code>\u3002\u4ed3\u5e93\u5bb9\u91cf\u4f7f\u7528 XFS \u7684 quota \u529f\u80fd\u76d1\u89c6\u3002</p> <p>Todo</p> <p>\u9700\u8981\u8c03\u7814\uff1a\u5feb\u901f\u5220\u9664\u4ed3\u5e93\u4e0e\u91cd\u547d\u540d\u4ed3\u5e93 (mv \u548c rm \u53ef\u80fd\u592a\u6162\u4e86)</p>"},{"location":"services/mirrors/4/repos/#_1","title":"\u6dfb\u52a0\u4e00\u4e2a\u65b0\u4ed3\u5e93","text":""},{"location":"services/mirrors/4/repos/#_2","title":"\u521b\u5efa\u76ee\u5f55","text":"<p>\u5728 <code>/srv/repo/</code> \u4e0b\u521b\u5efa\u5bf9\u5e94\u7684\u76ee\u5f55\u3002\u6ce8\u610f\u5bf9\u5e94\u76ee\u5f55\u7684\u6240\u6709\u8005\u548c\u6240\u6709\u7ec4\u5747\u5e94\u8be5\u662f <code>mirror</code>\u3002</p> <pre><code>chown mirror: /srv/repo/example\n</code></pre>"},{"location":"services/mirrors/4/repos/#xfs-project","title":"\u521b\u5efa XFS project","text":"<p>\u4e3a\u65b0\u4ed3\u5e93\u521b\u5efa XFS quota \u4ee5\u4fbf\u4e8e\u76d1\u89c6\u5bb9\u91cf\u3002\u9996\u5148\u68c0\u67e5 <code>/etc/projects</code> \u548c <code>/etc/projid</code>\uff0c\u627e\u5230\u5927\u4e8e 1000 \u7684 ID \u5e8f\u5217\uff0c\u627e\u51fa\u4e0b\u4e00\u4e2a ID\uff08\u4f8b\u5982 1111\uff0c\u4e0b\u9762\u4f7f\u7528\u8fd9\u4e2a\u4f5c\u4e3a\u4f8b\u5b50\uff09\u3002</p> <pre><code>mkdir /srv/repo/example\n</code></pre> <p>\u7f16\u8f91 <code>/etc/projects</code>\uff0c\u52a0\u5165\u5982\u4e0b\u4e00\u884c</p> <pre><code>1111:/srv/repo/example\n</code></pre> <p>\u7136\u540e\u6267\u884c\uff1a</p> <pre><code>xfs_quota -x -c 'project -s 1111'\n</code></pre> <p>\u7f16\u8f91 <code>/etc/projid</code>\uff0c\u52a0\u5165\u5982\u4e0b\u4e00\u884c</p> <pre><code>example:1111\n</code></pre> <p>\u4fe1\u606f</p> <p>\u6211\u4eec\u7684\u955c\u50cf\u7ba1\u7406\u5668 Yuki \u6839\u636e\u955c\u50cf\u76ee\u5f55\u7684\u6700\u540e\u4e00\u6bb5\u540d\u79f0\uff08\u5373 basename\uff09\u6765\u4ece XFS \u4e2d\u83b7\u53d6\u5bb9\u91cf\u4fe1\u606f\uff0c\u56e0\u6b64 <code>/etc/projid</code> \u6587\u4ef6\u5185\u5bb9\u6b63\u786e\u624d\u80fd\u4f7f Yuki \u5f97\u5230\u6b63\u786e\u7684\u5bb9\u91cf\u3002</p>"},{"location":"services/mirrors/4/repos/#_3","title":"\u4fbf\u6377\u914d\u7f6e\u811a\u672c","text":"<pre><code>#!/bin/bash\n\n# Determine largest project ID\nnext_id() {\n  local PROJID=$(cut -d':' -f1 /etc/projects | sort -n | tail -1)\n  echo $((++PROJID))\n}\n\nBASE=\"/srv/repo\"\nreadonly BASE\n\nif [ \"$1\" = \"-m\" ]; then\n  MKDIR=yes\n  shift\nfi\n\nwhile [ $# -ne 0 ]; do\n  N=\"${1//\\//}\"\n  shift\n  if grep -q \"$BASE/$N\\$\" /etc/projects; then\n    echo \"Repo $N exists, skipped.\" &gt;&amp;2\n    continue\n  fi\n\n  if [ ! -e \"$BASE/$N\" ]; then\n    if [ -n \"$MKDIR\" ]; then\n      echo \"Path $BASE/$N does not exist, creating directory.\" &gt;&amp;2\n      mkdir -p \"$BASE/$N\"\n    else\n      echo \"Path $BASE/$N does not exist, ignored.\" &gt;&amp;2\n      continue\n    fi\n  elif [ ! -d \"$BASE/$N\" ]; then\n    echo \"Path $BASE/$N is not a directory, ignored.\" &gt;&amp;2\n    continue\n  fi\n\n  ID=\"$(next_id)\"\n  echo \"$ID:$BASE/$N\" &gt;&gt; /etc/projects\n  echo \"$N:$ID\" &gt;&gt; /etc/projid\n  xfs_quota -x -c \"project -s $ID\" &amp;&gt;/dev/null\n  echo \"Added $N (ID $ID)\"\ndone\n</code></pre>"},{"location":"services/mirrors/4/repos/#_4","title":"\u6dfb\u52a0\u540c\u6b65\u914d\u7f6e","text":"<p>\u7167\u7740 <code>/home/mirror/repos</code> \u4e0b\u7684\u73b0\u6709\u6587\u4ef6\u81ea\u5df1\u7814\u7a76\u4e00\u4e0b\u5427\uff0c\u8fd9\u4e2a\u4e0d\u96be\u3002\u9700\u8981\u6ce8\u610f\u7684\u5c31\u4e00\u70b9\uff0c\u6587\u4ef6\u540d\u7ed3\u5c3e\u5fc5\u987b\u662f <code>.yaml</code>\uff08\u800c\u4e0d\u80fd\u662f <code>.yml</code>\uff09\uff0c\u8fd9\u662f Yuki \u4ee3\u7801\u91cc\u5199\u7684\u3002</p> <p>\u51b3\u5b9a <code>bindIP</code> \u6216 <code>network</code> \u7684\u503c</p> <p>\u955c\u50cf\u7ad9\u6709\u591a\u4e2a\u6765\u81ea\u4e0d\u540c\u8fd0\u8425\u5546\u7684 IP \u53ef\u7528\u4e8e\u540c\u6b65\u4efb\u52a1\u3002\u7531\u4e8e\u7f51\u7edc\u73af\u5883\u7684\u4e0d\u786e\u5b9a\u6027\uff0c\u6709\u65f6\u4f1a\u51fa\u73b0\u67d0\u4e2a IP \u540c\u6b65\u901f\u5ea6\u6781\u6162\u7684\u60c5\u51b5\u3002</p> <p>@taoky \u7684 admirror-speedtest \u53ef\u4ee5\u5e2e\u52a9\u51b3\u5b9a\u6700\u5feb\u901f\u7684 IP\u3002</p> <p>\u53e6\u5916\uff0c<code>bindIP</code> \u4e0d\u9002\u7528\u4e8e\u6240\u6709\u7684\u540c\u6b65\u955c\u50cf\uff08\u4e00\u90e8\u5206\u7a0b\u5e8f\u4e0d\u652f\u6301\u4fee\u6539 <code>bind()</code> \u7684\u53c2\u6570\uff09\uff0c\u6b64\u65f6\u53ef\u4ee5\u4f7f\u7528\u57fa\u4e8e Docker Network \u7684 <code>network</code> \u914d\u7f6e\u3002</p> <p>\u5199\u597d\u65b0\u4ed3\u5e93\u7684\u914d\u7f6e\u6587\u4ef6\u4e4b\u540e\u8fd0\u884c <code>yuki reload</code>\uff0c\u7136\u540e <code>yuki sync &lt;repo&gt;</code> \u5c31\u53ef\u4ee5\u5f00\u59cb\u521d\u6b21\u540c\u6b65\u4e86\u3002</p>"},{"location":"services/mirrors/4/repos/#git-srvgit","title":"\u4e3a Git \u7c7b\u578b\u4ed3\u5e93\u6dfb\u52a0\u8f6f\u94fe\u63a5\u81f3 <code>/srv/git</code>","text":"<p><code>git-daemon.service</code> \u6839\u636e <code>/srv/git</code> \u4e0b\u7684\u5185\u5bb9\u5bf9\u5916\u63d0\u4f9b Git \u670d\u52a1\u3002\u6240\u4ee5\u5982\u679c\u662f git \u7c7b\u578b\u7684\u4ed3\u5e93\uff0c\u9700\u8981\u6dfb\u52a0\u8f6f\u94fe\u63a5\uff0c\u5426\u5219\u65e0\u6cd5\u4f7f\u7528 <code>git://</code> \u7684\u534f\u8bae\u8bbf\u95ee\u3002\uff08<code>http(s)://</code> \u534f\u8bae\u6ca1\u6709\u95ee\u9898\uff09</p> <p>Git \u4ed3\u5e93\u670d\u52a1\u7684\u5176\u4ed6\u76f8\u5173\u914d\u7f6e</p> <p>\u90e8\u5206\u514b\u9686\u914d\u7f6e (See https://github.com/ustclug/discussions/issues/432)\uff1a</p> /etc/gitconfig<pre><code>[uploadpack]\n    allowfilter = true\n</code></pre>"},{"location":"services/mirrors/4/repos/#quota","title":"\u67e5\u770b quota \u60c5\u51b5","text":"<p>\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\uff1a</p> <pre><code>xfs_quota -c 'df -h'\n</code></pre>"},{"location":"services/mirrors/4/repos/#_5","title":"\u79fb\u52a8\uff08\u5220\u9664\uff09\u4e00\u4e2a\u4ed3\u5e93","text":"<p>\u4ee5\u4e0b\u4ee5 2023 \u5e74 12 \u6708 27 \u65e5\u5c06 <code>.private/sb</code> \u79fb\u52a8\u5230 <code>sb</code> \u7684\u64cd\u4f5c\u4e3a\u4f8b\u5b50\uff0c\u4ecb\u7ecd\u6211\u4eec\u9700\u8981\u505a\u7684\u4e8b\u60c5\u3002</p>"},{"location":"services/mirrors/4/repos/#sb","title":"\u521b\u5efa <code>sb</code> \u76ee\u5f55","text":"<p>\u53c2\u8003\u4e0a\u6587\uff0c\u521b\u5efa\u76ee\u5f55\uff0c\u4fee\u6539 <code>/etc/projects</code> \u7684\u8def\u5f84\uff08ID \u4e0d\u9700\u8981\u4fee\u6539\uff09\uff0c\u7136\u540e\u6267\u884c\u4e0a\u6587\u5bf9\u5e94\u7684 <code>xfs_quota</code> \u547d\u4ee4\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u7684\u4f8b\u5b50\u662f\u79fb\u52a8\u76ee\u5f55\uff0c\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528 <code>mv</code> \u547d\u4ee4\uff08<code>sb</code> \u4ed3\u5e93\u5f88\u5c0f\uff09\u3002</p>"},{"location":"services/mirrors/4/repos/#yuki","title":"\u4fee\u6539 Yuki \u914d\u7f6e","text":"<p>\u4fee\u6539 <code>/home/mirror/repos/sb.yaml</code>\uff0c\u5c06 <code>path</code> \u4fee\u6539\u4e3a <code>/srv/repo/sb</code>\u3002\u7136\u540e\u91cd\u65b0\u52a0\u8f7d\uff1a</p> <pre><code>yukictl reload sb\n</code></pre>"},{"location":"services/mirrors/4/repos/#rsync-attrs","title":"\u6d4b\u8bd5\u540c\u6b65\uff0c\u5e76\u5220\u9664 rsync-attrs \u4e2d\u7684\u65e7\u76ee\u5f55","text":"<pre><code>yukictl sync --debug sb\n</code></pre> <p>\u786e\u8ba4\u540c\u6b65\u65e0\u8bef\u540e\uff0c\u68c0\u67e5 <code>/srv/rsync-attrs</code> \u7684\u5185\u5bb9\uff0c\u5e76\u5220\u9664\u65e7\u76ee\u5f55 <code>/srv/rsync-attrs/.private</code>\u3002</p> <p>/srv/rsync-attrs</p> <p>\u8be5\u76ee\u5f55\u7684\u7528\u9014\u662f\u4e3a\u574f\u4eba\u4fee\u6539\u7248\u7684 rsyncd\uff08\u5373 rsyncd-huai\uff09\u63d0\u4f9b\u5feb\u901f\u7684\u6587\u4ef6\u5c5e\u6027\u67e5\u8be2\uff08\u5bf9\u5e94\u4f7f\u7528 Reiserfs \u683c\u5f0f\u5316\uff0c\u6302\u8f7d\u5728 SSD \u4e0a\uff09\u3002 \u540c\u65f6\u8be5\u76ee\u5f55\u4e5f\u7528\u4e8e\u4e3b\u9875\u751f\u6210\u3002</p>"},{"location":"services/mirrors/4/repos/#nginx","title":"\u4fee\u6539 nginx \u914d\u7f6e","text":"<p>\u7531\u4e8e\u6211\u4eec\u8fd9\u91cc\u662f\u79fb\u52a8\u4ed3\u5e93\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u65e7\u7528\u6237\u80fd\u591f\u6b63\u5e38\u4f7f\u7528\uff0c\u9700\u8981\u4fee\u6539 nginx \u914d\u7f6e\uff0c\u5c06\u65e7\u7684\u8def\u5f84\u91cd\u5b9a\u5411\u5230\u65b0\u7684\u8def\u5f84\u3002</p> <p>\u76f8\u5173\u7684\u914d\u7f6e\u4e00\u822c\u4f4d\u4e8e <code>/etc/nginx/snippets/mirrors-locations</code>\uff0c\u672c\u6b21\u6211\u4eec\u65b0\u589e\u7684\u5185\u5bb9\u5982\u4e0b\uff1a</p> <pre><code>location /.private/sb/ {\n    rewrite ^/.private(/sb/.*$) $1 permanent;\n}\n</code></pre> <p>Nginx rewrite \u76f8\u5173\u7684\u8bed\u6cd5\u77e5\u8bc6\u9700\u8bfb\u8005\u81ea\u884c\u5b66\u4e60\u3002</p> <p>\u4fee\u6539\u5b8c\u6210\u540e\uff0c\u91cd\u8f7d\u914d\u7f6e\uff1a</p> <pre><code>nginx -t\nnginx -s reload  # \u6216\u8005 systemctl reload nginx\n</code></pre> <p>\u5e76\u4e14 commit \u6709\u5173\u4fee\u6539\uff1a</p> <pre><code>git -c user.name=\u4f60\u7684\u540d\u5b57 -c user.email=\u4f60\u7684\u90ae\u7bb1 commit -m \"...\"\n</code></pre>"},{"location":"services/mirrors/4/repos/#rsync-proxy-rsyncd","title":"\u4fee\u6539 rsync-proxy \u4e0e rsyncd \u914d\u7f6e","text":"<p>rsync-proxy \u4e3a\u8fd1\u5e74\u6765\u6211\u4eec\u81ea\u884c\u7f16\u5199\u7684 rsync \u53cd\u5411\u4ee3\u7406\u670d\u52a1\u3002 \u4fee\u6539\u4e86 <code>/etc/rsync-proxy/config.toml</code>\uff0c\u5220\u9664 mirrors2 \u4e2d\u7684 <code>\".private\"</code> \u9879\uff0c\u5728 mirrors4 \u4e2d\u65b0\u589e <code>\"sb\"</code> \u9879\u3002</p> <p>\u56e0\u4e3a rsync-proxy \u6700\u7ec8\u8fd8\u9700\u8981\u8fde\u63a5\u5230\u540e\u7aef\u7684 rsyncd\uff0c\u56e0\u6b64 mirrors4 \u7684 rsyncd \u914d\u7f6e\u4e5f\u9700\u8981\u4fee\u6539\u3002 \u5728 <code>/etc/rsyncd</code> \u4e0b\u6267\u884c <code>python common_generator.py --write</code> \u5199\u5165\u914d\u7f6e\uff0c\u4f7f\u7528 <code>git diff</code> \u68c0\u67e5\u65e0\u8bef\u540e <code>git commit</code>\u3002 rsyncd \u914d\u7f6e\u4e2d\u5305\u542b\u4e0d\u516c\u5f00 rsync \u7684\u5185\u5bb9\uff08\u5982 git \u76ee\u5f55\uff09\u4e0d\u4f1a\u5bfc\u81f4\u95ee\u9898\uff0c\u56e0\u4e3a\u6240\u6709\u7528\u6237\u63a5\u89e6\u5230\u7684\u90fd\u662f rsync-proxy\u3002</p> <p>\u786e\u8ba4\u540e\u91cd\u8f7d rsync-proxy:</p> <pre><code>systemctl reload rsync-proxy\n</code></pre> <p>Rsyncd \u4e0d\u9700\u8981\u91cd\u8f7d\uff1a\u6bcf\u4e2a\u6709\u6548\u8fde\u63a5\u4f1a\u542f\u52a8\u65b0\u8fdb\u7a0b\uff0c\u800c\u65b0\u8fdb\u7a0b\u4f1a\u91cd\u65b0\u8bfb\u53d6\u914d\u7f6e\u3002</p>"},{"location":"services/mirrors/4/repos/#mirrors2","title":"\u5220\u9664 mirrors2 \u4e0a\u7684\u4ed3\u5e93\u4e0e\u76f8\u5173\u9879","text":"<p>\u6267\u884c <code>yukictl rm sb</code>\uff0c\u7136\u540e\u5220\u9664 Yuki \u540c\u6b65\u914d\u7f6e\uff08<code>~mirror/repos-etc/sb.yaml</code>\uff09\uff0c\u540c\u6837\u4e5f\u9700\u8981 git commit\u3002</p> <p>\u4e4b\u540e\u5220\u9664\u5b58\u50a8\u7684\u5185\u5bb9\uff1a\u6267\u884c <code>/sbin/zfs list</code> \u786e\u8ba4\u8981\u4e0b\u624b\u5220\u9664\u7684\u5b58\u50a8\u6c60\uff0c\u7136\u540e <code>sudo zfs destroy pool0/repo/\u5bf9\u5e94\u7684\u540d\u5b57</code> \u5220\u9664\u3002</p> <p>\u540c\u6837\uff0c<code>/srv/rsync-attrs/.private</code> \u7684\u5185\u5bb9\u4e5f\u9700\u8981\u5220\u9664\u3002</p>"},{"location":"services/mirrors/4/repos/#git-push","title":"\u5173\u4e8e git push","text":"<p>\u76ee\u524d\u914d\u7f6e\u7684 git push \u6bd4\u8f83\u9ebb\u70e6\uff1a\u9700\u8981\u7528\u6237\u5728 USTCLUG GitLab \u4e0a\u4e3a\u81ea\u5df1\u521b\u5efa\u4e00\u4e2a Access Token\uff0c\u7136\u540e\u6bcf\u6b21 git push \u65f6\u8f93\u5165\u5bc6\u7801\u3002</p> <p>\u6211\u4eec\u6709\u8ba1\u5212\u6539\u8fdb\u8fd9\u4e00\u70b9\uff1a\u4e3a\u6bcf\u4e2a\u4ed3\u5e93\u521b\u5efa\u4e00\u4e2a ssh key\uff0c\u4fee\u6539 git config\uff0c\u7136\u540e\u4e3a\u5728 USTCLUG GitLab \u4e0a\u4e3a\u5bf9\u5e94\u4ed3\u5e93\u65b0\u589e deploy key\uff0c\u8fd9\u6837\u5c31\u4e0d\u9700\u8981\u5bc6\u7801\u4e86\u3002</p>"},{"location":"services/mirrors/4/volumes/","title":"Volumes on mirrors4","text":"<p>\u4ecb\u7ecd\u9875\u8bb2\u8fc7\u4e86\uff0c\u63a7\u5236\u5668\u7684\u5751\u5bfc\u81f4\u4e0d\u80fd\u76f4\u63a5\u628a 12 \u5757\u786c\u76d8\u7ec4\u6210\u4e00\u4e2a\u903b\u8f91\u78c1\u76d8\uff0c\u56e0\u6b64\u6211\u4eec\u5728\u4e0a\u5c42\u4f7f\u7528 LVM \u6765\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898\u3002</p>"},{"location":"services/mirrors/4/volumes/#_1","title":"\u78c1\u76d8\u5206\u533a","text":"<p>\u6ce8\u610f</p> <p>\u8fd9\u91cc\u7ed9\u51fa\u7684\u547d\u4ee4\u4ec5\u7528\u4e8e\u5c55\u793a\u5206\u533a\uff08\u5377\uff09\u7684\u521b\u5efa\u65b9\u5f0f\uff0c\u9664\u975e\u5b8c\u5168\u91cd\u88c5\uff0c\u5426\u5219\u4e0d\u5e94\u8be5\u6267\u884c\u5176\u4e2d\u4efb\u4f55\u4e00\u6761\u6709\u526f\u4f5c\u7528\u7684\u547d\u4ee4\u3002</p> <p>\u64cd\u4f5c\u7cfb\u7edf\u770b\u5230\u4e09\u4e2a\u786c\u76d8\uff1a\u4e24\u4e2a RAID6 \u5927\u76d8\uff0840 TB / 36.4 TiB\uff09\u548c\u4e00\u4e2a SSD\uff082 TB / 1.86 TiB\uff09\u3002\u8bbe\u4e24\u4e2a\u5927\u76d8\u4e3a /dev/sda \u548c /dev/sdb\uff0cSSD \u4e3a /dev/sdc\u3002</p> <p>\u7531\u4e8e\u542f\u52a8\u5206\u533a\u4e0d\u80fd\u653e\u5728 LVM \u4e0a\uff0c\u56e0\u6b64\u4ee5\u5982\u4e0b\u65b9\u5f0f\u521b\u5efa\u5206\u533a\uff1a</p> <pre><code>root@mirrors4:~# fdisk -l /dev/sda\nDisk /dev/sda: 36.4 TiB, 40001177911296 bytes, 78127300608 sectors\nDisk model: MR9361-8i\nUnits: sectors of 1 * 512 = 512 bytes\nSector size (logical/physical): 512 bytes / 4096 bytes\nI/O size (minimum/optimal): 262144 bytes / 262144 bytes\nDisklabel type: gpt\nDisk identifier: AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA\n\nDevice       Start         End     Sectors  Size Type\n/dev/sda1     2048        4095        2048    1M BIOS boot\n/dev/sda2     4096     1052671     1048576  512M EFI System\n/dev/sda3  1052672 78127300574 78126247903 36.4T Linux LVM\n</code></pre> <p>sdb \u7684\u53c2\u6570\u5b8c\u5168\u4e00\u6837\u3002</p> <p>\u5b9e\u9645\u7684\u542f\u52a8\u5206\u533a\u4e3a /dev/sda2\uff0c\u5c06\u5176 dd \u5230 /dev/sdb2 \u505a\u5907\u4efd\u3002</p> <p>\u7136\u540e\u662f SSD \u7684\u5206\u533a\uff1a</p> <pre><code>Disk /dev/sdc: 1.8 TiB, 1919816826880 bytes, 3749642240 sectors\nDisk model: MR9361-8i\nUnits: sectors of 1 * 512 = 512 bytes\nSector size (logical/physical): 512 bytes / 4096 bytes\nI/O size (minimum/optimal): 65536 bytes / 65536 bytes\nDisklabel type: gpt\nDisk identifier: AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA\n\nDevice     Start        End    Sectors  Size Type\n/dev/sdc1   2048 3749642206 3749640159  1.8T Linux LVM\n</code></pre>"},{"location":"services/mirrors/4/volumes/#lvm","title":"LVM","text":"<p>\u628a sda3 \u548c sdb3 \u90fd\u653e\u8fdb LVM\uff1a</p> <pre><code># fdisk \u5206\u533a\u5b8c\u6bd5\uff0cw \u5199\u5165\u9000\u51fa\npvcreate /dev/sda3 /dev/sdb3\nvgcreate lug /dev/sda3 /dev/sdb3\n</code></pre> <p>\u521b\u5efa rootfs\uff0c\u8fd9\u91cc\u4ee5 RAID1 \u7684\u65b9\u5f0f\uff08<code>--type raid1</code>\uff09\u521b\u5efa\u8fd9\u4e2a\u5206\u533a\uff0c\u8fd9\u6837\u5373\u4f7f sda / sdb \u574f\u6389\u4e00\u6574\u7ec4\u4e4b\u540e\u8fd8\u6709 rootfs \u53ef\u4ee5\u7528\u3002</p> <p>\u6ce8\u610f\uff1a</p> <ul> <li><code>-m 1</code> \u8868\u793a 1 \u4efd\u989d\u5916\u7684\u955c\u50cf\u3002</li> <li><code>--type mirror</code> \u548c <code>--type raid1</code> \u662f\u4e0d\u540c\u7684\uff08\u524d\u8005\u5df2\u7ecf deprecated\uff09\u3002\u4e0d\u8981\u521b\u5efa <code>--type mirror</code> \u7684\u5206\u533a\u3002</li> </ul> <pre><code>lvcreate -n root -L 32G --type raid1 -m 1 lug\nmkfs.ext4 /dev/lug/root\n</code></pre> <p>\u521b\u5efa home\uff0c\u8fd9\u91cc\u53cd\u6b63\u4e0d\u6015\u574f\uff0c\u7528 RAID0\uff08<code>--type striped</code> \u6216 <code>--type raid0</code>\uff09\u3002</p> <pre><code>lvcreate -n root -L 64G --type striped -i 2 lug\nmkfs.ext4 /dev/lug/home\n</code></pre> <p>\u521b\u5efa\u653e\u955c\u50cf\u7684\u5206\u533a\uff0c\u8fd9\u6b21\u8981\u7528 xfs</p> <p>XFS \u4e0d\u652f\u6301\u7f29\u5c0f</p> <p>\u56e0\u6b64\u6211\u4eec\u5728\u521d\u88c5\u65f6\u9009\u62e9\u4e3a\u5176\u5206\u914d 48 TiB \u7684\u7a7a\u95f4\uff0c\u800c\u4e0d\u662f VG lug \u7684\u5269\u4f59\u5168\u90e8\u2014\u2014\u8fd9\u6837\u65b9\u4fbf\u4ee5\u540e\u7ef4\u62a4</p> <pre><code>lvcreate -n repo -L 48T --type striped -i 2 lug\nmkfs.xfs /dev/lug/repo\n</code></pre> <p>\u5176\u5b9e\u672c\u6765\u8981\u8c03\u4e00\u4e0b\u53c2\u7684\uff0c\u4e0d\u8fc7\u6839\u636e Arch Wiki\uff0c<code>mkfs.xfs</code> \u7684\u9ed8\u8ba4\u53c2\u6570\u5c31\u662f\u6700\u4f18\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u51b3\u5b9a\u4e0d\u52a8\u4e86\u3002</p>"},{"location":"services/mirrors/4/volumes/#ssd","title":"SSD","text":"<p>SSD \u7684\u7528\u9014\u4e3a\u5b58\u653e Docker \u6570\u636e <code>/var/lib/docker</code>\uff088 GiB \u5c31\u591f\u4e86\uff0c\u4f46\u662f overlay2 \u7684\u540e\u7aef\u7528 ext4 \u66f4\u597d\uff09\uff0c\u5269\u4e0b\u7528\u4f5c lvmcache(7)\u3002</p> <p>iBug \u5907\u6ce8</p> <p>\u867d\u7136\u4f3c\u4e4e\u6ca1\u6709\u8fd9\u6837\u505a\uff08\u5148\u521b\u5efa\u5355\u72ec\u7684 VG \u518d\u5408\u5e76\uff09\u7684\u5fc5\u8981\uff0c\u4f46\u662f\u8fd9\u4e48\u505a\u4e00\u5b9a\u4e0d\u4f1a\u51fa\u9519\uff0c\u5c31\u8fd9\u6837\u5427\u3002</p> <p>\u5728 SSD \u4e0a\u65b0\u5efa\u4e00\u4e2a VG\uff1a</p> <pre><code># fdisk \u521b\u5efa\u552f\u4e00\u4e00\u4e2a\u5206\u533a sdc1\uff0c\u4fdd\u5b58\u9000\u51fa\npvcreate /dev/sdc1\nvgcreate ssd /dev/sdc1\n</code></pre> <p>\u521b\u5efa Docker \u6570\u636e\u76d8\uff1a</p> <pre><code>lvcreate -L 8G -n docker ssd\nmkfs.ext4 /dev/ssd/docker\n</code></pre> <p>\u91cd\u8981\uff1a\u521b\u5efa\u7f13\u5b58\u76d8\u548c\u7f13\u5b58\u5143\u6570\u636e\u76d8\u3002\u6839\u636e Red Hat Documentation \u7684\u4ecb\u7ecd\uff0c\u5148\u624b\u52a8\u521b\u5efa\u6570\u636e\u76d8\u548c\u5143\u6570\u636e\u76d8\uff0c\u7136\u540e\u5c06\u4ed6\u4eec\u5408\u5e76\u4e3a\u4e00\u4e2a cache pool\u3002\u5927\u5c0f\u65b9\u9762\uff0c\u6587\u7ae0\u7684\u53c2\u8003\u662f 2G data \u2194 12M meta\uff0c\u8fd9\u91cc\u6211\u4eec\u6709\u63a5\u8fd1 2 TB \u7684 data\uff0c\u5c31\u5206\u914d 16 GB \u4f5c\u4e3a meta \u5427\u3002</p> <pre><code>lvcreate -L 16G -n mcache_meta ssd\nlvcreate -l 100%FREE -n mcache ssd\nlvreduce -l -2048 ssd/mcache\nlvconvert --type cache-pool --poolmetadata ssd/mcache_meta --cachemode writethrough -c 64K --config allocation/cache_pool_max_chunks=30000000 ssd/mcache\n</code></pre> <p>\u8fd9\u91cc\u7684\u7f13\u5b58\u6a21\u5f0f\u91c7\u7528 passthrough\uff0c\u5373\u5199\u5165\u52a8\u4f5c\u7ed5\u8fc7\u7f13\u5b58\u76f4\u63a5\u5199\u56de\u539f\u8bbe\u5907\uff08\u5f53\u7136\u5566\uff0c\u5199\u5165\u90fd\u662f\u7531\u4ece\u4e0a\u6e38\u540c\u6b65\u4ea7\u751f\u7684\uff09\uff0c\u53e6\u5916\u4e24\u79cd writeback \u548c writethrough \u90fd\u4f1a\u5199\u5165\u7f13\u5b58\uff0c\u4e0d\u662f\u6211\u4eec\u60f3\u8981\u7684\u3002 passthrough \u6a21\u5f0f\u4e2d\uff0c\u8bfb\u5199\u90fd\u4f1a\u7ed5\u8fc7 cache\uff0c\u552f\u4e00\u7684\u4f5c\u7528\u662f write hit \u4f1a\u4f7f\u5f97 cache \u5bf9\u5e94\u7684\u5757\u5931\u6548\u3002</p> <p>\u8fd9\u91cc\u4f7f\u7528 writeback \u6a21\u5f0f\uff0c\u56e0\u4e3a\u4ed3\u5e93\u6570\u636e\u6ca1\u4e86\u8fd8\u80fd\u518d\u540c\u6b65\uff0c\u4f7f\u7528 writeback \u63d0\u5347\u6027\u80fd\u66f4\u5408\u9002\u3002</p> <p>\u51fa\u4e8e\u7a33\u5b9a\u8003\u8651\uff0c\u4f7f\u7528 writethrough \u6a21\u5f0f\u3002\uff08\u6211\u4eec\u7684 Cache \u592a\u5927\u4e86\uff0cwriteback \u53ef\u80fd\u4f1a\u5f04\u574f\u4e0d\u5c11\u4e1c\u897f\uff0c\u5982\u679c metadata \u574f\u4e86\u5c31\u66f4\u9ebb\u70e6\u4e86\uff09</p> <p>\u5751</p> <p>\u76f4\u63a5\u4f7f\u7528 lvconvert(8) \u5c1d\u8bd5\u5408\u5e76\u4f1a\u5bfc\u81f4\u5410\u69fd\uff0c\u8fd9\u662f\u4e0a\u9762 lvreduce(8) \u7684\u539f\u56e0\u3002</p> <pre><code>Volume group \"ssd\" has insufficient free space (0 extents): 2048 required.\n</code></pre> <p>iBug \u5907\u6ce8</p> <p>LVM \u63a8\u8350\u7684\u662f\u4e00\u4e2a\u7f13\u5b58\u6c60\u91cc\u4e0d\u8d85\u8fc7 100 \u4e07\u4e2a chunk\uff08\u8fd9\u4e5f\u662f allocation/cache_pool_max_chunks \u7684\u9ed8\u8ba4\u503c\uff09\uff0c\u4f46\u662f\u8fd9\u6837\u6bcf\u4e2a chunk \u7684\u6700\u5c0f\u5927\u5c0f\u4e3a 1.84 MiB \u592a\u5927\u4e86\uff0c\u8003\u8651\u5230\u6211\u4eec\u6709\u8db3\u591f\u7684 CPU \u548c\u5185\u5b58\uff0c\u8fd9\u91cc\u5c31\u94e4\u800c\u8d70\u9669\u5c1d\u8bd5\u4e00\u4e0b\u8f83\u5927\u7684 chunk count\u3002</p> <p>\u5751 2</p> <p>\u7f13\u5b58\u76d8\uff08cache pool\uff09\u548c\u88ab\u7f13\u5b58\u7684\u5377\u5fc5\u987b\u5728\u540c\u4e00\u4e2a VG \u4e2d\u3002</p> <p>\u5751 3 (taoky \u5907\u6ce8)</p> <p>LVM Cache \u7684\u5e95\u5c42\u662f\u5728\u5185\u6838\u5b9e\u73b0\u7684 dm-cache\u3002\u76ee\u524d\u5df2\u77e5\u7684\u5751\u5982\u4e0b\uff1a</p> <ol> <li> <p>\u5f53\u51fa\u73b0 dirty blocks\uff08\u4e14 cache policy \u4e3a cleaner \u65f6\uff09\uff0c\u65e0\u6cd5\u6b63\u5e38 flush\u3002\u7f51\u7edc\u4e0a\u53ef\u4ee5\u627e\u5230\u7684\u8fd9\u4e2a bug \u7684\u89e3\u51b3\u65b9\u6cd5\u662f\u589e\u5927 migration_threshold \u7684\u503c\uff08\u5728\u65b0\u7248\u672c LVM \u4e2d\uff0cmigration_threshold \u9ed8\u8ba4\u81f3\u5c11\u4f1a\u662f chunk size \u7684 8 \u500d\uff0c\u5728\u6211\u4eec\u7684\u914d\u7f6e\u4e0b\u5c31\u662f 16384 = 2048 * 8\u3002\u8fd9\u4e2a\u7248\u672c\u7684 LVM \u6682\u65f6\u4e0d\u5728 Buster \u4e2d\uff09\uff0c\u4f46\u662f\u7ecf\u8fc7\u6d4b\u8bd5\uff0c\u5355\u7eaf\u589e\u5927 migration_threshold \u6ca1\u6709\u4efb\u4f55\u6548\u679c\u3002Jiahao \u7ffb\u4e86\u4e00\u4e0b dm-cache \u7684\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0 flush \u7684\u6761\u4ef6\u5728 https://elixir.bootlin.com/linux/latest/source/drivers/md/dm-cache-target.c#L1649\uff0c\u53ea\u5728\u72b6\u6001\u4e3a IDLE \u65f6\u624d\u4f1a flush\u3002IDLE \u7684\u7b2c\u4e00\u4e2a\u6761\u4ef6\u9700\u8981 inflight io = 0\uff0c\u6bd4\u8f83\u82db\u523b\uff0c\u53ef\u80fd\u662f\u65e0\u6cd5\u6b63\u5e38 flush \u7684\u539f\u56e0\u3002</p> <p>\u4e00\u4e2a\u626d\u66f2\u7684\u89e3\u51b3\u65b9\u6cd5\u662f\uff1a\u5148\u628a migration_threshold \u8bbe\u7f6e\u5f97\u5f88\u5927\uff08\u8bbe\u5927\u5c0f\u4e3a x\uff09\uff0c\u7136\u540e\u9a6c\u4e0a\u7f29\u5c0f\uff0c\u8fd9\u6837\u5c31\u80fd\u628a x \u90a3\u4e48\u591a\u5927\u5c0f\u7684\u810f\u5757\u5f04\u6389\uff08\u539f\u7406\u6682\u65f6\u4e0d\u660e\uff0c\u9700\u8981\u8865\u5145\uff09\u3002\u57fa\u4e8e\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u53ef\u4ee5\u5199\u4e00\u4e2a\u811a\u672c\u6765\u505a flush \u7684\u5de5\u4f5c\uff1a</p> <pre><code># dirty hack\nsudo lvchange --cachepolicy cleaner lug/repo\nfor i in `seq 1 1500`; do sudo lvchange --cachesettings migration_threshold=2113536 lug/repo &amp;&amp; sudo lvchange --cachesettings migration_threshold=16384 lug/repo &amp;&amp; echo $i &amp;&amp; sleep 15; done;\n# \u9700\u8981\u786e\u8ba4\u6ca1\u6709\u810f\u5757\u3002\u5982\u679c\u8fd8\u6709\u7684\u8bdd\u7ee7\u7eed\u6267\u884c\uff08\u6b21\u6570\u8c03\u5c0f\u4e00\u4e9b\uff09\n# \u5982\u679c\u662f\u4ece writeback \u5207\u6362\uff0c\u9700\u8981\u5148\u628a\u6a21\u5f0f\u5207\u5230 writethrough\n# \u7136\u540e\u518d\u4fee\u6539 cachepolicy \u5230 smq\nsudo lvchange --cachepolicy smq lug/repo\n</code></pre> <p>\u5728\u6267\u884c\u65f6\uff0c\u53ef\u4ee5\u67e5\u770b\uff1a</p> <pre><code>sudo dmsetup status lug-repo\n# \u5728 \"metadata2\" \u524d\u9762\u7684\u524d\u9762\u7684\u6570\u5b57\u5c31\u662f dirty block \u7684\u6570\u91cf\n# \u5982\u679c\u4e0d\u5728\u6267\u884c lvchange\uff08\u6ca1\u6709\u8fdb\u7a0b\u62a2\u5360\u4e86 LVM \u7684\u9501\uff09\uff0c\u53ef\u4ee5\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u786e\u8ba4\u810f\u5757\u6570\u91cf\u4ee5\u53ca\u5176\u4ed6\u4e00\u4e9b\u53c2\u6570\u3002\nsudo lvs -o name,cache_policy,cache_settings,chunk_size,cache_used_blocks,cache_dirty_blocks /dev/mapper/lug-repo\n</code></pre> </li> <li> <p>\u6bcf\u6b21 unclean shutdown \u4e4b\u540e\uff0ccache \u4e2d\u6240\u6709\u5757\u90fd\u4f1a\u88ab\u6807\u8bb0\u4e3a dirty\u3002\u5c3d\u7ba1\u4e0d\u592a\u53ef\u80fd\u963b\u585e\u7cfb\u7edf\u542f\u52a8\uff0c\u8fd9\u53ef\u80fd\u4f1a\u7ed9 HDD \u4e00\u5b9a\u7684\u538b\u529b\u3002</p> </li> <li>\u6269\u5927 lug/repo \u7684\u5927\u5c0f\u524d\u9700\u8981 uncache\uff0c\u4e14 uncache \u7684\u524d\u63d0\u6761\u4ef6\u662f\u6ca1\u6709\u810f\u5757\u3002</li> </ol> <p>\u5751 4</p> <p>\u4fee\u6539 <code>migration_threshold</code> \u7b49\u8bbe\u7f6e\u4f1a\u5bfc\u81f4\u76ee\u524d\u7248\u672c\u7684 GRUB \u65e0\u6cd5\u6b63\u786e\u8bc6\u522b LVM \u5143\u6570\u636e\u3002</p> <p>\u4e34\u65f6\u4fee\u590d\u7248\u672c\uff1ahttps://github.com/taoky/grub/releases/tag/2.02%2Bdfsg1-20%2Bdeb10u4taoky3_amd64\u3002\u76ee\u524d\u5df2\u90e8\u7f72\uff0c\u4e14\u8bbe\u7f6e\u4e86 <code>apt hold</code>\u3002</p> <p>\u5751 5</p> <p>\u8bbe\u7f6e chunksize \u5230 1M \u4f1a\u6709\u4e25\u91cd\u7684\u5199\u5165\u653e\u5927\u95ee\u9898\uff0c\u56e0\u6b64\u8fd9\u91cc\u4fee\u6539\u4e3a\u4e86 64K\u3002</p> <p>\u6240\u4ee5\u63a5\u4e0b\u6765\u8981\u5408\u5e76 VG\uff0c\u7136\u540e\u624d\u80fd\u4e3a\u4ed3\u5e93\u5377\u52a0\u4e0a\u7f13\u5b58\u3002</p> <pre><code>lvchange -a n ssd/docker\nvgmerge lug ssd\nlvconvert --type cache --cachepool lug/mcache lug/repo\n</code></pre> <p>\u63a5\u4e0b\u6765\u6302\u4e0a Docker \u5377\uff08\u6ce8\u610f VG \u540d\u5df2\u7ecf\u4ece ssd \u53d8\u6210\u4e86 lug\uff09\uff1a</p> <pre><code>lvchange -a y lug/docker\nmount /dev/lug/docker /var/lib/docker\n</code></pre>"},{"location":"services/mirrors/4/volumes/#repo","title":"repo \u6269\u5bb9","text":"<p>\u67e5\u770b\u5f53\u524d\u903b\u8f91\u5377\u4fe1\u606f\uff1a</p> <pre><code># lvs -a -o +devices\n  LV              VG  Attr       LSize   Pool     Origin       Data%  Meta%  Move Log         Cpy%Sync Convert Devices\n  backup          lug -wi-ao----   8.00g                                                                       /dev/sda3(6307840)\n  docker          lug -wi-ao----  64.00g                                                                       /dev/sdc1(0)\n  docker2         lug -wi-a----- 300.00g                                                                       /dev/sda3(7925248)\n  home            lug -wi-ao----  64.00g                                                                       /dev/sda3(8192),/dev/sdb3(8193)\n  log             lug -wi-ao---- 300.00g                                                                       /dev/sda3(6309888),/dev/sdb3(6307841)\n  log             lug -wi-ao---- 300.00g                                                                       /dev/sda3(7888896),/dev/sdb3(7882753)\n  [lvol0_pmspare] lug ewi-------  16.00g                                                                       /dev/sda3(7884800)\n  [mcache]        lug Cwi---C---   1.50t                       99.99  0.12                    0.00             mcache_cdata(0)\n  [mcache_cdata]  lug Cwi-ao----   1.50t                                                                       /dev/sdc1(20480)\n  [mcache_cmeta]  lug ewi-ao----  16.00g                                                                       /dev/sdc1(16384)\n  repo            lug Cwi-aoC---  60.00t [mcache] [repo_corig] 99.99  0.12                    0.00             repo_corig(0)\n  [repo_corig]    lug owi-aoC---  60.00t                                                                       /dev/sda3(16384),/dev/sdb3(16385)\n  [repo_corig]    lug owi-aoC---  60.00t                                                                       /dev/sda3(6311936),/dev/sdb3(6309889)\n  root            lug mwi-aom---  32.00g                                          [root_mlog] 100.00           root_mimage_0(0),root_mimage_1(0)\n  [root_mimage_0] lug iwi-aom---  32.00g                                                                       /dev/sda3(0)\n  [root_mimage_1] lug iwi-aom---  32.00g                                                                       /dev/sdb3(0)\n  [root_mlog]     lug lwi-aom---   4.00m                                                                       /dev/sdb3(8192)\n</code></pre> <p>\u68c0\u67e5 cache \u662f\u5426\u6709 dirty block\uff1a</p> <pre><code>$ sudo lvs -o name,cache_policy,cache_settings,chunk_size,cache_used_blocks,cache_dirty_blocks /dev/mapper/lug-repo\n  LV   CachePolicy CacheSettings Chunk CacheUsedBlocks  CacheDirtyBlocks\n  repo smq                       1.00m          1048551                0\n</code></pre> <p>\uff08\u6b63\u5e38\u91cd\u542f\u4e4b\u540e\u53ef\u80fd\u4f1a\u51fa\u73b0 dirty block\uff0c\u539f\u56e0\u4e0d\u660e\u3002\u5982\u679c\u770b\u5230\u6709\u7684\u8bdd\uff0c\u90a3\u53ea\u80fd \u518d\u6b21\u8fdb\u5165\u75db\u82e6\u7684\u8f6e\u56de \u7528\u4e0a\u8ff0\u7684\u65b9\u6cd5\u6e05\u9664\uff0c\u5e76\u4e14\u6e05\u9664\u7684\u65f6\u5019\u5bf9\u7cfb\u7edf\u8d1f\u8f7d\u5f71\u54cd\u5f88\u5927\uff0c\u56e0\u4e3a\u843d\u76d8\u7684\u65f6\u5019\u5176\u4ed6\u8fdb\u7a0b\u5bf9\u5e94\u7684 IO \u4f1a\u88ab\u6682\u505c\uff0c\u5728\u76f8\u5bf9\u5e73\u8861\u65f6\u95f4\u548c\u8d1f\u8f7d\u7684\u547d\u4ee4\u4e0b\uff0c\u4f30\u8ba1\u9700\u8981 10 \u5c0f\u65f6\u7684\u65f6\u95f4\u3002\uff09</p> <p>\u7136\u540e uncache\u3001\u6269\u5bb9\uff1a</p> <pre><code># lvconvert --uncache lug/repo\n# lvextend -L +5T lug/repo\n# xfs_growfs /srv\n</code></pre> <p>\u7136\u540e\u6062\u590d cache\uff08\u53c2\u8003\u4e0a\u9762 mcache_meta \u548c mcache \u903b\u8f91\u5377\u7684\u914d\u7f6e\uff0c\u8bf7\u6ce8\u610f\u5728\u7406\u89e3\u547d\u4ee4\u540e\u518d\u6267\u884c\uff01\uff09\uff1a</p> <pre><code># lvcreate -L 16G -n mcache_meta lug /dev/sdc1  # SSD \u8bbe\u5907\u8def\u5f84\u91cd\u542f\u540e\u53ef\u80fd\u4f1a\u53d8\u5316\n# lvcreate -l 100%FREE -n mcache lug /dev/sdc1\n# lvreduce -l -2048 lug/mcache\n# lvconvert --type cache-pool --poolmetadata lug/mcache_meta --cachemode writethrough -c 64K --config allocation/cache_pool_max_chunks=30000000 lug/mcache\n# lvconvert --type cache --cachepool lug/mcache lug/repo\n</code></pre> <p>\u5751 5</p> <p>\u65b0\u5efa\u65f6\u5728\u5012\u6570\u7b2c\u4e8c\u6b65\u7684 <code>lvconvert</code> \u53ef\u80fd\u4f1a\u5361\u6b7b\u8d85\u8fc7\u534a\u5c0f\u65f6\uff08\u4f46\u662f\u6700\u540e\u8fd8\u662f\u80fd\u5b8c\u6210\u7684\uff09\uff0c\u6808\u7684\u4fe1\u606f\u663e\u793a\u6808\u9876\u51fd\u6570\u662f <code>submit_bio_wait()</code>\uff0c\u5728\u6e05\u96f6\u5bf9\u5e94\u7684 block range\uff0c\u56e0\u4e3a RAID \u5361\u4e0d\u652f\u6301\u4e0b\u4f20 discarding \u6240\u4ee5\u4f1a\u5f88\u6162\uff0c\u9700\u8981\u7b49\u4e00\u6bb5\u65f6\u95f4\u3002</p>"},{"location":"services/mirrors/4/volumes/#fstab","title":"fstab","text":"<p>\u5206\u533a\u5b8c\u6bd5\u540e\u7ed9 <code>/etc/fstab</code> \u8865\u4e0a\u76f8\u5173\u7684\u5185\u5bb9\u5e76\u6302\u8f7d\uff1a</p> <pre><code>/dev/mapper/lug-home   /home           ext4 defaults             0 2\n/dev/mapper/lug-docker /var/lib/docker ext4 defaults             0 2\n/dev/mapper/lug-repo   /srv            xfs  defaults,pqnoenforce 0 2\n/dev/mapper/lug-log    /var/log        ext4 defaults             0 2\n</code></pre> <p>\uff08\u8fd9\u4e2a log \u5206\u533a\u524d\u9762\u6ca1\u63d0\uff0c\u53cd\u6b63\u50cf\u6a21\u50cf\u6837\u77e5\u9053\u5c31\u884c\u4e86\uff09</p>"},{"location":"services/mirrors/4/networking/","title":"Networking on mirrors4","text":"<p>\u51fa\u4e8e\u597d\u7528\u7684\u8003\u8651\uff0cmirrors4 \u4e0a\u7684\u7f51\u7edc\u4f7f\u7528 systemd-networkd \u914d\u7f6e\u3002\u4f5c\u4e3a\u5165\u95e8\uff0c\u4e0b\u9762\u662f\u4e24\u4e2a\u53c2\u8003\u94fe\u63a5\uff1a</p> <ul> <li>Systemd-networkd - Arch Wiki</li> <li>SystemdNetworkd - Debian Wiki</li> </ul> <p>Debian \u9ed8\u8ba4\u7528\u7684\u662f ifupdown\uff0c\u628a\u5b83\u76f4\u63a5\u5378\u6389\u5c31\u884c\u4e86\u3002\u5168\u90e8\u914d\u7f6e\u5b8c\u6bd5\u4e4b\u540e\u9700\u8981 <code>systemctl enable systemd-networkd.service</code> \u5e76\u4e14 start \u4e00\u4e0b\uff08\u6216\u8005\u76f4\u63a5\u91cd\u542f\uff09\u3002</p> <p>/etc/systemd/network \u76ee\u5f55\u4e0b\u6709\u4e2a Git \u4ed3\u5e93\uff0c\u65b9\u4fbf\u4fdd\u5b58\u4e0e\u6062\u590d</p>"},{"location":"services/mirrors/4/networking/#bond","title":"Bond","text":"<p>Bond \u7528\u4e8e\u5c06\u591a\u4e2a\u7f51\u5361\u805a\u5408\u5f53\u4f5c\u4e00\u4e2a\u4f7f\u7528\u3002</p>"},{"location":"services/mirrors/4/networking/#_1","title":"\u5b50\u7f51\u5361","text":"<p>\u5411 <code>/etc/systemd/network/ens41f0.network</code> \u5199\u5165\u5982\u4e0b\u5185\u5bb9\uff1a</p> <pre><code>[Match]\nName=ens41f0\n\n[Network]\nBond=bond1\n\n[Link]\nRequiredForOnline=no\n</code></pre> <p>\u5373\u53ef\u5c06\u5176\u8bbe\u7f6e\u4e3a bond1 \u7684\u4e00\u4e2a\u5b50\u7f51\u5361\u3002\u7528\u540c\u6837\u65b9\u5f0f\u628a ens41f1 \u4e5f\u8bbe\u4e3a\u5b50\u7f51\u5361\u3002</p> <p>\u4e00\u4e2a\u5c0f\u5751</p> <p>systemd-networkd \u6709\u4e00\u4e2a\u9ed8\u8ba4\u7684 bond0 \u805a\u5408\u7f51\u5361\uff0c\u6a21\u5f0f\u6c38\u8fdc\u662f round-robin\uff0c\u800c\u4e14\u5c1d\u8bd5\u8bbe\u7f6e\u8fd9\u4e2a\u7f51\u5361\u5f88\u5bb9\u6613\u51fa\u95ee\u9898\uff0c\u6240\u4ee5\u6211\u4eec\u907f\u5f00\u8fd9\u4e2a\u540d\u5b57\uff0c\u7528 bond1\u3002</p>"},{"location":"services/mirrors/4/networking/#bond1","title":"bond1 \u805a\u5408\u7f51\u5361","text":"<p>\u5199\u5165 <code>/etc/systemd/network/bond1.netdev</code>\uff1a</p> <pre><code>[NetDev]\nName=bond1\nKind=bond\n\n[Bond]\nMode=balance-tlb\nMIIMonitorSec=1\n</code></pre> <p>\u5173\u4e8e bond \u6a21\u5f0f\uff08<code>balance-tlb</code> vs <code>balance-alb</code>\uff09\uff0c\u53c2\u8003\u8fd9\u4e2a Server Fault \u4e0a\u7684\u56de\u7b54\u3002</p> <p>\u7136\u540e\u521b\u5efa VLAN\uff0c\u5199\u5165 <code>/etc/systemd/network/bond1.network</code>\uff1a</p> <pre><code>[Match]\nName=bond1\n\n[Network]\nDHCP=no\nVLAN=cernet\nVLAN=telecom\nVLAN=mobile\nVLAN=unicom\n</code></pre>"},{"location":"services/mirrors/4/networking/#vlan","title":"VLAN","text":"<p>NIC \u673a\u623f\u6709 4 \u4e2a VLAN\uff0c\u5206\u522b\u662f</p> <ul> <li>ID 95\uff0c\u6559\u80b2\u7f51 202.38.95.0/25</li> <li>ID 10\uff0c\u7535\u4fe1 202.141.160.0/25</li> <li>ID 400\uff0c\u79fb\u52a8 202.141.176.0/25</li> <li>ID 11\uff0c\u8054\u901a 218.104.71.96/28, 218.104.71.160/28</li> </ul> <p>\u6ce8\u610f\u8fd9\u51e0\u4e2a\u7f51\u6bb5\u90fd\u6ca1\u6709 DHCP\uff0c\u53ea\u6709\u6559\u80b2\u7f51 VLAN \u6709 IPv6 RA\u3002</p> <p>\u4e0b\u9762\u4ee5\u6559\u80b2\u7f51 VLAN \u4e3a\u4f8b\u3002</p> <p>\u56e0\u4e3a VLAN \u5728\u7269\u7406\u4e0a\u5c5e\u4e8e\u4e00\u4e2a\u7f51\u5361\uff0c\u56e0\u6b64\u5411\u5bf9\u5e94\u7f51\u5361\u7684 <code>.network</code> \u6587\u4ef6\u7684 <code>[Network]</code> \u6bb5\u8ffd\u52a0\u4e00\u884c\uff08\u89c1\u4e0a\u9762\u4e00\u8282 <code>bond1.network</code> \u6587\u4ef6\uff09\uff1a</p> <pre><code>VLAN=cernet\n</code></pre> <p>\u521b\u5efa VLAN \u754c\u9762\uff0c\u521b\u5efa <code>cernet.netdev</code> \u5e76\u5199\u5165</p> <pre><code>[NetDev]\nName=cernet\nKind=vlan\n\n[VLAN]\nId=95\n</code></pre> <p>\u7136\u540e\u5c31\u53ef\u4ee5\u6307\u5b9a IP \u5730\u5740\u7b49\u5177\u4f53\u4fe1\u606f\u4e86\uff0c\u521b\u5efa\u4e00\u4e2a\u540d\u5b57\u76f8\u540c\uff0c\u540e\u7f00\u6362\u6210 <code>.network</code> \u7684\u6587\u4ef6\u5e76\u5199\u5165</p> <pre><code>[Match]\nName=cernet\n\n[Network]\nDHCP=no\nAddress=202.38.95.110/25\n#Gateway=202.38.95.126\nAddress=2001:da8:d800:95::110/64\n#Gateway=2001:da8:d800:95::1\nIPv6AcceptRA=false\n</code></pre> <p>\u4fdd\u5b58\u540e\u91cd\u542f <code>systemd-networkd.service</code> \u5c31\u53ef\u4ee5\u770b\u5230\u6548\u679c\u4e86\u3002</p> <p>\u4e3a\u4ec0\u4e48 Gateway \u88ab\u6ce8\u91ca\u6389\u4e86</p> <p>\u6839\u636e systemd \u5b98\u65b9\u6587\u6863\uff0c\u5728 <code>[Network]</code> \u4e00\u8282\u51fa\u73b0\u7684 <code>Gateway=</code> \u7b49\u4ef7\u4e8e\u4e00\u4e2a\u5355\u72ec\u7684\u3001\u4ec5\u5305\u542b\u4e00\u884c <code>Gateway=</code> \u7684 <code>[Route]</code> \u8282\u3002\u7531\u4e8e\u6211\u4eec\u9700\u8981\u6df1\u5ea6\u81ea\u5b9a\u4e49\u8def\u7531\uff0c\u8fd9\u91cc\u4e0d\u65b9\u4fbf\u91c7\u7528\u8fd9\u4e2a\u8fc7\u4e8e\u7b80\u6d01\u7684\u8bbe\u5b9a\uff08\u4f8b\u5982\u5404\u79cd\u9ed8\u8ba4\u503c <code>Table=main</code> \u7b49\uff09\u3002</p>"},{"location":"services/mirrors/4/networking/#docker-network","title":"Docker network","text":"<p>\u9488\u5bf9\u4e2a\u522b\u4e0d\u652f\u6301 bind address \u7684\u540c\u6b65\u5de5\u5177\uff0c\u6211\u4eec\u901a\u8fc7\u5c06\u5176\u653e\u5165\u7279\u5b9a\u7684 docker network \u6765\u5b9e\u73b0\u9009\u62e9\u7ebf\u8def\u7684\u529f\u80fd\u3002</p> \u521b\u5efa\u547d\u4ee4<pre><code>docker network create --driver=bridge --subnet=172.17.4.1/24 -o \"com.docker.network.bridge.name=dockerC\" cernet\ndocker network create --driver=bridge --subnet=172.17.5.1/24 -o \"com.docker.network.bridge.name=dockerT\" telecom\ndocker network create --driver=bridge --subnet=172.17.6.1/24 -o \"com.docker.network.bridge.name=dockerM\" mobile\ndocker network create --driver=bridge --subnet=172.17.7.1/24 -o \"com.docker.network.bridge.name=dockerU\" unicom\ndocker network create --driver=bridge --ipv6 --subnet=172.17.8.1/24 --subnet=fd00:6::/64 -o \"com.docker.network.bridge.name=dockerC6\" cernet6\ndocker network create --driver=bridge --subnet=172.17.9.1/24 -o \"com.docker.network.bridge.name=dockerV\" lugvpn\n</code></pre> <p>\u7136\u540e\u4f7f\u7528 systemd-networkd \u5bf9\u521b\u5efa\u597d\u7684 docker network \u7f51\u6bb5\u914d\u7f6e\u89c4\u5219\u8def\u7531\u3002</p> /etc/systemd/network/cernet.network<pre><code># Docker Cernet\n[RoutingPolicyRule]\nFrom=172.17.4.0/24\nTable=1011\nPriority=5\n\n[RoutingPolicyRule]\nFrom=172.17.8.0/24\nTable=1011\nPriority=5\n</code></pre> <p>\u5176\u4ed6\u51e0\u4e2a\u6587\u4ef6\u7c7b\u4f3c\uff0c\u53ea\u9700\u8981\u4fee\u6539\u7f51\u6bb5\u548c Table \u5373\u53ef\u3002</p>"},{"location":"services/mirrors/4/networking/#docker-network-cernet6","title":"Docker network: cernet6","text":"<p>\u7531\u4e8e\u4e00\u4e9b\u7a0b\u5e8f\u6216\u7cfb\u7edf\u73af\u5883\u5728\u53cc\u6808\u7f51\u7edc\u4e2d\u4ecd\u7136\u4f1a\u4f18\u5148\u5c1d\u8bd5 IPv4\uff0c\u6211\u4eec\u5c06 cernet6 \u7f51\u7edc\u7684 v4 \u516c\u7f51\u8bbf\u95ee\u5c4f\u853d\u6389\u3002</p> rules.v4<pre><code>*filter\n:FORWARD DROP [0:0]\n# ...\n-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n-A FORWARD -i dockerC6 -j REJECT\n-A FORWARD -i docker+ -j ACCEPT\n</code></pre>"},{"location":"services/mirrors/4/networking/misc/","title":"mirrors \u7f51\u7edc\u914d\u7f6e\u6742\u9879","text":""},{"location":"services/mirrors/4/networking/misc/#sniproxy","title":"sniproxy","text":"<p>Sniproxy \u7528\u4e8e\u4e3a Docker \u5bb9\u5668\u63d0\u4f9b\u65b9\u4fbf\u7684 HTTP(S) \u7f51\u7edc\u5206\u6d41\u3002\u76ee\u524d\u5728 mirrors \u4e0a\u7528\u4e8e\u4e3a dockerhub \u5bb9\u5668\u63d0\u4f9b\uff08\u5230 Cloudflare \u7684\uff09IPv6 \u63a5\u5165\uff08Docker \u505a IPv6 NAT \u975e\u5e38\u4e0d\u65b9\u4fbf\uff0c\u6240\u4ee5\u4ee5\u6b64\u4e3a\u6743\u5b9c\u4e4b\u4e3e\uff09\uff0c\u4ee5\u63d0\u9ad8\u6821\u5185\u8bbf\u95ee\u65f6\u7684\u901f\u5ea6\u3002</p>"},{"location":"services/mirrors/4/networking/misc/#_1","title":"\u914d\u7f6e","text":"<p>\u5b89\u88c5 sniproxy\uff0c\u5e76\u4e14 mask \u539f\u670d\u52a1\u914d\u7f6e\uff08\u6211\u4eec\u81ea\u5df1\u5199\u4e00\u4e2a\uff09\uff1a</p> <pre><code>sudo apt install sniproxy\nsudo mkdir -p /etc/sniproxy\nsudo systemctl mask sniproxy.service\n</code></pre> <p>\u521b\u5efa <code>/etc/systemd/system/sniproxy@.service</code>\uff1a</p> <pre><code>[Unit]\nDescription=SNIProxy (%i.conf)\nAfter=network.target network-online.target\nStartLimitIntervalSec=1\n\n[Service]\nType=simple\nExecStart=/usr/sbin/sniproxy -f -c /etc/sniproxy/%i.conf\nRestart=on-failure\nRestartSec=3\n\n[Install]\nWantedBy=multi-user.target\n</code></pre> <p>\u5728 <code>/etc/sniproxy</code> \u4e2d\u521b\u5efa\u914d\u7f6e\u3002\u4ee5\u4e0b\u4e3a IPv6 + TLS (443) only \u7684\u914d\u7f6e\u4f8b\u5b50\uff1a</p> <pre><code>resolver {\n    nameserver 2001:da8:d800::1\n    mode ipv6_only\n}\n\naccess_log {\n    filename /dev/null\n}\n\nlisten &lt;Bind \u5230\u7684 IP \u5730\u5740&gt;:443 {\n    proto tls\n    reuseport yes\n    table all\n    source &lt;IPv6 \u51fa\u53e3\u5730\u5740&gt;\n}\n\ntable all {\n    .* *\n}\n</code></pre> <p>\u6700\u540e\u542f\u52a8\u670d\u52a1\uff1a</p> <pre><code>sudo systemctl enable sniproxy@\u914d\u7f6e\u6587\u4ef6\u540d.service\nsudo systemctl start sniproxy@\u914d\u7f6e\u6587\u4ef6\u540d.service\n</code></pre>"},{"location":"services/mirrors/4/networking/route/","title":"Routing on mirrors4","text":"<p>\u7531\u4e8e mirrors4 \u6ca1\u6709\u4f7f\u7528 ifupdown \u4f5c\u4e3a\u7f51\u7edc\u7ba1\u7406\u7cfb\u7edf\uff0c\u800c\u662f\u91c7\u7528 systemd-networkd\uff0c\u56e0\u6b64\u6211\u4eec\u6ca1\u6709 <code>pre-up</code>, <code>up</code>, <code>down</code>, <code>post-down</code> \u7b49\u8fd0\u884c\u547d\u4ee4\u7684\u65b9\u5f0f\uff0c\u6240\u4ee5 mirrors2 \u4e0a\u4f7f\u7528\u7684\u90a3\u5957\u811a\u672c\uff08<code>ip-route.sh</code> \u7b49\uff09\u65e0\u6cd5\u76f4\u63a5\u5728 mirrors4 \u4e0a\u7ee7\u7eed\u4f7f\u7528\u3002</p> <p>\u597d\u5728\u6211\u4eec\u4f7f\u7528 <code>up</code> \u7b49\u8fd0\u884c\u547d\u4ee4\u53ea\u662f\u4e3a\u4e86\u914d\u7f6e\u8def\u7531\uff0c\u56e0\u6b64\u6362\u4e86\u4e2a\u529e\u6cd5\uff0c\u6574\u4e86\u4e2a\u65b0\u811a\u672c\u628a IP \u5730\u5740\u5217\u8868\uff08\u6765\u81ea gaoyifan/china-operator-ip\uff09\u8f6c\u6362\u6210 networkd \u6240\u4f7f\u7528\u7684\u914d\u7f6e\u6587\u4ef6\u683c\u5f0f\u3002\u4ee3\u7801\u4e0d\u957f\uff1a</p> <pre><code>#!/bin/bash\n\nROOT_IP_LIST=/usr/local/network_config/iplist\nROOT_RT=/run/systemd/network\n\ngen_route() {\n  IPLIST=\"$ROOT_IP_LIST/$1\"\n  GW=\"$2\"\n  DEV=\"$3\"\n  # Convert table to number\n  TABLENAME=\"$4\"\n  TABLE=\"$(awk 'substr($0, 1, 1) != \"#\" &amp;&amp; $2 == \"'\"$TABLENAME\"'\" { print $1 }' /etc/iproute2/rt_tables | head -1)\"\n  PRIORITY=\"$5\"\n\n  F=\"$ROOT_RT/$DEV.network.d\"\n  mkdir -p \"$F\"\n  F=\"$F/route-${TABLENAME,,}.conf\"\n\n  echo -e \"[RoutingPolicyRule]\\nTable=$TABLE\\nPriority=$PRIORITY\\n\" &gt; \"$F\"\n  awk '{ print \"[Route]\\nDestination=\" $1 \"\\nGateway='\"$GW\"'\\nTable='\"$TABLE\"'\\n\" }' \"$IPLIST\" &gt;&gt; \"$F\"\n}\n\ngen_route ustcnet.txt 202.38.95.126 cernet Ustcnet 5\ngen_route cernet.txt 202.38.95.126 cernet Cernet 6\ngen_route telecom.txt 202.141.160.126 telecom Telecom 6\ngen_route mobile.txt 202.141.176.126 mobile Mobile 6\ngen_route unicom.txt 218.104.71.161 unicom Unicom 6\ngen_route china.txt 218.104.71.161 unicom China 7\n</code></pre> <p>\u8fd9\u4e2a\u4ed3\u5e93\u91cc\u6709\u5f88\u591a\u4e2a txt \u6587\u4ef6\uff0c\u6bcf\u4e2a\u6587\u4ef6\u5bf9\u5e94\u4e00\u4e2a ISP \u7684\u5730\u5740\u5217\u8868\uff0c\u6bcf\u884c\u4e00\u4e2a CIDR\u3002\u811a\u672c\u4e2d\u7684 <code>gen_route</code> \u51fd\u6570\u6839\u636e\u53c2\u6570\u8bfb\u53d6\u6587\u4ef6\uff0c\u5e76\u8f6c\u6362\u6210\u4e0b\u9762\u8fd9\u6837\u7684\u683c\u5f0f\uff1a</p> <pre><code>[Route]\nDestination=1.0.0.0/24\nGateway=202.38.95.126\nTable=1011\n</code></pre> <p>\u8fd9\u6837\u4e00\u4e2a <code>[Route]</code> \u8282\u5bf9\u5e94\u4e00\u6761\u8def\u7531\u89c4\u5219\uff0c\u6574\u4e2a txt \u7684\u8f6c\u6362\u7ed3\u679c\u8f93\u51fa\u5230 <code>/run/systemd/network/cernet.network.d/route-example.conf</code>\u3002\u5176\u4e2d <code>cernet.network.d/*.conf</code> \u7528\u4e8e\u5411\u73b0\u6709\u7684\u914d\u7f6e\u4e2d\u6dfb\u52a0\u5185\u5bb9\uff08\u4e0e systemd service \u7c7b\u4f3c\uff09\uff0c\u800c <code>/run</code> \u76ee\u5f55\uff08\u6309\u7406\u6765\u8bf4\uff09\u91cd\u542f\u4f1a\u6e05\u7a7a\uff0c\u9002\u5408\u653e\u7f6e\u8fd9\u4e9b\u7528\u4e8e\u52a8\u6001\u751f\u6210\u7684\u5185\u5bb9\u3002\u53e6\u5916\u7531\u4e8e\u8def\u7531\u89c4\u5219\uff08<code>ip rule</code>\uff09\u4e5f\u7531 networkd \u7ba1\u7406\u548c\u751f\u6210\u4e86\uff0c\u56e0\u6b64\u6bcf\u4e2a <code>route-xxx.conf</code> \u5f00\u5934\u4f1a\u5305\u542b\u4e00\u4e2a <code>[RoutingPolicyRule]</code> \u8282\u7528\u4e8e\u751f\u6210\u8def\u7531\u8868\u5bf9\u5e94\u7684\u8def\u7531\u89c4\u5219\u3002</p> <p>\u6ce8\u610f\u8def\u7531\u8868\u662f\u7528\u540d\u79f0\u6307\u5b9a\u7684\uff0c\u4ece <code>/etc/iproute2/rt_tables</code> \u4e2d\u67e5\u51fa\u5bf9\u5e94\u7684\u6570\u5b57 ID\u3002\u8fd9\u4e2a\u6587\u4ef6\u672c\u6765\u4e5f\u662f <code>ip</code> \u547d\u4ee4\u6240\u4f7f\u7528\u7684\uff08\u6ce8\u610f\u5b83\u7684\u76ee\u5f55\u540d\u53eb <code>iproute2</code>\uff09\u3002</p> <p>\u6700\u540e\u7ed9\u8fd9\u4e2a\u811a\u672c\u914d\u4e2a service\uff0c\u8ba9\u5b83\u5728 networkd \u4e4b\u524d\u8fd0\u884c\uff1a</p> <pre><code># WARNING: This is NOT the final configuration file!\n[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\nWants=systemd-networkd.service\n</code></pre> <p>\u8fd9\u4e2a\u6587\u4ef6\u5b58\u5230 <code>/etc/systemd/system/route-all.service</code>\uff0creload \u518d enable \u5c31\u53ef\u4ee5\u4e86\u3002</p> <p>\u6539 systemd-networkd.service \u9700\u8981\u989d\u5916\u6ce8\u610f</p> <p>\u8fd9\u4e2a\u81ea\u5e26\u7684\u670d\u52a1\u6709\u4e00\u4e2a <code>User=systemd-networkd</code>\uff0c\u4f60\u65e2\u4e0d\u80fd <code>ip rule</code> \u4e5f\u4e0d\u80fd\u5199\u5165 <code>/run/systemd</code> \u7b49\uff0c\u4f1a\u5bfc\u81f4\u670d\u52a1\u70b8\u6389\uff0c\u7136\u540e\u7f51\u4e5f\u70b8\u4e86\u3002\u3002\u3002</p> <p>\u5982\u679c\u8981\u6539 networkd \u670d\u52a1\u64cd\u4f5c <code>ip rule</code> \u7684\u8bdd\uff0c\u9700\u8981\u5728\u547d\u4ee4\u884c\u524d\u9762\u52a0\u4e00\u4e2a <code>+</code> \u8868\u793a\u8be5\u547d\u4ee4\u4e0d\u53d7 <code>User=</code> \u7b49\u6743\u9650\u8bbe\u7f6e\u5f71\u54cd\uff0c\u8be6\u7ec6\u89e3\u91ca\u89c1 systemd.service \u6587\u6863\u3002</p>"},{"location":"services/mirrors/4/networking/route/#special-routing","title":"Special routing","text":"<p>\u90e8\u5206 IP \u9700\u8981\u914d\u7f6e\u7279\u6b8a\u8def\u7531\u89c4\u5219\u65f6\uff08\u800c\u4e0d\u662f\u4f7f\u7528\u9ed8\u8ba4\uff09\uff0c\u7f16\u8f91 <code>/usr/local/network_config/special.yml</code>\uff0c\u5176\u683c\u5f0f\u5982\u4e0b\uff1a</p> <pre><code>routes: # Root key\uff0c\u4fdd\u7559\n  lugvpn: # /etc/systemd/network \u4e2d\u5bf9\u5e94\u7684 .network \u6587\u4ef6\u540d\n    # \u4e0b\u9762\u662f\u4e00\u4e2a\u8def\u7531\u6587\u4ef6\u7684\u914d\u7f6e\uff0c\u4e00\u4e2a\u6587\u4ef6\u5171\u4eab\u4e00\u4e2a table \u548c gateway \u8bbe\u7f6e\n    - name: route-special # \u5c06\u8981\u521b\u5efa\u7684 .conf \u6587\u4ef6\u540d\uff0c\u53ef\u4ee5\u968f\u610f\n      table: Special # \u8def\u7531\u8868\uff0c\u5373 ip route add table \u540e\u9762\u7684\u53c2\u6570\uff0c\u6570\u5b57\u6216\u8868\u540d\n      gateway: false # \u662f\u5426\u5305\u542b\u7f51\u5173\uff0c\u6216\u8005 ip route \u7684 via \u53c2\u6570\n      routes: # \u6240\u6709\u7684\u8def\u7531\u6761\u76ee\n        - 1.2.3.4\n        - 5.6.7.8/28\n        - 2001:db8::2333/64\n\n  cernet: # \u66f4\u591a\u7684\u914d\u7f6e\n    - ...\n</code></pre> <p>\u4fee\u6539 <code>special.yml</code> \u4e4b\u540e\u91cd\u542f <code>route-all.service</code>\u3002\u8be5\u670d\u52a1\u4f1a\u81ea\u52a8\u5bfc\u81f4 <code>systemd-networkd.service</code> \u91cd\u542f\u5e76\u8f7d\u5165\u65b0\u7684\u8def\u7531\u914d\u7f6e\u4fe1\u606f\u3002</p> special.rb \u5904\u7406\u811a\u672c\uff08\u653e\u5728\u8fd9\u5907\u4efd\uff09 <pre><code>#!/usr/bin/ruby\n\nrequire 'fileutils'\nrequire 'yaml'\n\nBASEDIR = '/run/systemd/network'\nRT_TABLES = '/etc/iproute2/rt_tables'\n\nrt_tables = Hash.new\nFile.readlines(RT_TABLES).each do |l|\n  next if l =~ /^\\s*#/\n  id, name = l.split\n  rt_tables[name] = id\nend\n\ndata = YAML.load_file File.join(__dir__, 'special.yml')\ndata['routes'].each do |fn, setups|\n  confdir = File.join(BASEDIR, \"#{fn}.network.d\")\n  FileUtils.mkdir_p confdir\n\n  setups.each do |config|\n    table = config['table']\n    gateway = config['gateway']\n    File.open File.join(confdir, \"#{config['name']}.conf\"), 'w' do |f|\n      config['routes'].each do |dst|\n        t = \"[Route]\\nDestination=#{dst}\\n\"\n        t += \"Table=#{rt_tables.fetch table, table}\\n\" if table\n        t += \"Gateway=#{gateway}\\n\" if gateway\n        f.write t + \"\\n\"\n      end\n    end\n  end\nend\n</code></pre> <p>route-all.service \u6709\u5f88\u591a\u6ce8\u610f\u4e8b\u9879</p> <p>\u4e3a\u4e86\u6e05\u7406\u5f00\u673a\u81ea\u52a8\u4ea7\u751f\u7684 32766 \u548c 32767 \u4e24\u6761\u8def\u7531\u89c4\u5219\uff0c\u6211\u4eec\u540c\u65f6\u4e3a <code>systemd-networkd.service</code> \u6dfb\u52a0\u4e86\u4e24\u4e2a <code>ExecStartPre</code> \u5982\u4e0b\uff1a</p> <pre><code>[Service]\nExecStartPre=-+/sbin/ip rule delete from all table main pref 32766\nExecStartPre=-+/sbin/ip rule delete from all table default pref 32767\n</code></pre> <p>\u53e6\u9644\u5b8c\u6574\u7684 <code>route-all.service</code> \u6587\u4ef6\uff1a</p> <pre><code>[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\nExecStart=/usr/local/network_config/special.rb\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\nWants=systemd-networkd.service\n</code></pre>"},{"location":"services/pxe/","title":"PXE","text":"<p>\u5bf9\u6821\u56ed\u7f51\u7528\u6237\u4e0e\u6821\u5916\u7528\u6237\u516c\u5f00\u7684 PXE \u670d\u52a1\u3002LIIMS \u4e0e\u76ee\u524d\u7684 PXE \u867d\u7136\u8fd0\u884c\u5728\u540c\u4e00\u53f0\u670d\u52a1\u5668\u4e0a\uff0c\u4f46\u662f\u914d\u7f6e\u6709\u6240\u4e0d\u540c\u3002</p> <p>\u672c\u6587\u6863\u9700\u8981\u5927\u5e45\u6269\u5145</p>"},{"location":"services/pxe/#intro","title":"Intro","text":"<p>https://lug.ustc.edu.cn/wiki/server/pxe/</p> <p>https://lug.ustc.edu.cn/planet/2018/10/PXE-intro/</p> <p>\u5173\u4e8e FAQ</p> <p>https://lug.ustc.edu.cn/wiki/server/pxe/faq/ \u5b9e\u5728\u662f\u5e74\u5934\u592a\u4e45\u8fdc\u4e86\uff0c\u65e0\u6cd5\u66f4\u65b0\u3002\u65b0\u7684\u5185\u5bb9\u8bb0\u5f55\u5728\u672c\u6587\u6863\u4e2d\u3002</p> <p>\u4e00\u822c\u7684\u542f\u52a8\u6d41\u7a0b\u662f\uff1a</p> <ol> <li>iPXE\uff0c\u6216\u8005\u4e3b\u677f\u4e0a\u83b7\u53d6\u7684 DHCP \u542f\u52a8\u4fe1\u606f\u7684\u56fa\u4ef6\u4e0b\u8f7d\u5e76\u52a0\u8f7d GRUB \u76f8\u5173\u6587\u4ef6\u3002</li> <li>\u5982\u679c MAC \u5730\u5740\u4e0d\u4e3a\u6307\u5b9a\u503c\uff0c\u90a3\u4e48\u52a0\u8f7d\u83dc\u5355\u5e76\u663e\u793a\uff1b\u7136\u540e\u52a0\u8f7d Linux \u5185\u6838\u4e0e initramfs \u7b49\u4e8b\u9879\u7531 GRUB \u8d1f\u8d23\u3002</li> <li>Initramfs \u4ece\u542f\u52a8\u53c2\u6570\u6302\u8f7d NFS \u4e3a rootfs\uff0c\u8fdb\u884c\u4e0b\u4e00\u6b65\u7684\u542f\u52a8\u3002</li> </ol>"},{"location":"services/pxe/#_1","title":"\u4f7f\u7528/\u8c03\u8bd5","text":"<p>PXE \u5728\u6821\u56ed\u7f51\u4e2d\u76f4\u63a5\u53ef\u7528\uff0c\u56e0\u4e3a\u5b66\u6821\u7684 DHCP \u670d\u52a1\u5668\u7ecf\u8fc7\u4e86\u914d\u7f6e\u3002</p> <p>\u5982\u679c\u9700\u8981\u5728\u865a\u62df\u673a\u4e2d\u8c03\u8bd5\uff0c\u53ef\u4ee5\uff1a</p> <ul> <li>\u4e0b\u8f7d IPXE \u7684 ISO\uff08http://boot.ipxe.org/ipxe.iso\uff09\uff0c\u6302\u8f7d\u5728\u865a\u62df\u673a\u4e2d\u6d4b\u8bd5\u3002</li> <li>\u6216\u8005\u76f4\u63a5\u4f7f\u7528\u6253\u5305\u540e\u7684 ISO\uff1ahttps://ftp.lug.ustc.edu.cn/PXE/image/ustc.ipxe.iso</li> </ul> <p>\u63a8\u8350\u4f7f\u7528\u7684\u865a\u62df\u673a\u65b9\u6848</p> <p>PXE \u80fd\u591f\u6210\u529f\u8fd0\u884c\u4e0e\u5426\u6709\u53ef\u80fd\u548c\u865a\u62df\u673a\u73af\u5883\uff08\u7279\u522b\u662f\u865a\u62df\u7f51\u5361\u578b\u53f7\uff09\u9ad8\u5ea6\u76f8\u5173\u3002\u63a8\u8350\u4f7f\u7528 QEMU\u3002</p> <p>\u5176\u4e2d\u4e3b\u8981\u4f7f\u7528\u7684\u662f\u57fa\u4e8e GRUB2 \u548c simple-pxe \u7684\u65b0 PXE \u65b9\u6848\u3002\u4e3b\u677f\u56fa\u4ef6\u4f7f\u7528 TFTP \u534f\u8bae\u83b7\u53d6 GRUB2 \u7a0b\u5e8f\uff08core.0 \u6216\u8005 core.efi\uff09\u4e4b\u540e\uff0cGRUB2 \u4f1a\u901a\u8fc7 HTTP \u534f\u8bae\u83b7\u53d6\u5269\u4e0b\u6240\u6709\u7684\u6587\u4ef6\u3002</p> <p>TFTP</p> <p>\u548c FTP active \u6a21\u5f0f\u4e00\u6837\uff0cTFTP \u662f\u4e00\u4e2a\u6709\u70b9\u9ebb\u70e6\u7684\u534f\u8bae\uff0c\u5982\u679c\u4f60\u7684\u865a\u62df\u673a\u65e0\u6cd5\u4e0d\u7ecf\u8fc7 NAT \u8fde\u63a5 PXE \u670d\u52a1\u5668\uff0c\u90a3\u4e48\u5c31\u9700\u8981\u8c03\u6574\u7f51\u7edc\u914d\u7f6e\uff0c\u4f1a\u5f88\u9ebb\u70e6\uff0c\u518d\u52a0\u4e0a\u5bf9\u6821\u5916\u8bbf\u95ee\u9700\u6c42\u7684\u8003\u91cf\uff0c\u56e0\u6b64\u76ee\u524d\u7684\u8003\u8651\u662f\u5c3d\u91cf\u4f7f\u7528 HTTP\u3002</p> <p>\u57fa\u4e8e SYSLINUX \u7684\u8001 PXE \u65b9\u6848\uff08lpxelinux.0 -&gt; bin/lpxelinux.0\uff09\u76ee\u524d\u4ecd\u53ef\u542f\u52a8\uff0c\u4f46\u662f\u4e0d\u4f7f\u7528\u3002</p>"},{"location":"services/pxe/#syslinux","title":"SYSLINUX \u66f4\u65b0","text":"<p>\u867d\u7136\u4e0d\u7ef4\u62a4\u4e86\uff0c\u4f46\u662f\u4ee5\u4e0b\u5185\u5bb9\u4ecd\u4f5c\u8bb0\u5f55\uff1a</p> <pre><code>wget https://mirrors.ustc.edu.cn/fedora/releases/40/Everything/x86_64/os/Packages/s/syslinux-tftpboot-6.04-0.26.fc40.noarch.rpm\n# decompress\nrpm2cpio syslinux-tftpboot-6.04-0.26.fc40.noarch.rpm | cpio -idmv\ncd tftpboot\nln -s lpxelinux.0 pxelinux.0\nln -s lpxelinux.0 undionly.kpxe\n</code></pre> <p>\u5f97\u5230\u7684 tftpboot \u76ee\u5f55\u66ff\u4ee3\u539f\u5148\u7684 tftp/bin \u76ee\u5f55\u3002\u542f\u52a8 VM \u7684\u65f6\u5019\u53ef\u4ee5 Wireshark \u770b\u770b\u5b83\u4e0b\u8f7d\u4e86\u54ea\u4e9b\u6587\u4ef6\u3002\u540c\u65f6\u8fd8\u6709\u4e2a <code>pxeknife</code>\uff0c\u76ee\u524d\u53ea\u5728 SYSLINUX \u7684 PXE \u65b9\u6848\u4e2d\u53ef\u7528\u3002</p> <p>pypxe</p> <p>pypxe \u4f3c\u4e4e\u53ea\u5728 SYSLINUX \u65b9\u6848\u4e2d\u4f7f\u7528\u3002</p>"},{"location":"services/pxe/#uefi","title":"\u4f7f\u7528 UEFI \u76f4\u63a5\u542f\u52a8","text":"<p>QEMU \u4e00\u822c\u4f7f\u7528\u7684 UEFI \u56fa\u4ef6 OVMF \u652f\u6301\u76f4\u63a5\u4ece HTTP \u542f\u52a8\u3002\u5728\u5199\u4f5c\u65f6\uff0cArch Linux \u6253\u5305\u7684 OVMF \u6ca1\u7f16\u8bd1\u6b64\u7279\u6027\uff0c\u5176\u4ed6\u7684\u53d1\u884c\u7248\u4e5f\u6709\u53ef\u80fd\u4e0d\u652f\u6301\uff0c\u56e0\u6b64\u9700\u8981\uff1a</p> <ol> <li>\u4ece https://www.kraxel.org/repos/jenkins/edk2/ \u4e0b\u8f7d x64 \u7248\u672c\u7684 rpm \u5e76\u89e3\u538b</li> <li> <p>\u7136\u540e\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u542f\u52a8 QEMU\uff1a</p> <pre><code>qemu-system-x86_64 -L . --bios ../ovmf-x64/OVMF-pure-efi.fd\n</code></pre> <p>\u542f\u52a8\u540e\u9a6c\u4e0a\u6309\u4e0b ESC\uff0c\u8fdb\u5165\u914d\u7f6e\u754c\u9762\uff0c\u7136\u540e\u9605\u8bfb https://github.com/tianocore/tianocore.github.io/wiki/HTTP-Boot \u505a\u8fdb\u4e00\u6b65\u914d\u7f6e\u3002</p> </li> </ol>"},{"location":"services/pxe/#grub2","title":"\u5236\u4f5c GRUB2 \u955c\u50cf","text":"<p>\u65e7\u7248\u672c\u7684 GRUB2 \u53ef\u80fd\u6709 bug\uff08\u4f8b\u5982 https://github.com/ustclug/discussions/issues/456\uff09\uff0c\u56e0\u6b64\u6709\u65f6\u5019\u9700\u8981\u5347\u7ea7\u3002</p> <p>\u66f4\u65b0\u7b56\u7565\u8003\u8651\u4f7f\u7528 Debian stable \u7684 grub2\u3002\u542f\u52a8\u5bb9\u5668\u5e76\u4e14\u5c06\u5916\u9762\u7684\u76ee\u5f55 bind mount\uff1a</p> <pre><code>docker run -it --rm -v $(pwd)/tftp:/srv/tftp ustclug/debian:12\n</code></pre> <p>\u7136\u540e\u5728\u5bb9\u5668\u4e2d\u6267\u884c\uff1a</p> <pre><code>apt update &amp;&amp; apt install grub-common grub-pc grub-efi-amd64-signed\ngrub-mknetdir\ngrub-mkimage -d /usr/lib/grub/i386-pc -O i386-pc-pxe -o /srv/tftp/boot/grub/i386-pc/core.0 -p '(http,202.38.93.94)/boot/tftp/grub/' pxe http\ngrub-mkimage -d /usr/lib/grub/x86_64-efi -O x86_64-efi -o /srv/tftp/boot/grub/x86_64-efi/core.efi -p '(http,202.38.93.94)/boot/tftp/grub/' efinet http\n</code></pre> <p>\u6700\u540e\u4e24\u4e2a <code>grub-mkimage</code> \u662f\u56e0\u4e3a <code>grub-mknetdir</code> \u751f\u6210\u7684\u955c\u50cf\u4f7f\u7528 tftp \u534f\u8bae\uff0c\u5728\u8c03\u8bd5\u65f6\u53ef\u80fd\u4f1a\u6709\u95ee\u9898\u3002\u6211\u4eec\u5e0c\u671b GRUB2 \u80fd\u591f\u5168\u7a0b\u4f7f\u7528 HTTP \u505a\u5269\u4e0b\u7684\u5de5\u4f5c\u3002</p> <p>\u66f4\u6362\u6587\u4ef6\u7684\u65f6\u5019\u522b\u628a\u914d\u7f6e\u8986\u76d6\u4e86\u3002</p>"},{"location":"services/pxe/#ipxe-iso","title":"\u6784\u5efa iPXE ISO","text":"<p>\u53c2\u8003 https://ipxe.org/embed\u3002</p> <pre><code>#!ipxe\n\n# Generated by GPT-4\ndhcp\nset 210:string http://202.38.93.94/boot/tftp/\n\n# UEFI boot?\niseq ${platform} efi &amp;&amp; goto uefi || goto bios\n\n:uefi\necho \"UEFI boot detected\"\nchain ${210:string}bootx64.efi\nexit\n\n:bios\necho \"BIOS boot detected\"\nchain ${210:string}pxelinux.0\nexit\n</code></pre> <p>clone ipxe/ipxe \u4ed3\u5e93\uff0c\u8fdb\u5165 src \u76ee\u5f55\uff0c\u7136\u540e\u6267\u884c\uff1a</p> <pre><code># https://github.com/ipxe/ipxe/pull/50\nmake bin-x86_64-efi/ipxe.efi bin/ipxe.lkrn\n./util/genfsimg -o ustc.ipxe.iso -s ../../ustc.ipxe bin-x86_64-efi/ipxe.efi bin/ipxe.lkrn\n</code></pre>"},{"location":"services/pxe/#_2","title":"\u67b6\u6784","text":"<p>\u65b0 PXE \u65b9\u6848\u7684 HTTP \u670d\u52a1\u5668\u4e3a Apache + Nginx\u3002URL \u4e2d\u7684 boot2 \u5bf9\u5e94 /nfsroot/pxe\u3002</p> <p>\u5904\u7406 web \u670d\u52a1\u5668</p> <p>\u76ee\u524d PXE \u673a\u5668\u7684 web \u670d\u52a1\u5668\u6709\u70b9\u8be1\u5f02\uff0cApache2 \u76d1\u542c 80\uff0cNginx \u76d1\u542c 443\uff0c\u540e\u7eed\u9700\u8981\u8c03\u6574\u5904\u7406\u3002</p> <p>\u6587\u4ef6\u8df3\u8f6c\u914d\u7f6e</p> <p>Apache2 \u4e2d\u914d\u7f6e\u4e86\u4e00\u4e9b alias \u8df3\u8f6c\uff0c\u540c\u6837\u7684\uff0cTFTP \u4e5f\u6709\u7c7b\u4f3c\u7684\u914d\u7f6e\uff08<code>/etc/xinetd.d/tftp</code> \u7684 <code>server_args</code> \u91cc\u9762\u6709 <code>-m /home/pxe/tftp/REMAP</code>\uff09\u3002</p> <p>\u9700\u8981\u68c0\u67e5\u4e00\u81f4\u6027\u3002</p> <p>\u5982\u679c\u51fa\u73b0\u95ee\u9898\u9700\u8981\u8c03\u8bd5\uff0c\u5efa\u8bae\u6293\u5305\uff08\u53ef\u4ee5\u4f7f\u7528 Wireshark \u67e5\u770b TFTP \u6216 HTTP \u534f\u8bae\uff09\u770b\u662f\u5426\u6b63\u5e38\u3002</p> <p>\u6bcf\u5929\u51cc\u6668\uff0cpxe \u7528\u6237\u7684 crontab \u4efb\u52a1\u4f1a\u6267\u884c https://github.com/ustclug/simple-pxe/blob/master/simple-pxe-in-docker\uff08\u6587\u4ef6\u4f4d\u4e8e pxe \u7528\u6237\u7684 home \u4e2d\uff09\uff0c\u5b9e\u73b0 PXE \u76f8\u5173\u6587\u4ef6\u7684\u66f4\u65b0\u3002</p>"},{"location":"services/pxe/#faults","title":"\u6545\u969c","text":"<p>pxe \u670d\u52a1\u5668\u5728\u5347\u7ea7\u5230 Debian Bullseye (11) \u540e\u65e0\u6cd5\u6b63\u5e38\u5f00\u673a\uff0c\u7ecf\u8fc7 GRUB \u8fdb\u5165\u5185\u6838\u540e\u6bcf 5 \u79d2\u5237\u51fa\u4ee5\u4e0b\u4fe1\u606f\uff1a</p> <pre><code>DMAR: DRHD: handling fault status reg 2\nDMAR: [DMA Read] Request device [03:00.0] PASID ffffffff fault addr cb2f0000 [fault reason 06] PTE Read access is not set\nDMAR: DRHD: handling fault status reg 102\n</code></pre> <p>\u7531\u4e8e\u6b64\u65f6\u521a\u5347\u7ea7\u81f3 Debian Bullseye\uff0c\u6240\u4ee5\u7cfb\u7edf\u4ecd\u7136\u4fdd\u7559\u4e86 Debian Buster \u7684 4.19 \u7248\u5185\u6838\u3002\u91cd\u542f\u8fdb\u8be5\u5185\u6838\u53ef\u6b63\u5e38\u542f\u52a8\u5e76\u8fd0\u884c\u670d\u52a1\uff0c\u4f46\u53ea\u8981\u8fdb 5.10 \u7684\u5185\u6838\u5c31\u4f1a\u51fa\u73b0\u4ee5\u4e0a\u9519\u8bef\u3002\u6d4b\u8bd5 Proxmox VE \u63d0\u4f9b\u7684 pve-kernel-5.15 \u4e5f\u662f\u540c\u6837\u95ee\u9898\u3002</p> <p>\u641c\u7d22\u53d1\u73b0\u4e3b\u673a\u4f7f\u7528\u7684 RAID \u5361 PERC H310 \u4e0d\u652f\u6301\u76f4\u901a\uff08IOMMU \u865a\u62df\u5316\uff09\uff0c\u914d\u7f6e GRUB \u52a0\u5165 <code>intel_iommu=off</code> \u540e\u53ef\u4ee5\u6b63\u5e38\u8fdb\u5165 5.10 \u7684\u5185\u6838\uff0c\u4f5c\u4e3a\u89e3\u51b3\u65b9\u6848\u3002</p> \u8c03\u67e5\u7ed3\u679c <p>\u6309\u8bf4 IOMMU\uff08VT-d\uff09\u4e0d\u5e94\u8be5\u9ed8\u8ba4\u542f\u7528\uff0c\u56e0\u6b64\u731c\u6d4b 5.10+ \u7684\u5185\u6838\u4f1a\u4e3b\u52a8\u5c1d\u8bd5\u5f00\u542f IOMMU\uff0c\u5bfc\u81f4 RAID \u5361\u51fa\u9519\u3002</p> <p>\u6bd4\u8f83 <code>/boot/config-4.19.0-18-amd64</code> \u548c <code>/boot/config-5.10.0-11-amd64</code> \u540e\u53d1\u73b0 5.10 \u7248\u7684 config \u591a\u4e86\u4e00\u884c <code>CONFIG_INTEL_IOMMU_DEFAULT_ON_INTGPU_OFF=y</code>\uff0c\u641c\u7d22\u53d1\u73b0 Debian bug #932086\uff0c\u5373 Debian \u9ed8\u8ba4\u5bf9\u9664\u4e86 Intel GPU \u4ee5\u5916\u7684\u8bbe\u5907\u542f\u7528 IOMMU\uff08<code>linux 5.2.9-2</code>\uff09\u3002</p> <p>\u53c2\u8003\u94fe\u63a5\uff1a</p> <ul> <li>DELLR730 server halts during boot-up when \"intel_iommu=on\" parameter is enabled in grub for SRIOV functionality. - Dell Community</li> <li> Dell PowerEdge RAID Controller (PERC) H310, H710, H710P, and H810 - User's Guide\uff08\u7b2c 85 \u9875\uff09</li> </ul>"},{"location":"services/pxe/images/","title":"PXE \u955c\u50cf","text":""},{"location":"services/pxe/images/#uefi-shell","title":"UEFI Shell","text":"<p>https://github.com/ustclug/simple-pxe/blob/master/menu.d/tool.sh</p> <p>\u4f9d\u8d56\u4e8e Arch Linux \u63d0\u4f9b\u7684 EFI \u6587\u4ef6\u3002</p>"},{"location":"services/pxe/images/#memtest86","title":"Memtest86+","text":"<p>https://github.com/memtest86plus/memtest86plus</p> <p>\u6b64\u5916 memtest86 \u6709\u4e2a\u95ed\u6e90\u5b9e\u73b0\uff0c\u4e0d\u8003\u8651\u7ee7\u7eed\u7ef4\u62a4\u3002</p> <p>\u4ee5\u4e0b\u6b65\u9aa4\u53c2\u8003\u4e86 https://gitlab.archlinux.org/archlinux/packaging/packages/memtest86plus/-/blob/main/PKGBUILD?ref_type=heads\u3002</p> <pre><code>git clone https://github.com/memtest86plus/memtest86plus.git\ncd memtest86plus/build64\nmake\n</code></pre> <p>\u5f97\u5230\u7684 <code>memtest.bin</code> \u662f BIOS \u7248\u7684\uff0c<code>memtest.efi</code> \u662f UEFI \u7248\u7684\u3002</p> <p>\u542f\u52a8\u83dc\u5355\uff1ahttps://github.com/ustclug/simple-pxe/blob/master/menu.d/tool.sh\u3002</p>"},{"location":"services/pxe/images/#gparted","title":"GParted","text":"<p>https://github.com/ustclug/simple-pxe/blob/master/menu.d/gparted.sh\u3002</p> <p>\u542f\u52a8\u53c2\u6570\u4e0d\u80fd\u52a0 <code>ip=</code>\uff1ahttps://gitlab.gnome.org/GNOME/gparted/-/issues/141\u3002</p>"},{"location":"services/pxe/liims/","title":"LIIMS","text":"<p>Short for Libray Independent Inquery Machine System.</p> <p>Server: pxe.s.ustclug.org</p> <p>Git Repository:</p> <ul> <li>liimstrap</li> </ul> <p>It is strongly advised to clone liimstrap and read through it when reading this document.</p>"},{"location":"services/pxe/liims/#add-machine","title":"\u542f\u52a8\u914d\u7f6e","text":"<p>\u914d\u7f6e\u6587\u4ef6\u5728 <code>/home/pxe/tftp/grub/grub.cfg.d</code>\uff0c\u82e5\u8981\u5141\u8bb8\u65b0\u673a\u5668\u542f\u52a8 liims \u955c\u50cf\uff0c\u521b\u5efa\u4e00\u4e2a\u7b26\u53f7\u94fe\u63a5\u5230\u5bf9\u5e94\u7684\u914d\u7f6e\u6587\u4ef6\u3002\u4f8b\u5982\uff1a</p> <pre><code>ln -s common_el 02:23:45:67:89:ab\n</code></pre> <p>\u76ee\u524d\u6211\u4eec\u901a\u8fc7\u51e0\u4e2a\u7b26\u53f7\u94fe\u63a5\u5c06\u914d\u7f6e\u6587\u4ef6\u201c\u5206\u7ec4\u201d\uff0cMAC \u5730\u5740\u5bf9\u5e94\u7684\u7b26\u53f7\u94fe\u63a5\u5e94\u8be5\u94fe\u63a5\u5230\u8fd9\u4e9b\u5206\u7ec4\u4e0a\u3002\u5df2\u6709\u7684\u5206\u7ec4\u5982\u4e0b\uff1a</p> <ul> <li><code>common_el</code>\uff1aEL \u5373 East-campus Library\uff08\u4e1c\u56fe\uff09</li> <li><code>common_wl</code>\uff1aWL \u5373 West-campus Library\uff08\u897f\u56fe\uff09</li> <li><code>common_sl</code>\uff1aSL \u5373 South-campus Library\uff08\u5357\u56fe\uff09</li> <li><code>common_iat</code>\uff1aIAT \u5373\u5148\u7814\u9662</li> <li><code>common_gx</code>\uff1aGaoXin \u9ad8\u65b0\u6821\u533a</li> <li><code>test</code>\uff1a\u6d4b\u8bd5\u955c\u50cf</li> </ul> <p>\u9664\u6b64\u4e4b\u5916\uff0c\u8fd8\u9700\u8981\u5728\u67e5\u8be2\u673a\u76d1\u63a7\u7a0b\u5e8f\u4e2d\u6dfb\u52a0\u8be5 MAC \u5730\u5740\uff0c\u89c1\u4e0b\u65b9\u67e5\u8be2\u673a\u76d1\u63a7\u3002</p>"},{"location":"services/pxe/liims/#lib-api","title":"\u4e3a\u56fe\u4e66\u9986\u8001\u5e08\u5f00\u653e\u7684\u63a5\u53e3","text":"<p>\u56fe\u4e66\u9986\u8001\u5e08\u53ef\u4ee5\u901a\u8fc7 SSH \u767b\u5f55\u673a\u5668\u76f4\u63a5\u521b\u5efa\u6240\u9700\u7684\u7b26\u53f7\u94fe\u63a5\uff08\u4f46\u662f\u8fd8\u9700\u8981\u6211\u4eec\u6765\u6539\u76d1\u63a7\u7a0b\u5e8f\u7684 json\uff09\u3002\u76f8\u5173\u914d\u7f6e\u5982\u4e0b\uff1a</p> /etc/sudoers.d/sonnie<pre><code>sonnie ALL=(pxe) NOPASSWD: /home/pxe/tftp/grub/grub.cfg.d/add_host.py *\n</code></pre> /etc/ssh/sshd_config<pre><code>Match User sonnie\n    AllowUsers sonnie\n    PubkeyAuthentication yes\n    AuthorizedKeysFile .ssh/authorized_keys\n</code></pre> <p>/etc/nsswitch.conf</p> <p>\u628a sudoers \u4e00\u884c\u4e2d\u7684 ldap \u79fb\u5230 files \u524d\u9762\u3002</p> <p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b ldap \u5728 files \u540e\u9762\uff0c\u90a3\u4e48\u6765\u81ea LDAP \u7684 sudo rules \u4f1a\u6392\u5728 sudoers \u6587\u4ef6\u4e2d\u7684 rules \u7684\u540e\u9762\uff0c\u800c sudo \u662f\u540e\u9762\u7684\u89c4\u5219\u4f18\u5148\u7ea7\u66f4\u9ad8\uff0c\u4f1a\u5bfc\u81f4\u65e0\u6cd5 NOPASSWD \u8fd0\u884c\u811a\u672c\u3002</p>"},{"location":"services/pxe/liims/#_1","title":"\u542f\u52a8\u955c\u50cf","text":"<p>\u4f4d\u4e8e <code>/home/pxe/nfsroot/&lt;category&gt;/&lt;name&gt;</code>\uff0c\u5176\u4e2d <code>&lt;name&gt;</code> \u5c31\u662f\u955c\u50cf\u540d\u79f0\uff08\u4f8b\u5982 <code>liims160909</code>\uff09\u3002\u76ee\u524d\u6709\u4e24\u79cd\u90e8\u7f72\u65b9\u5f0f\uff1a\u4e00\u79cd\u662f NFS as rootfs\uff0c\u6587\u4ef6\u5939\u4e2d\u5c31\u662f\u6574\u4e2a rootfs\uff0c\u76f4\u63a5\u4fee\u6539\u8fd9\u91cc\u7684\u6587\u4ef6\uff0c\u673a\u5668\u91cd\u542f\u540e\u5c31\u4f1a\u8f7d\u5165\u3002\uff08\u6ce8\u610f\uff1a\u8986\u76d6\u6587\u4ef6\u53ef\u80fd\u5bfc\u81f4\u5df2\u6709\u7684\u673a\u5668\u8fd0\u884c\u9519\u8bef\uff09</p> <p>\u53e6\u4e00\u79cd\u662f\u6253\u5305\u538b\u7f29\u4e3a squashfs\uff0c\u6b64\u65f6\u6587\u4ef6\u5939\u4e0b\u4e09\u4e2a\u6587\u4ef6\u5206\u522b\u4e3a vmlinuz\uff08kernel\uff09, initrd.img \u548c root.sfs\uff08squashfs \u955c\u50cf\uff09\u3002\u5982\u679c\u9700\u8981\u4fee\u6539\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>unsquashfs</code> \u89e3\u538b\u7f29\uff0c\u4fee\u6539\u5b8c\u6210\u540e\u53c2\u8003\u4ed3\u5e93\u4e2d deploy \u6587\u4ef6\u518d\u538b\u7f29\u4e3a squashfs\u3002</p> <p>IP \u767d\u540d\u5355\u91c7\u7528 iptables \u5b9e\u73b0\uff0c\u4fee\u6539 rootfs \u4e0b\u7684 <code>etc/iptables/rules.v4</code> \u548c <code>rules.v6</code> \u53ef\u4fee\u6539\u7b56\u7565\u3002\u6ce8\u610f\uff1a\u9632\u706b\u5899\u7b56\u7565\u4ec5\u5728\u673a\u5668\u542f\u52a8\u65f6\u4f1a\u8f7d\u5165\u4e00\u6b21\u3002</p>"},{"location":"services/pxe/liims/#_2","title":"\u955c\u50cf\u6784\u5efa","text":"<p>\u5907\u6ce8</p> <p>\u6b64\u8282\u7684\u5185\u5bb9\u4ec5\u9002\u7528\u4e8e 2022 \u4e4b\u524d\u7684\u8001\u7248\u672c\uff0c\u65b0\u7248\u672c\u6709\u5173\u6784\u5efa\u3001\u8c03\u8bd5\u7b49\u5185\u5bb9\u8bf7\u76f4\u63a5\u9605\u8bfb liimstrap \u4ed3\u5e93 README\u3002</p> <p>\u4f7f\u7528 liimstrap \u5728 ArchLinux \u4e0b\u8fdb\u884c\u6784\u5efa\uff0cliimstrap \u4f7f\u7528\u65b9\u6cd5\u53c2\u8003\u4ed3\u5e93\u4e2d\u7684\u8bf4\u660e\u3002</p> <p>\u6784\u5efa\u540e\u9700\u8981\u63a8\u9001\u5230\u670d\u52a1\u5668\u4e0a\u7684 <code>/nfsroot/liims</code> \u4e0b\uff0c\u5e76\u8bbe\u7f6e /usr \u7684\u6240\u6709\u8005\u4e3a liims\u3002\u673a\u5668\u7684\u9ed8\u8ba4 pxe \u542f\u52a8\u914d\u7f6e\u5728 <code>/home/pxe/tftp/pxelinux.cfg/</code> \u4e0b</p>"},{"location":"services/pxe/liims/#qemu","title":"\u793a\u4f8b qemu \u8c03\u8bd5\u65b9\u6cd5","text":"<p>\u521b\u5efa\u5e76\u6302\u8f7d\u4e34\u65f6\u955c\u50cf:</p> <pre><code>dd if=/dev/zero of=liims.img bs=4k count=1200000\nmkfs.ext4 liims.img\nmount -o loop liims.img /mnt\n</code></pre> <p>\u5047\u8bbe\u5f53\u524d\u8def\u5f84\u4e3a liimstrap\uff0c\u4fee\u6539 <code>initcpio/mkinitcpio.conf</code>\uff0c\u53bb\u6389 HOOKS \u4e2d\u7684 <code>liims_root</code>\uff0c\u589e\u52a0 <code>block</code>\uff08\u4ec5\u8c03\u8bd5\u65f6\u9700\u8981\uff09\u3002 \u4f7f\u7528 liimstrap \u5236\u4f5c\u955c\u50cf <code>./liimstrap /mnt</code>\u3002\u5b8c\u6210\u540e\u4f7f\u7528 qemu \u6253\u5f00\u8c03\u8bd5:</p> <pre><code>qemu -kernel /mnt/boot/vmlinuz-lts\\\n     -initrd /mnt/boot/initramfs-linux-lts.img\\\n     -hda liims.img\\\n     -netdev user,id=mynet0,net=114.214.188.0/24,dhcpstart=114.214.188.9\\\n     -device i82557a,netdev=mynet0\\\n     -append \"root=/dev/sda rootflags=rw\"\n</code></pre> <p>\u6ce8\uff1a\u5176\u4e2d netdev \u4e2d\u7684 ip \u6bb5\u53ef\u4ee5\u81ea\u7531\u9009\u53d6\uff0c<code>device</code> \u4e2d\u7684\u8bbe\u5907\u540d\u901a\u8fc7 <code>qemu -device \\?</code> \u67e5\u770b\u540e\u9009\u62e9\u4efb\u4e00\u7f51\u7edc\u8bbe\u5907\u5373\u53ef</p>"},{"location":"services/pxe/liims/#monitor","title":"\u67e5\u8be2\u673a\u76d1\u63a7","text":"<p>http://pxe.ustc.edu.cn:3000/</p> <p>2022 \u5e74\u524d\uff0c\u63d0\u4f9b\u670d\u52a1\u7684\u662f\u4e00\u4e2a Docker \u5bb9\u5668\u3002\u5728 iBug \u7528 Go \u91cd\u5199\u4e4b\u540e\uff0c\u76ee\u524d\u76f4\u63a5\u8dd1\u5728 host \u4e0a\u3002</p> <p>\u6dfb\u52a0\u65b0\u673a\u5668</p> <p>\u4fee\u6539 https://github.com/ustclug/liimstrap/blob/master/monitor/clients.json \u540e\uff0c\u5728 pxe \u4e0a clone \u5e76\u5728\u5f53\u524d\u76ee\u5f55 build\u3002\u4f7f\u7528 docker-run-script \u4e2d\u5bf9\u5e94\u811a\u672c\u6267\u884c\u5bb9\u5668\u5373\u53ef\u3002</p> <p>\u4fee\u6539 <code>/etc/liims-monitor/clients.json</code> \u4e4b\u540e <code>systemctl reload liims-monitor.service</code> \u5373\u53ef\u3002</p> /etc/liims-monitor/clients.json<pre><code>{\n    \"name\": \"\u4e1c\u533a\u4e09\u697c\u4e1c01\",\n    \"mac\": \"0223456789ab\"\n}\n</code></pre>"},{"location":"workflow/new-server/","title":"New Server Setup Checklist","text":""},{"location":"workflow/new-server/#ntp-date","title":"NTP Date","text":"<p>Install either <code>chrony</code> or <code>systemd-timesyncd</code>. Usually chrony comes pre-installed so it's easily forgot.</p> <p>Replace the default NTP pool with USTC's NTP server <code>time.ustc.edu.cn</code>, like this:</p> /etc/chrony/chrony.conf<pre><code># Use Debian vendor zone.\n#pool 2.debian.pool.ntp.org iburst\nserver time.ustc.edu.cn iburst\n</code></pre>"},{"location":"workflow/new-server/#time-zone","title":"Time zone","text":"<p>Run <code>dpkg-reconfigure tzdata</code> and select Asia/Shanghai as the timezone. Reboot the server.</p>"},{"location":"workflow/new-server/#use-nft-backend-for-iptables","title":"Use nft-backend for iptables","text":"<pre><code>update-alternatives --set iptables /usr/sbin/iptables-nft\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-nft\n</code></pre>"},{"location":"workflow/new-server/#update-resolvconf","title":"Update resolv.conf","text":""},{"location":"workflow/new-server/#install-console-setup","title":"Install console-setup","text":"<p>This may have already come with the base system. It's more likely missed if the system is installed from scratch (bootstrapped).</p>"},{"location":"workflow/new-vm/","title":"Create new server in LUGi","text":"<p>We no longer have a vSphere cluster, so anything mentioning vSphere is left only for references.</p>"},{"location":"workflow/new-vm/#create-vm-in-vcenter","title":"Create VM in vCenter","text":"<p>vCenter \u5730\u5740\uff1a<code>vcenter2.vm.ustclug.org</code></p> <p>\u6309\u7167\u63d0\u793a\u521b\u5efa\u865a\u62df\u673a</p> <ul> <li>Step 7: Customize hardware<ul> <li>Network:<ul> <li>ustclug: intranet</li> <li>ustclug-bridge: \u6ca1\u6709 MAC \u6e90\u5730\u5740\u68c0\u67e5</li> <li>cernet: \u6559\u80b2\u7f51\uff08\u5148\u9009\u8fd9\u4e2a\uff0c\u4ee5\u4fbf\u4e8e\u901a\u8fc7\u7f51\u7edc\u5b89\u88c5\u7cfb\u7edf\uff09</li> </ul> </li> <li>VM options<ul> <li>VMware Tools<ul> <li>\u6253\u5f00 Sync time with Host</li> </ul> </li> </ul> </li> </ul> </li> </ul>"},{"location":"workflow/new-vm/#install-os-vsphere","title":"Install OS (vSphere)","text":"<p>Note</p> <p>\u5c06\u7f51\u7edc\u6539\u4e3a cernet\uff0c\u4ee5\u4fbf\u7528 DHCP \u83b7\u5f97 IP \u5730\u5740\uff0c\u7528 PXE \u5b89\u88c5\u7cfb\u7edf\u3002</p> <p>\u51e0\u4e2a\u5173\u952e\u914d\u7f6e\uff1a</p> <ul> <li>hostname: \u4e3b\u673a\u540d\uff0c\u5982 vpnhc</li> <li>domain name: \u641c\u7d22\u57df\uff0c\u4e00\u822c\u8bbe\u4e3a s.ustclug.org</li> <li>\u7528\u6237\u8bbe\u7f6e\uff1a\u5148\u8bbe\u7f6e\u4e00\u4e2a\u4e34\u65f6\u7528\u6237\uff08\u5c3d\u91cf\u4e0d\u4e0e\u4e4b\u540e\u8981\u914d\u7f6e\u7684 ldap \u8d26\u53f7\u51b2\u7a81\uff09\uff0c\u7528\u4e8e\u521d\u59cb\u767b\u9646\u914d\u7f6e\uff0c\u4e4b\u540e\u5220\u9664</li> <li>\u78c1\u76d8\u8bbe\u7f6e\uff1a\u4f7f\u7528\u6574\u4e2a\u786c\u76d8\uff0c\u53ea\u7559\u4e00\u4e2a\u4e3b\u5206\u533a\uff0c\u4e0d\u7559 swap \u7b49\u5206\u533a\uff0c\u65b9\u4fbf\u6269\u5bb9</li> </ul>"},{"location":"workflow/new-vm/#create-vm-on-proxmox-ve","title":"Create VM on Proxmox VE","text":"<p>\u6211\u4eec\u76ee\u524d\u4e0d\u4f7f\u7528 PVE \u8fd0\u884c LXC \u5bb9\u5668\uff0c\u56e0\u6b64\u672c\u6587\u6863\u53ea\u4ecb\u7ecd\u521b\u5efa KVM \u865a\u62df\u673a\u7684\u6b65\u9aa4\u3002\u63a8\u8350\u4f7f\u7528 web \u754c\u9762\u64cd\u4f5c\uff0c\u9664\u975e\u4f60\u9700\u8981\u6279\u91cf\u521b\u5efa\u865a\u62df\u673a\uff08\u6b64\u65f6\u901a\u8fc7 SSH \u767b\u5f55\u540e\u53ef\u4ee5\u4f7f\u7528 <code>qm</code> \u547d\u4ee4\u6279\u5904\u7406\uff09\u3002</p> <p>\u767b\u5f55 web \u754c\u9762\uff0c\u70b9\u51fb\u53f3\u4e0a\u89d2\u7684 Create VM\uff0c\u5f39\u51fa\u521b\u5efa\u865a\u62df\u673a\u7684\u5bf9\u8bdd\u6846\u3002</p> General <p>\u6b63\u786e\u9009\u62e9\u865a\u62df\u673a\u6240\u5728\u7684 Node\uff08\u5373 Host\uff09\uff0c\u5e76\u6307\u5b9a\u4e00\u4e2a VMID\u3002\u76ee\u524d VMID \u7684\u5206\u914d\u65b9\u6848\u662f\u4e1c\u56fe 300-399\uff0cNIC 200-299\uff0c\u5728\u6b64\u57fa\u7840\u4e0a\u9012\u589e\u5373\u53ef\u3002\u7ed9 VM \u8d77\u4e2a\u6613\u4e8e\u8fa8\u8bc6\u7684\u540d\u79f0\uff0c\u4e0d\u8981\u4e0e\u5df2\u6709 VM \u91cd\u590d\u3002Resource Pool \u7559\u7a7a\u5373\u53ef\u3002</p> OS <p>\u9664\u975e\u4f60\u8981\u4f7f\u7528 iso \u955c\u50cf\u624b\u52a8\u5b89\u88c5\u7cfb\u7edf\uff0c\u5426\u5219\u8bf7\u9009\u62e9\u300cDo not use any media\u300d\u3002\u6b63\u786e\u9009\u62e9 Guest OS \u7684\u7c7b\u578b\u548c\u7248\u672c\u3002</p> System <p>\u5c06 SCSI Controller \u8bbe\u4e3a VirtIO SCSI\uff08\u6ce8\u610f\u4e0d\u8981\u9009 VirtIO SCSI Single\uff09\uff0c\u52fe\u4e0a Qemu Agent \u9009\u9879\uff0c\u5176\u4ed6\u9009\u9879\u90fd\u9009 Default \u5373\u53ef\u3002</p> Disks, CPU, Memory <p>\u6309\u9700\u5206\u914d\uff0c\u78c1\u76d8\u5bb9\u91cf\u5efa\u8bae\u63a7\u5236\u5728 10 GB \u4ee5\u5185\uff08\u4ec5\u7cfb\u7edf\u76d8\uff0c\u53ef\u53e6\u52a0\u6570\u636e\u76d8\uff09\uff0c\u5176\u4e2d Disk \u52fe\u9009\u4e0a Discard\uff0cCPU Type \u63a8\u8350\u9009\u62e9 Host\u3002</p> Network <p>\u6309\u9700\u9009\u62e9\uff0cModel \u9009 VirtIO\uff0c\u7136\u540e\u53d6\u6d88\u52fe\u9009 Firewall\u3002</p> <p>\u8bb0\u5f97\u5728\u865a\u62df\u673a\u7684 Options \u91cc\u5c06 Start at boot \u8bbe\u4e3a Yes</p> <p>\u5728 Proxmox VE \u4e0a\uff0c\u901a\u8fc7 web \u754c\u9762\u521b\u5efa\u65b0\u865a\u62df\u673a\u540e\uff0c\u53ef\u4ee5\u4f7f\u7528\u666e\u901a\u65b9\u5f0f\u5b89\u88c5\u7cfb\u7edf\uff0c\u4e5f\u53ef\u4ee5\u76f4\u63a5\u5bfc\u5165\u53d1\u884c\u7248\u63d0\u4f9b\u7684\u865a\u62df\u673a\u955c\u50cf\uff08\u9700\u8981\u901a\u8fc7 SSH \u767b\u5f55 Proxmox VE \u6216 NFS \u670d\u52a1\u5668\uff09\u3002</p> <p>\u4e0b\u9762\u4ee5 Debian \u4e3a\u4f8b\uff0c\u521b\u5efa\u4e00\u4e2a\u65b0\u865a\u62df\u673a\uff0c\u7136\u540e\u6253\u5f00 https://mirrors.ustc.edu.cn/debian-cdimage/cloud/bullseye/\uff0c\u70b9\u51fb\u6700\u65b0\u7684\u76ee\u5f55\uff08\u51fa\u4e8e\u672a\u77e5\u539f\u56e0 latest \u94fe\u63a5\u662f\u574f\u7684\uff09\uff0c\u590d\u5236 <code>debian-11-genericcloud-amd64-&lt;date&gt;-&lt;rev&gt;</code> \u7684\u94fe\u63a5\uff08\u63a8\u8350\u4f7f\u7528 genericcloud \u800c\u4e0d\u662f generic\uff0c\u5176\u9884\u88c5 <code>linux-image-cloud-amd64</code>\uff0c\u76f8\u6bd4\u4e8e\u201c\u5b8c\u6574\u7248\u201d\u5185\u6838\u7cbe\u7b80\u6389\u4e86\u5927\u90e8\u5206\u7269\u7406\u8bbe\u5907\u7684\u9a71\u52a8\u7a0b\u5e8f\uff0c\u9002\u7528\u4e8e\u865a\u62df\u673a\u73af\u5883\uff09\uff0c\u7136\u540e\u767b\u5f55 Proxmox VE \u6216 vdp\uff08NFS \u670d\u52a1\u5668\uff09\uff0c\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u76f4\u63a5\u4e0b\u8f7d\u955c\u50cf\u81f3\u865a\u62df\u673a\u78c1\u76d8\uff1a</p> <pre><code># Proxmox VE (ZFS / LVM), use RAW\nwget -O /dev/zvol/rpool/data/vm-&lt;id&gt;-disk-0 https://mirrors.ustc.edu.cn/&lt;...&gt;.raw\nwget -O /dev/&lt;vg&gt;/&lt;lv&gt; https://mirrors.ustc.edu.cn/&lt;...&gt;.raw\n\n# vdp over NFS, use QCOW2\nwget -O /media/vdp/pve/images/&lt;path&gt;.qcow2 https://mirrors.ustc.edu.cn/&lt;...&gt;.qcow2\n</code></pre> <p>\u7136\u540e\u5728 web \u754c\u9762\u6307\u5b9a\u865a\u62df\u673a\u7684\u78c1\u76d8\uff08\u5982\u6709\u9700\u8981\uff09\u3002</p>"},{"location":"workflow/new-vm/#reset-password","title":"Reset password","text":"<p>\u7531\u4e8e Debian \u63d0\u4f9b\u7684 cloud image \u9ed8\u8ba4\u7981\u7528\u4e86 root \u7528\u6237\uff0c\u9700\u8981\u624b\u52a8\u6302\u8f7d\u78c1\u76d8\uff0c\u7f16\u8f91\u78c1\u76d8\u4e2d\u7684 <code>/etc/shadow</code> \u6587\u4ef6\uff0c\u5c06\u7b2c\u4e00\u884c\u7684 <code>root:*:...</code> \u6539\u4e3a <code>root::...</code>\uff08\u5373\u5220\u6389\u661f\u53f7\uff09\u3002\u6ce8\u610f\u4e0d\u8981\u8bef\u6539\u4e3b\u673a\u7684 shadow \u6587\u4ef6\u3002</p> <p>Tip</p> <p>\u6b64\u6b65\u9aa4\u4e5f\u53ef\u4ee5\u66ff\u6362\u4e3a chroot \u8fdb\u53bb\u540e\u4f7f\u7528 <code>passwd</code> \u4fee\u6539\u6216\u6e05\u7a7a\u5bc6\u7801\u3002\u5982\u679c\u4f60\u4e0d\u591f\u719f\u6089 shadow \u6587\u4ef6\u7684\u683c\u5f0f\uff0c\u8fd9\u6837\u505a\u66f4\u5b89\u5168\u3002</p> <p>\u5bf9\u4e8e ZFS \u548c LVM \u5b58\u50a8\u7684\u78c1\u76d8\uff0c\u53ef\u4ee5\u76f4\u63a5\u6302\u8f7d <code>/dev/zvol/&lt;...&gt;</code> \u6216 <code>/dev/&lt;vg&gt;/&lt;lv&gt;</code>\uff08\u4f60\u53ef\u80fd\u9700\u8981\u4f7f\u7528 <code>kpartx</code> \u5de5\u5177\u52a0\u8f7d\u5206\u533a\uff09\u3002\u5bf9\u4e8e Qcow2 \u6587\u4ef6\u7684\u78c1\u76d8\uff0c\u53ef\u4ee5\u53c2\u8003\u8fd9\u4e2a Gist \u4f7f\u7528 <code>qemu-nbd</code> \u5de5\u5177\u6765\u6302\u8f7d\u3002\u5176\u4e2d <code>nbd</code> \u662f Linux \u539f\u751f\u7684\u5185\u6838\u6a21\u5757\uff0c\u53ef\u4ee5\u653e\u5fc3 modprobe\u3002</p> <p>\u4f60\u4e5f\u53ef\u4ee5\u5728\u8fd9\u4e00\u6b65\u540c\u65f6\u4fee\u6539\u522b\u7684\u914d\u7f6e\u6587\u4ef6\uff0c\u4f8b\u5982\u628a <code>/etc/apt/sources.list</code> \u6362\u6389\u7b49\u3002\u4fee\u6539\u5b8c\u6210\u540e\u4e0d\u8981\u5fd8\u8bb0 umount\u3002</p>"},{"location":"workflow/new-vm/#extra-configurations-for-cloud-images","title":"Extra configurations for cloud images","text":"<p>The first two or three boots may hang or end up in kernel panic - this is completely normal. The cloud image will grow the root partition and filesystem to the virtual disk size. After it's all set, purge everything related to <code>cloud-init</code>.</p> <p>For better console experiences, install and configure <code>console-setup</code>, and add <code>vga=792</code> to <code>GRUB_CMDLINE_LINUX</code> in <code>/etc/default/grub</code>. Then run <code>update-grub</code> and reboot.</p>"},{"location":"workflow/new-vm/#configure-network","title":"Configure network","text":"<ul> <li>\u589e\u52a0 hostname.s.ustclug.org \u7684 DNS \u89e3\u6790\u3002\uff08\u6587\u4ef6 <code>db/ustclug/ustclug.intranet</code>\uff09</li> <li>\u5728 vCenter \u4e2d\u66f4\u6539\u7f51\u7edc\u4e3a ustclug \uff08\u5982\u679c\u4e0d\u9700\u8981\u6e90 MAC \u5730\u5740\u68c0\u67e5\uff0c\u9009 ustclug-bridge\uff09</li> <li>\u5728\u865a\u62df\u673a\u4e2d\u91cd\u542f\u7f51\u7edc\u63a5\u53e3\uff0c\u6539\u4e3a\u9759\u6001 IP\uff0c\u5e76\u66f4\u6539\u7f51\u5173 \uff08\u4e1c\u56fe\u865a\u62df\u673a\u8bbe\u7f6e\u4e3a 10.254.0.254\uff0cNIC \u865a\u62df\u673a\u8bbe\u7f6e\u4e3a 10.254.0.245\uff09<ul> <li><code>ifdown -a</code></li> <li>edit <code>/etc/network/interfaces</code></li> <li><code>ifup -a</code></li> </ul> </li> <li>\u66f4\u6539\u865a\u62df\u673a\u7684 DNS \u548c domain/search\uff1a<ul> <li>DNS:<ul> <li>neat-dns (10.254.0.253)</li> <li>dns backup (202.38.93.94)</li> </ul> </li> <li>domain/search:<ul> <li>s.ustclug.org</li> </ul> </li> </ul> </li> </ul>"},{"location":"workflow/new-vm/#install-software","title":"Install software","text":"<ul> <li>\u6839\u636e\u9700\u8981\u6362\u6e90\uff0c\u52a0\u5165\u5b89\u5168\u66f4\u65b0\u6e90\u7b49</li> <li>\u5b89\u88c5\u865a\u62df\u673a\u5de5\u5177<ul> <li>\u5bf9\u4e8e Proxmox VE \u7684\u865a\u62df\u673a\uff1a\u5b89\u88c5 <code>qemu-guest-agent</code></li> <li>\u5bf9\u4e8e VMware vSphere \u7684\u865a\u62df\u673a\uff1a\u5b89\u88c5 <code>open-vm-tools</code></li> </ul> </li> <li>\u5b89\u88c5 <code>ssh</code></li> </ul>"},{"location":"workflow/new-vm/#configure-ldap-and-ssh-ca","title":"Configure LDAP and SSH CA","text":"<p>\u89c1 LDAP \u670d\u52a1\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e \u548c \u4e3a\u670d\u52a1\u5668\u8bbe\u7f6e SSH CA</p>"},{"location":"workflow/ldap/add-new-user/","title":"\u5728 LDAP \u4e2d\u6dfb\u52a0\u65b0\u7528\u6237","text":""},{"location":"workflow/ldap/add-new-user/#ldap_1","title":"\u65b0\u5efa LDAP \u7528\u6237","text":"<ol> <li>\u767b\u9646\u7f51\u9875\u754c\u9762</li> <li>Users &gt; Actions &gt; Create &gt; User</li> <li>Generic: \u8f93\u5165 Last name\uff0cFirst name\uff0cLogin\uff08\u767b\u5f55\u540d\uff09</li> <li>POSIX &gt; Generic\uff1a\u8f93\u5165 Home directory\u3002\u4f7f\u7528 Force UID/GID \uff0c\u5177\u4f53\u8bf4\u660e\u8be6\u89c1 LDAP Users \u548c Groups</li> </ol>"},{"location":"workflow/ldap/add-new-user/#ldap_2","title":"\u6dfb\u52a0 LDAP \u7528\u6237\u6743\u9650","text":"<p>POSIX &gt; Group membership &gt; Add\uff1a\u6839\u636e\u9700\u8981\u6dfb\u52a0\u7684\u6743\u9650\u9009\u62e9\u5bf9\u5e94\u7684\u7ec4\uff0c\u5177\u4f53\u8bf4\u660e\u8be6\u89c1 LDAP Users \u548c Groups</p> LDAP \u7f13\u5b58 <p>\u82e5\u53d1\u73b0\u7528\u6237\u65e0\u6cd5\u767b\u9646\u7b49\u60c5\u51b5\uff0c\u53ef\u80fd\u662f\u7f13\u5b58\u670d\u52a1 NSCD \u5bfc\u81f4\u7684\uff0c\u5177\u4f53\u53c2\u8003 LDAP Users \u548c Groups\uff1a</p>"},{"location":"workflow/mirrors/maintenance/","title":"\u5f00\u6e90\u8f6f\u4ef6\u955c\u50cf\u7ad9\u7ef4\u62a4\u65b9\u5f0f","text":"<p>\u79d1\u5927\u5f00\u6e90\u8f6f\u4ef6\u955c\u50cf\u7ad9\u662f LUG \u6700\u91cd\u8981\u7684\u670d\u52a1\u4e4b\u4e00\uff0c\u56e0\u6b64\u7ef4\u62a4\u64cd\u4f5c\u5fc5\u987b\u8c28\u614e\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_2","title":"\u91cd\u542f\u7cfb\u7edf","text":"<p>\u7531\u4e8e mirrors \u670d\u52a1\u91cf\u5927\uff0c\u91cd\u542f\u5e94\u63d0\u524d\u5728 LUG \u670d\u52a1\u5668\u65b0\u95fb\u7ad9 \u53d1\u5e03\u516c\u544a\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_3","title":"\u5b89\u88c5\u66f4\u65b0","text":""},{"location":"workflow/mirrors/maintenance/#_4","title":"\u666e\u901a\u66f4\u65b0","text":"<p>\u591a\u6570\u66f4\u65b0\u53ef\u4ee5\u76f4\u63a5\u4ece apt \u6e90\u5b89\u88c5\uff0c\u4f46\u662f\u90e8\u5206\u8f6f\u4ef6\u5e76\u975e\u6765\u81ea Debian \u5b98\u65b9\u4ed3\u5e93\uff08\u4f8b\u5982 OpenResty\uff09\uff0c\u56e0\u6b64\u66f4\u65b0\u7b56\u7565\u53ef\u80fd\u4e0d\u50cf Debian \u90a3\u4e48\u7a33\u5b9a\u3002\u5982\u679c\u9047\u5230\u63d0\u793a\u914d\u7f6e\u6587\u4ef6\u51b2\u7a81\uff0c\u8bf7\u5c3d\u91cf\u9009\u62e9 3-way merge\uff0c\u5982\u679c\u5931\u8d25\u7684\u8bdd\u53ef\u4ee5\u5148 keep local version\uff0c\u7136\u540e\u624b\u52a8\u89e3\u51b3\u5408\u5e76\u51b2\u7a81\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_5","title":"\u5185\u6838\u66f4\u65b0","text":"<p>mirrors \u4f7f\u7528\u4e86\u5185\u6838\u6a21\u5757\u63d0\u4f9b\u4e00\u4e9b\u529f\u80fd\u652f\u6301\uff0c\u5982 ZFS\u3002\u56e0\u6b64\u53ea\u8981\u66f4\u65b0\u4e86\u5185\u6838\uff0c\u5c31\u4e00\u5b9a\u8981\u6ce8\u610f\u5185\u6838\u6a21\u5757\u662f\u5426\u5b89\u88c5\u6210\u529f\uff0c\u5982\u679c apt \u5b89\u88c5\u5931\u8d25\u53ef\u4ee5\u624b\u52a8\u8fd0\u884c <code>dkms autoinstall</code>\uff0c\u4ee5\u786e\u4fdd\u65b0\u5185\u6838\u91cd\u542f\u65f6\u80fd\u6b63\u786e\u52a0\u8f7d\u5fc5\u987b\u7684\u5185\u6838\u6a21\u5757\u3002</p>"},{"location":"workflow/mirrors/maintenance/#ipmi","title":"IPMI","text":"<p>\u5730\u5740\u6682\u65e0\uff0c\u4e00\u822c\u7528\u6d4f\u89c8\u5668\u76f4\u63a5\u8bbf\u95ee\u5c31\u884c\u4e86\u3002\u5982\u679c\u9700\u8981\u63a5\u5165\u7ec8\u7aef\uff0cDashboard \u5de6\u8fb9\u7684 Remote Control \u6709 Launch \u6309\u94ae\u3002\u5982\u679c\u6d4f\u89c8\u5668\u4e0d\u652f\u6301 Java \u5c31\u4f1a\u4e0b\u8f7d\u4e00\u4e2a <code>jviewer.jnlp</code>\uff0c\u81ea\u884c\u89e3\u51b3 Java \u7684\u5b89\u5168\u8b66\u544a\u5373\u53ef\u4f7f\u7528\u3002</p> <p>\u5f53\u7136\u5982\u679c\u4f1a\u7528 <code>ipmitool</code> \u66f4\u597d\uff0c\u90a3\u8fd9\u4e00\u6bb5\u7684\u8bf4\u660e\u5c31\u4ea4\u7ed9\u4f60\u6765\u8865\u5145\u4e86 :)</p>"},{"location":"workflow/mirrors/maintenance/#ipmitool","title":"<code>ipmitool</code> \u7b80\u4ecb","text":"<p>\u5c3d\u7ba1\u51e0\u4e4e\u6211\u4eec\u673a\u5668\u7684 IPMI \u90fd\u6709 Web \u754c\u9762\uff0c\u4f46\u662f Web \u754c\u9762\u4e0d\u4e00\u5b9a\u9760\u8c31\uff0c\u53ef\u80fd\u4f1a\u51fa\u73b0\u6545\u969c\u3002\u6b64\u65f6\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528 <code>ipmitool</code> \u91cd\u7f6e IPMI \u7684\u72b6\u6001\uff08\u7cfb\u7edf\u914d\u7f6e\u4e0d\u4f1a\u6539\u53d8\uff09</p> <p>\u53c2\u8003\u547d\u4ee4\uff1a</p> <pre><code># \u4e00\u90e8\u5206 IPMI \u7684 interface \u662f lanplus \u800c\u4e0d\u662f lan\uff0c\u6bd4\u5982\u8bf4 mirrors3\nipmitool -I lan -H IPMI\u7684IP -U \u7528\u6237\u540d -a mc reset cold\n</code></pre> <p>\u5177\u4f53\u8be6\u60c5\u53ef\u4ee5\u770b <code>ipmitool</code> \u7684 manpage\u3002</p> <p>\u53e6\u5916:</p> <ul> <li>\u636e\u8bf4\u8fd8\u53ef\u4ee5\u7528\u5b83\u8bbe\u7f6e\u4e32\u53e3\u8f93\u51fa\u4ece\u800c\u5b9e\u73b0\u7c7b\u4f3c KVM \u7684\u6548\u679c\uff0c\u4f46\u662f\u6ca1\u6709\u6d4b\u8bd5\u8fc7\uff0c\u4e5f\u4e0d\u77e5\u9053\u5982\u4f55\u5b9e\u73b0\u3002</li> <li>mirrors3 \u7684 IPMI (iDRAC) \u662f broken \u7684\uff0c\u5c31\u7b97 reset cold \u4e86\u4e5f\u6ca1\u7528\u3002</li> </ul>"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"LUG @ USTC Documentation","text":"<p>Documentation for LUG @ USTC technical infrastructure.</p>"},{"location":"#layout","title":"Layout","text":"<p>Our documentation is divided into these sections, as laid out on the left navigation menu:</p> <ul> <li>The Workflow section provides guidance to (a few) common maintenance tasks.</li> <li>The Infrastructure section describes our infrastructure, as well as common configurations across different servers (networking, firewalls, security, monitoring, etc.).</li> <li>The Services section documents specific configurations on individual servers and service units (software and/or Docker containers).</li> <li>The Common Issues (a.k.a. FAQ) section records our troubleshooting experiences and serves partially as a \"notebook\" for known traps and workarounds.</li> </ul>"},{"location":"#links","title":"References","text":"<ul> <li>LUG @ USTC homepage</li> <li>sparanoid/chinese-copywriting-guidelines: Chinese copywriting guidelines for better written communication / \u4e2d\u6587\u6587\u6848\u6392\u7248\u6307\u5317 (Try to follow any guidelines in this repository)</li> <li>Material for MkDocs</li> <li>This repository (click the icon on the top-right)</li> </ul>"},{"location":"faq/dns/","title":"DNS \u57df\u540d\u89e3\u6790\u95ee\u9898","text":""},{"location":"faq/dns/#wrong-dns-result","title":"\u9519\u8bef\u7684\u89e3\u6790\u7ed3\u679c","text":"<p>\u6211\u4eec\u7684 DNS \u662f\u5206\u6821\u5185\u5916\u3001\u5206 ISP \u89e3\u6790\u7684\u3002\u6709\u65f6\u5019\u4f1a\u9047\u5230\u6821\u5185\u8bbf\u95ee\u89e3\u6790\u5230\u6821\u5916\uff0c\u53ef\u80fd\u7684\u539f\u56e0\u662f</p> <p><code>/etc/resolv.conf</code> \u987a\u5e8f\u4e0d\u5bf9</p> <p>iBug \u5728 2020 \u5e74 5 \u6708 21 \u65e5\u4fee\u4e86 gw-el \u548c mirrors2\uff0c\u8fd9\u4e24\u4e2a\u673a\u5668\u4e0a\u539f\u5148\u6392\u5728\u6700\u524d\u9762\u7684 nameserver \u5c31\u662f 8.8.4.4 \u6216\u8005 1.1.1.1 \u4e4b\u7c7b\u7684</p> <p>\u6211\u4eec\u7684\u6743\u5a01\u670d\u52a1\u5668\u4e24\u4e2a\u5728\u6821\u5185\u4e00\u4e2a\u5728\u56fd\u5185\uff0c\u56e0\u6b64\u6821\u5185\u673a\u5668\u5e94\u8be5\u4f18\u5148\u4ece\u6821\u5185\u89e3\u6790\u3002\u628a 202.38.64.1 / 2001:da8:d800::1\uff08\u5b66\u6821\u7684 DNS\uff09\u653e\u6700\u524d\u9762\u80af\u5b9a\u6ca1\u9519</p> <p>\u5982\u679c IPv4 \u89e3\u6790\u6b63\u786e\u4f46\u662f IPv6 \u8fd8\u662f\u89e3\u6790\u5230\u6821\u5916\u7684\u8bdd\uff0c</p> <p><code>/etc/resolv.conf</code> \u7f3a\u5c11 IPv6 \u6761\u76ee</p> <p>taoky \u5728 2020 \u5e74 5 \u6708 29 \u65e5\u53d1\u73b0\u7684\uff0cmirrors2 \u4e0a\u8bbf\u95ee servers.ustclug.org \u8fd4\u56de Cloudflare \u7684 522 \u9519\u8bef\u9875\u9762\uff08\u6b64\u65f6\u65e5\u672c\u53cd\u4ee3\u6302\u6389\u4e86\uff09\uff0c\u7ecf\u67e5\u5c3d\u7ba1 IPv4 \u6b63\u786e\u89e3\u6790\u5230\u4e86 gw-el \u4e0a\uff0c\u4f46\u662f IPv6 \u8fd8\u662f\u89e3\u6790\u5230\u4e86 Cloudflare \u4e0a\uff0c\u4e14 nslookup \u548c dig \u7b49\u5de5\u5177\u8f93\u51fa\u770b\u8d77\u6765\u90fd\u662f\u5bf9\u7684\u3002</p> <p>\u6392\u67e5\u53d1\u73b0 <code>/etc/resolv.conf</code> \u91cc\u6ca1\u6709 IPv6 \u7684\u670d\u52a1\u5668\u6761\u76ee\uff0c\u5728\u9760\u524d\u7684\u4f4d\u7f6e\u63d2\u5165 <code>nameserver 2001:da8:d800::1</code> \u540e\u89e3\u51b3\u3002</p> <p>\u624b\u52a8\u6e05\u7a7a\u672c\u673a\u7684 DNS \u7f13\u5b58\uff1a<code>nscd -i hosts</code></p> <p>\u6709\u65f6\u5019\u53ef\u80fd\u4f1a\u5728 DNS \u66f4\u65b0\u540e\u968f\u673a\u89e3\u6790\u51fa\u65b0\u65e7\u7ed3\u679c\uff0c\u53ef\u80fd\u7684\u539f\u56e0\u662f</p> <p>ns-a \u6ca1\u66f4\u65b0</p> <p>ns-a \u673a\u5668\u6bd4\u8f83\u8001\u65e7\uff0c\u7f51\u7edc\u53ef\u80fd\u4e0d\u987a\u7545\uff0c\u624b\u52a8\u628a ns-a \u66f4\u65b0\u4e00\u4e0b\u5c31\u884c\u4e86\uff08</p>"},{"location":"faq/docker/","title":"Docker \u76f8\u5173\u95ee\u9898","text":""},{"location":"faq/docker/#debian-11-aufs","title":"Debian 11 \u4e2d\u4e0d\u518d\u652f\u6301 aufs","text":"<p>\u4ece Debian 10 \u5347\u7ea7\u5230 Debian 11 \u65f6\uff0c<code>aufs-dkms</code> \u4e0d\u518d\u5305\u542b\u5728\u65b0\u5185\u6838\u4e2d\uff1a</p> <p>aufs-dkms \u8f6f\u4ef6\u5305\u5c06\u4e0d\u4f5c\u4e3a bullseye \u7684\u4e00\u90e8\u5206\u51fa\u73b0\u3002\u5927\u591a\u6570 aufs-dkms \u7528\u6237\u5e94\u5f53\u5207\u6362\u81f3 overlayfs\uff0c\u540e\u8005\u63d0\u4f9b\u4e86\u76f8\u4f3c\u7684\u529f\u80fd\u4e14\u5177\u6709\u5185\u6838\u7684\u652f\u6301\u3002\u7136\u800c\uff0c\u67d0\u4e9b Debian \u5b89\u88c5\u5b9e\u4f8b\u53ef\u80fd\u4f7f\u7528\u4e86\u4e0d\u517c\u5bb9 overlayfs \u7684\u6587\u4ef6\u7cfb\u7edf\uff0c\u5982\u4e0d\u5e26\u6709 d_type \u7684 xfs\u3002\u6211\u4eec\u5efa\u8bae\u9700\u8981\u4f7f\u7528 aufs-dkms \u7684\u7528\u6237\u5728\u5347\u7ea7\u81f3 bullseye \u4e4b\u524d\u5148\u8fdb\u884c\u8fc1\u79fb\u3002</p> <p>(https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.zh-cn.html)</p> <p>\u5bf9\u4e8e\u8001\u673a\u5668\u6765\u8bf4\u9700\u8981\u63d0\u524d\u786e\u8ba4 Docker \u7684 storage driver\uff1a</p> <pre><code>$ sudo docker info\n// ...\nServer:\n // ...\n Storage Driver: overlay2\n  Backing Filesystem: extfs\n  Supports d_type: true\n  Native Overlay Diff: true\n  userxattr: false\n</code></pre> <p>\u8fd9\u91cc\u5982\u679c\u662f overlay2 \u90a3\u4e48\u5c31\u6ca1\u95ee\u9898\uff0c\u5982\u679c\u662f aufs \u7684\u8bdd\u5c31\u9700\u8981\u63d0\u524d\u786e\u8ba4\uff0c\u56e0\u4e3a\u5207\u6362\u5230 overlay2 \u4e4b\u540e\u73b0\u6709\u7684\u5bb9\u5668\u548c\u5bb9\u5668\u955c\u50cf\u90fd\u4f1a\u4e22\u5931\uff0c\u9700\u8981\u91cd\u65b0\u521b\u5efa\u3002\u6240\u4ee5\u9700\u8981\u786e\u4fdd\u5bb9\u5668\uff08container\uff09\u548c\u955c\u50cf\uff08image\uff09\u662f\u53ef\u590d\u73b0\u7684\u3002</p> <p>\u5728\u5347\u7ea7\u7cfb\u7edf\u540e\uff0c\u7f16\u8f91 <code>/etc/docker/daemon.json</code>\uff0c\u52a0\u4e0a\uff1a</p> <pre><code>\"storage-driver\": \"overlay2\"\n</code></pre> <p>\u7136\u540e\u542f\u52a8 docker\uff0c\u91cd\u65b0\u521b\u5efa\u5bb9\u5668\u3002</p>"},{"location":"faq/ldap/","title":"LDAP \u5957\u4ef6\u95ee\u9898","text":""},{"location":"faq/ldap/#gosa","title":"GOsa \u95ee\u9898","text":"<p>User \u754c\u9762\u6253\u5f00\u65f6\u62a5\u9519</p> <p>\u5982\u679c\u5728 GOsa \u4e2d\u521b\u5efa\u4e86\u4e00\u4e2a\u65b0\u7528\u6237\uff0c\u5374\u6ca1\u6709\u5728\u6700\u540e\u4e3a\u4ed6\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5c31\u4f1a\u51fa\u73b0\u6b64\u95ee\u9898\uff0c\u6253\u5f00 User \u754c\u9762\u540e\u4f1a\u6709\u62a5\u9519\uff1a</p> <pre><code>Fatal error: Uncaught ArgumentCountError: Too few arguments to function userManagement::filterLockLabel(), 0 passed in /usr/share/gosa/include/class_listing.inc on line 856 and exactly 1 expected in /usr/share/gosa/plugins/admin/users/class_userManagement.inc:856\nStack trace:\n#0 /usr/share/gosa/include/class_listing.inc(856): userManagement::filterLockLabel()\n#1 /usr/share/gosa/include/class_listing.inc(980): listing-&gt;processElementFilter('%{filter:lockLa...', Array, 50)\n#2 /usr/share/gosa/include/class_listing.inc(853): listing-&gt;filterActions('cn=...,ou=...', 50, Array)\n#3 /usr/share/gosa/include/class_listing.inc(764): listing-&gt;processElementFilter('%{filter:action...', Array, 50)\n#4 /usr/share/gosa/include/class_listing.inc(407): listing-&gt;renderCell('%{filter:action...', Array, 50)\n#5 /usr/share/gosa/include/class_management.inc(233): listing-&gt;render()\n#6 /usr/share/gosa/include/class_management.inc(222): management-&gt;renderList()\n#7 /usr/share/gosa/plugins/admin/users/main.inc(44): management-&gt;execute()\n#8 /usr/sh in /usr/share/gosa/plugins/admin/users/class_userManagement.inc on line 856\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a GOsa \u65e0\u6cd5\u8bfb\u53d6\u5230\u7528\u6237\u5bc6\u7801\u7684 Hash\uff0c\u800c LDAP \u5374\u5141\u8bb8\u7528\u6237\u6ca1\u6709\u5bc6\u7801\u3002 \u53ea\u9700\u4e3a\u65b0\u7684\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\u6216\u5220\u9664\u65b0\u7684\u7528\u6237\u5373\u53ef\u3002</p>"},{"location":"faq/ldap/#slapd","title":"Slapd","text":"<p>Slapd \u662f openldap \u7684\u670d\u52a1\u7aef daemon\u3002\u6b63\u5e38\u60c5\u51b5\u4e0b\u4e0d\u9700\u8981\u78b0\uff0c\u4f46\u662f\u5982\u679c\u8981\u78b0\u7684\u65f6\u5019\uff0c\u4f60\u4f1a\u53d1\u73b0\u5b83\u7684\u914d\u7f6e\u6781\u5176\u590d\u6742\u9ebb\u70e6\u3002</p> <p>\u4fee\u6539\u524d\u4e00\u5b9a\u8981\u5148\u6253\u865a\u62df\u673a\u5feb\u7167\uff01\uff01\uff01</p> <p>\u5c0f\u5fc3\u5ef6\u6bd5</p>"},{"location":"faq/ldap/#migrate-hdb-to-mdb","title":"Migrate hdb to mdb","text":"<p><code>slapd-hdb</code> \u5728 Debian 11 \u5373\u5c06\u88ab deprecate\uff0c\u6240\u4ee5\u5728 2021/08/15 \u7ec4\u7ec7\u4e86\u4e00\u6b21 migrate\u3002</p> <p>\u7f51\u4e0a\u8d44\u6599\u5f88\u5c11\uff0c\u53c2\u8003\u4e86\uff1a</p> <ol> <li>https://github.com/osixia/docker-openldap/issues/97</li> <li>https://gist.github.com/wenzhixin/4705697206cdbf61bc88</li> </ol> <p>\u6b65\u9aa4\uff1a</p> <ol> <li>\u865a\u62df\u673a\u5feb\u7167\u6253\u597d\u3002</li> <li>\u5907\u4efd\u6570\u636e\u5e93\uff1a<code>slapcat -v -l dump.ldif</code></li> <li>\u5907\u4efd <code>/etc/ldap</code> \u4ee5\u53ca <code>/var/lib/ldap</code></li> <li>\u628a <code>/etc/ldap/slapd.d</code> \u4ee5\u53ca <code>/var/lib/ldap</code> \u5220\u6389\uff08\u6216\u8005\u6539\u540d\uff09</li> <li>\u8fd0\u884c <code>dpkg-reconfigure slapd</code></li> <li>\u521b\u5efa <code>/tmp/ldapconvert</code> \u76ee\u5f55\uff0c\u8fd0\u884c <code>slaptest -f /etc/ldap/convert.conf -F /tmp/ldapconvert</code></li> <li>\u6e05\u7a7a <code>/etc/ldap/slapd.d/cn=config/cn=schema/</code> \u4e0b\u7684\u6587\u4ef6\uff0c\u5c06 <code>/tmp/ldapconvert/slapd.d/cn=config/cn=schema/</code> \u4e0b\u7684\u6587\u4ef6\u590d\u5236\u5230 <code>/etc/ldap/slapd.d/cn=config/cn=schema/</code> \u5c06 slapd.d \u5907\u4efd\u4e2d <code>cn=config/cn=schema/</code> \u7684\u6587\u4ef6\u590d\u5236\u5230\u65b0\u7684 <code>slapd.d</code> \u5bf9\u5e94\u7684\u76ee\u5f55\u4e0b\uff0c\u5e76\u4e14\u4fee\u6539 owner \u4e3a <code>openldap:openldap</code></li> <li>\u91cd\u542f <code>slapd</code>\uff0c\u5982\u679c\u542f\u52a8\u5931\u8d25\uff0c\u770b <code>systemctl status slapd</code> \u7684\u65e5\u5fd7\u8f93\u51fa debug\u3002</li> <li>\u6062\u590d\u6570\u636e\u5e93\uff1a<code>slapadd -l dump.ldif</code>\u3002\u6ce8\u610f\uff0cmdb \u6ca1\u6709\u4e8b\u52a1\uff01\u5982\u679c\u4e2d\u95f4\u51fa\u9519\u4e86\uff0c\u6392\u67e5\u95ee\u9898\u540e\uff0c\u6e05\u7a7a <code>/var/lib/ldap</code>\uff0c\u91cd\u542f <code>slapd</code> \u91cd\u6765\u3002</li> </ol> <p>\u6062\u590d\u6210\u529f\u540e\uff0c\u6709\u4e9b\u914d\u7f6e\u9700\u8981\u624b\u52a8\u8bbe\u7f6e\uff1a</p> <ol> <li> <p>TLS/SSL</p> <pre><code># ldapmodify -H ldapi:/// -Y EXTERNAL &lt;&lt; EOF\n&gt; dn: cn=config\n&gt; changetype: modify\n&gt; replace: olcTLSCertificateFile\n&gt; olcTLSCertificateFile: /etc/ldap/ssl/slapd-server.crt\n&gt; -\n&gt; replace: olcTLSCACertificateFile\n&gt; olcTLSCACertificateFile: /etc/ldap/ssl/slapd-ca-cert.pem\n&gt; -\n&gt; replace: olcTLSCertificateKeyFile\n&gt; olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd-server.key\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u52a0\u8f7d pw-sha2.la\uff08\u82e5\u4f7f\u7528 ssha512/256 \u5219\u9700\u8981\u52a0\u8f7d\uff09</p> <pre><code># ldapmodify -H ldapi:/// -Y EXTERNAL &lt;&lt; EOF\n&gt; dn: cn=module,cn=config\n&gt; cn: module\n&gt; objectClass: olcModuleList\n&gt; olcModulePath: /usr/lib/ldap/\n&gt; olcModuleLoad: pw-sha2.la\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u4e3a sudoUser \u8bbe\u7f6e index</p> <pre><code># ldapadd -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={1}mdb,cn=config\n&gt; changetype: modify\n&gt; add: olcDbIndex\n&gt; olcDbIndex: sudoUser eq,sub\n&gt;\n&gt; EOF\n</code></pre> </li> <li> <p>\u66f4\u6539\u9ed8\u8ba4\u5bc6\u7801\u5b58\u50a8\u9009\u9879\uff08\u53ef\u9009\uff09</p> <p>\u66f4\u6539\u4e3a crypt/yescrypt</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; add: olcPasswordHash\n&gt; olcPasswordHash: {CRYPT}\n&gt; \n&gt; dn: cn=config\n&gt; add: olcPasswordCryptSaltFormat\n&gt; olcPasswordCryptSaltFormat: $y$j9T$%s\n</code></pre> <p>\u66f4\u6539\u4e3a ssha512\uff08\u9700\u8981 pw-sha2.la\uff0c\u4e5f\u53ef\u53c2\u7167\u4e0a\u8ff0 yescrypt \u7684\u914d\u7f6e\u66f4\u6539\u4e3a crypt/ssha512\uff09</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; add: olcPasswordHash\n&gt; olcPasswordHash: {SSHA512}\n</code></pre> <p>\u5982\u679c\u62a5\u9519\u5df2\u7ecf\u5b58\u5728\uff0c\u53ef\u4ee5\u7528 replace \u9009\u9879\uff0c\u4ee5 crypt/yescrypt \u4e3a\u4f8b\uff1a</p> <pre><code># ldapmodify -Y EXTERNAL -H ldapi:/// &lt;&lt; EOF\n&gt; dn: olcDatabase={-1}frontend,cn=config\n&gt; changetype: modify\n&gt; replace: olcPasswordHash\n&gt; olcPasswordHash: {CRYPT}\n&gt; \n&gt; dn: cn=config\n&gt; changetype: modify\n&gt; replace: olcPasswordCryptSaltFormat\n&gt; olcPasswordCryptSaltFormat: $y$j9T$%s\n</code></pre> <p>\u6ce8\u610f\u5728\u4f7f\u7528\u4e0a\u8ff0 hash \u65b9\u5f0f\u7684\u65f6\u5019\u8fdb\u5165 gosa \u7528\u6237\u9875\u9762\u65f6\u53ef\u80fd\u4f1a\u62a5\u9519 Cannot find a suitable password method for the current hash</p> </li> </ol>"},{"location":"faq/nginx/","title":"Nginx \u76f8\u5173\u914d\u7f6e","text":""},{"location":"faq/nginx/#git-host-specific","title":"\u4f7f\u7528 Git \u540c\u6b65\u914d\u7f6e\uff0c\u4f46\u9700\u8981 host-specific \u7684\u914d\u7f6e","text":"<ol> <li>Nginx \u81ea\u5e26\u4e00\u4e2a\u53d8\u91cf <code>$hostname</code> \u53ef\u4ee5\u5728\u5408\u9002\u7684\u5730\u65b9\u7528\u6765 if \u6216\u8005 map\uff0c\u4f46\u662f\u5728\u8fd9\u4e2a\u529e\u6cd5\u4e0d\u9876\u7528\u7684\u65f6\u5019\uff08\u4f8b\u5982\uff0c<code>resolver</code> \u4e0d\u652f\u6301\u53d8\u91cf\uff09\u5c31\u53ea\u80fd\u7528\u4e0b\u9762\u8fd9\u4e2a\u7b28\u529e\u6cd5\u4e86\u3002</li> <li>\u628a\u9700\u8981 host-specific \u7684\u90a3\u4e2a\u6587\u4ef6\u52a0\u5165 <code>.gitignore</code>\uff0c\u7136\u540e\u5728\u5408\u9002\u7684\u4f4d\u7f6e\u7559\u4e0b\u4e00\u4e2a README\u3002</li> </ol>"},{"location":"faq/nginx/#_1","title":"\u6587\u4ef6\u6253\u5f00\u6570\u5927\u5c0f\u9650\u5236","text":"<p>\u5728\u9ed8\u8ba4\u8bbe\u7f6e\u4e2d\uff0cnginx \u7684\u6700\u5927\u6587\u4ef6\u6253\u5f00\u6570\u4e0a\u9650\u5e76\u4e0d\u5927\u3002\u5f53\u6709\u5927\u91cf\u8bbf\u95ee\u65f6\uff0c\u6587\u4ef6\u6253\u5f00\u6570\u53ef\u80fd\u4f1a\u8d85\u8fc7\u9650\u989d\uff0c\u5bfc\u81f4\u7f51\u7ad9\u54cd\u5e94\u7f13\u6162\u3002\u5728\u65b0\u914d\u7f6e\u670d\u52a1\u5668\u65f6\uff0c\u8fd9\u4e00\u9879\u8bbe\u7f6e\u5f88\u5bb9\u6613\u88ab\u5ffd\u7565\u6389\u3002</p> <p>\u89e3\u51b3\u65b9\u6cd5\uff1a</p> <ol> <li><code>sudo systemctl edit nginx.service</code>\uff08\u90e8\u5206\u673a\u5668\u4e0a\u7684\u670d\u52a1\u540d\u53ef\u80fd\u4e3a <code>openresty.service</code>\uff09</li> <li>\u5728\u6253\u5f00\u7684 override \u6587\u4ef6\u7684 <code>[Service]</code> \u4e0b\u65b9\u6dfb\u52a0 <code>LimitNOFILE=524288</code>\uff08\u89c6\u60c5\u51b5\u8fd9\u4e2a\u503c\u53ef\u4ee5\u76f8\u5e94\u8c03\u6574\uff09</li> </ol>"},{"location":"faq/nginx/#gateway-tmpmem","title":"\u5173\u4e8e gateway \u914d\u7f6e\u4e2d\u7684 <code>/tmp/mem</code> \u8def\u5f84","text":"<p>\u66f4\u65b0</p> <p>\u6211\u4eec\u5df2\u4e0d\u518d\u5728 nginx.conf \u91cc\u4f7f\u7528 <code>/tmp/mem</code> \u4e86\uff0c\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u5b58\u6863\u3002</p> <p>\u9519\u8bef\u8868\u73b0\u662f <code>systemctl start nginx.service</code> \u5931\u8d25\uff0c\u4f7f\u7528 status \u6216 journalctl \u53ef\u4ee5\u770b\u5230\u4ee5\u4e0b\u4fe1\u606f\uff1a</p> <pre><code>[emerg] mkdir() \"/tmp/mem/nginx_temp\" failed (2: No such file or directory)\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a\u6211\u4eec\u7684 <code>nginx.conf</code> \u4e2d\u94a6\u70b9\u4e86 <code>proxy_temp /tmp/mem/nginx_temp</code>\uff0c\u800c <code>/tmp/mem</code> \u662f\u6211\u4eec\u81ea\u5df1\u5efa\u7684\u4e00\u4e2a tmpfs \u6302\u8f7d\u70b9\uff0c\u5b83\u4e0d\u662f\u4efb\u4f55\u53d1\u884c\u7248\u7684\u9ed8\u8ba4\u914d\u7f6e\uff0c\u6240\u4ee5\u65b0\u88c5\u7684\u7cfb\u7edf\u5982\u679c\u76f4\u63a5 pull \u4e86\u8fd9\u4efd nginx config \u5c31\u4f1a\u62a5\u4ee5\u4e0a\u9519\u8bef\u3002</p> <p>\uff08\u4f7f\u7528 <code>/tmp/mem</code> \u7684\u539f\u56e0\u662f\uff0c\u7531\u4e8e nginx \u53cd\u4ee3\u9700\u8981\u9891\u7e41\u8bfb\u5199\u4e34\u65f6\u6587\u4ef6\uff0c\u4e3a\u4e86\u51cf\u5c11\u78c1\u76d8 IO \u5360\u7528\uff0c\u6545\u5c06\u5176\u4e34\u65f6\u6587\u4ef6\u653e\u5165\u5185\u5b58\u4e2d\uff09</p> <p>\u6b63\u786e\u7684\u89e3\u51b3\u65b9\u6cd5\u662f\u8865\u4e0a\u5bf9\u5e94\u7684 fstab \u884c\uff1a</p> <pre><code>tmpfs   /tmp/mem    tmpfs   0   0\n</code></pre> <p>\u5982\u679c\u521b\u5efa/\u6302\u8f7d\u4e86 /tmp/mem \u540e\uff0c\u542f\u52a8\u4ecd\u7136\u51fa\u9519\uff0c\u5219\u9700\u8981\u68c0\u67e5 openresty.service/nginx.service \u6587\u4ef6\u4e2d\u662f\u5426\u5305\u542b <code>PrivateTmp=yes</code>\u3002\u5982\u679c\u5305\u542b\uff0c\u5219\u9700\u8981 <code>systemctl edit</code>\uff0c\u5c06\u6b64\u9879\u8bbe\u7f6e\u4e3a <code>false</code>\u3002</p> <p>fstab \u4e0e systemd</p> <p>\u8c03\u6574 fstab \u4e4b\u540e\uff0c\u9700\u8981\u6267\u884c <code>systemctl daemon-reload</code>\uff0c\u5426\u5219 systemd \u53ef\u80fd\u4f1a\u5728\u7b2c\u4e8c\u65e5\u51cc\u6668\u6302\u8f7d\u5df2\u88ab\u6ce8\u91ca\u7684\u78c1\u76d8\u9879\u3002</p>"},{"location":"faq/nginx/#openresty","title":"OpenResty","text":""},{"location":"faq/nginx/#lua","title":"Lua \u76f8\u5173","text":"<p>\u8fd9\u91cc\u5173\u6ce8\u4e09\u4e2a\u76f8\u5173\u7684\u6b65\u9aa4\uff1a<code>access_by</code>, <code>log_by</code> \u548c <code>header_filter_by</code>\uff0c\u4ee5\u53ca <code>ngx.ctx</code> \u548c <code>ngx.var</code> \u7684\u6ce8\u610f\u4e8b\u9879\u3002</p> <p>\u6d4b\u8bd5\u7528 server \u5757\uff1a</p> <pre><code>server {\n    listen 80 default_server;\n    listen [::]:80 default_server;\n\n    root /var/www/html;\n\n    index index.html index.htm index.nginx-debian.html;\n\n    server_name _;\n\n    set $testvar \"\";\n    access_by_lua_file /etc/nginx/lua/access.lua;\n    header_filter_by_lua_file /etc/nginx/lua/header_filter.lua;\n    log_by_lua_file /etc/nginx/lua/log.lua;\n\n    location / {\n        try_files $uri $uri/ =404;\n    }\n\n    location /lua-test0 {\n        return 302 /lua-test1;\n    }\n\n    location /lua-test1 {\n        return 200;\n    }\n\n    location /lua-test2 {\n        try_files $uri $uri/ @internal1;\n    }\n\n    location @internal1 {\n        return 418;\n    }\n}\n</code></pre> <p>\u4e09\u4e2a lua:</p> /etc/nginx/lua/access.lua<pre><code>local ctx = ngx.ctx\nctx.testvar = \"testvar\"\nngx.var.testvar = \"testvar\"\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre> /etc/nginx/lua/header_filter.lua<pre><code>local ctx = ngx.ctx\n\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre> /etc/nginx/lua/log.lua<pre><code>local ctx = ngx.ctx\n\nngx.log(ngx.ERR, \"ctx \", ctx.testvar)\nngx.log(ngx.ERR, \"var \", ngx.var.testvar)\n</code></pre>"},{"location":"faq/nginx/#rewritereturn-access_by","title":"rewrite/return \u4e0e access_by","text":"<p>\u8bbf\u95ee localhost/lua-test0 \u6216\u8005 localhost/lua-test1\uff0c\u6ca1\u6709 access.lua \u7684\u8f93\u51fa\uff1a</p> <pre><code>2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] header_filter.lua:3: ctx nil, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] header_filter.lua:4: var nil, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] log.lua:3: ctx nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n2024/07/22 02:50:16 [error] 9465#9465: *12 [lua] log.lua:4: var nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test0 HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u5982\u679c\u8bbf\u95ee localhost/somefile\uff0c\u662f\u6709\u8f93\u51fa\u7684\uff1a</p> <pre><code>2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] access.lua:4: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] access.lua:5: var testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] header_filter.lua:3: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] header_filter.lua:4: var testvar, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] log.lua:3: ctx testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:03:42 [error] 9628#9628: *19 [lua] log.lua:4: var testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /somefile HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u8fd9\u662f\u56e0\u4e3a <code>return</code> \u8bed\u53e5\u53d1\u751f\u5728 <code>rewrite</code> \u9636\u6bb5\uff0c\u56e0\u6b64\u8df3\u8fc7\u4e86 <code>access</code> \u9636\u6bb5\uff0c<code>access_by_lua_block</code> \u5c31\u6ca1\u6709\u88ab\u6267\u884c\u3002\u56e0\u6b64 Content phase \u4e2d\u7684\u7a0b\u5e8f\u4e0d\u80fd\u5047\u8bbe access_by \u80af\u5b9a\u88ab\u6267\u884c\u4e86\u3002</p>"},{"location":"faq/nginx/#ngxctx","title":"<code>ngx.ctx</code>","text":"<p>https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxctx</p> <p>\u652f\u6301\u4efb\u610f lua \u6570\u636e\u7ed3\u6784\u7684\uff0c\u4e0e\u5355\u72ec request \u7ed1\u5b9a\u7684\u72b6\u6001\u53d8\u91cf\u3002\u540c\u65f6\u4e5f\u4e0d\u9700\u8981\u50cf <code>ngx.var</code> \u4e00\u6837\u63d0\u524d <code>set</code>\u3002</p> <p>\u5c0f\u5fc3\u5185\u90e8\u8df3\u8f6c</p> <p>Internal redirects (triggered by nginx configuration directives like <code>error_page</code>, <code>try_files</code>, <code>index</code> and etc) will destroy the original request <code>ngx.ctx</code> data (if any) and the new request will have an empty ngx.ctx table.</p> <p>\u8bbf\u95ee localhost/lua-test2\uff08\u5047\u8bbe\u524d\u9762\u7684 <code>try_files</code> \u5931\u8d25\uff09\uff1a</p> <pre><code>2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] access.lua:4: ctx testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] access.lua:5: var testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] header_filter.lua:3: ctx nil, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] header_filter.lua:4: var testvar, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] log.lua:3: ctx nil while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n2024/07/22 03:10:15 [error] 9630#9630: *22 [lua] log.lua:4: var testvar while logging request, client: 127.0.0.1, server: _, request: \"GET /lua-test2 HTTP/1.1\", host: \"localhost\"\n</code></pre> <p>\u8fd9\u4e2a\u95ee\u9898\u5bf9\u4e00\u4e9b\u9700\u8981\u5728 access \u4e2d\u505a\u4e00\u4e9b\u4e8b\u60c5\uff0c\u5c06\u72b6\u6001\u5b58\u50a8\u5728 <code>ngx.ctx</code> \u4e2d\uff0c\u7136\u540e\u5728 header_filter \u6216\u8005 log \u4e2d\u53d6\u6d88\u5bf9\u5e94\u6548\u679c\u7684\u903b\u8f91\uff08\u4f8b\u5982 resty.limit.conn \u5728\u8bbf\u95ee\u7684\u6587\u4ef6\u5f53\u524d\u4e0d\u5b58\u5728\u7684\u60c5\u51b5\u4e0b\uff09\u6765\u8bf4\u662f\u81f4\u547d\u7684\u3002</p>"},{"location":"faq/nginx/#ngxvar","title":"<code>ngx.var</code>","text":"<p>https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxvarvariable</p> <p>\u4f7f\u7528\u6709\u4e00\u4e9b\u9ebb\u70e6\uff1a</p> <ul> <li>\u6027\u80fd\u76f8\u6bd4\u4e8e <code>ngx.ctx</code> \u6765\u8bf4\u4f4e\u4e00\u4e9b\uff0c\u5b98\u65b9\u6587\u6863\u4e0d\u5efa\u8bae\u5c06 <code>ngx.var</code> \u4f7f\u7528\u5230\u5173\u952e\u8def\u5f84\u4e0a\u3002</li> <li>\u9700\u8981\u63d0\u524d\u5b9a\u4e49\u53d8\u91cf\u3002</li> <li>\u53ea\u80fd\u8d4b\u503c\u6570\u5b57\u6216\u8005\u5b57\u7b26\u4e32\uff0c\u8d4b\u503c table \u53ef\u80fd\u4e0d\u4f1a\u76f4\u63a5\u62a5\u9519\uff0c\u4f46\u662f\u5b9e\u9645\u4e0a\u4e0d\u5de5\u4f5c\u3002</li> </ul> <p>\u4f46\u662f\u76f8\u6bd4\u4e8e <code>ngx.ctx</code>\uff0c\u6700\u5927\u7684\u4f18\u52bf\u5c31\u662f\u5373\u4f7f\u7ecf\u8fc7\u4e86 internal redirection\uff0c<code>ngx.var</code> \u7684\u5185\u5bb9\u4e5f\u4f1a\u4fdd\u7559\u3002</p> <p>\u7531\u4e8e <code>ngx.var</code> \u5176\u672c\u8eab\u4e0d\u9002\u5408\u5b58\u50a8\u590d\u6742\u7684\u7ed3\u6784\uff0c\u7b2c\u4e09\u65b9\u6a21\u5757 (lua-resty-ctxdump, 2-clause BSD license) \u5904\u7406\u8fd9\u4e2a\u95ee\u9898\u7684\u505a\u6cd5\u662f\uff1a\u5c06\u5b9e\u9645\u5185\u5bb9\u4fdd\u5b58\u5728\u6a21\u5757\u5185\u90e8\u7684 memo \u8868\u4e2d\uff0c\u800c\u9700\u8981\u5b58\u50a8\u5728 ngx.var \u91cc\u9762\u7684\u53ea\u662f memo \u8868\u7684 key\uff08\u6570\u5b57\uff09\u3002</p>"},{"location":"faq/nginx/#_2","title":"\u6a21\u5757\u7ba1\u7406","text":"<p>OpenResty \u5b98\u65b9\u63a8\u8350\u4f7f\u7528 opm (<code>openresty-opm</code>) \u7ba1\u7406\u6a21\u5757\u3002\u624b\u52a8\u7ef4\u62a4\u6a21\u5757\u7684\u8bdd\u9700\u8981\u81ea\u884c\u5904\u7406\u914d\u7f6e\uff0c\u5bf9\u5e94\u7684\u662f <code>lua_package_path</code>\uff08<code>http</code> \u5757\u5185\uff0c\u5206\u53f7\u5206\u5272\u8def\u5f84\uff0c\u6700\u540e <code>;;</code> \u4ee3\u8868\u5185\u7f6e\u7684\u539f\u59cb\u8def\u5f84\uff09\u3002</p> <p>\u4f8b\u5982\uff1a</p> <pre><code>lua_package_path \"/etc/nginx/lua/module/?.lua;;\";\n</code></pre> <p>\u4ee5 https://github.com/tokers/lua-resty-ctxdump/blob/master/lib/resty/ctxdump.lua \u4e3a\u4f8b\uff0c\u4e0b\u8f7d\u5230 <code>/etc/nginx/lua/module/</code> \u4e0b\u4e4b\u540e\uff0c\u5c31\u53ef\u4ee5\u5728\u5176\u4ed6 lua \u6587\u4ef6\u5185\u4f7f\u7528\u4e86\uff1a</p> /etc/nginx/lua/access.lua<pre><code>local ctxdump = require \"ctxdump\"\nlocal ctx = ngx.ctx\nctx.testvar = {foo = \"bar\", num = 42}\n-- \u9700\u8981 set $ctx_ref \"\";\nngx.var.ctx_ref = ctxdump.stash_ngx_ctx()\nngx.log(ngx.ERR, \"ctx foo \", ctx.testvar.foo)\nngx.log(ngx.ERR, \"ctx num \", ctx.testvar.num)\nngx.log(ngx.ERR, \"var ctx_ref \", ngx.var.ctx_ref)\n</code></pre> /etc/nginx/lua/log.lua<pre><code>local ctxdump = require \"ctxdump\"\nngx.log(ngx.ERR, \"var ctx_ref \", ngx.var.ctx_ref)\nngx.ctx = ctxdump.apply_ngx_ctx(ngx.var.ctx_ref)\nlocal ctx = ngx.ctx\nngx.log(ngx.ERR, \"ctx foo \", ctx.testvar.foo)\nngx.log(ngx.ERR, \"ctx num \", ctx.testvar.num)\n</code></pre> <p>\u5982\u679c\u6ca1\u6709\u627e\u5230\u6587\u4ef6\uff0c\u62a5\u9519\u4fe1\u606f\u4e2d\u4f1a\u5305\u542b\u6240\u6709\u5c1d\u8bd5\u8fc7\u7684\u8def\u5f84\u3002</p>"},{"location":"faq/nginx/#_3","title":"\u4ee3\u7801\u590d\u7528\u4e0e\u6a21\u5757\u7f16\u5199","text":"<p>\u6700\u7b80\u5355\u7684\u4ee3\u7801\u590d\u7528\u7684\u65b9\u6cd5\u662f\u4f7f\u7528 <code>loadfile()</code> \u51fd\u6570\uff0c\u8fd9\u6837\u51e0\u4e4e\u4e0d\u9700\u8981\u4fee\u6539\u4ee3\u7801\u5185\u5bb9\u3002</p> <pre><code>local f = loadfile(\"/etc/nginx/lua/somefile.lua\")\nif f then\n    f()\nelse\n    ngx.log(ngx.ERR, \"failed to load somefile.lua\")\nend\n</code></pre> <p>\u4f46\u662f\u8fd9\u4e48\u505a\u662f\u6ca1\u6709 JIT \u7f13\u5b58\u7684\uff0c\u610f\u5473\u7740\u6bcf\u4e2a\u8bf7\u6c42\u90fd\u9700\u8981\u6574\u4e2a\u52a0\u8f7d\u4e00\u904d\u5bf9\u5e94\u7684\u539f\u59cb lua \u4ee3\u7801\u3002\u4e00\u4e2a\u57fa\u672c\u7684\u6a21\u5757\u7c7b\u4f3c\u4e8e\u4e0b\u9762\u8fd9\u6837\uff1a</p> <pre><code>local _M = {}\n\nlocal function some_internal_func(a)\n    return a + a\nend\n\nfunction _M.f1(a, b)\n    local aa = some_internal_func(a)\n    local bb = some_internal_func(b)\n    return aa + bb\nend\n\nreturn _M\n</code></pre>"},{"location":"faq/ssd/","title":"SSD \u56fa\u4ef6","text":"<p>\u6570\u636e\u4e2d\u5fc3\u76d8\u7684 SSD \u8fd1\u5e74\u6765\u6709\u591a\u8d77\u56e0\u4e3a\u56fa\u4ef6\u95ee\u9898\u5bfc\u81f4\u4f7f\u7528\u65f6\u95f4\u8fc7\u957f\uff08\u51e0\u4e07\u5c0f\u65f6\uff09\u540e\u76d8\u574f\u6389\u7684\u65b0\u95fb\u3002 \u8fd9\u7c7b\u4e8b\u4ef6\u4e00\u65e6\u53d1\u751f\uff0c\u540e\u679c\u6781\u5176\u4e25\u91cd\uff0c\u56e0\u4e3a\u914d\u7f6e\u65b0\u670d\u52a1\u5668\u65f6\uff0c\u4e00\u822c\u4f7f\u7528\u7684\u76d8\u578b\u53f7\u662f\u4e00\u6837\u7684\uff0c\u5e76\u4e14\u5f00\u673a\u65f6\u95f4\u4e5f\u662f\u4e00\u6837\u7684\uff0c \u56e0\u6b64\u51fa\u73b0\u95ee\u9898\u4e4b\u540e\uff0c\u6240\u6709\u76d8\u90fd\u4f1a\u5728\u77ed\u65f6\u95f4\u5185\u574f\u6389\uff0cRAID \u6839\u672c\u65e0\u529b\u56de\u5929\u3002 \u56e0\u6b64\u4ee5\u4e0b\u8bb0\u5f55\u4e00\u4e9b\u56fa\u4ef6\u5347\u7ea7\u7684\u65b9\u6cd5\u3002</p>"},{"location":"faq/ssd/#intel","title":"Intel","text":""},{"location":"faq/ssd/#_1","title":"\u80cc\u666f","text":"<p>2024 \u5e74 1 \u6708 12 \u65e5\u51cc\u6668\uff0c\u5728\u53d1\u73b0\u4e24\u5757 Intel SSD S4510/S4610 \u51fa\u73b0 SMART \u9519\u8bef\u5e76\u4e14 ZFS \u63d0\u793a\u8bfb\u53d6\u9519\u8bef\u4e4b\u540e\u7d27\u6025\u8fdb\u884c\u4e86\u56fa\u4ef6\u5347\u7ea7\uff08\u5426\u5219\u8fd8\u6709 8 \u5757\u76d8\u4e5f\u4f1a\u5f88\u5feb\u56e0\u4e3a\u7c7b\u4f3c\u95ee\u9898\u635f\u574f\uff09\u3002\u7531\u4e8e\u7f3a\u5c11\u76f8\u5173\u8d44\u6599\uff0c\u5e76\u4e14 Intel \u4e0b\u67b6\u4e86\u5927\u91cf\u4fe1\u606f\uff0c\u56e0\u6b64\u82b1\u8d39\u4e86\u5f88\u591a\u65f6\u95f4\uff0c\u81f3\u51cc\u6668\u4e03\u70b9\u5b8c\u6210\u5347\u7ea7\u3002</p> Timeline <p>2024/01/11 04:21 - \u6536\u5230 smartd \u90ae\u4ef6\u79f0 <code>/dev/sdi</code> \u51fa\u73b0 <code>End-to-End_Error_Count</code> \u9519\u8bef\u3002</p> <p>\u4e4b\u540e\u672a\u6000\u7591\u662f\u56fa\u4ef6\u95ee\u9898\uff0c\u53ea\u8ba4\u4e3a\u662f\u5076\u53d1\u7684\u9519\u8bef\uff0c\u5e76\u4e14 SSD \u4ecd\u53ef\u6b63\u5e38\u8bfb\u53d6\uff0cZFS \u6b63\u5e38\u7ea0\u9519\uff0c\u56e0\u6b64\u5f53\u5929\u5f00\u59cb\u51c6\u5907\u91c7\u8d2d\u65b0 SSD\uff0c\u672a\u8fdb\u884c\u5176\u4ed6\u64cd\u4f5c\u3002</p> <p>2024/01/12 02:51 - \u6536\u5230 smartd \u90ae\u4ef6\u79f0 <code>/dev/sdh</code> \u51fa\u73b0 <code>End-to-End_Error_Count</code> \u9519\u8bef\u3002</p> <p>\u4e4b\u540e\u6000\u7591\u662f\u56fa\u4ef6\u95ee\u9898\uff0c\u5e76\u4ece\u6d6a\u6f6e\u7684\u7f51\u7ad9\u786e\u8ba4\u4e86\u8fd9\u4e00\u70b9\u3002 Dell \u63d0\u4f9b\u4e86\u4fee\u590d\u5305\uff0c\u4f46\u662f\u65e0\u6cd5\u5728 Debian \u4e0b\u5b89\u88c5\u3002Intel/Solidigm \u63d0\u4f9b\u7684\u5347\u7ea7\u5de5\u5177\u6709\u8bb8\u591a\u4e0d\u540c\u7248\u672c\uff0c\u5176\u4e2d isdct \u4e0e sst \u63d0\u793a\u5347\u7ea7\u5931\u8d25\uff0cintelmas \u63d0\u793a\u5f53\u524d\u4ea7\u54c1\u5df2\u4e0d\u518d\u652f\u6301\u3002</p> <p>\u5728\u8fc1\u79fb\u90e8\u5206\u91cd\u8981\u865a\u62df\u673a\uff0c\u5e76\u786e\u8ba4\u5907\u4efd\u6b63\u5e38\u540e\uff08\u5927\u81f4\u82b1\u8d39\u4e86 2 \u5230 2.5 \u5c0f\u65f6\uff09\uff0c\u91cd\u542f\u5bf9\u5e94\u670d\u52a1\u5668\uff0c\u5c1d\u8bd5\u4f7f\u7528 Solidigm \u63d0\u4f9b\u7684\u300c\u5347\u7ea7\u542f\u52a8\u76d8\u300d\u5347\u7ea7\uff0c\u63d0\u793a\u627e\u4e0d\u5230 SSD \u800c\u5931\u8d25\u3002 \u4e4b\u540e\u4ece Solidigm \u8bba\u575b\u4e86\u89e3\u5230\u9700\u8981\u5173\u95ed\u76f4\u901a\u8bbe\u7f6e\u3002\u5148\u5bf9 <code>/dev/sdi</code> \u8fdb\u884c\u4e86\u6d4b\u8bd5\uff08\u8be5\u76d8\u6709 SMART \u9519\u8bef\uff0c\u4f46\u662f\u4ecd\u53ef\u8bfb\u5199\uff09\uff0c\u5347\u7ea7\u6210\u529f\u3002\u4e4b\u540e\u5347\u7ea7\u4e86\u5168\u90e8 Intel SSD\u3002</p> <p>\u76f8\u5173\u6d89\u95ee\u9898\u56fa\u4ef6\u7248\u672c\u4e3a XCV10100\u3002XCV10110 \u53ca\u4ee5\u4e0a\u4fee\u590d\u4e86\u95ee\u9898\u3002</p>"},{"location":"faq/ssd/#_2","title":"\u5347\u7ea7\u65b9\u6cd5","text":"<p>Intel \u7684\u5b58\u50a8\u4e1a\u52a1\u5df2\u7ecf\u88ab SK Hynix \u5b50\u516c\u53f8 Solidigm \u6536\u8d2d\u3002\u5176\u63d0\u4f9b\u4e86\u76f8\u5173\u5de5\u5177\u8fdb\u884c\u5347\u7ea7\u3002</p> <p>https://www.solidigm.com/us/en/support-page/product-doc-cert/ka-00099.html \u63d0\u4f9b\u4e86 Solidigm \u5de5\u5177\u652f\u6301\u7684\u4ea7\u54c1\u5217\u8868\u3002\u4e0b\u8f7d\u6700\u65b0\u7248\u672c Solidigm\u2122 Storage Tool \u4e4b\u540e\uff08\u652f\u6301 Debian/Ubuntu\uff09\uff0c\u4f7f\u7528\u4ee5\u4e0b\u65b9\u6cd5\u68c0\u67e5\u6240\u6709 SSD \u7684\u4fe1\u606f\uff1a</p> <pre><code>sst show -ssd\n</code></pre> <p>\u5173\u6ce8\u6bcf\u4e2a SSD \u7684 <code>FirmwareUpdateAvailable</code> \u4e00\u884c\u662f\u5426\u6709\u66f4\u65b0\u4fe1\u606f\u3002</p> <p>\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5347\u7ea7\uff1a</p> <pre><code>sst load -ssd &lt;SSD \u7684\u7f16\u53f7&gt;\n</code></pre> <p>\u8bf7\u6ce8\u610f\uff0c\u8be5\u5de5\u5177\u4e0d\u652f\u6301 RAID \u5361\u7684\u76f4\u901a\u6a21\u5f0f\u3002\u5bf9\u4e8e Dell \u670d\u52a1\u5668\u6765\u8bf4\uff0c\u9700\u8981\u8bbe\u7f6e\u5982\u4e0b\uff1a</p> <ol> <li>\u542f\u7528 LSI \u652f\u6301\uff1a<code>sst set -system EnableLSIAdapter=True</code></li> <li>\u91cd\u542f\u8fdb\u5165 BIOS\uff0c\u5c06 RAID \u5361\u4ece HBA \u6a21\u5f0f\u5207\u6362\u4e3a RAID \u6a21\u5f0f\uff08\u5982\u679c\u662f\u7684\u8bdd\uff09</li> <li>\u5c06\u9700\u8981\u5347\u7ea7\u7684\u76d8\u4ece Non-RAID \u6a21\u5f0f\u5207\u6362\u4e3a RAID-Capable\uff08\u6ce8\u610f\u4e0d\u8981\u70b9\u6210\u6e05\u7a7a\u6240\u6709\u6570\u636e\uff01\uff09</li> <li>\u91cd\u542f\u8fdb\u5165 recovery \u6a21\u5f0f\uff0c\u4f7f\u7528 <code>sst</code> \u8fdb\u884c\u5347\u7ea7\u3002</li> <li>\u5347\u7ea7\u5b8c\u6210\u540e\u91cd\u542f\uff0c\u8fdb\u5165 BIOS \u6062\u590d\u4e4b\u524d\u7684\u8bbe\u7f6e\uff08\u540c\u6837\u6ce8\u610f\u4e0d\u8981\u70b9\u9519\uff01\uff09</li> </ol>"},{"location":"faq/systemd-timer/","title":"Systemd-timer \u53c2\u8003\u6a21\u677f","text":"<p>Systemd-timer \u4f5c\u4e3a crontab \u7684\u66ff\u4ee3\u54c1\uff0c\u6709\u4e00\u7cfb\u5217\u7684\u4f18\u70b9\uff1a</p> <ul> <li>\u786e\u4fdd\u76f8\u540c\u7684\u4efb\u52a1\u672a\u5b8c\u6210\u65f6\u4e0d\u4f1a\u88ab\u91cd\u590d\u6267\u884c\u3002</li> <li>\u6613\u4e8e\u8c03\u8bd5\u3001\u7ba1\u7406\u3002</li> </ul> <p>\u5f53\u7136\u76f8\u6bd4\u4e8e crontab\uff0c\u7f3a\u70b9\u4e5f\u5f88\u660e\u663e\uff1a</p> <ul> <li>\u5570\u55e6\u3001\u96be\u5199\u3002</li> </ul> <p>\u6240\u4ee5\u4ee5\u4e0b\u7ed9\u51fa\u4e00\u4e2a\u6a21\u677f\uff0c\u65b9\u4fbf\u5728\u521b\u5efa\u65b0\u5b9a\u65f6\u4efb\u52a1\u7684\u65f6\u5019\u4f7f\u7528\u3002\u8fd9\u91cc\u7684\u4f8b\u5b50\u662f mirrors2 \u4ece mirrors4 \u83b7\u53d6\u538b\u7f29\u540e\u7684\u65e5\u5fd7\u3002\u4ee5\u4e0b\u6587\u4ef6\u5747\u653e\u5728 <code>/etc/systemd/system</code>\u3002</p> m4log.service<pre><code>[Unit]\nDescription=Mirrors4 log backup\nDocumentation=man:rsync(1)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nUser=mirror\nGroup=mirror\nExecStart=rsync -rltpv --include=*/ --include=*.xz --exclude=* m4log:/ /var/m4log/\nRestart=on-failure\nRestartSec=3\n</code></pre> m4log.timer<pre><code>[Unit]\nDescription=Mirrors4 log backup timer\nDocumentation=man:rsync(1)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Timer]\nOnCalendar=*-*-* 7:13:00\nRandomizedDelaySec=60s\nPersistent=true\nUnit=m4log.service\n\n[Install]\nWantedBy=timer.target\n</code></pre> <p>\u5173\u4e8e OnCalendar \u7684\u89e6\u53d1\u65f6\u95f4\uff0c\u53ef\u4ee5\u53c2\u8003 systemd \u7684 Calendar Events \u8bf4\u660e\uff0c\u5e76\u7528 <code>systemd-analyze calendar</code> \u6765\u68c0\u9a8c\u6b63\u786e\u6027\uff0c\u4e5f\u53ef\u4ee5\u7528 <code>systemctl list-timers</code> \u89c2\u5bdf Timer \u4e0b\u6b21\u89e6\u53d1\u7684\u65f6\u95f4\u662f\u5426\u7b26\u5408\u9884\u671f\u3002</p> <p>\u4e0b\u9762\u662f\u4e00\u4e9b\u5e38\u7528\u547d\u4ee4\uff1a</p> <ul> <li>\u5f00\u673a\u542f\u7528\u8ba1\u65f6\u5668\uff1a<code>systemctl enable m4log.timer</code></li> <li>\u6fc0\u6d3b\u8ba1\u65f6\u5668\uff1a<code>systemctl start m4log.timer</code></li> <li>\u624b\u52a8\u8fd0\u884c\u670d\u52a1\uff1a<code>systemctl start m4log.service</code></li> <li>\u67e5\u770b\u670d\u52a1\u72b6\u6001\uff1a<code>systemctl status m4log.service</code></li> </ul>"},{"location":"faq/vm/","title":"\u865a\u62df\u5316\u76f8\u5173","text":""},{"location":"faq/vm/#_2","title":"\u6269\u76d8","text":"<p>\u6269\u5927\u865a\u62df\u78c1\u76d8\u7684\u5927\u5c0f\u540e\uff0c\u53ef\u4ee5\u91c7\u7528\u4ee5\u4e0b\u76f8\u5bf9\u7b80\u5355\u7684\u65b9\u5f0f\u6269\u5c55\u5206\u533a\u5927\u5c0f\uff1a</p> <p>\u8bf7\u786e\u4fdd\u7406\u89e3\u547d\u4ee4\u540e\u518d\u6267\u884c</p> <pre><code>$ # \u5b89\u88c5 growpart\n$ sudo apt install cloud-guest-utils\n$ # \u6269\u5c55 /dev/sdb1\n$ sudo growpart /dev/sdb 1\n$ # \u73b0\u5728\u5206\u533a\u8868\u4ee5\u53ca\u5206\u533a\u6269\u5c55\u4e86\uff0c\u4f46\u662f\u5206\u533a\u91cc\u9762\u7684\u6587\u4ef6\u7cfb\u7edf\u7684\u5927\u5c0f\u8fd8\u6ca1\u6709\u6269\u5c55\n$ # \u4ee5 ext4 \u4e3a\u4f8b\n$ sudo resize2fs /dev/sdb1\n</code></pre>"},{"location":"infrastructure/auth-dns/","title":"Authoritative DNS","text":"<p>Services (Servers):</p> <ul> <li>ns-a.ustclug.org (ns-a.s.ustclug.org)</li> <li>ns-b.ustclug.org (ns-b.s.ustclug.org)</li> <li>ns-c.ustclug.org (something else)</li> </ul> <p>All three servers are dedicated to DNS service and run no other services.</p>"},{"location":"infrastructure/auth-dns/#deploy","title":"Deploy","text":"<ul> <li>Bind configuration:  https://github.com/ustclug/auth-dns</li> <li>Bind Dockerfile:   https://github.com/zhsj/dockerfile/tree/master/bind9</li> </ul> <p>The bind configuration repository is only visible to admins because private key is included.</p> <pre><code># copy the ssh key https://github.com/ustclug/auth-dns/blob/master/git_pull_key\n# to ~/.ssh/id_ed25519\n\n# now get the conf\ngit clone git@github.com:ustclug/auth-dns.git /var/lib/bind\n\n# delete the ssh key\nrm ~/.ssh/id_ed25519\n</code></pre> <pre><code>docker run --restart=always -v /var/lib/bind/:/etc/bind \\\n       --net host -it -d --name=auth-dns zhusj/bind9\n</code></pre>"},{"location":"infrastructure/auth-dns/#update-dns-record","title":"Update DNS Record","text":"<p>Just commit your changes to the configuration repository. More details can be found in the repository.</p>"},{"location":"infrastructure/auth-dns/#webhook","title":"Webhook","text":"<p>Please add a webhook in the configuration repository, so that the DNS record can be automatically updated when commits are pushed.</p> <p>The webhook endpoint is <code>http://&lt;server_ip&gt;:9000/hooks/bind</code>, see https://github.com/ustclug/auth-dns/settings/hooks for examples.</p>"},{"location":"infrastructure/dockerhub/","title":"Docker Hub","text":""},{"location":"infrastructure/dockerhub/#dsos","title":"Docker-Sponsored Open-Source program (DSOS) application","text":"Item Reference response First Name Jiawei (Use your own name) Last Name Fu (Use your own name) Email Address redacted (Use your own email address) Role Tech Lead (or anything that makes sense) Company or Organization Name Linux User Group of University of Science and Technology of China Country (Select) China What is the name of your project? Various: USTC Open Source Software Mirror, USTC Network Boot Service, etc. Please link the public repository of your OSS organization (github, gitlab, etc.) https://github.com/ustclug Please provide a link to your project website. https://lug.ustc.edu.cn/ Enter your user Docker ID (aka username). ibugone (Use your own Docker ID) Do you have an existing Organization? (Select) Yes Enter the existing Docker ID for your organization on Docker Hub. ustclug What is the goal of this project? Ease the use of many Linux distros and open-source software, as well as advocate the spirit of Free Software What types of user(s) benefit from this project? Linux users and developers in mainland China What is the code distribution license for your OSS project? (Select) MIT License To what industry does your project or organization belong? (Select) Academic/research To what industry does your project or organization belong? 6 (Adjust as needed) Please list all sponsors for this project (patreon and other microdonations can be listed as one). USTC Network Information Center, USTC Library Does this project have a pathway to commercialization? ... (Select) No If approved, do you agree to the ...? (Tick the checkbox) Press Submit"},{"location":"infrastructure/dockerhub/#notes","title":"Notes","text":"<p>The first application on October 25, 2023 was declined with the following reason (emphasis mine):</p> <p>During our review of your application for Various (USTC Open Source Soft<sup>[sic]</sup>, we determined that while your project meets most of the program requirements, there is a lack of documentation in one or more of your repositories on Docker Hub.</p> <p>Before resubmitting the application, I deleted a few obsolete repositories and filled in the \"Repository overview\" for the rest, asking ChatGPT to produce it when needed. Afterwards, the second submission was approved in just 3 hours.</p>"},{"location":"infrastructure/github/","title":"GitHub Organization","text":"<p>ustclug @ GitHub</p>"},{"location":"infrastructure/github/#github-actions","title":"GitHub Actions","text":"<p>GitHub Actions \u5bf9\u516c\u5f00\u4ed3\u5e93\u514d\u8d39\uff0c\u5bf9\u79c1\u6709\u4ed3\u5e93\u6bcf\u6708\u6709 3000 \u5206\u949f\u7684\u9650\u989d\uff08\u6ce8\uff1a\u6211\u4eec\u662f\u5b66\u6821\u5e2e\u5fd9\u7533\u8bf7\u7684 GitHub Education\uff0c\u6240\u4ee5\u6211\u4eec\u5728\u529f\u80fd\u4e0a\u76f8\u5f53\u4e8e\u4ed8\u8d39\u7684 GitHub Team\uff09\u3002\u76ee\u524d\u6211\u4eec\u6709\u591a\u4e2a\u9879\u76ee\u4f7f\u7528 GitHub Actions \u90e8\u7f72\uff0c\u4f8b\u5982 Linux 101 \u7684\u8bb2\u4e49\u3002</p> <p>\u6211\u4eec\u66fe\u7ecf\u4f7f\u7528 Travis CI\uff08\u73b0\u5728\u4e5f\u5728\u90e8\u5206\u516c\u5f00\u4ed3\u5e93\u4e2d\u4f7f\u7528\uff09\uff0c\u56e0\u4e3a\uff08\u4e0d\u4f1a\u5b9a\u671f\u91cd\u7f6e\u7684\uff09\u6570\u91cf\u9650\u5236\u800c\u5c06\u79c1\u6709\u4ed3\u5e93\u5168\u90e8\u8fc1\u51fa\uff0c\u8ba8\u8bba\u89c1 Discussion #308.</p>"},{"location":"infrastructure/github/#2fa","title":"\u4e24\u6b65\u8ba4\u8bc1\uff082FA\uff09","text":"<p>\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u52a0\u5165 ustclug \u7ec4\u7ec7\u7684\u7528\u6237\u4e3a\u81ea\u5df1\u7684 GitHub \u8d26\u53f7\u914d\u7f6e\u4e24\u6b65\u8ba4\u8bc1\uff1a</p> <ul> <li>GitHub \u4e0d\u652f\u6301 +86 \u624b\u673a\u53f7\u8ba4\u8bc1\uff0c\u4f46\u662f\u53ef\u80fd\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539\u524d\u7aef\u7ed5\u8fc7\u9650\u5236\uff08\u4e0d\u63a8\u8350\uff09</li> <li>\u4f7f\u7528 Authenticator\uff1a\u5357\u5927\u7684 Yao Ge \u8001\u5e08\u6574\u7406\u4e86\u5728\u79fb\u52a8\u8bbe\u5907\uff08iOS \u4e0e Android\uff09\u53ef\u4ee5\u4f7f\u7528\u7684 TOTP \u5ba2\u6237\u7aef\uff0c\u5185\u5bb9\u53c2\u89c1 https://doc.nju.edu.cn/books/efe93/page/b1a59\u3002<ul> <li>iOS \u8bbe\u5907\u53ef\u4ee5\u4f7f\u7528 Google Authenticator \u6216 Microsoft Authenticator\uff0cAndroid \u8bbe\u5907\u4e5f\u53ef\u4ee5\u4ece Google Play \u5546\u5e97\u83b7\u53d6\u8fd9\u4e24\u4e2a\u5e94\u7528\uff1b</li> <li>\u65e0\u6cd5\u8bbf\u95ee Google Play \u7684 Android \u8bbe\u5907\u4e5f\u53ef\u4ee5\u4f7f\u7528 FreeOTP Plus, andOTP, Aegis Authenticator, Red Hat FreeOTP, OTP Authenticator\u3002</li> </ul> </li> </ul>"},{"location":"infrastructure/google/","title":"G Suite","text":"<p>\u7531\u4e8e G Suite \u81ea 2022 \u5e74 7 \u6708\u8d77\u4e0d\u518d\u63d0\u4f9b\u514d\u8d39\u7684 Teams\uff0c\u4e14\u5df2\u6709\u7684\u514d\u8d39 Teams \u4e5f\u5c06\u505c\u6b62\u670d\u52a1\uff0c\u6211\u4eec\u5df2\u4e8e 2022 \u5e74 3 \u6708\u5168\u9762\u8fc1\u79fb\u81f3 Office 365\u3002</p> <p>\u8003\u8651\u5230\u6b64\u9875\u9762\u7684 URL \u8fd8\u6709\u4e00\u5b9a\u6570\u91cf\u7684\u5916\u94fe\uff0c\u6211\u4eec\u628a\u672c\u9875\u6587\u6863\u91cd\u65b0\u52a0\u4e86\u56de\u6765\uff0c\u4f46\u662f\u6240\u6709\u6709\u610f\u4e49\u7684\u5185\u5bb9\u90fd\u5df2\u7ecf\u79fb\u52a8\u5230\u4e86 Office 365 \u9875\u9762\u4e2d\u3002</p>"},{"location":"infrastructure/ldap/","title":"LDAP \u670d\u52a1\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e","text":"<p>LDAP \u662f\u8f7b\u91cf\u76ee\u5f55\u8bbf\u95ee\u534f\u8bae\uff0c\u6211\u4eec\u7528\u7684\u8f6f\u4ef6\u662f OpenLDAP\u3002</p> <p>LDAP \u7684\u914d\u7f6e\u5f88\u9ebb\u70e6\uff0c\u6240\u4ee5\u88c5\u4e86\u4e00\u4e2a\u7f51\u9875\u524d\u7aef\u6765\u914d\u7f6e\u5b83\uff0c\u7f51\u9875\u524d\u7aef\u662f GOsa\u00b2\u3002</p>"},{"location":"infrastructure/ldap/#_1","title":"\u5bc6\u7801\u4fee\u6539","text":"<p>\u767b\u5f55\u4efb\u610f\u4e00\u53f0\u670d\u52a1\u5668\u4f7f\u7528 <code>passwd</code> \u5c31\u53ef\u4ee5\u4fee\u6539\u5bc6\u7801\uff0c\u4fee\u6539\u7684\u5bc6\u7801\u5728\u6240\u6709\u673a\u5668\u4e0a\u5b9e\u65f6\u751f\u6548\uff08\u56e0\u4e3a\u5b9e\u9645\u662f\u5b58\u5728 LDAP \u6570\u636e\u5e93\u91cc\u7684\uff09\u3002</p>"},{"location":"infrastructure/ldap/#gosa","title":"GOsa \u4f7f\u7528","text":"<p>\u7f51\u9875\u754c\u9762\u4f4d\u4e8e ldap.lug.ustc.edu.cn\u3002</p> <p>\u7528\u4f60\u7684\u8d26\u53f7\u767b\u5f55\u8fdb\u53bb\u4e4b\u540e\uff0c\u53ef\u4ee5\u5728\u53f3\u4e0a\u89d2\u9000\u51fa\uff0c\u53f3\u4e0a\u89d2\u8fd8\u6709\u4e24\u4e2a\u6309\u94ae\u5206\u522b\u662f\u4fee\u6539\u8d26\u53f7\u4fe1\u606f\u548c\u4fee\u6539\u5bc6\u7801\u3002\u8d26\u53f7\u4fe1\u606f\u7b2c\u4e00\u9875\u5927\u90e8\u5206\u662f\u6ca1\u7528\u7684\uff0c\u53ea\u6709\u4e00\u4e2a\u767b\u5f55\u540d\u662f\u6709\u7528\u7684\uff0c\u8fd9\u662f\u4f60\u767b\u5f55\u4efb\u4f55\u5730\u65b9\u7684\u7528\u6237\u540d\u3002</p>"},{"location":"infrastructure/ldap/#ldap-users-and-groups","title":"Users \u548c Groups","text":"<p>Users \u662f\u7528\u6765\u6dfb\u52a0\u548c\u914d\u7f6e\u7528\u6237\u4fe1\u606f\u7684\u5730\u65b9\u3002\u6700\u4e3b\u8981\u7684\u529f\u80fd\u4f4d\u4e8e\u6bcf\u4e2a User \u7684\u7b2c\u4e8c\u9875 POSIX\uff0c\u8fd9\u91cc\u53ef\u4ee5\u8bbe\u7f6e\u7528\u6237\u7684\u5bb6\u76ee\u5f55\uff0cUID\uff0cGID\uff0c\u4ee5\u53ca\u6240\u5c5e\u7684\u7528\u6237\u7ec4\u3002\u8fd9\u91cc\u9700\u8981\u6ce8\u610f\u7684\u5730\u65b9\u5982\u4e0b\uff1a</p> <ul> <li> <p>UID\uff0cGID \u4ece 2000 \u5f00\u59cb\u8ba1\u6570\uff0c\u7531\u4e8e gosa \u4e0d\u80fd\u5bf9 UID \u81ea\u52a8\u589e\u957f\uff0c\u6240\u4ee5\u7ba1\u7406\u5458\u9700\u8981\u4eba\u5de5\u589e\u957f\u3002\u65b9\u6cd5\u662f\u767b\u5f55\u4efb\u610f\u4e00\u53f0\u673a\u5668\uff0c\u8fd0\u884c <code>getent passwd</code> \u5e76\u89c2\u5bdf\u8f93\u51fa\uff0c\u53d6\u6700\u5927\u7684 UID + 1 \u5c31\u884c\u4e86\u3002</p> <p>\u5751</p> <p>\u5c0f\u5fc3\u8f93\u51fa\u7684\u987a\u5e8f\uff0c\u6700\u5927\u7684 UID \u4e0d\u4e00\u5b9a\u662f\u6700\u540e\u4e00\u4e2a\uff08\u800c\u4e14\u4e8b\u5b9e\u4e0a\u7ecf\u5e38\u4e0d\u662f\uff09\uff0c\u5efa\u8bae\u914d\u5408 sed, awk, sort \u4e4b\u7c7b\u7684\u547d\u4ee4\u59a5\u5584\u5904\u7406\uff0c\u4f8b\u5982</p> <pre><code>getent -s ldap passwd | cut -d: -f3 | sort -n\n</code></pre> <p>\u540c\u65f6\u8fd8\u6709\u82e5\u5e72 UID \u5f88\u5927\u4f46\u662f\u79bb\u6563\u7684\u7279\u6b8a\u8d26\u53f7\uff0c\u5f88\u5bb9\u6613\u5206\u8fa8\u3002\u663e\u7136\u65b0 UID \u662f 2000 \u5f00\u59cb\u8fde\u7eed\u7684\u6700\u5927 UID + 1.</p> <p>GID \u5efa\u8bae\u4e0d\u8981\u6bcf\u4eba\u4e00\u4e2a\uff0c\u6211\u4eec\u5efa\u4e00\u4e2a group\uff0c\u7ed9\u5927\u5bb6\u90fd\u52a0\u8fdb\u6765\uff0c\u8fd9\u6837\u5c31\u53ea\u9700\u8981\u8003\u8651 UID \u7684\u589e\u957f\u4e86\u3002\u76ee\u524d\u8be5 group \u4e3a <code>ldap_users</code>\uff0cGID \u4e3a 2001\u3002</p> </li> <li> <p>\u5efa\u8d26\u53f7\u4e4b\u524d\u5148\u6ce8\u610f\u4e00\u4e0b\u5404\u4e2a\u670d\u52a1\u5668\u4e0a\u6709\u6ca1\u6709\u76f8\u540c\u7684\u7528\u6237\u540d\uff0c\u6709\u7684\u8bdd\u628a\u539f\u5bb6\u76ee\u5f55 chown \u5230\u65b0\u7684 UID GID\uff0c\u5220\u9664\u540c\u540d\u7528\u6237\u3002</p> </li> </ul> <p>Groups \u4e2d\u4ee5 ssh \u5f00\u5934\u7684\u7ec4\u63a7\u5236\u5bf9\u5e94\u673a\u5668\u7684 ssh \u6743\u9650\uff0csudo \u5f00\u5934\u540c\u7406\u3002super_maneger \u7ec4\u5305\u542b\u6240\u6709\u673a\u5668\u7684\u6743\u9650\uff0c\u4ee5\u53ca LDAP \u7684 admin \u8eab\u4efd\u3002\u52a0\u5165\u5bf9\u5e94\u7684\u7ec4\u5373\u6388\u4e88\u76f8\u5e94\u6743\u9650\u3002\u5df2\u77e5\u7684 GID</p>"},{"location":"infrastructure/ldap/#access-control","title":"Access Control","text":"<p>\u8fd9\u91cc\u53ef\u4ee5\u914d\u7f6e GOsa \u7684\u7f16\u8f91\u6743\u9650\uff0c\u73b0\u5728\u8fd9\u91cc\u9762\u53ea\u6709\u4e00\u4e2a\u7ec4\uff0c\u662f\u5b8c\u5168\u6743\u9650\u7684\u3002\u53e6\u5916\uff0c\u6bcf\u4e2a\u9879\u53ef\u4ee5\u8bbe\u7f6e\u4e13\u95e8\u9488\u5bf9\u8fd9\u4e2a\u9879\u7684 ACL\u3002</p>"},{"location":"infrastructure/ldap/#sudo-rules","title":"Sudo rules","text":"<p>\u8fd9\u91cc\u914d\u7f6e sudo \u6743\u9650\u3002\u8fd9\u91cc\u7684\u8bed\u6cd5\u548c sudoers \u4e00\u6837\uff08\u8bf7\u65e0\u89c6 System trust\uff09\u3002\u7279\u522b\u8981\u8bf4\u7684\u4e00\u70b9\u662f\u901a\u8fc7\u5728 System \u4e2d\u52a0\u5165\u4e3b\u673a\u540d\u53ef\u4ee5\u9488\u5bf9\u6bcf\u4e2a\u4e3b\u673a\u914d\u7f6e\u6743\u9650\uff0c\u8fd9\u91cc\u8981\u586b\u7684\u662f\u4e3b\u673a\u540d\u800c\u4e0d\u662f\u57df\u540d\uff0c\u5177\u4f53\u8303\u4f8b\u8bf7\u770b\u91cc\u9762\u7684 lugsu wikimanager \u7b49\u9879\u3002</p> <p>\u5176\u5b83\u6211\u6ca1\u63d0\u5230\u7684\u9879\u6211\u4e5f\u6ca1\u641e\u660e\u767d\u600e\u4e48\u7528\u3002\u3002\u3002</p> <p>gosa \u7684\u914d\u7f6e\u6587\u4ef6\u5728 <code>/etc/gosa/gosa.conf</code>\uff0c\u5b83\u662f\u5728\u7b2c\u4e00\u6b21\u8fd0\u884c gosa \u65f6\u5019\u81ea\u52a8\u751f\u6210\u7684\uff0c\u4f46\u5728\u4e4b\u540e\u5c31\u53ea\u80fd\u901a\u8fc7\u624b\u52a8\u7f16\u8f91\u6765\u4fee\u6539\u3002\u7531\u4e8e\u914d\u7f6e\u6587\u4ef6\u51e0\u4e4e\u6ca1\u6709\u6587\u6863\uff0c\u5b98\u65b9\u7684 FAQ \u6709\u597d\u591a\u662f\u9519\u7684\uff0c\u6240\u4ee5\u6211\u57fa\u672c\u6ca1\u52a8:-D\u3002</p>"},{"location":"infrastructure/ldap/#_2","title":"\u7ef4\u62a4\u5907\u6ce8","text":"<p>\u5982\u679c\u53d1\u73b0\u66f4\u65b0 GOsa \u4e4b\u540e\uff0c<code>/gosa</code> \u6ca1\u6709\u6b63\u5e38\u5de5\u4f5c\uff08\u6bd4\u5982\u8bf4\u76f4\u63a5\u663e\u793a\u4e86 PHP \u7684\u6e90\u4ee3\u7801\uff09\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u5220\u9664 <code>/var/spool/gosa/</code> \u4e2d\u7684\u6240\u6709\u6587\u4ef6\uff0c\u8be6\u89c1 Gosa broken in Debian stretch\u3002</p>"},{"location":"infrastructure/ldap/#ldap_1","title":"LDAP \u5ba2\u6237\u7aef\u914d\u7f6e","text":""},{"location":"infrastructure/ldap/#debian","title":"Debian \u914d\u7f6e\u65b9\u6cd5","text":""},{"location":"infrastructure/ldap/#_3","title":"\u8f6f\u4ef6\u5305\u5b89\u88c5","text":"<p>Debian 7 \u4ee5\u4e0a\u7cfb\u7edf\u5b89\u88c5 <code>libnss-ldapd</code>\u3001<code>libpam-ldapd</code>\u3001<code>sudo-ldap</code></p> <p>Note</p> <p>\u66f4\u65b0\u8fd9\u4e9b\u8f6f\u4ef6\u5305\u65f6\uff0c\u6ce8\u610f\u4fdd\u7559\u4e00\u4e2a root \u7ec8\u7aef\uff0c\u66f4\u65b0\u540e\u53ef\u80fd\u9700\u8981\u91cd\u542f daemon \u8fdb\u7a0b</p> <p>\u5728\u5b89\u88c5\u8fc7\u7a0b\u4e2d\u4f1a\u88ab\u95ee\u4e00\u4e9b\u95ee\u9898\uff08\u4e0d\u540c\u7248\u672c\u7684 Debian \u7684\u95ee\u9898\u53ef\u80fd\u4e0d\u540c\uff09\uff1a</p> <ul> <li>LDAP \u670d\u52a1\u5668\u5730\u5740\u662f <code>ldaps://ldap.lug.ustc.edu.cn</code></li> <li>Base DN \u4e3a <code>dc=lug,dc=ustc,dc=edu,dc=cn</code></li> <li>\u534f\u8bae\u4e3a\u7248\u672c 3</li> <li>\u914d\u7f6e libnss-ldapd \u65f6\u6709\u4e2a\u9009 Name services to configure \u7684\uff0c\u5168\u90e8\u9009\u4e0a</li> </ul>"},{"location":"infrastructure/ldap/#etcldapldapconf","title":"/etc/ldap/ldap.conf","text":"<p>\u7f16\u8f91\u5185\u5bb9\u5982\u4e0b\uff1a</p> /etc/ldap/ldap.conf<pre><code>BASE dc=lug,dc=ustc,dc=edu,dc=cn\nURI ldaps://ldap.lug.ustc.edu.cn\nSSL yes\nTLS_CACERT /etc/ldap/slapd-ca-cert.pem\nTLS_REQCERT demand\nSUDOERS_BASE ou=sudoers,dc=lug,dc=ustc,dc=edu,dc=cn\n</code></pre> <p>\u4e3a\u4e86\u5b89\u5168\u6027\u8003\u8651\uff0c\u8981\u4ee5 ldaps \u7684\u65b9\u5f0f\u8fde\u63a5 ldap \u670d\u52a1\u5668\uff0c\u540c\u65f6\u5e94\u914d\u7f6e\u597d\u8bc1\u4e66 (<code>/etc/ldap/slapd-ca-cert.pem</code>, \u4ece\u5176\u5b83\u670d\u52a1\u5668\u590d\u5236\u4e00\u4e2a)</p>"},{"location":"infrastructure/ldap/#etcsudo-ldapconf","title":"/etc/sudo-ldap.conf","text":"<p>\u8fd9\u4e2a\u6587\u4ef6\u5e94\u8be5\u76f4\u63a5\u8f6f\u94fe\u63a5\u5230 <code>/etc/ldap/ldap.conf</code>\uff0c\u901a\u5e38 dpkg \u5df2\u7ecf\u4e3a\u4f60\u521b\u5efa\u597d\u4e86\u3002</p>"},{"location":"infrastructure/ldap/#etcnslcdconf","title":"/etc/nslcd.conf","text":"<p>\u6ce8\u610f\u68c0\u67e5\u4e00\u4e0b\u6b64\u914d\u7f6e\u6587\u4ef6\u662f\u5426\u4e0e <code>/etc/ldap/ldap.conf</code> \u4e0b\u7684\u5185\u5bb9\u76f8\u4e00\u81f4\uff0c\u5982</p> /etc/nslcd.conf<pre><code>uid nslcd\ngid nslcd\nuri ldaps://ldap.lug.ustc.edu.cn\nbase dc=lug,dc=ustc,dc=edu,dc=cn\nssl on\ntls_reqcert demand\ntls_cacertfile /etc/ldap/slapd-ca-cert.pem\n</code></pre>"},{"location":"infrastructure/ldap/#etcnsswitchconf","title":"/etc/nsswitch.conf","text":"<p>\u5b89\u88c5\u8f6f\u4ef6\u5305\u65f6\uff0c\u5b89\u88c5\u811a\u672c\u5df2\u7ecf\u5904\u7406\u8fc7\u8be5\u6587\u4ef6\u3002\u68c0\u67e5\u4e00\u4e0b\u5185\u5bb9\uff0c\u5927\u81f4\u4e3a\uff1a</p> <pre><code>passwd:         compat ldap\ngroup:          compat ldap\nshadow:         compat ldap\n......\nsudoers:        files ldap\n</code></pre> <p>\u6ce8\u610f\u6bcf\u4e00\u9879\u540e\u9762\u7684 <code>ldap</code>\uff0c\u5982\u679c\u6ca1\u6709\u8981\u624b\u52a8\u52a0\u4e0a\u3002\u4e0d\u592a\u6e05\u695a\u5177\u4f53\u542b\u4e49\uff0c\u53cd\u6b63\u7ed9\u6bcf\u4e00\u9879\u90fd\u52a0\u4e0a <code>ldap</code> \u662f\u6ca1\u6709\u95ee\u9898\u7684\u3002</p> <p>Debian 10 \u8981\u6539\u4e00\u4e0b sudoers \u90a3\u4e00\u884c</p> <p>\u628a ldap \u653e\u524d\u9762\uff0c\u540c\u65f6\u52a0\u4e0a <code>[SUCCESS=return]</code> \u5e94\u8be5\u50cf\u4e0b\u9762\u8fd9\u6837\uff1a</p> <pre><code>sudoers:        ldap [SUCCESS=return] files\n</code></pre> <p>\u91cd\u542f\u4e00\u4e0b <code>nscd</code> \u548c <code>nslcd</code> \u670d\u52a1\uff0c\u6b64\u65f6\u8fd0\u884c <code>getent passwd</code>\uff0c\u5e94\u8be5\u53ef\u4ee5\u770b\u5230\u6bd4 <code>/etc/passwd</code> \u66f4\u591a\u7684\u5185\u5bb9\uff0c\u8fd9\u5c31\u8bf4\u660e\u914d\u7f6e\u6b63\u786e\u4e86\u3002</p>"},{"location":"infrastructure/ldap/#pam","title":"PAM \u914d\u7f6e","text":"<p>\u5982\u679c PAM \u914d\u7f6e\u9519\u8bef\uff0c\u53ef\u80fd\u5bfc\u81f4\u7528\u6237\u65e0\u6cd5\u4f7f\u7528 SSH \u767b\u5f55\uff0c\u751a\u81f3\u8fde sudo \u4e5f\u53ef\u80fd\u6302\u6389\u3002\u6240\u4ee5\u4fee\u6539 PAM \u914d\u7f6e\u65f6\uff1a</p> <ol> <li>\u8bf7\u505a\u597d\u6587\u4ef6\u5907\u4efd\uff1b</li> <li>\u8bf7\u53e6\u5f00\u4e00\u4e2a root \u7ec8\u7aef\u4ee5\u9632\u4e07\u4e00\u3002</li> </ol> <p>\u5bf9\u4e8e Debian 7+\uff0c\u53ea\u9700\u8bbe\u7f6e\u4e00\u5904\u3002\u4e3a\u4e86\u767b\u5f55\u65f6\u81ea\u52a8\u521b\u5efa\u5bb6\u76ee\u5f55\uff0c\u5728 <code>/etc/pam.d/common-session</code> \u4e2d\u6dfb\u52a0\u4e0b\u9762\u8fd9\u53e5\uff1a</p> <pre><code>session required    pam_mkhomedir.so skel=/etc/skel umask=0022\n</code></pre> <p>\u5bf9\u4e8e Debian 5\uff0c\u8bf7\u67e5\u9605\u672c\u6587\u6863\u7684 Git \u8bb0\u5f55\u3002</p>"},{"location":"infrastructure/ldap/#centos","title":"CentOS \u914d\u7f6e\u65b9\u6cd5","text":"<p>\u901a\u8fc7 yum \u5b89\u88c5 openldap openldap-clients nss_ldap nss-pam-ldap</p> <p>\u4ee5 root \u8eab\u4efd\u6267\u884c</p> <pre><code>authconfig --enablecache \\\n       --enableldap \\\n       --enableldapauth \\\n       --ldapserver=\"ldaps://ldap.lug.ustc.edu.cn/\" \\\n       --ldapbasedn=\"dc=lug,dc=ustc,dc=edu,dc=cn\" \\\n       --enableshadow \\\n       --enablemkhomedir \\\n       --enablelocauthorize \\\n       --update\n</code></pre> <p>\u6ce8\u610f\uff0c\u7531\u4e8e authconfig \u7684 bug\uff0c\u4e0a\u4e00\u6761\u547d\u4ee4\u7684\u6267\u884c\u73af\u5883\u5fc5\u987b\u662f <code>LC_ALL=en_US.UTF-8</code></p> <p>Sudo \u7684\u914d\u7f6e\u662f\u901a\u8fc7 sssd \u5b9e\u73b0\u7684\uff0c\u53c2\u8003 https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sssd-ldap-sudo.html</p> <p>\u5b89\u88c5 sssd libsss_sudo \u5c06 <code>/usr/share/doc/sssd-common/sssd-example.conf</code> \u590d\u5236\u5230 <code>/etc/sssd/sssd.conf</code> \u5e76\u4fee\u6539\u6743\u9650\u4e3a 600\u3002</p> <pre><code>[taoky@gateway-nic ~]$ sudo diff /usr/share/doc/sssd-common/sssd-example.conf /etc/sssd/sssd.conf\n3c3\n&lt; services = nss, pam\n---\n&gt; services = nss, pam, sudo\n8c8\n&lt; ; domains = LDAP\n---\n&gt; domains = LDAP\n13a14,15\n&gt; [sudo]\n&gt;\n15,17c17,19\n&lt; ; [domain/LDAP]\n&lt; ; id_provider = ldap\n&lt; ; auth_provider = ldap\n---\n&gt; [domain/LDAP]\n&gt; id_provider = ldap\n&gt; auth_provider = ldap\n22,24c24,27\n&lt; ; ldap_schema = rfc2307\n&lt; ; ldap_uri = ldap://ldap.mydomain.org\n&lt; ; ldap_search_base = dc=mydomain,dc=org\n---\n&gt; ldap_schema = rfc2307\n&gt; ldap_uri = ldaps://ldap.lug.ustc.edu.cn\n&gt; ldap_search_base = dc=lug,dc=ustc,dc=edu,dc=cn\n&gt; ldap_sudo_search_base = ou=sudoers,dc=lug,dc=ustc,dc=edu,dc=cn\n30c33\n&lt; ; cache_credentials = true\n---\n&gt; cache_credentials = true\n35c38\n&lt; # you must install Microsoft Services For UNIX and map LDAP attributes onto\n---\n&gt; # you must install Microsoft Services For Unix and map LDAP attributes onto\n</code></pre> <p>\u5751</p> <p>\u9700\u8981\u52a0\u4e0a <code>[sudo]</code>\uff0c\u5426\u5219 sudo \u914d\u7f6e\u4f3c\u4e4e\u4e0d\u4f1a\u751f\u6548\uff0c\u8fd9\u4e2a\u914d\u7f6e\u95ee\u9898\u5bfc\u81f4\u4e86\u4fee\u6539\u524d\u5728 gateway-nic \u4e0a\u7528\u6237\u65e0\u6cd5\u4f7f\u7528 sudo\u3002</p> <p>\u53e6\u5916\u8bb0\u5f97\u50cf\u524d\u9762\u5728 Debian \u4e2d\u5b89\u88c5\u4ecb\u7ecd\u5230\u7684\u90a3\u6837\u4fee\u6539 <code>/etc/nsswitch.conf</code> \u4ee5\u53ca <code>/etc/nslcd.conf</code>.</p>"},{"location":"infrastructure/ldap/#nscd","title":"NSCD \u4f7f\u7528\u8bf4\u660e","text":"<p>NSCD \u662f\u7528\u4e8e LDAP \u7f13\u5b58\u7684\u670d\u52a1\uff0c\u76ee\u524d\u5728 mirrors \u4e0a\u7684\u914d\u7f6e\u662f\u4fdd\u6301 30 \u5929\u3002\u8fd9\u5bfc\u81f4\u7684\u95ee\u9898\u662f\u6bcf\u5f53 ldap \u670d\u52a1\u5668\u4e0a\u505a\u51fa\u4fee\u6539\u7684\u65f6\u5019\u9700\u8981\u5728 mirrors \u4e0a\u6267\u884c\uff0c\u6e05\u9664\u6307\u5b9a\u7c7b\u578b\u7684\u7f13\u5b58(\u76ee\u524d mirrors \u670d\u52a1\u5668\u6682\u672a\u914d\u7f6e LDAP \u8ba4\u8bc1\u3002)</p> <pre><code>nscd -i passwd\nnscd -i group\n</code></pre> <p>\u53c2\u8003\uff1ahttps://wiki.debian.org/LDAP/NSS</p>"},{"location":"infrastructure/ldap/#ldap-cli","title":"LDAP CLI \u5de5\u5177\u4f7f\u7528\u8bf4\u660e","text":"<p>\u8fd9\u91cc\u4ee5 <code>ldappasswd</code> \u4e3a\u4f8b\uff0c\u5176\u4f59 ldap \u7cfb\u5217\u6307\u4ee4\u4e0e\u5176\u5927\u81f4\u76f8\u540c\uff1a</p> <p>LDAP \u5229\u7528 dn \u6765\u5b9a\u4f4d\u4e00\u4e2a\u7528\u6237\uff0c\u4ee5\u4e0b\u6307\u4ee4\u53ef\u4ee5\u5217\u51fa\u6240\u6709\u7528\u6237\u53ca\u5176 dn\uff1a</p> <pre><code>ldapsearch -x -LLL uid=* uid\n</code></pre> <p><code>-x</code> \u6307\u5b9a\u4f7f\u7528 Simple authentication\uff0c\u5373\u4f7f\u7528\u5bc6\u7801\u8ba4\u8bc1\u3002</p> <p>\u5982\u679c\u8981\u4fee\u6539\u4e00\u4e2a\u7528\u6237\u7684\u5bc6\u7801\uff0c\u4f7f\u7528\uff1a</p> <pre><code>ldappasswd -x -D '&lt;executor dn&gt;' -W -S '&lt;target user dn&gt;'\n</code></pre> <p><code>-D '&lt;executor dn&gt;'</code> \u6307\u5b9a\u4e86\u6267\u884c\u8005\u7684\u8eab\u4efd\uff0c<code>-W</code>/<code>-S</code> \u6307\u5b9a\u4e86\u63a5\u4e0b\u6765\u8be2\u95ee\u6267\u884c\u8005/\u76ee\u6807\u7528\u6237\u7684\u5bc6\u7801/\u65e7\u5bc6\u7801\u3002</p> <p>\u9700\u8981\u989d\u5916\u6ce8\u610f\u7684\u662f\uff0c\u5728 CLI \u4e2d\u6dfb\u52a0/\u5220\u9664\u7528\u6237\u6216\u66f4\u6539\u7528\u6237\u5bc6\u7801\u65f6\u9700\u8981\u4ee5 LDAP admin \u6267\u884c\uff0c\u5426\u5219\u4f1a\u6709\u62a5\u9519\uff1a</p> <pre><code>Insufficient access (50) additional info: no write access to parent\n</code></pre> <p>\u6216\u662f\u5176\u4ed6\u7684\u6743\u9650\u4e0d\u8db3\u7684\u9519\u8bef\u3002</p>"},{"location":"infrastructure/ldap/#_4","title":"\u90e8\u7f72\u60c5\u51b5","text":"<p>\u76ee\u524d\u6240\u6709\u670d\u52a1\u5668\u5747\u5df2\u90e8\u7f72 LDAP</p>"},{"location":"infrastructure/ldap/#ldap-known-gids","title":"\u5df2\u77e5\u7684 GID","text":"<p>GID \u4fe1\u606f\u5df2\u8fc7\u65f6\uff0c\u4ee5 LDAP \u5b9e\u9645\u914d\u7f6e\u4e3a\u51c6\u3002</p> GID \u540d\u79f0 \u8bf4\u660e 2001 ldap_users \u6240\u6709\u7528\u6237\u90fd\u5728\u8fd9\u4e2a\u7ec4\u91cc 1001 ssh_docker2 - 2013 ssh_bbs - 2014 ssh_linode - 2101 ssh_ldap - 2102 ssh_blog - 2103 ssh_dns - 2104 ssh_gitlab - 2105 ssh_lug - 2106 ssh_vpn - 2107 ssh_mirrors - 2108 ssh_pxe - 2109 ssh_freeshell - 2110 ssh_backup - 2112 ssh_vmnfs - 2113 ssh_homepage - 2201 sudo_ldap - 2202 sudo_blog - 2203 sudo_dns - 2204 sudo_gitlab - 2205 sudo_lug - 2206 sudo_vpn - 2207 sudo_mirrors - 2208 sudo_pxe - 2209 sudo_freeshell - 2210 sudo_backup - 2212 sudo_vmnfs - 2213 sudo_homepage - 2000 super_manager - 2999 nologin \u4e0d\u786e\u5b9a\u8fd9\u4e2a\u7ec4\u6709\u6ca1\u6709\u7528 <ul> <li>\u4ece\u4e0a\u6587\u7684\u89c4\u8303\u6765\u8bb2\uff0c\u5e94\u8be5\u4ece 2000 \u5f00\u59cb\u7f16\u53f7 GID\uff0c\u4f46\u6709\u4e9b\u7ec4\u53ef\u80fd\u521b\u5efa\u8005\u6ca1\u6ce8\u610f\uff0c\u4e0d\u8fc7\u540e\u671f\u518d\u6539\u5c31\u4e0d\u65b9\u4fbf\u4e86\u3002</li> <li>ssh_* \u8fd9\u4e9b\u7ec4\uff0c\u662f\u5728\u6bcf\u4e2a\u4e3b\u673a\u7684 sshd_config \u91cc\u53ea\u5141\u8bb8\u76f8\u5e94\u7684\u7ec4\u767b\u9646\u3002</li> <li>sudo_* \u8fd9\u4e9b\u7ec4\uff0c\u662f\u5728 LDAP sudo rules \u91cc\u5141\u8bb8\u4e86\u76f8\u5e94\u7684\u7ec4\u3002</li> </ul> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>LDAP \u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u52a1\u5fc5\u786e\u8ba4 sshd_config \u5df2\u7ecf\u9650\u5236\u4e86\u516c\u7f51\u767b\u5f55\u3002</p> <p>\u672c\u6587\u6863\u539f\u59cb\u7248\u672c\u590d\u5236\u81ea LUG wiki\uff0c\u7531\u5f20\u5149\u5b87\u3001\u5d14\u704f\u3001\u6731\u665f\u83c1\u3001\u5de6\u683c\u975e\u64b0\u5199\u3002</p>"},{"location":"infrastructure/mail/","title":"Mail Agent","text":"<p>\u53ef\u4ee5\u914d\u7f6e\u673a\u5668\u901a\u8fc7 mail.ustclug.org \u53d1\u4ef6\uff0c\u5b9e\u73b0\u8b66\u62a5\u7684\u90ae\u4ef6\u63d0\u9192\uff08\u6536\u4ef6\u4eba\u8bbe\u7f6e\u4e3a alert AT ustclug DOT org\uff09\u3002\u914d\u7f6e\u65f6\u9700\u8981\u5728 mail.s.ustclug.org \u4e0a\u8bbe\u7f6e postfix \u767d\u540d\u5355\u3002</p>"},{"location":"infrastructure/mail/#_1","title":"\u5e38\u7528\u547d\u4ee4","text":"<p>\u4ece\u961f\u5217\u4e2d\u5220\u9664\u90ae\u4ef6\uff1a<code>sudo postsuper -d &lt;\u90ae\u4ef6 ID&gt;</code>\uff08\u90ae\u4ef6 ID \u53ef\u4ee5\u65e5\u5fd7\u4e2d\u770b\u5230\uff09</p> <p>\u66f4\u65b0 <code>virtual</code> \u8868\u6620\u5c04\uff1a<code>sudo postmap /etc/postfix/virtual</code> \u540e\u91cd\u542f <code>postfix</code> \u670d\u52a1\u3002</p>"},{"location":"infrastructure/mail/#mailustclugorg-dkim","title":"mail.ustclug.org \u7684 DKIM \u7b7e\u540d","text":"<p>\u7f16\u8f91 <code>/etc/opendkim/TrustedHosts</code>\uff0c\u6dfb\u52a0\u5185\u90e8\u670d\u52a1\u5bf9\u5e94\u7684 IP\uff08\u6bb5\uff09\u5230\u5176\u4e2d\uff0c\u5e76 reload <code>opendkim</code> \u5373\u53ef\u3002</p>"},{"location":"infrastructure/monitor/","title":"\u76d1\u63a7\u7cfb\u7edf\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e","text":"<p>\u76d1\u63a7\u7cfb\u7edf\u7531\u4ee5\u4e0b\u51e0\u4e2a\u7ec4\u4ef6\u7ec4\u6210\uff1a</p> <ul> <li>Telegraf: agent\uff0c\u8fd0\u884c\u5728\u6bcf\u4e2a\u88ab\u76d1\u63a7\u7684\u673a\u5668\u4e0a</li> <li>InfluxDB: \u6570\u636e\u5e93\uff0c\u8fd0\u884c\u5728 influxdb.ustclug.org (docker2.s.ustclug.org)</li> <li>Grafana: \u53ef\u89c6\u5316\u5de5\u5177\uff0c\u76d1\u63a7\u62a5\u8b66\uff0c\u5730\u5740\uff1amonitor.ustclug.org (docker2.s.ustclug.org)</li> </ul>"},{"location":"infrastructure/monitor/#configure-influxdb","title":"Configure InfluxDB","text":"<p>\u7279\u522b\u6ce8\u610f \uff1aInfluxDB \u9ed8\u8ba4\u6ca1\u6709\u5f00\u542f\u8ba4\u8bc1\u3002</p> <p>\u9996\u6b21\u8fd0\u884c\u65f6\uff0c\u521b\u5efa\u597d\u7ba1\u7406\u8d26\u53f7\uff08<code>admin</code>\uff09\uff0c\u53ea\u8bfb\u8d26\u53f7\uff08<code>grafana</code>\uff09\u548c\u5199\u5165\u8d26\u53f7\uff08<code>telegraf</code>\uff09\u3002</p> <p>\u7136\u540e\u4fee\u6539\u4f4d\u4e8e <code>/srv/docker/influxdb/conf/influxdb.conf</code> \u7684\u914d\u7f6e\uff0c\u4fee\u6539\u4ee5\u542f\u7528\u8ba4\u8bc1\uff1a</p> /srv/docker/influxdb/conf/influxdb.conf<pre><code>[http]\n# ...\n# Determines whether HTTP authentication is enabled.\nauth-enabled = true\n</code></pre> <p>\u6b64\u5916\uff0c\u53c2\u8003 https://docs.influxdata.com/influxdb/v1.8/administration/authentication_and_authorization/#set-up-authentication\uff0c\u8003\u8651\u5173\u95ed\u90e8\u5206\u529f\u80fd\uff1a</p> /srv/docker/influxdb/conf/influxdb.conf<pre><code>[http]\n# Determines whether the pprof endpoint is enabled.  This endpoint is used for\n# troubleshooting and monitoring.\npprof-enabled = false\n</code></pre>"},{"location":"infrastructure/monitor/#install-telegraf","title":"Install telegraf","text":"<p>\u5b98\u65b9\u6587\u6863\u89c1 https://docs.influxdata.com/telegraf/v1/install/</p> <p>\u5178\u578b\u7684\u5b89\u88c5\u65b9\u5f0f\u662f\u4ece APT \u6e90\u5b89\u88c5\uff1a</p> <pre><code>wget -O /etc/apt/trusted.gpg.d/influxdb.asc https://repos.influxdata.com/influxdata-archive_compat.key\necho \"deb https://mirrors.ustc.edu.cn/influxdata/debian bullseye stable\" &gt; /etc/apt/sources.list.d/influxdb.list\napt update\napt install --no-install-recommends telegraf\n</code></pre> \u624b\u52a8\u5b89\u88c5\u65b9\u5f0f\uff08\u4e0d\u63a8\u8350\uff09 <pre><code>wget https://dl.influxdata.com/telegraf/releases/telegraf_1.28.2-1_amd64.deb\nsudo dpkg -i telegraf_1.28.2-1_amd64.deb\n</code></pre>"},{"location":"infrastructure/monitor/#configure-telegraf","title":"Configure telegraf","text":"<p>\u914d\u7f6e\u6587\u4ef6\u5728 ustclug/telegraf-config \u4ed3\u5e93\u4e2d\u7ba1\u7406\uff0c\u4f7f\u7528\u65b9\u6cd5\u5982\u4e0b\uff1a</p> <ul> <li>\u6e05\u7a7a <code>/etc/telegraf/telegraf.conf</code>\uff08\u4f8b\u5982 <code>truncate -s 0</code> \u6216\u8005 <code>:&gt;</code>\uff09</li> <li> <p>\u628a\u4ed3\u5e93 clone \u5230 <code>/etc/telegraf/repo</code>\uff0c\u4f8b\u5982\uff1a</p> <pre><code>mkdir /etc/telegraf/repo\ncd /etc/telegraf/repo\ngit init\ngit branch -M master\n\nssh-keygen -f .git/id_ed25519 -t ed25519 -N ''\ncat .git/id_ed25519.pub\n# Upload the output to https://github.com/ustclug/telegraf-config/settings/keys\ngit config core.sshCommand 'ssh -i .git/id_ed25519'\ngit remote add origin git@github.com:ustclug/telegraf-config.git\ngit pull origin master\ngit branch --set-upstream-to=origin/master master\n</code></pre> </li> <li> <p>\u56de\u5230 <code>/etc/telegraf/telegraf.d</code>\uff0c\u4ece <code>../repo/*.conf</code> \u4e2d\u6309\u9700 symlink \u6587\u4ef6\u8fc7\u6765</p> </li> </ul> <p>\u914d\u7f6e\u5b8c\u6210\u4e4b\u540e\uff0c\u91cd\u542f telegraf \u670d\u52a1\uff0c\u5e76\u786e\u4fdd\u670d\u52a1\u8fd0\u884c\u6b63\u5e38\u3002</p> <pre><code>sudo systemctl restart telegraf\nsudo systemctl status telegraf\n</code></pre> <p>Tip</p> <p>\u5efa\u8bae\u5728\u88ab\u76d1\u63a7\u673a\u5668\u4e0a\u914d\u7f6e NTP\uff08\u53ef\u4ee5\u4f7f\u7528 <code>systemd-timesyncd</code>\uff0c\u8bbe\u7f6e NTP \u670d\u52a1\u5668\u4e3a time.ustc.edu.cn\uff09\uff0c\u4ee5\u907f\u514d\u65f6\u95f4\u4e0d\u540c\u6b65\u53ef\u80fd\u5e26\u6765\u7684\u95ee\u9898\u3002</p>"},{"location":"infrastructure/monitor/#web","title":"Web","text":"<p>Web \u7aef\u76d1\u63a7\u4f4d\u4e8e https://monitor.ustclug.org\uff0c\u8d26\u53f7\u7cfb\u7edf\u4f7f\u7528 LDAP\uff0c\u53ef\u4ee5\u5728\u8fd9\u91cc\u8bbe\u7f6e\u9884\u8b66\u63d0\u793a\u7b49\u3002</p> <p>Warning</p> <p>\u914d\u7f6e InfluxDB \u6570\u636e\u6e90\u65f6\uff0c\u53ea\u80fd\u4f7f\u7528\u53ea\u8bfb\u8d26\u53f7\uff0c\u5426\u5219\u4f1a\u5e26\u6765\u4e25\u91cd\u7684\u5b89\u5168\u95ee\u9898\u3002</p>"},{"location":"infrastructure/monitor/#_2","title":"\u66f4\u65b0\u8bb0\u5f55","text":""},{"location":"infrastructure/monitor/#unified-alerting","title":"\u8fc1\u79fb\u5230 Unified Alerting","text":"<p>Grafana 11 \u8d77\u5c06\u5b8c\u5168\u5220\u9664\u65e7\u7684\u62a5\u8b66\u7cfb\u7edf\uff0c\u5168\u9762\u4f7f\u7528\u65b0\u7684\uff08\u96be\u7528\u7684\uff09Unified Alerting\u3002</p> <p>\u5916\u5356\u539f\u5148\u8fd0\u884c\u7684\u662f Grafana 9.3.8\uff0c\u6839\u636e\u66f4\u65b0\u8bb0\u5f55\uff0c\u53d1\u73b0 v10.4 \u63d0\u4f9b\u4e86\u4e00\u4e2a\u8fc1\u79fb\u5de5\u5177\uff0c\u53ef\u4ee5\u5c06\u539f\u5148\u7684\u62a5\u8b66\u8fc1\u79fb\u5230\u65b0\u7684 Unified Alerting \u7cfb\u7edf\uff0c\u56e0\u6b64\u5148\u5c06 Grafana \u66f4\u65b0\u5230 10.4.3\uff0c\u51c6\u5907\u8fc1\u79fb\u3002</p> <p></p> <p>\u5728 Alerting (legacy) \u83dc\u5355\u4e0b\u6709\u4e2a Upgrade rules \u754c\u9762\uff0c\u70b9\u8fdb\u53bb\u5c31\u53ef\u4ee5\u4f7f\u7528\u8fc1\u79fb\u5411\u5bfc\u3002\u9996\u5148\u8fc1\u79fb\u6211\u4eec\u552f\u4e00\u7684\u4e00\u4e2a Notification Channel\uff0c\u53d8\u6210\u4e00\u4e2a Contact Point\u3002\u7531\u4e8e  \u5783\u573e\u7684\u65b0 alerting \u65b9\u6848\u6ca1\u6709\u63d0\u4f9b\u9ed8\u8ba4\u7684\u6d88\u606f\u6a21\u677f\uff0c\u56e0\u6b64\u6211\u4eec\u9700\u8981\u81ea\u5df1\u5199\u4e00\u4e2a\uff08\u6587\u6863\u4e5f\u6666\u6da9\u96be\u61c2\uff09\u3002</p> Notification template <code>telegram.message</code> <pre><code>{{ define \"alert_list\" -}}\n{{ range . }}[{{ .Labels.alertname }}] {{ .Annotations.description }}\n{{ if or (gt (len .GeneratorURL) 0) (gt (len .SilenceURL) 0) (gt (len .DashboardURL) 0) (gt (len .PanelURL) 0) }}|{{- end }}\n{{- if gt (len .GeneratorURL) 0 }} &lt;a href=\"{{ .GeneratorURL }}\"&gt;Source&lt;/a&gt; | {{- end }}\n{{- if gt (len .SilenceURL) 0 }} &lt;a href=\"{{ .SilenceURL }}\"&gt;Silence&lt;/a&gt; | {{- end }}\n{{- if gt (len .DashboardURL) 0 }} &lt;a href=\"{{ .DashboardURL }}\"&gt;Dashboard&lt;/a&gt; | {{- end }}\n{{- if gt (len .PanelURL) 0 }} &lt;a href=\"{{ .PanelURL }}\"&gt;Panel&lt;/a&gt; | {{- end }}\n{{ end }}\n{{ end }}\n\n{{- define \"telegram.message\" }}\n{{- if gt (len .Alerts.Firing) 0 }}&lt;strong&gt;Firing&lt;/strong&gt;\n{{ template \"alert_list\" .Alerts.Firing }}\n{{ if gt (len .Alerts.Resolved) 0 }}\n{{ end }}\n{{- end }}\n\n{{- if gt (len .Alerts.Resolved) 0 }}&lt;strong&gt;Resolved&lt;/strong&gt;\n{{ template \"alert_list\" .Alerts.Resolved }}\n{{ end }}\n{{- end }}\n</code></pre> <p>\u7136\u540e\u56de\u5230 Contact point \u7f16\u8f91\uff0c\u5c55\u5f00 Optional Telegram settings\uff0c\u5728 Message \u4e2d\u586b\u5165 <code>{{ template \"telegram. Message\" . }}</code> \u6765\u5f15\u7528\u6211\u4eec\u521a\u521a\u5199\u7684\u6a21\u677f\uff0c\u5e76\u5c06 Parse mode \u8bbe\u4e3a HTML\u3002</p> <p>\u63a5\u4e0b\u6765\u56de\u5230\u8fc1\u79fb Alerting \u7684\u5730\u65b9\uff0c\u9010\u4e2a\u8fc1\u79fb Alerting\uff1a</p> <ul> <li>\u70b9\u51fb\u53f3\u8fb9\u7684\u52a0\u53f7\uff0c\u7136\u540e\u70b9\u51fb New alert rule \u4e0b\u9762\u5bf9\u5e94\u7684\u65b0 rule\uff0c\u8fdb\u5165\u7f16\u8f91\u754c\u9762\uff08\u5982\u56fe\uff09\u3002</li> <li>\u68c0\u67e5\u8868\u8fbe\u5f0f A\uff08\u5e94\u8be5\u662f\u4e00\u4e2a InfluxDB query\uff09\uff0c\u786e\u4fdd\u5185\u5bb9\u6b63\u5e38\uff08\u4e00\u822c\u4e0d\u9700\u8981\u4fee\u6539\uff09\u3002<ul> <li>\u53ef\u9009\uff1a\u5c06 query \u7684 Min interval \u8bbe\u7f6e\u4e3a 10s \u6216\u66f4\u957f\u3002</li> </ul> </li> <li>\u89c2\u5bdf\u8868\u8fbe\u5f0f B\uff08\u5e94\u8be5\u662f\u4e00\u4e2a Classic condition\uff09\u7684\u5185\u5bb9\u548c\u53c2\u6570\uff08\u4e00\u822c\u662f <code>avg()</code> \u548c\u4e00\u4e2a\u6570\u503c\uff09\uff0c\u7136\u540e\u628a\u5b83\u5220\u6389</li> <li>\u65b0\u5efa B \u4e3a\u4e00\u4e2a Reduce\uff0c\u9009\u62e9 Input = A\uff0cFunction = Mean\uff08\u6216\u8005 Last\uff0c\u770b\u4e0a\u9762\u539f\u6765\u7684\u51fd\u6570\uff09\uff0cMode \u5927\u591a\u6570\u65f6\u5019\u9700\u8981\u6539\u6210 Drop Non-numeric Values\u3002</li> <li>\u65b0\u5efa C \u4e3a\u4e00\u4e2a Threshold\uff0c\u9009\u62e9 Input = B\uff0c\u5176\u4ed6\u7ee7\u7eed\u53c2\u8003\u539f\u6765\u7684\u8bbe\u7f6e\u3002</li> <li>\u5c06 C \"Set as alert condition\"\uff0c\u5982\u56fe</li> <li>\u5728\u4e0b\u9762\u7684 Evaluation behavior \u4e2d\u628a Folder \u548c Evaluation group \u90fd\u6362\u6210\u9ed8\u8ba4\u503c\uff0c\u5220\u6389\u90a3\u4e2a\u5947\u602a\u7684 label</li> <li>\u5728 Description \u4e2d\u586b\u5165\u4e00\u4e2a\u5408\u9002\u7684\u6a21\u677f\uff08\u89c1\u4e0b\uff09\uff0c\u7136\u540e\u5220\u6389\u90a3\u4e2a\u7a7a\u7684 Custom annotation\uff0c\u4fdd\u5b58\u5373\u53ef</li> </ul> Description \u6a21\u677f <p>\u5728 Go template \u4e2d\u53ef\u7528\u7684\u5e2e\u52a9\u51fd\u6570\u53c2\u89c1 https://grafana.com/docs/grafana/latest/alerting/alerting-rules/templating-labels-annotations/\u3002</p> <pre><code>{{ index $labels \"host\" }}: {{ humanize (index $values \"B\").Value }}\n\n{{ index $labels \"host\" }}: {{ humanizePercentage (index $values \"D\").Value }}\n\n{{ index $labels \"host\" }}: {{ humanizeDuration (index $values \"B\").Value }}\n</code></pre> <p>\u5176\u4e2d <code>index $labels</code> \u540e\u9762\u7684\u53c2\u6570\u53ef\u4ee5\u662f\u524d\u9762 InfluxDB query \u4e2d GROUP BY \u7684 tag\uff0c\u53ef\u4ee5\u7075\u6d3b\u4f7f\u7528\u3002</p> <p>\u624b\u5de5\u5904\u7406\u5b8c\u5168\u90e8 18 \u4e2a alert rules \u4e4b\u540e\uff08\u7d2f\u6b7b\u6211\u4e86\uff09\uff0c\u5c31\u53ef\u4ee5\u5f00\u59cb\u6d4b\u8bd5\u4e86\u3002</p> <p>\u5148\u542f\u7528\u65b0\u7684 unified alerting\uff1a</p> /srv/docker/grafana/conf/grafana.ini<pre><code>[alerting]\nenabled = false\n\n[unified_alerting]\nenabled = true\n\n[unified_alerting.screenshots]\ncapture = true\n</code></pre> <p>\u7136\u540e\u627e\u4e2a\u673a\u5668\u91cd\u542f\u4e00\u4e0b\uff0c\u89e6\u53d1 Reboot alert\uff0c\u53bb Telegram \u7fa4\u91cc\u770b\u6d88\u606f\u548c\u56fe\u7247\u90fd\u6b63\u786e\u5192\u51fa\u6765\u4e86\uff0c\u5c31\u8bf4\u660e\u8fc1\u79fb\u6210\u529f\u4e86\u3002</p> <p>Test alert \u4e0d\u4f1a\u89e6\u53d1\u622a\u56fe\uff0c\u5373\u4f7f\u8bbe\u7f6e\u4e86 Link dashboard and panel \u4e5f\u6ca1\u7528</p>"},{"location":"infrastructure/office/","title":"Office 365","text":""},{"location":"infrastructure/office/#application","title":"\u7533\u8bf7\u65b9\u5f0f","text":"<p>\u7406\u8bba\u4e0a\u4efb\u4f55\u793e\u56e2\u8d1f\u8d23\u4eba\u6216\u8005\u5728\u793e\u56e2\u4e2d\u8d1f\u8d23\u91cd\u8981\u9879\u76ee\u7684\u4eba\u5458\u90fd\u53ef\u4ee5\u7533\u8bf7\uff0c\u539f\u5219\u662f\u6309\u9700\u5206\u914d\uff0c\u56e0\u4e3a\u90ae\u7bb1\u662f\u5de5\u4f5c\u5de5\u5177\uff0c\u800c\u4e0d\u662f\u798f\u5229\u8d44\u6e90\u3002</p> <p>\u540c\u7406\uff0c\u4e0d\u518d\u62c5\u4efb\u8d1f\u8d23\u4eba\u4e14\u4e0d\u518d\u5904\u7406\u4e8b\u52a1\u7684\u540c\u5b66\u4f7f\u7528\u7684\u90ae\u7bb1\u5e94\u8be5\u6536\u56de\uff08\u89c1\u4e0b\u65b9 \u9ed8\u8ba4\u5730\u5740 \u4e00\u8282\uff09\u3002</p>"},{"location":"infrastructure/office/#email-etiquette","title":"\u90ae\u4ef6\u793c\u4eea","text":"<p>CC\uff08\u6284\u9001\uff09\u548c\u8bbe\u7f6e\u56de\u590d\u5730\u5740\u7684\u76ee\u7684\u90fd\u662f\u4e3a\u4e86\u8ba9\u6240\u6709 LUG \u8d1f\u8d23\u7684\u540c\u5b66\u53ef\u4ee5\u770b\u5230\u4e8b\u4ef6\u6700\u65b0\u7684\u8fdb\u5c55</p> <p>\u6284\u9001\u4f1a\u628a\u4f60\u53d1\u7684\u90ae\u4ef6\u7ed9\u6240\u6709\u7684\u8d1f\u8d23\u4eba\uff1b\u56de\u590d\u5730\u5740\uff08Reply-To\uff09\u8bbe\u7f6e\u4e4b\u540e\uff0c\u5bf9\u65b9\u5c31\u77e5\u9053\u8fd9\u662f\u4f60\u4ee3\u8868 LUG \u5199\u7684\u90ae\u4ef6\uff0c\u5e76\u4e14\u9ed8\u8ba4\u56de\u590d\u90ae\u4ef6\u7684\u65f6\u5019\u5730\u5740\u5c31\u662f\u6240\u6709\u8d1f\u8d23\u4eba\u7684\u90ae\u4ef6\u5217\u8868\u3002\u6240\u4ee5\u4e0b\u6587\u4e2d\u8981\u6c42\u8bbe\u7f6e\u8fd9\u4e9b\u5185\u5bb9\u3002</p> <p>\u5982\u679c\u9047\u5230\u9700\u8981\u4ee5\u79c1\u4eba\u8eab\u4efd\uff0c\u6216\u8005\u4ee5\u5176\u4ed6\u975e LUG \u4ee3\u8868\u8d1f\u8d23\u4eba\u7684\u8eab\u4efd\u56de\u590d\u90ae\u4ef6\u7684\u573a\u5408\uff0c\u8bf7\u4fee\u6539\u56de\u590d\u5730\u5740\u4fe1\u606f\u3002\u56e0\u4e3a Outlook \u7f51\u9875\u7248\u4e0d\u4fbf\u4e8e\u4fee\u6539\u8fd9\u4e9b\u5185\u5bb9\uff0c\u5efa\u8bae\u4f7f\u7528\u90ae\u4ef6\u5ba2\u6237\u7aef\u5904\u7406\u3002\uff08\u4e2a\u4eba\u63a8\u8350 ThunderBird\uff09\u3002</p> <p>\u5bf9\u4e8e\u9700\u8981\u5411\u975e\u90ae\u4ef6\u5217\u8868\u7684\u4e0d\u7279\u5b9a\u7fa4\u4f53\u7fa4\u53d1\u7684\u90ae\u4ef6\uff08\u4f8b\u5982\u901a\u77e5\u7c7b\u6d88\u606f\uff09\uff0c\u8bf7\u6ce8\u610f\u4e0d\u8981\u5c06\u6240\u6709\u90ae\u7bb1\u90fd\u653e\u5728\u6536\u4ef6\u4eba\u91cc\uff0c\u5426\u5219\u6240\u6709\u6536\u5230\u90ae\u4ef6\u7684\u4eba\u90fd\u80fd\u770b\u5230\u5176\u4ed6\u6536\u4ef6\u4eba\u7684\u90ae\u7bb1\uff08\u9690\u79c1\u95ee\u9898\uff09\uff1b\u5e76\u4e14\u6536\u4ef6\u4eba\u5982\u679c\u56de\u590d\u90ae\u4ef6\u4e0d\u5f53\uff0c\u5176\u4ed6\u7684\u6536\u4ef6\u4eba\u4e5f\u4f1a\u6536\u5230\u5176\u56de\u590d\u3002\u4e00\u79cd\u65b9\u4fbf\u7684\u505a\u6cd5\u662f\uff1a\u5c06\u6240\u6709\u9700\u8981\u6536\u5230\u901a\u77e5\u7684\u6536\u4ef6\u4eba\u653e\u5728\u5bc6\u9001 (BCC)\u4e00\u680f\u4e2d\uff0c\u6536\u4ef6\u4eba\u586b\u5199\u539f\u6284\u9001\u5730\u5740\u3002</p> <p>\u6211\u4eec\u52a0\u5165\u4e86\u5f88\u591a\u90ae\u4ef6\u5217\u8868\uff0c\u5176\u4e2d\u7ecf\u5e38\u6709\u5404\u79cd\u5f80\u6765\u90ae\u4ef6\uff08\u7279\u522b\u662f CentOS mirror announcement \u8fd9\u4e2a\u5217\u8868\uff0c\u5df2\u9000\uff09\uff0c\u5b83\u4eec\u5927\u591a\u6570\u4e0d\u9700\u8981\u6211\u4eec\u7406\u4f1a\u3002</p> <p>\u603b\u4e4b\uff0c\u4e0d\u77e5\u9053\u600e\u4e48\u5904\u7406\u7684\u90ae\u4ef6\u4e0d\u8981\u8d38\u7136\u56de\u590d\u3002\u5982\u679c\u4f60\u8ba4\u4e3a\u67d0\u4e00\u5c01\u90ae\u4ef6\u9700\u8981\u6211\u4eec\u5904\u7406\u4f46\u4e0d\u77e5\u9053\u600e\u4e48\u5904\u7406\uff0c\u8bf7\u8f6c\u544a\u7ed9\u5176\u4ed6\u76f8\u5173\u540c\u5b66\u3002</p> <p>\u4ee5\u4e0b\u5185\u5bb9\u4ece Hypercube \u7f16\u5199\u7684\u5185\u5bb9\u4e2d\u622a\u53d6\uff1a</p> <p>\u56de\u590d\u4efb\u4f55\u90ae\u4ef6\u65f6\uff0c\u8bf7\u6284\u9001 / CC\uff08\u4e0d\u662f\u5bc6\u9001 / BCC\uff09\u7ed9\u539f\u90ae\u4ef6\u7684\u6536\u4ef6\u5730\u5740\uff01\uff08\u6bd4\u5982\u522b\u4eba\u53d1\u5230 <code>lug A ustc.edu.cn</code>\uff0c\u56de\u590d\u65f6\u4e5f\u8bf7 CC \u5230 <code>lug A ustc.edu.cn</code>\uff09</p> <p>\u8bf7\u4e0d\u8981\u201c\u53ea\u56de\u590d\u90ae\u4ef6\u201d\u3002\u5982\u679c\u5728\u56de\u590d\u4e2d\u8bf4\u201c\u6211\u4eec\u4f1a\u505a\u67d0\u67d0\u4e8b\u201d\uff0c\u8bf7\u6ce8\u610f\u9664\u975e\u4f60\u660e\u786e\u8f6c\u4ea4\u7ed9\u4e86\u522b\u4eba\uff0c\u8fd9\u4ef6\u4e8b\u5e94\u5f53\u7531\u4f60\u6765\u5b8c\u6210\u3002</p>"},{"location":"infrastructure/office/#email-signature","title":"\u90ae\u4ef6\u7b7e\u540d","text":"<p>Outlook \u65e0\u6cd5\u76f4\u63a5\u901a\u8fc7\u7f51\u9875\u7aef\u6dfb\u52a0\u53d1\u4ef6\u4eba\u540d\u79f0\u3001\u8bbe\u7f6e\u56de\u590d\u5730\u5740\uff0c\u56e0\u6b64\u53ea\u80fd\u901a\u8fc7\u90ae\u4ef6\u5ba2\u6237\u7aef\u8fdb\u884c\u4f7f\u7528\u3002\u5728\u4e0b\u4e00\u7ae0\u8282\u7684 Thunderbird \u4e2d\u8fdb\u884c\u8be6\u7ec6\u9610\u8ff0\u3002</p>"},{"location":"infrastructure/office/#thunderbird","title":"Thunderbird \u914d\u7f6e","text":""},{"location":"infrastructure/office/#tb-login","title":"\u767b\u5f55","text":"<p>\u5728\u767b\u5f55\u65f6\uff0c\u8f93\u5165\u4e86\u7528\u6237\u540d\u3001\u5bc6\u7801\u540e\uff0c\u4f1a\u663e\u793a\u65e0\u6cd5\u627e\u5230\u5bf9\u5e94\u7684\u90ae\u7bb1\u914d\u7f6e</p> <p></p> <p>\u8fdb\u884c\u5982\u4e0b\u7684\u624b\u52a8\u914d\u7f6e\uff1a</p> <ul> <li>Incoming Server<ul> <li>Hostname: <code>outlook.office365.com</code></li> <li>Port: 993</li> <li>Connection security: SSL/TLS</li> <li>Authentication: Autodetect</li> </ul> </li> <li>Outgoing server<ul> <li>Hostname: <code>smtp.office365.com</code></li> <li>Port: 587</li> <li>Connection security: STARTTLS</li> <li>Authentication: Autodetect</li> </ul> </li> </ul> <p>\u5982\u4e0b\u56fe\uff1a</p> <p></p> <p>\u7136\u540e\u70b9\u5de6\u4e0b\u89d2\u7684 Re-test\uff0c\u91cd\u65b0\u641c\u7d22\u5230\u914d\u7f6e\u540e\uff0c\u5728\u4e24\u4e2a Authentication method \u4e2d\u5747\u9009\u62e9 OAuth2\u3002</p> <p></p> <p>\u7136\u540e\u70b9 Done\u3002\u5728\u5f39\u51fa\u7684\u7a97\u53e3\u4e2d\u5b8c\u6210\u8ba4\u8bc1\u3002</p>"},{"location":"infrastructure/office/#tb-signature","title":"\u7b7e\u540d\u4e0e\u53d1\u4ef6\u8eab\u4efd","text":"<p>\u5728\u53f3\u4e0a\u89d2\u4e2d\u9009\u62e9\u8d26\u6237\u8bbe\u7f6e\uff0c\u5728\u9ed8\u8ba4\u8eab\u4efd\u4e2d</p> <ul> <li>\u4fee\u6539 Your Name (\u60a8\u7684\u59d3\u540d) \u4e3a <code>Zeyu Gao on behalf of USTC LUG</code>\uff08\u8bf7\u6362\u6210\u81ea\u5df1\u7684\u540d\u5b57\uff09</li> <li>\u4fee\u6539 Reply-to Address (\u56de\u590d\u5730\u5740) \u4e3a <code>lug@ustc.edu.cn</code></li> <li> <p>\u4fee\u6539 Signature text (\u7b7e\u540d\u6587\u5b57) \u4e3a\uff08\u6700\u540e\u4e00\u884c\u6362\u6210\u81ea\u5df1\u7684\u4fe1\u606f\uff09</p> <pre><code>Linux User Group\nUniversity of Science and Technology of China\nHomepage: https://lug.ustc.edu.cn/\nE-Mail: lug@ustc.edu.cn\nZeyu Gao (\u9ad8\u6cfd\u8c6b) &lt;zeyugao@ustclug.org&gt;\n</code></pre> </li> </ul> <p>\u7ed3\u679c\u5982\u56fe\uff1a</p> <p></p>"},{"location":"infrastructure/office/#tb-cc","title":"\u6284\u9001\u8bbe\u7f6e","text":"<p>\u5728\u8d26\u6237\u8bbe\u7f6e\u4e2d\uff0c\u9009\u62e9\u8eab\u4efd\u7ba1\u7406\uff0c\u70b9\u51fb\u7f16\u8f91\uff0c\u9009\u62e9 Copies and Folders, \u542f\u7528 Cc these email addresses, \u5e76\u8f93\u5165\u9ed8\u8ba4\u6284\u9001\u5730\u5740 <code>lug A ustc.edu.cn</code></p> <p></p>"},{"location":"infrastructure/office/#html","title":"HTML\u4e0e\u7eaf\u6587\u672c","text":"<p>\u90ae\u4ef6\u53ef\u4ee5\u4ee5 HTML \u65b9\u5f0f\u7f16\u5199\uff0c\u4e5f\u53ef\u4ee5\u53ea\u662f\u7eaf\u6587\u672c\u5185\u5bb9\u3002\u4e3a\u4e86\u964d\u4f4e\u5bf9\u65b9\u9605\u8bfb\u51fa\u73b0\u9ebb\u70e6\u7684\u53ef\u80fd\u6027\uff0c\u5efa\u8bae\u4f7f\u7528\u7eaf\u6587\u672c\u6d88\u606f\u3002\u4f7f\u7528\u7eaf\u6587\u672c\u6d88\u606f\u7684\u65b9\u6cd5\u662f\uff1a\u6253\u5f00 Thunderbird \u8bbe\u7f6e \uff0c\u6253\u5f00 Account Settings \uff0c\u6253\u5f00\u5bf9\u5e94\u90ae\u4ef6\u5730\u5740\u4e0b\u7684 Composition &amp; Addressing \u9875\u9762\uff0c\u5728 Composition \u8282\u4e0b\u627e\u5230 Compose messages in HTML format \uff0c\u5c06\u5176\u590d\u9009\u6846\u53bb\u9664\u52fe\u9009\u5373\u53ef\u3002</p> <p></p>"},{"location":"infrastructure/office/#tb-folders","title":"\u6587\u4ef6\u5939","text":"<p>Thunderbird \u7ef4\u62a4\u4e86\u81ea\u5df1\u7684\u6587\u4ef6\u5939\uff0c\u5982\u679c\u9700\u8981\u4e0e\u4e91\u7aef\u7684\u6587\u4ef6\u5939\u540c\u6b65\uff0c\u53ef\u4ee5\u8fdb\u884c\u5982\u4e0b\u64cd\u4f5c</p> <p>\u5728\u8d26\u6237\u4e0a\u53f3\u952e\uff0c\u5728\u5f39\u51fa\u7684\u83dc\u5355\u4e2d\u70b9\u51fb Subscribe\u3002\u5f39\u51fa\u7684\u7a97\u53e3\u4e2d\u5305\u542b\u4e86\u4e91\u7aef\u7684\u6587\u4ef6\u5939\uff0c\u7531\u4e8e Thunderbird \u4f1a\u81ea\u884c\u7ef4\u62a4\u5783\u573e\u7bb1\u548c\u5df2\u53d1\u90ae\u4ef6\uff0c\u56e0\u6b64\u53ef\u80fd\u4f1a\u6709\u4e24\u4e2a\u5783\u573e\u7bb1\uff0cDeleted Items \u548c Trash\uff0c\u53ef\u4ee5\u5728\u7f51\u9875\u7aef\u5220\u9664\u4e0d\u9700\u8981\u7684\u6587\u4ef6\u5939\uff0c\u5e76\u5728 Thunderbird \u4e2d\u9009\u62e9\u9700\u8981\u7684\u3002</p> <p></p> <p>\u7136\u540e\u6253\u5f00\u8d26\u6237\u8bbe\u7f6e\uff0c\u8fdb\u884c\u5982\u4e0b\u4fee\u6539</p> <ol> <li> <p>\u5728 Server Settings \u4e0b\uff0c\u4fee\u6539 When I delete a message \u4e3a Move it to this folder: Deleted Items</p> <p></p> </li> <li> <p>\u5728 Copies &amp; Folders \u4e0b\uff0c\u4fee\u6539 Place a copy\u3001Keep message archives in\u3001Keep draft messages in \u4e3a\u5bf9\u5e94\u7684\u8fdc\u7aef\u670d\u52a1\u5668\u6587\u4ef6\u5939</p> <p></p> </li> </ol>"},{"location":"infrastructure/office/#tb-junk","title":"\u5783\u573e\u90ae\u4ef6","text":"<p>Outlook \u4e91\u7aef\u5df2\u7ecf\u5e26\u6709\u4e86\u5783\u573e\u90ae\u4ef6\u5206\u7c7b\u529f\u80fd\uff0c\u4e0d\u9700\u8981 Thunderbird \u81ea\u5df1\u7684\u5783\u573e\u90ae\u4ef6\u5206\u7c7b\u529f\u80fd\u3002</p> <p>\u5728\u8d26\u6237\u8bbe\u7f6e\u7684 Local Folders \u4e0b\u7684 Junk Settings \u4e2d\uff0c\u53d6\u6d88\u9009\u4e2d Enable adaptive junk mail controls for this account\u3002</p> <p>\u8bf7\u5728\u4e0a\u9762\u7684 Subscribe \u4e2d\u5c06\u5783\u573e\u90ae\u4ef6\u9009\u4e2d\u4ee5\u540c\u6b65\u3002\u6b64\u5916\uff0c\u7531\u4e8e Outlook \u76ee\u524d\u4f1a\u5c06\u51e0\u4e4e\u6240\u6709\u90ae\u4ef6\u90fd\u6254\u8fdb\u5783\u573e\u90ae\u4ef6\u7bb1\uff08\u539f\u56e0\u4f3c\u4e4e\u662f M365 \u7684\u673a\u5668\u5b66\u4e60\u6a21\u578b\u4f1a\u628a\u6240\u6709\u79d1\u5927\u7684\u90ae\u4ef6\u6254\u8fdb\u5783\u573e\u7bb1\uff09\uff0c\u56e0\u6b64\u8bbe\u7f6e\u62c9\u53d6\u90ae\u4ef6\u65f6\u603b\u662f\u68c0\u67e5\u5783\u573e\u90ae\u4ef6\u7bb1\u3002\u8bbe\u7f6e\u65b9\u6cd5\u4e3a\u5728\u5783\u573e\u90ae\u4ef6\u76ee\u5f55\u4e0a\u70b9\u51fb\u53f3\u952e \u2192 \u5c5e\u6027\uff0c\u7136\u540e\u9009\u62e9\u8fd9\u91cc\u7b2c\u4e8c\u4e2a\u52fe\uff1a</p> <p></p> <p>\u6ce8\u610f</p> <p>\u4e0d\u8981\u67e5\u770b\u5783\u573e\u90ae\u4ef6\u7684\u8fdc\u7a0b\u5185\u5bb9\u3002\u4e0d\u8981\u56de\u590d\u5783\u573e\u90ae\u4ef6\u3002\u6b63\u5e38\u90ae\u4ef6\u9700\u8981\u624b\u52a8\u79fb\u52a8\u5230\u6536\u4ef6\u7bb1\u3002</p>"},{"location":"infrastructure/office/#tb-profiles","title":"\u4f7f\u7528 Thunderbird \u914d\u7f6e\u4e0d\u540c\u7684\u8eab\u4efd","text":"<p>(written by taoky)</p> <p>\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u9700\u8981\u8bbe\u7f6e\u65b0\u7684\u53d1\u4ef6\u4eba\u540d\u79f0\u548c\u56de\u590d\u5730\u5740\uff08\u4f8b\u5982 hackergame staff \u9700\u8981\u4e00\u5957\u4e0d\u540c\u7684\u8bbe\u7f6e\uff09\u3002\u7531\u4e8e Gmail \u7f51\u9875\u7aef\u4fee\u6539\u914d\u7f6e\u5f88\u9ebb\u70e6\uff08\u800c\u4e14\u5f88\u5bb9\u6613\u5fd8\u8bb0\u6539\u56de\u6765\uff09\uff0c\u5f3a\u70c8\u5efa\u8bae\u4f7f\u7528\u90ae\u4ef6\u5ba2\u6237\u7aef\u3002\u4e2a\u4eba\u4f7f\u7528\u7684\u662f Thunderbird\uff0c\u4e0b\u9762\u4e5f\u4ee5\u5b83\u4e3a\u4f8b\u5b50\u3002</p> <p>\u5728\u8d26\u53f7\u52a0\u4e0a\u90ae\u7bb1\u4e4b\u540e\uff0c\u70b9\u51fb\u53f3\u952e \u2192 \u5c5e\u6027\uff0c\u9ed8\u8ba4\u914d\u7f6e\uff08LUG Staff\uff09\u5982\u56fe\uff1a</p> <p></p> <p>\u9700\u8981\u6dfb\u52a0\u65b0\u8eab\u4efd\u65f6\uff0c\u70b9\u51fb\u53f3\u4e0b\u89d2\u300c\u7ba1\u7406\u6807\u8bc6\u300d\uff0c\u6dfb\u52a0\u5bf9\u5e94\u7684\u6807\u8bc6\u3002\u5bf9\u4e8e hackergame\uff0c\u53ef\u4ee5\u914d\u7f6e\u5982\u4e0b\uff1a</p> <p></p> <p>\u5e76\u53c2\u8003\u6284\u9001\u8bbe\u7f6e \u914d\u7f6e\u9ed8\u8ba4\u6284\u9001\u5730\u5740 (<code>hackergame A ustclug.org</code>)</p> <p>\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u5728\u7f16\u5199\u90ae\u4ef6\u65f6\uff0c\u5c31\u53ef\u4ee5\u9009\u62e9\u65b0\u7684\u6807\u8bc6\u4e86\uff0c\u5e76\u4e14\u53d1\u4ef6\u4eba\u540d\u79f0\u3001\u56de\u590d\u5730\u5740\u548c\u7b7e\u540d\u90fd\u4f1a\u81ea\u52a8\u8bbe\u7f6e\u597d\u3002</p> \u4f7f\u7528 Thunderbird \u914d\u7f6e\u5b66\u6821\u90ae\u7bb1\u9700\u8981\u7684\u989d\u5916\u8bbe\u7f6e <p>james: \"thunderbird\u67d0\u6b21\u5347\u7ea7\u540e\u51fa\u4e86\u4e00\u4e2abug\uff0c\u8fde\u63a5\u65f6\u670d\u52a1\u5668\u8fd4\u56de\u652f\u6301utf8\uff0ctb\u53d1\u4e86\u4e00\u4e2a\u547d\u4ee4enable utf8\uff0c\u670d\u52a1\u5668\u6b63\u5e38\u8fd4\u56de\u540e\uff0ctb\u6709bug\u8ba4\u4e3a\u4e00\u76f4\u5728\u7b49\u670d\u52a1\u5668\u5e94\u7b54\u3002\"</p> <p>\u6240\u4ee5\u5982\u679c\u9700\u8981\u4f7f\u7528 Thunderbird \u4ece mail.ustc.edu.cn \u6536\u53d1\u90ae\u4ef6\uff0c\u9700\u8981\u505a\u4ee5\u4e0b\u7684\u914d\u7f6e\uff1aEdit -&gt; Settings\uff0c\u5728 \"General\" \u4e2d\u62d6\u5230\u6700\u4e0b\u9762\u9009\u62e9 \"Config Editor...\"\u3002\u5728\u65b0\u5f39\u51fa\u7684\u9ad8\u7ea7\u914d\u7f6e\u7684\u6807\u7b7e\u4e2d\u8f93\u5165 utf8\uff0c\u5c06 <code>mail.server.default.allow_utf8_accept</code> \u7684\u503c\u4ece true \u6539\u6210 false\u3002\u8fd9\u4e2a\u8bbe\u7f6e\u4e0d\u4f1a\u5f71\u54cd\u5176\u4ed6\u90ae\u7bb1\u7684\u4f7f\u7528\u3002</p>"},{"location":"infrastructure/office/#gmail","title":"Gmail","text":"<p>Warning</p> <p>\u7531\u4e8e Google \u5c06 G Suite \u5168\u9762\u8f6c\u5411\u4ed8\u8d39\u670d\u52a1\uff0c\u6211\u4eec\u5df2\u5728 2022 \u5e74 3 \u6708 31 \u65e5\u540e\u505c\u6b62\u4f7f\u7528 G Suite \u76f8\u5173\u670d\u52a1\u3002\u8f6c\u5411 Office 365 \u63d0\u4f9b\u7684\u670d\u52a1\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u4e3a\u5b58\u6863\u4e0e\u53c2\u8003</p> <p>\u4ee5\u4e0b\u539f\u6587\u7531 Hypercube \u7f16\u5199</p> <p>\u5927\u5bb6\u597d\uff0c</p> <p>\u8bf7\u5404\u4f4d\u9605\u8bfb\u4e0b\u65b9\u5185\u5bb9\uff0c\u5e76\u6309\u6307\u793a\u914d\u7f6e\u81ea\u5df1\u7684\u90ae\u7bb1\uff1a</p> <p>\u767b\u5f55\u7f51\u9875\u7248 Gmail\uff0c\u5728\u53f3\u4e0a\u89d2\u70b9\u5f00\u8bbe\u7f6e\uff0c\u4e8e\u201c\u5e38\u89c4\u201d\u6807\u7b7e\u9875\u4e2d\u8bbe\u7f6e\u201c\u7b7e\u540d\u201d\u4e3a\u7eaf\u6587\u672c\u5982\u4e0b\u5185\u5bb9\uff08\u5171 5 \u884c\uff0c\u5c06\u6700\u540e\u4e00\u884c\u6362\u6210\u81ea\u5df1\u7684\u4fe1\u606f\uff09\uff1a</p> <p>Linux User Group University of Science and Technology of China Homepage: https://lug.ustc.edu.cn/ E-Mail: lug@ustc.edu.cn Zibo Wang (\u738b\u5b50\u535a) &lt;example@ustclug.org&gt;</p> <p>\u4e8e\u201c\u8d26\u53f7\u201d\u6807\u7b7e\u9875\u4e2d\u201c\u7528\u8fd9\u4e2a\u5730\u5740\u53d1\u9001\u90ae\u4ef6\u201d\u5185\u70b9\u201c\u4fee\u6539\u4fe1\u606f\u201d\uff0c\u5728\u5f39\u51fa\u7a97\u53e3\u4e2d\u8f93\u5165\u540d\u79f0\u201cZibo Wang on behalf of USTC LUG\u201d\uff08\u8bf7\u6362\u6210\u81ea\u5df1\u7684\u540d\u5b57\uff09\uff0c\u8f93\u5165\u56de\u590d\u5730\u5740\u201c<code>lug@ustc.edu.cn</code>\u201d\u3002</p> <p>\u8fd8\u53ef\u4ee5\u89c6\u81ea\u5df1\u9700\u8981\u5728\u201c\u8f6c\u53d1\u548c POP / IMAP\u201d\u6807\u7b7e\u9875\u4e2d\u914d\u7f6e\u81ea\u52a8\u8f6c\u53d1\uff0c\u4f46\u8bf7\u6ce8\u610f\uff0c\u5982\u679c\u4f60\u914d\u7f6e\u4e86\u8f6c\u53d1\u5230\u81ea\u5df1\u7684\u5e38\u7528\u90ae\u7bb1\uff0c\u8bf7\u4e0d\u8981\u76f4\u63a5\u4ece\u5e38\u7528\u90ae\u7bb1\u56de\u590d\u90ae\u4ef6\uff0c\u800c\u5e94\u8be5\u767b\u5f55 LUG \u90ae\u7bb1\u56de\u590d\u3002 \u56de\u590d\u4efb\u4f55\u90ae\u4ef6\u65f6\uff0c\u8bf7\u6284\u9001 / CC\uff08\u4e0d\u662f\u5bc6\u9001 / BCC\uff09\u7ed9\u539f\u90ae\u4ef6\u7684\u6536\u4ef6\u5730\u5740\uff01\uff08\u6bd4\u5982\u522b\u4eba\u53d1\u5230 lug A ustc.edu.cn \uff0c\u56de\u590d\u65f6\u4e5f\u8bf7 CC \u5230 lug A ustc.edu.cn\uff09</p> <p>\u8bf7\u4e0d\u8981\u201c\u53ea\u56de\u590d\u90ae\u4ef6\u201d\u3002\u5982\u679c\u5728\u56de\u590d\u4e2d\u8bf4\u201c\u6211\u4eec\u4f1a\u505a\u67d0\u67d0\u4e8b\u201d\uff0c\u8bf7\u6ce8\u610f\u9664\u975e\u4f60\u660e\u786e\u8f6c\u4ea4\u7ed9\u4e86\u522b\u4eba\uff0c\u8fd9\u4ef6\u4e8b\u5e94\u5f53\u7531\u4f60\u6765\u5b8c\u6210\u3002</p> <p>\u5728\u6dfb\u52a0\u4e86\u7b7e\u540d\u540e\uff0c\u5728\u4e0b\u9762\u7684\u201c\u9ed8\u8ba4\u7b7e\u540d\u8bbe\u7f6e\u201d\u4e2d\uff0c\u5c06\u201c\u7528\u4e8e\u65b0\u7535\u5b50\u90ae\u4ef6\u201d\u4ee5\u53ca\u201c\u7528\u4e8e\u56de\u590d/\u8f6c\u53d1\u201d\u5747\u9009\u62e9\u4e3a\u4e0a\u9762\u6dfb\u52a0\u7684\u7b7e\u540d\u3002</p> <p>\u8bb0\u5f97\u6eda\u52a8\u5230\u9875\u9762\u6700\u4e0b\u65b9\u70b9\u51fb\u201c\u4fdd\u5b58\u9875\u9762\u201d\uff01</p>"},{"location":"infrastructure/office/#lug-ustc-mailing-list","title":"\u52a0\u5165 lug @ ustc \u5217\u8868","text":"<p>\u672c\u8282\u5199\u7684\u662f G Suite \u7528\u6cd5\uff0c\u9700\u8981\u66f4\u65b0\u6210 Office 365</p> <p>\u82e5\u8981\u6536\u5230\u53d1\u5f80 lug A ustc.edu.cn \u7684\u90ae\u4ef6\uff0c\u9700\u8981\u5728 \u7fa4\u7ec4\u7ba1\u7406 \u8fd9\u91cc\u5c06\u7528\u6237\u52a0\u5165 USTC LUG Staff \u7ec4\u3002\u8fd9\u4e2a\u7fa4\u7ec4\u5c31\u662f lug \u548c mirrors \u5728\u5b66\u6821\u90ae\u7bb1\u8bbe\u7f6e\u7684\u8f6c\u53d1\u76ee\u6807\u3002</p>"},{"location":"infrastructure/office/#default-route","title":"\u8bbe\u7f6e\u9ed8\u8ba4\u5730\u5740","text":"<p>\u672c\u8282\u5199\u7684\u662f G Suite \u7528\u6cd5\uff0c\u9700\u8981\u66f4\u65b0\u6210 Office 365</p> <p>G Suite \u652f\u6301\u5c06\u5355\u4e2a\u5730\u5740\u8bbe\u4e3a\u201c\u9ed8\u8ba4\u5730\u5740\u201d\uff0c\u7528\u4e8e\u63a5\u53d7\u53d1\u5f80\u4e0d\u5b58\u5728\u7684\u5730\u5740\u7684\u90ae\u4ef6\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1ahttps://support.google.com/a/answer/2368153</p> <p>\u5bf9\u4e8e\u4e2d\u6587\u754c\u9762\uff0c\u5e94\u8be5\u4ece Google Admin \u63a7\u5236\u53f0\u6309\u987a\u5e8f\u9009\u62e9 \u5e94\u7528 \u2192 G Suite \u2192 Gmail \u2192 \u9ad8\u7ea7\u8bbe\u7f6e\uff0c\u5176\u4e2d\u7684 \u65e0\u9650\u522b\u540d\u5730\u5740 \u5c31\u662f\u8fd9\u4e2a\u9009\u9879\uff0c\u4e00\u822c\u53d1\u7ed9\u4f1a\u957f\u6216 CTO\u3002</p>"},{"location":"infrastructure/raid/","title":"RAID","text":""},{"location":"infrastructure/raid/#megaraid","title":"MegaRAID \u5e38\u7528\u547d\u4ee4","text":"<p>MegaRAID \u6e90\u91cc\u6ca1\u6709\uff0c\u9700\u8981\u4ece\u5b98\u7f51\u4e0b\u8f7d RPM \u5305\u540e\u624b\u52a8\u89e3\u538b\u3002Debian 10 \u5b89\u88c5 libncurses5 \u540e\u53ef\u4f7f\u7528\u3002</p> <pre><code>sudo /opt/MegaRAID/MegaCli/MegaCli64 -adpallinfo -aAll  # \u67e5\u770b\u6240\u6709\u4fe1\u606f\nsudo /opt/MegaRAID/MegaCli/MegaCli64 -pdlist -aall  # \u67e5\u770b\u7269\u7406\u76d8\u4fe1\u606f\n</code></pre>"},{"location":"infrastructure/raid/#_1","title":"\u76d1\u63a7","text":"<p>\u73b0\u5728\u90e8\u7f72\u7684\u65b9\u6848\u662f\u7531 telegraf \u6267\u884c\u89e3\u6790\u811a\u672c\uff0c\u5c06\u6570\u636e\u53d1\u9001\u5230 influxdb\uff0c\u7531 grafana \u62a5\u8b66\u3002</p> <p>\u811a\u672c\uff1a</p> <ul> <li>\u89e3\u6790 megacli &amp; storcli https://github.com/taoky/raid-telegraf</li> <li>\u89e3\u6790 zpool https://github.com/taoky/telegraf-exec-zpool-status/releases</li> </ul>"},{"location":"infrastructure/raid/#esxi","title":"ESXi","text":"<p>https://docs.broadcom.com/docs-and-downloads/raid-controllers/raid-controllers-common-files/8-07-07_MegaCLI.zip</p> <p>ESXi 5 \u7684 binary \u548c ESXi 6.0 \u517c\u5bb9\u3002</p> <pre><code>esxcli software vib install -v=/tmp/vmware-esx-MegaCli-8.07.07.vib --no-sig-check\n</code></pre> <p>\u7136\u540e\u8fdb\u5165 <code>/opt/lsi/MegaCLI</code> \u76ee\u5f55\u6267\u884c <code>MegaCli</code>.</p>"},{"location":"infrastructure/raid/#ssacli-hpe-smart-array","title":"ssacli (HPE Smart Array)","text":"<p>pve-6 \u7684 RAID \u65b9\u6848\u662f HPE Smart Array\u3002\u5bf9\u5e94\u4f7f\u7528\u65b9\u6cd5\u53ef\u4ee5\u53c2\u8003 https://gist.github.com/mrpeardotnet/a9ce41da99936c0175600f484fa20d03\u3002</p> <p>\u5bf9\u5e94\u4e3b\u673a\u9700\u8981\u5b89\u88c5 https://downloads.linux.hpe.com/SDR/repo/mcp/Debian/pool/non-free/ssacli-5.30-6.0_amd64.deb\uff08HPE \u6e90\u5b9e\u5728\u592a\u6162\u4e86\uff09\u3002</p>"},{"location":"infrastructure/sshca/","title":"SSH Certificate Authentication","text":"<p>Discussion: SSH \u5347\u7ea7\u5230\u8bc1\u4e66\u767b\u9646\u65b9\u6848\u8ba8\u8bba</p> <p>Usage: SSH \u8bc1\u4e66\u8ba4\u8bc1\u7684\u4f7f\u7528\u65b9\u6cd5 (See also: iBug's blog)</p>"},{"location":"infrastructure/sshca/#introduction","title":"Introduction","text":"<p>An SSH Certificate Authority (CA) is a trusted key pair that issues certificates. It has the same format as a regular SSH private-public key pair (it is, in fact). </p> <p>Certificates can be used for authentication on both the server side and the client side. But certificates cannot issue new certificates (i.e. no chains), it is the very difference from X.509 certificate system.</p>"},{"location":"infrastructure/sshca/#server-setup","title":"Server setup","text":""},{"location":"infrastructure/sshca/#trustedusercakeys","title":"Configure server to accept client certificates","text":"<p>First drop our public key to <code>/etc/ssh/ssh_user_ca</code>:</p> /etc/ssh/ssh_user_ca<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Bxw9AXoZvc9HTe5o4f7/qOROcmzvlcO5oofoF3pewtRnhNpcd/DwmxSblqpj/cjLYkE32mSCzMYY8X0CRFyMJsgSIDC4i4LXDNU0e8PbB2NIQAAeyfJEU5m/Dn1tPw9WvPtPqHCRvgSwnRfzYngMVWROgV2Qe6pOqTTgetEYfb5gkDc2i1M7yfTp3H3ExfrDKwOKPc/9UYOADMFU6u1fJN+4epLETilHC1ubtBeVi23pn1K+LDy06Gwhq1MLljCM7gFBMrmv894HrOHU4WrzLUlfkiDt2cyXLb4qPWYqilBFLUjU92kjmiI/EwB/8pR1WmdU7FoYpdgBHNr3NT53 LUG-CA\n</code></pre> <p>Then add the following line to sshd config (Debian 11+):</p> /etc/ssh/sshd_config.d/ustclug.conf<pre><code>TrustedUserCAKeys /etc/ssh/ssh_user_ca\n</code></pre> <p>Old version config (&lt;= Debian 10)</p> <p>On Debian 10 (buster) or older, <code>sshd_config</code> does not support the <code>Include</code> directive. Thus any extra setting must be added in the main <code>sshd_config</code> file directly.</p>"},{"location":"infrastructure/sshca/#issue-a-server-certificate","title":"Issue a server certificate","text":"<p>Warning</p> <p>When signing certificates using OpenSSH &lt;= 8.1, add <code>-t rsa-sha2-512</code> to the <code>ssh-keygen</code> command. More details can be found here: https://ibug.io/p/35</p> <p>Note</p> <p>Some of our servers may still be running Debian Jessie, which has OpenSSH 6.7 that does not support SHA-2 certificate algorithms (OpenSSH 7.2 required). Sign with <code>-t ssh-rsa</code> instead if you want to log in to such servers.</p> <p>January 2022 update: We believe we have got rid of all Jessie systems, so this should no longer be the case. </p> <p>Copy the file <code>/etc/ssh/ssh_host_rsa_key.pub</code> from target server.</p> <p>Then, run <code>ssh-keygen</code> to issue a public key. For example:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca \\\n           -I blog \\\n           -h \\\n           -n blog.s.ustclug.org,blog.p.ustclug.org,10.254.0.15,202.141.176.98,202.141.160.98 \\\n           ssh_host_rsa_key.pub\n</code></pre> <p>Then, copy the certificate file <code>ssh_host_rsa_key-cert.pub</code> back to target server.</p> <p>At last, add the following lines to sshd config:</p> /etc/ssh/sshd_config.d/ustclug.conf<pre><code>HostKey /etc/ssh/ssh_host_rsa_key\nHostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub\n</code></pre> <p>Warning</p> <p>See the same warning block above.</p> <p>Certificate will take effect after SSH daemon is reloaded (<code>systemctl reload ssh</code>).</p>"},{"location":"infrastructure/sshca/#client-setup","title":"Client setup","text":"<p>Add the following line to your <code>known_hosts</code>:</p> ~/.ssh/known_hosts<pre><code>@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Bxw9AXoZvc9HTe5o4f7/qOROcmzvlcO5oofoF3pewtRnhNpcd/DwmxSblqpj/cjLYkE32mSCzMYY8X0CRFyMJsgSIDC4i4LXDNU0e8PbB2NIQAAeyfJEU5m/Dn1tPw9WvPtPqHCRvgSwnRfzYngMVWROgV2Qe6pOqTTgetEYfb5gkDc2i1M7yfTp3H3ExfrDKwOKPc/9UYOADMFU6u1fJN+4epLETilHC1ubtBeVi23pn1K+LDy06Gwhq1MLljCM7gFBMrmv894HrOHU4WrzLUlfkiDt2cyXLb4qPWYqilBFLUjU92kjmiI/EwB/8pR1WmdU7FoYpdgBHNr3NT53 LUG-CA\n</code></pre> <p>And when you log in to a LUG server, it is automatically trusted. If you find a machine that does not support this setup, report it to CTO.</p>"},{"location":"infrastructure/sshca/#issue-a-client-certificate","title":"Issue a client certificate","text":"<pre><code>ssh-keygen -s /path/to/ssh_ca \\\n           -I certificate_identity \\\n           -n principals \\\n          [-O options] \\\n          [-V validity_interval] \\\n           public_key_file\n</code></pre> <p>For example:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca -I \"Yifan Gao\" -n yifan -V -5m:+365d yifan.pub\n</code></pre> <p>In general, certificate_identity is the user's full name, and principals is the system username. The certificate identity is used to identify certificates and is logged in system logs. In addition, one certificate can carry multiply principals, like:</p> <pre><code>ssh-keygen -s /path/to/ssh_ca -I \"Yifan Gao\" -n yifan,root,liims -V -5m:+365d yifan.pub\n</code></pre> <p>It authorizes the certificate owner to login to any server as <code>yifan</code>, <code>root</code> or <code>liims</code> user.</p> <p>Note</p> <p>The <code>liims</code> principal is used to log into library inquiry machines.</p> <p>Tip</p> <p>The validity interval by default starts at the current system time. Using <code>-5m:+365d</code> creates a certificate valid from 5 minutes ago to make up for offset times on other systems. Otherwise it's not much useful to have a validity period starting from a long time ago.</p> <p>For security purposes, avoid creating certificates without a defined validity period. It's also recommended to keep validity periods as short as necessary.</p>"},{"location":"infrastructure/ssl/","title":"SSL Certificates","text":"<p>Discussion: #224</p> <p>Our SSL certificates are automatically renewed on GitHub ustclug/ssl-cert ( Private).</p> <p>We delegate the subdomain <code>ssl-digitalocean.ustclug.org</code> to DigitalOcean DNS hosting, and use acme.sh DNS alias mode to issue certificates. For this to work, we have the following CNAME records in place:</p> <pre><code>_acme-challenge.lug.ustc.edu.cn    -&gt;  lug.ssl-digitalocean.ustclug.org\n_acme-challenge.ustclug.org        -&gt;  lug.ssl-digitalocean.ustclug.org\n_acme-challenge.proxy.ustclug.org  -&gt;  lug.ssl-digitalocean.ustclug.org\n\n_acme-challenge.vpn.lug.ustc.edu.cn  -&gt;  lugvpn.ssl-digitalocean.ustclug.org\n_acme-challenge.vpn.ustclug.org      -&gt;  lugvpn.ssl-digitalocean.ustclug.org\n\n_acme-challenge.mirrors.ustc.edu.cn  -&gt;  mirrors.ssl-digitalocean.ustclug.org\n</code></pre> <p>Individual machines that use SSL certificates should pull from the said repository (branch <code>cert</code>). Certificates may be loaded via symbolic links (for processes running on the host system directly), or copied around from within the updater script (when there are path constraints, e.g. in a Docker container). The update task is managed by cron.</p> <p>Update script for reference:</p> /etc/ssl/private/.git/update.sh<pre><code>#!/bin/sh\n\ncd \"/etc/ssl/private\"\n\ngit fetch -q\nif [ \"$(git rev-parse HEAD)\" = \"$(git rev-parse '@{u}')\" ]; then\n  exit 0\nfi\ngit reset --hard '@{u}'\n\n# Display certificate dates. This section is optional\nif command -v openssl &gt;/dev/null 2&gt;&amp;1; then\n  echo \"Cert has been updated. New expiry:\"\n  for f in */cert.pem; do\n    echo \"$f:\"\n    openssl x509 -in \"$f\" -noout -dates\n  done\nelse\n  echo \"Cert has been updated.\"\nfi\n\nsystemctl reload openresty.service\n# Other `cp -a` or `docker restart` commands, etc.\n</code></pre> <p>The DigitalOcean account we use is owned by iBug and has nothing else running.</p> <p>Plan B</p> <p>Hurricane Electric provides hosted DNS zones for free, which is also supported by <code>acme.sh</code>. This makes HE DNS a feasible alternative should our current dependency (DigitalOcean) fails.</p>"},{"location":"infrastructure/ssl/#exceptions","title":"Exceptions","text":"<p>PXE manages its own certificates with <code>acme.sh</code> and validates via HTTP-01 challenge. The certificates are stored in <code>/etc/acme.sh/pxe.ustc.edu.cn/</code>.</p>"},{"location":"infrastructure/tinc/","title":"Tinc VPN \u914d\u7f6e\u8bf4\u660e","text":"<p>Tinc VPN \u662f LUG \u5185\u7f51\u7684\u4e3b\u8981\u6784\u6210\u8f6f\u4ef6\uff0cLDAP \u9700\u8981\u7528\u5230\u5b83\uff08\u56e0\u4e3a ldap \u670d\u52a1\u5668\u662f\u4e2a\u5185\u7f51\u670d\u52a1\u5668\uff09</p>"},{"location":"infrastructure/tinc/#_1","title":"\u5b89\u88c5","text":"<p>Debian 9+ \u53ef\u4ee5\u76f4\u63a5\u4ece apt \u6e90\u5b89\u88c5 <code>tinc</code> \u5305\u3002</p> <p>\u4e0d\u65e9\u8bf4\u8fd9\u73a9\u610f\u6709\u4e2a Git \u4ed3\u5e93\uff1f\uff1fhttps://git.lug.ustc.edu.cn/ustclug/tinc-configure</p> <p>\u65e2\u7136\u6709\u4ed3\u5e93\u6240\u4ee5\u8981\u505a\u7684\u4e8b\u60c5\u6bd4\u8f83\u7b80\u5355\uff0c\u8fdb\u5165 <code>/etc/tinc</code> \u76ee\u5f55\u51c6\u5907\u548c Git \u4ed3\u5e93\u540c\u6b65\u914d\u7f6e\uff1a</p> <pre><code>git init\ngit remote add origin https://git.lug.ustc.edu.cn/ustclug/tinc-configure.git\ngit fetch origin master\ngit reset --hard FETCH_HEAD\n</code></pre> <p>\u6ce8\u610f <code>git reset</code> \u4f1a\u8986\u76d6\u90e8\u5206\u6587\u4ef6\uff0c\u5efa\u8bae\u5728\u5168\u65b0\u5b89\u88c5 <code>tinc</code> \u4e4b\u540e\u8fdb\u884c\u540c\u6b65\u914d\u7f6e\u3002</p> <p>\u914d\u7f6e\u5b8c\u6210\u540e\u6267\u884c <code>systemctl enable tinc@ustclug.service</code> \u4f7f tinc \u80fd\u591f\u5f00\u673a\u542f\u52a8\u3002</p>"},{"location":"infrastructure/tinc/#_2","title":"\u52a0\u5165\u4e3b\u673a","text":"<p>\u9996\u5148\u9700\u8981\u5728\u65b0\u4e3b\u673a\u4e0a\u751f\u6210\u5bc6\u94a5\uff1a</p> <pre><code>tincd -n ustclug -K\n</code></pre> <p>\u7136\u540e\u5728 <code>/etc/tinc/ustclug/hosts/$HOST</code> \u6700\u540e\u8865\u4e0a\u4e00\u884c\uff1a</p> <pre><code>Address = [\u8fd9\u53f0\u673a\u5668\u7684\u516c\u7f51IP]\n</code></pre> <p>\u628a\u65b0\u589e\u7684\u8fd9\u4e2a\u6587\u4ef6\u63d0\u4ea4\u8fdb Git \u4ed3\u5e93\uff0c\u5e76\u5728 <code>{ldap,board,gateway-el,gateway-nic}.s.ustclug.org</code> \u7b49\u591a\u53f0\u673a\u5668\u4e0a\u901a\u8fc7 <code>git pull</code> \u66f4\u65b0\uff0c\u5e76 <code>systemctl reload tinc@ustclug.service</code>\u3002</p>"},{"location":"infrastructure/tinc/#ip","title":"\u5185\u7f51 IP","text":"<p>\u6d4b\u8bd5\u7684\u65f6\u5019\uff0c\u4f60\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7 <code>ifconfig</code> \u7b49\u65b9\u5f0f\u6307\u5b9a\u4e00\u4e2a\u4e34\u65f6\u7684 IP\uff0c\u6ce8\u610f\u4e0d\u8981\u4e0e\u5df2\u6709\u7684\u5185\u7f51 IP \u51b2\u7a81\uff1a</p> <pre><code>ifconfig 10.254.0.xxx/21 ustclug\n</code></pre> <p>\u8fd9\u65f6\u5019\u5e94\u8be5\u80fd\u4ece\u5176\u4ed6\u673a\u5668 ping \u901a\u8fd9\u4e2a IP\u3002</p> <p>\u6307\u5b9a\u9759\u6001\u5185\u7f51 IP \u7684\u6b63\u786e\u65b9\u6cd5\u662f\u5728 DNS \u4e2d\u6dfb\u52a0\u4e00\u6761\u8fd9\u6837\u7684\u8bb0\u5f55\uff1a</p> <pre><code>$ORIGIN s.ustclug.org\n&lt;HOST&gt;  600     IN A    &lt;Intranet IP&gt;\n</code></pre> <p>\u7136\u540e\u5728\u673a\u5668\u4e0a\u91cd\u542f <code>systemctl restart tinc@ustclug.service</code> \u5c31\u80fd\u81ea\u52a8\u83b7\u53d6\u4e86\u3002</p>"},{"location":"infrastructure/tinc/#ssh","title":"\u914d\u7f6e SSH \u4fa6\u542c\u5185\u7f51\u5730\u5740","text":"<p>Tip</p> <p>\u5bf9\u4e8e Debian 11+ \u7684\u7cfb\u7edf\uff0c\u5efa\u8bae\u4fdd\u6301 <code>sshd_config</code> \u4e0d\u52a8\uff0c\u5c06\u81ea\u5b9a\u4e49\u7684\u914d\u7f6e\u5199\u5165 <code>sshd_config.d/ustclug.conf</code>\uff0c\u4ee5\u51cf\u5c11\u66f4\u65b0 ssh \u8f6f\u4ef6\u5305\u65f6\u7684\u914d\u7f6e\u6587\u4ef6\u51b2\u7a81\u3002\u6ce8\u610f\u5982\u679c\u8fd9\u4e48\u505a\u7684\u8bdd\u9700\u8981\u628a\u914d\u7f6e\u6587\u4ef6\u91cc\u7684 <code>Subsystem sftp</code> \u5220\u6389\uff0c\u5426\u5219 sshd \u4f1a\u62a5\u9519\u201c\u91cd\u590d\u6307\u5b9a\u4e86 Subsystem sshd\u201d\u3002</p> <p>\u4ee5\u4e0b\u914d\u7f6e\u4f9b\u53c2\u8003\uff0c\u590d\u5236\u65f6\u6ce8\u610f\u4fee\u6539 <code>Match LocalAddress</code> \u540e\u9762\u7684\u5185\u5bb9\uff08\u5185\u7f51\u5730\u5740\u548c AllowGroups \u6700\u540e\u7684\u540d\u79f0\uff09\uff1a</p> /etc/ssh/sshd_config<pre><code>AddressFamily inet\nUseDNS no\n\nHostKey /etc/ssh/ssh_host_rsa_key\nHostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub\nTrustedUserCAKeys /etc/ssh/ssh_user_ca\nRevokedKeys /etc/ssh/ssh_revoked_keys\n\nPasswordAuthentication no\nPubkeyAuthentication no\nChallengeResponseAuthentication no\nUsePAM yes # LDAP for Debian\n\nAcceptEnv LANG LC_*\nX11Forwarding yes\nPrintLastLog no\nPrintMotd no\nSubsystem sftp /usr/lib/openssh/sftp-server\n\nMatch LocalAddress 10.254.0.0\n    AllowGroups ssh_local super_manager ssh_groupname\n    PasswordAuthentication yes\n    PubkeyAuthentication yes\n\n# Public IP access = root-only\nMatch LocalAddress 202.38.95.110,202.141.160.110,202.141.176.110,218.104.71.170\n    AllowUsers root\n    PubkeyAuthentication yes\n    AuthorizedKeysFile none  # \u5c4f\u853d\u516c\u94a5\uff0c\u4ec5\u5141\u8bb8\u8bc1\u4e66\u767b\u5f55\n\n# For SSH Push trigger\nMatch User mirror\n    AllowUsers mirror\n    AuthenticationMethods publickey\n    PermitTTY no\n    PermitTunnel no\n    X11Forwarding no\n\nMatch All #(1)\n</code></pre> <ol> <li>OpenSSH 6.5p1 \u4ee5\u4e0a\u53ef\u4ee5\u4f7f\u7528 <code>Match All</code> \u6765\u7ed3\u675f\u4e0a\u9762\u7684 Match \u5757\u3002\u7531\u4e8e <code>Include</code> \u6307\u4ee4\u51fa\u73b0\u5728 <code>/etc/ssh/sshd_config</code> \u7684\u6700\u4e0a\u9762\uff0c\u800c\u63a5\u4e0b\u6765\u7684\u5185\u5bb9\u90fd\u662f\u5168\u5c40\u8bbe\u7f6e\uff0c\u56e0\u6b64\u4f7f\u7528 <code>Match All</code> \u4fdd\u8bc1\u539f\u5148\u7684\u5185\u5bb9\u7ee7\u7eed\u4f5c\u7528\u4e8e\u5168\u5c40\uff0c\u800c\u4e0d\u662f\u50cf\u4e0a\u9762\u8fd9\u4e2a\u4f8b\u5b50\u4e00\u6837\u53d8\u6210 <code>Match User mirror</code> \u7684\u8bbe\u7f6e\u3002</li> </ol> <p>\u6ce8\u610f HostCertificate, TrustedUserCAKeys \u548c RevokedKeys \u8fd9\u4e09\u4e2a\u6587\u4ef6\u5fc5\u987b\u5b58\u5728\uff0c\u5426\u5219 SSH \u4f1a\u51fa\u4e00\u4e9b\u95ee\u9898\uff0c\u4f8b\u5982\u4e0d\u80fd\u5bc6\u94a5\u767b\u5f55\u53ea\u80fd\u5bc6\u7801\u767b\u5f55\u3002</p> <p>HostCertificate \u9700\u8981\u624b\u52a8\u7b7e\u53d1\u4e00\u4e2a\uff0c\u53e6\u5916\u4e24\u4e2a\u6587\u4ef6\u4ece\u522b\u7684\u673a\u5668\u4e0a\u590d\u5236\u5c31\u884c\u3002</p>"},{"location":"infrastructure/discontinued/","title":"\u4e0d\u518d\u4f7f\u7528\u7684\u57fa\u7840\u8bbe\u65bd","text":"<p>Warning</p> <p>Content under this section is not necessarily up-to-date.</p>"},{"location":"infrastructure/discontinued/#saltstack","title":"SaltStack","text":"<p>\u76ee\u524d\u4e0d\u77e5 SaltStack \u4f55\u65f6\u5f00\u59cb\u4f7f\u7528\uff0c\u4f46\u662f\u6211\u4eec\u6ca1\u6709\u4efb\u4f55\u4f9d\u8d56\u4e8e salt \u7684\u914d\u7f6e\u3002\u51fa\u4e8e\u8003\u8651\u5230 salt \u51fa\u73b0\u8fc7\u975e\u5e38\u4e25\u91cd\u7684 CVE\uff0csaltstack \u5df2\u4e0d\u518d\u8003\u8651\u4f7f\u7528\uff0c\u4e14\u5728\u5df2\u77e5\u7684\u673a\u5668\u4e0a\u90fd\u5df2\u5220\u9664\u3002\u5982\u679c\u4f60\u53d1\u73b0\u67d0\u53f0 lug \u7684\u673a\u5668\u4e0a\u5b89\u88c5\u4e86 salt\uff0c\u8bf7\u901a\u77e5 CTO \u4ee5\u5c06\u5176\u5220\u9664\u3002</p> <p>\u5728\u81ea\u52a8\u5316\u8fd0\u7ef4\u65b9\u9762\uff0c\u672a\u6765\u4f1a\u8c03\u7814 ansible\u3002</p>"},{"location":"infrastructure/discontinued/#vsphere","title":"vSphere \u96c6\u7fa4","text":"<p>\u6211\u4eec\u4ece 2015 \u5e74\uff08\u6216\u66f4\u65e9\uff09\u5f00\u59cb\u4f7f\u7528 vSphere \u5e73\u53f0\uff08ESXi + vCenter\uff09\u8fd0\u884c\u865a\u62df\u673a\u3002\u7531\u4e8e VMware \u4e13\u6709\u5e73\u53f0\u7684\u590d\u6742\u6027\u96be\u4ee5\u7ef4\u62a4\uff0c\u6211\u4eec\u5df2\u4e8e 2022 \u5e74 1 \u6708\u5168\u9762\u8fc1\u79fb\u81f3\u5f00\u6e90\u7684\u3001\u57fa\u4e8e Debian GNU/Linux \u7684\u865a\u62df\u5316\u5e73\u53f0 Proxmox VE\u3002</p>"},{"location":"infrastructure/discontinued/#pve-2-pve-4","title":"pve-2, pve-4","text":"<p>pve-2 \u548c pve-4 \u4e5f\u4f4d\u4e8e\u4e1c\u56fe\uff0c\u662f\u4e24\u53f0\u672a\u77e5\u54c1\u724c\u3001\u672a\u77e5\u578b\u53f7\u7684\u65e7\u673a\u5668\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5420 (Very old 4C4T, 2.50 GHz), 16 GB \u5185\u5b58\uff08DDR2 667 MHz\uff09\u548c\u4e00\u5757 16 GB \u7684 SanDisk SSD\u3002\u8be5\u578b\u53f7\u673a\u5668\u6ca1\u6709 IPMI\u3002</p> <p>\u7531\u4e8e\u914d\u7f6e\u4f4e\u4e0b\uff0c\u6211\u4eec\u624b\u52a8\u5b89\u88c5\u4e86 Proxmox VE\uff0c\u6ca1\u6709\u4f7f\u7528 LVM\uff0c\u5206\u914d\u4e86 1 GB \u7684 swap\uff0c\u5269\u4e0b\u5168\u90e8\u7ed9 rootfs\u3002</p> <p>\u673a\u5668\u7684\u7f51\u5361\u6709\u4e24\u4e2a 1 Gbps \u7684\u63a5\u53e3\uff0c\u4e0e pve-6 \u76f8\u540c\uff0c\u90fd\u63a5\u5728\u540c\u4e00\u4e2a\u4ea4\u6362\u673a\u4e0a\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/","title":"ESXi","text":"<p>\u73b0\u5f79\u7684 ESXi \u6709 3 \u53f0\uff1aesxi-2 \u548c esxi-6 \u4f4d\u4e8e\u4e1c\u56fe\u673a\u623f\uff0cesxi-5 \u4f4d\u4e8e\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u673a\u623f\u3002</p> <p>esxi-2 \u4e0a\u8fd0\u884c\u4e1c\u56fe\u7f51\u5173\u7b49\u670d\u52a1\uff0cesxi-6 \u4e0a\u8fd0\u884c ustclug gitlab\u3002esxi-5 \u4e0a\u8fd0\u884c\u8bf8\u5982 vcenter, \u90ae\u4ef6\u7f51\u5173, ldap, \u5907\u7528\u7f51\u5173, vSphereDataProtection \u5907\u4efd\u670d\u52a1\u7b49\u3002</p> <p>\u76ee\u524d\uff0c\u6709\u8ba1\u5212\u5c06\u865a\u62df\u5316\u65b9\u6848\u66f4\u6539\u4e3a Proxmox Virtual Environment\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/#about-snapshot","title":"\u5173\u4e8e\u5feb\u7167","text":"<p>Best practices: https://kb.vmware.com/s/article/1025279\uff0c\u7ba1\u7406\u865a\u62df\u673a\u524d\u52a1\u5fc5\u9605\u8bfb\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/esxi/#_1","title":"\u673a\u5668\u914d\u7f6e\u7ec6\u8282","text":""},{"location":"infrastructure/discontinued/vsphere/esxi/#esxi-5","title":"esxi-5","text":"<p>esxi-5 \u4e0a\u4e8e 2021/8 \u53d1\u73b0\u81ea\u5e26\u9635\u5217\u6709\u4e24\u5757\u574f\u76d8\uff0c\u5728\u66f4\u6362\u540e\u53d1\u73b0 storage \"root\"\uff08\u5b58\u653e vcenter \u865a\u62df\u673a\uff0c\u7ec4 RAID 1 \u540e\u5927\u5c0f 1.8TB\uff09\u65e0\u6cd5\u6b63\u5e38 rebuild\uff0c\u5e76\u4e14 vcenter \u865a\u62df\u673a\u7684 vmdk \u6587\u4ef6\u6709 4 \u4e2a\u51fa\u73b0 I/O error\u3002\u76ee\u524d vcenter \u865a\u62df\u673a\u5df2\u7ecf\u8fc1\u79fb\u5230 storage \"data\" (RAID10, 7.2 TB)\uff0c\u5de5\u4f5c\u6b63\u5e38\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/vcenter/","title":"vCenter","text":"<p>vCenter \u4e3a\u7ef4\u62a4\u4eba\u5458\u63d0\u4f9b\u4e86\u65b9\u4fbf\u7684\u7ba1\u7406\u6240\u6709 ESXi \u670d\u52a1\u5668\u7684\u754c\u9762\u3002\u9700\u8981\u6ce8\u610f\uff1a</p> <ul> <li>HTML5 \u7248\u53ef\u4ee5\u5b8c\u6210\u5927\u591a\u6570\u4efb\u52a1\uff0c\u4f46\u662f\u8bf8\u5982\u914d\u7f6e\u8b66\u62a5\uff08\u53ef\u914d\u7f6e\u90ae\u4ef6\u8b66\u544a\uff09\u3001\u67e5\u770b VDP \u5907\u4efd\u60c5\u51b5\u7b49\u9700\u8981 Flash \u7248\u672c\u3002</li> <li>\u5982\u679c\u67d0\u4e2a\u540c\u5b66\u53ea\u6709\u7ba1\u7406\u67d0\u4e2a\u865a\u62df\u673a\u7684\u9700\u6c42\uff0c\u5efa\u8bae\u65b0\u5efa\u8d26\u6237\uff0c\u5355\u72ec\u914d\u7f6e\u6743\u9650\u3002</li> <li>vCenter \u672c\u8eab\u4e5f\u662f\u4e00\u4e2a\u865a\u62df\u673a\uff0c\u76ee\u524d\u8fd0\u884c\u5728 esxi-5 \u4e0a\u3002</li> </ul>"},{"location":"infrastructure/discontinued/vsphere/vcenter/#patch","title":"\u5b89\u88c5 patch","text":"<p>\u5f53\u51fa\u73b0\u4e25\u91cd\u7684 CVE \u4e14\u65e0\u6cd5\u7b80\u5355 workaround \u65f6\uff0c\u5efa\u8bae\u5b89\u88c5 patch\uff0c\u5927\u81f4\u65b9\u6cd5\uff1a</p> <ol> <li>\u6253\u5feb\u7167\uff0c\u6700\u597d\u80fd\u624b\u52a8\u5907\u4efd\u4e00\u4e0b\u3002</li> <li>\u524d\u5f80 https://my.vmware.com/group/vmware/patch \u4e0b\u8f7d\u6700\u65b0\u7248 patch ISO \u6587\u4ef6\uff08\u5206\u7c7b\u4e3a VC\uff0c\u9700\u8981\u6ce8\u518c\u514d\u8d39\u8d26\u53f7\uff09\uff1b</li> <li>\u4e0a\u4f20 ISO \u6587\u4ef6\u5230 esxi-5 \u67d0\u4e2a datastore \u4e2d\uff0c\u5c06 ISO \u6302\u8f7d\u5230 VMware vCenter Server Appliance \u865a\u62df\u673a\u4e2d\uff1b</li> <li>\u767b\u5f55 esxi-5 \u7ba1\u7406\u754c\u9762\uff08\u4e0d\u662f vcenter \u754c\u9762\uff0c\u56e0\u4e3a\u66f4\u65b0\u7684\u65f6\u5019 vcenter \u4f1a\u4e0b\u7ebf\uff09\uff0c\u8fdb\u5165 vcenter console\u3002</li> <li><code>software-packages stage --iso</code> \u52a0\u8f7d\u8865\u4e01\u6587\u4ef6\uff08\u5b9e\u8d28\u662f\u4e00\u5806 rpm\uff09\u3002</li> <li><code>software-packages install --iso</code> \u5b89\u88c5\u8865\u4e01\u6587\u4ef6\u3002</li> <li><code>shell</code> \u8fdb\u5165 bash\uff0c<code>reboot</code> \u91cd\u542f\u3002</li> <li>\u91cd\u542f\u540e\u5982\u679c\u8fdb\u5165 5480 \u7aef\u53e3\u53d1\u73b0\u670d\u52a1\u72b6\u6001\u4e3a\u672a\u77e5\uff0c\u624b\u52a8\u91cd\u542f\u6240\u6709\u670d\u52a1\uff1a<code>service-control --start --all</code></li> <li>\u7b49\u5f85\u4e00\u6bb5\u65f6\u95f4\uff08\u6bd4\u8f83\u957f\uff09\uff0c\u671f\u95f4\u53ef\u80fd 503/\u663e\u793a\u670d\u52a1\u6b63\u5728\u52a0\u8f7d\u4e2d\uff0c\u7b49\u7b49\uff0c\u4e4b\u540e\u5c31\u5e94\u8be5\u6b63\u5e38\u4e86\u3002</li> <li>\u522b\u5fd8\u4e86\u624b\u52a8\u5907\u4efd\u3002</li> </ol> <p>\u5347\u7ea7\u65f6\u9047\u5230\u7684\u95ee\u9898\uff1a</p> <ol> <li>\u65e0\u6cd5\u8bc6\u522b ISO \u4e3a\u66f4\u65b0\u7684\u7248\u672c\uff1ahttps://kb.vmware.com/s/article/59659?lang=zh_CN</li> <li>\u300c\u73af\u5883\u5c1a\u672a\u51c6\u5907\u597d\u66f4\u65b0\u300d\uff1a\u4f7f\u7528 console \u7684 <code>software-packages</code> \u66f4\u65b0\uff0c\u67e5\u770b\u539f\u56e0\u3002\u5982\u679c\u662f root \u5bc6\u7801\u8fc7\u671f\uff0c\u8fdb\u5165 bash\uff0c\u4f7f\u7528 passwd \u5148\u91cd\u7f6e\u6210\u65b0\u7684\uff08\u7136\u540e\u518d\u6539\u56de\u6765\uff09\uff0c\u4f7f\u7528 <code>chage -I -1 -m 0 -M 99999 -E -1 root</code> \u8bbe\u7f6e\u6c38\u4e0d\u8fc7\u671f\u3002</li> </ol>"},{"location":"infrastructure/discontinued/vsphere/vdp/","title":"VDP","text":"<p>\u5f53\u6211\u4eec\u8bf4\u5230 VDP \u7684\u65f6\u5019\uff0c\u6211\u4eec\u5230\u5e95\u5728\u6307\u4ec0\u4e48\uff1f\u4e3a\u4e86\u907f\u514d\u6b67\u4e49\uff0c\u4ee5\u4e0b\u505a\u4e86\u4e00\u4e9b\u5b9a\u4e49\uff1a</p> <ul> <li>vdp -&gt; \u7279\u6307\u4f4d\u4e8e\u4e1c\u56fe\u7684 NFS \u670d\u52a1\u5668\u3002</li> <li>vdp2 -&gt; \u7279\u6307\u4f4d\u4e8e\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u7684\u865a\u62df\u673a\u5907\u4efd\u9635\u5217\u3002</li> <li>vdp \u5907\u4efd\u7a0b\u5e8f\u3001vdp \u5907\u4efd\u865a\u62df\u673a\u3001vSphereDataProtection -&gt; \u7279\u6307\u8fd0\u884c\u5728 esxi-5 \u4e0a\u7684 vdp \u5907\u4efd\u670d\u52a1\u3002</li> </ul> <p>vdp2 \u6302\u63a5\u5728 esxi-5 \u4e0a\uff0cesxi-5 \u6e90\u4e8e\u8001 mirrors\uff08mirrors2 \u4e4b\u524d\u7684\u4e00\u4ee3\u673a\u5668\uff09\u3002vSphereDataProtection \u7248\u672c\u4e3a 6.1.5\u3002</p> <p>\u5f53 vdp \u5907\u4efd\u7a0b\u5e8f\u51fa\u73b0\u5947\u602a\u7684\u95ee\u9898\u7684\u65f6\u5019\uff0c\u91cd\u542f vdp \u5907\u4efd\u865a\u62df\u673a\u7edd\u5927\u591a\u6570\u65f6\u5019\u80fd\u591f\u89e3\u51b3\u95ee\u9898\u3002\u91cd\u542f\u8017\u65f6\u975e\u5e38\u957f\uff0c\u9700\u8981\u505a\u597d\u5fc3\u7406\u51c6\u5907\u3002</p> <p>\u5907\u4efd\u65f6\uff0cvdp \u5907\u4efd\u7a0b\u5e8f\u4f1a\u4e3a\u865a\u62df\u673a\u65b0\u5efa\u4e00\u4e2a snapshot\uff0c\u4e4b\u540e\u4ece snapshot \u4f20\u8f93\u5907\u4efd\u3002\u5076\u5c14 snapshot \u4e0d\u4f1a\u88ab\u6b63\u5e38\u5220\u9664\uff0c\u800c\u5927\u91cf\u6216\u957f\u65f6\u95f4\u5b58\u653e\u7684 snapshot \u4f1a\u7ed9\u6027\u80fd\u5e26\u6765\u8d1f\u9762\u5f71\u54cd\uff0c\u6240\u4ee5\u5982\u679c\u53d1\u73b0\u6b64\u7c7b\u60c5\u51b5\uff0c\u5728\u786e\u8ba4\u5907\u4efd\u4e0d\u518d\u8fdb\u884c\u540e\uff0c\u9700\u8981\u5220\u9664 snapshot\uff0c\u540c\u65f6\u4fdd\u6301\u673a\u5668\u5728\u7ebf\uff08\u5728\u5173\u673a\u60c5\u51b5\u4e0b\u6574\u5408\u78c1\u76d8\u65f6\u65e0\u6cd5\u5f00\u673a\uff01\uff09\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1ahttps://docs.vmware.com/en/VMware-vSphere/6.5/rn/data-protection-615-release-notes.html</p> <p>VDP \u5907\u4efd\u865a\u62df\u673a\u5df2\u7ecf EOL\u3002\u8bbf\u95ee vcenter \u4e2d\u7684 VDP \u63d2\u4ef6\u9700\u8981\u4f7f\u7528 Adobe Flash\u3002</p>"},{"location":"infrastructure/discontinued/vsphere/vdp/#_1","title":"\u5907\u4efd\u8ba1\u5212","text":"<p>\u76ee\u524d\u7684\u5907\u4efd\u8ba1\u5212\u5982\u4e0b\uff1a</p> <ul> <li>\u4e1c\u56fe\u9664 gitlab \u4ee5\u5916\u7684\u865a\u62df\u673a\uff0cesxi-5 \u6d3b\u8dc3\u7684\u865a\u62df\u673a\uff0c\u4ee5\u53ca hackergame web \u865a\u62df\u673a\u6bcf\u65e5\u5907\u4efd\u4e00\u6b21\u3002</li> <li>gitlab \u548c vcenter \u6bcf\u5468\u5907\u4efd\u4e00\u6b21\u3002\uff08\u56e0\u4e3a\u5b83\u4eec\u592a\u5927\u4e86\uff09</li> </ul>"},{"location":"infrastructure/discontinued/vsphere/vdp/#_2","title":"\u9ad8\u7ea7\u547d\u4ee4","text":"<p>\u67e5\u770b\u5f53\u524d\u4efb\u52a1\uff1a</p> <pre><code># mccli activity show | grep Running\n</code></pre> <p>\u67e5\u770b\u670d\u52a1\u60c5\u51b5\uff1a</p> <pre><code># dpnctl status\n# status.dpn\n</code></pre>"},{"location":"infrastructure/discontinued/vsphere/vdp/#vspheredataprotection-on-virtio-scsi","title":"vSphereDataProtection on VirtIO SCSI","text":"<p>vdp \u7684\u64cd\u4f5c\u7cfb\u7edf\u662f SLES 11 SP3\uff0c\u8fd9\u4e2a\u64cd\u4f5c\u9700\u8981\u7cfb\u7edf\u76d8\u7684\u524d\u4e24\u4e2a\u5206\u533a\uff08<code>/boot</code> \u548c <code>/</code>\uff09\u3002</p> <ol> <li>\u53c2\u8003 https://www.suse.com/support/kb/doc/?id=000016530\uff0c\u89e3\u538b initrd \u5230\u67d0\u4e2a\u76ee\u5f55\u3002</li> <li>\u4ece rootfs \u7684 <code>/lib/modules/3.0.101-0.47.99-default/kernel/drivers/</code> \u91cc\u53d6\u51fa virtio \u7684\u5185\u6838\u6a21\u5757\uff08<code>block</code> \u91cc\u9762\u4e00\u4e2a\uff0c<code>virtio</code> \u6574\u4e2a\u76ee\u5f55\uff0c\u4ee5\u53ca <code>scsi</code> \u91cc\u9762\u4e00\u4e2a\uff09\uff0c\u653e\u5728 initrd \u89e3\u538b\u540e\u7684\u5bf9\u5e94\u4f4d\u7f6e\u3002</li> <li>rootfs \u7684 <code>/lib/modules/3.0.101-0.47.99-default/modules.dep*</code> \u590d\u5236\u5230 initrd \u91cc\u3002</li> <li>\u4fee\u6539 initrd \u91cc\u7684 <code>config/start.sh</code> \u548c <code>run_all.sh</code>\uff0c\u5728 <code>RESOLVED_INITRD_MODULES</code> \u53d8\u91cf\u4e2d\u6dfb\u52a0 <code>virtio_pci virtio virtio_scsi virtio_blk</code>\uff08\u5373\u4fee\u6539\u4e3a <code>RESOLVED_INITRD_MODULES='virtio_pci virtio virtio_scsi virtio_blk cifs ext2 ext3 ext4 fat nfs reiserfs ufs xfs'</code>\uff09\u3002</li> <li>\u53c2\u8003 https://www.suse.com/support/kb/doc/?id=000016530 \u91cd\u65b0\u6253\u5305\uff0c\u653e\u5728\u7b2c\u4e00\u4e2a\u5206\u533a (<code>/boot</code>) \u91cc\u9762\uff0c\u5efa\u8bae\u4e0d\u8981\u8986\u76d6\u539f\u6765\u7684 initrd\u3002</li> <li>\u4fee\u6539\u7b2c\u4e00\u4e2a\u5206\u533a\u91cc <code>grub/menu.lst</code>\uff0c\u5c06 initrd \u4fee\u6539\u4e3a\u4f60\u6240\u6253\u5305\u7684\u6587\u4ef6\u540d\u3002</li> </ol>"},{"location":"infrastructure/intranet/","title":"Servers Intranet","text":"<p>Servers Intranet connects all the servers together, including physical servers and virtual machines.</p>"},{"location":"infrastructure/intranet/#network-topology","title":"Network Topology","text":"<p>\u4ee5\u4e0a\u67b6\u6784\u56fe\u7531 iBug \u5728 2023 \u5e74 11 \u6708\u66f4\u65b0\u3002</p> \u6b64\u5904\u662f\u4e00\u4e9b\u8fc7\u65f6\u7684\u4fe1\u606f\uff0c\u4e5f\u8bb8\u8fd8\u6709\u70b9\u53c2\u8003\u4ef7\u503c <p>The network contains three parts:</p> <ul> <li>Physical Switch in East Library Data Center</li> <li>Virtual Switch on vSphere host machine</li> <li>tincVPN</li> </ul> <p>tincVPN is a mesh VPN, which can be abstracted as a virtual Switch.</p> <p>vm-nfs.s.ustclug.org runs a layer 2 bridge, connecting tincVPN and SRW2024 (physical switch).</p> <p>It is obvious that vm-nfs is a single point of failure of communicating between tinc host and vSphere virtual machine. I had tried to add another bridge node, but resulted in a broadcast storm. Maybe we can fix it by MPLS (merged in mainline kernel 4.3). But it isn't a right timing at this time.</p>"},{"location":"infrastructure/intranet/#network-information","title":"Network information","text":"<p>The network contains one single subnet: 10.254.0.0/21</p> <p>Every server and service binds to one and only one IP address, used to communicate with each other.</p>"},{"location":"infrastructure/intranet/#address-planning","title":"Address planning","text":"<ul> <li>10.254.0.0/24: Physical servers and virtual machines</li> <li>10.254.1.0/24: Docker containers</li> <li>10.254.6.0/24: LUGi emergency entrypoint (via vpnstv.s, managed by yzf)</li> <li>10.254.7.0/24: LUGi entrypoint (via board.s)</li> <li>Others: not used yet.</li> </ul>"},{"location":"infrastructure/intranet/gateway/","title":"Intranet Gateway","text":"<p>We run gateways in each colocation to provide internet access to intranet-only hosts (VMs and containers).</p> <p>When configuring VMs and containers, set their gateway according to their colocation:</p> <ul> <li>East Campus Library (EL): gateway-el (10.254.0.254)</li> <li>Network Information Center (NIC): gateway-nic (10.254.0.245)</li> </ul> <p>Gateway-JP is mainly used for HTTP reverse proxy, so that we can provide HTTP services in compliance with PRC regulations.</p> <p>For server configuration on each gateway, refer to their corresponding documentation:</p> <ul> <li>Gateway EL</li> <li>Gateway NIC</li> <li>Gateway JP</li> </ul>"},{"location":"infrastructure/intranet/gateway/#tinc-workaround-1","title":"Tinc \"received packet on ustclug with own address as source address\" workaround","text":"<p>After migrating to PVE, we found that sometimes tinc works abnormally within gateway-el and gateway-nic, with following kernel log:</p> <pre><code>bridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nbridge: received packet on ustclug with own address as source address (addr:12:34:56:78:90:ab, vlan:0)\nnet_ratelimit: 2 callbacks suppressed\n</code></pre> <p>We still don't know the source of this issue. To workaround that, following self-check timer is deployed now:</p> /opt/tinc-check.sh<pre><code>#!/bin/bash\n\nrestart() {\n  systemctl stop tinc@ustclug.service\n  sleep 3  # avoid race condition\n  systemctl start tinc@ustclug.service\n  echo \"tinc restarted\"\n}\n\ndmesg | tail -n 2 | grep 'received packet on ustclug with own address as source address' &amp;&amp; restart ||  echo \"tinc OK now\";\n</code></pre> /etc/systemd/system/tinc-check.service<pre><code>[Unit]\nDescription=Tinc Check and Auto-Restart\n\n[Service]\nType=oneshot\nExecStart=/opt/tinc-check.sh\n</code></pre> /etc/systemd/system/tinc-check.timer<pre><code>[Unit]\nDescription=Tinc Check and Auto-Restart Timer\n\n[Timer]\nOnCalendar=minutely\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n</code></pre>"},{"location":"infrastructure/intranet/lugivpn/","title":"LUG Intranet VPN","text":"<p>service: intranet.ustclug.org</p> <p>server: board.s.ustclug.org</p>"},{"location":"infrastructure/intranet/lugivpn/#introduction","title":"Introduction","text":"<p>Server intranet is a closed network, which cannot be accessed from Internet. LUGI VPN helps maintainer get access to intranet temporarily.</p> <p>LUGI VPN is running in Banana Pi Raspberry Pi 3B+, the only ARM architecture device we owned. Using OpenVPN protocal, authorizing via LDAP.</p> <p>The original Banana Pi was down in April 2021.</p>"},{"location":"infrastructure/intranet/lugivpn/#configuration","title":"Configuration","text":"<p>OpenVPN LDAP auth plugin config <code>/etc/openvpn/auth-ldap.conf</code>:</p> <pre><code>&lt;LDAP&gt;\n    URL             ldaps://ldap.ustclug.org\n    Timeout         15\n    FollowReferrals yes\n    TLSCACertFile   /etc/ldap/ssl/slapd-ca-cert.pem\n&lt;/LDAP&gt;\n\n&lt;Authorization&gt;\n    BaseDN          \"ou=people,dc=lug,dc=ustc,dc=edu,dc=cn\"\n    SearchFilter    \"(uid=%u)\"\n    RequireGroup    false\n&lt;/Authorization&gt;\n</code></pre> <p>In openvpn configuration:</p> <pre><code>...\nplugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth-ldap.conf\n</code></pre> <p>Servers intranet is a layer 2 network without default gateway. So NAT is needed:</p> <pre><code>iptables -t nat -A POSTROUTING -s 10.254.248.0/22 -d 10.254.0.0/21 -j MASQUERADE\n</code></pre>"},{"location":"infrastructure/proxmox/nfs/","title":"NFS","text":"<p>NFS \u670d\u52a1\u5668\uff08\"vdp\"\uff09\u662f\u4e1c\u56fe\u4e09\u4e2a PVE \u673a\u5668\u7684\u865a\u62df\u673a\u5b58\u50a8\uff0c\u578b\u53f7\u4e3a DELL PowerEdge R510\u3002\u78c1\u76d8\u9635\u5217\u7531\u4e8e\u5728 2021 \u5e74 3 \u6708\u521d\u635f\u574f\uff0c\u76ee\u524d\u5bb9\u91cf\u7f29\u51cf\u5230 8T\uff084 \u5757 4T \u84dd\u76d8 RAID10\uff09\u3002\u9664\u865a\u62df\u673a\u5916\uff0cNFS \u4e5f\u5b58\u50a8 LUG \u6210\u5458\u7684\u4e2a\u4eba\u6570\u636e\u53ca LUG FTP\u3002NFS \u670d\u52a1\u6062\u590d\u540e\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u6570\u636e\u5197\u4f59\u6027\uff0c\u4f7f\u7528<sub>~\u79d1\u5927 Office 365 A1 \u8d26\u53f7</sub>~\u5b66\u6821\u5bf9\u8c61\u5b58\u50a8\u548c Rclone \u6bcf\u5929\u589e\u91cf\u5907\u4efd LUG FTP \u548c LUG \u6210\u5458\u7684\u516c\u5f00\u6570\u636e\u3002</p> <p>vdp \u7684\u5185\u7f51\u8fde\u63a5\u4f9d\u8d56\u4e8e gateway-el\u3002</p> <p>\u53ef\u80fd\u7684\u7f51\u7edc\u95ee\u9898</p> <p>\u5728 2021 \u5e74\u4e5d\u6708\u4efd\u4e1c\u56fe\u7684 ESXi \u4e0e NFS \u8fde\u63a5\u4f1a\u51fa\u73b0\u4e0d\u7a33\u5b9a\u7684\u95ee\u9898\uff0c\u539f\u56e0\u76ee\u524d\u4e0d\u660e\u3002\u5728\u8fde\u63a5\u65b9\u5f0f\u4ece NFS 4.1 \u66f4\u6362\u5230 NFS 3 \u4e4b\u540e\uff0c\u8fde\u63a5\u7684\u4e0d\u7a33\u5b9a\u4e0d\u4f1a\u5bfc\u81f4\u865a\u62df\u673a\u88ab\u5173\u95ed\u3002</p> <p>2021/09/29 \u66f4\u65b0\uff1a\u8fd9\u4e24\u5929\u518d\u6b21\u51fa\u73b0\u4e86\u4e25\u91cd\u7684\u8fde\u63a5\u95ee\u9898\u3002\u8c03\u8bd5\u540e\u53d1\u73b0 192.168.93.0/24 \u7684\u7f51\u5173 192.168.93.254 (Cisco \u8bbe\u5907) \u4e22\u5305\u4e25\u91cd\uff0c\u800c NFS \u7684\u51fa\u53e3 IP \u9519\u8bef\u88ab\u8bbe\u7f6e\u5230\u4e86\u4e0e\u56fe\u4e66\u9986\u4ea4\u6362\u673a\u76f8\u8fde\u63a5\u7684 eno1\uff0c\u5bfc\u81f4\u8bf7\u6c42\u9700\u8981\u7ed5\u8def\u3002\u5c06\u6b64 IP \u79fb\u52a8\u81f3 eno2\uff0c\u4fee\u6539 sysctl \u8bbe\u7f6e ARP \u8fc7\u6ee4\u5e76\u91cd\u542f\u540e\uff0c\u76ee\u524d\u6682\u65f6\u89e3\u51b3\u4e86\u95ee\u9898\u3002</p> <p>Debian Bookworm \u5185\u6838\u95ee\u9898</p> <p>6.1.x \u5f00\u59cb\u7684\u5185\u6838\u7684 NFSv4 \u670d\u52a1\u5668\u5b9e\u73b0\u53ef\u80fd\u5b58\u5728\u6f5c\u5728\u7684\u95ee\u9898\uff0c\u5bfc\u81f4\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u6b7b\u9501\uff0c\u89c1 https://lore.kernel.org/all/50d62fc9-206b-4dbc-9a9b-335450656fd0@aixigo.com/T/\u3002\u4ece Buster \u5347\u7ea7\u5230 Bookworm \u4e4b\u540e\u88ab\u5751\u4e86\u4e00\u6b21\u3002</p> <p>\u7531\u4e8e\u8fd9\u4e2a\u95ee\u9898\u76ee\u524d\u5c1a\u672a\u89e3\u51b3\uff0c\u5728\u5347\u7ea7 Bookworm \u4e4b\u540e vdp \u4ecd\u4f7f\u7528 Bullseye \u7684\u5185\u6838\uff085.10.x\uff09\u3002</p> /etc/apt/preferences.d/linux-image-amd64<pre><code>Package: linux-image-amd64\nPin: release n=bullseye-security\nPin-Priority: 900\n</code></pre> <p>\u6211\u4eec\u521b\u5efa\u4e86\u5982\u4e0a\u6587\u4ef6\uff08\u4ee5\u4fbf\u80fd\u591f\u7ee7\u7eed\u4ece bullseye-security \u83b7\u5f97\u5185\u6838\u7684\u5b89\u5168\u66f4\u65b0\uff09\uff0c\u7136\u540e\u624b\u52a8\u5220\u6389\u4e86\u6240\u6709 6.1 \u7684\u5185\u6838\u5305\u3002</p>"},{"location":"infrastructure/proxmox/nfs/#pve","title":"PVE \u78c1\u76d8\u8def\u5f84\u4e0e\u6302\u8f7d\u53c2\u6570","text":"<p>\u5728 storage.cfg \u8bbe\u7f6e\u4e2d\uff0cNFS \u6302\u8f7d\u5230 <code>/mnt/nfs-el</code>\uff0c\u8bbe\u7f6e\u7684\u53c2\u6570\u4e3a <code>soft,noexec,nosuid,nodev</code>\u3002\u8bbe\u7f6e\u4e3a <code>hard</code> \u4f1a\u5bfc\u81f4 NFS \u4e0b\u7ebf\u65f6\u91cd\u8bd5\u65e0\u9650\u6b21\uff0c\u5927\u6982\u7387\u5bfc\u81f4\u7cfb\u7edf\u5361\u6b7b\uff0c\u5176\u4ed6\u51e0\u4e2a\u53c2\u6570\u4e3b\u8981\u662f\u4e3a\u4e86\u5b89\u5168\u3002</p> <p>\u5176\u4e2d\uff0c\u6839\u636e PVE \u7684\u8981\u6c42\uff0c\u865a\u62df\u673a\u78c1\u76d8\u6587\u4ef6\u9700\u8981\u653e\u5728 <code>images/&lt;vmid&gt;</code> \u76ee\u5f55\u4e0b\u624d\u4f1a\u88ab\u81ea\u52a8\u68c0\u6d4b\u5230\u3002\u82e5\u4e00\u5f00\u59cb\u6ca1\u6709\u6309\u8981\u6c42\u653e\u7f6e\u6587\u4ef6\u6216\u6dfb\u52a0\u4e86\u65b0\u6587\u4ef6\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>qm rescan</code> \u626b\u63cf\u65b0\u7684\u78c1\u76d8\u6587\u4ef6\u3002\u4e5f\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528 <code>qm set</code> \u547d\u4ee4\u6216\u624b\u52a8\u7f16\u8f91\u865a\u62df\u673a\u914d\u7f6e\u6587\u4ef6\u6307\u5b9a\u78c1\u76d8\u6587\u4ef6\u7684\u8def\u5f84\uff0c\u8fd9\u4e24\u79cd\u65b9\u6cd5\u6ca1\u6709\u6b64\u9650\u5236\u3002</p> <p>\u53e6\u5916\uff0c\u7531\u4e8e\u6574\u4e2a storage.cfg \u6587\u4ef6\u5728\u96c6\u7fa4\u4e2d\u5171\u4eab\uff0c\u9700\u8981\u624b\u52a8\u6307\u5b9a <code>nodes</code> \u4ee5\u514d NIC \u7684\u4e24\u53f0 PVE \u4e3b\u673a\u5c1d\u8bd5\u6302\u8f7d\u3002</p> /etc/pve/storage.cfg<pre><code>nfs: nfs-el\n        export /media/vdp/pve\n        path /mnt/nfs-el\n        server nfs-el.vm.ustclug.org\n        options soft,noexec,nosuid,nodev\n        content iso,images\n        nodes pve-2,pve-4,pve-6\n        shared 1\n        prune-backups keep-all=1\n</code></pre> <p>storage.cfg \u7684\u5168\u90e8\u914d\u7f6e\u5185\u5bb9\u53ef\u4ee5\u53c2\u8003 https://pve.proxmox.com/wiki/Storage\u3002</p>"},{"location":"infrastructure/proxmox/pbs/","title":"Proxmox Backup Server (PBS)","text":"<p>PBS \u73b0\u5728\u90e8\u7f72\u5728 esxi-5 \u4e0a\u9762\uff0c\u7528\u4f5c\u865a\u62df\u673a\u5907\u4efd\uff0cweb \u754c\u9762\u7684\u7aef\u53e3\u53f7\u4e3a 8007\uff08HTTPS only\uff09\u3002</p> <p>Info</p> <p>\u672c\u9875\u9762\u8bb0\u5f55 Proxmox Backup Server \u8f6f\u4ef6\u76f8\u5173\uff0c\u4ee5\u53ca Proxmox VE \u865a\u62df\u673a\u76f8\u5173\u7684\u8d44\u6599\u3002\u5173\u4e8e esxi-5 \u7684\u7cfb\u7edf\u914d\u7f6e\u4fe1\u606f\u8bb0\u5f55\u5728 Proxmox VE \u9875\u9762\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs","title":"\u5b89\u88c5 PBS","text":"<p>PBS \u53ef\u4ee5\u4f7f\u7528\u5b89\u88c5\u5149\u76d8 iso \u5b89\u88c5\u6216\u76f4\u63a5\u52a0\u88c5\u5728\u73b0\u6709\u7684\u5bf9\u5e94\u7248\u672c\u7684 Debian \u7cfb\u7edf\u4e0a\uff0c\u8fd9\u4e24\u79cd\u5b89\u88c5\u65b9\u5f0f\u90fd\u6709\u5b98\u65b9\u7684\u8bf4\u660e\u6587\u6863\u3002</p> <p>\u6211\u4eec\u7684 esxi-5 \u662f\u4f7f\u7528 PVE \u7684\u5b89\u88c5\u76d8\u5148\u88c5\u6210 PVE\uff0c\u518d\u5728\u4e0a\u9762\u989d\u5916\u52a0\u88c5 PBS \u7684\u3002\u7531\u4e8e PVE \u548c PBS \u5171\u4eab\u4e86\u5927\u91cf\u7ec4\u4ef6\uff0c\u56e0\u6b64\u5728 PVE \u4e0a\u52a0\u88c5 PBS \u5c31\u53ea\u5269\u4e0b\u5f88\u7b80\u5355\u7684\u4e00\u4e9b\u6b65\u9aa4\u4e86\uff1a</p> <pre><code>echo \"deb http://mirrors.ustc.edu.cn/proxmox/debian/pbs bullseye pbs-no-subscription\" &gt; /etc/apt/sources.list.d/pbs.list\napt update\napt install proxmox-backup\n</code></pre> <p>\u8be5\u8fc7\u7a0b\u4ec5\u5b89\u88c5\u4e86\u603b\u91cf\u4e3a 150+ MB \u7684 8 \u4e2a\u5305\uff0c\u5c31\u6709 PBS \u53ef\u7528\u4e86\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs-new-user","title":"\u521b\u5efa\u65b0\u7528\u6237","text":"<p>PBS \u81ea\u5df1\u7684\u8d26\u53f7\u4f53\u7cfb (Realm pbs) \u4e0e PVE (Realm pve) \u4e92\u76f8\u4e0d\u901a\uff0c\u5982\u679c\u9700\u8981\u521b\u5efa\u65b0\u7684 PBS \u7528\u6237\uff0c\u53ef\u4ee5\u901a\u8fc7 SSH \u767b\u5f55\uff0c\u7136\u540e\u53c2\u8003\u4ee5\u4e0b\u6b65\u9aa4\uff1a</p> <ol> <li><code>proxmox-backup-manager user create \u7528\u6237\u540d@pbs --email \u90ae\u7bb1\u5730\u5740@ustclug.org</code></li> <li><code>proxmox-backup-manager user update \u7528\u6237\u540d@pbs --password '\u4e00\u4e2a\u4e34\u65f6\u7684\u5bc6\u7801'</code></li> <li>\u4f7f\u7528\u8be5\u7528\u6237\u767b\u5f55 PBS\uff08\u6b64\u65f6\u7528\u6237\u65e0\u6743\u9650\uff09\uff0c\u4fee\u6539\u5bc6\u7801\uff1b</li> <li>\u8d4b\u4e88\u6743\u9650\u3002\u8d85\u7ea7\u7ba1\u7406\u5458\u5bf9\u5e94\u7684\u547d\u4ee4\u662f <code>proxmox-backup-manager acl update / Admin --auth-id \u7528\u6237\u540d@pbs</code></li> <li>\u4f7f\u7528 <code>proxmox-backup-manager acl list</code> \u786e\u8ba4\u6743\u9650\u5217\u8868\u3002</li> </ol> <p>\u53c2\u8003\uff1ahttps://pbs.proxmox.com/docs/user-management.html</p> <p>Tip</p> <p>\u5f53\u7136\uff0c\u4f60\u4e5f\u53ef\u4ee5 SSH \u767b\u5f55\u540e\u4fee\u6539 root \u5bc6\u7801\uff0c\u518d\u7528 root@pam \u7684\u8d26\u53f7\u767b\u5f55 web \u754c\u9762\u8fdb\u884c\u64cd\u4f5c\u3002\u8be5\u65b9\u6cd5\u540c\u65f6\u9002\u7528\u4e8e PVE \u548c PBS\u3002\u64cd\u4f5c\u5b8c\u6210\u540e\u8bf7\u6062\u590d root \u5bc6\u7801\uff08<code>passwd -d root</code>\uff09\u3002</p> <p>\u5982\u679c\u4f60\u9700\u8981\u7ecf\u5e38\u767b\u5f55 Web \u754c\u9762\u64cd\u4f5c\uff0c\u6700\u597d\u521b\u5efa\u4e00\u4e2a Realm pve/pbs \u800c\u4e0d\u662f\u4f9d\u8d56\u4e8e\u4f7f\u7528 root \u5bc6\u7801\u3002</p> <p>\u7279\u522b\u5730\uff0c\u7531\u4e8e PBS \u548c PVE \u540c\u65f6\u5b89\u88c5\u5728 esxi-5 \u4e0a\uff0c\u56e0\u6b64\u5b83\u4eec\u53ef\u4ee5\u5171\u4eab esxi-5 \u4e0a\u7684 Linux \u7528\u6237\uff08\u5373 Linux PAM standard authentication\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pbs/#pbs-add-datastore","title":"\u8bbe\u7f6e Datastore","text":"<p>PBS \u4e0a\u7684\u865a\u62df\u673a\u5907\u4efd\u5355\u5143\u662f\u5c0f\u5757\u7684 chunk\uff0c\u4e5f\u4f9d\u8d56\u8fd9\u4e2a\u8bbe\u8ba1\u5b9e\u73b0\u589e\u91cf\u5907\u4efd\uff0c\u6240\u4ee5\u865a\u62df\u673a\u5907\u4efd\uff08Datastore\uff09\u7684\u540e\u7aef\u90fd\u662f\u76ee\u5f55\u3002\u6dfb\u52a0 Datastore \u53ea\u9700\u8981\u6307\u5b9a\u4e00\u4e2a\u76ee\u5f55\uff0c\u53d6\u4e00\u4e2a\uff08\u7b80\u77ed\u7684\uff09\u540d\u5b57\u5c31\u53ef\u4ee5\u4e86\u3002\u5efa\u8bae\u4e0d\u8981\u4f7f\u7528\u6587\u4ef6\u7cfb\u7edf\u7684\u6839\u76ee\u5f55\u4f5c\u4e3a Datastore\uff0c\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a <code>pbs</code> \u6587\u4ef6\u5939\u7528\u4f5c Datastore\uff0c\u53c2\u8003\u4e0b\u9762\u6240\u8ff0\u7684 esxi-5 \u4e0a\u7684\u914d\u7f6e\u3002</p> <p>\u76ee\u524d\u5728 esxi-5 \u4e0a\u914d\u7f6e\u4e86\u4ee5\u4e0b datastore\uff1a</p> <ul> <li><code>/mnt/raid1/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/raid1</code>\uff0c\u662f esxi-5 \u673a\u8eab\u7684\u4e24\u5757\u5feb\u8981\u574f\u6389\u7684 2 TB HDD RAID-1\uff0c\u5df2\u7ecf\u6302\u4e86\uff1b</li> <li><code>/mnt/data/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/data</code>\uff0c\u662f\u4e00\u4e2a\u5bb9\u91cf\u4e3a 7 TB \u7684\u673a\u8eab HDD \u9635\u5217\uff1b</li> <li><code>/mnt/vdp2/pbs</code>\uff1a\u6302\u8f7d\u70b9\u4e3a <code>/mnt/vdp2</code>\uff0c\u662f\u4e00\u4e2a\u5bb9\u91cf\u4e3a 14 TB \u7684 iSCSI \u5916\u7f6e HDD \u9635\u5217\uff0c\u662f\u6211\u4eec\u76ee\u524d\u5907\u4efd\u865a\u62df\u673a\u7684\u4e3b\u8981\u5b58\u50a8\u3002</li> </ul>"},{"location":"infrastructure/proxmox/pve/","title":"Proxmox Virtual Environment (PVE)","text":"<p>LUG \u76ee\u524d\u670d\u5f79\u7684 Proxmox VE \u4e3b\u673a\u6709\uff1a</p> <ul> <li>pve-5 \u662f james \u5728 2021 \u5e74\u5e95\u7ed9\u6211\u4eec\u7684\uff0c\u7528\u4e8e\u66ff\u6362\u5df2\u8fd0\u884c\u591a\u5e74\u7684 esxi-5\uff08\u56e0\u6b64\u547d\u540d\u4e3a pve-5\uff09</li> <li> <p>esxi-5 \u662f 2011 \u5e74\u7684 mirrors \u670d\u52a1\u5668\uff0c\u4e8e 2016 \u5e74\u9000\u5f79\u540e\u6539\u88c5\u4e3a ESXi\uff0c\u73b0\u5728\u5df2\u66ff\u6362\u4e3a Proxmox VE</p> <ul> <li>esxi-5 \u4e0a\u9762\u989d\u5916\u52a0\u88c5\u4e86 Proxmox Backup Server \u7528\u4e8e\u63d0\u4f9b\u5907\u4efd\u529f\u80fd\uff0c\u8be6\u60c5\u53c2\u89c1 Proxmox Backup Server</li> <li> <p>PVE \u7684 web \u7aef\u53e3\u4e3a 8006\uff0c\u800c PBS \u7684\u7aef\u53e3\u4e3a 8007\uff0c\u56e0\u6b64\u5728\u4e00\u53f0\u4e3b\u673a\u4e0a\u540c\u65f6\u5b89\u88c5 PVE \u548c PBS \u4e92\u4e0d\u51b2\u7a81\uff0c\u8bbf\u95ee\u65f6\u9700\u8981\u4f7f\u7528 HTTPS \u5e76\u6307\u5b9a\u7aef\u53e3\u3002</p> <p>PVE \u548c PBS \u7684\u7aef\u53e3\u90fd\u662f\u56fa\u5b9a\u7684\uff0c\u65e0\u6cd5\u66f4\u6539</p> </li> </ul> </li> <li> <p>pve-6 \u662f\u4e00\u53f0\u8f83\u8001\u7684\u670d\u52a1\u5668\uff0c\u5728\u6539\u88c5\u524d\u8fd0\u884c ESXi 6.0\uff0c\u56e0\u6b64\u4e3b\u673a\u540d\u66fe\u7ecf\u662f esxi-6\u3002</p> <p>pve-1 \u5230 pve-4 \u53bb\u54ea\u4e86\uff1f</p> <p>esxi-1 \u548c esxi-3 \u5df2\u7ecf\u574f\u6389\u5f88\u591a\u5e74\u4e86\uff0c\u540c\u6279\u6b21 5 \u53f0\u673a\u5668\u5df2\u7ecf\u574f\u6389\u4e86 3 \u53f0\uff08\u53e6\u5916\u4e00\u4e2a\u662f vm-nfs\uff0cesxi-6 \u4e0d\u5c5e\u4e8e\u8be5\u6279\u6b21\uff09\u3002</p> <p>pve-2 \u548c pve-4 \u7531 esxi-2 \u548c esxi-4 \u6539\u88c5\u800c\u6765\uff0c\u7531\u4e8e\u8fc7\u4e8e\u53e4\u8001\uff082007 \u5e74\uff09\uff0c\u5373\u4f7f\u6ca1\u574f\uff0c\u6211\u4eec\u4e5f\u5c06\u5b83\u4eec\u4e0b\u67b6\u5904\u7406\u6389\u4e86\u3002</p> </li> </ul> <p>\u8fd9\u4e9b PVE \u4e3b\u673a\u914d\u7f6e\u4e3a\u4e00\u4e2a\u96c6\u7fa4\uff0c\u53ef\u4ee5\u5171\u4eab\u4e00\u4e9b\u914d\u7f6e\u4fe1\u606f\u5e76\u4e92\u76f8\u8fc1\u79fb\u865a\u62df\u673a\u3002\u7279\u522b\u5730\uff0cProxmox VE Authentication Server\uff08Realm \u4e3a pve\uff09\u7684\u8d26\u53f7\u5728 PVE \u4e3b\u673a\u4e4b\u95f4\u662f\u5171\u4eab\u7684\uff0c\u5e76\u4e14\u6dfb\u52a0\u7684 PBS \u5b58\u50a8\u540e\u7aef\u4e5f\u662f\u5171\u4eab\u7684\uff0c\u5373\u5927\u5bb6\u90fd\u53ef\u4ee5\u5f80\u76f8\u540c\u7684 PBS \u4e0a\u5907\u4efd\u865a\u62df\u673a\u3002</p> <p>\u4e0d\u540c\u4e3b\u673a\u4e4b\u95f4\u7684 Linux PAM \u7528\u6237\u662f\u4e0d\u76f8\u901a\u7684</p> <p>\u6240\u6709 Proxmox \u4e3b\u673a\u7684\u4e3b\u673a\u540d\uff08hostname\uff09\u90fd\u8bbe\u4e3a <code>&lt;hostname&gt;.vm.ustclug.org</code>\uff0c\u5bf9\u5e94\u7684 IP \u5730\u5740\u8bb0\u5f55\u5728 DNS \u4e2d\u3002</p>"},{"location":"infrastructure/proxmox/pve/#common","title":"\u516c\u7528\u914d\u7f6e","text":""},{"location":"infrastructure/proxmox/pve/#root","title":"root \u8d26\u6237","text":"<p>\u5df2\u5e9f\u5f03\u7684\u5185\u5bb9</p> <p>\u4e3a\u4e86\u4fbf\u4e8e\u901a\u8fc7 IPMI \u7b49\u65b9\u5f0f\u7ef4\u62a4\uff0c\u6211\u4eec\u7ea6\u5b9a\u6240\u6709 Proxmox \u4e3b\u673a\u7684 root \u8d26\u6237\u5bc6\u7801\u4fdd\u6301\u4e3a\u7a7a\u3002\u82e5\u6709\u64cd\u4f5c\u9700\u8981\u4f7f\u7528 root \u5bc6\u7801\uff08\u5982\u521b\u5efa\u548c\u52a0\u5165\u96c6\u7fa4\u65f6\uff09\uff0c\u8bf7\u901a\u8fc7 SSH \u6216 IPMI \u767b\u5f55\uff0c\u4e34\u65f6\u8bbe\u7f6e\u4e00\u4e2a root \u5bc6\u7801\uff0c\u5e76\u5728\u4fee\u6539\u5b8c PVE / PBS \u7684\u914d\u7f6e\u540e\u5c06\u5bc6\u7801\u5220\u9664\uff08<code>passwd -d</code>\uff09\u3002PVE / PBS \u6ca1\u6709\u4f9d\u8d56\u4e8e\u56fa\u5b9a\u4e0d\u53d8\u7684 root \u5bc6\u7801\u624d\u80fd\u6b63\u5e38\u8fd0\u884c\u7684\u7ec4\u4ef6\uff0c\u56e0\u6b64\u8fd9\u6837\u505a\u5bf9 PVE / PBS \u6765\u8bf4\u662f\u6ca1\u95ee\u9898\u7684\u3002</p>"},{"location":"infrastructure/proxmox/pve/#networking","title":"\u7f51\u7edc\u914d\u7f6e","text":"<p>\u5b89\u5168\u8d77\u89c1\uff0cPVE / PBS \u4e3b\u673a\u4f7f\u7528 RFC 1918 \u6bb5\u7684\u6821\u56ed\u7f51 IP\uff0c\u4e0d\u8fde\u63a5\u516c\u7f51\u3002</p> <ul> <li>\u4e1c\u56fe\u53ef\u7528\u7684 IP \u6bb5\u4e3a 192.168.93.0/24\uff08\u7f51\u5173 93.254\uff09</li> <li>\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u53ef\u7528\u7684 IP \u6bb5\u4e3a 10.38.95.0/24\uff08\u7f51\u5173 95.254\uff09</li> </ul> <p>Debian \u548c Proxmox \u7684\u8f6f\u4ef6\u66f4\u65b0\u4f7f\u7528 mirrors.ustc.edu.cn \u5373\u53ef\uff0c\u82e5\u6709\u9700\u8981\u8bbf\u95ee\u6821\u5916\uff08\u5982 GitHub \u7b49\uff09\uff0c\u8bf7\u5199 hosts \u5e76\u914d\u7f6e\u8def\u7531\uff0c\u4ee5 GitHub \u4e3a\u4f8b\uff1a</p> <pre><code>echo \"20.205.243.166 github.com\" &gt;&gt; /etc/hosts\nip route replace 20.205.243.166 via (?) dev (?)\n</code></pre> <p>\u5176\u4e2d <code>via</code> \u9009\u62e9 gateway-el \u6216 gateway-nic \u7684\u5185\u7f51\u5730\u5740\uff0c<code>dev</code> \u9009\u62e9\u6865\u63a5\u5185\u7f51\u7684 vmbr\uff08\u89c1\u4e0b\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pve/#vmbr","title":"\u865a\u62df\u673a\u7f51\u6865","text":"<p>Proxmox VE \u8981\u6c42\u4e3a\u865a\u62df\u673a\u63a5\u5165\u7684\u7f51\u6865\u5fc5\u987b\u547d\u540d\u4e3a <code>vmbrN</code>\uff0c\u5176\u4e2d N \u662f 0-4094 \u4e4b\u95f4\u7684\u6574\u6570\u3002\u65b9\u4fbf\u8d77\u89c1\uff0c\u6211\u4eec\u5728\u4e24\u4e2a\u673a\u623f\u5206\u522b\u7edf\u4e00 vmbr \u7684\u7f16\u53f7\uff1a</p> \u7f16\u53f7 \u4e1c\u56fe \u7f51\u7edc\u4e2d\u5fc3 vmbr0 \u6821\u56ed\u7f51\uff08\u6559\u80b2\u7f51\uff09 \u6821\u56ed\u7f51\uff08\u6559\u80b2\u7f51\uff09 vmbr1 \u5185\u7f51 \u5185\u7f51 vmbr2 \u7535\u4fe1+\u79fb\u52a8 \u7535\u4fe1 vmbr3 - \u8054\u901a vmbr4 - \u79fb\u52a8 vmbr5 - \u7279\u6b8a\u7528\u9014 vmbr10 \u5907\u7528 -"},{"location":"infrastructure/proxmox/pve/#pve-firewall","title":"\u9632\u706b\u5899","text":"<p>\u6211\u4eec\u4e0d\u4f7f\u7528 Proxmox \u81ea\u5e26\u7684\u9632\u706b\u5899\u529f\u80fd\uff0c\u4f46 pve-firewall \u4ecd\u7136\u4f1a\u5c1d\u8bd5\u90e8\u7f72\u6216\u6062\u590d\u9632\u706b\u5899\u8bbe\u7f6e\uff0c\u56e0\u6b64\u9700\u8981\u7981\u7528\u76f8\u5173\u8bbe\u7f6e\u53ca\u670d\u52a1\uff1a</p> /etc/pve/nodes/$(hostname -s)/host.fw<pre><code>[OPTIONS]\nenable: 0\n</code></pre> <pre><code>systemctl stop pve-firewall.service\nsystemctl disable pve-firewall.service\nsystemctl mask pve-firewall.service\n</code></pre> <p>\u53ef\u9009\u5185\u5bb9\uff1a\u540c\u65f6\u5b89\u88c5 <code>iptables-persistent</code> \u8f6f\u4ef6\u5305\uff0c\u5e76\u5229\u7528 iptables \u5c06 443 \u7aef\u53e3\u8f6c\u53d1\u5230 8006 \u7aef\u53e3\u65b9\u4fbf\u4f7f\u7528\u3002</p> <pre><code>update-alternatives --set iptables /usr/sbin/iptables-nft\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-nft\n</code></pre> /etc/iptables/rules.v4<pre><code>*nat\nPREROUTING ACCEPT [0:0]\nINPUT ACCEPT [0:0]\nOUTPUT ACCEPT [0:0]\nPOSTROUTING ACCEPT [0:0]\n-A PREROUTING -p tcp --dport 443 -m addrtype --dst-type LOCAL -j REDIRECT --to-ports 8006\nCOMMIT\n</code></pre> <p>\u5220\u6389 <code>rules.v6</code> \u6587\u4ef6\uff0c\u7136\u540e\u8fd0\u884c <code>systemctl restart netfilter-persistent.service</code> \u8f7d\u5165 iptables \u89c4\u5219\u3002</p>"},{"location":"infrastructure/proxmox/pve/#ntp","title":"NTP \u65f6\u95f4","text":"<p>Proxmox \u9ed8\u8ba4\u4f7f\u7528 chrony \u8f6f\u4ef6\u548c Debian \u63d0\u4f9b\u7684 NTP pool\uff0c\u8fd9\u4e9b\u670d\u52a1\u5668\u90fd\u5728\u6821\u5916\uff0c\u4f7f\u7528\u6821\u56ed\u7f51 IP \u65e0\u6cd5\u8fde\u901a\uff0c\u9700\u8981\u6539\u6210\u6821\u56ed\u7f51\u7684 NTP \u670d\u52a1\u5668\uff1a</p> /etc/chrony/chrony.conf<pre><code># Use Debian vendor zone.\n#pool 2.debian.pool.ntp.org iburst\nserver time.ustc.edu.cn iburst\n</code></pre> <p>\u7136\u540e\u8fd0\u884c <code>systemctl restart chrony.service</code> \u91cd\u542f\u670d\u52a1\u3002</p>"},{"location":"infrastructure/proxmox/pve/#ssl","title":"SSL \u8bc1\u4e66","text":"<p>\u53c2\u89c1 SSL \u8bc1\u4e66\uff0c\u6b63\u597d vdp \u4e0a\u9762\u8fd0\u884c\u4e86 LUG FTP \u800c\u56e0\u6b64\u914d\u7f6e\u4e86\u8bc1\u4e66\u7684\u81ea\u52a8\u66f4\u65b0\uff0c\u5229\u7528 vdp \u63d0\u4f9b\u7684 NFS \u670d\u52a1\uff0c\u6211\u4eec\u5728 vdp \u4e0a\u7684\u8bc1\u4e66\u66f4\u65b0\u811a\u672c\u4e2d\u6dfb\u52a0\u4e86\u5c06 vm \u8bc1\u4e66\u590d\u5236\u5230 NFS \u76ee\u5f55\u7684\u529f\u80fd\uff0c\u7136\u540e\u7531 pve-6 \u90e8\u7f72\u5230\u5404\u4e2a\u4e3b\u673a\u4e0a\u3002</p> <p>\u4e0b\u9762\u662f pve-6 \u4e0a\u7684\u811a\u672c\uff1a</p> /etc/cron.daily/sync-cert<pre><code>#!/bin/bash -e\n\nSRC=\"/etc/pve/nodes/$(hostname -s)\"\nDSTROOT=\"/etc/pve/nodes\"\nCERTSRC=\"/mnt/nfs-el/cert\"\n\ncp -u \"$CERTSRC/privkey.pem\" \"$SRC/pveproxy-ssl.key\"\ncp -u \"$CERTSRC/fullchain.pem\" \"$SRC/pveproxy-ssl.pem\"\nsystemctl reload pveproxy.service\n\nfor DST in \"$DSTROOT\"/*; do\n  [ \"$DST\" = \"$SRC\" ] &amp;&amp; continue\n  node=\"$(basename \"$DST\")\"\n  cp \"$SRC/pveproxy-ssl.key\" \"$SRC/pveproxy-ssl.pem\" \"$DST/\"\n  ssh \"$node\" 'systemctl reload pveproxy.service' &amp;\ndone\nwait\n</code></pre> <p>\u7531\u4e8e PVE \u548c PBS \u7684\u6570\u636e\u4e0d\u4e92\u901a\uff0c\u56e0\u6b64 esxi-5 \u4e0a\u7684\u76f8\u540c\u4f4d\u7f6e\u6709\u53e6\u4e00\u4e2a\u811a\u672c\u4e3a PBS \u90e8\u7f72\u8bc1\u4e66\uff1a</p> /etc/cron.daily/sync-cert<pre><code>#!/bin/bash\n\nSRC=\"/etc/pve/nodes/$(hostname -s)\"\nDST=\"/etc/proxmox-backup\"\n\nif ! cmp -s \"$SRC/pveproxy-ssl.pem\" \"$DST/proxy.pem\"; then\n  cp \"$SRC/pveproxy-ssl.key\" \"$DST/proxy.key\"\n  cp \"$SRC/pveproxy-ssl.pem\" \"$DST/proxy.pem\"\n  systemctl reload proxmox-backup-proxy.service\nfi\nexit 0\n\n# Unreachable code, leaving here for reference\nif command -v openssl 2&gt;/dev/null; then\n  FP=\"$(openssl x509 -noout -fingerprint -sha256 -inform pem -in \"$DST/proxy.pem\")\"\n  FP=\"${FP##*=}\"\n  pvesm set esxi-5-data --finerprint \"$FP\"\n  pvesm set esxi-5-vdp2 --finerprint \"$FP\"\nfi\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#pve-5","title":"pve-5","text":"<p>pve-5 \u4f4d\u4e8e\u7f51\u7edc\u4e2d\u5fc3\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5-2603 v4 (Broadwell 6C6T, 1.70 GHz, no HT, no Turbo Boost) Xeon E5-2667 v4 (Broadwell 8C16T, 3.20 GHz, Max 3.60 GHz)\uff0c256 GB \u5185\u5b58\u548c\u4e00\u5927\u5806 SSD\uff082\u00d7 \u4e09\u661f 240 GB SATA + 10x Intel DC S4500 1.92 TB SATA\uff09\u3002\u6211\u4eec\u5c06\u4e24\u5757 240 GB \u7684\u76d8\u7ec4\u6210\u4e00\u4e2a LVM VG\uff0c\u5206\u914d 16 GB \u7684 rootfs\uff08LVM mirror\uff09\u548c 8 GB \u7684 swap\uff0c\u5176\u4f59\u7a7a\u95f4\u7ed9\u4e00\u4e2a thinpool\u3002\u5341\u5757 1.92 TB \u7684\u76d8\u7ec4\u6210\u4e00\u4e2a RAIDZ2 \u7684 zpool\uff0c\u7528\u4e8e\u5b58\u50a8\u865a\u62df\u673a\u7b49\u6570\u636e\u3002</p> <p>\u5176\u8fde\u63a5\u7684\u5355\u6839 10 Gbps \u7684\u5149\u7ea4\uff0c\u6865\u63a5\u51fa <code>vmbr0</code> \u81f3 <code>vmbr4</code> \u7b49\u7f51\u6865\uff08\u7ebf\u8def\u5b9a\u4e49\u89c1\u4e0a\uff09\u3002\u5176\u4e2d\u65e0\u5934\u7f51\u6865\u7528\u4e8e\u4ece gateway-nic \u6865\u63a5 Tinc\u3002</p> <p>\u786c\u76d8\u63a7\u5236\u5668\u4e0d\u8981\u4f7f\u7528 VirtIO SCSI Single \u6216 LSI \u5f00\u5934\u7684\u9009\u9879</p> <p>\u53ef\u80fd\u7531\u4e8e ZFS \u6a21\u5757\u7684 bug \u6216\u8005\u5185\u5b58\u6761\u6545\u969c\uff0c\u4f7f\u7528\u8fd9\u4e9b\u6a21\u5f0f\u5728\u865a\u62df\u673a\u91cd\u542f\u65f6\u4f1a\u5bfc\u81f4\u6574\u4e2a Proxmox VE \u4e3b\u673a\u5361\u4f4f\u800c\u4e0d\u5f97\u4e0d\u91cd\u542f\u3002\u8bf7\u4f7f\u7528 VirtIO SCSI\uff08\u4e0d\u5e26 Single\uff09\u3002\u540c\u6837\u539f\u56e0\u521b\u5efa\u865a\u62df\u673a\u786c\u76d8\u65f6\u4e5f\u4e0d\u8981\u52fe\u9009 iothread\u3002</p> <p>\u4e3b\u673a\u4f7f\u7528 ZFS\uff08Zvol\uff09\u4f5c\u4e3a\u865a\u62df\u673a\u7684\u865a\u62df\u786c\u76d8\uff0c\u5728\u865a\u62df\u673a\u4e2d\u542f\u7528 <code>fstrim.timer</code>\uff08systemd \u7684 fstrim \u5b9a\u65f6\u4efb\u52a1\uff0c\u7531 <code>util-linux</code> \u63d0\u4f9b\uff09\u53ef\u4ee5\u5b9a\u671f\u817e\u51fa\u4e0d\u7528\u7684\u7a7a\u95f4\uff0c\u5e2e\u52a9 ZFS \u66f4\u597d\u5730\u89c4\u5212\u7a7a\u95f4\u3002\u542f\u7528 fstrim \u7684\u865a\u62df\u786c\u76d8\u9700\u8981\u5728 PVE \u4e0a\u542f\u7528 <code>discard</code> \u9009\u9879\uff0c\u5426\u5219 fstrim \u4e0d\u8d77\u4f5c\u7528\u3002\u8be5\u7279\u6027\u662f\u7531\u4e8e ZFS \u662f CoW \u7684\uff0c\u4e0e ZFS \u5e95\u5c42\u4f7f\u7528 SSD \u6ca1\u6709\u592a\u5927\u5173\u8054\u3002</p>"},{"location":"infrastructure/proxmox/pve/#esxi-5","title":"esxi-5","text":"<p>esxi-5 \u4e5f\u4f4d\u4e8e\u7f51\u7edc\u4e2d\u5fc3\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5620\uff08Westmere-EP 4C8T, 2.40~2.66 GHz\uff09\uff0c48 GB \u5185\u5b58\uff0c\u4e24\u5757 240 GB SATA SSD \u548c\u4e00\u4e9b\u4e0d\u77e5\u9053\u574f\u4e86\u591a\u5c11\u7684 1 TB \u548c 2 TB HDD\uff08\u89c1\u4e0b\uff09\u3002\u7531\u4e8e\u673a\u8eab\u81ea\u5e26\u7684 RAID \u5361\u4e0d\u652f\u6301\u786c\u76d8\u76f4\u901a\uff08JBOD \u6a21\u5f0f\uff09\uff0c\u56e0\u6b64\u6211\u4eec\u5c06\u4e24\u5757 SSD \u5206\u522b\u505a\u6210\u5355\u76d8\u201c\u9635\u5217\u201d\u7136\u540e\u5728\u7cfb\u7edf\u91cc\u4f7f\u7528 LVM\uff08LVM \u89c4\u683c\u4e0e pve-5 \u76f8\u540c\uff09</p> <p>\u987e\u540d\u601d\u4e49\u672c\u673a\u5668\u66fe\u7ecf\u8fd0\u884c\u7684\u662f VMware ESXi\uff0c\u5728 2022 \u5e74 1 \u6708\u91cd\u88c5\u4e3a Proxmox VE 7.1\uff0c\u56e0\u4e3a\u54b1\u4eec\u90fd\u662f\u7ea0\u7ed3\u602a\u6240\u4ee5\u51b3\u5b9a\u4e0d\u6539\u540d\uff0c\u8fd8\u53eb esxi-5\u3002\u8003\u8651\u5230\u8be5\u673a\u5668\u914d\u7f6e\u4e86\u591a\u4e2a\u786c\u76d8\u9635\u5217\uff0c\u4e14\u9635\u5217\u7684\u53ef\u7528\u5bb9\u91cf\u6bd4 pve-5 \u7684\u786c\u76d8\u7684\u539f\u59cb\u5bb9\u91cf\u8fd8\u5927\uff0c\u6211\u4eec\u5728\u4e0a\u9762\u52a0\u88c5 Proxmox Backup Server \u8f6f\u4ef6\uff0c\u4e3b\u8981\u7528\u4f5c\u865a\u62df\u673a\u5907\u4efd\uff0c\u66ff\u4ee3\u539f\u5148\u8fd0\u884c\u5728 ESXi \u4e0a\u7684 vSphereDataProtection \u865a\u62df\u673a\u3002</p>"},{"location":"infrastructure/proxmox/pve/#_1","title":"\u7f51\u7edc","text":"<p>\u7f51\u7edc\u914d\u7f6e\u4e0e pve-5 \u76f8\u4f3c\uff0c\u5176\u4e0a\u6709\u4e24\u4e2a\u5343\u5146\u7f51\u5361 enp3s0 \u548c enp4s0\u3002enp3s0 \u8fde\u63a5\u7f51\u7edc\u4e2d\u5fc3\u7684\u4ea4\u6362\u673a\uff0c\u6865\u63a5\u4e0d\u540c\u7684 VLAN \u7f51\u7edc\u7ed9\u865a\u62df\u673a\uff0c\u5e76\u4e14\u5404 vmbrX \u7684\u6570\u5b57\u548c\u7aef\u53e3\u4e0e pve-5 \u4e00\u81f4\uff1b\u800c enp4s0 \u8fde\u63a5\u4e00\u4e2a\u5916\u90e8\u9635\u5217\uff08vdp2\uff09\uff0c\u4f7f\u7528 iSCSI \u8bbf\u95ee\u8be5\u9635\u5217\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u53ea\u6709\u4e00\u4e2a gateway-nic\uff0c\u800c pve-5 \u548c esxi-5 \u4e24\u4e2a\u4e3b\u673a\u90fd\u4f9d\u8d56 gw-nic \u6865\u63a5\u7684 tinc \u6765\u63a5\u5165\u5185\u7f51\uff0c\u56e0\u6b64\u6211\u4eec\u5728 pve-5 \u548c esxi-5 \u4e4b\u95f4\u62c9\u4e86\u4e00\u6761 GRETAP \u96a7\u9053\uff0c\u5e76\u5728\u4e24\u4e2a\u4e3b\u673a\u4e0a\u5206\u522b\u5c06 VTEP \u6865\u63a5\u5230 vmbr1\u3002</p> <p>\u53c2\u8003\u914d\u7f6e\uff1a</p> pve-5:/etc/network/interfaces<pre><code>auto gretap0esxi-5\niface gretap0esxi-5 inet manual\n    pre-up ip link add name $IFACE mtu $IF_MTU type gretap local 10.38.95.115 remote 10.38.95.111\n    post-down ip link delete $IFACE\n    mtu 1500\n\nauto vmbr1\niface vmbr1 inet static\n    address 10.254.0.240/21\n    bridge-ports gretap0esxi-5\n    bridge-stp off\n    bridge-fd 0\n</code></pre> <p>esxi-5 \u8fd9\u7aef\u7684\u914d\u7f6e\u5219\u5c06\u5bf9\u5e94\u7684 iface \u540d\u79f0\u548c IP \u5730\u5740\u7b49\u5168\u90e8\u5bf9\u6362\u5373\u53ef\u3002</p> <p>MTU \u95ee\u9898</p> <p>2022 \u5e74 2 \u6708\u5904\u7406\u5185\u7f51 tinc ARP \u95ee\u9898\u65f6\u53d1\u73b0 esxi-5 \u548c pve-5 \u7684 vmbr1 MTU \u90fd\u88ab\u8bbe\u7f6e\u6210\u4e86 1462\uff08GRETAP \u7684\u9ed8\u8ba4 MTU\uff09\u3002\u6211\u4eec\u4e0d\u786e\u5b9a MTU \u95ee\u9898\u4e0e tinc \u662f\u5426\u76f8\u5173\uff0c\u4f46\u4fdd\u9669\u8d77\u89c1\u6211\u4eec\u8fd8\u662f\u5c06\u8be5 GRETAP \u754c\u9762\u7684 MTU \u8bbe\u7f6e\u6210\u4e86 1500\uff08GRE \u5177\u6709\u5206\u7247\u529f\u80fd\uff09\u3002</p> <pre><code>-pre-up ip link add name $IFACE type gretap local 10.38.95.115 remote 10.38.95.111\n+pre-up ip link add name $IFACE mtu $IF_MTU type gretap local 10.38.95.115 remote 10.38.95.111\n post-down ip link delete $IFACE\n+mtu 1500\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#iscsi","title":"iSCSI","text":"<p>\u8bbe\u7f6e iSCSI \u5f00\u673a\u81ea\u52a8\u767b\u5f55\uff1a</p> <pre><code>iscsiadm -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 -o update -n node.startup -v automatic\niscsiadm -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 -o update -n node.conn[0].startup -v automatic\n</code></pre> <p>\u53c2\u8003\u94fe\u63a5\uff1ahttps://library.netapp.com/ecmdocs/ECMP1654943/html/GUID-8EC685B4-8CB6-40D8-A8D5-031A3899BCDC.html</p> \u8fc7\u65f6\u4fe1\u606f <p>\u7531\u4e8e\u6211\u4eec\u6ca1\u6709\u7814\u7a76\u6e05\u695a open-iscsi \u7684\u5f00\u673a\u81ea\u52a8\u6302\u8f7d\u673a\u5236\uff0c\u56e0\u6b64\u6211\u4eec\u9009\u62e9\u76f4\u63a5 override \u5bf9\u5e94\u7684 service \u6765\u5b8c\u6210\u8fd9\u4e2a\u4efb\u52a1\uff1a</p> $ systemctl edit open-iscsi.service<pre><code>[Service]\nExecStart=\nExecStart=/sbin/iscsiadm -d8 -m node -T iqn.2002-10.com.infortrend:raid.sn8223150.001 -p 192.168.10.1:3260 --login\nExecStart=/lib/open-iscsi/activate-storage.sh\n</code></pre> <p>\u82e5 iSCSI \u8fde\u63a5\u6210\u529f\uff0c\u5e94\u8be5\u53ef\u4ee5\u5728\u7cfb\u7edf\u4e2d\u770b\u5230\u4e00\u4e2a\u65b0\u7684\u786c\u76d8\uff0c\u5bb9\u91cf\u4e3a 14.55 TiB\uff0c\u578b\u53f7\u663e\u793a\u4e3a RS-3116I-S42-6\u3002</p>"},{"location":"infrastructure/proxmox/pve/#rootfs-backup","title":"rootfs \u5907\u4efd","text":"<p>\u5c3d\u7ba1 esxi-5 \u7684 rootfs \u4e5f\u4f7f\u7528\u4e86 LVM mirror \u5728\u4e24\u5757 SSD \u4e0a\u955c\u50cf\uff0c\u4f46\u662f\u6211\u4eec\u4e0d\u592a\u4fe1\u4efb\u8fd9\u5757 RAID \u5361\uff0c\u56e0\u6b64\u6211\u4eec\u5c06 esxi-5 \u7684 rootfs \u6bcf\u5929\u5907\u4efd\u5230 vdp2 \u4e0a\u3002\u4e3a\u4e86\u907f\u514d\u5728 vdp2 \u6389\u7ebf\u7684\u65f6\u5019\u4e71\u201c\u5907\u4efd\u201d\uff0c\u6211\u4eec\u4f7f\u7528\u4e00\u4e2a systemd \u670d\u52a1\uff0c\u8bbe\u7f6e\u4e86 <code>RequiresMountsFor</code> \u4f9d\u8d56\uff1a</p> /etc/systemd/system/rootfs-backup.service<pre><code>[Unit]\nDescription=Backup rootfs to vdp2\nRequiresMountsFor=/mnt/vdp2\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/rsync -aHAXx --delete / /mnt/vdp2/rootfs/\n</code></pre> crontab<pre><code>21 4 * * * systemctl start rootfs-backup.service\n</code></pre>"},{"location":"infrastructure/proxmox/pve/#esxi-5-others","title":"\u5176\u4ed6\u8bb0\u5f55","text":"<p>esxi-5 \u4e8e 2021/8 \u53d1\u73b0\u81ea\u5e26\u9635\u5217\u6709\u4e24\u5757\u574f\u76d8\uff0c\u5728\u66f4\u6362\u540e\u53d1\u73b0 storage \"root\"\uff08\u5b58\u653e vcenter \u865a\u62df\u673a\uff0c\u7ec4\u5efa RAID 1 \u540e\u5927\u5c0f 1.8 TB\uff09\u65e0\u6cd5\u6b63\u5e38 rebuild\uff0c\u5e76\u4e14 vcenter \u865a\u62df\u673a\u7684 vmdk \u6587\u4ef6\u6709 4 \u4e2a\u51fa\u73b0 I/O error\u3002\u6b64\u540e vcenter \u865a\u62df\u673a\u5df2\u7ecf\u8fc1\u79fb\u5230 storage \"data\" (RAID10, 7.2 TB) \u5e76\u6b63\u5e38\u5de5\u4f5c\u3002</p>"},{"location":"infrastructure/proxmox/pve/#records","title":"\u5de5\u4f5c\u8bb0\u5f55","text":""},{"location":"infrastructure/proxmox/pve/#migrate-docker2","title":"2021-12-31 \u8fc1\u79fb docker2","text":"<p>docker2 \u539f\u5148\u4f7f\u7528 QEMU \u76f4\u63a5\u8fd0\u884c\u5728 mirrors2 \u4e0a\uff0c\u4e0b\u5c42\u5b58\u50a8\u4e3a ZFS Zvol\uff08<code>pool0/qemu/docker2</code>\uff09\uff0c\u7531\u4e8e ZFS \u8c03\u53c2\u4e0d\u5f53\u4f7f\u5176\u5360\u7528\u4e86 3 \u500d\u7684\u786c\u76d8\u7a7a\u95f4\uff08\u89c1\u8fd9\u4e2a Reddit \u8d34\u5b50\uff09\uff0c\u52a0\u4e0a mirrors2 \u672c\u8eab\u5bf9\u5916\u63d0\u4f9b Rsync \u670d\u52a1\uff0c\u786c\u76d8\u8d1f\u8f7d\u6781\u9ad8\uff0c\u6240\u4ee5\u957f\u671f\u4ee5\u6765 docker2 \u7684 I/O \u6027\u80fd\u5341\u5206\u4f4e\u4e0b\u3002\u6b63\u597d\u501f\u8fd9\u6b21\u5168\u95ea\u7684\u65b0\u5bbf\u4e3b\u673a\u5c06\u5176\u8fc1\u79fb\u8fc7\u53bb\u3002</p> <p>\u8fc1\u79fb\u65f6\u9700\u8981\u4fdd\u8bc1\u5b8c\u6574\u6027\u7684\u4e3b\u8981\u5185\u5bb9\u5c31\u662f\u865a\u62df\u673a\u5185\u7684\u4e1a\u52a1\uff0c\u56e0\u6b64\u9700\u8981\u5728\u4e3b\u673a\u95f4\u4f20\u8f93\u7684\u5185\u5bb9\u5c31\u662f\u865a\u62df\u78c1\u76d8\uff0c\u5176\u4ed6\u914d\u7f6e\uff08CPU\u3001\u5185\u5b58\u3001\u7f51\u5361\u7b49\uff09\u90fd\u53ef\u4ee5\u76f4\u63a5\u5728\u65b0\u5e73\u53f0\u4e0a\u521b\u5efa\u65b0\u865a\u62df\u673a\u65f6\u4fee\u6539\u3002\u539f\u672c\u6211\u4eec\u6253\u7b97\u4f7f\u7528 rsync \u6216\u8005 dd \u7684\u65b9\u5f0f\u590d\u5236\u78c1\u76d8\uff0c\u4f46\u662f\u8003\u8651\u5230\u4e24\u8fb9\u90fd\u662f ZFS\uff0c\u4f7f\u7528 <code>zfs send</code> \u662f\u4e00\u4e2a\u66f4\u597d\u7684\u65b9\u6848\u3002</p> <p>\u6211\u4eec\u5728 pve-5 \u4e0a\u8fd0\u884c <code>nc -l -p 9999 &lt;/dev/null | pv | zfs recv rpool/data/docker2</code>\uff0c\u7136\u540e\u5728 mirrors2 \u4e0a\u5bf9 zvol \u5148\u6253\u4e2a\u5feb\u7167\uff0c\u8fd0\u884c <code>zfs send pool0/qemu/docker2@20211230 &gt; /dev/tcp/{pve-5}/9999</code> \u5c06\u5feb\u7167\u5185\u5bb9\u53d1\u9001\u5230 pve-5 \u4e0a\uff08300 GiB \u7684\u6570\u636e\u82b1\u8d39\u4e86 16 \u5c0f\u65f6\uff09\uff0c\u7136\u540e\u518d\u5c06 docker2 \u5173\u673a\u5e76\u589e\u91cf\u4f20\u8f93\uff0c<code>zfs send -i @20211230 pool0/qemu/docker2 &gt; /dev/tcp/{pve-5}/9999</code>\uff08\u589e\u91cf\u4f20\u8f93\u53ea\u53d1\u9001\u4e86 10 GB \u6570\u636e\uff09\u3002\u540c\u65f6\u6211\u4eec\u5728 Proxmox \u7684 web \u754c\u9762\u4e0a\u521b\u5efa\u4e00\u4e2a\u65b0\u865a\u62df\u673a\uff0c\u914d\u597d CPU \u5185\u5b58\u7f51\u5361\u7b49\uff0c\u5206\u914d 300 GiB \u7684\u786c\u76d8\u3002</p> <p>\u7531\u4e8e zfs send \u662f\u539f\u6837\u53d1\u9001\u7684\uff0c\u56e0\u6b64\u63a5\u6536\u5230\u7684 zvol \u786c\u76d8\u5360\u7528\u91cf\u4ecd\u7136\u6709 712 GB\u3002Proxmox \u65b0\u5efa\u7684 zvol \u53c2\u6570\u5c31\u6bd4\u8f83\u5408\u7406\uff08<code>volblocksize=16k</code>\uff09\uff0c\u6ca1\u6709\u4e25\u91cd\u653e\u5927\u7684\u95ee\u9898\uff0c\u56e0\u6b64\u6211\u4eec\u518d\u5c06\u63a5\u6536\u5230\u7684 zvol \u7ed9 dd \u8fdb\u65b0\u865a\u62df\u673a\u7684 zvol \u800c\u4e0d\u662f\u76f4\u63a5\u4f7f\u7528\u3002dd \u7ed3\u679c\u7ea6 345 GiB\uff08\u5341\u5206\u5408\u7406\uff09\uff0c\u5f00\u673a\u8fdb\u7cfb\u7edf\u8fd0\u884c fstrim \u4e4b\u540e\u5360\u7528\u91cf\u7ea6\u4e3a 240 GiB\uff08\u66f4\u52a0\u5408\u7406\u4e86\uff09\u3002</p> <p>\u8fc1\u79fb\u8fc7\u7a0b\u6ca1\u6709\u9047\u5230\u4efb\u4f55\u5751\uff0c\u4ec5\u6709\u7684\u6ce8\u610f\u4e8b\u9879\u5c31\u662f zvol \u8c03\u53c2\u9700\u8981\u91cd\u65b0 dd \u800c\u4e0d\u80fd\u76f4\u63a5\u6539\uff0c\u4ee5\u53ca\u521b\u5efa\u7f51\u5361\u7684\u987a\u5e8f\uff08\u4f1a\u5f71\u54cd\u865a\u62df\u673a\u5185\u90e8 eth0 \u548c eth1 \u7684\u987a\u5e8f\uff0c\u9664\u975e\u865a\u62df\u673a\u5185\u90e8\u4f7f\u7528 udev persistent net \u65b9\u5f0f\u6839\u636e MAC \u5730\u5740\u5c06\u7f51\u5361\u6539\u540d\uff09\u3002</p>"},{"location":"infrastructure/proxmox/pve/#esxi-5-syslog-zfs-error-cannot-open-rpool-no-such-pool","title":"esxi-5 \u7684 syslog \u4e00\u76f4\u51fa\u73b0 zfs error: cannot open 'rpool': no such pool","text":"<p>\u8fd9\u662f\u56e0\u4e3a esxi-5 \u4e0a\u9762\u6839\u672c\u5c31\u6ca1\u6709\u4f7f\u7528 ZFS\uff0c\u800c\u52a0\u5165 pve-5 \u7684\u96c6\u7fa4\u65f6\u865a\u62df\u673a\u7684\u5b58\u50a8\u4fe1\u606f\uff08<code>/etc/pve/storage.cfg</code>\uff09\u4e5f\u4ece pve-5 \u540c\u6b65\u8fc7\u6765\u5408\u5e76\u4e86\uff0c\u56e0\u6b64 esxi-5 \u5728\u6839\u636e pve-5 \u7684\u914d\u7f6e\u5c1d\u8bd5\u542f\u7528 zfs \u5b58\u50a8\u3002</p> <p>\u89e3\u51b3\u529e\u6cd5\uff1a\u7531\u4e8e <code>/etc/pve</code> \u4e0b\u5927\u591a\u6570\u5185\u5bb9\u5728\u96c6\u7fa4\u95f4\u662f\u540c\u6b65\u7684\uff0c\u6253\u5f00 <code>storage.cfg</code>\uff0c\u5728 <code>zfspool: local-zfs</code> \u4e0b\u9762\u52a0\u5165\u4e00\u884c\uff0c\u7f29\u8fdb\u4e00\u4e2a Tab \u5e76\u52a0\u4e0a <code>nodes pve-5</code>\uff0c\u8868\u793a\u8fd9\u4e2a storage \u53ea\u5728 pve-5 \u4e0a\u4f7f\u7528\u3002</p>"},{"location":"infrastructure/proxmox/pve/#pve-6","title":"pve-6","text":"<p>pve-6 \u4f4d\u4e8e\u4e1c\u56fe\uff0c\u662f\u4e00\u53f0 HP DL380G6\uff0c\u914d\u7f6e\u4e3a 2\u00d7 Xeon E5620 (Westmere 4C8T, 2.50 GHz), 72 GB \u5185\u5b58\u548cl\u4e24\u5757 300 GB \u7684 SAS \u786c\u76d8\u3002\u66fe\u7ecf\u53eb\u505a esxi-6\uff0c\u5728 2022 \u5e74 1 \u6708\u7edf\u4e00\u66f4\u6362\u4e3a Proxmox VE\u3002</p> <p>\u673a\u5668\u6709\u4e24\u4e2a\u7f51\u5361\uff0c\u5171\u6709 4 \u4e2a 1 Gbps \u7684\u63a5\u53e3\uff0c\u5176\u4e2d 3 \u4e2a\u90fd\u63a5\u5728 VLAN \u4ea4\u6362\u673a\u4e0a\uff08\u53e6\u4e00\u4e2a\u4e0d\u77e5\u9053\u63a5\u4e86\u5565\uff09\uff0c\u901a\u8fc7 VLAN \u540c\u65f6\u8fde\u63a5\u56fe\u4e66\u9986\u7684\u4e24\u4e2a\u7f51\u6bb5\u4ee5\u53ca\u7ecf\u7531 gateway-el \u6865\u63a5\u7684\u5185\u7f51\uff0c\u4ee5\u53ca\u8fde\u63a5 vdp \u6302\u8f7d NFS\u3002</p> <p>HP Smart Array</p> <p>HP \u7684\u81ea\u5e26 RAID \u5361\u7ba1\u7406\u8f6f\u4ef6\u53ef\u4ee5\u5728 http://downloads.linux.hpe.com/SDR/repo/mcp/Debian/pool/non-free/ \u4e0b\u8f7d\uff0c\u5b89\u88c5 <code>ssacli</code> \u8f6f\u4ef6\u5305\u3002\u76f8\u5173\u4f7f\u7528\u65b9\u6cd5\u53ef\u4ee5\u53c2\u8003 https://sleeplessbeastie.eu/2017/03/06/how-to-use-hp-command-line-array-configuration-utility/\u3002</p>"},{"location":"services/","title":"LUG \u670d\u52a1\u603b\u89c8","text":"<p>\u6ce8\u610f</p> <p>LUG \u7684\u4e3b\u9875\u4e0a\u8fd8\u6709\u4e00\u4efd\u300a\u7f51\u7edc\u670d\u52a1\u5217\u8868\u300b \uff0c\u5982\u679c\u6709\u670d\u52a1\u72b6\u6001\u6539\u53d8\uff0c\u8bb0\u5f97\u540c\u6b65\u66f4\u65b0\u4e3b\u9875\u4e0a\u7684\u5217\u8868\u3002</p>"},{"location":"services/#mirrors","title":"Mirrors \u955c\u50cf\u7ad9","text":"<p>\u670d\u52a1\u5668\uff1a</p> <ul> <li>\u4e3b\uff1amirrors4<ul> <li>\u4e3b\u670d\u52a1\u5668\u5b58\u50a8\u7edd\u5927\u90e8\u5206\u4ed3\u5e93\uff0c\u5bf9\u5916\u63d0\u4f9b HTTP(S), git \u4e0e Rsync \u670d\u52a1\u3002<ul> <li>HTTP(S) \u5bf9\u5e94 nginx\uff0cRsync \u5bf9\u5e94 rsync-proxy\uff0c\u4e24\u8005\u5747\u652f\u6301\u53cd\u5411\u4ee3\u7406\uff08\u56e0\u6b64\u53ef\u4ee5\u5c06\u4ed3\u5e93\u653e\u5728\u522b\u7684\u673a\u5668\u4e0a\uff0c\u540c\u65f6\u5728 mirrors4 \u5411\u5916\u63d0\u4f9b\u5bf9\u5e94\u7684\u670d\u52a1\uff09\u3002</li> <li>\u63a5\u5165\u4e86\u5305\u62ec\u6559\u80b2\u7f51\u7b49\u5728\u5185\u7684\u591a\u4e2a ISP\u3002</li> </ul> </li> <li>\u72b6\u6001\u9875\u9762\u901a\u8fc7 SSH \u96a7\u9053\u4e0e mirrors[2-3] \u66b4\u9732 Yuki \u516c\u5f00 API\u3002</li> </ul> </li> <li>\u526f\uff1amirrors3<ul> <li>mirrors3 \u5b58\u50a8\u8f83\u5927\u7684\u5b58\u6863\u7c7b\u4ed3\u5e93\u3001\u6781\u51b7\u95e8\u4e14\u7a7a\u95f4\u6781\u5927\u4e0e\u6709\u9700\u8981\u4f46\u662f mirrors4 \u653e\u4e0d\u4e0b\u7684\u4ed3\u5e93\u3002</li> <li>\u622a\u81f3\u76ee\u524d\uff082023/11\uff09\uff0c\u6709 centos-vault, openeuler, percona, ubuntu-old-releases</li> <li>https://mirrors.ustc.edu.cn/status/mirrors3.html</li> <li>\u6ce8\u610f\uff1amirrors3 \u8fde\u63a5\u7684 SAN \u7684\u7ba1\u7406\u53e3\u5df2\u7ecf\u635f\u574f\uff0c\u9700\u8981\u5b9a\u671f\u68c0\u67e5\u78c1\u76d8\u72b6\u6001\u3002</li> </ul> </li> <li>\u526f\uff1amirrors2<ul> <li>mirrors2 \u5b58\u50a8\u7684\u5185\u5bb9\u662f mirrors4 \u7684\u5b50\u96c6\uff0c\u8d1f\u8d23\u5e2e\u52a9 mirrors4 \u627f\u62c5\u4e00\u90e8\u5206 rsync \u6d41\u91cf\u7684\u538b\u529b\u3002</li> <li>rsync \u76f8\u6bd4 http(s)\uff0c\u7ed9\u670d\u52a1\u5668\u5e26\u6765\u7684\u8d1f\u8f7d\u9ad8\u5f97\u591a\u3002</li> </ul> </li> <li>\u5df2\u5e9f\u5f03\uff1amirrors1</li> </ul> <p>\u955c\u50cf\u7ad9\u65e5\u5fd7\u4f1a\u5907\u4efd\u81f3 mirrorlog \u865a\u62df\u673a\u4e0a\u3002</p>"},{"location":"services/#auth-dns","title":"\u6743\u5a01 DNS","text":"<p>\u4ee5\u4e0b\u5185\u5bb9\u7531 GPT-4 \u751f\u6210</p> <p>User: \u5411\u65b0\u624b\u8fd0\u7ef4\u4ecb\u7ecd\u4ec0\u4e48\u662f\u6743\u5a01 DNS</p> <p>Bot: \u6743\u5a01DNS\uff08Authoritative DNS\uff09\u670d\u52a1\u662f\u56e0\u7279\u7f51\u57df\u540d\u7cfb\u7edf\uff08DNS\uff09\u7684\u4e00\u90e8\u5206\uff0c\u5b83\u8d1f\u8d23\u5904\u7406\u5173\u4e8e\u5176\u8d1f\u8d23\u7ba1\u7406\u7684\u4e00\u7ec4\u57df\u540d\u7684\u67e5\u8be2\u3002\u8fd9\u4e9bDNS\u670d\u52a1\u5668\u5e26\u6709\u5173\u4e8e\u4ed6\u4eec\u6240\u8d1f\u8d23\u57df\u7684\u6240\u6709\u5fc5\u8981\u6570\u636e\uff0c\u5e76\u4ece\u7ba1\u7406\u8be5\u57df\u7684\u4eba\u6216\u7ec4\u7ec7\u4e2d\u6536\u5230\u66f4\u65b0\u3002</p> <p>\u6bd4\u5982\uff0c\u5982\u679c\u4f60\u5728\u6d4f\u89c8\u5668\u4e2d\u8f93\u5165\u4e00\u4e2a\u7f51\u7ad9\u5730\u5740\uff0c\u4f60\u7684\u8bf7\u6c42\u9996\u5148\u53d1\u9001\u5230\u9012\u5f52DNS\u670d\u52a1\u5668\uff0c\u7136\u540e\u9012\u5f52\u670d\u52a1\u5668\u67e5\u8be2\u6743\u5a01DNS\u670d\u52a1\u5668\u6765\u83b7\u53d6\u5bf9\u5e94\u7684IP\u5730\u5740\u3002\u6743\u5a01\u670d\u52a1\u5668\u5c31\u662f\u201c\u6743\u5a01\u201d\u8d44\u6e90\uff0c\u80fd\u591f\u544a\u8bc9\u9012\u5f52\u670d\u52a1\u5668\u5bf9\u5e94\u7684IP\u5730\u5740\u662f\u4ec0\u4e48\u3002\u8fd9\u4e2a\u8fc7\u7a0b\u88ab\u79f0\u4e3aDNS\u89e3\u6790\u3002</p> <p>\u603b\u7684\u6765\u8bf4\uff0c\u6743\u5a01DNS\u670d\u52a1\u5668\u5c31\u662f\u5b58\u50a8\u3001\u7ba1\u7406\u5e76\u54cd\u5e94\u7279\u5b9a\u57df\u540d\u4fe1\u606f\u7684\u201c\u6743\u5a01\u201d\u6765\u6e90\u3002</p> <p>\u6211\u4eec\u7684\u6743\u5a01 DNS \u670d\u52a1\u5668\u63d0\u4f9b\u4e86\u4e0e LUG \u6709\u5173\u7684\u57df\u540d\u7684\u76f8\u5173\u89e3\u6790\u4fe1\u606f\uff0c\u540c\u65f6\u4e5f\u662f\u4e00\u4e2a\uff08\u901a\u8fc7\u57df\u540d\uff09\u53ef\u4ee5\u6982\u89c8 LUG \u66fe\u7ecf\u4e0e\u76ee\u524d\u6709\u7684\u670d\u52a1\u7684\u5730\u65b9\u3002</p>"},{"location":"services/#lug-ftp","title":"LUG FTP","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>vdp.s.ustclug.org</code>\uff0cSSH \u7aef\u53e3 2222\u3002\u5bf9\u5916\u63d0\u4f9b HTTP(S)\uff08\u6587\u4ef6\u5217\u8868\uff09\u4e0e FTP \u670d\u52a1\u3002\u540c\u65f6\u63a5\u5165 LDAP\uff0c\u6bcf\u4e2a LDAP \u7528\u6237\u90fd\u53ef\u4ee5\u4f7f\u7528 LUG FTP \u5b58\u50a8\u81ea\u5df1\u7684\u6587\u4ef6\u3002</p> <p>\u4e0e\u6b64\u540c\u65f6\uff0cvdp \u4e5f\u627f\u62c5\u4e86\u4f7f\u7528 NFS \u5411 PVE \u670d\u52a1\u5668\u63d0\u4f9b\u4e00\u90e8\u5206\u5b58\u50a8\u7684\u4efb\u52a1\u3002</p>"},{"location":"services/#gitlab","title":"LUG GitLab","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>gitlab.s.ustclug.org</code>\uff0cSSH \u7aef\u53e3 2222\u3002</p>"},{"location":"services/#revproxy","title":"\u4e3b\u9875\u53cd\u4ee3","text":"<p>\u662f\u591a\u4e2a HTTP \u670d\u52a1\u7684\u5165\u53e3\u3002</p> <p>\u7531\u4e8e\u653f\u7b56\u548c\u5408\u89c4\u6027\u539f\u56e0\uff0c\u6211\u4eec\u5bf9\u4f7f\u7528\u4e3b\u9875\u53cd\u4ee3\u7684\u57df\u540d\u91c7\u7528\u4e86\u5206\u7ebf\u8def\u89e3\u6790\u7684\u65b9\u6848\uff0c\u5176\u4e2d\u7edd\u5927\u90e8\u5206\u57df\u540d\u5728\u6821\u5916\u90fd\u89e3\u6790\u5230 gateway-jp\uff0c\u5728\u6821\u5185\u89e3\u6790\u5230 gateway-nic\u3002\u8fd9\u4e24\u53f0\u670d\u52a1\u5668\u5747\u63a5\u5165 tinc \u5185\u7f51\uff0c\u91c7\u7528\u540c\u4e00\u5957 Nginx \u914d\u7f6e\uff0c\u4e3a\u5185\u7f51\u670d\u52a1\u5668\u63d0\u4f9b HTTP \u53cd\u4ee3\u3002</p> <p>\u5b8c\u6574\u5217\u8868\u8bf7\u5728 auth-dns \u4ed3\u5e93\u5185\u5bfb\u627e CNAME \u5230 <code>gateway.cname.ustclug.org.</code> \u7684\u57df\u540d\u3002</p> <p>\u4e00\u4e9b\u4f8b\u5916\uff1a</p> <ul> <li>\u955c\u50cf\u7ad9\u3001LUG FTP\u3001GitLab \u548c PXE \u7f51\u7edc\u542f\u52a8\uff08\u5b83\u4eec\u5206\u522b\u5404\u81ea\u72ec\u7acb\u8fd0\u884c Nginx\uff09</li> <li>GOsa\u00b2\uff08\u8fd0\u884c\u5728 <code>ldap</code> \u670d\u52a1\u5668\u4e0a\uff0c\u5e76\u4e14\u4f7f\u7528 Apache2\uff0c\u5efa\u8bae\u522b\u52a8\uff09</li> <li>Light</li> <li>\u6280\u672f\u6587\u6863\u3001Linux 101 \u6587\u6863\u7684\u6d77\u5916\u7248\uff08https://101.ustclug.org\uff09\u548c\u5176\u4ed6\u6307\u5411 <code>*.cdn.cloudflare.net.</code> \u7684\u57df\u540d</li> <li>\u5176\u4ed6\u6307\u5411 <code>web-cf.cname.ustclug.org.</code> \u7684\u57df\u540d</li> </ul>"},{"location":"services/#homepage","title":"LUG \u4e3b\u9875","text":"<p>\u540e\u7aef\u662f docker2 \u4e0a\u7684 <code>website</code> \u5bb9\u5668\u3002</p> <p>\u89c1  ustclug/website \u4ed3\u5e93\u7684 README\u3002</p> <p>tky: planet \u73b0\u5728\u7f3a\u4e4f\u7ef4\u62a4\uff0c\u5e0c\u671b\u80fd\u6709\u4eba\u628a\u5b83\u641e\u8d77\u6765\u3002</p>"},{"location":"services/#linux-101","title":"Linux 101","text":"<p>\u540e\u7aef\u662f docker2 \u4e0a\u7684 <code>linux101</code> \u5bb9\u5668\u3002</p> <p>\u89c1  ustclug/Linux101-docs \u4ed3\u5e93\u7684 README\u3002</p>"},{"location":"services/#getvpn","title":"\u7533\u8bf7\u7cfb\u7edf","text":"<p>\u4e00\u4e2a\u4f7f\u7528 Flask \u7f16\u5199\u7684 web \u5e94\u7528\uff0c\u90e8\u7f72\u4e86\u4e24\u5957\uff0c\u5206\u522b\u63d0\u4f9b LUG VPN \u548c Light \u7684\u7533\u8bf7\u670d\u52a1\u3002\u5176\u4e2d\uff1a</p> <ul> <li>LUG VPN \u7684\u7533\u8bf7\u7cfb\u7edf\u8fd0\u884c\u5728 docker2 \u4e0a\uff08<code>lugvpn-web</code>\uff09\uff1b</li> <li>Light \u7684\u7533\u8bf7\u7cfb\u7edf\u8fd0\u884c\u5728 swarm \u4e0a\u3002</li> </ul>"},{"location":"services/#proxy","title":"\u5404\u8def\u53cd\u5411\u4ee3\u7406","text":"<p>\u57df\u540d\uff1a<code>*.proxy.ustclug.org</code></p> <p>\u4f5c\u4e3a\u955c\u50cf\u7ad9\u670d\u52a1\u7684\u4e00\u90e8\u5206\uff0cgateway-jp/nic \u4e5f\u5206\u522b\u4e3a\u6821\u5916\u5185\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u5217\u8868\u7684\u53cd\u5411\u4ee3\u7406\u670d\u52a1\u3002</p>"},{"location":"services/#qt-guide-opensuse-guide","title":"Qt Guide \u548c openSUSE Guide","text":"<p>\u7531 @winland0704 \u8d1f\u8d23\u7f16\u5199\u5185\u5bb9\uff0c\u6211\u4eec\u5e2e\u52a9\u6258\u7ba1\uff0c\u5e73\u65f6\u653e\u7740\u4e0d\u52a8\u5c31\u884c\u3002</p> <p>\u540e\u7aef\u662f docker2 \u4e0a\u7684\u4e24\u4e2a\u5bb9\u5668 <code>qtguide</code> \u548c <code>opensuse-guide</code>\u3002</p>"},{"location":"services/#_1","title":"\u670d\u52a1\u8fd0\u884c\u72b6\u6001\u670d\u52a1\u5668\u9ed1\u677f\u62a5","text":"<p>TODO: servers \u4e0e status \u7684\u5408\u5e76\u5de5\u4f5c\u3002</p>"},{"location":"services/#lug-vpn","title":"LUG VPN","text":"<p>\u4e3b\u670d\u52a1\u5668\uff1a<code>vpnstv.s.ustclug.org</code>\uff08\u865a\u62df\u673a\uff0cNIC \u673a\u623f\uff09</p> <p>RADIUS \u8ba4\u8bc1\u670d\u52a1\u5668\uff1a<code>radius.s.ustclug.org</code>\uff0c\u540c\u65f6\u8fd0\u884c\u4e86 FreeRADIUS \u548c\u5b83\u7684 MySQL \u6570\u636e\u5e93\u3002</p> <p>\u53e6\u6709\u65e7\u7684 <code>vpn.s.ustclug.org</code> \u8fd0\u884c\u5728\u4e1c\u56fe\uff0c\u6682\u4e0d\u9700\u8981\u5173\u6ce8\u3002</p>"},{"location":"services/#hackergame","title":"Hackergame","text":"<p>\u76f8\u5173\u5185\u5bb9\u89c1 hackergame \u5185\u90e8\u6587\u6863\u3002</p>"},{"location":"services/#docker2","title":"\u5404\u7c7b Docker \u670d\u52a1","text":"<p>Docker2 \u662f\u4e13\u804c\u8d1f\u8d23\u8fd0\u884c\u5bb9\u5668\u7684\u673a\u5668\u3002</p>"},{"location":"services/#adrain","title":"Adrain","text":"<p>ustcflyer\uff08\u79d1\u5927\u98de\u8dc3\u624b\u518c\u7f51\u7ad9\uff09\u7684\u524d\u8eab\uff0c\u76ee\u524d\u4fdd\u6301\u8fd0\u884c\u3002</p> <p>tky: ustcflyer \u6ca1\u6709\u5b9e\u73b0\u7ed9 session \u5220\u5bf9\u5e94\u8bc4\u8bba\u7684\u529f\u80fd\uff0c\u6240\u4ee5 adrain \u6ca1\u6709\u4e0b\u7ebf\u3002</p>"},{"location":"services/#grafana","title":"Grafana","text":"<p>LUG \u7684\u76d1\u63a7\u7ad9\u70b9\u3002</p>"},{"location":"services/#ldap","title":"LDAP","text":""},{"location":"services/#mail","title":"Mail","text":"<p>\u4e3a\u670d\u52a1\u5668\u3001IPMI \u7b49\u63d0\u4f9b\u7684\u5185\u90e8\u90ae\u4ef6\u670d\u52a1\u3002</p> <p>[WIP]: \u9700\u8981\u8865\u5145</p>"},{"location":"services/#pve","title":"\u865a\u62df\u5316\uff1aPVE \u4e0e PBS","text":"<p>PVE: \u63d0\u4f9b\u865a\u62df\u5316\u652f\u6301\uff1bPBS: PVE \u7684\u865a\u62df\u673a\u5907\u4efd\u3002</p>"},{"location":"services/#pxe","title":"PXE","text":"<p>\u7f51\u7edc\u542f\u52a8\u670d\u52a1\uff0c\u8d1f\u8d23\u4e3a\u5168\u6821\u673a\u5668\u63d0\u4f9b\u63d2\u7f51\u53e3\u5373\u53ef\u5b89\u88c5\u7cfb\u7edf\u7684\u529f\u80fd\uff0c\u4ee5\u53ca\u4e3a\u56fe\u4e66\u9986\u67e5\u8be2\u673a\u63d0\u4f9b\u955c\u50cf\u3002</p>"},{"location":"services/#others","title":"\u5176\u4ed6","text":"<p>\u6b64\u5904\u6240\u5217\u51fa\u7684\u201c\u670d\u52a1\u201d\u6ca1\u6709\u4f7f\u7528\u6211\u4eec\u81ea\u5df1\u7684\u670d\u52a1\u5668\u8d44\u6e90\uff0c\u90fd\u6258\u7ba1\u5728\u5916\u90e8\u5e73\u53f0\u4e0a\uff0c\u4ec5\u57df\u540d\uff08\u5373 DNS\uff09\u7531\u6211\u4eec\u7ef4\u62a4\u3002</p>"},{"location":"services/#documentations","title":"\u6280\u672f\u6587\u6863","text":"<p>\u4e5f\u5c31\u662f\u672c\u6587\u6863\uff0c\u8fd0\u884c\u5728 Cloudflare Pages \u4e0a\u3002</p>"},{"location":"services/#ghauth","title":"GHAuth","text":"<p>https://ghauth.ustclug.org</p> <p>\u7528\u4e8e\u53cc\u5411\u9a8c\u8bc1 GitHub \u8d26\u53f7\u4e0e\u79d1\u5927\u5b66\u53f7\u7684\u670d\u52a1\uff08\u7c7b\u4f3c\u4e8e https://qq.ustc.life\uff09\uff0c\u76ee\u524d\u5904\u4e8e\u95f2\u7f6e\uff0c\u8fd0\u884c\u5728 iBug \u7684 AWS Lambda \u4e0a\u3002</p>"},{"location":"services/#discontinued","title":"\u5df2\u5e9f\u5f03\u670d\u52a1","text":""},{"location":"services/discontinued/","title":"Discontinued Services","text":"<p>\u672c\u9875\u9762\u8bb0\u8f7d\u66fe\u7ecf\u63d0\u4f9b\u7684\u670d\u52a1\uff0c\u4f46\u662f\u7531\u4e8e\u67b6\u6784\u6539\u53d8\u6216\u670d\u52a1\u8fc1\u79fb\uff0c\u8fd9\u4e9b\u670d\u52a1\u4e0d\u518d\u4ee5\u539f\u6765\u7684\u5f62\u5f0f\u63d0\u4f9b\uff0c\u5e76\u53ef\u80fd\u5728\u539f\u5904\u6709\u6b8b\u7559\u7684\u914d\u7f6e\u6587\u4ef6\u3002</p> <p>\u901a\u5e38\u60c5\u51b5\u4e0b\u6b8b\u7559\u7684\u914d\u7f6e\u6587\u4ef6\u53ef\u4ee5\u76f4\u63a5\u5220\u9664\uff0c\u4f46\u662f\u4fdd\u9669\u8d77\u89c1\uff0c\u4ecd\u7136\u5efa\u8bae\u5728 Internals \u7fa4\u91cc\u5148\u8be2\u95ee\u4e00\u4e0b\u518d\u5904\u7406\u3002</p>"},{"location":"services/discontinued/#docker-registry","title":"Docker Registry","text":"<p>\u66fe\u7ecf\u8fd0\u884c\u5728 docker2 \u4e0a\uff0c\u73b0\u5728 LUG \u7684 Docker \u955c\u50cf\u5df2\u8f6c\u79fb\u81f3 Docker Hub\u3002</p>"},{"location":"services/discontinued/#freeshell","title":"Freeshell","text":"<p>\uff08\u672a\u5b8c\u5f85\u7eed\uff0c\u914d\u7f6e\u6587\u4ef6\u5148\u4fdd\u7559\uff09</p>"},{"location":"services/discontinued/#ustc-blog","title":"USTC Blog","text":"<p>Refer to Gitlab Wiki.</p>"},{"location":"services/discontinued/#telegram-web","title":"Telegram Web","text":"<p>Service\uff1atelegram.ustclug.org</p> <p>Repository\uff1agithub.com/ustclug/telegram-web</p> <p>DockerHub\uff1austclug/telegram-web</p> <p>Deployment\uff1atelegram-web.sh</p> <p>Servers\uff1a</p> <ul> <li>swarm.s.ustclug.org\uff08Docker Container\uff09</li> <li>revproxy-el.s.ustclug.org\uff08reverse proxy\uff09</li> </ul> <p>Blog\uff1aadd-telegram-web-service</p>"},{"location":"services/discontinued/#ustc-life","title":"USTC Life","text":"<p>USTC Life is a navigation page, which included useful sites in USTC.</p> <p>Service: ustc.life</p> <p>2020-04-09 \u66f4\u65b0\u4fe1\u606f</p> <p>\u76ee\u524d\uff0cUSTC Life \u670d\u52a1\u6258\u7ba1\u5728 GitHub Pages \u4e0a\uff0c\u4ed3\u5e93\u4e5f\u5df2\u8f6c\u79fb\u81f3  SmartHypercube/ustclife\uff0c\u7531 Hypercube \u8d1f\u8d23\u7ef4\u62a4\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4e3a\u5386\u53f2\u8bb0\u5f55\u3002</p> <p>Git Repository: github.com/ustclug/ustclife</p> <p>DockerHub: ustclug/ustclife</p> <p>server: docker2.s.ustclug.org</p> <p>deploy: /srv/webhook/ustclife.sh</p> <p>webhook from DockerHub: /srv/webhook/hooks.json</p>"},{"location":"services/discontinued/#wordpress-based-serversustclugorg-planetustclugorg","title":"Wordpress-based servers.ustclug.org &amp; planet.ustclug.org","text":"<p>\u4e3a\u4e86\u51cf\u5c0f\u653b\u51fb\u9762\u4e0e\u7ef4\u62a4\u6210\u672c\uff0cservers.ustclug.org \u8fc1\u79fb\u5230\u4e86\u57fa\u4e8e Jekyll \u7684\u65b9\u6848\uff1bplanet.ustclug.org \u5728\u65e9\u524d\u5df2\u7ecf\u6574\u5408\u5230\u4e86 LUG \u4e3b\u7ad9\u4e2d\u3002</p>"},{"location":"services/docker2/","title":"Docker services","text":"<p>Server: docker2.s.ustclug.org</p> <p>Provides Docker container environment for other services. All non-system services should be run as Docker containers on this host.</p> <p>Methods to run individual containers are maintained in the  ustclug/docker-run-script repository.</p>"},{"location":"services/docker2/#special-configurations","title":"Special configurations","text":""},{"location":"services/docker2/#network-interfaces","title":"Network interfaces","text":"<p>We use udev rules to assign consistent names to network interfaces, identified by their MAC addresses.</p> /etc/udev/rules.d/70-persistent-net.rules<pre><code>SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:22\", NAME=\"Telecom\"\nSUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:5b\", NAME=\"Mobile\"\nSUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", ATTR{address}==\"00:50:56:9f:00:5d\", NAME=\"ustclug\"\n</code></pre> <p>We then refer to these interfaces using their new names in <code>/etc/network/interfaces</code> to ensure consistent network configuration.</p> <p>2022 \u5e74 2 \u6708 21 \u65e5\u66f4\u65b0</p> <p>\u4eca\u65e5\u53d1\u73b0 docker2 \u65e0\u6cd5\u8fde\u63a5\u5bb9\u5668\u7f51\u7edc\uff0810.254.1.0/21\uff09\uff0c\u8c03\u8bd5\u540e\u53d1\u73b0\u4e3a Linux macvlan \u7f51\u7edc\u7279\u6027\uff08Stack Overflow\uff09\u3002\u4e3a\u4e86\u4fee\u590d\u8fde\u63a5\u95ee\u9898\uff0c\u8fdb\u884c\u4e86\u4ee5\u4e0b\u4fee\u6539\uff1a</p> <ol> <li>\u5c06 <code>/etc/udev/rules.d/70-persistent-net.rules</code> \u4e2d <code>Policy</code> \u66f4\u540d\u4e3a <code>ustclug</code>\uff1b</li> <li> <p>\u5728 <code>/etc/network/interfaces</code> \u4e2d\u8bbe\u7f6e <code>Policy</code> \u548c <code>ustclug</code> \u4e24\u4e2a interface \u7684\u76f8\u5173\u914d\u7f6e\u5982\u4e0b\uff1a</p> <pre><code>auto Policy\niface Policy inet static\n    address 10.254.0.16/21\n    pre-up ip link add $IFACE link ustclug type macvlan mode bridge\n    post-down ip link del $IFACE\n\nauto ustclug\niface ustclug inet manual\n</code></pre> </li> </ol>"},{"location":"services/docker2/#docker-daemon-service","title":"Docker daemon service","text":"<p>docker2 \u4e0a\u9762\u7684 Docker \u4f7f\u7528 macvlan \u6765\u5c06\u865a\u62df\u673a\u63a5\u5165 lugi \u5185\u7f51\uff0c\u56e0\u6b64\u5c06 macvlan \u7684\u4e3b\u7aef\u53e3 Policy \u914d\u7f6e\u4e3a <code>docker.service</code> \u7684\u5f3a\u4f9d\u8d56\u3002</p> systemctl edit docker.service<pre><code>[Unit]\nBindsTo=sys-subsystem-net-devices-Policy.device\nAfter=sys-subsystem-net-devices-Policy.device\n</code></pre> <p>\u5b9e\u9645\u4e0a <code>After=network-online.target</code> \u5c31\u591f\u4e86\uff0c\u4f46\u662f\u51fa\u4e8e\u5386\u53f2\u539f\u56e0\u4f7f\u7528\u4e86 <code>BindsTo</code> \u5f3a\u4f9d\u8d56\u5185\u7f51\u7aef\u53e3\uff0c\u8fd9\u662f\u56e0\u4e3a docker2 \u66fe\u7ecf\u5355\u72ec\u8fd0\u884c tinc \u63a5\u5165\u5185\u7f51\uff0c\u800c tinc \u7684\u7aef\u53e3\u53ea\u5728 tinc \u542f\u52a8\u540e\u624d\u4f1a\u51fa\u73b0\uff08\u624d\u80fd\u5206\u51fa macvlan \u5b50\u7aef\u53e3\uff09\uff0c\u56e0\u6b64\u4f7f\u7528 <code>BindsTo</code> \u4fdd\u8bc1 docker \u968f\u8be5\u7aef\u53e3\u7684\u51fa\u73b0\u548c\u6d88\u5931\u800c\u542f\u52a8/\u505c\u6b62\u3002</p> <p>2022 \u5e74 1 \u6708 15 \u65e5\u4ee5\u540e docker2 \u4e0e\u5176\u4ed6\u865a\u62df\u673a\u4e00\u6837\u901a\u8fc7 gateway-nic \u6865\u63a5\u7684 tinc \u63a5\u5165\u5185\u7f51\uff0c\u4e0d\u518d\u5355\u72ec\u8fd0\u884c tinc\u3002</p>"},{"location":"services/docker2/#opensuse-guide-qtguide","title":"opensuse-guide \u4e0e qtguide \u6bcf\u65e5\u66f4\u65b0","text":"<p>\u7531\u4e8e\u6ca1\u6709\u8bbe\u7f6e webhook\uff0c\u76ee\u524d\u914d\u7f6e\u4e86 systemd timer\uff0c\u6267\u884c <code>/srv/docker/guide</code> \u4e2d\u7684\u811a\u672c\uff0c\u4ee5\u5206\u522b\u5728\u6bcf\u65e5\u665a\u4e0a 23:15 \u548c 23:30 \u66f4\u65b0 opensuse-guide \u548c qtguide \u4e24\u4e2a\u5bb9\u5668\u7684 image \u5e76\u91cd\u542f\u5bb9\u5668\u3002</p> <p>\u8be6\u7ec6\u7684\u914d\u7f6e\u6587\u4ef6\u53ef\u67e5\u770b docker-run-script \u4e2d\u7684 opensuse-guide \u548c qtguide \u4e24\u4e2a\u6587\u4ef6\u5939\u3002</p>"},{"location":"services/docker2/#workflows-troubleshooting","title":"Workflows &amp; Troubleshooting","text":""},{"location":"services/docker2/#docker-pingd","title":"Docker \"pingd\"","text":"<p>\u66f4\u65b0</p> <p>\u95ee\u9898\u5df2\u7ecf\u67e5\u660e\u4e3a Debian \u7684 Linux \u5185\u6838 bug (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=952660)\uff0c\u5df2\u7ecf\u901a\u8fc7\u66f4\u65b0\u5185\u6838\u5e76\u91cd\u542f\u800c\u89e3\u51b3\u3002\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f5c\u5b58\u6863\u3002</p> <p>\u51fa\u4e8e\u672a\u77e5\u539f\u56e0\u6709\u65f6\u5019\u5916\u90e8\u4e3b\u673a\u4f1a\u65e0\u6cd5\u4e3b\u52a8\u8fde\u901a Docker \u5bb9\u5668\uff08\u53ef\u80fd\u4e0e ARP \u6709\u5173\uff09\uff0c\u4f46\u662f\u5982\u679c\u67d0\u4e2a\u5bb9\u5668\u5148 ping \u4e86\u4e00\u4e0b\u5916\u90e8\u4e3b\u673a\uff0c\u5c31\u80fd\u53cc\u5411\u8fde\u901a\u4e86\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u6682\u672a\u627e\u5230\u6b63\u5e38\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u56e0\u6b64\u4f7f\u7528 \u201cping daemon\u201d \u4f5c\u4e3a\u4e00\u4e2a workaround\uff0c\u5728\u5bb9\u5668\u4e2d\u8fd0\u884c ping \u4fdd\u6301\u5916\u90e8\u4e3b\u673a\u7684\u8fde\u901a\u6027\u3002</p> docker-pingd@.service<pre><code>[Unit]\nDescription=Docker pingd service %I\nDocumentation=man:ping(8)\nAfter=network.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nUser=root\nGroup=root\nExecStart=/bin/sh -c 'IVAR=\"%i\"; exec /usr/bin/docker exec \"$${IVAR%:*}\" ping -q -s 32 \"$${IVAR#*:}\"'\nExecStop=/bin/kill -s INT $MAINPID\nRestart=on-failure\nRestartSec=3\n\n[Install]\nWantedBy=multi-user.target\nAlias=docker-ping@.service\n</code></pre> <p>\u4f7f\u7528\u65b9\u5f0f\uff1a<code>systemctl enable docker-pingd@container:host.service</code>\uff0c<code>container</code> \u6362\u6210\u5bb9\u5668\u540d\uff0c<code>host</code> \u6362\u6210 ping \u7684\u76ee\u6807\u3002</p> <p>Trick \u4ecb\u7ecd\uff1aSystemd service \u914d\u7f6e\u6682\u4e0d\u652f\u6301\u591a\u4e2a\u6a21\u677f\u53c2\u6570 <code>%i</code>\uff0c\u56e0\u6b64\u8c03\u7528 shell \u6765\u89e3\u6790\u53c2\u6570\u3002Ref: https://github.com/systemd/systemd/issues/14895#issuecomment-612270690</p>"},{"location":"services/docker2/#wordpress","title":"WordPress \u5347\u7ea7","text":"<p>taoky</p> <p>\u5f88\u9ebb\u70e6\uff0c\u5efa\u8bae lug \u4ee5\u540e\u518d\u4e5f\u522b\u7528\uff08\u522b\u5f00\u65b0\u7684\uff09wordpress \u4e86\u3002</p> <p>servers \u4e0e\u65e7 planet \u4f7f\u7528 WordPress\uff0c\u6258\u7ba1\u5728 docker2 \u4e0a\u3002\u56e0\u4e3a docker2 \u73b0\u5728\u78c1\u76d8 IO \u5f88\u6162\uff0c\u6240\u4ee5\u53ef\u80fd\u4f1a\u51fa\u73b0\u4e00\u4e9b\u989d\u5916\u7684\u95ee\u9898\u3002</p> <p>\u63a8\u8350\u4f7f\u7528 https://wp-cli.org/#installing\u3002\u547d\u4ee4\uff1a</p> <pre><code>chmod +x wp-cli.phar\nmv wp-cli.phar /usr/local/bin/wp\ncd /var/www/public/\nsudo -u www-data -- wp core update --version=5.8.1 /tmp/wordpress-5.8.1.zip\n</code></pre> <p>\u5bb9\u5668\u91cc sudo \u8981\u624b\u52a8\u88c5\u3002</p> <p>\u4ee5\u4e0b\u5185\u5bb9\u4ec5\u4f9b\u53c2\u8003\u3002</p> <p>\u5c1d\u8bd5\u5347\u7ea7\u65f6\u5982\u679c\u672a\u51fa\u73b0\u5347\u7ea7\u63d0\u793a\uff0c\u53ef\u4ee5\u4fee\u6539\uff1a</p> <ul> <li>\u6587\u4ef6 <code>wp-includes/update.php</code>\uff0c\u5c06\u51fd\u6570 <code>wp_version_check()</code> \u4e2d <code>$doing_cron ? 3 : 30</code> \u4fee\u6539\u4e3a <code>$doing_cron ? 30 : 30</code>\u3002</li> <li>\u6587\u4ef6 <code>wp-admin/includes/update.php</code>\uff0c\u5c06\u51fd\u6570 <code>get_core_checksums()</code> \u4e2d\u5bf9\u5e94\u7684\u90e8\u5206\u4fee\u6539\u4e3a <code>$doing_cron ? 30 : 30</code>\u3002</li> </ul> <p>\u5982\u679c\u51fa\u73b0\u300c\u53e6\u4e00\u66f4\u65b0\u6b63\u5728\u8fd0\u884c\u300d\uff0c\u4e14\u786e\u8ba4\u4e0d\u5728\u66f4\u65b0\uff0c\u53ef\u4ee5\u5728\u6570\u636e\u5e93\u7684 <code>wordpress</code> \u8868\u4e2d\u6267\u884c\uff1a</p> <pre><code>DELETE FROM wp_options WHERE option_name = 'core_updater.lock';\n</code></pre>"},{"location":"services/docker2/#docker","title":"\u770b\u8d77\u6765\u6b63\u5728\u8fd0\u884c\u4f46\u662f\u6ca1\u6709\u8fdb\u7a0b\u7684 Docker \u5bb9\u5668","text":"<p>2021/10/25 \u53d1\u73b0\u67d0\u5bb9\u5668\u663e\u793a\u6b63\u5728\u8fd0\u884c\uff0c\u4f46\u662f\u5b9e\u9645\u6ca1\u6709\u8fdb\u7a0b\u3002\u540e\u53d1\u73b0\u4e3a Docker \u7684 bug\uff0c\u5728\u5bb9\u5668\u8fdb\u7a0b\u88ab cgroups \u5e72\u6389\u4e4b\u540e\u53ef\u80fd\u4f1a\u51fa\u73b0\u6b64\u60c5\u51b5\u3002</p> <p>\u5bf9\u5e94 issue\uff1ahttps://github.com/moby/moby/issues/38501</p> <p>\u89e3\u51b3\u65b9\u6cd5\uff1a\u5c06\u5bb9\u5668 ID \u5bf9\u5e94\u7684 <code>containerd-shim</code> \u6740\u6b7b\u5373\u53ef\u8ba9 Docker \u66f4\u65b0\u5176\u72b6\u6001\u4e3a\u5df2\u505c\u6b62\uff0c\u7136\u540e\u91cd\u65b0\u5f00\u542f\u5373\u53ef\u3002</p>"},{"location":"services/documentations/","title":"LUG \u6587\u6863","text":""},{"location":"services/ftp/","title":"LUG FTP","text":"<p>Services: FTP/FTPS, SFTP, HTTP, HTTPS, AFP</p> <p>Git repository: ustclug/lugftp</p> <p>Docker Hub: ustclug/ftp</p> <p>Server: vdp.s.ustclug.org (management ssh port 2222)</p> <p>Theme: h5ai</p> <p>Deploy: ftp.sh</p>"},{"location":"services/ftp/#notes","title":"Notes","text":"<ol> <li>SSL cert is required when running LUG FTP.</li> <li><code>ssh-keygen -A</code> is required to be manually run when initializing.</li> <li>About directory permission:<ol> <li>It is strongly suggested to keep permission &amp; owner metadata when backing up/restoring.</li> <li>Public folder root: set owner <code>root:root</code> and permission 0755.</li> <li>Subfolders: set owner to <code>1000:1000</code>. <code>_h5ai</code> and <code>wp-content</code> needs to be set to a different owner (misconfigured?). And <code>Incoming</code> shall be set to 0775.</li> </ol> </li> <li>Do not use Google DNS in host, as China Mobile network may drop UDP packets to 8.8.8.8. A misconfigured DNS may lead to LDAP in container broken.</li> <li>Port 22 is delegated to the LUG FTP container for SFTP, and SSH access to the host has been reassigned to port 2222.</li> </ol>"},{"location":"services/gateway-el/","title":"Gateway: East Campus Library (<code>gateway-el</code>)","text":"<p>Todo</p> <p>Currently <code>systemctl restart networking</code> is required after a reboot to set up tunnel. This bug should be fixed.</p>"},{"location":"services/gateway-el/#configurations","title":"Configurations","text":""},{"location":"services/gateway-el/#ip-virtual-server","title":"IP Virtual Server","text":"<p>gateway-el uses IPVS to send requests from one port to other machines directly. IPVS is a Linux kernel feature. Use <code>ipvsadm -Ln</code> to get its status.</p>"},{"location":"services/gateway-el/#tunnelmonitor","title":"tunnelmonitor","text":"<p>The tunnels used by <code>gateway-el</code> is mainly maintained by tunnelmonitor. Its config files are in <code>/etc/tunnelmonitor</code>, service is <code>tunnelmonitor.service</code>, and log is <code>/var/log/tunnel_monitor.log</code>.</p> <p>When starting, <code>netfilter-persistent.service</code> should be run before <code>tunnelmonitor</code>. <code>tunnelmonitor</code> generates new mangle chains when starting, and pings all tunnels periodically and selects all available tunnels, and generates <code>statistc</code> rules.</p> <p>You check check <code>/var/log/tunnel_monitor.log</code> to see if one tunnel has been down. Currently (2021/09), only one tunnel is available among all tunnel settings in <code>/etc/tunnelmonitor/tunnel.ini</code>.</p>"},{"location":"services/gateway-el/#iptables-mangle-rt_tables-and-ip-rule","title":"iptables mangle, rt_tables and ip rule","text":"<p>The following example is for demonstration purposes only.</p> <p>You can get current status by <code>iptables -t mangle -S</code>. It is expected to see something like this:</p> <pre><code>-A DemonstrateManglePrerouting -m statistic --mode nth --every 1 --packet 0 -j MARK --set-xmark 0x12345/0xffffffff\n// ...\n-A PREOUT -m mark --mark 0x0 -j DemonstrateManglePrerouting\n</code></pre> <p>In this case, all packages to <code>DemonstrateManglePrerouting</code> chain will get <code>fwmark</code> <code>0x12345</code> (= <code>74565</code>).</p> <p>Check <code>ip rule</code> for that:</p> <pre><code>// ...\n10: from all fwmark 0x12345 lookup ExtraDemoTunnel\n// ...\n</code></pre> <p>You can get tunnel information in <code>ip a</code>:</p> <pre><code>29: ExtraDemoTunnel: &lt;POINTOPOINT,NOARP,UP,LOWER_UP&gt; mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000\n    link/none\n    inet 192.168.252.17 peer 192.168.253.17/32 brd 192.168.252.17 scope global ExtraDemoTunnel\n       valid_lft forever preferred_lft forever\n</code></pre> <p>Here <code>192.168.252.17</code> is the local server of tunnel, and <code>192.168.253.17</code> is the remote server.</p> <p>Let's check <code>/etc/network/interfaces.d</code>:</p> /etc/network/interfaces.d/03ExtraDemoTunnel<pre><code>auto ExtraDemoTunnel\niface ExtraDemoTunnel inet static\n    address 192.168.252.17\n    netmask 255.255.255.255\n    pre-up ip link add dev $IFACE type wireguard\n    post-down ip link del dev $IFACE\n    up wg set $IFACE listen-port 4601 private-key /etc/wireguard/privkey peer pkeypkeypkeypkeypkeypkeypkeypkeypkeypkeypkey endpoint 23.3.3.3:4600 allowed-ips 0.0.0.0/0\n    up ip route replace default dev $IFACE table $IFACE\n    up ip rule add from all fwmark 74565 table $IFACE prio 10\n    pointopoint 192.168.253.17\n</code></pre> <p>Here we know that this is a wireguard tunnel, and the endpoint is <code>23.3.3.3:4600</code>. The fwmark here is <code>74565</code> (in decimal).</p> <p>Why is <code>74565</code> set? Let's check <code>/etc/iproute2/rt_tables</code>!</p> <pre><code>// ...\n74565   ExtraDemoTunnel\n// ...\n</code></pre> <p>For wireguard, you can use <code>wg</code> to check status. If you find that the \"received\" is 0 in transferred, something is going wrong.</p>"},{"location":"services/gateway-el/#nginx","title":"Nginx","text":""},{"location":"services/gateway-el/#ustclugorg-issue","title":"ustclug.org issue","text":"<p>See Gateway-NIC</p>"},{"location":"services/gateway-el/#issues","title":"Issues &amp; resolution","text":""},{"location":"services/gateway-el/#ipvs-conntrack","title":"IPVS Conntrack","text":"<p>In early March 2022 we noticed Light connectivity issues from outside USTCnet, which was narrowed down to connections bypassing Linux Conntrack mechanism.</p> <p>Thanks to TUNA group we learned about <code>/proc/sys/net/ipv4/vs/conntrack</code>, which at the time the problem was located, was zero. Settings this to 1 solved the problem.</p> <p>However after writing <code>net.ipv4.vs.conntrack = 1</code> to <code>/etc/sysctl.d/10-ipvs-conntrack.conf</code> and rebooting, the problem returned. Checking <code>systemctl status systemd-sysctl.service</code> we noticed this:</p> <pre><code>Mar 05 00:00:00 gateway-el systemd-sysctl[218]: Couldn't write '0' to 'net/ipv4/vs/conntrack', ignoring: No such file or directory\n</code></pre> <p>Adding <code>ip_vs</code> to <code>/etc/modules</code> and rebooting again correctly fixed the problem.</p> <p>This is because the module was automatically loaded the first time <code>ipvsadm</code> is called (namely, <code>/etc/init.d/ipvsadm</code>), which happened at a very late stage. Adding to <code>/etc/modules</code> gets the module loaded earlier (and before <code>systemd-sysctl.service</code>) so it worked.</p>"},{"location":"services/gateway-el/#tinc-issue","title":"Tinc issue","text":"<p>See gateway</p>"},{"location":"services/gateway-jp/","title":"Gateway: Japan (<code>gateway-jp</code>)","text":"<p>This page is currently a stub.</p>"},{"location":"services/gateway-nic/","title":"Gateway: Network Information Center (<code>gateway-nic</code>)","text":"<p>Previously gateway-nic used CentOS 7 to 8 to Stream, to \"avoid putting all eggs in one basket\". This VM was replaced by a newly setup Debian Bullseye VM on January 2022 during migration from ESXi to Proxmox VE.</p> <p>The virtual disk of the old gateway-nic was copied onto pve-5, located at ZFS Zvol <code>rpool/data/gateway-nic</code>. The current VM uses <code>rpool/data/vm-200-disk-0</code> instead (Proxmox naming convention).</p>"},{"location":"services/gateway-nic/#config-file-management","title":"Config file management","text":"<p>Git repositories exist for these directories:</p> <pre><code>/etc/nginx\n/etc/systemd/network\n/etc/tinc\n</code></pre>"},{"location":"services/gateway-nic/#networking","title":"Networking","text":"<p>We use systemd-networkd to configure network on gateway-nic. This replaces both <code>ifupdown</code> (config file <code>/etc/network/interfaces</code>)</p> $ systemctl edit systemd-networkd.service<pre><code>[Service]\nExecStartPre=-/sbin/ip -4 rule flush\nExecStartPre=-/sbin/ip -6 rule flush\n\n[Install]\nAlias=networkd.service\n</code></pre> <p>The <code>ExecStartPre=</code> commands flush (clear) existing rules so that systemd-networkd can fully manage all rules. This is because <code>ManageForeignRoutingPolicyRules</code> is a new setting in systemd 249, while Debian Bullseye uses systemd 247, so we have to do this manually.</p> <p>We then load the regular \"main\" and \"default\" rules on the loopback interface (routing rules aren't bound to interfaces, but are added/removed when the configured interface is brought up/turned down).</p> /etc/systemd/network/00-lo.network<pre><code>[Match]\nName=lo\n\n# Route \"main\"\n[RoutingPolicyRule]\nFamily=both\nTable=254\nPriority=2\nSuppressPrefixLength=1\n\n# Route \"Special\"\n[RoutingPolicyRule]\nFamily=both\nTable=1000\nPriority=5\nSuppressPrefixLength=1\n\n# Route \"default\"\n[RoutingPolicyRule]\nFamily=both\nTable=253\nPriority=32767\n</code></pre>"},{"location":"services/gateway-nic/#interfaces","title":"Interfaces","text":"<p>Systemd-networkd has built-in capability to rename interfaces, so there's no need to use udev rules.</p> <p>For example, to assign a name for the cernet interface, we use:</p> /etc/systemd/network/12-Cernet.link<pre><code>[Match]\nPermanentMACAddress=00:50:56:a2:02:8c\n\n[Link]\nName=Cernet\n</code></pre> <p>We then configure addresses and routing rules for this interface:</p> /etc/systemd/network/12-Cernet.network <pre><code>[Match]\nName=Cernet\n\n[Network]\nAddress=202.38.95.102/25\nAddress=2001:da8:d800:95::102/64\nIPv6AcceptRA=no\n\n[Route]\nGateway=202.38.95.126\nTable=253\nMetric=2\n\n[Route]\nGateway=2001:da8:d800:95::1\nTable=253\nMetric=2\n\n[Route]\nGateway=202.38.95.126\nTable=1002\n\n[Route]\nGateway=2001:da8:d800:95::1\nTable=1002\n\n[RoutingPolicyRule]\nFrom=202.38.95.102\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFrom=2001:da8:d800:95::102\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFamily=both\nOutgoingInterface=Cernet\nTable=1002\nPriority=3\n\n[RoutingPolicyRule]\nFamily=both\nFirewallMark=0x2\nTable=1002\nPriority=4\n</code></pre> <p>This config file assigns one IPv4 and one IPv6 address to the interface, as well as one IPv4 route and one IPv6 route for both the default routing table and an interface-specific routing table. It then adds three routing rules in both IPv4 and IPv6 for replying on the same interface, for sockets bound to this interfaces, and for firewall mark routing.</p> <p>Other interfaces are configured similarly, so just refer to their configuration files for details.</p>"},{"location":"services/gateway-nic/#routes","title":"Routes","text":"<p>Outgoing connections are routed through different ISPs. We use ISP IP data from gaoyifan/china-operator-ip. Relevant files are located under <code>/usr/local/network_config</code>.</p> <p>The said repository (branch <code>ip-lists</code>) is cloned and we symlink select files to <code>iplist</code> directory for consumption. A custom script converts these IP data into additional systemd-networkd config files (under <code>/run/systemd</code>).</p> $ ls -l /usr/local/network_config/iplist/<pre><code>lrwxrwxrwx cernet.txt -&gt; ../china-operator-ip/cernet.txt\nlrwxrwxrwx cernet6.txt -&gt; ../china-operator-ip/cernet6.txt\nlrwxrwxrwx china.txt -&gt; ../china-operator-ip/china.txt\nlrwxrwxrwx china6.txt -&gt; ../china-operator-ip/china6.txt\nlrwxrwxrwx cstnet.txt -&gt; ../china-operator-ip/cstnet.txt\nlrwxrwxrwx cstnet6.txt -&gt; ../china-operator-ip/cstnet6.txt\nlrwxrwxrwx mobile.txt -&gt; ../china-operator-ip/cmcc.txt\nlrwxrwxrwx telecom.txt -&gt; ../china-operator-ip/chinanet.txt\nlrwxrwxrwx unicom.txt -&gt; ../china-operator-ip/unicom.txt\n-rw-r--r-- ustcnet.txt\n-rw-r--r-- ustcnet6.txt\n</code></pre> /usr/local/network_config/route-all.sh<pre><code>#!/bin/bash\n\n[ -n \"$BASH_VERSION\" ] || exit 1\n\nWD=\"$(dirname \"$0\")\"\nROOT_IP_LIST=\"$WD/iplist\"\nROOT_CONF=/etc/systemd/network\nROOT_RT=/run/systemd/network\n\ngen_route() {\n  local DEVFILE=\"$1\"\n  local DEV=\"$(awk -F = '/^Name=/{print $2; exit}' \"$ROOT_CONF/$DEVFILE.network\")\"\n  local GW=\"$2\" FAMILY=ipv4 V6\n  if [[ \"$GW\" =~ : ]]; then\n    FAMILY=ipv6\n    V6=\"-v6\"\n  fi\n  # Convert table to number\n  local TABLENAME=\"$3\"\n  local TABLE=\"$(awk 'substr($0, 1, 1) != \"#\" &amp;&amp; $2 == \"'\"$TABLENAME\"'\" { print $1 }' /etc/iproute2/rt_tables | head -1)\"\n  local PRIORITY=\"$4\"\n  shift 4\n\n  F=\"$ROOT_RT/$DEVFILE.network.d\"\n  mkdir -p \"$F\"\n  F=\"$F/route-${TABLENAME,,}${V6}.conf\"\n  echo -e \"[RoutingPolicyRule]\\nFamily=$FAMILY\\nTable=$TABLE\\nPriority=$PRIORITY\\n\" &gt; \"$F\"\n\n  awk '{ print \"[Route]\\nDestination=\" $1 \"\\nGateway='\"$GW\"'\\nTable='\"$TABLE\"'\\n\" }' \"${@/#/$ROOT_IP_LIST/}\" &gt;&gt; \"$F\"\n}\n\ngen_route 12-Cernet 202.38.95.126 ustcnet 5 ustcnet.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 ustcnet 5 ustcnet6.txt\ngen_route 12-Cernet 202.38.95.126 cernet 6 cernet.txt cstnet.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 cernet 6 cernet6.txt cstnet6.txt\ngen_route 13-Telecom 202.141.160.126 telecom 6 telecom.txt unicom.txt\ngen_route 14-Mobile 202.141.176.126 mobile 6 mobile.txt\ngen_route 12-Cernet 202.38.95.126 china 7 china.txt\ngen_route 12-Cernet 2001:da8:d800:95::1 china 7 china6.txt\n</code></pre> <p>We then use a systemd service to ensure additional files for systemd-networkd are generated before it starts.</p> /etc/systemd/system/route-all.service<pre><code>[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\n#ExecStart=/usr/local/network_config/special.rb\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\n</code></pre> <p>Updating routes from upstream is easy:</p> /usr/local/network_config/update.sh<pre><code>#!/bin/sh\n\ncd \"$(dirname \"$0\")\"\n\ngit -C china-operator-ip pull\nsystemctl restart route-all.service\n</code></pre> <p>The resulting routing policies look like this:</p> $ ip rule<pre><code>0:      from all lookup local\n2:      from all lookup main suppress_prefixlength 1\n3:      from 172.16.0.2 lookup Warp\n3:      from all oif Warp lookup Warp\n3:      from 202.141.176.102 lookup Mobile\n3:      from all oif Mobile lookup Mobile\n3:      from 202.141.160.102 lookup Telecom\n3:      from all oif Telecom lookup Telecom\n3:      from 202.38.95.102 lookup Cernet\n3:      from all oif Cernet lookup Cernet\n4:      from all fwmark 0x5 lookup Warp\n4:      from all fwmark 0x4 lookup Mobile\n4:      from all fwmark 0x3 lookup Telecom\n4:      from all fwmark 0x2 lookup Cernet\n5:      from all lookup Special suppress_prefixlength 1\n5:      from all lookup Ustcnet\n6:      from all lookup mobile\n6:      from all lookup telecom\n6:      from all lookup cernet\n7:      from all lookup china\n32767:  from all lookup default\n</code></pre>"},{"location":"services/gateway-nic/#tinc-vpn","title":"Tinc VPN","text":"<p>Gateway-NIC connects to intranet with Tinc. There's no special Tinc configuration other than those described at the Tinc VPN page.</p> <p>Because Tinc now uses systemd services instead of System V <code>init.d</code> scripts, we need to <code>systemctl enable tinc@ustclug.service</code> to make it start on boot. Everything is managed through this templated systemd service.</p>"},{"location":"services/gateway-nic/#systemd-networkd-wait-onlineservice","title":"systemd-networkd-wait-online.service","text":"<p>We also override systemd-networkd's online detection for goodness' sake, so it doesn't block booting. Note that it may interfere with services depending on <code>network-online.target</code>, though we have yet to discover any issues.</p> $ systemctl edit systemd-networkd-wait-online.service<pre><code>[Service]\nExecStart=\nExecStart=/bin/sleep 1\n</code></pre>"},{"location":"services/gateway-nic/#iptables","title":"iptables","text":"<p>All iptables firewall rules are managed manually. We use <code>iptables-persistent</code> to automatically load firewall rules on boot.</p> <p>To change the rules, manually edit <code>/root/iptables/rules.v4</code> or <code>rules.v6</code> and then run <code>apply.sh</code> to apply the changes.</p>"},{"location":"services/gateway-nic/#fail2ban","title":"Fail2ban","text":"<p>We use fail2ban to stop SSH scanning and brute-force attempts.</p> <p>Because fail2ban relies on changing iptables to work, to improve its performance as well as minimize its tampering of iptables rules, we use ipsets for fail2ban.</p> <p>After stock installation of <code>fail2ban</code> package, remove <code>defaults-debian.conf</code> and add this file to secure SSH daemon:</p> /etc/fail2ban/jail.d/sshd.conf<pre><code>[sshd]\nenabled = true\nmode    = aggressive\nfilter  = sshd[mode=%(mode)s]\nlogpath = /var/log/auth.log\nbackend = pyinotify\naction  = iptables-ipset-proto6[chain=\"fail2ban\"]\n</code></pre> <p>We provide a pre-created empty chain named <code>fail2ban</code> for fail2ban to manipulate (see iptables above).</p> <p>To make sure fail2ban rules can be re-applied after reloading iptables manually, we override the systemd service so that fail2ban is restarted whenever the iptables service is restarted.</p> $ systemctl edit fail2ban.service<pre><code>[Unit]\nAfter=netfilter-persistent.service\nBindsTo=netfilter-persistent.service\n</code></pre> <p>For some servers where we want to manually start fail2ban, we use <code>Requires=</code> + <code>PartOf=</code>. This will propagate \"restart\" event from iptables to fail2ban, but not \"start\".</p> $ systemctl edit fail2ban.service<pre><code>[Unit]\nAfter=netfilter-persistent.service\nRequires=netfilter-persistent.service\nPartOf=netfilter-persistent.service\n</code></pre>"},{"location":"services/gateway-nic/#nginx","title":"Nginx","text":""},{"location":"services/gateway-nic/#unregistered-domain-traffic","title":"ustclug.org issue","text":"<p>To mitigate the issue of the complaints from ISPs and the regulation authorities caused by the gateways in USTCnet responding to the requests for <code>ustclug.org</code>, which is a unregistered domain in China MIIT, we make nginx listen on an alternative port 81/444 for HTTP and HTTPS respectively, to response to the requests for <code>lug.ustc.edu.cn</code> only, and rejecting the handshake for any other domain.</p> /etc/nginx/sites-available/default<pre><code>server {\n  listen 81 default_server;\n  listen [::]:81 default_server;\n  listen 444 ssl http2 default_server;\n  listen [::]:444 ssl http2 default_server;\n  server_name _;\n  ssl_reject_handshake on; \n  return 444;\n}\n</code></pre> <p>To whitelist any domain, add <code>listen 81</code> and <code>listen 444 http2 ssl</code> to corresponding site's server block.</p> <p>We use iptables to redirect any traffic from outside USTCnet whose destination is TCP port 80/443 on local machine to TCP port 81/444 respectively.</p> <pre><code>-A PREROUTING -m addrtype --dst-type LOCAL -j NGINX-REDIRECT\n-A NGINX-REDIRECT -i lo -j RETURN\n-A NGINX-REDIRECT -m set --match-set ustcnet src -j RETURN\n-A NGINX-REDIRECT -p tcp --dport 80 -j REDIRECT --to-port 81\n-A NGINX-REDIRECT -p tcp --dport 443 -j REDIRECT --to-port 444\n</code></pre>"},{"location":"services/generate-204/","title":"Generate 204","text":"<p>Service: 204.ustclug.org (HTTP / HTTPS)</p> <p>Server: (gateway)</p> <p>Blog: add-http-204-service</p>"},{"location":"services/generate-204/#configration","title":"Configration","text":"/etc/nginx/sites-available/204.ustclug.org<pre><code>server {\n    listen      80;\n    listen      [::]:80;\n    listen      443 ssl http2;\n    listen      [::]:443 ssl http2;\n    server_name 204.ustclug.org;\n    access_log  /var/log/nginx/204_access.log;\n    error_log   /var/log/nginx/204_error.log;\n    return 204;\n}\n</code></pre> <p>The authoritative copy is on LUG GitLab.</p>"},{"location":"services/gitlab/","title":"GitLab","text":"<p>Server: gitlab.s.ustclug.org (management ssh port 2222)</p> <p>Git Repository: gitlab-scripts</p>"},{"location":"services/gitlab/#gitlab-security","title":"GitLab &amp; Security","text":"<p>GitLab \u7ef4\u62a4\u8005\u9700\u8981\u8ba2\u9605\uff1a</p> <ol> <li>GitLab Security Notices \u90ae\u4ef6\u5217\u8868 (https://about.gitlab.com/company/contact/ \u53f3\u4fa7 \"Sign up for security notices\")</li> <li> sameersbn/docker-gitlab Releases (Watch \u2192 Custom \u2192 Releases)</li> </ol> <p>\u5728 GitLab \u6709 Security Release \u4e14 docker-gitlab \u53d1\u5e03\u65b0\u7248\u672c\u4e4b\u540e\u9700\u8981\u5b89\u6392\u65f6\u95f4\u66f4\u65b0\u3002\u5c24\u5176 Critical Security Release \u9700\u8981\u5c3d\u5feb\u627e\u65f6\u95f4\u66f4\u65b0\u3002</p>"},{"location":"services/gitlab/#_1","title":"\u66f4\u65b0","text":"<p>\uff08\u5efa\u8bae\u9605\u8bfb https://docs.gitlab.com/ee/update/index.html\uff0c\u4ee5\u53ca GitLab \u5b98\u65b9\u7684\u5347\u7ea7\u8def\u5f84\u5206\u6790\u5de5\u5177\uff1ahttps://gitlab-com.gitlab.io/support/toolbox/upgrade-path/\uff09</p> <p>GitLab 16.0 \u8d77\u79fb\u9664\u4e86\u5bf9 CAS3 \u7684\u652f\u6301\uff0c\u56e0\u6b64\u6211\u4eec\u5207\u6362\u5230\u4e86 OAuth2 \u6765\u5bf9\u63a5\u4e2d\u56fd\u79d1\u5b66\u6280\u672f\u5927\u5b66\u7edf\u4e00\u8eab\u4efd\u8ba4\u8bc1\u3002\u4e3a\u4e86\u5b9e\u73b0\u81ea\u5b9a\u4e49 OAuth2 \u767b\u5f55\u53c2\u6570\uff0c\u6211\u4eec fork \u4e86 sameersbn/docker-gitlab\uff0c\u4ed3\u5e93\u4f4d\u4e8e ustclug/docker-gitlab\u3002\u66f4\u65b0\u65f6\uff0c\u9700\u8981\u9996\u5148\u6309\u7167 ustclug/docker-gitlab \u7684 <code>README.md</code> \u6240\u8ff0\u7684\u6b65\u9aa4\u66f4\u65b0\u955c\u50cf\uff0c\u4e00\u822c\u53ea\u9700\u66f4\u6539\u6240\u8ff0\u7684\u4e24\u4e2a\u4f4d\u7f6e\u7684\u7248\u672c\u53f7\uff0c\u63a8\u9001\u5230\u4ed3\u5e93\u540e\uff0cGitHub Actions \u5c06\u81ea\u52a8\u5b8c\u6210\u955c\u50cf\u7684\u6784\u5efa\uff0c\u5e76\u4e0a\u4f20\u5230 ghcr.io\u3002\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u82e5\u4e0a\u6e38\u66f4\u65b0\u5305\u542b\u5bf9 <code>assets/runtime</code> \u76ee\u5f55\u7684\u53d8\u66f4\uff0c\u5219\u9700\u5148\u5c06\u4e0a\u6e38\u66f4\u65b0\u5408\u5e76\u5230\u6211\u4eec\u7684\u4ed3\u5e93\uff0c\u5426\u5219\u53ef\u80fd\u51fa\u73b0\u6784\u5efa\u6216\u8fd0\u884c\u65f6\u9519\u8bef\u3002</p> <p>\u7531\u4e8e\u5df2\u7ecf docker \u5316\uff0c\u56e0\u6b64\u6211\u4eec\u7684\u66f4\u65b0\u662f\u901a\u8fc7\u62c9\u53d6 ustclug/docker-gitlab \u7684 docker image\uff0c\u8fdb\u884c\u6570\u636e\u5e93\u51c6\u5907\u4ee5\u53ca\u542f\u52a8\u955c\u50cf\u5b9e\u4f8b\u6765\u8fdb\u884c\u66f4\u65b0\uff0cZack Zeng \u5b66\u957f\u5df2\u7ecf\u5199\u597d\u4e86\u4e00\u5957\u811a\u672c\u7cfb\u7edf\uff1agitlab-scripts\uff0c\u56e0\u6b64\u66f4\u65b0\u65f6\u53ea\u8981\u8dd1\u811a\u672c\u5c31\u53ef\u4ee5\u4e86\u3002</p> <p>\u7531\u4e8e\u66f4\u65b0\u9700\u8981\u505c\u6b62\u670d\u52a1\uff0c\u56e0\u6b64\u8bf7\u4e8e\u66f4\u65b0\u524d\u81f3\u5c11\u51e0\u5c0f\u65f6\u53d1\u5e03\u66f4\u65b0\u516c\u544a\uff08\u5305\u62ec\u5177\u4f53\u65f6\u95f4\u7b49\uff09\uff0c\u5e76\u68c0\u67e5 Admin -&gt; Monitoring -&gt; Background Migrations \u4e2d\u6240\u6709 migration \u662f\u5426\u90fd\u5df2\u7ecf\u6210\u529f\u5b8c\u6210\u3002</p> <p>\u66f4\u65b0\u524d\u8bf7\u5148\u63d0\u524d\u4e8e Proxmox VE \u4e0a\u5bf9\u865a\u62df\u673a\u6253\u5feb\u7167\uff08\u6253\u5feb\u7167\u65f6\u670d\u52a1\u4f1a\u6682\u65f6\u505c\u6b62\uff09</p> <p>\u6253\u5b8c\u5feb\u7167\u4e4b\u540e\u4f7f\u7528\u811a\u672c\u8fdb\u884c\u66f4\u65b0\uff08\u76ee\u524d\u811a\u672c\u4f4d\u4e8e <code>/home/sirius/gitlab-scripts</code>\uff09\uff0c\u9996\u5148\u4f7f\u7528 <code>./gitlab.sh db</code> \u8fdb\u884c\u6570\u636e\u5e93\u7684\u51c6\u5907\u5de5\u4f5c\u3002\u4e4b\u540e\u53ef\u4ee5\u901a\u8fc7 <code>./gitlab.sh run &lt;\u7248\u672c\u53f7&gt;</code> \u6765\u8fdb\u884c docker container \u7684\u66ff\u6362\u3002\u66f4\u6362\u524d\u811a\u672c\u4f1a\u81ea\u52a8\u62c9\u53d6\u76f8\u5e94\u7248\u672c\u53f7\u7684 docker \u955c\u50cf\uff0c\u5982\u679c\u62c5\u5fc3\u62c9\u53d6\u65f6\u95f4\u8fc7\u957f\u53ef\u4ee5\u5728\u6253\u5feb\u7167\u524d\u63d0\u524d\u901a\u8fc7 <code>docker pull ghcr.io/ustclug/docker-gitlab:&lt;\u7248\u672c\u53f7&gt;</code> \u6765\u62c9\u53d6\u76f8\u5e94\u7684\u955c\u50cf\u3002</p> <p>\u4e00\u822c\u60c5\u51b5\u4e0b\u7ecf\u4ee5\u4e0a\u64cd\u4f5c\u540e\u66f4\u65b0\u5c31\u6b63\u5e38\u7ed3\u675f\uff0c\u5982\u679c\u957f\u65f6\u95f4\u65e0\u6cd5\u542f\u52a8\uff0c\u53ef\u4ee5\u901a\u8fc7 <code>docker logs gitlab</code> \u67e5\u770b\u65e5\u5fd7\uff0c\u5982\u679c\u53d1\u73b0\u66f4\u65b0\u540e\u7684\u542f\u52a8\u51fa\u73b0\u95ee\u9898\uff0c\u53ef\u4ee5\u5230 sameersbn/docker-gitlab \u7684 issue \u533a\u7b49\u5730\u67e5\u770b\u76f8\u5173 issue\uff0c\u4ee5\u53ca\u901a\u8fc7\u5bf9\u51fa\u9519\u65e5\u5fd7\u8fdb\u884c Google \u53ef\u80fd\u4f1a\u53d1\u73b0\u662f gitlab \u4e0a\u6e38\u7b49\u51fa\u73b0\u7684\u95ee\u9898\u3002\u5982\u679c\u6709\u89e3\u51b3\u529e\u6cd5\uff0c\u53ef\u4ee5\u6309\u7167\u76f8\u5e94\u89e3\u51b3\u529e\u6cd5\u89e3\u51b3\uff0c\u5982\u679c\u6ca1\u6709\u3002\u53ef\u4ee5\u901a\u8fc7\u627e\u5230\u6709\u76f8\u5e94\u95ee\u9898\u524d\u7684\u6b63\u5e38\u7248\u672c\u53f7\uff0c\u56de\u6eda\u5feb\u7167\uff0c\u4e4b\u540e\u66f4\u5230\u8868\u73b0\u6b63\u5e38\u7684\u7248\u672c\u3002\uff08\u6700\u8fd1\u7684\u66f4\u65b0\u4f1a\u5728\u542f\u52a8\u4e4b\u540e\u77ed\u6682\u51fa\u73b0 502 \u7684\u60c5\u51b5\uff0c\u4f46\u5f88\u5feb\u5c31\u4f1a\u6062\u590d\uff0c\u9047\u5230\u8fd9\u79cd\u60c5\u51b5\u65f6\u4e0d\u8981\u60ca\u614c\uff09\u3002</p> <p>\u7531\u4e8e\u66f4\u65b0\u53ef\u80fd\u4f1a\u51fa\u73b0\u95ee\u9898\u5bfc\u81f4\u670d\u52a1\u4e0d\u53ef\u7528\uff0c\u56e0\u6b64\u4e0d\u5efa\u8bae\u901a\u8fc7 cron \u7b49\u65b9\u5f0f\u81ea\u52a8\u8fdb\u884c\u66f4\u65b0\u3002</p>"},{"location":"services/gitlab/#postgresql-redis","title":"postgresql \u4e0e redis \u7684\u66f4\u65b0","text":"<p>\u7531\u4e8e gitlab \u66f4\u65b0\u540e\u53ef\u80fd\u5bf9 postgresql \u4e0e redis \u7684\u7248\u672c\u6709\u8981\u6c42\uff0c\u56e0\u6b64\u6709\u53ef\u80fd\u9700\u8981\u5b9a\u671f\u66f4\u65b0 redis \u4e0e postgresql\u3002</p> <p>\u66f4\u65b0\u524d\u8bf7\u5148\u505c\u6b62 gitlab \u7684 container\u3002</p> <p>\u66f4\u65b0\u65f6\u53ef\u4ee5\u6309\u7167\u5b98\u7f51\u6559\u7a0b docker-postgresql \u8fdb\u884c\u66f4\u65b0\uff0c\u53ef\u4ee5\u901a\u8fc7\u62c9\u53d6 latest \u6807\u7b7e\u7684\u955c\u50cf\uff0c\u5220\u9664\u539f\u6765\u7684 container\uff0c\u518d\u901a\u8fc7\u811a\u672c <code>./gitlab.sh db</code> \u81ea\u52a8\u542f\u52a8\uff0c\u6570\u636e\u5e93\u66f4\u65b0\u65f6\u53ef\u80fd\u4f1a\u9700\u8981\u4e00\u5b9a\u65f6\u95f4\u6765\u8fc1\u79fb\u6570\u636e\uff0c\u8bf7\u901a\u8fc7 <code>docker logs -f gitlab-postgresql</code> \u547d\u4ee4\u6765\u67e5\u770b\u8fc1\u79fb\u8fdb\u5ea6\uff0c\u5f85\u8fc1\u79fb\u5b8c\u6210\u540e\u518d\u8fd0\u884c GitLab \u7684 container\u3002</p>"},{"location":"services/gitlab/#rails-console","title":"\u8bbf\u95ee Rails console","text":"<p>Rails console \u53ef\u4ee5\u5b8c\u6210\u4e00\u4e9b\u9ad8\u7ea7\u7684\u7ef4\u62a4\u4efb\u52a1\u3002\u5728 gitlab \u5bb9\u5668\u4e2d\u6267\u884c <code>bin/rails console</code> \u542f\u52a8\u3002\u6ce8\u610f console \u7684\u542f\u52a8\u65f6\u95f4\u5f88\u957f\uff08 1 \u5206\u949f\u4ee5\u4e0a\uff09\uff0c\u9700\u8981\u6709\u8010\u5fc3\u3002</p> <p>\u53ef\u4ee5\u6267\u884c\u7684\u547d\u4ee4\u53ef\u53c2\u8003 https://docs.gitlab.com/ee/administration/troubleshooting/gitlab_rails_cheat_sheet.html\u3002</p>"},{"location":"services/gitlab/#_2","title":"\u67e5\u8be2","text":""},{"location":"services/gitlab/#hashed-storage","title":"\u67e5\u8be2 Hashed storage \u4e0b\u4ed3\u5e93\u5bf9\u5e94\u7684\u9879\u76ee","text":"<pre><code>ProjectRepository.find_by(disk_path: '@hashed/23/33/2333333333333333333333333333333333333333333333333333333333333333').project\n</code></pre> <p>\u5982\u679c\u5b58\u5728\uff0c\u4f1a\u8fd4\u56de\u7c7b\u4f3c\u4ee5\u4e0b\u7684\u5185\u5bb9\uff1a</p> <pre><code>=&gt; #&lt;Project id:23333 username/project&gt;&gt;\n</code></pre>"},{"location":"services/gitlab/#sql-like","title":"\u67e5\u8be2\u65e0\u9879\u76ee\u4e14\u90ae\u7bb1\u6ee1\u8db3\u6761\u4ef6\u7684\u7528\u6237 (SQL <code>like</code>)","text":"<pre><code>users = User.where('id NOT IN (select distinct(user_id) from project_authorizations)')\nusers = users.where('email like ?', '%.ru')\nusers.count\n\nusers.each do |user|\n    puts user.last_activity_on\nend\n</code></pre>"},{"location":"services/gitlab/#_3","title":"\u5237\u65b0\u67d0\u4e2a\u9879\u76ee\u7684\u7edf\u8ba1\u4fe1\u606f","text":"<pre><code>p = Project.find_by_full_path('&lt;namespace&gt;/&lt;project&gt;')\npp p.statistics\np.statistics.refresh!\npp p.statistics\n</code></pre>"},{"location":"services/gitlab/#lfs-id","title":"\u83b7\u53d6\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee ID","text":"<pre><code>LfsObject.all.each do |lo|\n    puts LfsObjectsProject.find_by_lfs_object_id(lo.id).project_id\nend\n</code></pre> <p>\u8f93\u51fa\u8f83\u591a\u3002\u53ef\u4ee5\u4f7f\u7528 <code>rails r xxx.rb</code> \u8fd0\u884c\uff0c\u91cd\u5b9a\u5411\u5230\u6587\u4ef6\uff0c\u53bb\u91cd\u540e\u67e5\u770b\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee\u3002</p>"},{"location":"services/gitlab/#rake-tasks","title":"\u4f7f\u7528 Rake tasks","text":"<p>\u8be6\u89c1 https://github.com/sameersbn/docker-gitlab#rake-tasks\u3002\u548c Rails console \u4e00\u6837\uff0c\u521d\u59cb\u5316\u5f88\u6162\u3002</p> <p>\u5f53\u524d\u5b9e\u4f8b\u4fe1\u606f\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:env:info RAILS_ENV=production\n</code></pre>"},{"location":"services/gitlab/#_4","title":"\u6e05\u7406","text":"<p>\u53c2\u8003 https://github.com/gitlabhq/gitlabhq/blob/master/doc/raketasks/cleanup.md\u3002</p> <p>\u4e0d\u8fc7\u4f5c\u7528\u6709\u9650\u3002</p>"},{"location":"services/gitlab/#_5","title":"\u6e05\u7406\u4e0a\u4f20\u76ee\u5f55","text":"<p>\u67e5\u770b\u4f1a\u88ab\u6e05\u7406\u7684\u6587\u4ef6\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:project_uploads RAILS_ENV=production\n</code></pre> <p>\u6e05\u7406\uff08\u79fb\u52a8\u5230 /-/project-lost-found/\uff09\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:project_uploads RAILS_ENV=production DRY_RUN=false\n</code></pre>"},{"location":"services/gitlab/#artifact","title":"\u6e05\u7406\u672a\u88ab\u5f15\u7528\u7684 artifact \u6587\u4ef6","text":"<p>\u67e5\u770b\u4f1a\u88ab\u6e05\u7406\u7684 artifact \u6570\u91cf\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_job_artifact_files RAILS_ENV=production\n</code></pre> <p>\u6e05\u7406\uff1a</p> <pre><code>docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_job_artifact_files RAILS_ENV=production DRY_RUN=false\n</code></pre> <p>\u6ce8\u610f\uff0c\u65b0\u8bbe\u7f6e\u7684 expire \u671f\u9650\u4e0d\u4f1a\u5f71\u54cd\u4ee5\u524d\u7684 artifact\uff0c\u8fd9\u91cc\u7684\u547d\u4ee4\u4e5f\u65e0\u6cd5\u6e05\u7406\u3002</p>"},{"location":"services/gitlab/#lfs-reference","title":"\u6e05\u7406\u65e0\u6548\u7684 LFS reference","text":"<pre><code>for i in `cat projectid_lfs`; do docker exec --user git -it gitlab bundle exec rake gitlab:cleanup:orphan_lfs_file_references PROJECT_ID=$i RAILS_ENV=production DRY_RUN=false; done\n</code></pre> <p><code>projectid_lfs</code> \u662f\u4e0a\u6587\u4e2d\u300c\u83b7\u53d6\u6240\u6709\u5305\u542b LFS \u7684\u9879\u76ee ID\u300d\u7684\u53bb\u91cd\u540e\u7684\u8f93\u51fa\u3002</p> <p>\u65e0 reference \u7684 LFS \u6587\u4ef6\u6bcf\u65e5 GitLab \u4f1a\u81ea\u52a8\u6e05\u9664\u3002\u5982\u679c\u9700\u8981\u7acb\u523b\u5220\u9664\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>gitlab:cleanup:orphan_lfs_files</code>\u3002</p>"},{"location":"services/gitlab/#_6","title":"\u7d27\u6025\u64cd\u4f5c","text":""},{"location":"services/gitlab/#_7","title":"\u8bbe\u7f6e\u4e3a\u53ea\u8bfb","text":"<p>Ref: https://docs.gitlab.com/ee/administration/read_only_gitlab.html</p> <pre><code>docker exec --user git -it gitlab bin/rails console\n</code></pre> <p>\u4e4b\u540e\u6267\u884c</p> <pre><code>Project.all.find_each { |project| puts project.name; project.update!(repository_read_only: true) }\n</code></pre> <p>\u5c06\u6240\u6709\u4ed3\u5e93\u8bbe\u7f6e\u4e3a\u53ea\u8bfb\u3002\u5982\u679c\u4e2d\u95f4\u51fa\u73b0\u9519\u8bef\uff08\u7279\u6b8a\u7684\u9879\u76ee\u540d\u53ef\u80fd\u4f1a\u5bfc\u81f4\u8fd0\u884c\u4e2d\u65ad\uff09\uff0c\u91cd\u547d\u540d\u6700\u540e\u8f93\u51fa\u5bf9\u5e94\u7684\u9879\u76ee\u3002</p> <p>\u5728\u8bbe\u7f6e\u524d\uff0c\u9700\u8981\u6dfb\u52a0 Messages \u901a\u77e5\u7528\u6237\u3002</p> <p>\u6b64\u65f6\u6570\u636e\u5e93\u4ecd\u7136\u53ef\u5199\u5165\u3002\u5982\u679c\u9700\u8981\u6570\u636e\u5e93\u53ea\u8bfb\uff0c\u53c2\u8003\u4ee5\u4e0a\u94fe\u63a5\u914d\u7f6e\u3002</p>"},{"location":"services/light/","title":"Light Accelerator","text":"<p>Service: light.ustclug.org</p> <p>Git Repository:</p> <ul> <li>Server Daemon</li> <li>Web UI</li> <li>Accelerate list</li> <li>Documentation</li> </ul> <p>Docker Hub:</p> <ul> <li>ustclug/light-server</li> <li>ustclug/lug-vpn-web:light</li> </ul> <p>Mailing list: \u8f7b\u91cf\u7ea7\u7f51\u7edc\u52a0\u901f\u670d\u52a1</p> <p>Servers:</p> <ul> <li>swarm.s.ustclug.org (docker containers)<ul> <li>light-mysql</li> <li>light-freeradius</li> <li>light-server</li> <li>light-socks5</li> <li>light-web</li> </ul> </li> <li>gateway-el.s.ustclug.org (port mapping + reverse proxy)<ul> <li>29979 \u2192 light-server.d.ustclug.org:29979</li> <li>29980 \u2192 light-server.d.ustclug.org:29980</li> <li>light.ustclug.org \u2192 light-web.d.ustclug.org</li> </ul> </li> <li>vdp.s.ustclug.org<ul> <li>LUG FTP: https://ftp.lug.ustc.edu.cn/light/</li> </ul> </li> </ul>"},{"location":"services/light/#deploy","title":"Deploy","text":"<p>Deploy script:  docker-run-script/light</p> <p>Deploy order:</p> <ol> <li>mysql</li> <li>freeradius, light-web</li> <li>squid</li> </ol>"},{"location":"services/light/#add-new-domain","title":"Add new domain","text":"<pre><code>git clone https://github.com/ustclug/light-list\ncd accelerate-list\n./tools/add-domain.sh accelerate.list www.example.com\ngit commit -v -a\ngit push origin master\n</code></pre> <p>GitHub Actions will update PAC files in LUG FTP automatically.</p>"},{"location":"services/light/#database-maintenance","title":"Database maintenance","text":"<p>Example:</p> <pre><code>select count(*) from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ninsert into radacct_backup select * from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ndelete from radacct where acctstoptime &lt; '2021-01-01 00:00:00';\ndelete from radacct_backup where acctstoptime &lt; '2020-06-01 00:00:00';\noptimize table radacct;\noptimize table radacct_backup;\n</code></pre>"},{"location":"services/light/#shutdown","title":"Shutdown","text":"<ol> <li>Stop two containers: <code>light-server</code> &amp; <code>light-socks</code></li> <li>Set restart policy to <code>no</code> (See Docker Documentation)</li> </ol>"},{"location":"services/light/#logs","title":"Logs","text":"<p>Proxy related log is under <code>/srv/docker/light/log</code>. Container log (stdout &amp; stderr) is under <code>/srv/docker/docker/containers/&lt;container id&gt;/*.log*</code> (use <code>docker logs &lt;container&gt;</code> to view).</p> <p>Logrotate is configured to save logs for 180 days. Please manually backup logs when removing the container.</p>"},{"location":"services/mirrorz/","title":"MirrorZ CERNET server","text":"<p>MirrorZ \u9879\u76ee\u5728 CERNET \u5317\u4eac\u8282\u70b9\u6709\u4e00\u4e2a\u865a\u62df\u673a\uff0c\u901a\u8fc7 *.mirrors.cernet.edu.cn \u7684\u57df\u540d\u63d0\u4f9b 302 \u8df3\u8f6c\u548c\u5e2e\u52a9\u9875\u9762\u7b49\u670d\u52a1\u3002</p> <p>\u7531\u4e8e CentOS 7 \u5728 2024 \u5e74 6 \u6708\u7ed3\u675f\u652f\u6301\uff0ciBug \u548c taoky \u5728 2024 \u5e74 2 \u6708\u914d\u7f6e\u4e86\u4e00\u4e2a\u8fd0\u884c Debian 12 \u7684\u65b0\u865a\u62df\u673a\u3002\u65b0\u865a\u62df\u673a\u955c\u50cf\u57fa\u4e8e debian-cdimage \u63d0\u4f9b\u7684 <code>debian-12-genericcloud-amd64.qcow2</code>\u3002</p>"},{"location":"services/mirrorz/#system","title":"\u7cfb\u7edf\u914d\u7f6e","text":""},{"location":"services/mirrorz/#network","title":"\u7f51\u7edc","text":"<p>\u865a\u62df\u673a\u7684\u7f51\u7edc\u91c7\u7528 systemd-networkd \u914d\u7f6e\uff0c\u914d\u7f6e\u6587\u4ef6\u5728 <code>/etc/systemd/network</code> \u4e0b\uff0cv4/v6 \u5747\u4f7f\u7528\u9759\u6001 IP \u914d\u7f6e\u3002\u5176\u4e2d <code>[Match]</code> \u5757\u4f7f\u7528 <code>MACAddress=...</code> \u6765\u5339\u914d\u7f51\u5361\u3002</p>"},{"location":"services/mirrorz/#ssh","title":"SSH","text":"/etc/ssh/sshd_config.d/ibug.conf<pre><code>PasswordAuthentication no\nPermitRootLogin prohibit-password\n</code></pre>"},{"location":"services/mirrorz/#ntp","title":"NTP","text":"/etc/systemd/timesyncd.conf.d/ibug.conf<pre><code>[Time]\nNTP=ntp.tuna.tsinghua.edu.cn\n</code></pre>"},{"location":"services/mirrorz/#software","title":"\u8f6f\u4ef6","text":"<p>etckeeper\uff08\u4e0d\u77e5\u9053\u600e\u4e48\u914d\u7f6e\u7684\uff0c\u88c5\u597d\u5373\u7528\uff1f\uff09</p> <ul> <li>Nginx (\u4f7f\u7528 n.wtf \u7684\u7248\u672c)</li> <li>Node.js 18</li> <li>InfluxDB 2</li> <li>Grafana 9</li> </ul> <p>\u4ee5\u4e0a\u56db\u4e2a\u8f6f\u4ef6\u5206\u522b\u4ece\u56db\u4e2a\u4e0d\u540c\u7684 APT \u6e90\u5b89\u88c5\uff0c\u5bf9\u5e94\u7684 APT \u516c\u94a5\u90fd\u5b58\u5728 <code>/etc/apt/keyrings</code> \u4e2d\u3002</p> <p>APT \u6e90\u914d\u7f6e</p> /etc/apt/sources.list.d/docker.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://mirrors.ustc.edu.cn/docker-ce/linux/debian bookworm stable\n</code></pre> /etc/apt/sources.list.d/grafana.list<pre><code>deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://mirrors.tuna.tsinghua.edu.cn/grafana/apt stable main\n</code></pre> /etc/apt/sources.list.d/influxdata.list<pre><code>deb [signed-by=/etc/apt/keyrings/influxdata.asc] https://mirrors.ustc.edu.cn/influxdata/debian stable main\n</code></pre> /etc/apt/sources.list.d/nodesource.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_18.x nodistro main\n</code></pre> /etc/apt/sources.list.d/sb-nginx.list<pre><code>deb [arch=amd64 signed-by=/etc/apt/keyrings/sb-nginx.asc] https://mirror.xtom.com.hk/sb/nginx/ bookworm main\n</code></pre>"},{"location":"services/mirrorz/#go","title":"Go","text":"<p>\u4ece\u5b98\u65b9\u7f51\u7ad9\u4e0b\u8f7d\u6700\u65b0\u7684 tar.gz \u5e76\u89e3\u538b\u5230 <code>/usr/local/go</code>\uff0c\u7136\u540e\u5c06 <code>/usr/local/go/bin</code> \u4e2d\u7684\u4e24\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6\u8f6f\u94fe\u63a5\u5230 <code>/usr/local/bin</code>\u3002</p> <p>\u66f4\u65b0 Go \u7684\u5feb\u6377\u811a\u672c\u4f4d\u4e8e <code>/root/go/update.sh</code>\uff0c\u5185\u5bb9\u89c1 iBug/shGadgets\u3002</p>"},{"location":"services/mirrorz/#_1","title":"\u6570\u636e\u76ee\u5f55","text":"<p>MirrorZ \u4e3b\u9879\u76ee\u548c\u5e2e\u52a9\u9875\u9762\u7b49\u53ef\u4ee5\u901a\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee\u7684\u9875\u9762\u90fd\u5728 <code>/var/www</code> \u4e0b\u3002</p>"},{"location":"services/mirrorz/#_2","title":"\u81ea\u52a8\u66f4\u65b0","text":"<p>\u5229\u7528 GitHub \u7684 webhook \u529f\u80fd\uff0c\u90e8\u7f72\u4e86\u4e00\u4efd iBug/uniAPI\u3002\u76f8\u5173\u6587\u4ef6\u5982\u4e0b\uff1a</p> <pre><code>/usr/bin/uniAPI\n/etc/uniAPI.yml\n/etc/systemd/system/uniAPI.service\n</code></pre> <p>\u914d\u7f6e\u6837\u4f8b\u5982\u4e0b\uff1a</p> <pre><code>services:\n  uniAPI:\n    type: server\n    services:\n      mirrorz-json-legacy:\n        type: github.webhook\n        path: /home/mirrorz/mirrorz-org/mirrorz-json-legacy\n        branch: master\n        secret: # empty\n</code></pre> <pre><code>location ^~ /uniAPI {\n    proxy_pass http://127.0.1.1:1024;\n}\n</code></pre>"},{"location":"services/neat-dns/","title":"Neat DNS","text":"<p>Services: neatdns.ustclug.org (UDP, TCP, HTTPS, DNSCrypt)</p> <p>Server: docker2</p> <p>Deploy:  docker-run-script/neatdns</p>"},{"location":"services/neat-dns/#notes","title":"Notes","text":"<p>Previously all containers on docker2 had gateway-el as their gateway, which generated heavy load on the Tinc network. Docker2 has since been updated to use gateway-nic as gateway for containers, bypassing Tinc for most of the traffic. This, however, broke NAT-based service like Neat DNS, which required that reply traffic goes back through gateway-el (but now gateway-nic).</p> <p>What's worse, Docker doesn't support setting gateways for individual containers, nor can network config be changed from within the container (default setup). So we chose to selectively route traffic back to gateway-el on gateway-nic. This is accomplished with two parts:</p> <ul> <li> <p>Routing tables and routing rules:</p> /etc/systemd/network/11-Policy.network<pre><code>[RoutingPolicyRule]\nFrom=0.0.0.0/0\nFirewallMark=0x101/0x1ff\nTable=1101  # Ustclug_override\nPriority=1\n\n[Route]\nGateway=10.254.0.254  # gateway-el\nTable=1011\n</code></pre> <p>Using iproute2 <code>ip</code> command, this would be:</p> <pre><code>ip rule add fwmark 0x101/0x1ff table Ustclug_override prio 1\nip route replace default via 10.254.0.254 table Ustclug_override\n</code></pre> </li> <li> <p>And then we select traffic to redirect to gateway-el using iptables marks:</p> iptables -t mangle -S<pre><code>-A PREROUTING -s 10.254.1.5/32 -i Policy -p tcp -m multiport --sports 53,53443 -j MARK --set-xmark 0x101/0x1ff\n-A PREROUTING -s 10.254.1.5/32 -i Policy -p udp -m multiport --sports 53,53443 -j MARK --set-xmark 0x101/0x1ff\n</code></pre> <p>These two lines of iptables rules selects replying traffic originating from the neat-dns container and marks it appropriately, so it will be routed to gateway-el instead of exiting the intranet right from gateway-nic.</p> </li> </ul>"},{"location":"services/vpn/","title":"LUG VPN","text":""},{"location":"services/vpn/#iptables","title":"iptables \u9632\u706b\u5899\u7ba1\u7406","text":"<p>\u672c\u8282\u5185\u5bb9\u9002\u7528\u4e8e\u5305\u62ec VPN \u5728\u5185\u7684\u591a\u4e2a\u670d\u52a1\u5668</p> <ul> <li>mirrors2</li> <li>mirrors4</li> <li>gateway-el</li> <li>gateway-nic</li> </ul>"},{"location":"services/vpn/#tftp-helper","title":"TFTP helper","text":"<p>\u76ee\u524d\u4ec5\u5bf9 IPv4 \u542f\u7528\u3002</p> <pre><code>*raw\n:PREROUTING ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A PREROUTING -p udp --dport 69 -j CT --helper tftp\nCOMMIT\n</code></pre> /etc/modules<pre><code>nf_conntrack_tftp\nnf_nat_tftp\n</code></pre>"},{"location":"services/vpn/#ssl-certs","title":"SSL Certificates","text":"<p>The certificate for <code>*.vpn.lug.ustc.edu.cn</code> + <code>*.vpn.ustclug.org</code> is acquired with our certificate infrastructure and the vpn server runs <code>updater.sh</code> with cron.</p> <p>Two services running in Docker (strongswan and ocserv) use the certificate, so another cron job exists to copy the certificate files into the Docker volume (<code>vpn-certs</code>). The second updater script is listed below:</p> /usr/local/docker_sh/vpn-cert-updater.sh<pre><code>#!/bin/sh\n\n# outside, call docker\nif command -v docker &gt;/dev/null 2&gt;&amp;1; then\n  exec docker run --rm \\\n    --name=vpn-cert-updater \\\n    --net=none \\\n    -v \"$(realpath \"$0\")\":/update.sh:ro \\\n    -v vpn-certs:/vpn-certs \\\n    -v /etc/ssl/private:/ssl-certs:ro \\\n    alpine \\\n    /update.sh\n  exit 1 # exec failed\nfi\n\nset -eux\n\nSSL_CERTS=\"/ssl-certs\"\nVPN_CERTS=\"/vpn-certs\"\n\ncp -p \"${SSL_CERTS}/lugvpn/fullchain.pem\" \"${VPN_CERTS}/certs/vpn.ustclug.org.crt\"\ncp -p \"${SSL_CERTS}/lugvpn/privkey.pem\" \"${VPN_CERTS}/private/vpn.ustclug.org.key\"\necho \"Cert Update Complete\"\n</code></pre>"},{"location":"services/mirrors/","title":"\u5f00\u6e90\u955c\u50cf\u7ad9","text":""},{"location":"services/mirrors/#_2","title":"\u5386\u53f2","text":""},{"location":"services/mirrors/#debianustceducn","title":"debian.ustc.edu.cn","text":"<p>2000 \u5e74\u5de6\u53f3\uff0c\u79d1\u5927\u6821\u5185\u7684 Debian \u7231\u597d\u8005\u4f7f\u7528\u81ea\u5df1\u5b9e\u9a8c\u5ba4\u7684\u673a\u5668\u4e3a\u5927\u5bb6\u63d0\u4f9b Debian \u955c\u50cf\u670d\u52a1\u3002\u968f\u7740\u4e00\u5c4a\u5c4a\u5e08\u5144\u7684\u6bd5\u4e1a\uff0c\u670d\u52a1\u5668\u5728\u5404\u5b9e\u9a8c\u5ba4\u95f4\u63a5\u529b\u3002</p> <p>2002 \u5e74 5 \u6708\uff0cDebian \u955c\u50cf\u7ad9\u6709\u4e86\u81ea\u5df1\u7684\u57df\u540d debian.ustc.edu.cn\uff0c\u4f46\u670d\u52a1\u5668\u4ecd\u5728\u5b9e\u9a8c\u5ba4\u95f4\u8f97\u8f6c\u3002</p> <p>2002 \u5e74 6 \u6708 23 \u65e5\uff0c\u79d1\u5927Debian\u955c\u50cf\u7ad9\u5f00\u59cb\u63d0\u4f9b\u975e\u5b98\u65b9(UO)\u8f6f\u4ef6\u4ed3\u5e93\u30022004\u5e744\u670823\u65e5\uff0c\u63d0\u4f9b\u65b0\u7684UO\u4ed3\u5e93\u3002</p> <p>2005 \u5e74 6 \u6708 20 \u65e5\uff0c\u79d1\u5927 LUG \u53d1\u8d77\u4e3a\u79d1\u5927 Debian \u955c\u50cf\u7ad9\u6350\u6b3e\u7684\u5021\u8bae\uff0c\u622a\u81f3 10 \u6708 1 \u65e5\u52df\u6350\u6d3b\u52a8\u505c\u6b62\uff0cLUG \u5171\u6536\u5230 2922.05 \u5143\u6350\u6b3e\u300210 \u6708 6 \u65e5\u65b0\u673a\u5668\u5b89\u88c5\u914d\u7f6e\u5230\u4f4d\u3002\u5728\u5927\u5bb6\u7684\u9f50\u5fc3\u52aa\u529b\u4e4b\u4e0b\uff0c\u79d1\u5927 Debian \u955c\u50cf\u7ad9\u6709\u4e86\u4e00\u4e2a\u76f8\u5bf9\u56fa\u5b9a\u7684\u201c\u5bb6\u201d\u3002</p> <p>2009 \u5e74\u5e95\uff0cdebian.ustc \u843d\u6237\u56fe\u4e66\u9986\u6280\u672f\u90e8\u3002</p>"},{"location":"services/mirrors/#ossustceducn","title":"oss.ustc.edu.cn","text":"<p>2008 \u5e74 12 \u6708 25 \u65e5\uff0c\u79d1\u5927\u5f00\u6e90\u8f6f\u4ef6 (OSS) \u955c\u50cf\u7ad9\u6b63\u5f0f\u542f\u7528\u3002\u5176\u670d\u52a1\u5668\u7531\u5434\u5cf0\u5149\u5e08\u5144\u63d0\u4f9b\u3002Novell \u516c\u53f8\u4e3a\u6211\u4eec\u63d0\u4f9b\u4e86\u4e00\u57571.5T \u7684\u786c\u76d8\u3002</p> <p>2009 \u5e74 12 \u6708\uff0c\u5f20\u6210\u5e08\u5144\u4e3a OSS \u955c\u50cf\u7ad9\u63d0\u4f9b\u6350\u8d60 1T \u786c\u76d8\u3002</p> <p>2010 \u5e74 6 \u6708\uff0c\u79d1\u5927 LUG \u4f7f\u7528\u51fa\u552e\u7248\u886b\u4f59\u4e0b\u7684\u94b1\u4e3a OSS \u955c\u50cf\u7ad9\u6dfb\u7f6e\u4e86\u4e00\u5757 2T \u786c\u76d8\u3002</p>"},{"location":"services/mirrors/#mirrorsustceducn","title":"mirrors.ustc.edu.cn","text":"<p>2011 \u5e74 4 \u6708 8 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\uff0c\u5e76\u7533\u8bf7\u5230\u4e86 mirrors.ustc \u7684\u57df\u540d\u3002debian.ustc \u4e0e oss.ustc \u5f00\u59cb\u5411 mirrors.ustc \u8fc1\u79fb\u3002</p> <p>\u540c\u5e74 4 \u6708 15 \u65e5\uff0c\u51e0\u5927\u70ed\u95e8\u53d1\u884c\u7248\u955c\u50cf\u540c\u6b65\u5b8c\u6bd5\uff0cmirrors \u5f00\u59cb\u6b63\u5f0f\u5bf9\u5916\u63d0\u4f9b\u670d\u52a1\uff0c\u540c\u65f6 debian.ustc \u4e0e oss.ustc \u9000\u51fa\u4e86\u5386\u53f2\u821e\u53f0\u3002</p> <p>2013 \u5e74 1 \u6708 6 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u78c1\u76d8\u9635\u5217\uff0c\u5927\u5927\u7f13\u89e3\u4e86 mirrors \u56e0\u78c1\u76d8\u7a7a\u95f4\u4e0d\u8db3\u800c\u5e26\u6765\u7684\u538b\u529b\u3002</p> <p>2016 \u5e74 12 \u6708 29 \u65e5\uff0c\u79d1\u5927 LUG \u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\u3002\u89e3\u51b3\u4e86\u8fd1\u4e00\u5e74\u6765\u7531\u4e8e\u670d\u52a1\u5668\u548c\u9635\u5217\u8001\u5316\u5e26\u6765\u7684\u7a33\u5b9a\u6027\u95ee\u9898\u3002</p> <p>2019 \u5e74 6 \u6708\uff0c\u79d1\u5927 LUG \u4ece\u56fe\u4e66\u9986\u6280\u672f\u90e8\u83b7\u5f97\u4e86\u4e00\u53f0\u65e7\u670d\u52a1\u5668\uff0c\u7f13\u89e3\u4e86 mirrors \u5bb9\u91cf\u7d27\u5f20\u7684\u95ee\u9898\u3002</p> <p>2020 \u5e74 3 \u6708 24 \u65e5\uff0c\u79d1\u5927 LUG \u518d\u6b21\u4ece\u7f51\u7edc\u4e2d\u5fc3\u5904\u83b7\u5f97\u4e86\u65b0\u7684\u670d\u52a1\u5668\uff0c\u89e3\u51b3\u4e86\u591a\u5e74\u6765\u7531\u4e8e\u670d\u52a1\u5668\u5bb9\u91cf\u4e0d\u8db3\u548c\u8d1f\u8f7d\u8fc7\u5927\u5e26\u6765\u7684\u538b\u529b\u3002</p>"},{"location":"services/mirrors/#hardware","title":"\u786c\u4ef6\u914d\u7f6e","text":"<ul> <li>2020 \u5e74\u81f3\u4eca\uff1amirrors4</li> <li>2020 \u5e74\u81f3\u4eca\uff1amirrors3</li> <li>2016 \u5e74\u81f3\u4eca\uff1amirrors2</li> <li>2011 \u5e74\u81f3 2016 \u5e74\uff1amirrors1</li> </ul>"},{"location":"services/mirrors/docker/","title":"Docker","text":""},{"location":"services/mirrors/docker/#networking","title":"Networking","text":"<p>Docker \u9ed8\u8ba4\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a bridge \u7684\u7f51\u7edc\uff0c\u4e3b\u673a\u754c\u9762\u4e3a <code>docker0</code>\uff0cIP \u5730\u5740\u6bb5\u4e3a 172.17.0.0/16\u3002\u8fd9\u4e2a\u9ed8\u8ba4\u5730\u5740\u6bb5\u8fc7\u4e8e\u6d6a\u8d39\uff0c\u56e0\u6b64\u6211\u4eec\u7ed9\u5b83\u914d\u7f6e\u4e00\u4e2a\u66f4\u5c0f\u7684\u5730\u5740\u6bb5\uff1a</p> /etc/docker/daemon.json<pre><code>{\n  \"bip\": \"172.17.0.0/22\"\n}\n</code></pre> <p>\u6211\u4eec\u5c06 Docker Registry \u7684\u53cd\u4ee3\u6302\u5728\u53e6\u5916\u4e00\u4e2a\u5b50\u7f51\u4e0b\uff0c\u9700\u8981\u5148\u884c\u521b\u5efa\u3002</p> <pre><code>docker network create \\\n  --opt com.docker.network.bridge.name=docker1 \\\n  --subnet=172.18.0.0/24 \\\n  --gateway=172.18.0.1 \\\n  docker-registry\n</code></pre>"},{"location":"services/mirrors/docker/#routing","title":"Routing","text":"<p>\u4e00\u4e9b\u540c\u6b65\u7a0b\u5e8f\u4e0d\u652f\u6301 bindIP \u7684\u914d\u7f6e\uff0c\u5bf9\u4e8e\u8fd9\u4e9b\u540c\u6b65\u7a0b\u5e8f\uff0c\u6211\u4eec\u901a\u8fc7\u521b\u5efa\u591a\u4e2a Docker network\uff0c\u7136\u540e\u5728\u4e3b\u673a\u4e0a\u6839\u636e Docker network \u8fdb\u884c\u7b56\u7565\u8def\u7531\uff0c\u8fbe\u5230\u9009\u62e9\u51fa\u53e3\u7684\u6548\u679c\u3002</p> <p>\u521b\u5efa Docker network \u7684\u547d\u4ee4\u5982\u4e0b\uff1a</p> <pre><code>docker network create --driver=bridge --subnet=172.17.4.0/24 --gateway=172.17.4.1 -o \"com.docker.network.bridge.name=dockerC\" cernet\ndocker network create --driver=bridge --subnet=172.17.5.0/24 --gateway=172.17.5.1 -o \"com.docker.network.bridge.name=dockerT\" telecom\ndocker network create --driver=bridge --subnet=172.17.6.0/24 --gateway=172.17.6.1 -o \"com.docker.network.bridge.name=dockerM\" mobile\ndocker network create --driver=bridge --subnet=172.17.7.0/24 --gateway=172.17.7.1 -o \"com.docker.network.bridge.name=dockerU\" unicom\n\ndocker network create --driver=bridge --subnet=172.17.8.0/24 --gateway=172.17.8.1 \\\n  --ipv6 --subnet=fd00:6::/64 --gateway=fd00:6::1 \\\n  -o \"com.docker.network.bridge.name=dockerC6\" cernet6\n</code></pre> <p>\u5bf9\u5e94\u5730\uff0c\u4e3b\u673a\u4e0a\u4e5f\u914d\u7f6e\u597d\u4e86\u7b56\u7565\u8def\u7531\uff0c\u4f8b\u5982\uff1a</p> /etc/systemd/network/cernet.network<pre><code># Docker Cernet\n[RoutingPolicyRule]\nFrom=172.17.4.0/24\nTable=1011\nPriority=6\n[RoutingPolicyRule]\nFrom=172.17.8.0/24\nTable=1011\nPriority=6\n</code></pre> /etc/systemd/network/telecom.network<pre><code># Docker Telecom\n[RoutingPolicyRule]\nFrom=172.17.5.0/24\nTable=1012\nPriority=6\n</code></pre> <p><code>mobile.network</code> \u548c <code>unicom.network</code> \u4e5f\u7c7b\u4f3c\u3002</p> <p>\u9700\u8981\u4f7f\u7528\u8fd9\u79cd\u65b9\u5f0f\u8fdb\u884c\u8def\u7531\u7684\u540c\u6b65\u955c\u50cf\uff0c\u53ef\u4ee5\u5728 YAML \u4e2d\u6307\u5b9a <code>network</code>\uff0c\u4f8b\u5982\uff1a</p> adoptium.yum.yaml<pre><code>network: telecom\n</code></pre>"},{"location":"services/mirrors/ipmi/","title":"IPMI","text":""},{"location":"services/mirrors/ipmi/#mirrors4","title":"Mirrors4","text":"<p>\u8fd9\u53f0\u673a\u5668\u7684 IPMI \u6709 HTML5 KVM\uff0c\u53ef\u4ee5\u76f4\u63a5\u7f51\u9875\u4f7f\u7528\uff0c\u6bd4\u8f83\u65b9\u4fbf\u3002</p>"},{"location":"services/mirrors/ipmi/#mirrors23","title":"Mirrors2/3","text":"<p>\u767b\u5f55 IPMI \u540e\uff0c\u4e3a\u4e86\u4f7f\u7528\u8fdc\u7a0b Shell\uff0c\u9700\u8981\u8fd0\u884c\u4e00\u4e2a jnlp \u6587\u4ef6\u3002 \u6b64\u6587\u4ef6\u4e0b\u8f7d\u65f6\u4f1a\u88ab Chrome \u62e6\u622a\uff0c\u9700\u8981\u989d\u5916\u5141\u8bb8\u4e00\u4e0b\u3002</p> <p>\u6b64 jnlp \u6587\u4ef6\u9700\u8981 Oracle JDK 7 \u8fd0\u884c\uff0cOpenJDK 7 \u65e0\u6cd5\u8fd0\u884c\u3002 \u6307\u4ee4\u7528 <code>javaws a.jnlp</code> \u5373\u53ef\u3002</p> <p>Java 8 \u53ca\u4e4b\u524d Java \u7684\u5404\u4e2a\u5de5\u5177\u662f\u6253\u5305\u5728 JDK \u4e2d\u7684\uff0c\u5305\u62ec Java Web Starter\uff0c\u5373\u6211\u4eec\u7528\u7684 <code>javaws</code>\u3002 \u6240\u4ee5\u53ea\u9700\u8981\u5b89\u88c5 Oracle JDK 7 \u5373\u53ef\uff0c\u65e0\u9700\u5b89\u88c5\u5176\u4ed6\u7684\u3001\u9488\u5bf9 Java 9 \u53ca\u4e4b\u540e\u7248\u672c\u7684\u5176\u4ed6\u5de5\u5177\u3002</p>"},{"location":"services/mirrors/limiter/","title":"\u9650\u5236\u7b56\u7565","text":"<p>\u7531\u4e8e mirrors \u5c5e\u4e8e I/O\u3001\u7f51\u7edc\u5bc6\u96c6\u578b\u670d\u52a1\uff0c\u5728\u90e8\u5206\u7684\u8d1f\u8f7d\u573a\u666f\u4e0b\u6781\u6613\u51fa\u73b0 I/O \u6216\u7f51\u7edc\u8fc7\u8f7d\u3002\u9650\u5236\u7b56\u7565\u4e3b\u8981\u662f\u4e3a\u4e86\u51cf\u5f31\u4ee5\u4e0b\u51e0\u7c7b\u8bf7\u6c42\u5bf9 mirrors \u6574\u4f53\u670d\u52a1\u8d28\u91cf\u7684\u5f71\u54cd\uff1a</p> <ol> <li>\u7a81\u53d1\u6027\u7684\u9ad8\u5e76\u53d1\u8bf7\u6c42</li> <li>\u722c\u866b\u7c7b\u6d41\u91cf</li> <li>\u4e0d\u5408\u7406\u7684\u8bf7\u6c42\uff08\u5982\uff1a\u6781\u5c11\u6570\u7528\u6237\u7684\u5927\u91cf\u8bf7\u6c42\uff09</li> </ol>"},{"location":"services/mirrors/limiter/#whitelists","title":"\u767d\u540d\u5355","text":"<p>\u4e00\u822c\u800c\u8a00\uff0c\u79d1\u5927\u6821\u5185\u7684\u5730\u5740\u4f4d\u4e8e\u9650\u5236\u89c4\u5219\u7684\u767d\u540d\u5355\u4e2d\uff0c\u4e0d\u53d7\u5230\u9650\u5236\u7b56\u7565\u7684\u5f71\u54cd\u3002\u5982\u679c\u6ca1\u6709\u7279\u6b8a\u8bf4\u660e\uff0c\u79d1\u5927\u5730\u5740\u9ed8\u8ba4\u4e0d\u53d7\u9650\u5236\u3002</p> <p>\u767d\u540d\u5355\u4f4d\u4e8e\uff1a</p> <ul> <li><code>/usr/local/network_config/iptables/ipset</code></li> <li><code>/etc/nginx/conf.d/geo-ustcnet.conf</code></li> </ul>"},{"location":"services/mirrors/limiter/#firewall","title":"\u9632\u706b\u5899\u7ea7\u522b\u9650\u5236","text":"<p>\u9632\u706b\u5899 (iptables) \u76ee\u524d\u53ea\u8d1f\u8d23\u9650\u5236\u5355 IP \u7684\u5e76\u53d1\u94fe\u63a5\u6570\u3002\u8fd9\u662f\u4e3a\u4e86\u9632\u6b62\u540c\u65f6\u6d8c\u5165\u5927\u91cf\u5e76\u53d1\u8fde\u63a5\uff0c\u5bfc\u81f4\u540e\u7aef\u5e94\u7528\u8017\u8d39\u5927\u91cf CPU \u548c I/O \u8d44\u6e90\u5904\u7406\u8fd9\u4e9b\u4e0d\u5408\u5e38\u7406\u7684\u8bf7\u6c42\u3002</p> \u5e8f\u53f7 \u7aef\u53e3 \u670d\u52a1 \u6700\u5927\u8fde\u63a5\u6570 IPv4 CIDR IPv6 CIDR 1 80,443 HTTP/HTTPS 12 29 64 2 20,21,50100:50200 FTP 4* 32 64 3 873 Rsync 5* 32 64 4 9418 Git 10 32 64 <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u8fde\u63a5\u6570\u9650\u5236\u4ec5\u9650\u5236\u77ac\u65f6\u5e76\u53d1\uff08connlimit\uff09\u3002</p> <p>\u8bf7\u6ce8\u610f\uff0c\u540c\u7ec4\u5185\u7684\u8fde\u63a5\u5171\u4eab\u8fde\u63a5\u6570\u914d\u989d\u3002\u5982\uff1a</p> <ul> <li>10.0.0.1 \u4e0e 10.0.0.2 \u5171\u4eab HTTP \u9650\u989d</li> <li>1.1.1.1 \u53d1\u8d77\u7684 HTTP \u4e0e HTTPS \u8fde\u63a5\u5171\u4eab 12 \u4e2a\u8fde\u63a5\u6570\u9650\u989d</li> </ul> <p>\u8d85\u8fc7\u914d\u989d\u7684\u8fde\u63a5\u4f1a\u8fd4\u56de TCP Reset\u3002</p> <p>* FTP \u670d\u52a1\u5df2\u505c\u6b62\u63d0\u4f9b\uff0cRsync \u4ec5\u4ece mirrors2 \u63d0\u4f9b\uff0cmirrors4 \u4e0a\u7684 Rsync \u7aef\u53e3\u9650\u5236\u53ea\u80fd\u4ece mirrors2 \u4e0a\u8bbf\u95ee\u3002</p>"},{"location":"services/mirrors/limiter/#application","title":"\u5e94\u7528\u7ea7\u522b\u9650\u5236","text":"<p>\u6b64\u7c7b\u9650\u5236\u89c4\u5219\u4f4d\u4e8e\u5e94\u7528\u7a0b\u5e8f\u5185\u3002\u7531\u4e8e\u5728\u7528\u6237\u6001\u7a0b\u5e8f\u4e2d\u5b9e\u73b0\uff0c\u56e0\u6b64\u66f4\u52a0\u7075\u6d3b\u3002</p>"},{"location":"services/mirrors/limiter/#nginx-mod-lua","title":"Nginx LUA \u7ec4\u4ef6","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/lua/access.lua</p> <p>\u76ee\u524d\u4f7f\u7528\u4e86 Nginx \u7684 lua \u8bed\u8a00\u6269\u5c55\u5b9e\u73b0\u5bf9\u8bf7\u6c42\u7684\u9650\u5236\u3002\u4e3b\u8981\u6709\u4ee5\u4e0b\u4e09\u7c7b\u9650\u5236\u65b9\u5f0f\uff1a</p> <ol> <li>\u6309\u8fde\u63a5\u6570\u9650\u5236\uff08\u5373\uff1a\u5e76\u53d1\u8bf7\u6c42\u6570\uff09</li> <li>\u6309\u8bf7\u6c42\u901f\u7387\u9650\u5236</li> <li>\u6309\u7d2f\u8ba1\u8bf7\u6c42\u6570\u9650\u5236\uff08\u5468\u671f\u6027\u91cd\u7f6e\u8ba1\u6570\u5668\uff09</li> </ol> <p>\u76ee\u524d\uff0c\u955c\u50cf\u7ad9\u914d\u7f6e\u4e86\u4ee5\u4e0b\u51e0\u79cd\u529f\u80fd\u7684\u9650\u5236\u5668\uff1a</p> <ol> <li>\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u6240\u6709\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u5168\u5c40\u8bf7\u6c42\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u6240\u6709\u8bf7\u6c42\uff0c\u68c0\u6d4b\u5355 IP \u5728\u4e00\u5929\u5185\u7684\u7d2f\u8ba1\u8bf7\u6c42\u6570\u3002\u8d85\u8fc7\u9608\u503c\u540e\uff0c\u964d\u4f4e\u8be5 IP \u7684\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u7684\u9608\u503c\u3002</li> <li>HEAD \u8bf7\u6c42\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e HTTP Method == HEAD \u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u68c0\u6d4b\u5355 IP \u5728\u4e00\u5929\u5185\u7684\u7d2f\u8ba1\u8bf7\u6c42\u6570\u3002\u8d85\u8fc7\u9608\u503c\u540e\uff0c\u5f00\u542f HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u3002</li> <li>HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e HTTP Method == HEAD \u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002\u8be5\u9650\u5236\u5668\u9ed8\u8ba4\u5173\u95ed\u3002</li> <li>\u65ad\u70b9\u7eed\u4f20\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u65ad\u70b9\u7eed\u4f20\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u7684\u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u65ad\u70b9\u7eed\u4f20\u8fde\u63a5\u6570\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u65ad\u70b9\u7eed\u4f20\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u5355 URI \u7684\u8fde\u63a5\u6570\u3002</li> <li>\u76ee\u5f55\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u5217\u76ee\u5f55\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355 IP \u8bf7\u6c42\u901f\u7387\u3002</li> <li>\u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\uff1a\u5bf9\u4e8e\u975e\u76ee\u5f55\u7c7b\u578b\u7684\u8bf7\u6c42\uff0c\u9650\u5236\u5355\u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u3002\u5373\uff1a\u6240\u6709\u7528\u6237\u4e4b\u95f4\u5171\u4eab\u540c\u4e00\u4e2a\u914d\u989d\u3002</li> </ol> <p>\u5907\u6ce8\uff1a</p> <ul> <li>\u4f8b\u5916\uff1a</li> <li>apt/yum \u4ed3\u5e93\u7684\u7d22\u5f15\u6587\u4ef6\u4e0d\u53d7\u9650\u5236\u3002</li> <li>AOSP \u4ed3\u5e93\u4e0d\u9650\u5236\u5168\u5c40\u8bf7\u6c42\u6570\uff08git objects \u592a\u591a\u4e86\uff0c\u7528\u6237\u53cd\u9988\u89c1  Issue 397\uff09\u3002</li> <li>\u6848\u4f8b\uff1a\u66fe\u9047\u5230\u8fc7\u653b\u51fb\u8005\u5206\u5e03\u5f0f\u8bf7\u6c42\u540c\u4e00\u4e2a\u5927\u6587\u4ef6\uff0c\u5bfc\u81f4 IO\u3001\u7f51\u7edc\u540c\u65f6\u8fc7\u8f7d\u3002\u57fa\u4e8e IP \u5730\u5740\u7684\u9650\u5236\u63aa\u65bd\u5bf9\u4e8e\u6e90\u5730\u5740\u6c60\u5f88\u5927\u7684\u653b\u51fb\u5f80\u5f80\u6ca1\u6709\u6548\u679c\uff0c\u9650\u5236\u5355\u6587\u4ef6\u7684\u8bf7\u6c42\u901f\u7387\u80fd\u591f\u6709\u6548\u7f13\u89e3\u8fd9\u7c7b\u653b\u51fb\u3002</li> </ul> <p>\u5177\u4f53\u53c2\u6570\u53c2\u8003\u4e0b\u8868\uff1a</p> \u9650\u5236\u5668\u540d\u79f0\u4e0e\u4ee3\u53f7 \u9608\u503c\u5355\u4f4d \u9608\u503c \u7a81\u53d1\u91cf \u8ba1\u6570\u5668\u91cd\u7f6e\u5468\u671f \u52a8\u4f5c \u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Main-Req</code> \u6b21/\u79d2 40 100 / \u8fd4\u56de 429 \u9519\u8bef \u5168\u5c40\u8bf7\u6c42\u6570\u9650\u5236\u5668 <code>Main-Count</code> \u6b21 15000 / 1 \u5929 \u8bbe\u7f6e\u5168\u5c40\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668\u9608\u503c\u4e3a 0.2 \u6b21/\u79d2 HEAD \u8bf7\u6c42\u6570\u9650\u5236\u5668 <code>Head-Count</code> \u6b21 300 / 1 \u5929 \u5f00\u542f HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 HEAD \u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Head-Req</code> \u6b21/\u79d2 0.05 5 / \u8fd4\u56de 429 \u9519\u8bef \u65ad\u70b9\u7eed\u4f20\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Partial-Req</code> \u6b21/\u79d2 1 10 / \u8fd4\u56de 429 \u9519\u8bef \u65ad\u70b9\u7eed\u4f20\u8fde\u63a5\u6570\u9650\u5236\u5668 <code>Partial-Conn</code> \u6761 1 0 / \u8fd4\u56de 429 \u9519\u8bef \u76ee\u5f55\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>Ls-Req</code> \u6b21/\u79d2 0.5 10 / \u8fd4\u56de 429 \u9519\u8bef \u6587\u4ef6\u8bf7\u6c42\u901f\u7387\u9650\u5236\u5668 <code>File-Req</code> \u6b21/\u79d2 5 25 / \u8fd4\u56de 429 \u9519\u8bef \u6587\u4ef6\u8bf7\u6c42\u8fde\u63a5\u6570\u9650\u5236\u5668 <code>File-Conn</code> \u6761 100 0 / \u8fd4\u56de 429 \u9519\u8bef How lua-resty-limit-traffic works <p>\u9650\u5236\u5668\u903b\u8f91\u4f7f\u7528 https://github.com/openresty/lua-resty-limit-traffic \u5b9e\u73b0\uff0c\u5176\u4e2d\u4e0a\u8868\u4ee3\u53f7\u5206\u522b\u5bf9\u5e94\u5176 <code>req</code>, <code>count</code>, <code>conn</code> \u4e09\u79cd\u5b9e\u73b0\uff0c<code>traffic</code> \u5219 aggregate \u4e86 <code>count</code> \u4e4b\u5916\u7684\u9650\u5236\u5668\uff0c\u8fd4\u56de\u6700\u5927\u7684\u5ef6\u8fdf\u3002</p> <p><code>req</code> \u7684\u6838\u5fc3\u516c\u5f0f\u662f\uff1a<code>excess = max(excess - rate * elapsed / 1000 + 1000, 0)</code>\uff0c\u5176\u4e2d\u65f6\u95f4\u5355\u4f4d\u662f\u6beb\u79d2\uff08<code>rate</code> \u548c <code>burst</code> \u53c2\u6570\u8ba1\u7b97\u65f6\u90fd\u9700\u8981\u4e58\u4ee5 1000\uff09\u3002<code>excess</code> \u4f1a\u5148\u548c <code>burst</code> \u6bd4\u8f83\uff08\u5982\u679c\u8d85\u51fa\uff0c\u5219 reject\uff09\uff0c\u5982\u679c\u6ca1\u6709\u8d85\u51fa\uff0c\u5219 delay <code>excess / rate</code> \u79d2\u3002</p> <p>\u5f53 elapsed = 1000/rate \u65f6\uff0c\u6070\u597d\u4e0d\u4f1a\u589e\u52a0 <code>excess</code> \u7684\u503c\uff0c\u6b64\u65f6 1 \u79d2\u5185\u6070\u597d\u53ef\u4ee5\u5bb9\u7eb3 rate \u4e2a\u8bf7\u6c42\uff1b\u5f53 elapsed = 1000/(rate+burst) \u65f6\uff0c<code>excess</code> \u589e\u91cf\u4e3a 1000(1-r/(r+b))\uff0c\u6b64\u65f6 1 \u79d2\u5185\u6070\u597d\u6709 (rate+burst) \u4e2a\u8bf7\u6c42\u4e0d\u4f1a\u88ab reject\u3002</p> <p>\u7406\u60f3\u60c5\u51b5\u4e0b\u7684\u4f8b\u5b50\uff1a\u5982\u679c rate = 40r/s = 40 * 1000 r/ms\uff0c\u5219 elapsed \u9700\u8981\u81f3\u5c11\u4e3a 1/40 \u79d2\uff0825 \u6beb\u79d2\uff09\uff0c\u624d\u80fd\u548c\u540e\u9762\u7684 <code>+ 1000</code> \u62b5\u6d88\uff0c\u5426\u5219 <code>excess</code> \u4f1a\u4e00\u76f4\u589e\u52a0\u3002\u5982\u679c burst = 100r/s = 100 * 1000 r/ms\uff0c\u90a3\u4e48\u5047\u8bbe\u6709\u7528\u6237\u6bcf 1/140 \u79d2\uff087.1 \u6beb\u79d2\uff09\u8bbf\u95ee\u4e00\u6b21\uff0c\u90a3\u4e48 <code>excess</code> \u6bcf\u6b21\u4f1a\u589e\u52a0 714.28\uff0c\u5982\u679c\u6709 140 \u4e2a\u8fd9\u6837\u7684\u8bf7\u6c42\uff0c\u90a3\u4e48 <code>excess</code> \u7684\u503c\u5219\u6070\u597d\u662f <code>burst</code> \u7684\u503c\u3002</p> <p><code>count</code> \u7684\u903b\u8f91\u7b80\u5355\u5f88\u591a\uff0c\u4f7f\u7528 lua-nginx-module \u5e26\u7684 https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#ngxshareddictincr \u4e3a\u6bcf\u6b21\u81ea\u589e\u8bbe\u7f6e TTL \u5373\u53ef\u3002</p> <p><code>conn</code> \u4f7f\u7528\u5b57\u5178\u8ba1\u6570\u5668\u7edf\u8ba1\u5f53\u524d\u8fde\u63a5\u6570\uff0c\u5982\u679c\u8d85\u8fc7\u4e86 <code>max + burst</code>\uff0c\u5219 reject\u3002\u5426\u5219\u5982\u679c\u8d85\u8fc7\u4e86 <code>max</code> \u5219\u5ef6\u8fdf <code>unit_delay * floor((conn - 1) / max)</code> \u79d2\u3002<code>unit_delay</code> \u8d77\u59cb\u4e3a\u7528\u6237\u7ed9\u5b9a\u7684\u503c\uff0c\u5728\u4e4b\u540e\u4f1a\u6309\u7167 <code>unit_delay = (req_latency + unit_delay) / 2</code> \u5b9a\u65f6\u8c03\u6574\u3002</p> <p>\u5230\u8fbe\u9608\u503c\u540e\u4f1a\u53d1\u751f\u4ec0\u4e48\uff1f</p> <ul> <li>\u5f53\u8bf7\u6c42\u901f\u7387\u8d85\u8fc7\u9608\u503c\uff0c\u4f46\u672a\u8d85\u8fc7\u7a81\u53d1\u91cf\u65f6\uff0c\u9650\u5236\u5668\u4f1a\u8ba1\u7b97\u51fa\u4e00\u4e2a\u6ee1\u8db3\u9608\u503c\u6761\u4ef6\u7684\u6700\u5c0f\u7b49\u5f85\u65f6\u95f4\u3002\u8fde\u63a5\u4f1a\u88ab\u4e22\u5165\u7b49\u5f85\u6c60\uff0c\u5230\u8fbe\u7b49\u5f85\u65f6\u95f4\u540e\u518d\u88ab\u5904\u7406\u3002</li> <li>\u5f53\u8bf7\u6c42\u901f\u7387\u8d85\u8fc7\u9608\u503c\uff0c\u4e14\u8d85\u8fc7\u7a81\u53d1\u8bf7\u6c42\u91cf\u65f6\uff0c\u5c06\u4f1a\u5728\u7b49\u5f85 5 \u79d2\u540e\u8fd4\u56de HTTP 429 \u9519\u8bef\u3002</li> </ul> <p>\u9650\u5236\u5668\u4e4b\u95f4\u76f8\u4e92\u72ec\u7acb\uff0c\u5f53\u88ab\u89e6\u53d1\u7684\u6240\u6709\u9650\u5236\u5668\u4ea7\u751f\u4e0d\u4e00\u81f4\u7684\u7b49\u5f85\u65f6\u95f4\u65f6\uff0c\u5e94\u7528\u6700\u957f\u7684\u7b49\u5f85\u65f6\u95f4\u3002</p>"},{"location":"services/mirrors/limiter/#large-files","title":"\u5927\u6587\u4ef6\u4e0b\u8f7d\u901f\u5ea6\u9650\u5236","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/lua/header_filter.lua</p> <p>\u9488\u5bf9\u5927\u6587\u4ef6\u4e0b\u8f7d\uff0c\u9650\u5236\u6bcf\u4e2a\u6587\u4ef6\u7684\u603b\u5e26\u5bbd\u4e3a 1Gbps\uff0c\u4ee5\u907f\u514d\u5927\u6587\u4ef6\u6d41\u91cf\u5360\u6ee1\u603b\u5e26\u5bbd\u3002</p> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u5982\u679c\u6709\u591a\u4e2a\u6587\u4ef6\u9762\u4e34\u9ad8\u538b\u529b\u8bbf\u95ee\uff0c\u603b\u5e26\u5bbd\u4f9d\u7136\u53ef\u80fd\u88ab\u5360\u6ee1</p> <p>\u5177\u4f53\u505a\u6cd5\u4e3a\uff0c\u8bbe\u7f6e\u4e0b\u8f7d\u901f\u5ea6\u9608\u503c = 1Gbps / (\u8be5\u5927\u6587\u4ef6\u7684\u540c\u65f6\u8fde\u63a5\u6570 +1)</p> <p>\u5f53\u4e0b\u8f7d\u7684\u6587\u4ef6\u65e0\u7a77\u5927\u65f6\uff0c\u5c06\u51fa\u73b0\u6700\u5dee\u60c5\u5f62\uff0c\u5373\u7528\u6237\u88ab\u5206\u914d\u5230\u7684\u4e0b\u8f7d\u901f\u7387\u670d\u4ece\u7c7b\u8c03\u548c\u7ea7\u6570\uff0c\u51fd\u6570\u53d1\u6563\u3002\u5b9e\u9645\u60c5\u51b5\u4e0b\uff0c\u65e9\u671f\u7528\u6237\u4e0b\u8f7d\u5b8c\u6210\u540e\u8fde\u63a5\u91ca\u653e\uff0c\u6700\u7ec8\u5e26\u5bbd\u5c06\u6536\u655b\u5230 1Gbps\u3002</p> <p>\u6ce8\uff1a\u5927\u6587\u4ef6\u5b9a\u4e49\u53c2\u7167\u76ee\u524d\u7684 lua \u811a\u672c\u914d\u7f6e\u3002</p>"},{"location":"services/mirrors/limiter/#nginx-js-challenge","title":"Nginx JavaScript \u6311\u6218","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/sites-available/iso.mirrors.ustc.edu.cn</p> <p>\u4e3a\u4e86\u62b5\u6297\u201c\u8fc5\u96f7\u653b\u51fb\u201d\u3002\u5bf9\u4e8e\u7279\u5b9a\u7c7b\u578b\u7684\u6587\u4ef6\uff0c\u5f00\u542f\u4e86 JS \u6311\u6218\u3002\u5982\u679c\u5ba2\u6237\u7aef User-Agent \u4e3a Mozilla\uff08\u5373\u6d4f\u89c8\u5668\uff09\uff0c\u5219\u53d1\u9001\u4e00\u6bb5\u5305\u542b JS \u811a\u672c\u7684\u9875\u9762\uff0c\u68c0\u9a8c\u8fd0\u884c\u7684\u7ed3\u679c\u3002\u5982\u679c\u6311\u6218\u5931\u8d25\uff0c\u5219\u8fd4\u56de\u9519\u8bef\u3002</p> <p>\u88ab\u4fdd\u62a4\u7684\u6587\u4ef6\u7c7b\u578b\u6709\uff1a</p> <ul> <li>iso</li> <li>exe</li> <li>dmg</li> <li>run</li> <li>zip</li> <li>tar</li> </ul>"},{"location":"services/mirrors/limiter/#robots","title":"\u722c\u866b\u9650\u5236","text":"<p>\u4ee3\u7801\u4f4d\u4e8e /etc/nginx/snippets/robots</p> <p>\u5982\u679c\u5ba2\u6237\u7aef User-Agent \u5305\u542b Spider\u3001Robot \u5173\u952e\u5b57\uff0c\u5219\u7981\u6b62\u5176\u8bbf\u95ee\u4ed3\u5e93\u5185\u5bb9\u3002\u907f\u514d\u7531\u4e8e\u9891\u7e41\u5217\u76ee\u5f55\u5e26\u6765\u5927\u91cf IO \u8d1f\u8f7d\u3002</p>"},{"location":"services/mirrors/limiter/#rsync-connections","title":"Rsync \u603b\u8fde\u63a5\u6570\u9650\u5236","text":"<p>Rsync \u670d\u52a1\u8bbe\u7f6e\u4e86\u603b\u8fde\u63a5\u6570\u9650\u5236\u3002\u5373\uff1a\u5f53\u5efa\u7acb\u7684\u8fde\u63a5\u6570\u5230\u8fbe\u67d0\u4e2a\u9608\u503c\u540e\uff0c\u62d2\u7edd\u4e4b\u540e\u6536\u5230\u7684\u8fde\u63a5\u3002</p> <p>\u5386\u53f2\u8bb0\u5f55</p> <p>\u4ee5\u524d HTTP \u548c Rsync \u670d\u52a1\u7531\u540c\u4e00\u53f0\u670d\u52a1\u5668\u63d0\u4f9b\uff0c\u7531\u4e8e\u767d\u5929 HTTP \u8bbf\u95ee\u538b\u529b\u8f83\u5927\uff0c\u591c\u665a HTTP \u8bbf\u95ee\u91cf\u8f83\u5c0f\uff0c\u4e3a\u4e86\u5b9e\u73b0\u9519\u5cf0\u540c\u6b65\uff0c\u4fdd\u8bc1\u767d\u5929 HTTP \u7684\u670d\u52a1\u8d28\u91cf\uff0c\u56e0\u6b64\u9488\u5bf9\u4e0d\u540c\u65f6\u6bb5\u8bbe\u7f6e\u4e86\u4e0d\u540c\u7684\u9608\u503c\uff0c\u5177\u4f53\u5982\u4e0b\uff1a</p> <ul> <li>23:00 ~ 8:00\uff1a\u6700\u591a 60 \u4e2a\u8fde\u63a5</li> <li>8:00 ~ 23:00\uff1a\u6700\u591a 30 \u4e2a\u8fde\u63a5</li> </ul> <p>\u5728 2020 \u5e74 8 \u6708 25 \u65e5\u540e\uff0c\u7531\u4e8e\u66f4\u6362\u4e86\u65b0\u670d\u52a1\u5668\uff0cRsync \u7531\u5355\u72ec\u673a\u5668\u63d0\u4f9b\u670d\u52a1\uff0c\u603b\u8fde\u63a5\u6570\u63d0\u5347\u5230\u4e86\u5168\u5929 60 \u4e2a\u8fde\u63a5\u3002</p> <p>\u7279\u522b\u7684\uff0c\u79d1\u5927\u6821\u5185 IP \u5730\u5740\u53d7\u5230 rsync \u8fde\u63a5\u6570\u9650\u5236\u3002</p>"},{"location":"services/mirrors/limiter/#interface-limit","title":"\u7f51\u7edc\u63a5\u53e3\u7ea7\u522b\u9650\u5236","text":"<p>mirrors \u5e38\u6001\u4e0b\u6ca1\u6709\u7f51\u7edc\u63a5\u53e3\u9650\u5236\uff0c\u4f46\u5728\u9700\u8981\u4e34\u65f6\u5bf9\u67d0\u4e00\u63a5\u53e3\u8fdb\u884c\u9650\u5236\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528 tc \u6765\u5b8c\u6210\u3002</p> <p>\u4f8b\u5982\u53ef\u4ee5\u53c2\u8003\u8fd9\u4efd\u56de\u7b54\uff1aiptables - Limiting interface bandwidth with tc under Linux - Server Fault\uff0c\u4f7f\u7528\u5982\u4e0b\u6307\u4ee4\u9650\u5236\u67d0\u4e00\u63a5\u53e3\u7684\u7f51\u7edc\u901f\u7387\u4e3a 1.5Gbps\uff1a</p> <pre><code>tc qdisc add dev &lt;interface&gt; root handle 1: tbf rate 1500Mbit burst 750K latency 14ms\n</code></pre> <p>\u8fd9\u91cc\u4f7f\u7528\u4e86 TBF\uff08\u4ee4\u724c\u6876\uff09\u7b97\u6cd5\uff0c\u540e\u9762\u7684 burst \u548c latency \u53c2\u6570\u610f\u4e49\u53ef\u4ee5\u53c2\u89c1 <code>man tc-tbf</code>\u3002 \u5177\u4f53\u800c\u8a00\uff0clatency \u6ca1\u6709\u63a8\u8350\u503c\uff0c\u4f46 burst \u8981\u6c42\u81f3\u5c11\u4e3a <code>rate / HZ</code>\uff0cHZ = 100 \u65f6 10Mbps \u81f3\u5c11\u7ea6 10MB\u3002 HZ \u7684\u503c\u9700\u8981\u4ece\u5185\u6838\u7684\u7f16\u8bd1\u53c2\u6570\u4e2d\u67e5\u770b\uff1a<code>egrep '^CONFIG_HZ_[0-9]+' /boot/config-`uname -r`</code>\u3002\u73b0\u4ee3\u53d1\u884c\u7248\u63d0\u4f9b\u7684\u5185\u6838\u4e2d\u8fd9\u4e2a\u503c\u4e00\u822c\u4e3a 250\u3002</p> <p>\u53c2\u8003\u8d44\u6599\uff1aBucket size in tbf</p> <p>\u76ee\u524d\u90e8\u7f72\u7684\u9650\u5236\u6709\uff1a</p> <ul> <li>unicom 1500Mbit\uff08\u5b66\u6821\u51fa\u53e3\u5e26\u5bbd 2 Gbps\uff09</li> <li>telecom 2500Mbit\uff08\u5b66\u6821\u51fa\u53e3\u5e26\u5bbd 5 Gbps\uff09</li> </ul> <p>\u5728 mirrors4 \u4e0a\u8be5\u914d\u7f6e\u7684\u5f00\u673a\u81ea\u542f\u5206\u522b\u4f4d\u4e8e <code>tc-unicom.service</code> \u548c <code>tc-telecom.service</code> \u4e24\u4e2a\u670d\u52a1\u4e2d\uff0c\u5176\u4e2d <code>tc-unicom.service</code> \u914d\u7f6e\u5982\u4e0b\uff1a</p> <pre><code>[Unit]\nDescription=Rate Limiting for Unicom Interface\n\n[Service]\nType=oneshot\nRemainAfterExit=true\nExecStart=/usr/sbin/tc qdisc replace dev unicom root handle 1: tbf rate 1500Mbit burst 750K latency 14ms\nExecStop=/usr/sbin/tc qdisc delete dev unicom root handle 1\n\n[Install]\nWantedBy=sys-subsystem-net-devices-unicom.device\n</code></pre> <p>Install \u90e8\u5206\u7684 WantedBy \u4f7f\u7528\u8fd9\u79cd\u5199\u6cd5\u53ef\u4ee5\u4f7f\u8be5\u670d\u52a1\u4f9d\u8d56\u4e8e\u540d\u4e3a <code>unicom</code> \u7684\u7f51\u53e3\uff0c\u8be6\u7ec6\u56de\u7b54\u53ef\u4ee5\u770b What is the systemd-networkd equivalent of post-up?\u3002</p>"},{"location":"services/mirrors/limiter/#blacklists","title":"IP \u9ed1\u540d\u5355\u9650\u5236","text":"<p>\u5bf9\u4e8e\u6ee5\u7528\u7684 IP \u6bb5\uff0c\u53ef\u4ee5\u4f7f\u7528 ipset \u548c iptables \u5b9e\u73b0\u9ed1\u540d\u5355\u9650\u5236\u3002 ipset \u5c06\u67d0\u4e2a IP \u5339\u914d\u5230\u4e00\u4e2a\u96c6\u5408\u4e2d\uff0ciptables \u518d\u9488\u5bf9\u67d0\u4e00\u96c6\u5408\u8fdb\u884c\u9650\u5236\u3002</p> <p>ipset \u548c iptables \u7684\u4f7f\u7528\u53ef\u4ee5\u53c2\u8003\uff1aIpset - Arch Wiki \u3002</p> <p>\u6211\u4eec\u5df2\u5728 mirrors4 \u4e0a\u914d\u7f6e\u4e86 <code>blacklist</code> \u548c <code>blacklist6</code> \u96c6\u5408\uff0c\u82e5\u8981\u5c01\u7981\u67d0\u4e2a IP \u6216\u7f51\u6bb5\uff0c\u53ef\u4ee5\u76f4\u63a5\u5c06\u8be5\u7f51\u6bb5\u52a0\u5165\u96c6\u5408\uff0c\u4f8b\u5982\uff1a</p> <pre><code>ipset add blacklist 192.0.2.0/24\nipset add blacklist6 2001:db8:114:514::/64\n</code></pre> <p>\u4e0e iptables \u7c7b\u4f3c\uff0cipset \u4e5f\u9700\u8981\u6301\u4e45\u5316\u3002\u5c01\u7981\u540d\u5355\u7684\u6587\u4ef6\u4f4d\u4e8e\uff08mirrors4\uff09<code>/usr/local/network_config/iptables/blacklist.list</code>\uff0c\u4fee\u6539\u6b64\u6587\u4ef6\u589e\u51cf\u6761\u76ee\u540e\u8fd0\u884c\u8be5\u76ee\u5f55\u4e0b\u7684 <code>apply.sh</code> \u5373\u53ef\u3002</p> <p>\u7531\u4e8e\u5c01\u7981\u4ec5\u5bf9\u65b0\u5efa\u7acb\u7684\u8fde\u63a5\u6709\u6548\uff0c\u8bf7\u5728\u4fee\u6539\u5c01\u7981\u540d\u5355\u540e\uff0c\u4f7f\u7528 <code>ss -K dst \u5bf9\u5e94\u7684\u7f51\u6bb5</code> \u5173\u95ed\u5df2\u7ecf\u5efa\u7acb\u7684\u8fde\u63a5\uff08\u4f8b\u5982\u5bf9\u4e8e\u4ee5\u4e0a\u4e24\u884c\u89c4\u5219\uff0c\u547d\u4ee4\u5206\u522b\u4e3a <code>ss -K dst 192.0.2.0/24</code> \u4e0e <code>ss -K dst 2001:db8:114:514::/64</code>\uff09\u3002</p>"},{"location":"services/mirrors/limiter/#ipset-persistent","title":"ipset \u6301\u4e45\u5316","text":"<p>\u6211\u4eec\u4f7f\u7528\u8f6f\u4ef6\u6e90\u91cc\u7684 <code>ipset-persistent</code> \u5305\u6765\u5e2e\u52a9 ipset \u5728\u5f00\u673a\u65f6\u81ea\u52a8\u6062\u590d\uff0c\u8be5\u8f6f\u4ef6\u5305\u4f1a\u5728\u5f00\u673a\u52a0\u8f7d iptables \u524d\u5148\u4ece <code>/etc/iptables/ipsets</code> \u4e2d\u6062\u590d ipset \u4ee5\u786e\u4fdd iptables \u4e2d\u7684\u5f15\u7528\u80fd\u6b63\u786e\u5904\u7406\u3002</p> <p>\u56e0\u4e3a ipset-persistent \u5728\u5f00\u673a\u65f6\u81ea\u52a8\u52a0\u8f7d\uff0c\u6211\u4eec\u9009\u62e9\u4ec5\u52a0\u8f7d\u4e00\u4e2a\u8f83\u5c0f\u7684\u5b50\u96c6\uff0c\u5305\u542b\u5fc5\u8981\u914d\u7f6e\uff08create set\uff09\u548c\u8f83\u5c11\u53d1\u751f\u53d8\u5316\u7684\u5185\u5bb9\uff08\u5982 ustcnet \u7684\u7f51\u6bb5\uff09\u3002\u76ee\u524d <code>/etc/iptables/ipsets</code> \u5305\u542b\u4ee5\u4e0b\u5185\u5bb9\uff1a</p> <pre><code>create ustcnet hash:net family inet hashsize 1024 maxelem 65536\ncreate f2b-sshd hash:ip family inet hashsize 1024 maxelem 65536 timeout 3600\ncreate blacklist hash:net family inet hashsize 1024 maxelem 65536\ncreate blacklist6 hash:net family inet6 hashsize 1024 maxelem 65536\n\nadd ustcnet 202.38.64.0/19\n# more ustcnet entries...\n</code></pre>"},{"location":"services/mirrors/limiter/#403","title":"403 \u9875\u9762","text":"<p>\u76ee\u524d mirrors4 \u5c06\u6765\u6e90 IP \u5c5e\u4e8e <code>blacklist</code> \u6216 <code>blacklist6</code> \u96c6\u5408\u4e14\u76ee\u6807\u7aef\u53e3\u4e3a 80 \u6216 443 \u7684\u8fde\u63a5\u91cd\u5b9a\u5411\u81f3 403 \u7aef\u53e3\u3002403 \u9875\u9762\u4f4d\u4e8e <code>/var/www/html/403.html</code>\u3002</p> <p>\u76f8\u5173 nginx \u914d\u7f6e\u4f4d\u4e8e /etc/nginx/sites-available/mirrors.ustc.edu.cn-403\u3002</p> <p>\u6211\u4eec\u4f7f\u7528 <code>ip{,6}tables</code> \u5c06\u5bf9 80 \u6216 443 \u7aef\u53e3\u7684\u8bbf\u95ee\u91cd\u5b9a\u5411\u81f3 403 \u7aef\u53e3\uff0c\u5728 <code>nat</code> \u8868\u7684 <code>PREROUTING</code> \u94fe\u6dfb\u52a0\u89c4\u5219\uff1a</p> <pre><code>-A PREROUTING -m set --match-set blacklist src -p tcp -m multiport --dports 80,443 -j REDIRECT --to-port 403\n</code></pre> <p>\u5e76\u5728 <code>filter</code> \u8868 <code>BLACKLIST</code> \u94fe\u653e\u884c\u5df2\u5efa\u7acb\u8fde\u63a5\uff0c\u5bf9 403 \u7aef\u53e3\u9650\u901f\uff1a</p> <pre><code>-A BLACKLIST -m conntrack --ctstate ESTABLISHED -j RETURN\n-A BLACKLIST -p tcp --dport 403 -m hashlimit --hashlimit-upto 60/min --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-srcmask 64 --hashlimit-name nginx-403 --hashlimit-htable-expire 60000 -j RETURN\n-A BLACKLIST -j DROP\n</code></pre>"},{"location":"services/mirrors/mail-list/","title":"Mail List","text":"<p>Warning</p> <p>This no longer works since servers.ustclug.org has been migrated to Jekyll.</p> <p>Plugin Email Subscribers &amp; Newsletters on servers.ustclug.org sends a mail to Google Group when a new article posted on mirrors catalogue.</p> <p>The mails are sent from servers@ustclug.org, which is a member of Google Group with write permission.</p> <p>Google Group: ustc-mirrors@googlegroups.com</p>"},{"location":"services/mirrors/monitor/","title":"Mirrors-specific monitoring","text":""},{"location":"services/mirrors/monitor/#connections-users-online","title":"Connections (Users online)","text":"/etc/telegraf/telegraf.d/exec.conf<pre><code>[[inputs.exec]]\n  commands = [\n    \"/opt/monitor/telegraf/connection.sh 21:80:443:873:9418\",\n    \"/opt/monitor/telegraf/nfacct.sh\",\n    \"/opt/monitor/telegraf/process.sh\",\n  ]\n  timeout = \"5s\"\n  data_format = \"influx\"\n</code></pre> /opt/monitor/telegraf/connection.sh<pre><code>#!/bin/bash\n\nport_list_input=${1//:/|}\nport_list=${port_list_input:-\"80|443\"}\nnetstat -ntW | gawk '{print tolower($6),gensub(/^(.+):([^:]+)$/,\"\\\\1 \\\\2\",\"g\",$4)}' | grep -P \" ($port_list)\\$\" | sort | uniq -c | sort -k 4 -k 3 | awk \"{printf(\\\"connection,protocol=tcp,port=%s,address=%s %s=%s\\n\\\",\\$4,\\$3,\\$2,\\$1)}\"\nnetstat -ntW | gawk '{print tolower($6),gensub(/^(.+):([^:]+)$/,\"\\\\2\",\"g\",$4)}' | grep -P \" ($port_list)\\$\" | sort | uniq -c | sort -k 3 | awk \"{printf(\\\"connection,protocol=tcp,port=%s,address=any %s=%s\\n\\\",\\$3,\\$2,\\$1)}\"\n</code></pre> /opt/monitor/telegraf/nfacct.sh<pre><code>#!/bin/bash\n\nsudo nfacct list | awk '-F[ ,;]' \"{printf(\\\"nfacct,object=%s bytes=%i,pkgs=%i\\n\\\",\\$11,\\$8,\\$4)}\"\n</code></pre> /opt/monitor/telegraf/process.sh<pre><code>#!/bin/sh\n\nps -e -o s= -o comm= |\n  grep -v '^[SI] ' |\n  sed 's|/.*$|/|g' |\n  sort | uniq -c |\n  awk '{printf(\"process,state=%s,name=%s count=%ii\\n\",$2,$3,$1)}'\n</code></pre>"},{"location":"services/mirrors/rsync/","title":"Rsync","text":""},{"location":"services/mirrors/rsync/#rsync-huai","title":"rsync-huai","text":"<p>rsync-huai \u662f\u574f\u4eba\u7684\u5143\u6570\u636e\u52a0\u901f\u7248\u7684 rsync\uff0c\u539f\u59cb\u4ee3\u7801\u5728 https://github.com/tuna/rsync\u3002</p> <p>\u7531\u4e8e TUNA \u73b0\u5728\u4f7f\u7528\u5168\u95ea\u7684\u65b9\u6848\uff0c\u4e0d\u518d\u9700\u8981\u8fd9\u4e2a patch \u4e86\uff0c\u56e0\u6b64\u6211\u4eec\u81ea\u5df1\u7ef4\u62a4\u5bf9\u5e94\u7684\u7248\u672c\uff1ahttps://github.com/ustclug/rsync/tree/rsync-3.2.7\u3002</p> <p>\u7279\u522b\u5730\uff0c<code>/etc/systemd/system/rsyncd-huai@.service</code> \u5185\u5bb9\u5982\u4e0b\uff1a</p> <pre><code>[Unit]\nDescription=fast remote file copy program daemon\nConditionPathExists=/etc/rsyncd/rsyncd-%i.conf\nAfter=network.target network-online.target\n\n[Service]\nType=simple\nPIDFile=/run/rsyncd-%i.pid\nExecStart=/usr/bin/rsync-huai --daemon --no-detach --config=/etc/rsyncd/rsyncd-%i.conf\nIOSchedulingClass=best-effort\nIOSchedulingPriority=7\nIOAccounting=true\n\n[Install]\nWantedBy=multi-user.target\n</code></pre>"},{"location":"services/mirrors/rsync/#rsync-proxy","title":"rsync-proxy","text":"<p>\u8be6\u53c2 https://github.com/ustclug/rsync-proxy\u3002\u4e3a\u4e86\u8ba9\u670d\u52a1\u5668\u80fd\u591f\u8bb0\u5f55 IP \u4e0e\u8bbf\u95ee\u8def\u5f84\u7684\u5173\u7cfb\uff0c\u6211\u4eec\u6253\u5f00\u4e86 proxy protocol \u7279\u6027\u3002</p>"},{"location":"services/mirrors/services/","title":"\u955c\u50cf\u670d\u52a1","text":""},{"location":"services/mirrors/services/#_2","title":"\u9996\u9875\u751f\u6210","text":"<p>\u955c\u50cf\u7ad9\u4e3b\u9875\u662f\u9759\u6001\u7684\uff0c\u7531 https://git.lug.ustc.edu.cn/mirrors/mirrors-index \u811a\u672c\u751f\u6210\u3002</p> <p>crontab \u4f1a\u5b9a\u65f6\u8fd0\u884c\u8be5\u811a\u672c\uff0c\u751f\u6210\u9996\u9875\u548c mirrorz \u9879\u76ee\u9700\u8981\u7684\u6570\u636e\u3002</p> <p>\u5728\u9996\u9875\u5c55\u793a\u7684\u300c\u83b7\u53d6\u5b89\u88c5\u955c\u50cf\u300d\u3001\u300c\u83b7\u53d6\u5f00\u6e90\u8f6f\u4ef6\u300d\u3001\u300c\u53cd\u5411\u4ee3\u7406\u5217\u8868\u300d\u5206\u522b\u7531 config \u5185\u914d\u7f6e\u6307\u5b9a\uff0c\u300c\u6587\u4ef6\u5217\u8868\u300d\u5185\u5bb9\u5219\u4f1a\u4ece\u540c\u6b65\u7a0b\u5e8f yuki \u7684 api \u4e2d\u83b7\u53d6\u3002</p>"},{"location":"services/mirrors/services/#http","title":"HTTP \u670d\u52a1","text":"<p>Mirrors \u4f7f\u7528 OpenResty\uff08\u4e00\u4e2a\u6253\u5305 Nginx \u548c\u4e00\u5806\u6709\u7528\u7684 Lua \u6a21\u5757\u7684\u8f6f\u4ef6\u5305\uff09\u63d0\u4f9b HTTP \u670d\u52a1\u3002</p> <p>\u914d\u7f6e\u6587\u4ef6\u4f4d\u4e8e LUG GitLab \u4e0a\uff1ahttps://git.lug.ustc.edu.cn/mirrors/nginx-config\uff0c\u6b64\u4ed3\u5e93\u5bf9\u5e94 mirrors \u4e0a\u7684 <code>/etc/nginx</code> \u76ee\u5f55\u3002</p>"},{"location":"services/mirrors/services/#_3","title":"\u8bf7\u6c42\u9650\u5236\u7b56\u7565","text":"<p>\u89c1\u9650\u5236\u7b56\u7565\u3002</p>"},{"location":"services/mirrors/services/#rsync","title":"Rsync \u670d\u52a1","text":"<p>\u672a\u5b8c\u5f85\u7eed\u3002</p>"},{"location":"services/mirrors/services/#_4","title":"\u53cd\u5411\u4ee3\u7406\u670d\u52a1","text":"<p>\u672a\u5b8c\u5f85\u7eed\u3002</p>"},{"location":"services/mirrors/services/#ftp","title":"FTP \u670d\u52a1\uff08\u5df2\u5e9f\u5f03\uff09","text":"<p>Mirrors \u66fe\u7ecf\u63d0\u4f9b FTP \u670d\u52a1\uff0c\u7531 vsftpd \u63d0\u4f9b\u3002\u5728\u5c06\u4e3b\u529b\u670d\u52a1\u5668\u4ece mirrors2 \u8fc1\u79fb\u81f3 mirrors4 \u65f6\u5e9f\u5f03\uff0c\u5373 mirrors4 \u4e0a\u4ece\u672a\u5b89\u88c5\u914d\u7f6e\u8fc7 vsftpd\uff08\u4f46 mirrors2 \u4e0a\u8fd8\u7559\u5b58\u6709\u914d\u7f6e\u6587\u4ef6\uff09\u3002</p> <p>\u7531\u4e8e\u5e74\u4ee3\u4e45\u8fdc\u4e14\u6211\u4eec\u4e0d\u518d\u6253\u7b97\u6062\u590d FTP \u670d\u52a1\uff0c\u8fd9\u90e8\u5206\u6587\u6863\u4e5f\u5c31\u5495\u5495\u5495\u4e86\u3002</p>"},{"location":"services/mirrors/zfs/","title":"ZFS","text":""},{"location":"services/mirrors/zfs/#configuration","title":"Configuration","text":""},{"location":"services/mirrors/zfs/#pool-setup-mirrors2","title":"Pool setup (mirrors2)","text":"<pre><code>zpool create pool0 \\\n  -O canmount=off \\\n  -O xattr=sa \\\n  -O relatime=on \\\n  -O compress=zstd \\\n  raidz2 \\\n  ata-HGST_HUS726060ALE610_K1GKVAAD \\\n  ata-HGST_HUS726060ALE610_K1GHTLND \\\n  ata-HGST_HUS726060ALE610_K1GHTVWD \\\n  ata-HGST_HUS726060ALE610_K1GKNJUD \\\n  ata-HGST_HUS726060ALE610_K1GK5KND \\\n  ata-HGST_HUS726060ALE610_K1GK9GXD \\\n  raidz2 \\\n  ata-HGST_HUS726060ALE610_NCH13D2V \\\n  ata-HGST_HUS726T6TALE6L4_V9KWJ1PL \\\n  ata-HGST_HUS726T6TALE6L4_V9HU810L \\\n  ata-HGST_HUS726060ALE610_NCH141WV \\\n  ata-HGST_HUS726060ALE610_K1GKPDSD \\\n  ata-HGST_HUS726T6TALE6L4_V9KTTT5L \\\n  cache nvme0n1\n</code></pre> <p>Note</p> <p>The <code>-O</code> option applies to the root dataset.</p> Create ZFS (2016) <pre><code>zpool create -f pool0 \\\n  raidz3 \\\n  ata-HGST_HUS726060ALE610_K1GHTLND \\\n  ata-HGST_HUS726060ALE610_K1GHTVWD \\\n  ata-HGST_HUS726060ALE610_K1GK5KND \\\n  ata-HGST_HUS726060ALE610_K1GK9GXD \\\n  ata-HGST_HUS726060ALE610_K1GKNJUD \\\n  ata-HGST_HUS726060ALE610_K1GKNP5D \\\n  ata-HGST_HUS726060ALE610_K1GKNR6D \\\n  ata-HGST_HUS726060ALE610_K1GKPDSD \\\n  ata-HGST_HUS726060ALE610_K1GKVAAD \\\n  ata-HGST_HUS726060ALE610_NCH04T5V \\\n  ata-HGST_HUS726060ALE610_NCH13D2V \\\n  spare \\\n  ata-HGST_HUS726060ALE610_NCH141WV \\\n  log mirror \\\n  ata-INTEL_SSDSC2BB240G6_PHWA64410400240AGN-part1 \\\n  ata-INTEL_SSDSC2BB240G6_PHWA6441041N240AGN-part1 \\\n  cache \\\n  ata-INTEL_SSDSC2BB240G6_PHWA64410400240AGN-part2 \\\n  ata-INTEL_SSDSC2BB240G6_PHWA6441041N240AGN-part2\n</code></pre>"},{"location":"services/mirrors/zfs/#zfs-kernel-module","title":"ZFS kernel module","text":"<p>For OpenZFS 2.2:</p> /etc/modprobe.d/zfs.conf<pre><code># Set ARC size to 160-200 GiB\noptions zfs zfs_arc_max=214748364800\noptions zfs zfs_arc_min=171798691840\noptions zfs zfs_arc_sys_free=17179869184\n\n# Allow up to 80% of ARC to be used for dnodes\noptions zfs zfs_arc_dnode_limit_percent=80\n\n# Allow every block to be written to ZIL\noptions zfs zfs_immediate_write_sz=16777216\n\n# See man page section \"ZFS I/O Scheduler\"\noptions zfs zfs_vdev_async_read_max_active=8\noptions zfs zfs_vdev_async_read_min_active=2\noptions zfs zfs_vdev_scrub_max_active=5\noptions zfs zfs_vdev_max_active=20000\n\n# Never throttle the ARC\noptions zfs zfs_arc_lotsfree_percent=0\n\n# Tune L2ARC\noptions zfs l2arc_headroom=8\noptions zfs l2arc_write_max=67108864\noptions zfs l2arc_noprefetch=0\n</code></pre> <p>Refer to <code>zfs(4)</code>.</p> <p>Note</p> <p><code>zfs_dmu_offset_next_sync</code> is 1 by default since OpenZFS v2.1.5, so it's omitted in the configuration.</p>"},{"location":"services/mirrors/zfs/#dataset-properties","title":"Dataset properties","text":"<p>On mirrors2:</p> <pre><code>zfs create -o compress=zstd-8 -o recordsize=1M -o atime=off pool0/backup\n\nzfs create pool0/backup/rootfs # inherit everything\nzfs create -o acltype=posix pool0/backup/oldlog\n\nzfs create \\\n  -o mountpoint=/srv/repo \\\n  -o recordsize=1M \\\n  -o xattr=off \\\n  -o atime=off \\\n  -o setuid=off \\\n  -o exec=off \\\n  -o devices=off \\\n  -o sync=disabled \\\n  -o secondarycache=metadata \\\n  -o redundant_metadata=some \\\n  pool0/repo\n</code></pre> <p>Refer to <code>zfsprops(7)</code>.</p>"},{"location":"services/mirrors/zfs/#considerations","title":"Considerations","text":"<code>mountpoint</code> <p>Self-explanatory.</p> <code>recordsize=1M</code> <p>This is the \"block size\" for ZFS, i.e. how large files are split into blocks. Each block (record) is stored contiguously on disk and is read/written as a whole.</p> <p>Since the typical read pattern on mirror sites is whole-file sequential read, it makes sense to set <code>recordsize</code> to the maximum value permitted<sup>1</sup>. Larger <code>recordsize</code> allows the compression algorithm to exploit more opportunities, while also reducing I/O count for large files.</p> <p>Note that files under a single <code>recordsize</code> will not be padded up and will be stored as a single block, so no space is wasted.</p> <code>compression=zstd</code> (inherited from <code>pool0</code>) <p>Enable compression so anything will be tried to compress. The default algorithm (i.e. <code>compression=on</code>) is LZ4, which is very fast but not as effective. Zstd is a modern multi-threaded algorithm that is also very fast but compresses better. The default compression level is 3 (i.e. <code>zstd</code> = <code>zstd-3</code>).</p> <p>Since OpenZFS 2.2, there's an \"early-abort\" mechanism for Zstd level 3 or up: Every block is first tried with LZ4, then Zstd-1, and if and only if both algorithms suggest that the data block would compress well, the actual algorithm will be applied and the compressed result will be written to disk. This early-abort mechanism ensures minimal CPU wasted for incompressible data.</p> <code>xattr=off</code> <p>Apparently mirror data do not need extended attributes.</p> <code>atime=off</code>, <code>setuid=off</code>, <code>exec=off</code>, <code>devices=off</code> <p>These simply maps to the <code>noatime</code>, <code>nosuid</code>, <code>noexec</code>, and <code>nodev</code> mount options respectively. It's safe to assume we don't need these features for mirror data.</p> <code>sync=disabled</code> <p>Disable any \"synchronous write\" semantics. This means files will not respond to <code>open(O_SYNC)</code> and <code>sync(2)</code> calls. Pending writes will only be committed to disk after <code>zfs_txg_timeout</code> seconds (default 5) or when the write buffer is full.</p> <p>While normally this is a bad idea as it goes against data integrity (namely, the \"D\" in ACID), for mirror data that can be easily regenerated, this improves write performance and reduces fragmentation (also note that <code>zfs_dmu_offset_next_sync</code> is enabled by default).</p> <code>secondarycache=metadata</code> <p>As mirrors2 only serves Rsync requests, caching file content provides little benefit. Instead, we cache metadata only to reduce the number of disk seeks.</p> <code>redundant_metadata=some</code> <p>(Just read <code>zfsprops(7)</code> and you'll be able to reason about this.)</p>"},{"location":"services/mirrors/zfs/#common-operations","title":"Common Operations","text":"Get zpool status<pre><code>zpool status\n</code></pre> Get IO status<pre><code>zpool iostat -v 1\n</code></pre> Replace Disk<pre><code>zpool replace pool0 old-disk new-disk\n</code></pre> New ZFS file system<pre><code>zfs create [-o option=value ...] &lt;filesystem&gt;\n\n# Example\nzfs create pool0/repo/debian\n</code></pre> <p>If <code>mountpoint</code> is not specified, then it's inherited from the parent with a subpath appended. E.g. when <code>pool0/example</code> is mounted on <code>/mnt/haha</code> then <code>pool0/example/test</code> will by default mount on <code>/mnt/haha/test</code>.</p> Destory ZFS file system<pre><code>zfs destroy &lt;filesystem&gt;\n\n# Example\nzfs destroy pool0/repo/debian\n</code></pre>"},{"location":"services/mirrors/zfs/#traps","title":"Traps","text":"<p>Do NOT install <code>zfs-dkms</code> and related packages from Debian backports repositories. They'll easily break when upgrading.</p> <p>As of Debian Buster the ZFS packages from the mainstream repository is stable and new enough for our use.</p> <p>\u4ecd\u7136\u5efa\u8bae\u5b89\u88c5 Backports \u7248\u672c\u7684 ZFS\u3002\u300cStable \u8d8a\u5f80\u540e\uff08\u5bf9 ZFS \u76f8\u5173\u8f6f\u4ef6\u5305\u7684\uff09\u7ef4\u62a4\u8d8a\u5f31\u300d\uff0c\u4ece\u800c\u5bfc\u81f4 stable \u7684 ZFS \u53cd\u800c\u8d28\u91cf\u4e0d\u5982 backports \u7248\u672c\u7684\u3002</p> <ol> <li> <p>Actually, there's the <code>zfs_max_recordsize</code> module parameter which can be increased to up to 16 MiB. There's a reason this is set to 1 MiB by default, so we're not going to blindly aim for the maximum.\u00a0\u21a9</p> </li> </ol>"},{"location":"services/mirrors/1/","title":"mirrors1","text":"<p>mirrors1 \u662f 2011 \u5e74\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u63d0\u4f9b\u7ed9 LUG \u7528\u4f5c\u521d\u4ee3 mirrors.ustc.edu.cn \u670d\u52a1\u7684\u673a\u5668\uff0c\u662f\u4e00\u53f0\u66d9\u5149 i620r-G</p> \u53c2\u6570 \u914d\u7f6e CPU Intel(R) Xeon(R) CPU E5620 @ 2.40GHz x 2 \u5185\u5b58 48 GB \u5b58\u50a8 LSI Logic MegaRAID SAS 8708EM2 x 2 DFT RS-3016I-S/D30 \u78c1\u76d8\u9635\u5217 \u7f51\u7edc Ethernet Intel 82574L Gigabit x 2 <p>\u7528\u6237\u624b\u518c</p> <p>\u7531\u4e8e\u672c\u6587\u7f16\u5199\u65f6\uff082020 \u5e74\uff09\u8be5\u670d\u52a1\u5668\u65e9\u5df2\u4e0d\u518d\u7528\u4f5c mirrors\uff08\u73b0\u5728\u662f esxi-5\uff09\uff0c\u56e0\u6b64\u66f4\u591a\u7684\u4fe1\u606f\u6682\u65e0\u4ece\u8003\u5bdf\u3002</p>"},{"location":"services/mirrors/2/","title":"mirrors2","text":"<p>2016 \u5e74\u5e95\u4ece\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u83b7\u5f97\u7684\u65b0\u673a\u5668\uff0c\u8fd0\u884c\u81f3\u4eca\uff0c\u627f\u62c5\u4e86\u76ee\u524d mirrors \u7684 rsync \u6d41\u91cf\u3002</p> \u53c2\u6570 \u914d\u7f6e CPU \u53cc\u8def E5-2620 v4 \u5185\u5b58 256 GB DDR4 \u5b58\u50a8 6 TB * 12 (HDD), 250 GB *2 (SSD) \u7f51\u7edc 1 Gbps * 2 <p>\u66d9\u5149 I620-G20 \u5bfc\u822a\u5149\u76d8</p>"},{"location":"services/mirrors/2/#networking","title":"Networking","text":"<p>mirrors2 \u4e0a\u7684\u7f51\u7edc\u914d\u7f6e\u81ea 2024-07-19 \u7ef4\u62a4\u540e\u4e5f\u5207\u6362\u5230\u4e86 systemd-networkd \u65b9\u6848\uff0c\u6587\u6863\u53ef\u4ee5\u53c2\u8003 mirrors4\u3002</p> Old info <p>mirrors2 \u4e0a\u7684\u7f51\u7edc\u4f7f\u7528\u9ed8\u8ba4\u7684 ifupdown \u914d\u7f6e\u3002</p> <p>\u5728 <code>/etc/network/interfaces.d</code> \u4e2d\u5b58\u653e\u7740\u63a5\u53e3\u914d\u7f6e\uff0c\u4f7f\u7528 <code>ifup</code>/<code>ifdown</code> \u6765\u542f\u7528/\u505c\u7528\u67d0\u4e00\u63a5\u53e3\u3002</p> <p>\u91cd\u542f\u6240\u6709\u7f51\u7edc\u63a5\u53e3</p> <p>\u5728\u67d0\u6b21 mirrors2 \u79bb\u7ebf\u6545\u969c\u4e2d\uff0c\u8bef\u64cd\u4f5c\u7684 <code>systemctl restart networking</code> \u8fd4\u56de\u4e86\u5931\u8d25\u7684\u7ed3\u679c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86 mirrors2 \u4ece\u67d0\u4e00\u7f51\u7edc\u63a5\u53e3\u65ad\u5f00\uff08\u731c\u6d4b\uff09\uff08\u5b9e\u9645\u539f\u56e0\u89c1\u4e0b\uff09\uff0c\u91cd\u542f\u6240\u6709\u63a5\u53e3\u4fee\u590d\u4e86\u95ee\u9898\uff1a<code>ifdown -a &amp;&amp; ifup -a</code></p> <p>\u5b9e\u9645\u539f\u56e0\u662f bridge interface \u8fde\u63a5\u7684\u90a3\u4e2a interface \u5728 ifupdown \u7684 config \u91cc\u7684\u914d\u7f6e\u65b9\u5f0f\u662f <code>static</code> \u7684\uff0c\u5728\u542f\u7528 bridge interface \u65f6\u4f1a\u81ea\u52a8\u66f4\u6539\u914d\u7f6e\u5bfc\u81f4 offline\u3002\u6539\u6210 <code>manual</code> \u7981\u6b62\u5b83\u7684\u81ea\u52a8\u884c\u4e3a\u4e4b\u540e\u5c31\u6ca1\u4e8b\u4e86\u3002</p>"},{"location":"services/mirrors/3/","title":"mirrors3","text":"<p>2020 \u5e74\u521d\u4ece\u56fe\u4e66\u9986\u6280\u672f\u90e8\u83b7\u5f97\u7684\u4e00\u53f0\u65e7\u670d\u52a1\u5668\uff0c\u4e3a\u6234\u5c14 PowerEdge R510\uff0c\u8d1f\u8f7d\u6bd4\u8f83\u6742\u4e71,\u4e3b\u8981\u662f\u4e00\u4e9b\u65e2\u51b7\u95e8\u53c8\u5927\u7684\u4ed3\u5e93\u7684 HTTP + rsync \u6d41\u91cf\u3002</p> \u53c2\u6570 \u914d\u7f6e CPU \u53cc\u8def\u81f3\u5f3a E5620 \u5185\u5b58 32 GB DDR3 \u5b58\u50a8 1 TB*2 (HDD), 2 TB*5 (HDD), 3 TB*1 (HDD)  1 TB (SAS HDD), 1.8 TB * 3 (SATA HDD), 1 TB (SATA HDD)  \u540c\u53cb iSCSI \u9635\u5217\uff0c4 TB * 16 (HDD) \u7f51\u7edc 1 Gbps * 2 <p>\u5b58\u50a8\u7ed3\u6784\uff1a</p> <p>\u6ce8\u610f\u4e8b\u9879</p> <p>\u7531\u4e8e PERC 6/i \u9635\u5217\u5361\u7684\u9650\u5236\uff0c\u7269\u7406\u78c1\u76d8\u5927\u5c0f\u6700\u5927\u652f\u6301 2TB\uff08SAS 4TB \u76d8\u65e0\u6cd5\u8bc6\u522b\u5927\u5c0f\uff09\u3002\u5728\u5c06 SAS \u574f\u76d8\u79fb\u9664\u540e\uff0c\u76ee\u524d\uff082022/5/10\uff09rootfs VD \u5904\u4e8e degraded \u72b6\u6001\u3002</p> <p>PERC H700 \u9635\u5217\u5361\u7531\u4e8e\u7f3a\u5c11\u4e24\u6839 SAS \u8f6c\u63a5\u7ebf\uff0c\u5e76\u4e14 mirrors3 \u673a\u67b6\u524d\u53f3\u4fa7\u8f68\u9053\u5904\u65e0\u6cd5\u89e3\u9664\u9501\u5b9a\uff0c\u4e14\u66f4\u6362\u9635\u5217\u5361\u9700\u8981\u5c06\u5176\u4ed6\u6269\u5c55\u5361\u5168\u90e8\u79fb\u9664\uff08\u53c2\u89c1 PowerEdge R510 \u786c\u4ef6\u7528\u6237\u624b\u518c\uff09\uff0c\u7ed9\u65b0\u9635\u5217\u5361\u5b89\u88c5\u5e26\u6765\u4e86\u5f88\u5927\u7684\u96be\u5ea6\u3002</p> 1 TB * 2 <p>\u4f4d\u4e8e\u673a\u8eab\uff0c\u7ec4\u6210 RAID1 \u5b89\u88c5\u64cd\u4f5c\u7cfb\u7edf\uff0c\u6302\u8f7d\u4e3a rootfs</p> 2 TB * 5 + 3 TB * 1 <p>\u540c\u6837\u4f4d\u4e8e\u673a\u8eab\uff0c\u7ec4\u6210 RAID6 \u5b58\u653e\u8d44\u6599\uff08\u6240\u4ee5\u552f\u4e00\u4e00\u5757 3 TB \u7684\u786c\u76d8\u5b9e\u9645\u4e0a\u5f53\u505a 2 TB \u7684\u6765\u7528\uff09</p> \u5916\u90e8\u9635\u5217\uff0c4 TB * 16 <p>\u901a\u8fc7 SFP+ \u5149\u7ea4\u6302\u8f7d\u4e3a iSCSI \u8bbe\u5907\uff0c\u5206\u4e3a\u4e24\u7ec4 RAID60\uff08\u53ef\u7528\u5bb9\u91cf\u4e3a 12 \u5757\u76d8\uff09\u5b58\u50a8\u8d44\u6599</p>"},{"location":"services/mirrors/4/","title":"mirrors4","text":"<p>mirrors4 \u662f 2020 \u5e74 3 \u6708 24 \u65e5\u7f51\u7edc\u4fe1\u606f\u4e2d\u5fc3\u63d0\u4f9b\u7ed9 LUG \u7684\u65b0\u673a\u5668\uff0c\u662f\u4e00\u53f0\u6d6a\u6f6e NF5280M5\u3002</p>"},{"location":"services/mirrors/4/#_1","title":"\u786c\u4ef6\u914d\u7f6e","text":"CPU <p>\u53cc\u8def Intel Xeon Gold 6230</p> \u5185\u5b58 <p>256 GB DDR4 2933 (8 * 32 GB SKHynix)</p> \u786c\u76d8 <p>\u4e00\u5757\u4e09\u661f PM883 2TB</p> <p>12 \u5757 HGST HUH721010AL (10 TB)</p> <p>\u4e24\u4e2a\u786c\u76d8\u63a7\u5236\u5668 MegaRAID SAS-3 3108</p> <p>\u786c\u76d8\u63a7\u5236\u5668</p> <p>\u7531\u4e8e\u4e0d\u80fd\u8de8\u63a7\u5236\u5668\u7ec4 RAID \u6216 LUN\uff0c\u4e14\u6bcf\u4e2a\u63a7\u5236\u5668\u53ea\u6709 8 \u4e2a\u63d2\u69fd\uff0c\u56e0\u6b64\u5c06 12 \u5757 HDD \u5206\u4e3a 6 \u5757\u4e00\u7ec4\u63d2\u5728\u4e24\u4e2a\u63a7\u5236\u5668\u4e0a\u7ec4\u6210 RAID6\uff0c\u4ee5\u4e24\u4e2a\u903b\u8f91\u5377\u5448\u73b0\u7ed9\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4e0a\u5c42\u7528 LVM \u5904\u7406\u3002SSD \u5355\u72ec\u521b\u5efa\u4e00\u4e2a\u903b\u8f91\u5377\u7ed9\u64cd\u4f5c\u7cfb\u7edf\u3002</p> \u7f51\u5361 <p>\u677f\u8f7d Intel X722 GbE (4 \u4e2a\u5343\u5146\u7f51\u53e3)</p> <p>PCI-e \u6269\u5c55\u5361\uff1aIntel X520 (82599ES) SFP+ (2 \u4e2a\u4e07\u5146\u5149\u53e3)</p>"},{"location":"services/mirrors/4/repos/","title":"Repositories","text":"<p>mirrors4 \u4e0a\u7684\u4ed3\u5e93\u548c mirrors2/3 \u4e00\u6837\uff0c\u4f4d\u4e8e <code>/srv/repo</code>\u3002\u4ed3\u5e93\u5bb9\u91cf\u4f7f\u7528 XFS \u7684 quota \u529f\u80fd\u76d1\u89c6\u3002</p> <p>Todo</p> <p>\u9700\u8981\u8c03\u7814\uff1a\u5feb\u901f\u5220\u9664\u4ed3\u5e93\u4e0e\u91cd\u547d\u540d\u4ed3\u5e93 (mv \u548c rm \u53ef\u80fd\u592a\u6162\u4e86)</p>"},{"location":"services/mirrors/4/repos/#_1","title":"\u6dfb\u52a0\u4e00\u4e2a\u65b0\u4ed3\u5e93","text":""},{"location":"services/mirrors/4/repos/#_2","title":"\u521b\u5efa\u76ee\u5f55","text":"<p>\u5728 <code>/srv/repo/</code> \u4e0b\u521b\u5efa\u5bf9\u5e94\u7684\u76ee\u5f55\u3002\u6ce8\u610f\u5bf9\u5e94\u76ee\u5f55\u7684\u6240\u6709\u8005\u548c\u6240\u6709\u7ec4\u5747\u5e94\u8be5\u662f <code>mirror</code>\u3002</p> <pre><code>chown mirror: /srv/repo/example\n</code></pre>"},{"location":"services/mirrors/4/repos/#xfs-project","title":"\u521b\u5efa XFS project","text":"<p>\u4e3a\u65b0\u4ed3\u5e93\u521b\u5efa XFS quota \u4ee5\u4fbf\u4e8e\u76d1\u89c6\u5bb9\u91cf\u3002\u9996\u5148\u68c0\u67e5 <code>/etc/projects</code> \u548c <code>/etc/projid</code>\uff0c\u627e\u5230\u5927\u4e8e 1000 \u7684 ID \u5e8f\u5217\uff0c\u627e\u51fa\u4e0b\u4e00\u4e2a ID\uff08\u4f8b\u5982 1111\uff0c\u4e0b\u9762\u4f7f\u7528\u8fd9\u4e2a\u4f5c\u4e3a\u4f8b\u5b50\uff09\u3002</p> <pre><code>mkdir /srv/repo/example\n</code></pre> <p>\u7f16\u8f91 <code>/etc/projects</code>\uff0c\u52a0\u5165\u5982\u4e0b\u4e00\u884c</p> <pre><code>1111:/srv/repo/example\n</code></pre> <p>\u7136\u540e\u6267\u884c\uff1a</p> <pre><code>xfs_quota -x -c 'project -s 1111'\n</code></pre> <p>\u7f16\u8f91 <code>/etc/projid</code>\uff0c\u52a0\u5165\u5982\u4e0b\u4e00\u884c</p> <pre><code>example:1111\n</code></pre> <p>\u4fe1\u606f</p> <p>\u6211\u4eec\u7684\u955c\u50cf\u7ba1\u7406\u5668 Yuki \u6839\u636e\u955c\u50cf\u76ee\u5f55\u7684\u6700\u540e\u4e00\u6bb5\u540d\u79f0\uff08\u5373 basename\uff09\u6765\u4ece XFS \u4e2d\u83b7\u53d6\u5bb9\u91cf\u4fe1\u606f\uff0c\u56e0\u6b64 <code>/etc/projid</code> \u6587\u4ef6\u5185\u5bb9\u6b63\u786e\u624d\u80fd\u4f7f Yuki \u5f97\u5230\u6b63\u786e\u7684\u5bb9\u91cf\u3002</p>"},{"location":"services/mirrors/4/repos/#_3","title":"\u4fbf\u6377\u914d\u7f6e\u811a\u672c","text":"<pre><code>#!/bin/bash\n\n# Determine largest project ID\nnext_id() {\n  local PROJID=$(cut -d':' -f1 /etc/projects | sort -n | tail -1)\n  echo $((++PROJID))\n}\n\nBASE=\"/srv/repo\"\nreadonly BASE\n\nif [ \"$1\" = \"-m\" ]; then\n  MKDIR=yes\n  shift\nfi\n\nwhile [ $# -ne 0 ]; do\n  N=\"${1//\\//}\"\n  shift\n  if grep -q \"$BASE/$N\\$\" /etc/projects; then\n    echo \"Repo $N exists, skipped.\" &gt;&amp;2\n    continue\n  fi\n\n  if [ ! -e \"$BASE/$N\" ]; then\n    if [ -n \"$MKDIR\" ]; then\n      echo \"Path $BASE/$N does not exist, creating directory.\" &gt;&amp;2\n      mkdir -p \"$BASE/$N\"\n    else\n      echo \"Path $BASE/$N does not exist, ignored.\" &gt;&amp;2\n      continue\n    fi\n  elif [ ! -d \"$BASE/$N\" ]; then\n    echo \"Path $BASE/$N is not a directory, ignored.\" &gt;&amp;2\n    continue\n  fi\n\n  ID=\"$(next_id)\"\n  echo \"$ID:$BASE/$N\" &gt;&gt; /etc/projects\n  echo \"$N:$ID\" &gt;&gt; /etc/projid\n  xfs_quota -x -c \"project -s $ID\" &amp;&gt;/dev/null\n  echo \"Added $N (ID $ID)\"\ndone\n</code></pre>"},{"location":"services/mirrors/4/repos/#_4","title":"\u6dfb\u52a0\u540c\u6b65\u914d\u7f6e","text":"<p>\u7167\u7740 <code>/home/mirror/repos</code> \u4e0b\u7684\u73b0\u6709\u6587\u4ef6\u81ea\u5df1\u7814\u7a76\u4e00\u4e0b\u5427\uff0c\u8fd9\u4e2a\u4e0d\u96be\u3002\u9700\u8981\u6ce8\u610f\u7684\u5c31\u4e00\u70b9\uff0c\u6587\u4ef6\u540d\u7ed3\u5c3e\u5fc5\u987b\u662f <code>.yaml</code>\uff08\u800c\u4e0d\u80fd\u662f <code>.yml</code>\uff09\uff0c\u8fd9\u662f Yuki \u4ee3\u7801\u91cc\u5199\u7684\u3002</p> <p>\u51b3\u5b9a <code>bindIP</code> \u6216 <code>network</code> \u7684\u503c</p> <p>\u955c\u50cf\u7ad9\u6709\u591a\u4e2a\u6765\u81ea\u4e0d\u540c\u8fd0\u8425\u5546\u7684 IP \u53ef\u7528\u4e8e\u540c\u6b65\u4efb\u52a1\u3002\u7531\u4e8e\u7f51\u7edc\u73af\u5883\u7684\u4e0d\u786e\u5b9a\u6027\uff0c\u6709\u65f6\u4f1a\u51fa\u73b0\u67d0\u4e2a IP \u540c\u6b65\u901f\u5ea6\u6781\u6162\u7684\u60c5\u51b5\u3002</p> <p>@taoky \u7684 admirror-speedtest \u53ef\u4ee5\u5e2e\u52a9\u51b3\u5b9a\u6700\u5feb\u901f\u7684 IP\u3002</p> <p>\u53e6\u5916\uff0c<code>bindIP</code> \u4e0d\u9002\u7528\u4e8e\u6240\u6709\u7684\u540c\u6b65\u955c\u50cf\uff08\u4e00\u90e8\u5206\u7a0b\u5e8f\u4e0d\u652f\u6301\u4fee\u6539 <code>bind()</code> \u7684\u53c2\u6570\uff09\uff0c\u6b64\u65f6\u53ef\u4ee5\u4f7f\u7528\u57fa\u4e8e Docker Network \u7684 <code>network</code> \u914d\u7f6e\u3002</p> <p>\u5199\u597d\u65b0\u4ed3\u5e93\u7684\u914d\u7f6e\u6587\u4ef6\u4e4b\u540e\u8fd0\u884c <code>yuki reload</code>\uff0c\u7136\u540e <code>yuki sync &lt;repo&gt;</code> \u5c31\u53ef\u4ee5\u5f00\u59cb\u521d\u6b21\u540c\u6b65\u4e86\u3002</p>"},{"location":"services/mirrors/4/repos/#git-srvgit","title":"\u4e3a Git \u7c7b\u578b\u4ed3\u5e93\u6dfb\u52a0\u8f6f\u94fe\u63a5\u81f3 <code>/srv/git</code>","text":"<p><code>git-daemon.service</code> \u6839\u636e <code>/srv/git</code> \u4e0b\u7684\u5185\u5bb9\u5bf9\u5916\u63d0\u4f9b Git \u670d\u52a1\u3002\u6240\u4ee5\u5982\u679c\u662f git \u7c7b\u578b\u7684\u4ed3\u5e93\uff0c\u9700\u8981\u6dfb\u52a0\u8f6f\u94fe\u63a5\uff0c\u5426\u5219\u65e0\u6cd5\u4f7f\u7528 <code>git://</code> \u7684\u534f\u8bae\u8bbf\u95ee\u3002\uff08<code>http(s)://</code> \u534f\u8bae\u6ca1\u6709\u95ee\u9898\uff09</p> <p>Git \u4ed3\u5e93\u670d\u52a1\u7684\u5176\u4ed6\u76f8\u5173\u914d\u7f6e</p> <p>\u90e8\u5206\u514b\u9686\u914d\u7f6e (See https://github.com/ustclug/discussions/issues/432)\uff1a</p> /etc/gitconfig<pre><code>[uploadpack]\n    allowfilter = true\n</code></pre>"},{"location":"services/mirrors/4/repos/#quota","title":"\u67e5\u770b quota \u60c5\u51b5","text":"<p>\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\uff1a</p> <pre><code>xfs_quota -c 'df -h'\n</code></pre>"},{"location":"services/mirrors/4/repos/#_5","title":"\u79fb\u52a8\uff08\u5220\u9664\uff09\u4e00\u4e2a\u4ed3\u5e93","text":"<p>\u4ee5\u4e0b\u4ee5 2023 \u5e74 12 \u6708 27 \u65e5\u5c06 <code>.private/sb</code> \u79fb\u52a8\u5230 <code>sb</code> \u7684\u64cd\u4f5c\u4e3a\u4f8b\u5b50\uff0c\u4ecb\u7ecd\u6211\u4eec\u9700\u8981\u505a\u7684\u4e8b\u60c5\u3002</p>"},{"location":"services/mirrors/4/repos/#sb","title":"\u521b\u5efa <code>sb</code> \u76ee\u5f55","text":"<p>\u53c2\u8003\u4e0a\u6587\uff0c\u521b\u5efa\u76ee\u5f55\uff0c\u4fee\u6539 <code>/etc/projects</code> \u7684\u8def\u5f84\uff08ID \u4e0d\u9700\u8981\u4fee\u6539\uff09\uff0c\u7136\u540e\u6267\u884c\u4e0a\u6587\u5bf9\u5e94\u7684 <code>xfs_quota</code> \u547d\u4ee4\u3002</p> <p>\u7531\u4e8e\u6211\u4eec\u7684\u4f8b\u5b50\u662f\u79fb\u52a8\u76ee\u5f55\uff0c\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528 <code>mv</code> \u547d\u4ee4\uff08<code>sb</code> \u4ed3\u5e93\u5f88\u5c0f\uff09\u3002</p>"},{"location":"services/mirrors/4/repos/#yuki","title":"\u4fee\u6539 Yuki \u914d\u7f6e","text":"<p>\u4fee\u6539 <code>/home/mirror/repos/sb.yaml</code>\uff0c\u5c06 <code>path</code> \u4fee\u6539\u4e3a <code>/srv/repo/sb</code>\u3002\u7136\u540e\u91cd\u65b0\u52a0\u8f7d\uff1a</p> <pre><code>yukictl reload sb\n</code></pre>"},{"location":"services/mirrors/4/repos/#rsync-attrs","title":"\u6d4b\u8bd5\u540c\u6b65\uff0c\u5e76\u5220\u9664 rsync-attrs \u4e2d\u7684\u65e7\u76ee\u5f55","text":"<pre><code>yukictl sync --debug sb\n</code></pre> <p>\u786e\u8ba4\u540c\u6b65\u65e0\u8bef\u540e\uff0c\u68c0\u67e5 <code>/srv/rsync-attrs</code> \u7684\u5185\u5bb9\uff0c\u5e76\u5220\u9664\u65e7\u76ee\u5f55 <code>/srv/rsync-attrs/.private</code>\u3002</p> <p>/srv/rsync-attrs</p> <p>\u8be5\u76ee\u5f55\u7684\u7528\u9014\u662f\u4e3a\u574f\u4eba\u4fee\u6539\u7248\u7684 rsyncd\uff08\u5373 rsyncd-huai\uff09\u63d0\u4f9b\u5feb\u901f\u7684\u6587\u4ef6\u5c5e\u6027\u67e5\u8be2\uff08\u5bf9\u5e94\u4f7f\u7528 Reiserfs \u683c\u5f0f\u5316\uff0c\u6302\u8f7d\u5728 SSD \u4e0a\uff09\u3002 \u540c\u65f6\u8be5\u76ee\u5f55\u4e5f\u7528\u4e8e\u4e3b\u9875\u751f\u6210\u3002</p>"},{"location":"services/mirrors/4/repos/#nginx","title":"\u4fee\u6539 nginx \u914d\u7f6e","text":"<p>\u7531\u4e8e\u6211\u4eec\u8fd9\u91cc\u662f\u79fb\u52a8\u4ed3\u5e93\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u65e7\u7528\u6237\u80fd\u591f\u6b63\u5e38\u4f7f\u7528\uff0c\u9700\u8981\u4fee\u6539 nginx \u914d\u7f6e\uff0c\u5c06\u65e7\u7684\u8def\u5f84\u91cd\u5b9a\u5411\u5230\u65b0\u7684\u8def\u5f84\u3002</p> <p>\u76f8\u5173\u7684\u914d\u7f6e\u4e00\u822c\u4f4d\u4e8e <code>/etc/nginx/snippets/mirrors-locations</code>\uff0c\u672c\u6b21\u6211\u4eec\u65b0\u589e\u7684\u5185\u5bb9\u5982\u4e0b\uff1a</p> <pre><code>location /.private/sb/ {\n    rewrite ^/.private(/sb/.*$) $1 permanent;\n}\n</code></pre> <p>Nginx rewrite \u76f8\u5173\u7684\u8bed\u6cd5\u77e5\u8bc6\u9700\u8bfb\u8005\u81ea\u884c\u5b66\u4e60\u3002</p> <p>\u4fee\u6539\u5b8c\u6210\u540e\uff0c\u91cd\u8f7d\u914d\u7f6e\uff1a</p> <pre><code>nginx -t\nnginx -s reload  # \u6216\u8005 systemctl reload nginx\n</code></pre> <p>\u5e76\u4e14 commit \u6709\u5173\u4fee\u6539\uff1a</p> <pre><code>git -c user.name=\u4f60\u7684\u540d\u5b57 -c user.email=\u4f60\u7684\u90ae\u7bb1 commit -m \"...\"\n</code></pre>"},{"location":"services/mirrors/4/repos/#rsync-proxy-rsyncd","title":"\u4fee\u6539 rsync-proxy \u4e0e rsyncd \u914d\u7f6e","text":"<p>rsync-proxy \u4e3a\u8fd1\u5e74\u6765\u6211\u4eec\u81ea\u884c\u7f16\u5199\u7684 rsync \u53cd\u5411\u4ee3\u7406\u670d\u52a1\u3002 \u4fee\u6539\u4e86 <code>/etc/rsync-proxy/config.toml</code>\uff0c\u5220\u9664 mirrors2 \u4e2d\u7684 <code>\".private\"</code> \u9879\uff0c\u5728 mirrors4 \u4e2d\u65b0\u589e <code>\"sb\"</code> \u9879\u3002</p> <p>\u56e0\u4e3a rsync-proxy \u6700\u7ec8\u8fd8\u9700\u8981\u8fde\u63a5\u5230\u540e\u7aef\u7684 rsyncd\uff0c\u56e0\u6b64 mirrors4 \u7684 rsyncd \u914d\u7f6e\u4e5f\u9700\u8981\u4fee\u6539\u3002 \u5728 <code>/etc/rsyncd</code> \u4e0b\u6267\u884c <code>python common_generator.py --write</code> \u5199\u5165\u914d\u7f6e\uff0c\u4f7f\u7528 <code>git diff</code> \u68c0\u67e5\u65e0\u8bef\u540e <code>git commit</code>\u3002 rsyncd \u914d\u7f6e\u4e2d\u5305\u542b\u4e0d\u516c\u5f00 rsync \u7684\u5185\u5bb9\uff08\u5982 git \u76ee\u5f55\uff09\u4e0d\u4f1a\u5bfc\u81f4\u95ee\u9898\uff0c\u56e0\u4e3a\u6240\u6709\u7528\u6237\u63a5\u89e6\u5230\u7684\u90fd\u662f rsync-proxy\u3002</p> <p>\u786e\u8ba4\u540e\u91cd\u8f7d rsync-proxy:</p> <pre><code>systemctl reload rsync-proxy\n</code></pre> <p>Rsyncd \u4e0d\u9700\u8981\u91cd\u8f7d\uff1a\u6bcf\u4e2a\u6709\u6548\u8fde\u63a5\u4f1a\u542f\u52a8\u65b0\u8fdb\u7a0b\uff0c\u800c\u65b0\u8fdb\u7a0b\u4f1a\u91cd\u65b0\u8bfb\u53d6\u914d\u7f6e\u3002</p>"},{"location":"services/mirrors/4/repos/#mirrors2","title":"\u5220\u9664 mirrors2 \u4e0a\u7684\u4ed3\u5e93\u4e0e\u76f8\u5173\u9879","text":"<p>\u6267\u884c <code>yukictl rm sb</code>\uff0c\u7136\u540e\u5220\u9664 Yuki \u540c\u6b65\u914d\u7f6e\uff08<code>~mirror/repos-etc/sb.yaml</code>\uff09\uff0c\u540c\u6837\u4e5f\u9700\u8981 git commit\u3002</p> <p>\u4e4b\u540e\u5220\u9664\u5b58\u50a8\u7684\u5185\u5bb9\uff1a\u6267\u884c <code>/sbin/zfs list</code> \u786e\u8ba4\u8981\u4e0b\u624b\u5220\u9664\u7684\u5b58\u50a8\u6c60\uff0c\u7136\u540e <code>sudo zfs destroy pool0/repo/\u5bf9\u5e94\u7684\u540d\u5b57</code> \u5220\u9664\u3002</p> <p>\u540c\u6837\uff0c<code>/srv/rsync-attrs/.private</code> \u7684\u5185\u5bb9\u4e5f\u9700\u8981\u5220\u9664\u3002</p>"},{"location":"services/mirrors/4/repos/#git-push","title":"\u5173\u4e8e git push","text":"<p>\u76ee\u524d\u914d\u7f6e\u7684 git push \u6bd4\u8f83\u9ebb\u70e6\uff1a\u9700\u8981\u7528\u6237\u5728 USTCLUG GitLab \u4e0a\u4e3a\u81ea\u5df1\u521b\u5efa\u4e00\u4e2a Access Token\uff0c\u7136\u540e\u6bcf\u6b21 git push \u65f6\u8f93\u5165\u5bc6\u7801\u3002</p> <p>\u6211\u4eec\u6709\u8ba1\u5212\u6539\u8fdb\u8fd9\u4e00\u70b9\uff1a\u4e3a\u6bcf\u4e2a\u4ed3\u5e93\u521b\u5efa\u4e00\u4e2a ssh key\uff0c\u4fee\u6539 git config\uff0c\u7136\u540e\u4e3a\u5728 USTCLUG GitLab \u4e0a\u4e3a\u5bf9\u5e94\u4ed3\u5e93\u65b0\u589e deploy key\uff0c\u8fd9\u6837\u5c31\u4e0d\u9700\u8981\u5bc6\u7801\u4e86\u3002</p>"},{"location":"services/mirrors/4/volumes/","title":"Volumes on mirrors4","text":"<p>\u4ecb\u7ecd\u9875\u8bb2\u8fc7\u4e86\uff0c\u63a7\u5236\u5668\u7684\u5751\u5bfc\u81f4\u4e0d\u80fd\u76f4\u63a5\u628a 12 \u5757\u786c\u76d8\u7ec4\u6210\u4e00\u4e2a\u903b\u8f91\u78c1\u76d8\uff0c\u56e0\u6b64\u6211\u4eec\u5728\u4e0a\u5c42\u4f7f\u7528 LVM \u6765\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898\u3002</p>"},{"location":"services/mirrors/4/volumes/#_1","title":"\u78c1\u76d8\u5206\u533a","text":"<p>\u6ce8\u610f</p> <p>\u8fd9\u91cc\u7ed9\u51fa\u7684\u547d\u4ee4\u4ec5\u7528\u4e8e\u5c55\u793a\u5206\u533a\uff08\u5377\uff09\u7684\u521b\u5efa\u65b9\u5f0f\uff0c\u9664\u975e\u5b8c\u5168\u91cd\u88c5\uff0c\u5426\u5219\u4e0d\u5e94\u8be5\u6267\u884c\u5176\u4e2d\u4efb\u4f55\u4e00\u6761\u6709\u526f\u4f5c\u7528\u7684\u547d\u4ee4\u3002</p> <p>\u64cd\u4f5c\u7cfb\u7edf\u770b\u5230\u4e09\u4e2a\u786c\u76d8\uff1a\u4e24\u4e2a RAID6 \u5927\u76d8\uff0840 TB / 36.4 TiB\uff09\u548c\u4e00\u4e2a SSD\uff082 TB / 1.86 TiB\uff09\u3002\u8bbe\u4e24\u4e2a\u5927\u76d8\u4e3a /dev/sda \u548c /dev/sdb\uff0cSSD \u4e3a /dev/sdc\u3002</p> <p>\u7531\u4e8e\u542f\u52a8\u5206\u533a\u4e0d\u80fd\u653e\u5728 LVM \u4e0a\uff0c\u56e0\u6b64\u4ee5\u5982\u4e0b\u65b9\u5f0f\u521b\u5efa\u5206\u533a\uff1a</p> <pre><code>root@mirrors4:~# fdisk -l /dev/sda\nDisk /dev/sda: 36.4 TiB, 40001177911296 bytes, 78127300608 sectors\nDisk model: MR9361-8i\nUnits: sectors of 1 * 512 = 512 bytes\nSector size (logical/physical): 512 bytes / 4096 bytes\nI/O size (minimum/optimal): 262144 bytes / 262144 bytes\nDisklabel type: gpt\nDisk identifier: AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA\n\nDevice       Start         End     Sectors  Size Type\n/dev/sda1     2048        4095        2048    1M BIOS boot\n/dev/sda2     4096     1052671     1048576  512M EFI System\n/dev/sda3  1052672 78127300574 78126247903 36.4T Linux LVM\n</code></pre> <p>sdb \u7684\u53c2\u6570\u5b8c\u5168\u4e00\u6837\u3002</p> <p>\u5b9e\u9645\u7684\u542f\u52a8\u5206\u533a\u4e3a /dev/sda2\uff0c\u5c06\u5176 dd \u5230 /dev/sdb2 \u505a\u5907\u4efd\u3002</p> <p>\u7136\u540e\u662f SSD \u7684\u5206\u533a\uff1a</p> <pre><code>Disk /dev/sdc: 1.8 TiB, 1919816826880 bytes, 3749642240 sectors\nDisk model: MR9361-8i\nUnits: sectors of 1 * 512 = 512 bytes\nSector size (logical/physical): 512 bytes / 4096 bytes\nI/O size (minimum/optimal): 65536 bytes / 65536 bytes\nDisklabel type: gpt\nDisk identifier: AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA\n\nDevice     Start        End    Sectors  Size Type\n/dev/sdc1   2048 3749642206 3749640159  1.8T Linux LVM\n</code></pre>"},{"location":"services/mirrors/4/volumes/#lvm","title":"LVM","text":"<p>\u628a sda3 \u548c sdb3 \u90fd\u653e\u8fdb LVM\uff1a</p> <pre><code># fdisk \u5206\u533a\u5b8c\u6bd5\uff0cw \u5199\u5165\u9000\u51fa\npvcreate /dev/sda3 /dev/sdb3\nvgcreate lug /dev/sda3 /dev/sdb3\n</code></pre> <p>\u521b\u5efa rootfs\uff0c\u8fd9\u91cc\u4ee5 RAID1 \u7684\u65b9\u5f0f\uff08<code>--type raid1</code>\uff09\u521b\u5efa\u8fd9\u4e2a\u5206\u533a\uff0c\u8fd9\u6837\u5373\u4f7f sda / sdb \u574f\u6389\u4e00\u6574\u7ec4\u4e4b\u540e\u8fd8\u6709 rootfs \u53ef\u4ee5\u7528\u3002</p> <p>\u6ce8\u610f\uff1a</p> <ul> <li><code>-m 1</code> \u8868\u793a 1 \u4efd\u989d\u5916\u7684\u955c\u50cf\u3002</li> <li><code>--type mirror</code> \u548c <code>--type raid1</code> \u662f\u4e0d\u540c\u7684\uff08\u524d\u8005\u5df2\u7ecf deprecated\uff09\u3002\u4e0d\u8981\u521b\u5efa <code>--type mirror</code> \u7684\u5206\u533a\u3002</li> </ul> <pre><code>lvcreate -n root -L 32G --type raid1 -m 1 lug\nmkfs.ext4 /dev/lug/root\n</code></pre> <p>\u521b\u5efa home\uff0c\u8fd9\u91cc\u53cd\u6b63\u4e0d\u6015\u574f\uff0c\u7528 RAID0\uff08<code>--type striped</code> \u6216 <code>--type raid0</code>\uff09\u3002</p> <pre><code>lvcreate -n root -L 64G --type striped -i 2 lug\nmkfs.ext4 /dev/lug/home\n</code></pre> <p>\u521b\u5efa\u653e\u955c\u50cf\u7684\u5206\u533a\uff0c\u8fd9\u6b21\u8981\u7528 xfs</p> <p>XFS \u4e0d\u652f\u6301\u7f29\u5c0f</p> <p>\u56e0\u6b64\u6211\u4eec\u5728\u521d\u88c5\u65f6\u9009\u62e9\u4e3a\u5176\u5206\u914d 48 TiB \u7684\u7a7a\u95f4\uff0c\u800c\u4e0d\u662f VG lug \u7684\u5269\u4f59\u5168\u90e8\u2014\u2014\u8fd9\u6837\u65b9\u4fbf\u4ee5\u540e\u7ef4\u62a4</p> <pre><code>lvcreate -n repo -L 48T --type striped -i 2 lug\nmkfs.xfs /dev/lug/repo\n</code></pre> <p>\u5176\u5b9e\u672c\u6765\u8981\u8c03\u4e00\u4e0b\u53c2\u7684\uff0c\u4e0d\u8fc7\u6839\u636e Arch Wiki\uff0c<code>mkfs.xfs</code> \u7684\u9ed8\u8ba4\u53c2\u6570\u5c31\u662f\u6700\u4f18\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u51b3\u5b9a\u4e0d\u52a8\u4e86\u3002</p>"},{"location":"services/mirrors/4/volumes/#ssd","title":"SSD","text":"<p>SSD \u7684\u7528\u9014\u4e3a\u5b58\u653e Docker \u6570\u636e <code>/var/lib/docker</code>\uff088 GiB \u5c31\u591f\u4e86\uff0c\u4f46\u662f overlay2 \u7684\u540e\u7aef\u7528 ext4 \u66f4\u597d\uff09\uff0c\u5269\u4e0b\u7528\u4f5c lvmcache(7)\u3002</p> <p>iBug \u5907\u6ce8</p> <p>\u867d\u7136\u4f3c\u4e4e\u6ca1\u6709\u8fd9\u6837\u505a\uff08\u5148\u521b\u5efa\u5355\u72ec\u7684 VG \u518d\u5408\u5e76\uff09\u7684\u5fc5\u8981\uff0c\u4f46\u662f\u8fd9\u4e48\u505a\u4e00\u5b9a\u4e0d\u4f1a\u51fa\u9519\uff0c\u5c31\u8fd9\u6837\u5427\u3002</p> <p>\u5728 SSD \u4e0a\u65b0\u5efa\u4e00\u4e2a VG\uff1a</p> <pre><code># fdisk \u521b\u5efa\u552f\u4e00\u4e00\u4e2a\u5206\u533a sdc1\uff0c\u4fdd\u5b58\u9000\u51fa\npvcreate /dev/sdc1\nvgcreate ssd /dev/sdc1\n</code></pre> <p>\u521b\u5efa Docker \u6570\u636e\u76d8\uff1a</p> <pre><code>lvcreate -L 8G -n docker ssd\nmkfs.ext4 /dev/ssd/docker\n</code></pre> <p>\u91cd\u8981\uff1a\u521b\u5efa\u7f13\u5b58\u76d8\u548c\u7f13\u5b58\u5143\u6570\u636e\u76d8\u3002\u6839\u636e Red Hat Documentation \u7684\u4ecb\u7ecd\uff0c\u5148\u624b\u52a8\u521b\u5efa\u6570\u636e\u76d8\u548c\u5143\u6570\u636e\u76d8\uff0c\u7136\u540e\u5c06\u4ed6\u4eec\u5408\u5e76\u4e3a\u4e00\u4e2a cache pool\u3002\u5927\u5c0f\u65b9\u9762\uff0c\u6587\u7ae0\u7684\u53c2\u8003\u662f 2G data \u2194 12M meta\uff0c\u8fd9\u91cc\u6211\u4eec\u6709\u63a5\u8fd1 2 TB \u7684 data\uff0c\u5c31\u5206\u914d 16 GB \u4f5c\u4e3a meta \u5427\u3002</p> <pre><code>lvcreate -L 16G -n mcache_meta ssd\nlvcreate -l 100%FREE -n mcache ssd\nlvreduce -l -2048 ssd/mcache\nlvconvert --type cache-pool --poolmetadata ssd/mcache_meta --cachemode writethrough -c 64K --config allocation/cache_pool_max_chunks=30000000 ssd/mcache\n</code></pre> <p>\u8fd9\u91cc\u7684\u7f13\u5b58\u6a21\u5f0f\u91c7\u7528 passthrough\uff0c\u5373\u5199\u5165\u52a8\u4f5c\u7ed5\u8fc7\u7f13\u5b58\u76f4\u63a5\u5199\u56de\u539f\u8bbe\u5907\uff08\u5f53\u7136\u5566\uff0c\u5199\u5165\u90fd\u662f\u7531\u4ece\u4e0a\u6e38\u540c\u6b65\u4ea7\u751f\u7684\uff09\uff0c\u53e6\u5916\u4e24\u79cd writeback \u548c writethrough \u90fd\u4f1a\u5199\u5165\u7f13\u5b58\uff0c\u4e0d\u662f\u6211\u4eec\u60f3\u8981\u7684\u3002 passthrough \u6a21\u5f0f\u4e2d\uff0c\u8bfb\u5199\u90fd\u4f1a\u7ed5\u8fc7 cache\uff0c\u552f\u4e00\u7684\u4f5c\u7528\u662f write hit \u4f1a\u4f7f\u5f97 cache \u5bf9\u5e94\u7684\u5757\u5931\u6548\u3002</p> <p>\u8fd9\u91cc\u4f7f\u7528 writeback \u6a21\u5f0f\uff0c\u56e0\u4e3a\u4ed3\u5e93\u6570\u636e\u6ca1\u4e86\u8fd8\u80fd\u518d\u540c\u6b65\uff0c\u4f7f\u7528 writeback \u63d0\u5347\u6027\u80fd\u66f4\u5408\u9002\u3002</p> <p>\u51fa\u4e8e\u7a33\u5b9a\u8003\u8651\uff0c\u4f7f\u7528 writethrough \u6a21\u5f0f\u3002\uff08\u6211\u4eec\u7684 Cache \u592a\u5927\u4e86\uff0cwriteback \u53ef\u80fd\u4f1a\u5f04\u574f\u4e0d\u5c11\u4e1c\u897f\uff0c\u5982\u679c metadata \u574f\u4e86\u5c31\u66f4\u9ebb\u70e6\u4e86\uff09</p> <p>\u5751</p> <p>\u76f4\u63a5\u4f7f\u7528 lvconvert(8) \u5c1d\u8bd5\u5408\u5e76\u4f1a\u5bfc\u81f4\u5410\u69fd\uff0c\u8fd9\u662f\u4e0a\u9762 lvreduce(8) \u7684\u539f\u56e0\u3002</p> <pre><code>Volume group \"ssd\" has insufficient free space (0 extents): 2048 required.\n</code></pre> <p>iBug \u5907\u6ce8</p> <p>LVM \u63a8\u8350\u7684\u662f\u4e00\u4e2a\u7f13\u5b58\u6c60\u91cc\u4e0d\u8d85\u8fc7 100 \u4e07\u4e2a chunk\uff08\u8fd9\u4e5f\u662f allocation/cache_pool_max_chunks \u7684\u9ed8\u8ba4\u503c\uff09\uff0c\u4f46\u662f\u8fd9\u6837\u6bcf\u4e2a chunk \u7684\u6700\u5c0f\u5927\u5c0f\u4e3a 1.84 MiB \u592a\u5927\u4e86\uff0c\u8003\u8651\u5230\u6211\u4eec\u6709\u8db3\u591f\u7684 CPU \u548c\u5185\u5b58\uff0c\u8fd9\u91cc\u5c31\u94e4\u800c\u8d70\u9669\u5c1d\u8bd5\u4e00\u4e0b\u8f83\u5927\u7684 chunk count\u3002</p> <p>\u5751 2</p> <p>\u7f13\u5b58\u76d8\uff08cache pool\uff09\u548c\u88ab\u7f13\u5b58\u7684\u5377\u5fc5\u987b\u5728\u540c\u4e00\u4e2a VG \u4e2d\u3002</p> <p>\u5751 3 (taoky \u5907\u6ce8)</p> <p>LVM Cache \u7684\u5e95\u5c42\u662f\u5728\u5185\u6838\u5b9e\u73b0\u7684 dm-cache\u3002\u76ee\u524d\u5df2\u77e5\u7684\u5751\u5982\u4e0b\uff1a</p> <ol> <li> <p>\u5f53\u51fa\u73b0 dirty blocks\uff08\u4e14 cache policy \u4e3a cleaner \u65f6\uff09\uff0c\u65e0\u6cd5\u6b63\u5e38 flush\u3002\u7f51\u7edc\u4e0a\u53ef\u4ee5\u627e\u5230\u7684\u8fd9\u4e2a bug \u7684\u89e3\u51b3\u65b9\u6cd5\u662f\u589e\u5927 migration_threshold \u7684\u503c\uff08\u5728\u65b0\u7248\u672c LVM \u4e2d\uff0cmigration_threshold \u9ed8\u8ba4\u81f3\u5c11\u4f1a\u662f chunk size \u7684 8 \u500d\uff0c\u5728\u6211\u4eec\u7684\u914d\u7f6e\u4e0b\u5c31\u662f 16384 = 2048 * 8\u3002\u8fd9\u4e2a\u7248\u672c\u7684 LVM \u6682\u65f6\u4e0d\u5728 Buster \u4e2d\uff09\uff0c\u4f46\u662f\u7ecf\u8fc7\u6d4b\u8bd5\uff0c\u5355\u7eaf\u589e\u5927 migration_threshold \u6ca1\u6709\u4efb\u4f55\u6548\u679c\u3002Jiahao \u7ffb\u4e86\u4e00\u4e0b dm-cache \u7684\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0 flush \u7684\u6761\u4ef6\u5728 https://elixir.bootlin.com/linux/latest/source/drivers/md/dm-cache-target.c#L1649\uff0c\u53ea\u5728\u72b6\u6001\u4e3a IDLE \u65f6\u624d\u4f1a flush\u3002IDLE \u7684\u7b2c\u4e00\u4e2a\u6761\u4ef6\u9700\u8981 inflight io = 0\uff0c\u6bd4\u8f83\u82db\u523b\uff0c\u53ef\u80fd\u662f\u65e0\u6cd5\u6b63\u5e38 flush \u7684\u539f\u56e0\u3002</p> <p>\u4e00\u4e2a\u626d\u66f2\u7684\u89e3\u51b3\u65b9\u6cd5\u662f\uff1a\u5148\u628a migration_threshold \u8bbe\u7f6e\u5f97\u5f88\u5927\uff08\u8bbe\u5927\u5c0f\u4e3a x\uff09\uff0c\u7136\u540e\u9a6c\u4e0a\u7f29\u5c0f\uff0c\u8fd9\u6837\u5c31\u80fd\u628a x \u90a3\u4e48\u591a\u5927\u5c0f\u7684\u810f\u5757\u5f04\u6389\uff08\u539f\u7406\u6682\u65f6\u4e0d\u660e\uff0c\u9700\u8981\u8865\u5145\uff09\u3002\u57fa\u4e8e\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u53ef\u4ee5\u5199\u4e00\u4e2a\u811a\u672c\u6765\u505a flush \u7684\u5de5\u4f5c\uff1a</p> <pre><code># dirty hack\nsudo lvchange --cachepolicy cleaner lug/repo\nfor i in `seq 1 1500`; do sudo lvchange --cachesettings migration_threshold=2113536 lug/repo &amp;&amp; sudo lvchange --cachesettings migration_threshold=16384 lug/repo &amp;&amp; echo $i &amp;&amp; sleep 15; done;\n# \u9700\u8981\u786e\u8ba4\u6ca1\u6709\u810f\u5757\u3002\u5982\u679c\u8fd8\u6709\u7684\u8bdd\u7ee7\u7eed\u6267\u884c\uff08\u6b21\u6570\u8c03\u5c0f\u4e00\u4e9b\uff09\n# \u5982\u679c\u662f\u4ece writeback \u5207\u6362\uff0c\u9700\u8981\u5148\u628a\u6a21\u5f0f\u5207\u5230 writethrough\n# \u7136\u540e\u518d\u4fee\u6539 cachepolicy \u5230 smq\nsudo lvchange --cachepolicy smq lug/repo\n</code></pre> <p>\u5728\u6267\u884c\u65f6\uff0c\u53ef\u4ee5\u67e5\u770b\uff1a</p> <pre><code>sudo dmsetup status lug-repo\n# \u5728 \"metadata2\" \u524d\u9762\u7684\u524d\u9762\u7684\u6570\u5b57\u5c31\u662f dirty block \u7684\u6570\u91cf\n# \u5982\u679c\u4e0d\u5728\u6267\u884c lvchange\uff08\u6ca1\u6709\u8fdb\u7a0b\u62a2\u5360\u4e86 LVM \u7684\u9501\uff09\uff0c\u53ef\u4ee5\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u786e\u8ba4\u810f\u5757\u6570\u91cf\u4ee5\u53ca\u5176\u4ed6\u4e00\u4e9b\u53c2\u6570\u3002\nsudo lvs -o name,cache_policy,cache_settings,chunk_size,cache_used_blocks,cache_dirty_blocks /dev/mapper/lug-repo\n</code></pre> </li> <li> <p>\u6bcf\u6b21 unclean shutdown \u4e4b\u540e\uff0ccache \u4e2d\u6240\u6709\u5757\u90fd\u4f1a\u88ab\u6807\u8bb0\u4e3a dirty\u3002\u5c3d\u7ba1\u4e0d\u592a\u53ef\u80fd\u963b\u585e\u7cfb\u7edf\u542f\u52a8\uff0c\u8fd9\u53ef\u80fd\u4f1a\u7ed9 HDD \u4e00\u5b9a\u7684\u538b\u529b\u3002</p> </li> <li>\u6269\u5927 lug/repo \u7684\u5927\u5c0f\u524d\u9700\u8981 uncache\uff0c\u4e14 uncache \u7684\u524d\u63d0\u6761\u4ef6\u662f\u6ca1\u6709\u810f\u5757\u3002</li> </ol> <p>\u5751 4</p> <p>\u4fee\u6539 <code>migration_threshold</code> \u7b49\u8bbe\u7f6e\u4f1a\u5bfc\u81f4\u76ee\u524d\u7248\u672c\u7684 GRUB \u65e0\u6cd5\u6b63\u786e\u8bc6\u522b LVM \u5143\u6570\u636e\u3002</p> <p>\u4e34\u65f6\u4fee\u590d\u7248\u672c\uff1ahttps://github.com/taoky/grub/releases/tag/2.02%2Bdfsg1-20%2Bdeb10u4taoky3_amd64\u3002\u76ee\u524d\u5df2\u90e8\u7f72\uff0c\u4e14\u8bbe\u7f6e\u4e86 <code>apt hold</code>\u3002</p> <p>\u5751 5</p> <p>\u8bbe\u7f6e chunksize \u5230 1M \u4f1a\u6709\u4e25\u91cd\u7684\u5199\u5165\u653e\u5927\u95ee\u9898\uff0c\u56e0\u6b64\u8fd9\u91cc\u4fee\u6539\u4e3a\u4e86 64K\u3002</p> <p>\u6240\u4ee5\u63a5\u4e0b\u6765\u8981\u5408\u5e76 VG\uff0c\u7136\u540e\u624d\u80fd\u4e3a\u4ed3\u5e93\u5377\u52a0\u4e0a\u7f13\u5b58\u3002</p> <pre><code>lvchange -a n ssd/docker\nvgmerge lug ssd\nlvconvert --type cache --cachepool lug/mcache lug/repo\n</code></pre> <p>\u63a5\u4e0b\u6765\u6302\u4e0a Docker \u5377\uff08\u6ce8\u610f VG \u540d\u5df2\u7ecf\u4ece ssd \u53d8\u6210\u4e86 lug\uff09\uff1a</p> <pre><code>lvchange -a y lug/docker\nmount /dev/lug/docker /var/lib/docker\n</code></pre>"},{"location":"services/mirrors/4/volumes/#repo","title":"repo \u6269\u5bb9","text":"<p>\u67e5\u770b\u5f53\u524d\u903b\u8f91\u5377\u4fe1\u606f\uff1a</p> <pre><code># lvs -a -o +devices\n  LV              VG  Attr       LSize   Pool     Origin       Data%  Meta%  Move Log         Cpy%Sync Convert Devices\n  backup          lug -wi-ao----   8.00g                                                                       /dev/sda3(6307840)\n  docker          lug -wi-ao----  64.00g                                                                       /dev/sdc1(0)\n  docker2         lug -wi-a----- 300.00g                                                                       /dev/sda3(7925248)\n  home            lug -wi-ao----  64.00g                                                                       /dev/sda3(8192),/dev/sdb3(8193)\n  log             lug -wi-ao---- 300.00g                                                                       /dev/sda3(6309888),/dev/sdb3(6307841)\n  log             lug -wi-ao---- 300.00g                                                                       /dev/sda3(7888896),/dev/sdb3(7882753)\n  [lvol0_pmspare] lug ewi-------  16.00g                                                                       /dev/sda3(7884800)\n  [mcache]        lug Cwi---C---   1.50t                       99.99  0.12                    0.00             mcache_cdata(0)\n  [mcache_cdata]  lug Cwi-ao----   1.50t                                                                       /dev/sdc1(20480)\n  [mcache_cmeta]  lug ewi-ao----  16.00g                                                                       /dev/sdc1(16384)\n  repo            lug Cwi-aoC---  60.00t [mcache] [repo_corig] 99.99  0.12                    0.00             repo_corig(0)\n  [repo_corig]    lug owi-aoC---  60.00t                                                                       /dev/sda3(16384),/dev/sdb3(16385)\n  [repo_corig]    lug owi-aoC---  60.00t                                                                       /dev/sda3(6311936),/dev/sdb3(6309889)\n  root            lug mwi-aom---  32.00g                                          [root_mlog] 100.00           root_mimage_0(0),root_mimage_1(0)\n  [root_mimage_0] lug iwi-aom---  32.00g                                                                       /dev/sda3(0)\n  [root_mimage_1] lug iwi-aom---  32.00g                                                                       /dev/sdb3(0)\n  [root_mlog]     lug lwi-aom---   4.00m                                                                       /dev/sdb3(8192)\n</code></pre> <p>\u68c0\u67e5 cache \u662f\u5426\u6709 dirty block\uff1a</p> <pre><code>$ sudo lvs -o name,cache_policy,cache_settings,chunk_size,cache_used_blocks,cache_dirty_blocks /dev/mapper/lug-repo\n  LV   CachePolicy CacheSettings Chunk CacheUsedBlocks  CacheDirtyBlocks\n  repo smq                       1.00m          1048551                0\n</code></pre> <p>\uff08\u6b63\u5e38\u91cd\u542f\u4e4b\u540e\u53ef\u80fd\u4f1a\u51fa\u73b0 dirty block\uff0c\u539f\u56e0\u4e0d\u660e\u3002\u5982\u679c\u770b\u5230\u6709\u7684\u8bdd\uff0c\u90a3\u53ea\u80fd \u518d\u6b21\u8fdb\u5165\u75db\u82e6\u7684\u8f6e\u56de \u7528\u4e0a\u8ff0\u7684\u65b9\u6cd5\u6e05\u9664\uff0c\u5e76\u4e14\u6e05\u9664\u7684\u65f6\u5019\u5bf9\u7cfb\u7edf\u8d1f\u8f7d\u5f71\u54cd\u5f88\u5927\uff0c\u56e0\u4e3a\u843d\u76d8\u7684\u65f6\u5019\u5176\u4ed6\u8fdb\u7a0b\u5bf9\u5e94\u7684 IO \u4f1a\u88ab\u6682\u505c\uff0c\u5728\u76f8\u5bf9\u5e73\u8861\u65f6\u95f4\u548c\u8d1f\u8f7d\u7684\u547d\u4ee4\u4e0b\uff0c\u4f30\u8ba1\u9700\u8981 10 \u5c0f\u65f6\u7684\u65f6\u95f4\u3002\uff09</p> <p>\u7136\u540e uncache\u3001\u6269\u5bb9\uff1a</p> <pre><code># lvconvert --uncache lug/repo\n# lvextend -L +5T lug/repo\n# xfs_growfs /srv\n</code></pre> <p>\u7136\u540e\u6062\u590d cache\uff08\u53c2\u8003\u4e0a\u9762 mcache_meta \u548c mcache \u903b\u8f91\u5377\u7684\u914d\u7f6e\uff0c\u8bf7\u6ce8\u610f\u5728\u7406\u89e3\u547d\u4ee4\u540e\u518d\u6267\u884c\uff01\uff09\uff1a</p> <pre><code># lvcreate -L 16G -n mcache_meta lug /dev/sdc1  # SSD \u8bbe\u5907\u8def\u5f84\u91cd\u542f\u540e\u53ef\u80fd\u4f1a\u53d8\u5316\n# lvcreate -l 100%FREE -n mcache lug /dev/sdc1\n# lvreduce -l -2048 lug/mcache\n# lvconvert --type cache-pool --poolmetadata lug/mcache_meta --cachemode writethrough -c 64K --config allocation/cache_pool_max_chunks=30000000 lug/mcache\n# lvconvert --type cache --cachepool lug/mcache lug/repo\n</code></pre> <p>\u5751 5</p> <p>\u65b0\u5efa\u65f6\u5728\u5012\u6570\u7b2c\u4e8c\u6b65\u7684 <code>lvconvert</code> \u53ef\u80fd\u4f1a\u5361\u6b7b\u8d85\u8fc7\u534a\u5c0f\u65f6\uff08\u4f46\u662f\u6700\u540e\u8fd8\u662f\u80fd\u5b8c\u6210\u7684\uff09\uff0c\u6808\u7684\u4fe1\u606f\u663e\u793a\u6808\u9876\u51fd\u6570\u662f <code>submit_bio_wait()</code>\uff0c\u5728\u6e05\u96f6\u5bf9\u5e94\u7684 block range\uff0c\u56e0\u4e3a RAID \u5361\u4e0d\u652f\u6301\u4e0b\u4f20 discarding \u6240\u4ee5\u4f1a\u5f88\u6162\uff0c\u9700\u8981\u7b49\u4e00\u6bb5\u65f6\u95f4\u3002</p>"},{"location":"services/mirrors/4/volumes/#fstab","title":"fstab","text":"<p>\u5206\u533a\u5b8c\u6bd5\u540e\u7ed9 <code>/etc/fstab</code> \u8865\u4e0a\u76f8\u5173\u7684\u5185\u5bb9\u5e76\u6302\u8f7d\uff1a</p> <pre><code>/dev/mapper/lug-home   /home           ext4 defaults             0 2\n/dev/mapper/lug-docker /var/lib/docker ext4 defaults             0 2\n/dev/mapper/lug-repo   /srv            xfs  defaults,pqnoenforce 0 2\n/dev/mapper/lug-log    /var/log        ext4 defaults             0 2\n</code></pre> <p>\uff08\u8fd9\u4e2a log \u5206\u533a\u524d\u9762\u6ca1\u63d0\uff0c\u53cd\u6b63\u50cf\u6a21\u50cf\u6837\u77e5\u9053\u5c31\u884c\u4e86\uff09</p>"},{"location":"services/mirrors/4/networking/","title":"Networking on mirrors4","text":"<p>\u51fa\u4e8e\u597d\u7528\u7684\u8003\u8651\uff0cmirrors4 \u4e0a\u7684\u7f51\u7edc\u4f7f\u7528 systemd-networkd \u914d\u7f6e\u3002\u4f5c\u4e3a\u5165\u95e8\uff0c\u4e0b\u9762\u662f\u4e24\u4e2a\u53c2\u8003\u94fe\u63a5\uff1a</p> <ul> <li>Systemd-networkd - Arch Wiki</li> <li>SystemdNetworkd - Debian Wiki</li> </ul> <p>Debian \u9ed8\u8ba4\u7528\u7684\u662f ifupdown\uff0c\u628a\u5b83\u76f4\u63a5\u5378\u6389\u5c31\u884c\u4e86\u3002\u5168\u90e8\u914d\u7f6e\u5b8c\u6bd5\u4e4b\u540e\u9700\u8981 <code>systemctl enable systemd-networkd.service</code> \u5e76\u4e14 start \u4e00\u4e0b\uff08\u6216\u8005\u76f4\u63a5\u91cd\u542f\uff09\u3002</p> <p>/etc/systemd/network \u76ee\u5f55\u4e0b\u6709\u4e2a Git \u4ed3\u5e93\uff0c\u65b9\u4fbf\u4fdd\u5b58\u4e0e\u6062\u590d</p>"},{"location":"services/mirrors/4/networking/#bond","title":"Bond","text":"<p>Bond \u7528\u4e8e\u5c06\u591a\u4e2a\u7f51\u5361\u805a\u5408\u5f53\u4f5c\u4e00\u4e2a\u4f7f\u7528\u3002</p>"},{"location":"services/mirrors/4/networking/#_1","title":"\u5b50\u7f51\u5361","text":"<p>\u5411 <code>/etc/systemd/network/ens41f0.network</code> \u5199\u5165\u5982\u4e0b\u5185\u5bb9\uff1a</p> <pre><code>[Match]\nName=ens41f0\n\n[Network]\nBond=bond1\n\n[Link]\nRequiredForOnline=no\n</code></pre> <p>\u5373\u53ef\u5c06\u5176\u8bbe\u7f6e\u4e3a bond1 \u7684\u4e00\u4e2a\u5b50\u7f51\u5361\u3002\u7528\u540c\u6837\u65b9\u5f0f\u628a ens41f1 \u4e5f\u8bbe\u4e3a\u5b50\u7f51\u5361\u3002</p> <p>\u4e00\u4e2a\u5c0f\u5751</p> <p>systemd-networkd \u6709\u4e00\u4e2a\u9ed8\u8ba4\u7684 bond0 \u805a\u5408\u7f51\u5361\uff0c\u6a21\u5f0f\u6c38\u8fdc\u662f round-robin\uff0c\u800c\u4e14\u5c1d\u8bd5\u8bbe\u7f6e\u8fd9\u4e2a\u7f51\u5361\u5f88\u5bb9\u6613\u51fa\u95ee\u9898\uff0c\u6240\u4ee5\u6211\u4eec\u907f\u5f00\u8fd9\u4e2a\u540d\u5b57\uff0c\u7528 bond1\u3002</p>"},{"location":"services/mirrors/4/networking/#bond1","title":"bond1 \u805a\u5408\u7f51\u5361","text":"<p>\u5199\u5165 <code>/etc/systemd/network/bond1.netdev</code>\uff1a</p> <pre><code>[NetDev]\nName=bond1\nKind=bond\n\n[Bond]\nMode=balance-tlb\nMIIMonitorSec=1\n</code></pre> <p>\u5173\u4e8e bond \u6a21\u5f0f\uff08<code>balance-tlb</code> vs <code>balance-alb</code>\uff09\uff0c\u53c2\u8003\u8fd9\u4e2a Server Fault \u4e0a\u7684\u56de\u7b54\u3002</p> <p>\u7136\u540e\u521b\u5efa VLAN\uff0c\u5199\u5165 <code>/etc/systemd/network/bond1.network</code>\uff1a</p> <pre><code>[Match]\nName=bond1\n\n[Network]\nDHCP=no\nVLAN=cernet\nVLAN=telecom\nVLAN=mobile\nVLAN=unicom\n</code></pre>"},{"location":"services/mirrors/4/networking/#vlan","title":"VLAN","text":"<p>NIC \u673a\u623f\u6709 4 \u4e2a VLAN\uff0c\u5206\u522b\u662f</p> <ul> <li>ID 95\uff0c\u6559\u80b2\u7f51 202.38.95.0/25</li> <li>ID 10\uff0c\u7535\u4fe1 202.141.160.0/25</li> <li>ID 400\uff0c\u79fb\u52a8 202.141.176.0/25</li> <li>ID 11\uff0c\u8054\u901a 218.104.71.96/28, 218.104.71.160/28</li> </ul> <p>\u6ce8\u610f\u8fd9\u51e0\u4e2a\u7f51\u6bb5\u90fd\u6ca1\u6709 DHCP\uff0c\u53ea\u6709\u6559\u80b2\u7f51 VLAN \u6709 IPv6 RA\u3002</p> <p>\u4e0b\u9762\u4ee5\u6559\u80b2\u7f51 VLAN \u4e3a\u4f8b\u3002</p> <p>\u56e0\u4e3a VLAN \u5728\u7269\u7406\u4e0a\u5c5e\u4e8e\u4e00\u4e2a\u7f51\u5361\uff0c\u56e0\u6b64\u5411\u5bf9\u5e94\u7f51\u5361\u7684 <code>.network</code> \u6587\u4ef6\u7684 <code>[Network]</code> \u6bb5\u8ffd\u52a0\u4e00\u884c\uff08\u89c1\u4e0a\u9762\u4e00\u8282 <code>bond1.network</code> \u6587\u4ef6\uff09\uff1a</p> <pre><code>VLAN=cernet\n</code></pre> <p>\u521b\u5efa VLAN \u754c\u9762\uff0c\u521b\u5efa <code>cernet.netdev</code> \u5e76\u5199\u5165</p> <pre><code>[NetDev]\nName=cernet\nKind=vlan\n\n[VLAN]\nId=95\n</code></pre> <p>\u7136\u540e\u5c31\u53ef\u4ee5\u6307\u5b9a IP \u5730\u5740\u7b49\u5177\u4f53\u4fe1\u606f\u4e86\uff0c\u521b\u5efa\u4e00\u4e2a\u540d\u5b57\u76f8\u540c\uff0c\u540e\u7f00\u6362\u6210 <code>.network</code> \u7684\u6587\u4ef6\u5e76\u5199\u5165</p> <pre><code>[Match]\nName=cernet\n\n[Network]\nDHCP=no\nAddress=202.38.95.110/25\n#Gateway=202.38.95.126\nAddress=2001:da8:d800:95::110/64\n#Gateway=2001:da8:d800:95::1\nIPv6AcceptRA=false\n</code></pre> <p>\u4fdd\u5b58\u540e\u91cd\u542f <code>systemd-networkd.service</code> \u5c31\u53ef\u4ee5\u770b\u5230\u6548\u679c\u4e86\u3002</p> <p>\u4e3a\u4ec0\u4e48 Gateway \u88ab\u6ce8\u91ca\u6389\u4e86</p> <p>\u6839\u636e systemd \u5b98\u65b9\u6587\u6863\uff0c\u5728 <code>[Network]</code> \u4e00\u8282\u51fa\u73b0\u7684 <code>Gateway=</code> \u7b49\u4ef7\u4e8e\u4e00\u4e2a\u5355\u72ec\u7684\u3001\u4ec5\u5305\u542b\u4e00\u884c <code>Gateway=</code> \u7684 <code>[Route]</code> \u8282\u3002\u7531\u4e8e\u6211\u4eec\u9700\u8981\u6df1\u5ea6\u81ea\u5b9a\u4e49\u8def\u7531\uff0c\u8fd9\u91cc\u4e0d\u65b9\u4fbf\u91c7\u7528\u8fd9\u4e2a\u8fc7\u4e8e\u7b80\u6d01\u7684\u8bbe\u5b9a\uff08\u4f8b\u5982\u5404\u79cd\u9ed8\u8ba4\u503c <code>Table=main</code> \u7b49\uff09\u3002</p>"},{"location":"services/mirrors/4/networking/#docker-network","title":"Docker network","text":"<p>\u9488\u5bf9\u4e2a\u522b\u4e0d\u652f\u6301 bind address \u7684\u540c\u6b65\u5de5\u5177\uff0c\u6211\u4eec\u901a\u8fc7\u5c06\u5176\u653e\u5165\u7279\u5b9a\u7684 docker network \u6765\u5b9e\u73b0\u9009\u62e9\u7ebf\u8def\u7684\u529f\u80fd\u3002</p> \u521b\u5efa\u547d\u4ee4<pre><code>docker network create --driver=bridge --subnet=172.17.4.1/24 -o \"com.docker.network.bridge.name=dockerC\" cernet\ndocker network create --driver=bridge --subnet=172.17.5.1/24 -o \"com.docker.network.bridge.name=dockerT\" telecom\ndocker network create --driver=bridge --subnet=172.17.6.1/24 -o \"com.docker.network.bridge.name=dockerM\" mobile\ndocker network create --driver=bridge --subnet=172.17.7.1/24 -o \"com.docker.network.bridge.name=dockerU\" unicom\ndocker network create --driver=bridge --ipv6 --subnet=172.17.8.1/24 --subnet=fd00:6::/64 -o \"com.docker.network.bridge.name=dockerC6\" cernet6\ndocker network create --driver=bridge --subnet=172.17.9.1/24 -o \"com.docker.network.bridge.name=dockerV\" lugvpn\n</code></pre> <p>\u7136\u540e\u4f7f\u7528 systemd-networkd \u5bf9\u521b\u5efa\u597d\u7684 docker network \u7f51\u6bb5\u914d\u7f6e\u89c4\u5219\u8def\u7531\u3002</p> /etc/systemd/network/cernet.network<pre><code># Docker Cernet\n[RoutingPolicyRule]\nFrom=172.17.4.0/24\nTable=1011\nPriority=5\n\n[RoutingPolicyRule]\nFrom=172.17.8.0/24\nTable=1011\nPriority=5\n</code></pre> <p>\u5176\u4ed6\u51e0\u4e2a\u6587\u4ef6\u7c7b\u4f3c\uff0c\u53ea\u9700\u8981\u4fee\u6539\u7f51\u6bb5\u548c Table \u5373\u53ef\u3002</p>"},{"location":"services/mirrors/4/networking/#docker-network-cernet6","title":"Docker network: cernet6","text":"<p>\u7531\u4e8e\u4e00\u4e9b\u7a0b\u5e8f\u6216\u7cfb\u7edf\u73af\u5883\u5728\u53cc\u6808\u7f51\u7edc\u4e2d\u4ecd\u7136\u4f1a\u4f18\u5148\u5c1d\u8bd5 IPv4\uff0c\u6211\u4eec\u5c06 cernet6 \u7f51\u7edc\u7684 v4 \u516c\u7f51\u8bbf\u95ee\u5c4f\u853d\u6389\u3002</p> rules.v4<pre><code>*filter\n:FORWARD DROP [0:0]\n# ...\n-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n-A FORWARD -i dockerC6 -j REJECT\n-A FORWARD -i docker+ -j ACCEPT\n</code></pre>"},{"location":"services/mirrors/4/networking/misc/","title":"mirrors \u7f51\u7edc\u914d\u7f6e\u6742\u9879","text":""},{"location":"services/mirrors/4/networking/misc/#sniproxy","title":"sniproxy","text":"<p>Sniproxy \u7528\u4e8e\u4e3a Docker \u5bb9\u5668\u63d0\u4f9b\u65b9\u4fbf\u7684 HTTP(S) \u7f51\u7edc\u5206\u6d41\u3002\u76ee\u524d\u5728 mirrors \u4e0a\u7528\u4e8e\u4e3a dockerhub \u5bb9\u5668\u63d0\u4f9b\uff08\u5230 Cloudflare \u7684\uff09IPv6 \u63a5\u5165\uff08Docker \u505a IPv6 NAT \u975e\u5e38\u4e0d\u65b9\u4fbf\uff0c\u6240\u4ee5\u4ee5\u6b64\u4e3a\u6743\u5b9c\u4e4b\u4e3e\uff09\uff0c\u4ee5\u63d0\u9ad8\u6821\u5185\u8bbf\u95ee\u65f6\u7684\u901f\u5ea6\u3002</p>"},{"location":"services/mirrors/4/networking/misc/#_1","title":"\u914d\u7f6e","text":"<p>\u5b89\u88c5 sniproxy\uff0c\u5e76\u4e14 mask \u539f\u670d\u52a1\u914d\u7f6e\uff08\u6211\u4eec\u81ea\u5df1\u5199\u4e00\u4e2a\uff09\uff1a</p> <pre><code>sudo apt install sniproxy\nsudo mkdir -p /etc/sniproxy\nsudo systemctl mask sniproxy.service\n</code></pre> <p>\u521b\u5efa <code>/etc/systemd/system/sniproxy@.service</code>\uff1a</p> <pre><code>[Unit]\nDescription=SNIProxy (%i.conf)\nAfter=network.target network-online.target\nStartLimitIntervalSec=1\n\n[Service]\nType=simple\nExecStart=/usr/sbin/sniproxy -f -c /etc/sniproxy/%i.conf\nRestart=on-failure\nRestartSec=3\n\n[Install]\nWantedBy=multi-user.target\n</code></pre> <p>\u5728 <code>/etc/sniproxy</code> \u4e2d\u521b\u5efa\u914d\u7f6e\u3002\u4ee5\u4e0b\u4e3a IPv6 + TLS (443) only \u7684\u914d\u7f6e\u4f8b\u5b50\uff1a</p> <pre><code>resolver {\n    nameserver 2001:da8:d800::1\n    mode ipv6_only\n}\n\naccess_log {\n    filename /dev/null\n}\n\nlisten &lt;Bind \u5230\u7684 IP \u5730\u5740&gt;:443 {\n    proto tls\n    reuseport yes\n    table all\n    source &lt;IPv6 \u51fa\u53e3\u5730\u5740&gt;\n}\n\ntable all {\n    .* *\n}\n</code></pre> <p>\u6700\u540e\u542f\u52a8\u670d\u52a1\uff1a</p> <pre><code>sudo systemctl enable sniproxy@\u914d\u7f6e\u6587\u4ef6\u540d.service\nsudo systemctl start sniproxy@\u914d\u7f6e\u6587\u4ef6\u540d.service\n</code></pre>"},{"location":"services/mirrors/4/networking/route/","title":"Routing on mirrors4","text":"<p>\u7531\u4e8e mirrors4 \u6ca1\u6709\u4f7f\u7528 ifupdown \u4f5c\u4e3a\u7f51\u7edc\u7ba1\u7406\u7cfb\u7edf\uff0c\u800c\u662f\u91c7\u7528 systemd-networkd\uff0c\u56e0\u6b64\u6211\u4eec\u6ca1\u6709 <code>pre-up</code>, <code>up</code>, <code>down</code>, <code>post-down</code> \u7b49\u8fd0\u884c\u547d\u4ee4\u7684\u65b9\u5f0f\uff0c\u6240\u4ee5 mirrors2 \u4e0a\u4f7f\u7528\u7684\u90a3\u5957\u811a\u672c\uff08<code>ip-route.sh</code> \u7b49\uff09\u65e0\u6cd5\u76f4\u63a5\u5728 mirrors4 \u4e0a\u7ee7\u7eed\u4f7f\u7528\u3002</p> <p>\u597d\u5728\u6211\u4eec\u4f7f\u7528 <code>up</code> \u7b49\u8fd0\u884c\u547d\u4ee4\u53ea\u662f\u4e3a\u4e86\u914d\u7f6e\u8def\u7531\uff0c\u56e0\u6b64\u6362\u4e86\u4e2a\u529e\u6cd5\uff0c\u6574\u4e86\u4e2a\u65b0\u811a\u672c\u628a IP \u5730\u5740\u5217\u8868\uff08\u6765\u81ea gaoyifan/china-operator-ip\uff09\u8f6c\u6362\u6210 networkd \u6240\u4f7f\u7528\u7684\u914d\u7f6e\u6587\u4ef6\u683c\u5f0f\u3002\u4ee3\u7801\u4e0d\u957f\uff1a</p> <pre><code>#!/bin/bash\n\nROOT_IP_LIST=/usr/local/network_config/iplist\nROOT_RT=/run/systemd/network\n\ngen_route() {\n  IPLIST=\"$ROOT_IP_LIST/$1\"\n  GW=\"$2\"\n  DEV=\"$3\"\n  # Convert table to number\n  TABLENAME=\"$4\"\n  TABLE=\"$(awk 'substr($0, 1, 1) != \"#\" &amp;&amp; $2 == \"'\"$TABLENAME\"'\" { print $1 }' /etc/iproute2/rt_tables | head -1)\"\n  PRIORITY=\"$5\"\n\n  F=\"$ROOT_RT/$DEV.network.d\"\n  mkdir -p \"$F\"\n  F=\"$F/route-${TABLENAME,,}.conf\"\n\n  echo -e \"[RoutingPolicyRule]\\nTable=$TABLE\\nPriority=$PRIORITY\\n\" &gt; \"$F\"\n  awk '{ print \"[Route]\\nDestination=\" $1 \"\\nGateway='\"$GW\"'\\nTable='\"$TABLE\"'\\n\" }' \"$IPLIST\" &gt;&gt; \"$F\"\n}\n\ngen_route ustcnet.txt 202.38.95.126 cernet Ustcnet 5\ngen_route cernet.txt 202.38.95.126 cernet Cernet 6\ngen_route telecom.txt 202.141.160.126 telecom Telecom 6\ngen_route mobile.txt 202.141.176.126 mobile Mobile 6\ngen_route unicom.txt 218.104.71.161 unicom Unicom 6\ngen_route china.txt 218.104.71.161 unicom China 7\n</code></pre> <p>\u8fd9\u4e2a\u4ed3\u5e93\u91cc\u6709\u5f88\u591a\u4e2a txt \u6587\u4ef6\uff0c\u6bcf\u4e2a\u6587\u4ef6\u5bf9\u5e94\u4e00\u4e2a ISP \u7684\u5730\u5740\u5217\u8868\uff0c\u6bcf\u884c\u4e00\u4e2a CIDR\u3002\u811a\u672c\u4e2d\u7684 <code>gen_route</code> \u51fd\u6570\u6839\u636e\u53c2\u6570\u8bfb\u53d6\u6587\u4ef6\uff0c\u5e76\u8f6c\u6362\u6210\u4e0b\u9762\u8fd9\u6837\u7684\u683c\u5f0f\uff1a</p> <pre><code>[Route]\nDestination=1.0.0.0/24\nGateway=202.38.95.126\nTable=1011\n</code></pre> <p>\u8fd9\u6837\u4e00\u4e2a <code>[Route]</code> \u8282\u5bf9\u5e94\u4e00\u6761\u8def\u7531\u89c4\u5219\uff0c\u6574\u4e2a txt \u7684\u8f6c\u6362\u7ed3\u679c\u8f93\u51fa\u5230 <code>/run/systemd/network/cernet.network.d/route-example.conf</code>\u3002\u5176\u4e2d <code>cernet.network.d/*.conf</code> \u7528\u4e8e\u5411\u73b0\u6709\u7684\u914d\u7f6e\u4e2d\u6dfb\u52a0\u5185\u5bb9\uff08\u4e0e systemd service \u7c7b\u4f3c\uff09\uff0c\u800c <code>/run</code> \u76ee\u5f55\uff08\u6309\u7406\u6765\u8bf4\uff09\u91cd\u542f\u4f1a\u6e05\u7a7a\uff0c\u9002\u5408\u653e\u7f6e\u8fd9\u4e9b\u7528\u4e8e\u52a8\u6001\u751f\u6210\u7684\u5185\u5bb9\u3002\u53e6\u5916\u7531\u4e8e\u8def\u7531\u89c4\u5219\uff08<code>ip rule</code>\uff09\u4e5f\u7531 networkd \u7ba1\u7406\u548c\u751f\u6210\u4e86\uff0c\u56e0\u6b64\u6bcf\u4e2a <code>route-xxx.conf</code> \u5f00\u5934\u4f1a\u5305\u542b\u4e00\u4e2a <code>[RoutingPolicyRule]</code> \u8282\u7528\u4e8e\u751f\u6210\u8def\u7531\u8868\u5bf9\u5e94\u7684\u8def\u7531\u89c4\u5219\u3002</p> <p>\u6ce8\u610f\u8def\u7531\u8868\u662f\u7528\u540d\u79f0\u6307\u5b9a\u7684\uff0c\u4ece <code>/etc/iproute2/rt_tables</code> \u4e2d\u67e5\u51fa\u5bf9\u5e94\u7684\u6570\u5b57 ID\u3002\u8fd9\u4e2a\u6587\u4ef6\u672c\u6765\u4e5f\u662f <code>ip</code> \u547d\u4ee4\u6240\u4f7f\u7528\u7684\uff08\u6ce8\u610f\u5b83\u7684\u76ee\u5f55\u540d\u53eb <code>iproute2</code>\uff09\u3002</p> <p>\u6700\u540e\u7ed9\u8fd9\u4e2a\u811a\u672c\u914d\u4e2a service\uff0c\u8ba9\u5b83\u5728 networkd \u4e4b\u524d\u8fd0\u884c\uff1a</p> <pre><code># WARNING: This is NOT the final configuration file!\n[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\nWants=systemd-networkd.service\n</code></pre> <p>\u8fd9\u4e2a\u6587\u4ef6\u5b58\u5230 <code>/etc/systemd/system/route-all.service</code>\uff0creload \u518d enable \u5c31\u53ef\u4ee5\u4e86\u3002</p> <p>\u6539 systemd-networkd.service \u9700\u8981\u989d\u5916\u6ce8\u610f</p> <p>\u8fd9\u4e2a\u81ea\u5e26\u7684\u670d\u52a1\u6709\u4e00\u4e2a <code>User=systemd-networkd</code>\uff0c\u4f60\u65e2\u4e0d\u80fd <code>ip rule</code> \u4e5f\u4e0d\u80fd\u5199\u5165 <code>/run/systemd</code> \u7b49\uff0c\u4f1a\u5bfc\u81f4\u670d\u52a1\u70b8\u6389\uff0c\u7136\u540e\u7f51\u4e5f\u70b8\u4e86\u3002\u3002\u3002</p> <p>\u5982\u679c\u8981\u6539 networkd \u670d\u52a1\u64cd\u4f5c <code>ip rule</code> \u7684\u8bdd\uff0c\u9700\u8981\u5728\u547d\u4ee4\u884c\u524d\u9762\u52a0\u4e00\u4e2a <code>+</code> \u8868\u793a\u8be5\u547d\u4ee4\u4e0d\u53d7 <code>User=</code> \u7b49\u6743\u9650\u8bbe\u7f6e\u5f71\u54cd\uff0c\u8be6\u7ec6\u89e3\u91ca\u89c1 systemd.service \u6587\u6863\u3002</p>"},{"location":"services/mirrors/4/networking/route/#special-routing","title":"Special routing","text":"<p>\u90e8\u5206 IP \u9700\u8981\u914d\u7f6e\u7279\u6b8a\u8def\u7531\u89c4\u5219\u65f6\uff08\u800c\u4e0d\u662f\u4f7f\u7528\u9ed8\u8ba4\uff09\uff0c\u7f16\u8f91 <code>/usr/local/network_config/special.yml</code>\uff0c\u5176\u683c\u5f0f\u5982\u4e0b\uff1a</p> <pre><code>routes: # Root key\uff0c\u4fdd\u7559\n  lugvpn: # /etc/systemd/network \u4e2d\u5bf9\u5e94\u7684 .network \u6587\u4ef6\u540d\n    # \u4e0b\u9762\u662f\u4e00\u4e2a\u8def\u7531\u6587\u4ef6\u7684\u914d\u7f6e\uff0c\u4e00\u4e2a\u6587\u4ef6\u5171\u4eab\u4e00\u4e2a table \u548c gateway \u8bbe\u7f6e\n    - name: route-special # \u5c06\u8981\u521b\u5efa\u7684 .conf \u6587\u4ef6\u540d\uff0c\u53ef\u4ee5\u968f\u610f\n      table: Special # \u8def\u7531\u8868\uff0c\u5373 ip route add table \u540e\u9762\u7684\u53c2\u6570\uff0c\u6570\u5b57\u6216\u8868\u540d\n      gateway: false # \u662f\u5426\u5305\u542b\u7f51\u5173\uff0c\u6216\u8005 ip route \u7684 via \u53c2\u6570\n      routes: # \u6240\u6709\u7684\u8def\u7531\u6761\u76ee\n        - 1.2.3.4\n        - 5.6.7.8/28\n        - 2001:db8::2333/64\n\n  cernet: # \u66f4\u591a\u7684\u914d\u7f6e\n    - ...\n</code></pre> <p>\u4fee\u6539 <code>special.yml</code> \u4e4b\u540e\u91cd\u542f <code>route-all.service</code>\u3002\u8be5\u670d\u52a1\u4f1a\u81ea\u52a8\u5bfc\u81f4 <code>systemd-networkd.service</code> \u91cd\u542f\u5e76\u8f7d\u5165\u65b0\u7684\u8def\u7531\u914d\u7f6e\u4fe1\u606f\u3002</p> special.rb \u5904\u7406\u811a\u672c\uff08\u653e\u5728\u8fd9\u5907\u4efd\uff09 <pre><code>#!/usr/bin/ruby\n\nrequire 'fileutils'\nrequire 'yaml'\n\nBASEDIR = '/run/systemd/network'\nRT_TABLES = '/etc/iproute2/rt_tables'\n\nrt_tables = Hash.new\nFile.readlines(RT_TABLES).each do |l|\n  next if l =~ /^\\s*#/\n  id, name = l.split\n  rt_tables[name] = id\nend\n\ndata = YAML.load_file File.join(__dir__, 'special.yml')\ndata['routes'].each do |fn, setups|\n  confdir = File.join(BASEDIR, \"#{fn}.network.d\")\n  FileUtils.mkdir_p confdir\n\n  setups.each do |config|\n    table = config['table']\n    gateway = config['gateway']\n    File.open File.join(confdir, \"#{config['name']}.conf\"), 'w' do |f|\n      config['routes'].each do |dst|\n        t = \"[Route]\\nDestination=#{dst}\\n\"\n        t += \"Table=#{rt_tables.fetch table, table}\\n\" if table\n        t += \"Gateway=#{gateway}\\n\" if gateway\n        f.write t + \"\\n\"\n      end\n    end\n  end\nend\n</code></pre> <p>route-all.service \u6709\u5f88\u591a\u6ce8\u610f\u4e8b\u9879</p> <p>\u4e3a\u4e86\u6e05\u7406\u5f00\u673a\u81ea\u52a8\u4ea7\u751f\u7684 32766 \u548c 32767 \u4e24\u6761\u8def\u7531\u89c4\u5219\uff0c\u6211\u4eec\u540c\u65f6\u4e3a <code>systemd-networkd.service</code> \u6dfb\u52a0\u4e86\u4e24\u4e2a <code>ExecStartPre</code> \u5982\u4e0b\uff1a</p> <pre><code>[Service]\nExecStartPre=-+/sbin/ip rule delete from all table main pref 32766\nExecStartPre=-+/sbin/ip rule delete from all table default pref 32767\n</code></pre> <p>\u53e6\u9644\u5b8c\u6574\u7684 <code>route-all.service</code> \u6587\u4ef6\uff1a</p> <pre><code>[Unit]\nDescription=Generate routes for systemd-networkd\nBefore=systemd-networkd.service\n\n[Service]\nType=oneshot\nExecStart=/bin/bash /usr/local/network_config/route-all.sh\nExecStart=/usr/local/network_config/special.rb\nRemainAfterExit=true\n\n[Install]\nWantedBy=network.target systemd-networkd.service\nWants=systemd-networkd.service\n</code></pre>"},{"location":"services/pxe/","title":"PXE","text":"<p>\u5bf9\u6821\u56ed\u7f51\u7528\u6237\u4e0e\u6821\u5916\u7528\u6237\u516c\u5f00\u7684 PXE \u670d\u52a1\u3002LIIMS \u4e0e\u76ee\u524d\u7684 PXE \u867d\u7136\u8fd0\u884c\u5728\u540c\u4e00\u53f0\u670d\u52a1\u5668\u4e0a\uff0c\u4f46\u662f\u914d\u7f6e\u6709\u6240\u4e0d\u540c\u3002</p> <p>\u672c\u6587\u6863\u9700\u8981\u5927\u5e45\u6269\u5145</p>"},{"location":"services/pxe/#intro","title":"Intro","text":"<p>https://lug.ustc.edu.cn/wiki/server/pxe/</p> <p>https://lug.ustc.edu.cn/planet/2018/10/PXE-intro/</p> <p>\u5173\u4e8e FAQ</p> <p>https://lug.ustc.edu.cn/wiki/server/pxe/faq/ \u5b9e\u5728\u662f\u5e74\u5934\u592a\u4e45\u8fdc\u4e86\uff0c\u65e0\u6cd5\u66f4\u65b0\u3002\u65b0\u7684\u5185\u5bb9\u8bb0\u5f55\u5728\u672c\u6587\u6863\u4e2d\u3002</p> <p>\u4e00\u822c\u7684\u542f\u52a8\u6d41\u7a0b\u662f\uff1a</p> <ol> <li>iPXE\uff0c\u6216\u8005\u4e3b\u677f\u4e0a\u83b7\u53d6\u7684 DHCP \u542f\u52a8\u4fe1\u606f\u7684\u56fa\u4ef6\u4e0b\u8f7d\u5e76\u52a0\u8f7d GRUB \u76f8\u5173\u6587\u4ef6\u3002</li> <li>\u5982\u679c MAC \u5730\u5740\u4e0d\u4e3a\u6307\u5b9a\u503c\uff0c\u90a3\u4e48\u52a0\u8f7d\u83dc\u5355\u5e76\u663e\u793a\uff1b\u7136\u540e\u52a0\u8f7d Linux \u5185\u6838\u4e0e initramfs \u7b49\u4e8b\u9879\u7531 GRUB \u8d1f\u8d23\u3002</li> <li>Initramfs \u4ece\u542f\u52a8\u53c2\u6570\u6302\u8f7d NFS \u4e3a rootfs\uff0c\u8fdb\u884c\u4e0b\u4e00\u6b65\u7684\u542f\u52a8\u3002</li> </ol>"},{"location":"services/pxe/#_1","title":"\u4f7f\u7528/\u8c03\u8bd5","text":"<p>PXE \u5728\u6821\u56ed\u7f51\u4e2d\u76f4\u63a5\u53ef\u7528\uff0c\u56e0\u4e3a\u5b66\u6821\u7684 DHCP \u670d\u52a1\u5668\u7ecf\u8fc7\u4e86\u914d\u7f6e\u3002</p> <p>\u5982\u679c\u9700\u8981\u5728\u865a\u62df\u673a\u4e2d\u8c03\u8bd5\uff0c\u53ef\u4ee5\uff1a</p> <ul> <li>\u4e0b\u8f7d IPXE \u7684 ISO\uff08http://boot.ipxe.org/ipxe.iso\uff09\uff0c\u6302\u8f7d\u5728\u865a\u62df\u673a\u4e2d\u6d4b\u8bd5\u3002</li> <li>\u6216\u8005\u76f4\u63a5\u4f7f\u7528\u6253\u5305\u540e\u7684 ISO\uff1ahttps://ftp.lug.ustc.edu.cn/PXE/image/ustc.ipxe.iso</li> </ul> <p>\u63a8\u8350\u4f7f\u7528\u7684\u865a\u62df\u673a\u65b9\u6848</p> <p>PXE \u80fd\u591f\u6210\u529f\u8fd0\u884c\u4e0e\u5426\u6709\u53ef\u80fd\u548c\u865a\u62df\u673a\u73af\u5883\uff08\u7279\u522b\u662f\u865a\u62df\u7f51\u5361\u578b\u53f7\uff09\u9ad8\u5ea6\u76f8\u5173\u3002\u63a8\u8350\u4f7f\u7528 QEMU\u3002</p> <p>\u5176\u4e2d\u4e3b\u8981\u4f7f\u7528\u7684\u662f\u57fa\u4e8e GRUB2 \u548c simple-pxe \u7684\u65b0 PXE \u65b9\u6848\u3002\u4e3b\u677f\u56fa\u4ef6\u4f7f\u7528 TFTP \u534f\u8bae\u83b7\u53d6 GRUB2 \u7a0b\u5e8f\uff08core.0 \u6216\u8005 core.efi\uff09\u4e4b\u540e\uff0cGRUB2 \u4f1a\u901a\u8fc7 HTTP \u534f\u8bae\u83b7\u53d6\u5269\u4e0b\u6240\u6709\u7684\u6587\u4ef6\u3002</p> <p>TFTP</p> <p>\u548c FTP active \u6a21\u5f0f\u4e00\u6837\uff0cTFTP \u662f\u4e00\u4e2a\u6709\u70b9\u9ebb\u70e6\u7684\u534f\u8bae\uff0c\u5982\u679c\u4f60\u7684\u865a\u62df\u673a\u65e0\u6cd5\u4e0d\u7ecf\u8fc7 NAT \u8fde\u63a5 PXE \u670d\u52a1\u5668\uff0c\u90a3\u4e48\u5c31\u9700\u8981\u8c03\u6574\u7f51\u7edc\u914d\u7f6e\uff0c\u4f1a\u5f88\u9ebb\u70e6\uff0c\u518d\u52a0\u4e0a\u5bf9\u6821\u5916\u8bbf\u95ee\u9700\u6c42\u7684\u8003\u91cf\uff0c\u56e0\u6b64\u76ee\u524d\u7684\u8003\u8651\u662f\u5c3d\u91cf\u4f7f\u7528 HTTP\u3002</p> <p>\u57fa\u4e8e SYSLINUX \u7684\u8001 PXE \u65b9\u6848\uff08lpxelinux.0 -&gt; bin/lpxelinux.0\uff09\u76ee\u524d\u4ecd\u53ef\u542f\u52a8\uff0c\u4f46\u662f\u4e0d\u4f7f\u7528\u3002</p>"},{"location":"services/pxe/#syslinux","title":"SYSLINUX \u66f4\u65b0","text":"<p>\u867d\u7136\u4e0d\u7ef4\u62a4\u4e86\uff0c\u4f46\u662f\u4ee5\u4e0b\u5185\u5bb9\u4ecd\u4f5c\u8bb0\u5f55\uff1a</p> <pre><code>wget https://mirrors.ustc.edu.cn/fedora/releases/40/Everything/x86_64/os/Packages/s/syslinux-tftpboot-6.04-0.26.fc40.noarch.rpm\n# decompress\nrpm2cpio syslinux-tftpboot-6.04-0.26.fc40.noarch.rpm | cpio -idmv\ncd tftpboot\nln -s lpxelinux.0 pxelinux.0\nln -s lpxelinux.0 undionly.kpxe\n</code></pre> <p>\u5f97\u5230\u7684 tftpboot \u76ee\u5f55\u66ff\u4ee3\u539f\u5148\u7684 tftp/bin \u76ee\u5f55\u3002\u542f\u52a8 VM \u7684\u65f6\u5019\u53ef\u4ee5 Wireshark \u770b\u770b\u5b83\u4e0b\u8f7d\u4e86\u54ea\u4e9b\u6587\u4ef6\u3002\u540c\u65f6\u8fd8\u6709\u4e2a <code>pxeknife</code>\uff0c\u76ee\u524d\u53ea\u5728 SYSLINUX \u7684 PXE \u65b9\u6848\u4e2d\u53ef\u7528\u3002</p> <p>pypxe</p> <p>pypxe \u4f3c\u4e4e\u53ea\u5728 SYSLINUX \u65b9\u6848\u4e2d\u4f7f\u7528\u3002</p>"},{"location":"services/pxe/#uefi","title":"\u4f7f\u7528 UEFI \u76f4\u63a5\u542f\u52a8","text":"<p>QEMU \u4e00\u822c\u4f7f\u7528\u7684 UEFI \u56fa\u4ef6 OVMF \u652f\u6301\u76f4\u63a5\u4ece HTTP \u542f\u52a8\u3002\u5728\u5199\u4f5c\u65f6\uff0cArch Linux \u6253\u5305\u7684 OVMF \u6ca1\u7f16\u8bd1\u6b64\u7279\u6027\uff0c\u5176\u4ed6\u7684\u53d1\u884c\u7248\u4e5f\u6709\u53ef\u80fd\u4e0d\u652f\u6301\uff0c\u56e0\u6b64\u9700\u8981\uff1a</p> <ol> <li>\u4ece https://www.kraxel.org/repos/jenkins/edk2/ \u4e0b\u8f7d x64 \u7248\u672c\u7684 rpm \u5e76\u89e3\u538b</li> <li> <p>\u7136\u540e\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u542f\u52a8 QEMU\uff1a</p> <pre><code>qemu-system-x86_64 -L . --bios ../ovmf-x64/OVMF-pure-efi.fd\n</code></pre> <p>\u542f\u52a8\u540e\u9a6c\u4e0a\u6309\u4e0b ESC\uff0c\u8fdb\u5165\u914d\u7f6e\u754c\u9762\uff0c\u7136\u540e\u9605\u8bfb https://github.com/tianocore/tianocore.github.io/wiki/HTTP-Boot \u505a\u8fdb\u4e00\u6b65\u914d\u7f6e\u3002</p> </li> </ol>"},{"location":"services/pxe/#grub2","title":"\u5236\u4f5c GRUB2 \u955c\u50cf","text":"<p>\u65e7\u7248\u672c\u7684 GRUB2 \u53ef\u80fd\u6709 bug\uff08\u4f8b\u5982 https://github.com/ustclug/discussions/issues/456\uff09\uff0c\u56e0\u6b64\u6709\u65f6\u5019\u9700\u8981\u5347\u7ea7\u3002</p> <p>\u66f4\u65b0\u7b56\u7565\u8003\u8651\u4f7f\u7528 Debian stable \u7684 grub2\u3002\u542f\u52a8\u5bb9\u5668\u5e76\u4e14\u5c06\u5916\u9762\u7684\u76ee\u5f55 bind mount\uff1a</p> <pre><code>docker run -it --rm -v $(pwd)/tftp:/srv/tftp ustclug/debian:12\n</code></pre> <p>\u7136\u540e\u5728\u5bb9\u5668\u4e2d\u6267\u884c\uff1a</p> <pre><code>apt update &amp;&amp; apt install grub-common grub-pc grub-efi-amd64-signed\ngrub-mknetdir\ngrub-mkimage -d /usr/lib/grub/i386-pc -O i386-pc-pxe -o /srv/tftp/boot/grub/i386-pc/core.0 -p '(http,202.38.93.94)/boot/tftp/grub/' pxe http\ngrub-mkimage -d /usr/lib/grub/x86_64-efi -O x86_64-efi -o /srv/tftp/boot/grub/x86_64-efi/core.efi -p '(http,202.38.93.94)/boot/tftp/grub/' efinet http\n</code></pre> <p>\u6700\u540e\u4e24\u4e2a <code>grub-mkimage</code> \u662f\u56e0\u4e3a <code>grub-mknetdir</code> \u751f\u6210\u7684\u955c\u50cf\u4f7f\u7528 tftp \u534f\u8bae\uff0c\u5728\u8c03\u8bd5\u65f6\u53ef\u80fd\u4f1a\u6709\u95ee\u9898\u3002\u6211\u4eec\u5e0c\u671b GRUB2 \u80fd\u591f\u5168\u7a0b\u4f7f\u7528 HTTP \u505a\u5269\u4e0b\u7684\u5de5\u4f5c\u3002</p> <p>\u66f4\u6362\u6587\u4ef6\u7684\u65f6\u5019\u522b\u628a\u914d\u7f6e\u8986\u76d6\u4e86\u3002</p>"},{"location":"services/pxe/#ipxe-iso","title":"\u6784\u5efa iPXE ISO","text":"<p>\u53c2\u8003 https://ipxe.org/embed\u3002</p> <pre><code>#!ipxe\n\n# Generated by GPT-4\ndhcp\nset 210:string http://202.38.93.94/boot/tftp/\n\n# UEFI boot?\niseq ${platform} efi &amp;&amp; goto uefi || goto bios\n\n:uefi\necho \"UEFI boot detected\"\nchain ${210:string}bootx64.efi\nexit\n\n:bios\necho \"BIOS boot detected\"\nchain ${210:string}pxelinux.0\nexit\n</code></pre> <p>clone ipxe/ipxe \u4ed3\u5e93\uff0c\u8fdb\u5165 src \u76ee\u5f55\uff0c\u7136\u540e\u6267\u884c\uff1a</p> <pre><code># https://github.com/ipxe/ipxe/pull/50\nmake bin-x86_64-efi/ipxe.efi bin/ipxe.lkrn\n./util/genfsimg -o ustc.ipxe.iso -s ../../ustc.ipxe bin-x86_64-efi/ipxe.efi bin/ipxe.lkrn\n</code></pre>"},{"location":"services/pxe/#_2","title":"\u67b6\u6784","text":"<p>\u65b0 PXE \u65b9\u6848\u7684 HTTP \u670d\u52a1\u5668\u4e3a Apache + Nginx\u3002URL \u4e2d\u7684 boot2 \u5bf9\u5e94 /nfsroot/pxe\u3002</p> <p>\u5904\u7406 web \u670d\u52a1\u5668</p> <p>\u76ee\u524d PXE \u673a\u5668\u7684 web \u670d\u52a1\u5668\u6709\u70b9\u8be1\u5f02\uff0cApache2 \u76d1\u542c 80\uff0cNginx \u76d1\u542c 443\uff0c\u540e\u7eed\u9700\u8981\u8c03\u6574\u5904\u7406\u3002</p> <p>\u6587\u4ef6\u8df3\u8f6c\u914d\u7f6e</p> <p>Apache2 \u4e2d\u914d\u7f6e\u4e86\u4e00\u4e9b alias \u8df3\u8f6c\uff0c\u540c\u6837\u7684\uff0cTFTP \u4e5f\u6709\u7c7b\u4f3c\u7684\u914d\u7f6e\uff08<code>/etc/xinetd.d/tftp</code> \u7684 <code>server_args</code> \u91cc\u9762\u6709 <code>-m /home/pxe/tftp/REMAP</code>\uff09\u3002</p> <p>\u9700\u8981\u68c0\u67e5\u4e00\u81f4\u6027\u3002</p> <p>\u5982\u679c\u51fa\u73b0\u95ee\u9898\u9700\u8981\u8c03\u8bd5\uff0c\u5efa\u8bae\u6293\u5305\uff08\u53ef\u4ee5\u4f7f\u7528 Wireshark \u67e5\u770b TFTP \u6216 HTTP \u534f\u8bae\uff09\u770b\u662f\u5426\u6b63\u5e38\u3002</p> <p>\u6bcf\u5929\u51cc\u6668\uff0cpxe \u7528\u6237\u7684 crontab \u4efb\u52a1\u4f1a\u6267\u884c https://github.com/ustclug/simple-pxe/blob/master/simple-pxe-in-docker\uff08\u6587\u4ef6\u4f4d\u4e8e pxe \u7528\u6237\u7684 home \u4e2d\uff09\uff0c\u5b9e\u73b0 PXE \u76f8\u5173\u6587\u4ef6\u7684\u66f4\u65b0\u3002</p>"},{"location":"services/pxe/#faults","title":"\u6545\u969c","text":"<p>pxe \u670d\u52a1\u5668\u5728\u5347\u7ea7\u5230 Debian Bullseye (11) \u540e\u65e0\u6cd5\u6b63\u5e38\u5f00\u673a\uff0c\u7ecf\u8fc7 GRUB \u8fdb\u5165\u5185\u6838\u540e\u6bcf 5 \u79d2\u5237\u51fa\u4ee5\u4e0b\u4fe1\u606f\uff1a</p> <pre><code>DMAR: DRHD: handling fault status reg 2\nDMAR: [DMA Read] Request device [03:00.0] PASID ffffffff fault addr cb2f0000 [fault reason 06] PTE Read access is not set\nDMAR: DRHD: handling fault status reg 102\n</code></pre> <p>\u7531\u4e8e\u6b64\u65f6\u521a\u5347\u7ea7\u81f3 Debian Bullseye\uff0c\u6240\u4ee5\u7cfb\u7edf\u4ecd\u7136\u4fdd\u7559\u4e86 Debian Buster \u7684 4.19 \u7248\u5185\u6838\u3002\u91cd\u542f\u8fdb\u8be5\u5185\u6838\u53ef\u6b63\u5e38\u542f\u52a8\u5e76\u8fd0\u884c\u670d\u52a1\uff0c\u4f46\u53ea\u8981\u8fdb 5.10 \u7684\u5185\u6838\u5c31\u4f1a\u51fa\u73b0\u4ee5\u4e0a\u9519\u8bef\u3002\u6d4b\u8bd5 Proxmox VE \u63d0\u4f9b\u7684 pve-kernel-5.15 \u4e5f\u662f\u540c\u6837\u95ee\u9898\u3002</p> <p>\u641c\u7d22\u53d1\u73b0\u4e3b\u673a\u4f7f\u7528\u7684 RAID \u5361 PERC H310 \u4e0d\u652f\u6301\u76f4\u901a\uff08IOMMU \u865a\u62df\u5316\uff09\uff0c\u914d\u7f6e GRUB \u52a0\u5165 <code>intel_iommu=off</code> \u540e\u53ef\u4ee5\u6b63\u5e38\u8fdb\u5165 5.10 \u7684\u5185\u6838\uff0c\u4f5c\u4e3a\u89e3\u51b3\u65b9\u6848\u3002</p> \u8c03\u67e5\u7ed3\u679c <p>\u6309\u8bf4 IOMMU\uff08VT-d\uff09\u4e0d\u5e94\u8be5\u9ed8\u8ba4\u542f\u7528\uff0c\u56e0\u6b64\u731c\u6d4b 5.10+ \u7684\u5185\u6838\u4f1a\u4e3b\u52a8\u5c1d\u8bd5\u5f00\u542f IOMMU\uff0c\u5bfc\u81f4 RAID \u5361\u51fa\u9519\u3002</p> <p>\u6bd4\u8f83 <code>/boot/config-4.19.0-18-amd64</code> \u548c <code>/boot/config-5.10.0-11-amd64</code> \u540e\u53d1\u73b0 5.10 \u7248\u7684 config \u591a\u4e86\u4e00\u884c <code>CONFIG_INTEL_IOMMU_DEFAULT_ON_INTGPU_OFF=y</code>\uff0c\u641c\u7d22\u53d1\u73b0 Debian bug #932086\uff0c\u5373 Debian \u9ed8\u8ba4\u5bf9\u9664\u4e86 Intel GPU \u4ee5\u5916\u7684\u8bbe\u5907\u542f\u7528 IOMMU\uff08<code>linux 5.2.9-2</code>\uff09\u3002</p> <p>\u53c2\u8003\u94fe\u63a5\uff1a</p> <ul> <li>DELLR730 server halts during boot-up when \"intel_iommu=on\" parameter is enabled in grub for SRIOV functionality. - Dell Community</li> <li> Dell PowerEdge RAID Controller (PERC) H310, H710, H710P, and H810 - User's Guide\uff08\u7b2c 85 \u9875\uff09</li> </ul>"},{"location":"services/pxe/images/","title":"PXE \u955c\u50cf","text":""},{"location":"services/pxe/images/#uefi-shell","title":"UEFI Shell","text":"<p>https://github.com/ustclug/simple-pxe/blob/master/menu.d/tool.sh</p> <p>\u4f9d\u8d56\u4e8e Arch Linux \u63d0\u4f9b\u7684 EFI \u6587\u4ef6\u3002</p>"},{"location":"services/pxe/images/#memtest86","title":"Memtest86+","text":"<p>https://github.com/memtest86plus/memtest86plus</p> <p>\u6b64\u5916 memtest86 \u6709\u4e2a\u95ed\u6e90\u5b9e\u73b0\uff0c\u4e0d\u8003\u8651\u7ee7\u7eed\u7ef4\u62a4\u3002</p> <p>\u4ee5\u4e0b\u6b65\u9aa4\u53c2\u8003\u4e86 https://gitlab.archlinux.org/archlinux/packaging/packages/memtest86plus/-/blob/main/PKGBUILD?ref_type=heads\u3002</p> <pre><code>git clone https://github.com/memtest86plus/memtest86plus.git\ncd memtest86plus/build64\nmake\n</code></pre> <p>\u5f97\u5230\u7684 <code>memtest.bin</code> \u662f BIOS \u7248\u7684\uff0c<code>memtest.efi</code> \u662f UEFI \u7248\u7684\u3002</p> <p>\u542f\u52a8\u83dc\u5355\uff1ahttps://github.com/ustclug/simple-pxe/blob/master/menu.d/tool.sh\u3002</p>"},{"location":"services/pxe/images/#gparted","title":"GParted","text":"<p>https://github.com/ustclug/simple-pxe/blob/master/menu.d/gparted.sh\u3002</p> <p>\u542f\u52a8\u53c2\u6570\u4e0d\u80fd\u52a0 <code>ip=</code>\uff1ahttps://gitlab.gnome.org/GNOME/gparted/-/issues/141\u3002</p>"},{"location":"services/pxe/liims/","title":"LIIMS","text":"<p>Short for Libray Independent Inquery Machine System.</p> <p>Server: pxe.s.ustclug.org</p> <p>Git Repository:</p> <ul> <li>liimstrap</li> </ul> <p>It is strongly advised to clone liimstrap and read through it when reading this document.</p>"},{"location":"services/pxe/liims/#add-machine","title":"\u542f\u52a8\u914d\u7f6e","text":"<p>\u914d\u7f6e\u6587\u4ef6\u5728 <code>/home/pxe/tftp/grub/grub.cfg.d</code>\uff0c\u82e5\u8981\u5141\u8bb8\u65b0\u673a\u5668\u542f\u52a8 liims \u955c\u50cf\uff0c\u521b\u5efa\u4e00\u4e2a\u7b26\u53f7\u94fe\u63a5\u5230\u5bf9\u5e94\u7684\u914d\u7f6e\u6587\u4ef6\u3002\u4f8b\u5982\uff1a</p> <pre><code>ln -s common_el 02:23:45:67:89:ab\n</code></pre> <p>\u76ee\u524d\u6211\u4eec\u901a\u8fc7\u51e0\u4e2a\u7b26\u53f7\u94fe\u63a5\u5c06\u914d\u7f6e\u6587\u4ef6\u201c\u5206\u7ec4\u201d\uff0cMAC \u5730\u5740\u5bf9\u5e94\u7684\u7b26\u53f7\u94fe\u63a5\u5e94\u8be5\u94fe\u63a5\u5230\u8fd9\u4e9b\u5206\u7ec4\u4e0a\u3002\u5df2\u6709\u7684\u5206\u7ec4\u5982\u4e0b\uff1a</p> <ul> <li><code>common_el</code>\uff1aEL \u5373 East-campus Library\uff08\u4e1c\u56fe\uff09</li> <li><code>common_wl</code>\uff1aWL \u5373 West-campus Library\uff08\u897f\u56fe\uff09</li> <li><code>common_sl</code>\uff1aSL \u5373 South-campus Library\uff08\u5357\u56fe\uff09</li> <li><code>common_iat</code>\uff1aIAT \u5373\u5148\u7814\u9662</li> <li><code>common_gx</code>\uff1aGaoXin \u9ad8\u65b0\u6821\u533a</li> <li><code>test</code>\uff1a\u6d4b\u8bd5\u955c\u50cf</li> </ul> <p>\u9664\u6b64\u4e4b\u5916\uff0c\u8fd8\u9700\u8981\u5728\u67e5\u8be2\u673a\u76d1\u63a7\u7a0b\u5e8f\u4e2d\u6dfb\u52a0\u8be5 MAC \u5730\u5740\uff0c\u89c1\u4e0b\u65b9\u67e5\u8be2\u673a\u76d1\u63a7\u3002</p>"},{"location":"services/pxe/liims/#lib-api","title":"\u4e3a\u56fe\u4e66\u9986\u8001\u5e08\u5f00\u653e\u7684\u63a5\u53e3","text":"<p>\u56fe\u4e66\u9986\u8001\u5e08\u53ef\u4ee5\u901a\u8fc7 SSH \u767b\u5f55\u673a\u5668\u76f4\u63a5\u521b\u5efa\u6240\u9700\u7684\u7b26\u53f7\u94fe\u63a5\uff08\u4f46\u662f\u8fd8\u9700\u8981\u6211\u4eec\u6765\u6539\u76d1\u63a7\u7a0b\u5e8f\u7684 json\uff09\u3002\u76f8\u5173\u914d\u7f6e\u5982\u4e0b\uff1a</p> /etc/sudoers.d/sonnie<pre><code>sonnie ALL=(pxe) NOPASSWD: /home/pxe/tftp/grub/grub.cfg.d/add_host.py *\n</code></pre> /etc/ssh/sshd_config<pre><code>Match User sonnie\n    AllowUsers sonnie\n    PubkeyAuthentication yes\n    AuthorizedKeysFile .ssh/authorized_keys\n</code></pre> <p>/etc/nsswitch.conf</p> <p>\u628a sudoers \u4e00\u884c\u4e2d\u7684 ldap \u79fb\u5230 files \u524d\u9762\u3002</p> <p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b ldap \u5728 files \u540e\u9762\uff0c\u90a3\u4e48\u6765\u81ea LDAP \u7684 sudo rules \u4f1a\u6392\u5728 sudoers \u6587\u4ef6\u4e2d\u7684 rules \u7684\u540e\u9762\uff0c\u800c sudo \u662f\u540e\u9762\u7684\u89c4\u5219\u4f18\u5148\u7ea7\u66f4\u9ad8\uff0c\u4f1a\u5bfc\u81f4\u65e0\u6cd5 NOPASSWD \u8fd0\u884c\u811a\u672c\u3002</p>"},{"location":"services/pxe/liims/#_1","title":"\u542f\u52a8\u955c\u50cf","text":"<p>\u4f4d\u4e8e <code>/home/pxe/nfsroot/&lt;category&gt;/&lt;name&gt;</code>\uff0c\u5176\u4e2d <code>&lt;name&gt;</code> \u5c31\u662f\u955c\u50cf\u540d\u79f0\uff08\u4f8b\u5982 <code>liims160909</code>\uff09\u3002\u76ee\u524d\u6709\u4e24\u79cd\u90e8\u7f72\u65b9\u5f0f\uff1a\u4e00\u79cd\u662f NFS as rootfs\uff0c\u6587\u4ef6\u5939\u4e2d\u5c31\u662f\u6574\u4e2a rootfs\uff0c\u76f4\u63a5\u4fee\u6539\u8fd9\u91cc\u7684\u6587\u4ef6\uff0c\u673a\u5668\u91cd\u542f\u540e\u5c31\u4f1a\u8f7d\u5165\u3002\uff08\u6ce8\u610f\uff1a\u8986\u76d6\u6587\u4ef6\u53ef\u80fd\u5bfc\u81f4\u5df2\u6709\u7684\u673a\u5668\u8fd0\u884c\u9519\u8bef\uff09</p> <p>\u53e6\u4e00\u79cd\u662f\u6253\u5305\u538b\u7f29\u4e3a squashfs\uff0c\u6b64\u65f6\u6587\u4ef6\u5939\u4e0b\u4e09\u4e2a\u6587\u4ef6\u5206\u522b\u4e3a vmlinuz\uff08kernel\uff09, initrd.img \u548c root.sfs\uff08squashfs \u955c\u50cf\uff09\u3002\u5982\u679c\u9700\u8981\u4fee\u6539\uff0c\u53ef\u4ee5\u4f7f\u7528 <code>unsquashfs</code> \u89e3\u538b\u7f29\uff0c\u4fee\u6539\u5b8c\u6210\u540e\u53c2\u8003\u4ed3\u5e93\u4e2d deploy \u6587\u4ef6\u518d\u538b\u7f29\u4e3a squashfs\u3002</p> <p>IP \u767d\u540d\u5355\u91c7\u7528 iptables \u5b9e\u73b0\uff0c\u4fee\u6539 rootfs \u4e0b\u7684 <code>etc/iptables/rules.v4</code> \u548c <code>rules.v6</code> \u53ef\u4fee\u6539\u7b56\u7565\u3002\u6ce8\u610f\uff1a\u9632\u706b\u5899\u7b56\u7565\u4ec5\u5728\u673a\u5668\u542f\u52a8\u65f6\u4f1a\u8f7d\u5165\u4e00\u6b21\u3002</p>"},{"location":"services/pxe/liims/#_2","title":"\u955c\u50cf\u6784\u5efa","text":"<p>\u5907\u6ce8</p> <p>\u6b64\u8282\u7684\u5185\u5bb9\u4ec5\u9002\u7528\u4e8e 2022 \u4e4b\u524d\u7684\u8001\u7248\u672c\uff0c\u65b0\u7248\u672c\u6709\u5173\u6784\u5efa\u3001\u8c03\u8bd5\u7b49\u5185\u5bb9\u8bf7\u76f4\u63a5\u9605\u8bfb liimstrap \u4ed3\u5e93 README\u3002</p> <p>\u4f7f\u7528 liimstrap \u5728 ArchLinux \u4e0b\u8fdb\u884c\u6784\u5efa\uff0cliimstrap \u4f7f\u7528\u65b9\u6cd5\u53c2\u8003\u4ed3\u5e93\u4e2d\u7684\u8bf4\u660e\u3002</p> <p>\u6784\u5efa\u540e\u9700\u8981\u63a8\u9001\u5230\u670d\u52a1\u5668\u4e0a\u7684 <code>/nfsroot/liims</code> \u4e0b\uff0c\u5e76\u8bbe\u7f6e /usr \u7684\u6240\u6709\u8005\u4e3a liims\u3002\u673a\u5668\u7684\u9ed8\u8ba4 pxe \u542f\u52a8\u914d\u7f6e\u5728 <code>/home/pxe/tftp/pxelinux.cfg/</code> \u4e0b</p>"},{"location":"services/pxe/liims/#qemu","title":"\u793a\u4f8b qemu \u8c03\u8bd5\u65b9\u6cd5","text":"<p>\u521b\u5efa\u5e76\u6302\u8f7d\u4e34\u65f6\u955c\u50cf:</p> <pre><code>dd if=/dev/zero of=liims.img bs=4k count=1200000\nmkfs.ext4 liims.img\nmount -o loop liims.img /mnt\n</code></pre> <p>\u5047\u8bbe\u5f53\u524d\u8def\u5f84\u4e3a liimstrap\uff0c\u4fee\u6539 <code>initcpio/mkinitcpio.conf</code>\uff0c\u53bb\u6389 HOOKS \u4e2d\u7684 <code>liims_root</code>\uff0c\u589e\u52a0 <code>block</code>\uff08\u4ec5\u8c03\u8bd5\u65f6\u9700\u8981\uff09\u3002 \u4f7f\u7528 liimstrap \u5236\u4f5c\u955c\u50cf <code>./liimstrap /mnt</code>\u3002\u5b8c\u6210\u540e\u4f7f\u7528 qemu \u6253\u5f00\u8c03\u8bd5:</p> <pre><code>qemu -kernel /mnt/boot/vmlinuz-lts\\\n     -initrd /mnt/boot/initramfs-linux-lts.img\\\n     -hda liims.img\\\n     -netdev user,id=mynet0,net=114.214.188.0/24,dhcpstart=114.214.188.9\\\n     -device i82557a,netdev=mynet0\\\n     -append \"root=/dev/sda rootflags=rw\"\n</code></pre> <p>\u6ce8\uff1a\u5176\u4e2d netdev \u4e2d\u7684 ip \u6bb5\u53ef\u4ee5\u81ea\u7531\u9009\u53d6\uff0c<code>device</code> \u4e2d\u7684\u8bbe\u5907\u540d\u901a\u8fc7 <code>qemu -device \\?</code> \u67e5\u770b\u540e\u9009\u62e9\u4efb\u4e00\u7f51\u7edc\u8bbe\u5907\u5373\u53ef</p>"},{"location":"services/pxe/liims/#monitor","title":"\u67e5\u8be2\u673a\u76d1\u63a7","text":"<p>http://pxe.ustc.edu.cn:3000/</p> <p>2022 \u5e74\u524d\uff0c\u63d0\u4f9b\u670d\u52a1\u7684\u662f\u4e00\u4e2a Docker \u5bb9\u5668\u3002\u5728 iBug \u7528 Go \u91cd\u5199\u4e4b\u540e\uff0c\u76ee\u524d\u76f4\u63a5\u8dd1\u5728 host \u4e0a\u3002</p> <p>\u6dfb\u52a0\u65b0\u673a\u5668</p> <p>\u4fee\u6539 https://github.com/ustclug/liimstrap/blob/master/monitor/clients.json \u540e\uff0c\u5728 pxe \u4e0a clone \u5e76\u5728\u5f53\u524d\u76ee\u5f55 build\u3002\u4f7f\u7528 docker-run-script \u4e2d\u5bf9\u5e94\u811a\u672c\u6267\u884c\u5bb9\u5668\u5373\u53ef\u3002</p> <p>\u4fee\u6539 <code>/etc/liims-monitor/clients.json</code> \u4e4b\u540e <code>systemctl reload liims-monitor.service</code> \u5373\u53ef\u3002</p> /etc/liims-monitor/clients.json<pre><code>{\n    \"name\": \"\u4e1c\u533a\u4e09\u697c\u4e1c01\",\n    \"mac\": \"0223456789ab\"\n}\n</code></pre>"},{"location":"workflow/new-server/","title":"New Server Setup Checklist","text":""},{"location":"workflow/new-server/#ntp-date","title":"NTP Date","text":"<p>Install either <code>chrony</code> or <code>systemd-timesyncd</code>. Usually chrony comes pre-installed so it's easily forgot.</p> <p>Replace the default NTP pool with USTC's NTP server <code>time.ustc.edu.cn</code>, like this:</p> /etc/chrony/chrony.conf<pre><code># Use Debian vendor zone.\n#pool 2.debian.pool.ntp.org iburst\nserver time.ustc.edu.cn iburst\n</code></pre>"},{"location":"workflow/new-server/#time-zone","title":"Time zone","text":"<p>Run <code>dpkg-reconfigure tzdata</code> and select Asia/Shanghai as the timezone. Reboot the server.</p>"},{"location":"workflow/new-server/#use-nft-backend-for-iptables","title":"Use nft-backend for iptables","text":"<pre><code>update-alternatives --set iptables /usr/sbin/iptables-nft\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-nft\n</code></pre>"},{"location":"workflow/new-server/#update-resolvconf","title":"Update resolv.conf","text":""},{"location":"workflow/new-server/#install-console-setup","title":"Install console-setup","text":"<p>This may have already come with the base system. It's more likely missed if the system is installed from scratch (bootstrapped).</p>"},{"location":"workflow/new-vm/","title":"Create new server in LUGi","text":"<p>We no longer have a vSphere cluster, so anything mentioning vSphere is left only for references.</p>"},{"location":"workflow/new-vm/#create-vm-in-vcenter","title":"Create VM in vCenter","text":"<p>vCenter \u5730\u5740\uff1a<code>vcenter2.vm.ustclug.org</code></p> <p>\u6309\u7167\u63d0\u793a\u521b\u5efa\u865a\u62df\u673a</p> <ul> <li>Step 7: Customize hardware<ul> <li>Network:<ul> <li>ustclug: intranet</li> <li>ustclug-bridge: \u6ca1\u6709 MAC \u6e90\u5730\u5740\u68c0\u67e5</li> <li>cernet: \u6559\u80b2\u7f51\uff08\u5148\u9009\u8fd9\u4e2a\uff0c\u4ee5\u4fbf\u4e8e\u901a\u8fc7\u7f51\u7edc\u5b89\u88c5\u7cfb\u7edf\uff09</li> </ul> </li> <li>VM options<ul> <li>VMware Tools<ul> <li>\u6253\u5f00 Sync time with Host</li> </ul> </li> </ul> </li> </ul> </li> </ul>"},{"location":"workflow/new-vm/#install-os-vsphere","title":"Install OS (vSphere)","text":"<p>Note</p> <p>\u5c06\u7f51\u7edc\u6539\u4e3a cernet\uff0c\u4ee5\u4fbf\u7528 DHCP \u83b7\u5f97 IP \u5730\u5740\uff0c\u7528 PXE \u5b89\u88c5\u7cfb\u7edf\u3002</p> <p>\u51e0\u4e2a\u5173\u952e\u914d\u7f6e\uff1a</p> <ul> <li>hostname: \u4e3b\u673a\u540d\uff0c\u5982 vpnhc</li> <li>domain name: \u641c\u7d22\u57df\uff0c\u4e00\u822c\u8bbe\u4e3a s.ustclug.org</li> <li>\u7528\u6237\u8bbe\u7f6e\uff1a\u5148\u8bbe\u7f6e\u4e00\u4e2a\u4e34\u65f6\u7528\u6237\uff08\u5c3d\u91cf\u4e0d\u4e0e\u4e4b\u540e\u8981\u914d\u7f6e\u7684 ldap \u8d26\u53f7\u51b2\u7a81\uff09\uff0c\u7528\u4e8e\u521d\u59cb\u767b\u9646\u914d\u7f6e\uff0c\u4e4b\u540e\u5220\u9664</li> <li>\u78c1\u76d8\u8bbe\u7f6e\uff1a\u4f7f\u7528\u6574\u4e2a\u786c\u76d8\uff0c\u53ea\u7559\u4e00\u4e2a\u4e3b\u5206\u533a\uff0c\u4e0d\u7559 swap \u7b49\u5206\u533a\uff0c\u65b9\u4fbf\u6269\u5bb9</li> </ul>"},{"location":"workflow/new-vm/#create-vm-on-proxmox-ve","title":"Create VM on Proxmox VE","text":"<p>\u6211\u4eec\u76ee\u524d\u4e0d\u4f7f\u7528 PVE \u8fd0\u884c LXC \u5bb9\u5668\uff0c\u56e0\u6b64\u672c\u6587\u6863\u53ea\u4ecb\u7ecd\u521b\u5efa KVM \u865a\u62df\u673a\u7684\u6b65\u9aa4\u3002\u63a8\u8350\u4f7f\u7528 web \u754c\u9762\u64cd\u4f5c\uff0c\u9664\u975e\u4f60\u9700\u8981\u6279\u91cf\u521b\u5efa\u865a\u62df\u673a\uff08\u6b64\u65f6\u901a\u8fc7 SSH \u767b\u5f55\u540e\u53ef\u4ee5\u4f7f\u7528 <code>qm</code> \u547d\u4ee4\u6279\u5904\u7406\uff09\u3002</p> <p>\u767b\u5f55 web \u754c\u9762\uff0c\u70b9\u51fb\u53f3\u4e0a\u89d2\u7684 Create VM\uff0c\u5f39\u51fa\u521b\u5efa\u865a\u62df\u673a\u7684\u5bf9\u8bdd\u6846\u3002</p> General <p>\u6b63\u786e\u9009\u62e9\u865a\u62df\u673a\u6240\u5728\u7684 Node\uff08\u5373 Host\uff09\uff0c\u5e76\u6307\u5b9a\u4e00\u4e2a VMID\u3002\u76ee\u524d VMID \u7684\u5206\u914d\u65b9\u6848\u662f\u4e1c\u56fe 300-399\uff0cNIC 200-299\uff0c\u5728\u6b64\u57fa\u7840\u4e0a\u9012\u589e\u5373\u53ef\u3002\u7ed9 VM \u8d77\u4e2a\u6613\u4e8e\u8fa8\u8bc6\u7684\u540d\u79f0\uff0c\u4e0d\u8981\u4e0e\u5df2\u6709 VM \u91cd\u590d\u3002Resource Pool \u7559\u7a7a\u5373\u53ef\u3002</p> OS <p>\u9664\u975e\u4f60\u8981\u4f7f\u7528 iso \u955c\u50cf\u624b\u52a8\u5b89\u88c5\u7cfb\u7edf\uff0c\u5426\u5219\u8bf7\u9009\u62e9\u300cDo not use any media\u300d\u3002\u6b63\u786e\u9009\u62e9 Guest OS \u7684\u7c7b\u578b\u548c\u7248\u672c\u3002</p> System <p>\u5c06 SCSI Controller \u8bbe\u4e3a VirtIO SCSI\uff08\u6ce8\u610f\u4e0d\u8981\u9009 VirtIO SCSI Single\uff09\uff0c\u52fe\u4e0a Qemu Agent \u9009\u9879\uff0c\u5176\u4ed6\u9009\u9879\u90fd\u9009 Default \u5373\u53ef\u3002</p> Disks, CPU, Memory <p>\u6309\u9700\u5206\u914d\uff0c\u78c1\u76d8\u5bb9\u91cf\u5efa\u8bae\u63a7\u5236\u5728 10 GB \u4ee5\u5185\uff08\u4ec5\u7cfb\u7edf\u76d8\uff0c\u53ef\u53e6\u52a0\u6570\u636e\u76d8\uff09\uff0c\u5176\u4e2d Disk \u52fe\u9009\u4e0a Discard\uff0cCPU Type \u63a8\u8350\u9009\u62e9 Host\u3002</p> Network <p>\u6309\u9700\u9009\u62e9\uff0cModel \u9009 VirtIO\uff0c\u7136\u540e\u53d6\u6d88\u52fe\u9009 Firewall\u3002</p> <p>\u8bb0\u5f97\u5728\u865a\u62df\u673a\u7684 Options \u91cc\u5c06 Start at boot \u8bbe\u4e3a Yes</p> <p>\u5728 Proxmox VE \u4e0a\uff0c\u901a\u8fc7 web \u754c\u9762\u521b\u5efa\u65b0\u865a\u62df\u673a\u540e\uff0c\u53ef\u4ee5\u4f7f\u7528\u666e\u901a\u65b9\u5f0f\u5b89\u88c5\u7cfb\u7edf\uff0c\u4e5f\u53ef\u4ee5\u76f4\u63a5\u5bfc\u5165\u53d1\u884c\u7248\u63d0\u4f9b\u7684\u865a\u62df\u673a\u955c\u50cf\uff08\u9700\u8981\u901a\u8fc7 SSH \u767b\u5f55 Proxmox VE \u6216 NFS \u670d\u52a1\u5668\uff09\u3002</p> <p>\u4e0b\u9762\u4ee5 Debian \u4e3a\u4f8b\uff0c\u521b\u5efa\u4e00\u4e2a\u65b0\u865a\u62df\u673a\uff0c\u7136\u540e\u6253\u5f00 https://mirrors.ustc.edu.cn/debian-cdimage/cloud/bullseye/\uff0c\u70b9\u51fb\u6700\u65b0\u7684\u76ee\u5f55\uff08\u51fa\u4e8e\u672a\u77e5\u539f\u56e0 latest \u94fe\u63a5\u662f\u574f\u7684\uff09\uff0c\u590d\u5236 <code>debian-11-genericcloud-amd64-&lt;date&gt;-&lt;rev&gt;</code> \u7684\u94fe\u63a5\uff08\u63a8\u8350\u4f7f\u7528 genericcloud \u800c\u4e0d\u662f generic\uff0c\u5176\u9884\u88c5 <code>linux-image-cloud-amd64</code>\uff0c\u76f8\u6bd4\u4e8e\u201c\u5b8c\u6574\u7248\u201d\u5185\u6838\u7cbe\u7b80\u6389\u4e86\u5927\u90e8\u5206\u7269\u7406\u8bbe\u5907\u7684\u9a71\u52a8\u7a0b\u5e8f\uff0c\u9002\u7528\u4e8e\u865a\u62df\u673a\u73af\u5883\uff09\uff0c\u7136\u540e\u767b\u5f55 Proxmox VE \u6216 vdp\uff08NFS \u670d\u52a1\u5668\uff09\uff0c\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u76f4\u63a5\u4e0b\u8f7d\u955c\u50cf\u81f3\u865a\u62df\u673a\u78c1\u76d8\uff1a</p> <pre><code># Proxmox VE (ZFS / LVM), use RAW\nwget -O /dev/zvol/rpool/data/vm-&lt;id&gt;-disk-0 https://mirrors.ustc.edu.cn/&lt;...&gt;.raw\nwget -O /dev/&lt;vg&gt;/&lt;lv&gt; https://mirrors.ustc.edu.cn/&lt;...&gt;.raw\n\n# vdp over NFS, use QCOW2\nwget -O /media/vdp/pve/images/&lt;path&gt;.qcow2 https://mirrors.ustc.edu.cn/&lt;...&gt;.qcow2\n</code></pre> <p>\u7136\u540e\u5728 web \u754c\u9762\u6307\u5b9a\u865a\u62df\u673a\u7684\u78c1\u76d8\uff08\u5982\u6709\u9700\u8981\uff09\u3002</p>"},{"location":"workflow/new-vm/#reset-password","title":"Reset password","text":"<p>\u7531\u4e8e Debian \u63d0\u4f9b\u7684 cloud image \u9ed8\u8ba4\u7981\u7528\u4e86 root \u7528\u6237\uff0c\u9700\u8981\u624b\u52a8\u6302\u8f7d\u78c1\u76d8\uff0c\u7f16\u8f91\u78c1\u76d8\u4e2d\u7684 <code>/etc/shadow</code> \u6587\u4ef6\uff0c\u5c06\u7b2c\u4e00\u884c\u7684 <code>root:*:...</code> \u6539\u4e3a <code>root::...</code>\uff08\u5373\u5220\u6389\u661f\u53f7\uff09\u3002\u6ce8\u610f\u4e0d\u8981\u8bef\u6539\u4e3b\u673a\u7684 shadow \u6587\u4ef6\u3002</p> <p>Tip</p> <p>\u6b64\u6b65\u9aa4\u4e5f\u53ef\u4ee5\u66ff\u6362\u4e3a chroot \u8fdb\u53bb\u540e\u4f7f\u7528 <code>passwd</code> \u4fee\u6539\u6216\u6e05\u7a7a\u5bc6\u7801\u3002\u5982\u679c\u4f60\u4e0d\u591f\u719f\u6089 shadow \u6587\u4ef6\u7684\u683c\u5f0f\uff0c\u8fd9\u6837\u505a\u66f4\u5b89\u5168\u3002</p> <p>\u5bf9\u4e8e ZFS \u548c LVM \u5b58\u50a8\u7684\u78c1\u76d8\uff0c\u53ef\u4ee5\u76f4\u63a5\u6302\u8f7d <code>/dev/zvol/&lt;...&gt;</code> \u6216 <code>/dev/&lt;vg&gt;/&lt;lv&gt;</code>\uff08\u4f60\u53ef\u80fd\u9700\u8981\u4f7f\u7528 <code>kpartx</code> \u5de5\u5177\u52a0\u8f7d\u5206\u533a\uff09\u3002\u5bf9\u4e8e Qcow2 \u6587\u4ef6\u7684\u78c1\u76d8\uff0c\u53ef\u4ee5\u53c2\u8003\u8fd9\u4e2a Gist \u4f7f\u7528 <code>qemu-nbd</code> \u5de5\u5177\u6765\u6302\u8f7d\u3002\u5176\u4e2d <code>nbd</code> \u662f Linux \u539f\u751f\u7684\u5185\u6838\u6a21\u5757\uff0c\u53ef\u4ee5\u653e\u5fc3 modprobe\u3002</p> <p>\u4f60\u4e5f\u53ef\u4ee5\u5728\u8fd9\u4e00\u6b65\u540c\u65f6\u4fee\u6539\u522b\u7684\u914d\u7f6e\u6587\u4ef6\uff0c\u4f8b\u5982\u628a <code>/etc/apt/sources.list</code> \u6362\u6389\u7b49\u3002\u4fee\u6539\u5b8c\u6210\u540e\u4e0d\u8981\u5fd8\u8bb0 umount\u3002</p>"},{"location":"workflow/new-vm/#extra-configurations-for-cloud-images","title":"Extra configurations for cloud images","text":"<p>The first two or three boots may hang or end up in kernel panic - this is completely normal. The cloud image will grow the root partition and filesystem to the virtual disk size. After it's all set, purge everything related to <code>cloud-init</code>.</p> <p>For better console experiences, install and configure <code>console-setup</code>, and add <code>vga=792</code> to <code>GRUB_CMDLINE_LINUX</code> in <code>/etc/default/grub</code>. Then run <code>update-grub</code> and reboot.</p>"},{"location":"workflow/new-vm/#configure-network","title":"Configure network","text":"<ul> <li>\u589e\u52a0 hostname.s.ustclug.org \u7684 DNS \u89e3\u6790\u3002\uff08\u6587\u4ef6 <code>db/ustclug/ustclug.intranet</code>\uff09</li> <li>\u5728 vCenter \u4e2d\u66f4\u6539\u7f51\u7edc\u4e3a ustclug \uff08\u5982\u679c\u4e0d\u9700\u8981\u6e90 MAC \u5730\u5740\u68c0\u67e5\uff0c\u9009 ustclug-bridge\uff09</li> <li>\u5728\u865a\u62df\u673a\u4e2d\u91cd\u542f\u7f51\u7edc\u63a5\u53e3\uff0c\u6539\u4e3a\u9759\u6001 IP\uff0c\u5e76\u66f4\u6539\u7f51\u5173 \uff08\u4e1c\u56fe\u865a\u62df\u673a\u8bbe\u7f6e\u4e3a 10.254.0.254\uff0cNIC \u865a\u62df\u673a\u8bbe\u7f6e\u4e3a 10.254.0.245\uff09<ul> <li><code>ifdown -a</code></li> <li>edit <code>/etc/network/interfaces</code></li> <li><code>ifup -a</code></li> </ul> </li> <li>\u66f4\u6539\u865a\u62df\u673a\u7684 DNS \u548c domain/search\uff1a<ul> <li>DNS:<ul> <li>neat-dns (10.254.0.253)</li> <li>dns backup (202.38.93.94)</li> </ul> </li> <li>domain/search:<ul> <li>s.ustclug.org</li> </ul> </li> </ul> </li> </ul>"},{"location":"workflow/new-vm/#install-software","title":"Install software","text":"<ul> <li>\u6839\u636e\u9700\u8981\u6362\u6e90\uff0c\u52a0\u5165\u5b89\u5168\u66f4\u65b0\u6e90\u7b49</li> <li>\u5b89\u88c5\u865a\u62df\u673a\u5de5\u5177<ul> <li>\u5bf9\u4e8e Proxmox VE \u7684\u865a\u62df\u673a\uff1a\u5b89\u88c5 <code>qemu-guest-agent</code></li> <li>\u5bf9\u4e8e VMware vSphere \u7684\u865a\u62df\u673a\uff1a\u5b89\u88c5 <code>open-vm-tools</code></li> </ul> </li> <li>\u5b89\u88c5 <code>ssh</code></li> </ul>"},{"location":"workflow/new-vm/#configure-ldap-and-ssh-ca","title":"Configure LDAP and SSH CA","text":"<p>\u89c1 LDAP \u670d\u52a1\u4f7f\u7528\u53ca\u914d\u7f6e\u8bf4\u660e \u548c \u4e3a\u670d\u52a1\u5668\u8bbe\u7f6e SSH CA</p>"},{"location":"workflow/ldap/add-new-user/","title":"\u5728 LDAP \u4e2d\u6dfb\u52a0\u65b0\u7528\u6237","text":""},{"location":"workflow/ldap/add-new-user/#ldap_1","title":"\u65b0\u5efa LDAP \u7528\u6237","text":"<ol> <li>\u767b\u9646\u7f51\u9875\u754c\u9762</li> <li>Users &gt; Actions &gt; Create &gt; User</li> <li>Generic: \u8f93\u5165 Last name\uff0cFirst name\uff0cLogin\uff08\u767b\u5f55\u540d\uff09</li> <li>POSIX &gt; Generic\uff1a\u8f93\u5165 Home directory\u3002\u4f7f\u7528 Force UID/GID \uff0c\u5177\u4f53\u8bf4\u660e\u8be6\u89c1 LDAP Users \u548c Groups</li> </ol>"},{"location":"workflow/ldap/add-new-user/#ldap_2","title":"\u6dfb\u52a0 LDAP \u7528\u6237\u6743\u9650","text":"<p>POSIX &gt; Group membership &gt; Add\uff1a\u6839\u636e\u9700\u8981\u6dfb\u52a0\u7684\u6743\u9650\u9009\u62e9\u5bf9\u5e94\u7684\u7ec4\uff0c\u5177\u4f53\u8bf4\u660e\u8be6\u89c1 LDAP Users \u548c Groups</p> LDAP \u7f13\u5b58 <p>\u82e5\u53d1\u73b0\u7528\u6237\u65e0\u6cd5\u767b\u9646\u7b49\u60c5\u51b5\uff0c\u53ef\u80fd\u662f\u7f13\u5b58\u670d\u52a1 NSCD \u5bfc\u81f4\u7684\uff0c\u5177\u4f53\u53c2\u8003 LDAP Users \u548c Groups\uff1a</p>"},{"location":"workflow/mirrors/maintenance/","title":"\u5f00\u6e90\u8f6f\u4ef6\u955c\u50cf\u7ad9\u7ef4\u62a4\u65b9\u5f0f","text":"<p>\u79d1\u5927\u5f00\u6e90\u8f6f\u4ef6\u955c\u50cf\u7ad9\u662f LUG \u6700\u91cd\u8981\u7684\u670d\u52a1\u4e4b\u4e00\uff0c\u56e0\u6b64\u7ef4\u62a4\u64cd\u4f5c\u5fc5\u987b\u8c28\u614e\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_2","title":"\u91cd\u542f\u7cfb\u7edf","text":"<p>\u7531\u4e8e mirrors \u670d\u52a1\u91cf\u5927\uff0c\u91cd\u542f\u5e94\u63d0\u524d\u5728 LUG \u670d\u52a1\u5668\u65b0\u95fb\u7ad9 \u53d1\u5e03\u516c\u544a\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_3","title":"\u5b89\u88c5\u66f4\u65b0","text":""},{"location":"workflow/mirrors/maintenance/#_4","title":"\u666e\u901a\u66f4\u65b0","text":"<p>\u591a\u6570\u66f4\u65b0\u53ef\u4ee5\u76f4\u63a5\u4ece apt \u6e90\u5b89\u88c5\uff0c\u4f46\u662f\u90e8\u5206\u8f6f\u4ef6\u5e76\u975e\u6765\u81ea Debian \u5b98\u65b9\u4ed3\u5e93\uff08\u4f8b\u5982 OpenResty\uff09\uff0c\u56e0\u6b64\u66f4\u65b0\u7b56\u7565\u53ef\u80fd\u4e0d\u50cf Debian \u90a3\u4e48\u7a33\u5b9a\u3002\u5982\u679c\u9047\u5230\u63d0\u793a\u914d\u7f6e\u6587\u4ef6\u51b2\u7a81\uff0c\u8bf7\u5c3d\u91cf\u9009\u62e9 3-way merge\uff0c\u5982\u679c\u5931\u8d25\u7684\u8bdd\u53ef\u4ee5\u5148 keep local version\uff0c\u7136\u540e\u624b\u52a8\u89e3\u51b3\u5408\u5e76\u51b2\u7a81\u3002</p>"},{"location":"workflow/mirrors/maintenance/#_5","title":"\u5185\u6838\u66f4\u65b0","text":"<p>mirrors \u4f7f\u7528\u4e86\u5185\u6838\u6a21\u5757\u63d0\u4f9b\u4e00\u4e9b\u529f\u80fd\u652f\u6301\uff0c\u5982 ZFS\u3002\u56e0\u6b64\u53ea\u8981\u66f4\u65b0\u4e86\u5185\u6838\uff0c\u5c31\u4e00\u5b9a\u8981\u6ce8\u610f\u5185\u6838\u6a21\u5757\u662f\u5426\u5b89\u88c5\u6210\u529f\uff0c\u5982\u679c apt \u5b89\u88c5\u5931\u8d25\u53ef\u4ee5\u624b\u52a8\u8fd0\u884c <code>dkms autoinstall</code>\uff0c\u4ee5\u786e\u4fdd\u65b0\u5185\u6838\u91cd\u542f\u65f6\u80fd\u6b63\u786e\u52a0\u8f7d\u5fc5\u987b\u7684\u5185\u6838\u6a21\u5757\u3002</p>"},{"location":"workflow/mirrors/maintenance/#ipmi","title":"IPMI","text":"<p>\u5730\u5740\u6682\u65e0\uff0c\u4e00\u822c\u7528\u6d4f\u89c8\u5668\u76f4\u63a5\u8bbf\u95ee\u5c31\u884c\u4e86\u3002\u5982\u679c\u9700\u8981\u63a5\u5165\u7ec8\u7aef\uff0cDashboard \u5de6\u8fb9\u7684 Remote Control \u6709 Launch \u6309\u94ae\u3002\u5982\u679c\u6d4f\u89c8\u5668\u4e0d\u652f\u6301 Java \u5c31\u4f1a\u4e0b\u8f7d\u4e00\u4e2a <code>jviewer.jnlp</code>\uff0c\u81ea\u884c\u89e3\u51b3 Java \u7684\u5b89\u5168\u8b66\u544a\u5373\u53ef\u4f7f\u7528\u3002</p> <p>\u5f53\u7136\u5982\u679c\u4f1a\u7528 <code>ipmitool</code> \u66f4\u597d\uff0c\u90a3\u8fd9\u4e00\u6bb5\u7684\u8bf4\u660e\u5c31\u4ea4\u7ed9\u4f60\u6765\u8865\u5145\u4e86 :)</p>"},{"location":"workflow/mirrors/maintenance/#ipmitool","title":"<code>ipmitool</code> \u7b80\u4ecb","text":"<p>\u5c3d\u7ba1\u51e0\u4e4e\u6211\u4eec\u673a\u5668\u7684 IPMI \u90fd\u6709 Web \u754c\u9762\uff0c\u4f46\u662f Web \u754c\u9762\u4e0d\u4e00\u5b9a\u9760\u8c31\uff0c\u53ef\u80fd\u4f1a\u51fa\u73b0\u6545\u969c\u3002\u6b64\u65f6\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528 <code>ipmitool</code> \u91cd\u7f6e IPMI \u7684\u72b6\u6001\uff08\u7cfb\u7edf\u914d\u7f6e\u4e0d\u4f1a\u6539\u53d8\uff09</p> <p>\u53c2\u8003\u547d\u4ee4\uff1a</p> <pre><code># \u4e00\u90e8\u5206 IPMI \u7684 interface \u662f lanplus \u800c\u4e0d\u662f lan\uff0c\u6bd4\u5982\u8bf4 mirrors3\nipmitool -I lan -H IPMI\u7684IP -U \u7528\u6237\u540d -a mc reset cold\n</code></pre> <p>\u5177\u4f53\u8be6\u60c5\u53ef\u4ee5\u770b <code>ipmitool</code> \u7684 manpage\u3002</p> <p>\u53e6\u5916:</p> <ul> <li>\u636e\u8bf4\u8fd8\u53ef\u4ee5\u7528\u5b83\u8bbe\u7f6e\u4e32\u53e3\u8f93\u51fa\u4ece\u800c\u5b9e\u73b0\u7c7b\u4f3c KVM \u7684\u6548\u679c\uff0c\u4f46\u662f\u6ca1\u6709\u6d4b\u8bd5\u8fc7\uff0c\u4e5f\u4e0d\u77e5\u9053\u5982\u4f55\u5b9e\u73b0\u3002</li> <li>mirrors3 \u7684 IPMI (iDRAC) \u662f broken \u7684\uff0c\u5c31\u7b97 reset cold \u4e86\u4e5f\u6ca1\u7528\u3002</li> </ul>"}]}
\ No newline at end of file