# Install ## debian 13 ### vps provider debian 10 install default root: ``` 8txlD7djkkKk ``` Good catch 👍 — you’re right. Debian 11 _Bullseye_ moved from the **main mirrors** to the **Debian archive repository** after its LTS phase ended in 2026. That means: - You **can still upgrade** from Debian 10 → 11 → 12 → 13, - But for Debian 11 you’ll need to point your `sources.list` to the **archive.debian.org** service, since the normal `deb.debian.org` no longer carries Bullseye. --- ## 🔧 How to Handle Missing Debian 11 (Bullseye) Repos When upgrading **Debian 10 → 11**, change your `/etc/apt/sources.list` to use the archive: ```bash sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list sed -i 's|security.debian.org|archive.debian.org|g' /etc/apt/sources.list ``` Then explicitly set it to Bullseye: ``` deb http://archive.debian.org/debian bullseye main contrib non-free deb http://archive.debian.org/debian-security bullseye-security main contrib non-free ``` ⚠️ Important: you also need to **disable `Valid-Until` checks** (since archive metadata is old). Add this to `/etc/apt/apt.conf.d/99no-check-valid-until`: ``` Acquire::Check-Valid-Until "false"; ``` After that, `apt update` will work again for Debian 11 packages. --- ## 🔄 Recommended Path - **Debian 10 → Debian 11 (Bullseye)** using `archive.debian.org` - **Debian 11 → Debian 12 (Bookworm)** switch back to `deb.debian.org` - **Debian 12 → Debian 13 (Trixie)** upgrade normally from main repos --- ## ⚠️ Alternative Approach (Skip Hop?) Some admins **reinstall instead of multi-hop upgrades** when they’re more than 2 releases behind. It’s often faster and cleaner to install Debian 13 fresh and migrate configs/data. --- 👉 Do you want me to prepare the **exact `sources.list` entries** for each step (10 → 11, 11 → 12, 12 → 13), so you can just copy-paste them before each upgrade? ## traefik ```compose.yml services: 10:47:35 [24/1240] traefik: image: traefik:v3.4 container_name: traefik restart: unless-stopped security_opt: - no-new-privileges:true networks: [traefik] ports: - "80:80" - "443:443" - "8080:8080" # dashboard volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - ./letsencrypt:/letsencrypt - ./dynamic:/dynamic:ro command: # Entrypoints - "--entrypoints.web.address=:80" - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--entrypoints.web.http.redirections.entrypoint.permanent=true" - "--entrypoints.websecure.address=:443" - "--entrypoints.websecure.http.tls=true" # Providers - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--providers.docker.network=traefik" - "--providers.file.directory=/dynamic" - "--providers.file.watch=true" # Let's Encrypt (ACME) - "--certificatesresolvers.letsencrypt.acme.email=admin@windy.me" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" # Dashboard - "--api.dashboard=true" - "--api.insecure=false" # Logging - "--log.level=INFO" - "--accesslog=true" # Metrics (optional) - "--metrics.prometheus=true" labels: - "traefik.enable=true" - "traefik.http.routers.dashboard.rule=Host(`npm.chans.xyz`)" - "traefik.http.routers.dashboard.entrypoints=websecure" - "traefik.http.routers.dashboard.service=api@internal" - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt" - "traefik.http.routers.dashboard.middlewares=dashboard-auth@docker" - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$wrhTVUaG$$tcchNFj..." networks: traefik: external: true ``` dashboard user and pass ``` Ahku+eRei_chu3ah ``` ``` htpasswd -nb windy "Ahku+eRei_chu3ah" ``` ``` windy:$apr1$wrhTVUaG$tcchNFj.yyA3OpK8f9XnA. ``` ## 一步改成 MASTER 执行以下命令即可统一切换类型： ``` docker compose exec -T db psql -U pdns -d pdns -c "UPDATE domains SET type='MASTER';" ``` 执行完，再确认： ``` docker compose exec -T db psql -U pdns -d pdns -c "SELECT id, name, type FROM domains ORDER BY name;" ``` 应输出： ``` id | name | type ----+-----------+--------- 7 | chans.xyz | MASTER 9 | windy.me | MASTER 8 | wsvc.info | MASTER (3 rows) ``` --- ## ✅ 一、明确两种元数据的作用 |kind|作用|主节点是否需要| |---|---|---| |`PRESIGNED`|表示该 zone 的 DNSSEC 已经签好，不需要 PowerDNS 重新签名|✅ 需要保留| |`AXFR-MASTER-TSIG`|从节点用来验证上游 master（旧主）的 TSIG 密钥|❌ 主节点不需要| --- ## 🧹 二、删除无用的 `AXFR-MASTER-TSIG` 记录 执行： ```bash docker compose exec -T db psql -U pdns -d pdns -c "DELETE FROM domainmetadata WHERE kind='AXFR-MASTER-TSIG';" ``` 验证删除结果： ```bash docker compose exec -T db psql -U pdns -d pdns -c "SELECT domain_id, kind, content FROM domainmetadata;" ``` 应该只剩： ``` domain_id | kind | content ------------+------------+--------- 7 | PRESIGNED | 1 8 | PRESIGNED | 1 9 | PRESIGNED | 1 (3 rows) ``` --- ## 🧩 三、保留 `PRESIGNED`（不要删） 这三条 `PRESIGNED` 的存在说明你的 zone 已经是“预签名区”， 也就是在数据库里已经有 DNSKEY、RRSIG、NSEC/NSEC3 等签名记录， PowerDNS 不会去重新签名，非常正确 ✅ --- ## 🧰 四、确保 `supermasters` 已清空（如果还没执行） ```bash docker compose exec -T db psql -U pdns -d pdns -c "TRUNCATE TABLE supermasters;" ``` --- ## 🚀 五、重启 PDNS 并验证主节点状态 ```bash docker compose exec auth pdnsutil list-all-zones docker compose exec auth pdnsutil check-all-zones ``` 预期输出： ``` Zone "chans.xyz." (MASTER) Zone "windy.me." (MASTER) Zone "wsvc.info." (MASTER) All zones OK ``` --- ## ✅ 六、总结（当前应保留状态） |表|应保留内容|已处理状态| |---|---|---| |domains|type=MASTER|✅| |domainmetadata|仅 `PRESIGNED`|🧹 已清理| |supermasters|空表|✅| |records / cryptokeys / tsigkeys|原样保留|✅| --- 如果你愿意，我可以帮你生成一个命令脚本，一次性完成： - 把所有域设为 MASTER - 删除 AXFR/MASTER 相关 metadata - 清空 supermasters - 验证 zone 状态 你只需执行一条命令即可让任何副节点快照变主节点。是否要我生成？ ``` docker compose exec auth pdnsutil metadata set wsvc.info ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set windy.me ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set chans.xyz ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set wsvc.info TSIG-ALLOW-AXFR "mykey." Set 'wsvc.info' meta TSIG-ALLOW-AXFR = mykey. docker compose exec auth pdnsutil metadata set windy.me TSIG-ALLOW-AXFR "mykey." Set 'windy.me' meta TSIG-ALLOW-AXFR = mykey. docker compose exec auth pdnsutil metadata set chans.xyz TSIG-ALLOW-AXFR "mykey." Set 'chans.xyz' meta TSIG-ALLOW-AXFR = mykey. docker compose exec auth pdns_control notify windy.me docker compose exec auth pdns_control notify chans.xyz docker compose exec auth pdns_control notify wsvc.info ``` db-init/01-init.sh ```bash #!/bin/bash set -e echo "🔧 Creating PowerDNS role and databases..." psql -v ON_ERROR_STOP=1 --username "$PGUSER" <<-'EOSQL' DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'pdns') THEN CREATE USER pdns WITH PASSWORD 'windyboy'; END IF; END $$; EOSQL for dbname in pdns pdnsadmin; do if ! psql -tAc "SELECT 1 FROM pg_database WHERE datname='${dbname}'" | grep -q 1; then echo "🆕 Creating database ${dbname} owned by pdns" psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" -c "CREATE DATABASE ${dbname} OWNER pdns;" else echo "✅ Database ${dbname} already exists" fi done echo "✅ Initialization finished." ``` ``` for z in windy.me chans.xyz wsvc.info; do docker compose exec auth pdnsutil zone unset-presigned $z docker compose exec auth pdnsutil zone secure $z docker compose exec auth pdnsutil zone rectify $z done ``` ``` docker compose exec auth pdnsutil zone list-all | while read z; do docker compose exec auth pdnsutil zone list "$z" > "auth/export/$z.zone" done ``` ``` labels: - "traefik.enable=true" - "traefik.http.routers.pgweb.rule=Host(`pgweb.wsvc.info`)" - "traefik.http.routers.pgweb.entrypoints=websecure" - "traefik.http.routers.pgweb.tls.certresolver=letsencrypt" - "traefik.http.services.pgweb.loadbalancer.server.port=8081" ``` ## AdGuard Home ```bash htpasswd -B -C 10 -n -b zhiqiang 6kjmnGwseQ3jlsW1 ``` ``` zhiqiang:$2y$10$IMskdbhx33L.L1TVptYad.4AhV4eQUy121/UtzwjXTR/Qa6eUUpHa ```