Optimize Personal folder: remove empty files and flatten nested paths
Deleted 7 empty/meaningless files with no useful content. Flattened 7 redundant nested directory structures (VPS/VPS, Cooking/Cooking, Gaming/Game, Mobile/Phone, Obsidian/Obsidian Theme, PARA/PARA Starter Kit, Resume/resume) to simplify navigation and reduce path complexity. (vault changes by Claude Code)
This commit is contained in:
zhiqiang feng
+362
@@ -0,0 +1,362 @@
|
||||
|
||||
|
||||
# Install
|
||||
|
||||
|
||||
## debian 13
|
||||
### vps provider debian 10 install
|
||||
|
||||
default root:
|
||||
```
|
||||
8txlD7djkkKk
|
||||
```
|
||||
|
||||
Good catch 👍 — you’re right.
|
||||
Debian 11 _Bullseye_ moved from the **main mirrors** to the **Debian archive repository** after its LTS phase ended in 2026. That means:
|
||||
|
||||
- You **can still upgrade** from Debian 10 → 11 → 12 → 13,
|
||||
|
||||
- But for Debian 11 you’ll need to point your `sources.list` to the **archive.debian.org** service, since the normal `deb.debian.org` no longer carries Bullseye.
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 🔧 How to Handle Missing Debian 11 (Bullseye) Repos
|
||||
|
||||
When upgrading **Debian 10 → 11**, change your `/etc/apt/sources.list` to use the archive:
|
||||
|
||||
```bash
|
||||
sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list
|
||||
sed -i 's|security.debian.org|archive.debian.org|g' /etc/apt/sources.list
|
||||
```
|
||||
|
||||
Then explicitly set it to Bullseye:
|
||||
|
||||
```
|
||||
deb http://archive.debian.org/debian bullseye main contrib non-free
|
||||
deb http://archive.debian.org/debian-security bullseye-security main contrib non-free
|
||||
```
|
||||
|
||||
⚠️ Important: you also need to **disable `Valid-Until` checks** (since archive metadata is old). Add this to `/etc/apt/apt.conf.d/99no-check-valid-until`:
|
||||
|
||||
```
|
||||
Acquire::Check-Valid-Until "false";
|
||||
```
|
||||
|
||||
After that, `apt update` will work again for Debian 11 packages.
|
||||
|
||||
---
|
||||
|
||||
## 🔄 Recommended Path
|
||||
|
||||
- **Debian 10 → Debian 11 (Bullseye)**
|
||||
using `archive.debian.org`
|
||||
|
||||
- **Debian 11 → Debian 12 (Bookworm)**
|
||||
switch back to `deb.debian.org`
|
||||
|
||||
- **Debian 12 → Debian 13 (Trixie)**
|
||||
upgrade normally from main repos
|
||||
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Alternative Approach (Skip Hop?)
|
||||
|
||||
Some admins **reinstall instead of multi-hop upgrades** when they’re more than 2 releases behind.
|
||||
It’s often faster and cleaner to install Debian 13 fresh and migrate configs/data.
|
||||
|
||||
---
|
||||
|
||||
👉 Do you want me to prepare the **exact `sources.list` entries** for each step (10 → 11, 11 → 12, 12 → 13), so you can just copy-paste them before each upgrade?
|
||||
|
||||
|
||||
|
||||
|
||||
## traefik
|
||||
|
||||
```compose.yml
|
||||
services: 10:47:35 [24/1240]
|
||||
traefik:
|
||||
image: traefik:v3.4
|
||||
container_name: traefik
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
networks: [traefik]
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "8080:8080" # dashboard
|
||||
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./letsencrypt:/letsencrypt
|
||||
- ./dynamic:/dynamic:ro
|
||||
|
||||
command:
|
||||
# Entrypoints
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--entrypoints.websecure.http.tls=true"
|
||||
|
||||
# Providers
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=traefik"
|
||||
- "--providers.file.directory=/dynamic"
|
||||
- "--providers.file.watch=true"
|
||||
|
||||
# Let's Encrypt (ACME)
|
||||
- "--certificatesresolvers.letsencrypt.acme.email=admin@windy.me"
|
||||
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
||||
|
||||
# Dashboard
|
||||
- "--api.dashboard=true"
|
||||
- "--api.insecure=false"
|
||||
|
||||
# Logging
|
||||
- "--log.level=INFO"
|
||||
- "--accesslog=true"
|
||||
|
||||
# Metrics (optional)
|
||||
- "--metrics.prometheus=true"
|
||||
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dashboard.rule=Host(`npm.chans.xyz`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.dashboard.middlewares=dashboard-auth@docker"
|
||||
- "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$wrhTVUaG$$tcchNFj..."
|
||||
|
||||
networks:
|
||||
traefik:
|
||||
external: true
|
||||
|
||||
```
|
||||
|
||||
|
||||
dashboard user and pass
|
||||
|
||||
```
|
||||
Ahku+eRei_chu3ah
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
htpasswd -nb windy "Ahku+eRei_chu3ah"
|
||||
```
|
||||
|
||||
```
|
||||
windy:$apr1$wrhTVUaG$tcchNFj.yyA3OpK8f9XnA.
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 一步改成 MASTER
|
||||
|
||||
执行以下命令即可统一切换类型：
|
||||
|
||||
```
|
||||
docker compose exec -T db psql -U pdns -d pdns -c "UPDATE domains SET type='MASTER';"
|
||||
```
|
||||
|
||||
|
||||
执行完，再确认：
|
||||
|
||||
```
|
||||
docker compose exec -T db psql -U pdns -d pdns -c "SELECT id, name, type FROM domains ORDER BY name;"
|
||||
```
|
||||
|
||||
应输出：
|
||||
|
||||
```
|
||||
id | name | type ----+-----------+--------- 7 | chans.xyz | MASTER 9 | windy.me | MASTER 8 | wsvc.info | MASTER (3 rows)
|
||||
```
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
## ✅ 一、明确两种元数据的作用
|
||||
|
||||
|kind|作用|主节点是否需要|
|
||||
|---|---|---|
|
||||
|`PRESIGNED`|表示该 zone 的 DNSSEC 已经签好，不需要 PowerDNS 重新签名|✅ 需要保留|
|
||||
|`AXFR-MASTER-TSIG`|从节点用来验证上游 master（旧主）的 TSIG 密钥|❌ 主节点不需要|
|
||||
|
||||
---
|
||||
|
||||
## 🧹 二、删除无用的 `AXFR-MASTER-TSIG` 记录
|
||||
|
||||
执行：
|
||||
|
||||
```bash
|
||||
docker compose exec -T db psql -U pdns -d pdns -c "DELETE FROM domainmetadata WHERE kind='AXFR-MASTER-TSIG';"
|
||||
```
|
||||
|
||||
验证删除结果：
|
||||
|
||||
```bash
|
||||
docker compose exec -T db psql -U pdns -d pdns -c "SELECT domain_id, kind, content FROM domainmetadata;"
|
||||
```
|
||||
|
||||
应该只剩：
|
||||
|
||||
```
|
||||
domain_id | kind | content
|
||||
------------+------------+---------
|
||||
7 | PRESIGNED | 1
|
||||
8 | PRESIGNED | 1
|
||||
9 | PRESIGNED | 1
|
||||
(3 rows)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🧩 三、保留 `PRESIGNED`（不要删）
|
||||
|
||||
这三条 `PRESIGNED` 的存在说明你的 zone 已经是“预签名区”，
|
||||
也就是在数据库里已经有 DNSKEY、RRSIG、NSEC/NSEC3 等签名记录，
|
||||
PowerDNS 不会去重新签名，非常正确 ✅
|
||||
|
||||
---
|
||||
|
||||
## 🧰 四、确保 `supermasters` 已清空（如果还没执行）
|
||||
|
||||
```bash
|
||||
docker compose exec -T db psql -U pdns -d pdns -c "TRUNCATE TABLE supermasters;"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🚀 五、重启 PDNS 并验证主节点状态
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil list-all-zones
|
||||
docker compose exec auth pdnsutil check-all-zones
|
||||
```
|
||||
|
||||
预期输出：
|
||||
|
||||
```
|
||||
Zone "chans.xyz." (MASTER)
|
||||
Zone "windy.me." (MASTER)
|
||||
Zone "wsvc.info." (MASTER)
|
||||
All zones OK
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ✅ 六、总结（当前应保留状态）
|
||||
|
||||
|表|应保留内容|已处理状态|
|
||||
|---|---|---|
|
||||
|domains|type=MASTER|✅|
|
||||
|domainmetadata|仅 `PRESIGNED`|🧹 已清理|
|
||||
|supermasters|空表|✅|
|
||||
|records / cryptokeys / tsigkeys|原样保留|✅|
|
||||
|
||||
---
|
||||
|
||||
如果你愿意，我可以帮你生成一个命令脚本，一次性完成：
|
||||
|
||||
- 把所有域设为 MASTER
|
||||
|
||||
- 删除 AXFR/MASTER 相关 metadata
|
||||
|
||||
- 清空 supermasters
|
||||
|
||||
- 验证 zone 状态
|
||||
|
||||
|
||||
你只需执行一条命令即可让任何副节点快照变主节点。是否要我生成？
|
||||
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set windy.me ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz ALLOW-AXFR-FROM "202.91.35.141"
|
||||
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info TSIG-ALLOW-AXFR "mykey."
|
||||
Set 'wsvc.info' meta TSIG-ALLOW-AXFR = mykey.
|
||||
docker compose exec auth pdnsutil metadata set windy.me TSIG-ALLOW-AXFR "mykey."
|
||||
Set 'windy.me' meta TSIG-ALLOW-AXFR = mykey.
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz TSIG-ALLOW-AXFR "mykey."
|
||||
Set 'chans.xyz' meta TSIG-ALLOW-AXFR = mykey.
|
||||
|
||||
docker compose exec auth pdns_control notify windy.me
|
||||
docker compose exec auth pdns_control notify chans.xyz
|
||||
docker compose exec auth pdns_control notify wsvc.info
|
||||
|
||||
```
|
||||
|
||||
db-init/01-init.sh
|
||||
|
||||
```bash
|
||||
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
echo "🔧 Creating PowerDNS role and databases..."
|
||||
|
||||
psql -v ON_ERROR_STOP=1 --username "$PGUSER" <<-'EOSQL'
|
||||
DO $$
|
||||
BEGIN
|
||||
IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'pdns') THEN
|
||||
CREATE USER pdns WITH PASSWORD 'windyboy';
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
EOSQL
|
||||
|
||||
for dbname in pdns pdnsadmin; do
|
||||
if ! psql -tAc "SELECT 1 FROM pg_database WHERE datname='${dbname}'" | grep -q 1; then
|
||||
echo "🆕 Creating database ${dbname} owned by pdns"
|
||||
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" -c "CREATE DATABASE ${dbname} OWNER pdns;"
|
||||
else
|
||||
echo "✅ Database ${dbname} already exists"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "✅ Initialization finished."
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
for z in windy.me chans.xyz wsvc.info; do
|
||||
docker compose exec auth pdnsutil zone unset-presigned $z
|
||||
docker compose exec auth pdnsutil zone secure $z
|
||||
docker compose exec auth pdnsutil zone rectify $z
|
||||
done
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker compose exec auth pdnsutil zone list-all | while read z; do
|
||||
docker compose exec auth pdnsutil zone list "$z" > "auth/export/$z.zone"
|
||||
done
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.pgweb.rule=Host(`pgweb.wsvc.info`)"
|
||||
- "traefik.http.routers.pgweb.entrypoints=websecure"
|
||||
- "traefik.http.routers.pgweb.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.pgweb.loadbalancer.server.port=8081"
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user