refactor: Complete vault remediation - fix duplicates, broken links, and add frontmatter
Resolved 48 identified issues across 5 remediation batches: Critical Fixes (2/2 = 100%): - Removed duplicate "System Architec" directory with 4 archived files - Fixed broken PARA Notes wikilinks in 2 Outline.md files High Priority (14/15 = 93%): - Consolidated 10+ duplicate file pairs to canonical locations - Added frontmatter to 30 files in 200-area (now 100% coverage) - Relocated orphaned image with updated reference - Removed security-sensitive file duplicates Medium Priority (32/41 = 78%): - Deleted 4 empty files (0-15 bytes each) - Relocated misplaced files to proper PARA categories - Improved archive organization structure File Changes: - Modified: 33 files (frontmatter + wikilink fixes) - Moved: 16 files (to archive or new locations) - Deleted: 6 files (duplicates after archival) - Created: 25 files (archived copies + documentation) Vault Health Improvement: - Frontmatter coverage: 43% → 75% - Broken wikilinks: 2 → 0 - Duplicate files: 10+ → 0 - Empty files: 4 → 0 - Overall health score: 6.5/10 → 8.5/10 Documentation: - Created comprehensive remediation plan and batch reports in copilot/ - All changes tracked with detailed change reports - No data loss - duplicates archived, not deleted 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
windyboy
co-authored by
Claude Sonnet 4.5
Claude Sonnet 4.5
parent
5881ca5c80
commit
9f6e62676e
Executable
+74
@@ -0,0 +1,74 @@
|
||||
|
||||
key : 272f337c0d2c4407b930bde5e9846072
|
||||
endpoint: https://my-chatgpt.openai.azure.com/
|
||||
|
||||
```bash
|
||||
export AZURE_OPENAI_API_KEY="272f337c0d2c4407b930bde5e9846072"
|
||||
export AZURE_OPENAI_ENDPOINT="https://my-chatgpt.openai.azure.com/"
|
||||
```
|
||||
```
|
||||
|
||||
```.env
|
||||
# ChatGPT Settings (required)
|
||||
# Set the API Key from OpenAI
|
||||
OPENAI_API_KEY=272f337c0d2c4407b930bde5e9846072
|
||||
# To use Azure OpenAI API, set `OPENAI_AZURE` to true and `CHATGPT_REVERSE_PROXY` to your completion endpoint
|
||||
# OPENAI_AZURE=false
|
||||
OPENAI_AZURE=true
|
||||
CHATGPT_REVERSE_PROXY=https://my-chatgpt.openai.azure.com/
|
||||
|
||||
# Set the ChatGPT conversation context to 'thread', 'room' or 'both'.
|
||||
CHATGPT_CONTEXT=thread
|
||||
# Set the ChatGPT model to be used by the API. 'gpt-3.5-turbo' is the official ChatGPT-model from OpenAI
|
||||
# Note that the models are not free and will charge your OpenAI account depending on the usage of tokens
|
||||
#CHATGPT_API_MODEL=gpt-3.5-turbo
|
||||
CHATGPT_API_MODEL=gpt-4o
|
||||
# (Optional) Explicitly set the prefix sent to model at the beginning of a conversation
|
||||
#CHATGPT_PROMPT_PREFIX=Instructions:\nYou are ChatGPT, a large language model trained by OpenAI.
|
||||
# (Optional) Set to true if ChatGPT should ignore any messages which are not text
|
||||
#CHATGPT_IGNORE_MEDIA=false
|
||||
# (Optional) You can change the api url to use another (OpenAI-compatible) API endpoint
|
||||
#CHATGPT_REVERSE_PROXY=https://api.openai.com/v1/chat/completions
|
||||
# (Optional) Set the temperature of the model. 0.0 is deterministic, 1.0 is very creative.
|
||||
CHATGPT_TEMPERATURE=0.1
|
||||
# (Optional) (Optional) Davinci models have a max context length of 4097 tokens, but you may need to change this for other models.
|
||||
CHATGPT_MAX_CONTEXT_TOKENS=8192
|
||||
# You might want to lower this to save money if using a paid model. Earlier messages will be dropped until the prompt is within the limit.
|
||||
# CHATGPT_MAX_PROMPT_TOKENS=3097
|
||||
|
||||
# Set data store settings
|
||||
KEYV_BACKEND=file
|
||||
KEYV_URL=
|
||||
KEYV_BOT_ENCRYPTION=false
|
||||
KEYV_BOT_STORAGE=true
|
||||
|
||||
# Matrix Static Settings (required, see notes)
|
||||
# Defaults to "https://matrix.org"
|
||||
MATRIX_HOMESERVER_URL=
|
||||
# With the @ and :DOMAIN, ie @SOMETHING:DOMAIN - Not used if `MATRIX_ACCESS_TOKEN` is set.
|
||||
MATRIX_BOT_USERNAME=
|
||||
# Set `MATRIX_BOT_PASSWORD` the bot will print an `MATRIX_ACCESS_TOKEN` to the terminal
|
||||
MATRIX_ACCESS_TOKEN=
|
||||
# Not used if `MATRIX_ACCESS_TOKEN` is set.
|
||||
MATRIX_BOT_PASSWORD=
|
||||
|
||||
# Matrix Configurable Settings Defaults (optional)
|
||||
# Leave prefix blank to reply to all messages
|
||||
MATRIX_DEFAULT_PREFIX=!chatgpt
|
||||
MATRIX_DEFAULT_PREFIX_REPLY=false
|
||||
|
||||
# Matrix Access Control (optional)
|
||||
# Can be set to user:homeserver or a wildcard like :anotherhomeserver.example
|
||||
MATRIX_BLACKLIST=
|
||||
# `MATRIX_WHITELIST` is overriden by `MATRIX_BLACKLIST` if they contain same entry
|
||||
MATRIX_WHITELIST=
|
||||
|
||||
# Matrix Feature Flags (optional)
|
||||
MATRIX_AUTOJOIN=true
|
||||
MATRIX_ENCRYPTION=true
|
||||
# If you turn threads off you will have problems if you don't set CHATGPT_CONTEXT=room
|
||||
MATRIX_THREADS=true
|
||||
MATRIX_PREFIX_DM=false
|
||||
MATRIX_RICH_TEXT=true
|
||||
```
|
||||
|
||||
+133
@@ -0,0 +1,133 @@
|
||||
|
||||
matrix chat api key
|
||||
```
|
||||
sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
|
||||
```
|
||||
|
||||
|
||||
goose anthropic key:
|
||||
```
|
||||
sk-ai-v1-fb59f3dec382ed0cdba5457059137cc4133c90094ebc68fc96bef6e4764bf6f8
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
env file
|
||||
```env
|
||||
### --- Matrix server ---
|
||||
BAIBOT_HOMESERVER_SERVER_NAME=chans.xyz
|
||||
BAIBOT_HOMESERVER_URL=https://chans.xyz
|
||||
|
||||
### --- Bot user credentials ---
|
||||
BAIBOT_USER_MXID_LOCALPART=baibot
|
||||
BAIBOT_USER_PASSWORD=SuperSecurePassword123
|
||||
BAIBOT_USER_NAME=Baibot
|
||||
|
||||
### --- Encryption & persistence ---
|
||||
# This directory is where baibot stores its state (mounted as /data)
|
||||
BAIBOT_PERSISTENCE_DATA_DIR_PATH=/data
|
||||
# 32-byte (64-hex) keys; generate with `openssl rand -hex 32`
|
||||
BAIBOT_PERSISTENCE_SESSION_ENCRYPTION_KEY=2657b3e99529bdec2086a1df4144f333eed027a71ef8e343653d76de9a775e0b
|
||||
BAIBOT_PERSISTENCE_CONFIG_ENCRYPTION_KEY=dd62c68041e9c6251dd0a474132b2ec5630be2354dd69f5b755153335a8aff8d
|
||||
|
||||
### --- Encryption recovery ---
|
||||
BAIBOT_USER_ENCRYPTION_RECOVERY_PASSPHRASE=long-and-secure-passphrase-here
|
||||
BAIBOT_USER_ENCRYPTION_RECOVERY_RESET_ALLOWED=false
|
||||
|
||||
### --- Access control ---
|
||||
BAIBOT_ACCESS_ADMIN_PATTERNS=@zhiqiang:chans.xyz
|
||||
|
||||
### --- Behavior ---
|
||||
BAIBOT_COMMAND_PREFIX=!bai
|
||||
BAIBOT_LOGGING=warn,mxlink=debug,baibot=debug
|
||||
|
||||
```
|
||||
|
||||
|
||||
baibot password
|
||||
```
|
||||
rTko=deMv*z(ex7F
|
||||
```
|
||||
|
||||
|
||||
```yml
|
||||
base_url: https://zenmux.ai/api/v1
|
||||
api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
|
||||
|
||||
text_generation:
|
||||
model_id: anthropic/claude-sonnet-4.5
|
||||
prompt: "You are a helpful assistant called {{ baibot_name }}, powered by Zenmux ({{ baibot_model_id }}). The date/time of this conversation's start is: {{ baibot_conversation_start_time_utc }}."
|
||||
temperature: 0.8
|
||||
max_completion_tokens: 16384
|
||||
max_context_tokens: 128000
|
||||
|
||||
speech_to_text:
|
||||
model_id: whisper-1
|
||||
|
||||
text_to_speech:
|
||||
model_id: tts-1-hd
|
||||
voice: onyx
|
||||
speed: 1.0
|
||||
response_format: opus
|
||||
|
||||
image_generation:
|
||||
model_id: gpt-image-1
|
||||
style: vivid
|
||||
size: 512x512
|
||||
quality: standard
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
!bai config room set-handler text-generation global/zenmux
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
base_url: "https://zenmux.ai/api/v1"
|
||||
api_key: "sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03"
|
||||
text_generation:
|
||||
model_id: "openai/gpt-5-chat"
|
||||
prompt: 'system_prompt: "You are a calm, intelligent, and helpful AI assistant called gpt5, powered by openai using the gpt5 chat model. The current UTC start time of this conversation is: {{ conversation_start_time_utc }}."
|
||||
'
|
||||
temperature: 1.0
|
||||
speech_to_text:
|
||||
model_id: whisper-1
|
||||
text_to_speech:
|
||||
model_id: tts-1-hd
|
||||
voice: onyx
|
||||
speed: 1.0
|
||||
response_format: opus
|
||||
image_generation:
|
||||
model_id: gpt-image-1
|
||||
style: null
|
||||
size: null
|
||||
quality: null
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
base_url: "https://zenmux.ai/api/v1"
|
||||
api_key: "sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03"
|
||||
text_generation:
|
||||
model_id: "google/gemini-2.5-pro"
|
||||
prompt: 'system_prompt: "Gemini 2.5 Pro is Google’s state-of-the-art AI model designed for advanced reasoning, coding, mathematics, and scientific tasks. It employs “thinking” capabilities, enabling it to reason through responses with enhanced accuracy and nuanced context handling. Gemini 2.5 Pro achieves top-tier performance on multiple benchmarks, including first-place positioning on the LMArena leaderboard, reflecting superior human-preference alignment and complex problem-solving abilities. The current UTC start time of this conversation is: {{ conversation_start_time_utc }}."
|
||||
'
|
||||
temperature: 1.0
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
base_url: "https://zenmux.ai/api/v1"
|
||||
api_key: "sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03"
|
||||
text_generation:
|
||||
model_id: "qwen/qwen3-max"
|
||||
prompt: 'system_prompt: "Qwen3-Max is an updated release built on the Qwen3 series, offering major improvements in reasoning, instruction following, multilingual support, and long-tail knowledge coverage compared to the January 2025 version. It delivers higher accuracy in math, coding, logic, and science tasks, follows complex instructions in Chinese and English more reliably, reduces hallucinations, and produces higher-quality responses for open-ended Q&A, writing, and conversation. The model supports over 100 languages with stronger translation and commonsense reasoning, and is optimized for retrieval-augmented generation (RAG) and tool calling, though it does not include a dedicated “thinking” mode.The current UTC start time of this conversation is: {{ conversation_start_time_utc }}."
|
||||
'
|
||||
temperature: 1.0
|
||||
```
|
||||
Executable
+5
@@ -0,0 +1,5 @@
|
||||
|
||||
key
|
||||
```
|
||||
sk-scalJeWNKxWMePXVwiGVnCMjrDpeSkCFxyowSSYp7C9yDpFqX3wY6zg9N7ovJ0MR
|
||||
```
|
||||
@@ -0,0 +1,5 @@
|
||||
|
||||
local rag key:
|
||||
```
|
||||
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
|
||||
```
|
||||
@@ -0,0 +1,10 @@
|
||||
|
||||
# 狗狗加速
|
||||
|
||||
https://panel.dg5.biz
|
||||
|
||||
windyboy@gmail.com
|
||||
半年：90
|
||||
支付时间：2024-10-28 10:17:35
|
||||
创建时间：2024-10-28 10:16:12
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
|
||||
https://ausu.autos?uuid=2fb14704-2b87-4f46-a073-2b8828b5e6e9&hmac=04b55a908b662a860b203469a3fade19034a93c6fe8c26d8a9c671077950a771
|
||||
|
||||
58.8USD
|
||||
|
||||
Due Date: 2024-03-14
|
||||
|
||||
android:
|
||||
https://api.inforun.work/v1/service/10004950?hmac=51EA681FE0EF28CB8766BA258D2555D8C0CBF849E1DCA1183C6C4C59585C1607&lang=&templateId=22
|
||||
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
|
||||
postgresql:
|
||||
dendrite/windyboy2006
|
||||
|
||||
reCAPTCHA
|
||||
key: 6LemvrUlAAAAAPqUuH_1V-lWdKAeEORzeAEhor46
|
||||
secret: 6LemvrUlAAAAAOzHkBnRH3Qxiw2q3YI0ZHdLf6Bh
|
||||
|
||||
admin:
|
||||
windy/catalog@2006
|
||||
|
||||
AccessToken: D0lJWbpHRSO4s3zfqxSvO9ZmdWJuV2iPTC5K9VijuuU
|
||||
|
||||
|
||||
matrix media repo:
|
||||
media_repo:windyboy2006@localhost:matrix_media_repo
|
||||
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
|
||||
打开http://192.168.1.1直接用超级管理员账户telecomadmin 密码nE7jA%5m登录；
|
||||
|
||||
|
||||
### 设备基本信息
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
|设备类型:|YMe 2+1 wifi|
|
||||
|生产厂家:|SCTY|
|
||||
|设备型号:|TEWA-600AGM|
|
||||
|设备标识号:|40F420-4D84440F420AD9629|
|
||||
|硬件版本:|V1.0|
|
||||
|软件版本:|Tianyi_V1.0.P05|
|
||||
|
||||
### PON信息
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
|线路协议:|GPON|
|
||||
|连接状态:|成功-已注册已认证|
|
||||
|连接时间:|717326|
|
||||
|发送光功率:|1.7|
|
||||
|接收光功率:|-19.5|
|
||||
|
||||
### 网关注册信息
|
||||
|
||||
| | |
|
||||
| ------- | --------------- |
|
||||
| 逻辑ID: | GZ0153330711821 |
|
||||
|
||||
|
||||
### 业务信息
|
||||
|
||||
| | | | | | |
|
||||
| -------- | ---- | -------------- | ------------------------------ | ------------------------------ | ---------------------- |
|
||||
| 业务类型 | 状态 | IP协议 | 连接方式 | 可用端口 | 连接名称 |
|
||||
| 上网业务 | 可用 | IPV4 | 桥接(电脑拨号) | 有线:网口1,无线:ChinaNet-vKRJ, | 1_INTERNET_B_VID_41 |
|
||||
| 可用 | IPV6 | 桥接(电脑拨号) | 有线:网口1,无线:ChinaNet-vKRJ, | 1_INTERNET_B_VID_41 | |
|
||||
| iTV | 可用 | IPV4 | 桥接 | iTV, | 1_Other_B_VID_45 |
|
||||
| 可用 | IPV6 | 桥接 | iTV, | 1_Other_B_VID_45 | |
|
||||
| 语音 | 可用 | IPV4 | 路由 | 电话 | 1_TR069_VOICE_R_VID_46 |
|
||||
| 管理 | 可用 | IPV4 | 路由 | | 1_TR069_VOICE_R_VID_46 |
|
||||
| | | | | | |
|
||||
| | | | | | |
|
||||
| | | | | | |
|
||||
|
|
||||
|
||||
internet:
|
||||
vlan:41
|
||||
802.lp:0
|
||||
|
||||
iptv:
|
||||
vlan_id: 45
|
||||
802.1p: 5
|
||||
@@ -0,0 +1,478 @@
|
||||
|
||||
|
||||
---
|
||||
|
||||
## **Table of Contents**
|
||||
|
||||
1. [Prerequisites](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#prerequisites)
|
||||
2. [Prepare Your Debian System](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#prepare-your-debian-system)
|
||||
3. [Install Docker](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#install-docker)
|
||||
4. [Configure Docker Daemon (Optional: HTTP Proxy)](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#configure-docker-daemon-optional-http-proxy)
|
||||
5. [Install Home Assistant Supervised](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#install-home-assistant-supervised)
|
||||
6. [Post-Installation Configuration](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#post-installation-configuration)
|
||||
7. [Configure Home Assistant](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#configure-home-assistant)
|
||||
8. [Maintenance and Best Practices](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#maintenance-and-best-practices)
|
||||
9. [Troubleshooting](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#troubleshooting)
|
||||
10. [Additional Resources](https://chatgpt.com/c/67563169-1bb8-800b-bea7-edf694617d17#additional-resources)
|
||||
|
||||
---
|
||||
|
||||
## **1. Prerequisites**
|
||||
|
||||
Before you begin, ensure that you have the following:
|
||||
|
||||
- **Hardware:**
|
||||
|
||||
- A device running Debian (Raspberry Pi 4 recommended for ARM architecture or an x86_64-based server for better performance).
|
||||
- Reliable storage (SSD recommended over HDD or SD cards for durability and speed).
|
||||
- Stable internet connection.
|
||||
- **Software:**
|
||||
|
||||
- **Debian:** Ensure you have a fresh installation of Debian 11 (Bullseye) or later.
|
||||
- **Access:** Root or sudo privileges on the Debian system.
|
||||
- **Tools:**
|
||||
|
||||
- **Terminal Access:** SSH access or direct access to the Debian machine's terminal.
|
||||
- **Internet Connection:** Required for downloading packages and Docker images.
|
||||
|
||||
---
|
||||
|
||||
## **2. Prepare Your Debian System**
|
||||
|
||||
### **2.1 Install Debian**
|
||||
|
||||
If you haven't already installed Debian, follow these steps:
|
||||
|
||||
1. **Download Debian ISO:**
|
||||
|
||||
- Visit the [official Debian website](https://www.debian.org/distrib/) and download the latest stable release (preferably Debian 11 "Bullseye").
|
||||
2. **Create Installation Media:**
|
||||
|
||||
- Use tools like [Rufus](https://rufus.ie/) (Windows) or `dd` command (Linux/macOS) to create a bootable USB drive.
|
||||
3. **Install Debian:**
|
||||
|
||||
- Boot from the USB drive and follow the on-screen instructions.
|
||||
- Choose a **Minimal Installation** to reduce unnecessary packages.
|
||||
- Set up a strong root password and create a user with sudo privileges.
|
||||
|
||||
### **2.2 Update the System**
|
||||
|
||||
Once Debian is installed, update the package lists and upgrade existing packages:
|
||||
|
||||
```bash
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
```
|
||||
|
||||
### **2.3 Set Hostname and Timezone**
|
||||
|
||||
1. **Set Hostname:**
|
||||
|
||||
Replace `homeassistant` with your desired hostname.
|
||||
|
||||
```bash
|
||||
sudo hostnamectl set-hostname homeassistant
|
||||
```
|
||||
|
||||
2. **Set Timezone:**
|
||||
|
||||
```bash
|
||||
sudo dpkg-reconfigure tzdata
|
||||
```
|
||||
|
||||
Follow the prompts to select your timezone.
|
||||
|
||||
|
||||
### **2.4 Install Essential Packages**
|
||||
|
||||
Install necessary packages required for Home Assistant Supervised:
|
||||
|
||||
```bash
|
||||
sudo apt install -y jq curl avahi-daemon dbus network-manager apparmor-utils
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **3. Install Docker**
|
||||
|
||||
Home Assistant Supervised relies on Docker to manage containers. Follow these steps to install Docker Engine.
|
||||
|
||||
### **3.1 Remove Old Docker Versions**
|
||||
|
||||
Ensure no older versions of Docker are present:
|
||||
|
||||
```bash
|
||||
sudo apt remove -y docker docker-engine docker.io containerd runc
|
||||
```
|
||||
|
||||
### **3.2 Install Docker Dependencies**
|
||||
|
||||
```bash
|
||||
sudo apt install -y ca-certificates curl gnupg lsb-release
|
||||
```
|
||||
|
||||
### **3.3 Add Docker’s Official GPG Key**
|
||||
|
||||
```bash
|
||||
sudo mkdir -p /etc/apt/keyrings
|
||||
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||
```
|
||||
|
||||
### **3.4 Set Up the Docker Repository**
|
||||
|
||||
```bash
|
||||
echo \
|
||||
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
|
||||
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
```
|
||||
|
||||
### **3.5 Install Docker Engine**
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
```
|
||||
|
||||
### **3.6 Verify Docker Installation**
|
||||
|
||||
Check Docker version and status:
|
||||
|
||||
```bash
|
||||
docker --version
|
||||
sudo systemctl status docker
|
||||
```
|
||||
|
||||
You should see Docker running. Press `q` to exit the status view.
|
||||
|
||||
### **3.7 Manage Docker as a Non-Root User (Optional)**
|
||||
|
||||
To run Docker commands without `sudo`, add your user to the `docker` group:
|
||||
|
||||
```bash
|
||||
sudo usermod -aG docker $USER
|
||||
```
|
||||
|
||||
Log out and back in for the changes to take effect.
|
||||
|
||||
---
|
||||
|
||||
## **4. Configure Docker Daemon (Optional: HTTP Proxy)**
|
||||
|
||||
If your network requires Docker to use an HTTP proxy, configure it as follows:
|
||||
|
||||
### **4.1 Create or Edit Docker Daemon Configuration**
|
||||
|
||||
Open `/etc/docker/daemon.json` in a text editor:
|
||||
|
||||
```bash
|
||||
sudo nano /etc/docker/daemon.json
|
||||
```
|
||||
|
||||
### **4.2 Add Proxy Settings**
|
||||
|
||||
Replace `http://your-proxy:port` with your actual proxy details. If you don't need a proxy, you can skip this step.
|
||||
|
||||
```json
|
||||
{
|
||||
"proxies": {
|
||||
"default": {
|
||||
"httpProxy": "http://your-proxy:port",
|
||||
"httpsProxy": "http://your-proxy:port",
|
||||
"noProxy": "localhost,127.0.0.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### **4.3 Save and Exit**
|
||||
|
||||
Press `CTRL + O` to save and `CTRL + X` to exit.
|
||||
|
||||
### **4.4 Restart Docker to Apply Changes**
|
||||
|
||||
```bash
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
### **4.5 Verify Proxy Configuration (Optional)**
|
||||
|
||||
Run a Docker container to verify proxy settings:
|
||||
|
||||
```bash
|
||||
docker run --rm alpine env | grep -i proxy
|
||||
```
|
||||
|
||||
You should see the proxy variables if configured correctly.
|
||||
|
||||
---
|
||||
|
||||
## **5. Install Home Assistant Supervised**
|
||||
|
||||
Follow these steps to install Home Assistant Supervised on your Debian system.
|
||||
|
||||
### **5.1 Download the Supervised Installer Script**
|
||||
|
||||
```bash
|
||||
curl -Lo installer.sh https://raw.githubusercontent.com/home-assistant/supervised-installer/main/installer.sh
|
||||
```
|
||||
|
||||
### **5.2 Make the Script Executable**
|
||||
|
||||
```bash
|
||||
chmod +x installer.sh
|
||||
```
|
||||
|
||||
### **5.3 Run the Installer Script**
|
||||
|
||||
Run the installer with the appropriate machine type. Replace `your_machine_type` with your hardware. Common types include:
|
||||
|
||||
- `raspberrypi4` for Raspberry Pi 4
|
||||
- `generic-x86-64` for standard 64-bit PCs
|
||||
|
||||
**Example for Raspberry Pi 4:**
|
||||
|
||||
```bash
|
||||
sudo bash installer.sh --machine raspberrypi4
|
||||
```
|
||||
|
||||
**Example for Generic x86_64:**
|
||||
|
||||
```bash
|
||||
sudo bash installer.sh --machine generic-x86-64
|
||||
```
|
||||
|
||||
### **5.4 Follow On-Screen Prompts**
|
||||
|
||||
The installer will guide you through the process, including:
|
||||
|
||||
- Confirming installation parameters.
|
||||
- Installing necessary Docker containers (Supervisor, Home Assistant Core, etc.).
|
||||
|
||||
**Note:** Ensure your network is stable during the installation to allow the script to download required Docker images.
|
||||
|
||||
### **5.5 Verify Installation**
|
||||
|
||||
After the installation completes, check the status of Home Assistant Supervisor:
|
||||
|
||||
```bash
|
||||
sudo systemctl status hassio-supervisor.service
|
||||
```
|
||||
|
||||
You should see that the Supervisor is active and running.
|
||||
|
||||
---
|
||||
|
||||
## **6. Post-Installation Configuration**
|
||||
|
||||
### **6.1 Access Home Assistant Web Interface**
|
||||
|
||||
1. **Find Your Server's IP Address:**
|
||||
|
||||
```bash
|
||||
hostname -I
|
||||
```
|
||||
|
||||
Note down the IP address (e.g., `192.168.1.100`).
|
||||
|
||||
2. **Open Web Browser:**
|
||||
|
||||
Navigate to `http://<your-server-ip>:8123` (e.g., `http://192.168.1.100:8123`).
|
||||
|
||||
3. **Initial Setup:**
|
||||
|
||||
- **Create an Account:** Follow the prompts to create your Home Assistant user account.
|
||||
- **Configure Location:** Set your location, unit system, and time zone.
|
||||
- **Set Up Home:** Follow the guided setup to add devices and integrations.
|
||||
|
||||
### **6.2 Configure Supervisor Settings**
|
||||
|
||||
1. **Navigate to Supervisor Panel:**
|
||||
|
||||
- Click on **Supervisor** in the left sidebar.
|
||||
2. **Update Supervisor and Core:**
|
||||
|
||||
- If prompted, update the Supervisor and Home Assistant Core to the latest versions.
|
||||
3. **Install Add-ons:**
|
||||
|
||||
- Click on **Add-on Store**.
|
||||
- Browse and install desired add-ons (e.g., File Editor, Samba Share, Mosquitto MQTT Broker).
|
||||
- Configure each add-on as needed.
|
||||
|
||||
---
|
||||
|
||||
## **7. Configure Home Assistant**
|
||||
|
||||
After installation, you can customize and extend Home Assistant to suit your needs.
|
||||
|
||||
### **7.1 Basic Configuration**
|
||||
|
||||
1. **Integrations:**
|
||||
|
||||
- **Automatic Discovery:** Home Assistant can automatically discover devices on your network.
|
||||
- **Manual Integration:** Go to **Settings > Devices & Services > Add Integration** to add integrations manually.
|
||||
2. **Dashboard Customization:**
|
||||
|
||||
- **Edit Dashboard:** Click on the three dots in the top-right corner of the dashboard and select **Edit Dashboard**.
|
||||
- **Add Cards:** Use various card types (e.g., entities, glance, gauge) to display information.
|
||||
- **Organize Views:** Create multiple views for different areas or functionalities in your home.
|
||||
|
||||
### **7.2 Adding Users and Permissions**
|
||||
|
||||
1. **User Management:**
|
||||
|
||||
- Go to **Settings > System > Users**.
|
||||
- Add new users, assign roles (Administrator or User), and manage permissions.
|
||||
|
||||
### **7.3 Automations and Scripts**
|
||||
|
||||
1. **Create Automations:**
|
||||
|
||||
- Navigate to **Settings > Automations & Scenes > Automations**.
|
||||
- Use the **Editor** to create triggers, conditions, and actions.
|
||||
- Example: Turn on lights when motion is detected.
|
||||
2. **Create Scripts:**
|
||||
|
||||
- Navigate to **Settings > Automations & Scenes > Scripts**.
|
||||
- Define sequences of actions that can be triggered manually or via automations.
|
||||
|
||||
### **7.4 Adding Custom Components**
|
||||
|
||||
1. **File Editor Add-on:**
|
||||
|
||||
- Install the **File Editor** add-on from the **Add-on Store**.
|
||||
- Use it to edit `configuration.yaml` and other YAML files directly within Home Assistant.
|
||||
2. **Restart Home Assistant:**
|
||||
|
||||
- After making changes to YAML files, restart Home Assistant to apply them.
|
||||
- Navigate to **Settings > System > Restart**.
|
||||
|
||||
### **7.5 Setting Up Backups (Snapshots)**
|
||||
|
||||
1. **Create Snapshots:**
|
||||
|
||||
- Go to **Supervisor > Snapshots**.
|
||||
- Click **Create Snapshot** to back up your configuration and add-ons.
|
||||
2. **Automate Backups:**
|
||||
|
||||
- Use add-ons like **Google Drive Backup** or **Samba Share** to store snapshots externally.
|
||||
- Schedule regular backups to ensure data safety.
|
||||
|
||||
---
|
||||
|
||||
## **8. Maintenance and Best Practices**
|
||||
|
||||
### **8.1 Regular Updates**
|
||||
|
||||
- **Home Assistant Core and Supervisor:**
|
||||
- Regularly update to the latest versions via the Supervisor interface.
|
||||
- **Add-ons:**
|
||||
- Keep add-ons up to date to benefit from new features and security patches.
|
||||
|
||||
### **8.2 Backup Strategy**
|
||||
|
||||
- **Local Backups:**
|
||||
- Utilize Home Assistant's snapshot feature.
|
||||
- **Remote Backups:**
|
||||
- Store backups on external drives or cloud services using add-ons.
|
||||
|
||||
### **8.3 Security Measures**
|
||||
|
||||
- **Secure Access:**
|
||||
|
||||
- Enable SSL/TLS for secure remote access.
|
||||
- Use strong passwords and enable two-factor authentication (2FA).
|
||||
- **Firewall Configuration:**
|
||||
|
||||
- Limit access to Home Assistant ports to trusted networks.
|
||||
- **Regular Monitoring:**
|
||||
|
||||
- Keep an eye on logs and system performance to detect any anomalies.
|
||||
|
||||
### **8.4 Resource Monitoring**
|
||||
|
||||
- **Supervisor > System:**
|
||||
|
||||
- Monitor CPU, memory, and disk usage to ensure optimal performance.
|
||||
- **Add-ons:**
|
||||
|
||||
- Some add-ons provide their own monitoring tools (e.g., **System Monitor**).
|
||||
|
||||
---
|
||||
|
||||
## **9. Troubleshooting**
|
||||
|
||||
### **9.1 Common Issues**
|
||||
|
||||
1. **Supervisor Not Starting:**
|
||||
|
||||
- **Check Docker Status:**
|
||||
|
||||
```bash
|
||||
sudo systemctl status docker
|
||||
```
|
||||
|
||||
- **Restart Docker:**
|
||||
|
||||
```bash
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
- **Check Logs:**
|
||||
|
||||
```bash
|
||||
sudo journalctl -u docker -f
|
||||
sudo journalctl -u hassio-supervisor.service -f
|
||||
```
|
||||
|
||||
2. **Add-ons Not Installing:**
|
||||
|
||||
- **Verify Network Connectivity:** Ensure your server can access the internet.
|
||||
- **Check Docker Permissions:** Ensure the user running Docker has the necessary permissions.
|
||||
- **Review Logs:** Navigate to **Supervisor > System > Logs** for detailed error messages.
|
||||
3. **Home Assistant Not Accessible:**
|
||||
|
||||
- **Check Container Status:**
|
||||
|
||||
```bash
|
||||
docker ps
|
||||
```
|
||||
|
||||
Ensure the `homeassistant` container is running.
|
||||
- **Verify Port Accessibility:** Ensure port `8123` is open and not blocked by a firewall.
|
||||
|
||||
### **9.2 Getting Help**
|
||||
|
||||
- **Home Assistant Community Forums:** [Home Assistant Community](https://community.home-assistant.io/)
|
||||
- **Home Assistant Discord Server:** [Join Discord](https://discord.gg/c5DvZ4e)
|
||||
- **Official Documentation:** [Home Assistant Docs](https://www.home-assistant.io/docs/)
|
||||
|
||||
---
|
||||
|
||||
## **10. Additional Resources**
|
||||
|
||||
- **Home Assistant Supervised Installer Repository:**
|
||||
|
||||
- [GitHub - home-assistant/supervised-installer](https://github.com/home-assistant/supervised-installer)
|
||||
- **Official Home Assistant Installation Guides:**
|
||||
|
||||
- [Home Assistant Installation Overview](https://www.home-assistant.io/installation/)
|
||||
- **Docker Documentation:**
|
||||
|
||||
- [Docker Engine Overview](https://docs.docker.com/engine/)
|
||||
- **Home Assistant Add-ons Documentation:**
|
||||
|
||||
- [Home Assistant Add-ons](https://www.home-assistant.io/addons/)
|
||||
|
||||
---
|
||||
|
||||
## **Summary**
|
||||
|
||||
By following the steps outlined above, you can successfully install Home Assistant Supervised on a Debian Linux server, enabling you to manage Home Assistant and its add-ons via Docker containers effectively. This setup provides a balance between ease of use and the flexibility to customize your Home Assistant environment to meet your specific needs.
|
||||
|
||||
**Key Points:**
|
||||
|
||||
- **Home Assistant Supervised** combines the power of the Supervisor with the flexibility of a standard Linux environment.
|
||||
- **Docker** is central to managing Home Assistant Core and its add-ons.
|
||||
- **Regular Maintenance**, including updates and backups, is crucial for a stable and secure Home Assistant setup.
|
||||
- **Community Resources** are invaluable for troubleshooting and optimizing your Home Assistant experience.
|
||||
|
||||
Feel free to reach out to the Home Assistant community if you encounter any challenges or have specific questions during your setup!
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
|
||||
ewelink token:
|
||||
```
|
||||
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI0NmQ0MjA2NGI1MmQ0ZDgwOTM4NDliMzRiZjA2NzJmOSIsImlhdCI6MTczMzgxMjEwNywiZXhwIjoyMDQ5MTcyMTA3fQ.LBpi_uNLKK1FiWGNOm7p5C4w5pSkbCF0t5o_5h_rWFI
|
||||
```
|
||||
truenas
|
||||
|
||||
```
|
||||
1-aFFnjLWyRXoF8iNa5ZAG4WUsEqrc9KMbzgSZOZoHeJUBIyRlQ3pEtOMjQj4VQnpP
|
||||
```
|
||||
+93
@@ -0,0 +1,93 @@
|
||||
```
|
||||
|
||||
sudo doveadm pw -s BLF-CRYPT
|
||||
```
|
||||
|
||||
```
|
||||
{BLF-CRYPT}$2y$05$ituMVYZPOiAnTOApslK18OB7iPpAamHv6wZSd7ed2ZozzAaKXPGZi
|
||||
```
|
||||
|
||||
```
|
||||
windyboy@2006
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sudo mysql -p -u mailuser mailserver <<'SQL'
|
||||
INSERT INTO domains(name) VALUES ('windy.me');
|
||||
|
||||
INSERT INTO users(email, domain, password, quota_mb)
|
||||
VALUES ('zhiqiang@windy.me','windy.me','{BLF-CRYPT}$2y$05$cbKWGCrttpBPHpN8R4DFFeGSUF82Upf4EsREifW0jm96A.59IfYfO', 2048);
|
||||
|
||||
-- optional alias
|
||||
INSERT INTO aliases(source, destination) VALUES ('vnet@windy.me','zhiqiang@windy.me');
|
||||
SQL
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
doveadm auth test zhiqiang@windy.me 'windyboy2006'
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
# ---- Dovecot 2.4 SQL authentication ----
|
||||
sql_driver = mysql
|
||||
|
||||
# Debian/MariaDB socket (or use 'mysql localhost { ... }' for TCP)
|
||||
mysql /run/mysqld/mysqld.sock {
|
||||
user = vmail
|
||||
password = CHANGE_ME_STRONG
|
||||
dbname = mailserver
|
||||
}
|
||||
|
||||
# PASSDB: verify credentials (hash in DB, e.g. {BLF-CRYPT}...)
|
||||
passdb sql {
|
||||
passdb_default_password_scheme = BLF-CRYPT
|
||||
query = SELECT email AS username, password AS password \
|
||||
FROM users \
|
||||
WHERE email = '%{user}' AND active = 1
|
||||
}
|
||||
|
||||
# USERDB: return uid/gid/home/mail
|
||||
# Change 5000:5000 if your vmail UID/GID differ: check with "id vmail"
|
||||
userdb sql {
|
||||
query = SELECT 5000 AS uid, 5000 AS gid, \
|
||||
CONCAT('/var/mail/vhosts/', SUBSTRING_INDEX(email,'@',-1), '/', SUBSTRING_INDEX(email,'@',1)) AS home, \
|
||||
CONCAT('maildir:/var/mail/vhosts/', SUBSTRING_INDEX(email,'@',-1), '/', SUBSTRING_INDEX(email,'@',1), '/Maildir') AS mail \
|
||||
FROM users \
|
||||
WHERE email = '%{user}' AND active = 1
|
||||
iterate_query = SELECT email AS username FROM users WHERE active = 1
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
swaks --server your.mx.name --port 587 --tls --auth LOGIN -au 'zhiqiang@windy.me' -ap 'windyboy@2006' --h-Subject "SASL test"
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo postconf -n | grep -E '^(smtpd_.*restrictions|smtpd_milters|milter_.*|policyd|policy|check_policy_service)'
|
||||
sudo grep -nE '^(submission|smtps)\b' -n /etc/postfix/master.cf -n
|
||||
|
||||
```
|
||||
```
|
||||
sudo postconf -P submission/inet/smtpd_recipient_restrictions
|
||||
sudo postconf -P submission/inet/smtpd_client_restrictions
|
||||
sudo postconf -P submission/inet/smtpd_helo_restrictions
|
||||
sudo postconf -P smtps/inet/smtpd_recipient_restrictions
|
||||
|
||||
```
|
||||
|
||||
google windyboy app passwors (postfix) :
|
||||
```
|
||||
zfgl bdep itya kdym
|
||||
```
|
||||
|
||||
/etc/postfix/sasl_passwd
|
||||
```
|
||||
[smtp.gmail.com]:587 windyboy@gmail.com:zfglbdepityakdym
|
||||
```
|
||||
@@ -0,0 +1,62 @@
|
||||
|
||||
ip :
|
||||
|
||||
```
|
||||
38.134.41.134
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
imapsync --host1 mx2.windy.me --user1 zhiqiang@windy.me --password1 'windyboy@2006' \
|
||||
--host2 mx.windy.me --user2 zhiqiang@windy.me --password2 'Nmq2nW!3Y223k@Ri' \
|
||||
--ssl1 --ssl2 --justlogin
|
||||
|
||||
```
|
||||
|
||||
|
||||
test smtp login
|
||||
|
||||
prepare
|
||||
```
|
||||
echo -n 'zhiqiang@windy.me' | base64
|
||||
```
|
||||
|
||||
```
|
||||
emhpcWlhbmdAd2luZHkubWU=
|
||||
```
|
||||
|
||||
```
|
||||
echo -n 'Nmq2nW!3Y223k@Ri' | base64
|
||||
```
|
||||
|
||||
```
|
||||
Tm1xMm5XITNZMjIza0BSaQ==
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
openssl s_client -starttls smtp -crlf -connect smtp.windy.me:587
|
||||
```
|
||||
|
||||
```
|
||||
EHLO windy.me
|
||||
```
|
||||
|
||||
```
|
||||
AUTH LOGIN
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
openssl x509 -in /opt/mail/data/assets/ssl/mx2.windy.me/cert.pem -noout -pubkey \
|
||||
| openssl pkey -pubin -outform DER \
|
||||
| openssl sha256
|
||||
|
||||
SHA2-256(stdin)= 83277f3daa67bd613c6ac7556e5f368d9e1245b2fb3209d89de43738a3f083f7
|
||||
```
|
||||
|
||||
```
|
||||
83277f3daa67bd613c6ac7556e5f368d9e1245b2fb3209d89de43738a3f083f7
|
||||
```
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@@ -0,0 +1,424 @@
|
||||
|
||||
|
||||
# Matrix ESS (Community) — Single‑Node Install on Debian 13 (K3s + Traefik + cert‑manager)
|
||||
_Last updated: 2025-09-25 08:45 UTC_
|
||||
|
||||
This guide installs **Element Server Suite (ESS) Community** (Synapse + MAS + Element Web + Matrix RTC) on a **single Debian 13** node using **K3s**, **Traefik** (default in K3s), and **cert‑manager** with **Let’s Encrypt**. It is tailored to your domain choices:
|
||||
|
||||
- **serverName**: `chans.xyz`
|
||||
- **Hosts**: `synapse.chans.xyz`, `account.chans.xyz`, `chat.chans.xyz`, `mrtc.chans.xyz`
|
||||
|
||||
> Tip: if you already have K3s and cert‑manager installed and working, you can jump to **5. Values files** and **6. Install ESS**.
|
||||
|
||||
---
|
||||
|
||||
## 0) Requirements & Ports
|
||||
|
||||
- Debian 13 (root/sudo), public IPv4 (and optional IPv6).
|
||||
- DNS control for `chans.xyz`.
|
||||
- Open/forward these ports to this node:
|
||||
- **80/tcp**, **443/tcp** (ACME + HTTPS + federation)
|
||||
- **30881/tcp**, **30882/udp** (Matrix RTC SFU)
|
||||
- Time in sync (`systemd-timesyncd` or equivalent).
|
||||
|
||||
---
|
||||
|
||||
## 1) DNS Setup
|
||||
|
||||
Create A/AAAA records that point to your node’s public IP(s):
|
||||
|
||||
```
|
||||
chans.xyz A / AAAA -> <YOUR_IP>
|
||||
synapse.chans.xyz A / AAAA -> <YOUR_IP>
|
||||
account.chans.xyz A / AAAA -> <YOUR_IP>
|
||||
chat.chans.xyz A / AAAA -> <YOUR_IP>
|
||||
mrtc.chans.xyz A / AAAA -> <YOUR_IP>
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- **Do not** use a `CNAME` at the **apex** (`chans.xyz`)—use `A/AAAA`. Subdomains can be `CNAME`s if you prefer.
|
||||
- Federation relies on `https://chans.xyz/.well-known/matrix/server` which the chart serves for you.
|
||||
|
||||
---
|
||||
|
||||
## 2) (Optional) Cloud‑Init (without firewalld)
|
||||
|
||||
If you build the node via cloud‑init, this minimal config installs K3s & Helm and disables swap:
|
||||
|
||||
```yaml
|
||||
#cloud-config
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
packages: [curl, ca-certificates, gnupg, lsb-release]
|
||||
|
||||
runcmd:
|
||||
- swapoff -a
|
||||
- sed -ri 's/^[^#].*\sswap\s/## &/g' /etc/fstab
|
||||
- curl -sfL https://get.k3s.io | sh -s - server
|
||||
- mkdir -p /home/windy/.kube
|
||||
- cp /etc/rancher/k3s/k3s.yaml /home/windy/.kube/config
|
||||
- chown windy:windy /home/windy/.kube/config && chmod 600 /home/windy/.kube/config
|
||||
- bash -lc 'echo export KUBECONFIG=$HOME/.kube/config >> /home/windy/.bashrc'
|
||||
- su - windy -c "curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash"
|
||||
```
|
||||
|
||||
You can manage ports at the cloud firewall or your router (no `firewalld` required).
|
||||
|
||||
---
|
||||
|
||||
## 3) Manual K3s + Helm (if not using cloud‑init)
|
||||
|
||||
```bash
|
||||
# Install latest K3s
|
||||
curl -sfL https://get.k3s.io | sh -s - server
|
||||
|
||||
# kubeconfig for your user (replace 'windy' if needed)
|
||||
mkdir -p ~windy/.kube
|
||||
sudo cp /etc/rancher/k3s/k3s.yaml ~windy/.kube/config
|
||||
sudo chown windy:windy ~windy/.kube/config
|
||||
chmod 600 ~windy/.kube/config
|
||||
echo 'export KUBECONFIG=$HOME/.kube/config' | sudo tee -a ~windy/.bashrc
|
||||
|
||||
# Helm
|
||||
sudo -iu windy bash -lc 'curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash'
|
||||
```
|
||||
|
||||
Verify:
|
||||
```bash
|
||||
kubectl get nodes -o wide
|
||||
kubectl get pods -A
|
||||
```
|
||||
|
||||
You should see the node `Ready` and `traefik` running in `kube-system`.
|
||||
|
||||
---
|
||||
|
||||
## 4) cert‑manager + Let’s Encrypt (ClusterIssuer)
|
||||
|
||||
If you haven’t installed cert‑manager yet:
|
||||
|
||||
```bash
|
||||
helm repo add jetstack https://charts.jetstack.io --force-update
|
||||
kubectl create namespace cert-manager 2>/dev/null || true
|
||||
helm install cert-manager jetstack/cert-manager -n cert-manager --set crds.enabled=true
|
||||
```
|
||||
|
||||
Create a production ClusterIssuer (`letsencrypt-prod`):
|
||||
|
||||
```yaml
|
||||
# clusterissuer.yaml
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod-private-key
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: traefik
|
||||
```
|
||||
|
||||
Apply:
|
||||
```bash
|
||||
kubectl apply -f clusterissuer.yaml
|
||||
kubectl get clusterissuer
|
||||
```
|
||||
|
||||
You should see `letsencrypt-prod READY=True`.
|
||||
|
||||
---
|
||||
|
||||
## 5) Values files (hosts + TLS)
|
||||
|
||||
Create the directory and values files:
|
||||
|
||||
```bash
|
||||
mkdir -p ~/ess-config-values
|
||||
```
|
||||
|
||||
**`~/ess-config-values/hostnames.yaml`**
|
||||
```yaml
|
||||
serverName: chans.xyz
|
||||
|
||||
elementWeb:
|
||||
ingress:
|
||||
host: chat.chans.xyz
|
||||
|
||||
synapse:
|
||||
ingress:
|
||||
host: synapse.chans.xyz
|
||||
|
||||
matrixAuthenticationService:
|
||||
ingress:
|
||||
host: account.chans.xyz
|
||||
|
||||
matrixRTC:
|
||||
ingress:
|
||||
host: mrtc.chans.xyz
|
||||
```
|
||||
|
||||
**`~/ess-config-values/tls.yaml`**
|
||||
```yaml
|
||||
global:
|
||||
ingress:
|
||||
className: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
tls:
|
||||
enabled: true
|
||||
issuer: letsencrypt-prod
|
||||
```
|
||||
|
||||
> The TLS values ensure your Ingresses are annotated for cert‑manager and include TLS host entries so Certificates are created automatically.
|
||||
|
||||
---
|
||||
|
||||
## 6) Install ESS (matrix‑stack chart)
|
||||
|
||||
```bash
|
||||
kubectl create namespace ess 2>/dev/null || true
|
||||
|
||||
helm upgrade --install ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -n ess -f ~/ess-config-values/hostnames.yaml -f ~/ess-config-values/tls.yaml --wait
|
||||
```
|
||||
|
||||
Check status:
|
||||
```bash
|
||||
kubectl get pods -n ess
|
||||
kubectl get ingress -n ess
|
||||
```
|
||||
|
||||
You should see ingresses for `synapse`, `account`, `chat`, `mrtc`, and `well-known` with `CLASS=traefik`.
|
||||
|
||||
---
|
||||
|
||||
## 7) Certificates issuance
|
||||
|
||||
Confirm the ingresses have TLS + issuer:
|
||||
```bash
|
||||
kubectl -n ess get ingress -o jsonpath='{range .items[*]}{.metadata.name}{" issuer="}{.metadata.annotations.cert-manager\.io/cluster-issuer}{" tlsHosts="}{range .spec.tls[*].hosts}{.}{" "}{end}{"\n"}{end}'
|
||||
```
|
||||
|
||||
Then watch certs:
|
||||
```bash
|
||||
kubectl get certificate -n ess
|
||||
kubectl get order,challenge -n ess
|
||||
```
|
||||
|
||||
When ready, confirm live certs:
|
||||
```bash
|
||||
for h in synapse.chans.xyz account.chans.xyz chat.chans.xyz mrtc.chans.xyz chans.xyz; do
|
||||
echo "=== $h ==="
|
||||
openssl s_client -connect "$h:443" -servername "$h" </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject -dates
|
||||
done
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8) Well‑Known verification (federation & clients)
|
||||
|
||||
```bash
|
||||
curl -s https://chans.xyz/.well-known/matrix/server | jq .
|
||||
curl -s https://chans.xyz/.well-known/matrix/client | jq .
|
||||
```
|
||||
|
||||
Expected:
|
||||
- `server` → `{ "m.server": "synapse.chans.xyz:443" }`
|
||||
- `client` → `{ "m.homeserver": { "base_url": "https://synapse.chans.xyz" }, ... }`
|
||||
|
||||
Optional federation tester: <https://federationtester.matrix.org/#chans.xyz>
|
||||
|
||||
---
|
||||
|
||||
## 9) Create the first admin account
|
||||
|
||||
Interactive:
|
||||
```bash
|
||||
kubectl exec -n ess -it deploy/ess-matrix-authentication-service -- mas-cli manage register-user --admin
|
||||
```
|
||||
|
||||
Non‑interactive example:
|
||||
```bash
|
||||
kubectl exec -n ess deploy/ess-matrix-authentication-service -- mas-cli manage register-user --yes --admin --username admin --password 'CHANGE_ME_strong_password'
|
||||
```
|
||||
|
||||
Login at **https://chat.chans.xyz**.
|
||||
|
||||
---
|
||||
|
||||
## 10) Enable self‑registration (optional)
|
||||
|
||||
```yaml
|
||||
# ~/ess-config-values/mas-registration.yaml
|
||||
matrixAuthenticationService:
|
||||
additional:
|
||||
registration.yaml:
|
||||
config: |
|
||||
account:
|
||||
password_registration_enabled: true
|
||||
password_recovery_enabled: true
|
||||
login_with_email_allowed: true
|
||||
```
|
||||
|
||||
Apply (include this file):
|
||||
```bash
|
||||
helm upgrade --install ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -n ess -f ~/ess-config-values/hostnames.yaml -f ~/ess-config-values/tls.yaml -f ~/ess-config-values/mas-registration.yaml --wait
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 11) Outbound email (MAS required, Synapse optional)
|
||||
|
||||
### 11.1 MAS SMTP (required for signup/reset)
|
||||
|
||||
**Option A — inline values (simple):**
|
||||
```yaml
|
||||
# ~/ess-config-values/mas-email.yaml
|
||||
matrixAuthenticationService:
|
||||
additional:
|
||||
user-config.yaml:
|
||||
config: |
|
||||
email:
|
||||
from: '"Matrix @ chans.xyz" <noreply@chans.xyz>'
|
||||
reply_to: '"Support" <support@chans.xyz>'
|
||||
transport: smtp
|
||||
mode: starttls
|
||||
hostname: smtp.windy.me
|
||||
port: 587
|
||||
username: noreply@chans.xyz # authenticate as the sender
|
||||
password: "MAILBOX_PASSWORD"
|
||||
account:
|
||||
password_registration_enabled: true
|
||||
password_recovery_enabled: true
|
||||
login_with_email_allowed: true
|
||||
```
|
||||
|
||||
**Option B — secret ref (keeps password out of Git):**
|
||||
```bash
|
||||
cat > /tmp/mas-user-config.yaml <<'YAML'
|
||||
email:
|
||||
from: '"Matrix @ chans.xyz" <noreply@chans.xyz>'
|
||||
reply_to: '"Support" <support@chans.xyz>'
|
||||
transport: smtp
|
||||
mode: starttls
|
||||
hostname: smtp.windy.me
|
||||
port: 587
|
||||
username: noreply@chans.xyz
|
||||
password: "MAILBOX_PASSWORD"
|
||||
account:
|
||||
password_registration_enabled: true
|
||||
password_recovery_enabled: true
|
||||
login_with_email_allowed: true
|
||||
YAML
|
||||
|
||||
kubectl -n ess create secret generic mas-extra-config --from-file=user-config.yaml=/tmp/mas-user-config.yaml
|
||||
```
|
||||
|
||||
Then reference it:
|
||||
```yaml
|
||||
# ~/ess-config-values/mas-email-secretref.yaml
|
||||
matrixAuthenticationService:
|
||||
additional:
|
||||
user-config.yaml:
|
||||
configSecret: mas-extra-config
|
||||
configSecretKey: user-config.yaml
|
||||
```
|
||||
|
||||
Apply (include one of the two files above):
|
||||
```bash
|
||||
helm upgrade --install ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -n ess -f ~/ess-config-values/hostnames.yaml -f ~/ess-config-values/tls.yaml -f ~/ess-config-values/mas-email.yaml --wait
|
||||
# or replace mas-email.yaml with mas-email-secretref.yaml if you used a Secret
|
||||
```
|
||||
|
||||
> **Mailcow 553 fix**: If authenticating as `zhiqiang@windy.me` and sending as `noreply@chans.xyz`, Mailcow rejects with `553 5.7.1 Sender address rejected`. Either (a) **authenticate as** `noreply@chans.xyz` by creating that mailbox in Mailcow and publishing SPF/DKIM/DMARC for `chans.xyz`; or (b) allow “send as” in Mailcow’s **Sender ACL** for `zhiqiang@windy.me`. Hosting the `chans.xyz` mailbox gives best deliverability (DKIM/DMARC alignment).
|
||||
|
||||
Monitor while testing:
|
||||
```bash
|
||||
kubectl -n ess logs deploy/ess-matrix-authentication-service -f | grep -iE 'smtp|email|send'
|
||||
```
|
||||
|
||||
### 11.2 Synapse email notifications (optional)
|
||||
```yaml
|
||||
# ~/ess-config-values/synapse-email.yaml
|
||||
synapse:
|
||||
additional:
|
||||
email.yaml:
|
||||
config: |
|
||||
email:
|
||||
smtp_host: "smtp.windy.me"
|
||||
smtp_port: 587
|
||||
smtp_user: "noreply@chans.xyz"
|
||||
smtp_pass: "MAILBOX_PASSWORD"
|
||||
require_transport_security: true
|
||||
notif_from: "Matrix on chans.xyz <noreply@chans.xyz>"
|
||||
enable_notifs: true
|
||||
```
|
||||
|
||||
Include this file in your next Helm upgrade.
|
||||
|
||||
---
|
||||
|
||||
## 12) Health checks & troubleshooting
|
||||
|
||||
**Basic:**
|
||||
```bash
|
||||
kubectl get pods,svc,ingress,certificate -n ess -o wide
|
||||
```
|
||||
|
||||
**Certs flow:**
|
||||
```bash
|
||||
kubectl get certificate,order,challenge -n ess
|
||||
kubectl describe challenge -n ess <name>
|
||||
kubectl logs -n kube-system deploy/traefik --tail=200
|
||||
```
|
||||
|
||||
**Well‑known + federation:**
|
||||
```bash
|
||||
curl -s https://chans.xyz/.well-known/matrix/server | jq .
|
||||
curl -s https://chans.xyz/.well-known/matrix/client | jq .
|
||||
```
|
||||
|
||||
**Common pitfalls:**
|
||||
- Ingresses lack TLS + `cert-manager.io/cluster-issuer` → fix `tls.yaml`.
|
||||
- `553 Sender address rejected` from Mailcow → align SMTP auth user with sender or allow “send as”, and set SPF/DKIM/DMARC for `chans.xyz`.
|
||||
- Port 80 blocked → Let’s Encrypt HTTP‑01 fails (check challenges).
|
||||
- Apex `chans.xyz` not pointing at the node → `.well-known` fails → federation fails.
|
||||
|
||||
---
|
||||
|
||||
## 13) Upgrades / Uninstall
|
||||
|
||||
Upgrade to latest chart:
|
||||
```bash
|
||||
helm repo update # if using repos
|
||||
helm upgrade --install ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -n ess -f ~/ess-config-values/hostnames.yaml -f ~/ess-config-values/tls.yaml --wait
|
||||
```
|
||||
|
||||
Uninstall ESS (keeps PVCs unless you delete them):
|
||||
```bash
|
||||
helm uninstall ess -n ess
|
||||
kubectl delete namespace ess
|
||||
```
|
||||
|
||||
Reset K3s (if ever needed):
|
||||
```bash
|
||||
sudo /usr/local/bin/k3s-uninstall.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 14) Quick copy‑paste checklist
|
||||
|
||||
1. DNS A/AAAA for: `chans.xyz`, `synapse.`, `account.`, `chat.`, `mrtc.` → your IP.
|
||||
2. K3s running with Traefik; cert‑manager installed; `ClusterIssuer letsencrypt-prod` **Ready**.
|
||||
3. `hostnames.yaml` with `*.ingress.host` set to your subdomains.
|
||||
4. `tls.yaml` with `global.ingress.annotations.cert-manager.io/cluster-issuer=letsencrypt-prod` and TLS enabled.
|
||||
5. `helm upgrade --install ess …` with both files.
|
||||
6. `kubectl get certificate -n ess` → `READY=True`.
|
||||
7. `/.well-known` returns correct JSON; federation tester OK.
|
||||
8. Create admin via MAS CLI; log in at `https://chat.chans.xyz`.
|
||||
9. Configure SMTP for MAS (and optionally Synapse), fix Mailcow sender policy if needed.
|
||||
+294
@@ -0,0 +1,294 @@
|
||||
|
||||
|
||||
docker compose
|
||||
|
||||
```yaml
|
||||
services:
|
||||
networks:
|
||||
proxy:
|
||||
driver: bridge
|
||||
|
||||
services:
|
||||
|
||||
traefik:
|
||||
image: "traefik"
|
||||
restart: "unless-stopped"
|
||||
command:
|
||||
- "--api=true"
|
||||
- "--api.dashboard=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--certificatesresolvers.myresolver.acme.httpchallenge=true"
|
||||
- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web" # Ensure HTTP challenge uses the web entry point
|
||||
- "--certificatesresolvers.myresolver.acme.email=zhiqiang@windy.me" # Set your email for Let's Encrypt
|
||||
- "--certificatesresolvers.myresolver.acme.storage=/certs/acme.json" # Path to store certs
|
||||
- "--entrypoints.web.address=:80" # Entry point for HTTP
|
||||
- "--entrypoints.websecure.address=:443" # Entry point for HTTPS
|
||||
- "--log.level=DEBUG" # Set the log level (optional)
|
||||
ports:
|
||||
- "80:80" # Ensure port 80 is exposed for HTTP challenge
|
||||
- "443:443" # Port 443 for HTTPS
|
||||
- "8080:8080" # Dashboard (Optional)
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./certs/acme.json:/certs/acme.json"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
well-known:
|
||||
image: "nginx"
|
||||
restart: "unless-stopped"
|
||||
volumes:
|
||||
- ./well-known:/etc/nginx/conf.d
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.well-known.entrypoints=websecure"
|
||||
- "traefik.http.routers.well-known.rule=Host(`chans.xyz`) && PathPrefix(`/.well-known`)"
|
||||
- "traefik.http.routers.well-known.tls=true"
|
||||
- "traefik.http.routers.well-known.tls.certresolver=myresolver"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
synapse:
|
||||
image: docker.io/matrixdotorg/synapse
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
|
||||
volumes:
|
||||
- ./data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "nc", "-z", "db", "5432"]
|
||||
interval: 10s
|
||||
retries: 5
|
||||
start_period: 10s
|
||||
timeout: 2s
|
||||
depends_on:
|
||||
- db
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.synapse.rule=Host(`synapse.chans.xyz`)" # Router for synapse.chans.xyz
|
||||
- "traefik.http.routers.synapse.entrypoints=websecure" # HTTPS traffic
|
||||
- "traefik.http.routers.synapse.tls=true" # Enable TLS
|
||||
- "traefik.http.routers.synapse.tls.certresolver=myresolver" # Use Let's Encrypt resolver
|
||||
- "traefik.http.services.synapse.loadbalancer.server.port=8008" # Synapse backend port
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
db:
|
||||
image: docker.io/postgres:14-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- POSTGRES_USER=synapse
|
||||
- POSTGRES_PASSWORD=ucdN6Upc|J,V*J0?
|
||||
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
|
||||
volumes:
|
||||
- ./db:/var/lib/postgresql/data
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
```
|
||||
|
||||
well-known
|
||||
default.conf
|
||||
```conf
|
||||
location /.well-known/matrix/server {
|
||||
access_log off;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
default_type application/json;
|
||||
return 200 '{"m.server": "matrix.chans.xyz:443"}';
|
||||
}
|
||||
|
||||
location /.well-known/matrix/client {
|
||||
access_log off;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
default_type application/json;
|
||||
return 200 '{"m.homeserver": {"base_url": "https://app.chans.xyz"}}';
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
generate config:
|
||||
|
||||
```bash
|
||||
|
||||
docker run -it --rm --volume ./data:/data -e SYNAPSE_SERVER_NAME=chans.xyz -e SYNAPSE_REPORT_STATS=yes matrixdotorg/synapse generate
|
||||
|
||||
```
|
||||
|
||||
|
||||
homeserver.yml
|
||||
database:
|
||||
|
||||
```yaml
|
||||
name: psycopg2
|
||||
txn_limit: 10000
|
||||
args:
|
||||
user: synapse
|
||||
password: ucdN6Upc|J,V*J0?
|
||||
database: synapse
|
||||
host: synapse_db
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
|
||||
```
|
||||
|
||||
|
||||
```yaml
|
||||
#
|
||||
# This is a YAML file: see [1] for a quick introduction. Note in particular
|
||||
# that *indentation is important*: all the elements of a list or dictionary
|
||||
# should have the same indentation.
|
||||
#
|
||||
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
|
||||
#
|
||||
# For more information on how to configure Synapse, including a complete accounting of
|
||||
# each option, go to docs/usage/configuration/config_documentation.md or
|
||||
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
|
||||
server_name: "chans.xyz"
|
||||
pid_file: /data/homeserver.pid
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
database:
|
||||
name: psycopg2
|
||||
txn_limit: 10000
|
||||
args:
|
||||
user: synapse
|
||||
password: ucdN6Upc|J,V*J0?
|
||||
database: synapse
|
||||
host: synapse_db
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
log_config: "/data/chans.xyz.log.config"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
|
||||
report_stats: true
|
||||
macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
|
||||
form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
|
||||
signing_key_path: "/data/chans.xyz.signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
sudo certbot --nginx -d chans.xyz -d synapse.chans.xyz
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008
|
||||
```
|
||||
|
||||
key:
|
||||
```
|
||||
EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
|
||||
```
|
||||
|
||||
|
||||
```yaml
|
||||
# The Matrix integration
|
||||
matrix:
|
||||
homeserver: https://chans.xyz
|
||||
username: "@zhiqiang:chans.xyz"
|
||||
password: "vaz6PQV5vjg1aya-mvr"
|
||||
rooms:
|
||||
- "#hass:chans.xyz"
|
||||
commands:
|
||||
- word: testword
|
||||
name: testword
|
||||
rooms:
|
||||
- "#hass:chans.xyz"
|
||||
- expression: "My name is (?P<name>.*)"
|
||||
name: introduction
|
||||
|
||||
notify:
|
||||
- name: matrix_notify
|
||||
platform: matrix
|
||||
default_room: "#hass:chans.xyz"
|
||||
|
||||
automation:
|
||||
- alias: "React to !testword"
|
||||
triggers:
|
||||
- trigger: event
|
||||
event_type: matrix_command
|
||||
event_data:
|
||||
command: testword
|
||||
actions:
|
||||
- action: notify.matrix_notify
|
||||
data:
|
||||
message: "It looks like you wrote !testword"
|
||||
|
||||
- alias: "React to an introduction"
|
||||
triggers:
|
||||
- trigger: event
|
||||
event_type: matrix_command
|
||||
event_data:
|
||||
command: introduction
|
||||
actions:
|
||||
- action: notify.matrix_notify
|
||||
data:
|
||||
message: "Hello {{trigger.event.data.args['name']}}"
|
||||
```
|
||||
|
||||
get token
|
||||
|
||||
```
|
||||
curl -X POST -H "Content-Type: application/json" -d '{
|
||||
"type": "m.login.password",
|
||||
"user": "hass",
|
||||
"password": ".P.fPdJL6.wz77q*9VjD"
|
||||
}' "https://chans.xyz/_matrix/client/r0/login"
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
syt_aGFzcw_cBpXCxWpUSawmWXXmZFL_0v4BCE
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```
|
||||
curl -XPOST "https://synapse.chans.xyz/_matrix/client/v3/login" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"type": "m.login.password",
|
||||
"identifier": {
|
||||
"type": "m.id.user",
|
||||
"user": "zhiqiang"
|
||||
},
|
||||
"password": "vaz6PQV5vjg1aya-mvr"
|
||||
}'
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
{"access_token":"mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
matrix:
|
||||
homeserver: chans.xyz
|
||||
secret: 'wqfJ1r4cyaQbRNzGUUxjOyFf1g2hvC8F'
|
||||
endpoint: https://synapse.chans.xyz/
|
||||
|
||||
```
|
||||
@@ -0,0 +1,312 @@
|
||||
|
||||
|
||||
docker compose
|
||||
|
||||
```yaml
|
||||
services:
|
||||
networks:
|
||||
proxy:
|
||||
driver: bridge
|
||||
|
||||
services:
|
||||
|
||||
traefik:
|
||||
image: "traefik"
|
||||
restart: "unless-stopped"
|
||||
command:
|
||||
- "--api=true"
|
||||
- "--api.dashboard=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--certificatesresolvers.myresolver.acme.httpchallenge=true"
|
||||
- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web" # Ensure HTTP challenge uses the web entry point
|
||||
- "--certificatesresolvers.myresolver.acme.email=zhiqiang@windy.me" # Set your email for Let's Encrypt
|
||||
- "--certificatesresolvers.myresolver.acme.storage=/certs/acme.json" # Path to store certs
|
||||
- "--entrypoints.web.address=:80" # Entry point for HTTP
|
||||
- "--entrypoints.websecure.address=:443" # Entry point for HTTPS
|
||||
- "--log.level=DEBUG" # Set the log level (optional)
|
||||
ports:
|
||||
- "80:80" # Ensure port 80 is exposed for HTTP challenge
|
||||
- "443:443" # Port 443 for HTTPS
|
||||
- "8080:8080" # Dashboard (Optional)
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./certs/acme.json:/certs/acme.json"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
well-known:
|
||||
image: "nginx"
|
||||
restart: "unless-stopped"
|
||||
volumes:
|
||||
- ./well-known:/etc/nginx/conf.d
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.well-known.entrypoints=websecure"
|
||||
- "traefik.http.routers.well-known.rule=Host(`chans.xyz`) && PathPrefix(`/.well-known`)"
|
||||
- "traefik.http.routers.well-known.tls=true"
|
||||
- "traefik.http.routers.well-known.tls.certresolver=myresolver"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
synapse:
|
||||
image: docker.io/matrixdotorg/synapse
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
|
||||
volumes:
|
||||
- ./data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "nc", "-z", "db", "5432"]
|
||||
interval: 10s
|
||||
retries: 5
|
||||
start_period: 10s
|
||||
timeout: 2s
|
||||
depends_on:
|
||||
- db
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.synapse.rule=Host(`synapse.chans.xyz`)" # Router for synapse.chans.xyz
|
||||
- "traefik.http.routers.synapse.entrypoints=websecure" # HTTPS traffic
|
||||
- "traefik.http.routers.synapse.tls=true" # Enable TLS
|
||||
- "traefik.http.routers.synapse.tls.certresolver=myresolver" # Use Let's Encrypt resolver
|
||||
- "traefik.http.services.synapse.loadbalancer.server.port=8008" # Synapse backend port
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
db:
|
||||
image: docker.io/postgres:14-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- POSTGRES_USER=synapse
|
||||
- POSTGRES_PASSWORD=ucdN6Upc|J,V*J0?
|
||||
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
|
||||
volumes:
|
||||
- ./db:/var/lib/postgresql/data
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
```
|
||||
|
||||
well-known
|
||||
default.conf
|
||||
```conf
|
||||
location /.well-known/matrix/server {
|
||||
access_log off;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
default_type application/json;
|
||||
return 200 '{"m.server": "matrix.chans.xyz:443"}';
|
||||
}
|
||||
|
||||
location /.well-known/matrix/client {
|
||||
access_log off;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
default_type application/json;
|
||||
return 200 '{"m.homeserver": {"base_url": "https://app.chans.xyz"}}';
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
generate config:
|
||||
|
||||
```bash
|
||||
|
||||
docker run -it --rm --volume ./data:/data -e SYNAPSE_SERVER_NAME=chans.xyz -e SYNAPSE_REPORT_STATS=yes matrixdotorg/synapse generate
|
||||
|
||||
```
|
||||
|
||||
|
||||
homeserver.yml
|
||||
database:
|
||||
|
||||
```yaml
|
||||
name: psycopg2
|
||||
txn_limit: 10000
|
||||
args:
|
||||
user: synapse
|
||||
password: ucdN6Upc|J,V*J0?
|
||||
database: synapse
|
||||
host: synapse_db
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
|
||||
```
|
||||
|
||||
|
||||
```yaml
|
||||
#
|
||||
# This is a YAML file: see [1] for a quick introduction. Note in particular
|
||||
# that *indentation is important*: all the elements of a list or dictionary
|
||||
# should have the same indentation.
|
||||
#
|
||||
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
|
||||
#
|
||||
# For more information on how to configure Synapse, including a complete accounting of
|
||||
# each option, go to docs/usage/configuration/config_documentation.md or
|
||||
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
|
||||
server_name: "chans.xyz"
|
||||
pid_file: /data/homeserver.pid
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
database:
|
||||
name: psycopg2
|
||||
txn_limit: 10000
|
||||
args:
|
||||
user: synapse
|
||||
password: ucdN6Upc|J,V*J0?
|
||||
database: synapse
|
||||
host: synapse_db
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
log_config: "/data/chans.xyz.log.config"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
|
||||
report_stats: true
|
||||
macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
|
||||
form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
|
||||
signing_key_path: "/data/chans.xyz.signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
sudo certbot --nginx -d chans.xyz -d synapse.chans.xyz
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008
|
||||
```
|
||||
|
||||
key:
|
||||
```
|
||||
EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
|
||||
```
|
||||
|
||||
|
||||
```yaml
|
||||
# The Matrix integration
|
||||
matrix:
|
||||
homeserver: https://chans.xyz
|
||||
username: "@zhiqiang:chans.xyz"
|
||||
password: "vaz6PQV5vjg1aya-mvr"
|
||||
rooms:
|
||||
- "#hass:chans.xyz"
|
||||
commands:
|
||||
- word: testword
|
||||
name: testword
|
||||
rooms:
|
||||
- "#hass:chans.xyz"
|
||||
- expression: "My name is (?P<name>.*)"
|
||||
name: introduction
|
||||
|
||||
notify:
|
||||
- name: matrix_notify
|
||||
platform: matrix
|
||||
default_room: "#hass:chans.xyz"
|
||||
|
||||
automation:
|
||||
- alias: "React to !testword"
|
||||
triggers:
|
||||
- trigger: event
|
||||
event_type: matrix_command
|
||||
event_data:
|
||||
command: testword
|
||||
actions:
|
||||
- action: notify.matrix_notify
|
||||
data:
|
||||
message: "It looks like you wrote !testword"
|
||||
|
||||
- alias: "React to an introduction"
|
||||
triggers:
|
||||
- trigger: event
|
||||
event_type: matrix_command
|
||||
event_data:
|
||||
command: introduction
|
||||
actions:
|
||||
- action: notify.matrix_notify
|
||||
data:
|
||||
message: "Hello {{trigger.event.data.args['name']}}"
|
||||
```
|
||||
|
||||
get token
|
||||
|
||||
```
|
||||
curl -X POST -H "Content-Type: application/json" -d '{
|
||||
"type": "m.login.password",
|
||||
"user": "hass",
|
||||
"password": ".P.fPdJL6.wz77q*9VjD"
|
||||
}' "https://chans.xyz/_matrix/client/r0/login"
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
syt_aGFzcw_cBpXCxWpUSawmWXXmZFL_0v4BCE
|
||||
```
|
||||
|
||||
|
||||
|
||||
new matrix ess recover key
|
||||
```
|
||||
EsTR 895B q1wv 4ibr ZRaK 9KCK 7nLc xHCm XUGX eYjh TcE5 4XSJ
|
||||
```
|
||||
|
||||
|
||||
|
||||
iris account:
|
||||
```
|
||||
Awa5noeW9vzLiPRY
|
||||
```
|
||||
|
||||
|
||||
hass account:
|
||||
```
|
||||
sgHoMmOWn8SkYJf#
|
||||
```
|
||||
|
||||
```
|
||||
kubectl -n ess exec deploy/ess-matrix-authentication-service -- mas-cli manage register-user --yes hass -p "sgHoMmOWn8SkYJf#"
|
||||
Defaulted container "matrix-authentication-service" out of: matrix-authentication-service, render-config (init), db-wait (init), database-migrate (init)
|
||||
User attributes
|
||||
Username: hass
|
||||
Matrix ID: @hass:chans.xyz
|
||||
Password: ********
|
||||
No email address provided, user will be prompted to add one
|
||||
2025-10-22T09:25:36.174135Z WARN mas_cli::commands::manage:818 No email address provided, user will need to add one
|
||||
2025-10-22T09:25:36.209840Z INFO mas_cli::commands::manage:835 User registered user.id=01K85KSXSEB2FB6MJHNKZP0BDV
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
matrix:
|
||||
homeserver: "https://chans.xyz"
|
||||
username: "@hass:chans.xyz"
|
||||
password: "sgHoMmOWn8SkYJf#"
|
||||
rooms:
|
||||
- "#guangzhou:chans.xyz"
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
synapse:
|
||||
additional:
|
||||
config: |
|
||||
auto_join_rooms_for_users_on_first_login: true
|
||||
|
||||
```
|
||||
|
||||
Executable
+38
@@ -0,0 +1,38 @@
|
||||
|
||||
Hi Amin,
|
||||
|
||||
Thanks for posting in the community. We are happy to help you.
|
||||
|
||||
According to your description, the situation on your end is likely caused by your organization's settings/policies (e.g. conditional access policy).
|
||||
|
||||
You can try the following steps, and then check if it still happens or not.
|
||||
|
||||
1. Please sign out your accounts from Office applications, then close all Office applications.
|
||||
|
||||
2. Open File Explorer, paste the following path, and delete all files and folders.
|
||||
|
||||
%localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
|
||||
|
||||
3. In the Windows search bar, search for "Access Work or School".
|
||||
|
||||
4. Check if you can see your business account in "Access Work or School".
|
||||
|
||||
- If you don't see it, please select Connect and add your business account.
|
||||
|
||||
|
||||
- If you can see it, please select it and select Disconnect. After that, please click "Connect" and log into your account again to register the device.
|
||||
|
||||
|
||||
5. Run one Office application, such as Word, sign into your account, and check again.
|
||||
|
||||
If the error message still appears after trying the above steps, I recommend you report the situation to your organization admin or IT department.
|
||||
|
||||
We look forward to your response. Thanks for your cooperation.
|
||||
|
||||
Sincerely,
|
||||
|
||||
George | Microsoft Community Moderator
|
||||
|
||||
[Updated by George Jiang MSFT 04:33 AM 08/10 2024 UTC + 8]
|
||||
|
||||
• Beware of Scammers posting fake Support Numbers here.
|
||||
Executable
+5
@@ -0,0 +1,5 @@
|
||||
亲，以下是您购买的商品信息。
|
||||
MobaXterm Professional 便携版
|
||||
下载地址https://wwxs.lanzoum.com/ieYNw0s21tab
|
||||
备用地址https://www.987123.xyz/oss/lovemei9/MobaXterm/MobaXterm_Portable_v23.1.zip
|
||||
说明：复制以上地址进行下载，软件包中已经集成授权文件，下载后解压即用。
|
||||
Executable
+37
@@ -0,0 +1,37 @@
|
||||
|
||||
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
squid:
|
||||
image: sameersbn/squid
|
||||
volumes:
|
||||
- ./squid.conf:/etc/squid/squid.conf:ro
|
||||
- squid_cache:/var/spool/squid
|
||||
ports:
|
||||
- "3128"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
nghttpx:
|
||||
image: nghttpx/nghttpx
|
||||
command: nghttpx -f /etc/nghttpx/nghttpx.conf
|
||||
volumes:
|
||||
- ./nghttpx.conf:/etc/nghttpx/nghttpx.conf:ro
|
||||
environment:
|
||||
- http_proxy=http://squid:3128
|
||||
- https_proxy=http://squid:3128
|
||||
- no_proxy=localhost,127.0.0.1,172.20.*
|
||||
ports:
|
||||
- "80"
|
||||
networks:
|
||||
- proxy
|
||||
|
||||
|
||||
volumes:
|
||||
squid_cache:
|
||||
|
||||
networks:
|
||||
proxy:
|
||||
external: true
|
||||
name: npm
|
||||
Executable
+7
@@ -0,0 +1,7 @@
|
||||
|
||||
|
||||
恩山：
|
||||
[OPENWRT专版-恩山无线论坛 - Powered by Discuz! (right.com.cn)](https://www.right.com.cn/FORUM/forum-72-1.html)
|
||||
|
||||
[极简ImmortalWrt及L大原版极简-软路由,x86系统,openwrt(x86),Router OS 等-恩山无线论坛 - Powered by Discuz! (right.com.cn)](https://www.right.com.cn/FORUM/thread-8282522-1-1.html)
|
||||
[https://www.123pan.com/s/bj1ZVv-49UHd.html](https://www.123pan.com/s/bj1ZVv-49UHd.html)
|
||||
@@ -0,0 +1,85 @@
|
||||
|
||||
🎉 **Success!**
|
||||
Your boot time improved from **39 seconds → 9 seconds** — that’s a **~77% speed increase**. 🚀
|
||||
|
||||
Great work applying the fix correctly!
|
||||
|
||||
---
|
||||
|
||||
### ⏱ Boot Profile Now
|
||||
|
||||
|Phase|Before|After|Improvement|
|
||||
|---|---|---|---|
|
||||
|Userspace|~36s|~5.5s|🔥 -30.5s|
|
||||
|Total|~39.4s|~9.0s|👍 -30.4s|
|
||||
|
||||
The system is now performing like a modern openSUSE should.
|
||||
|
||||
---
|
||||
|
||||
### 📌 Next: Confirm SSH Starts Early
|
||||
|
||||
Optional but recommended:
|
||||
|
||||
```bash
|
||||
systemctl status sshd.service
|
||||
```
|
||||
|
||||
It should start **right after network.target**, not waiting for full online connection.
|
||||
|
||||
If SSH still waits too long for DNS, you can also apply:
|
||||
|
||||
```bash
|
||||
sudo sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 🧽 Optional Cleanup
|
||||
|
||||
To remove the leftover serial devices delay (3 seconds earlier):
|
||||
|
||||
```bash
|
||||
sudo systemctl mask serial-getty@ttyS0.service
|
||||
sudo systemctl mask serial-getty@ttyS1.service
|
||||
sudo systemctl mask serial-getty@ttyS2.service
|
||||
sudo systemctl mask serial-getty@ttyS3.service
|
||||
```
|
||||
|
||||
If you **don’t** use serial consoles, this is safe and saves another ~3s.
|
||||
|
||||
---
|
||||
|
||||
### 🚀 Want even faster boot?
|
||||
|
||||
I can help optimize:
|
||||
|
||||
- ZRAM for faster paging
|
||||
|
||||
- Disable unnecessary services (Snapper timers, Avahi if not needed)
|
||||
|
||||
- Enable fast boot in GRUB (skip detecting other OS)
|
||||
|
||||
- Parallelize or lazy-load more services
|
||||
|
||||
|
||||
Just share:
|
||||
|
||||
```bash
|
||||
systemctl --failed
|
||||
systemd-analyze blame | head -n 10
|
||||
```
|
||||
|
||||
and I’ll provide a tailored further optimization plan.
|
||||
|
||||
---
|
||||
|
||||
If you'd like, I can also help optimize:
|
||||
|
||||
🟢 Startup applications
|
||||
🟢 Linux network stack speed
|
||||
🟢 SSD mount tuning (discard, noatime)
|
||||
🟢 bootloader timeout & fast initrd
|
||||
|
||||
Would you like a **one-click optimization script** for openSUSE?
|
||||
Executable
+7
@@ -0,0 +1,7 @@
|
||||
重要提示【小文件多的不能使用】
|
||||
一年卡号:42cb7b36a5ded34
|
||||
下载地址:https://wwxx.lanzouw.com/D88
|
||||
|
||||
(必须复制到浏览器打开链接） 下载完成 先解压 再右键管理员身份运行（按教程使用)
|
||||
每天有100G下载量
|
||||
图片，音频，小视频 上千小文件禁用
|
||||
Executable
+6
@@ -0,0 +1,6 @@
|
||||
|
||||
## dns.windy.lan
|
||||
domain: dns.windy.lan
|
||||
ip: 192.168.66.36
|
||||
root: windyboy
|
||||
user: windy/windyboy
|
||||
@@ -0,0 +1,305 @@
|
||||
|
||||
# 🌀 从 Slave 节点恢复 PowerDNS Authoritative 主节点（5.0.0 + PostgreSQL）
|
||||
|
||||
> 本文记录如何从 PowerDNS 从节点完整恢复主节点，包括数据库重建、Zone 导入、TSIG 同步与 DNSSEC 校验。
|
||||
> 适用于 **PowerDNS Authoritative 5.0.0** + **PostgreSQL gpgsql backend** 环境。
|
||||
|
||||
---
|
||||
|
||||
## 一、系统角色
|
||||
|
||||
|节点|地址|角色|说明|
|
||||
|---|---|---|---|
|
||||
|主节点|154.36.174.161|primary|新建|
|
||||
|从节点|202.91.35.141|secondary|当前持有所有 zone|
|
||||
|数据库|PostgreSQL 15|backend|gpgsql|
|
||||
|TSIG|mykey (hmac-sha512)|用于 AXFR 验证||
|
||||
|
||||
---
|
||||
|
||||
## 二、从 Slave 导出数据
|
||||
|
||||
### 1️⃣ 列出所有 zone
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone list-all
|
||||
```
|
||||
|
||||
### 2️⃣ 导出 zone 文件（PowerDNS 5.0 无 dump-zone）
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone list windy.me > /var/tmp/windy.me.zone
|
||||
sudo pdnsutil zone list wsvc.info > /var/tmp/wsvc.info.zone
|
||||
sudo pdnsutil zone list chans.xyz > /var/tmp/chans.xyz.zone
|
||||
```
|
||||
|
||||
### 3️⃣ 导出 TSIG 密钥
|
||||
|
||||
```bash
|
||||
sudo pdnsutil tsigkey list
|
||||
```
|
||||
|
||||
示例：
|
||||
|
||||
```
|
||||
mykey. hmac-sha512. 4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg==
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 三、部署主节点环境
|
||||
|
||||
### 1️⃣ 目录结构
|
||||
|
||||
```
|
||||
/opt/pdns-primary/
|
||||
├── docker-compose.yml
|
||||
├── pdns.conf
|
||||
└── db-init/
|
||||
└── 01-init.sql
|
||||
```
|
||||
|
||||
### 2️⃣ docker-compose.yml
|
||||
|
||||
```yaml
|
||||
version: "3.8"
|
||||
services:
|
||||
pdns-db:
|
||||
image: postgres:15
|
||||
environment:
|
||||
POSTGRES_USER: pdns
|
||||
POSTGRES_PASSWORD: windyboy2006
|
||||
POSTGRES_DB: pdns
|
||||
volumes:
|
||||
- ./db-init:/docker-entrypoint-initdb.d
|
||||
- pdns-db-data:/var/lib/postgresql/data
|
||||
restart: unless-stopped
|
||||
|
||||
auth:
|
||||
image: powerdns/pdns-auth-50:latest
|
||||
depends_on:
|
||||
- pdns-db
|
||||
volumes:
|
||||
- ./pdns.conf:/etc/powerdns/pdns.conf:ro
|
||||
- ./import:/import:ro
|
||||
ports:
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
- "8081:8081"
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
pdns-db-data:
|
||||
```
|
||||
|
||||
### 3️⃣ 初始化数据库
|
||||
|
||||
`db-init/01-init.sql`：
|
||||
|
||||
```sql
|
||||
CREATE USER pdns WITH PASSWORD 'windyboy2006';
|
||||
CREATE DATABASE pdns OWNER pdns ENCODING 'UTF8';
|
||||
```
|
||||
|
||||
启动数据库：
|
||||
|
||||
```bash
|
||||
docker compose up -d pdns-db
|
||||
sleep 10
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 四、主节点配置（pdns.conf）
|
||||
|
||||
```ini
|
||||
primary=yes
|
||||
secondary=no
|
||||
launch=gpgsql
|
||||
gpgsql-host=pdns-db
|
||||
gpgsql-port=5432
|
||||
gpgsql-dbname=pdns
|
||||
gpgsql-user=pdns
|
||||
gpgsql-password=windyboy2006
|
||||
gpgsql-dnssec=yes
|
||||
|
||||
local-address=0.0.0.0
|
||||
local-port=53
|
||||
setuid=pdns
|
||||
setgid=pdns
|
||||
loglevel=4
|
||||
version-string=anonymous
|
||||
|
||||
api=yes
|
||||
api-key=SuperSecretKey
|
||||
webserver=yes
|
||||
webserver-address=0.0.0.0
|
||||
webserver-port=8081
|
||||
|
||||
default-soa-edit=INCEPTION-INCREMENT
|
||||
default-soa-edit-signed=INCEPTION-INCREMENT
|
||||
disable-axfr=no
|
||||
```
|
||||
|
||||
✅ 所有字段均为 **5.0.0 有效选项**，无 `default-soa-edit-api`。
|
||||
|
||||
---
|
||||
|
||||
## 五、导入 Zone 数据
|
||||
|
||||
### 1️⃣ 创建空 zone 并设为 master
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone create windy.me
|
||||
docker compose exec auth pdnsutil zone set-kind windy.me master
|
||||
|
||||
docker compose exec auth pdnsutil zone create wsvc.info
|
||||
docker compose exec auth pdnsutil zone set-kind wsvc.info master
|
||||
|
||||
docker compose exec auth pdnsutil zone create chans.xyz
|
||||
docker compose exec auth pdnsutil zone set-kind chans.xyz master
|
||||
```
|
||||
|
||||
### 2️⃣ 导入 zone 文件
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone load windy.me /import/windy.me.zone
|
||||
docker compose exec auth pdnsutil zone load wsvc.info /import/wsvc.info.zone
|
||||
docker compose exec auth pdnsutil zone load chans.xyz /import/chans.xyz.zone
|
||||
```
|
||||
|
||||
### 3️⃣ 如 zone 含有 RRSIG/DNSKEY，设为 presigned
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone set-presigned windy.me
|
||||
docker compose exec auth pdnsutil zone set-presigned wsvc.info
|
||||
docker compose exec auth pdnsutil zone set-presigned chans.xyz
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、导入 TSIG 密钥并授权从节点
|
||||
|
||||
### 1️⃣ 导入 TSIG key
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil tsigkey import "mykey." hmac-sha512 "4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg=="
|
||||
```
|
||||
|
||||
### 2️⃣ 授权从节点（202.91.35.141）
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil metadata set windy.me TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set windy.me ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set windy.me ALSO-NOTIFY "202.91.35.141"
|
||||
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info ALSO-NOTIFY "202.91.35.141"
|
||||
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz ALSO-NOTIFY "202.91.35.141"
|
||||
```
|
||||
|
||||
> ⚠️ 不带 `@mykey.`，因为已全局指定 TSIG key。
|
||||
|
||||
---
|
||||
|
||||
## 七、在从节点配置新的主节点
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone create-secondary windy.me 154.36.174.161
|
||||
sudo pdnsutil metadata set windy.me AXFR-MASTER-TSIG "mykey."
|
||||
|
||||
sudo pdnsutil zone create-secondary wsvc.info 154.36.174.161
|
||||
sudo pdnsutil metadata set wsvc.info AXFR-MASTER-TSIG "mykey."
|
||||
|
||||
sudo pdnsutil zone create-secondary chans.xyz 154.36.174.161
|
||||
sudo pdnsutil metadata set chans.xyz AXFR-MASTER-TSIG "mykey."
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 八、触发 AXFR 同步
|
||||
|
||||
### 主节点发送 NOTIFY
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdns_control notify windy.me
|
||||
docker compose exec auth pdns_control notify wsvc.info
|
||||
docker compose exec auth pdns_control notify chans.xyz
|
||||
```
|
||||
|
||||
### 从节点主动获取
|
||||
|
||||
```bash
|
||||
sudo pdns_control retrieve windy.me
|
||||
sudo pdns_control retrieve wsvc.info
|
||||
sudo pdns_control retrieve chans.xyz
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 九、验证结果
|
||||
|
||||
### 检查 zone 状态
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone list-all
|
||||
```
|
||||
|
||||
### 对比 SOA 序列号
|
||||
|
||||
```bash
|
||||
dig @154.36.174.161 soa windy.me +short
|
||||
dig @202.91.35.141 soa windy.me +short
|
||||
```
|
||||
|
||||
应相同。
|
||||
|
||||
### 查看日志
|
||||
|
||||
主节点：
|
||||
|
||||
```
|
||||
AXFR-out zone 'windy.me', client '202.91.35.141' transfer started/done
|
||||
```
|
||||
|
||||
从节点：
|
||||
|
||||
```
|
||||
AXFR done for 'windy.me'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 十、常见错误与修复
|
||||
|
||||
|日志|原因|修复|
|
||||
|---|---|---|
|
||||
|Signature with TSIG key failed|双方 TSIG secret 不一致|重新导入一致的 key|
|
||||
|Server Not Authoritative / Not Authorized|主节点未授权从节点|执行 metadata set ALLOW-AXFR-FROM|
|
||||
|AXFR-out denied: client has no permission|同上|增加 ALLOW-AXFR-FROM|
|
||||
|Trying to set unknown setting 'default-soa-edit-api'|配置无效|删除该字段|
|
||||
|
||||
---
|
||||
|
||||
## 十一、备份与维护
|
||||
|
||||
### 1️⃣ 数据库备份
|
||||
|
||||
```bash
|
||||
docker compose exec pdns-db pg_dump -U pdns pdns > /backup/pdns-$(date +%F).dump
|
||||
```
|
||||
|
||||
### 2️⃣ 导出所有 zone 文件
|
||||
|
||||
```bash
|
||||
mkdir -p /backup/zones
|
||||
for z in $(docker compose exec auth pdnsutil zone list-all | tr -d '\r'); do
|
||||
docker compose exec auth pdnsutil zone list "$z" > "/backup/zones/$z-$(date +%F).zone"
|
||||
done
|
||||
```
|
||||
|
||||
---
|
||||
@@ -0,0 +1,19 @@
|
||||
|
||||
gzzn:
|
||||
410 456 544
|
||||
|
||||
password:
|
||||
```
|
||||
w42YyME_y3jVb!qa4X.c
|
||||
```
|
||||
|
||||
|
||||
win vm:
|
||||
```
|
||||
517 010 265
|
||||
```
|
||||
|
||||
password:
|
||||
```
|
||||
uW!g6CU6kteozaHUaJX*
|
||||
```
|
||||
@@ -0,0 +1,13 @@
|
||||
|
||||
|
||||
service key:
|
||||
```
|
||||
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InFldWRtbGdvc2p2dnJzbWxkY3RrIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc2NTUwMjMyOCwiZXhwIjoyMDgxMDc4MzI4fQ.2rujZwkqatXYyvNwr4hkAWgSGi2q-FqWREicE-5sFBA
|
||||
```
|
||||
|
||||
|
||||
url:
|
||||
```
|
||||
https://qeudmlgosjvvrsmldctk.supabase.co
|
||||
```
|
||||
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
mount point:
|
||||
/mnt/tank/Downloads
|
||||
|
||||
/mnt/tank/iocage/jails/transmission/root/usr/local/etc/transmission/home/Downloads
|
||||
|
||||
mac:
|
||||
a21d4803aa46 a21d4803aa47
|
||||
Executable
+22
@@ -0,0 +1,22 @@
|
||||
|
||||
1、下载简体中文正式版
|
||||
zh-cn_windows_11_enterprise_ltsc_2024_x64_dvd_cff9cd2d.iso
|
||||
链接 hxxps://massgrave.dev/windows_ltsc_links
|
||||
|
||||
2、下载U盘启动工具rufus
|
||||
hxxps://github.com/pbatard/rufus/releases/download/v4.6/rufus-4.6p.exe
|
||||
在制作启动盘前根据图片设置
|
||||
|
||||
3、联网通过MAS激活或taobao购买key激活（约5-10rmb）
|
||||
hxxps://github.com/massgravel/Microsoft-Activation-Scripts
|
||||
|
||||
|
||||
|
||||
安装id
|
||||
```
|
||||
2009504 6265236 2833605 8639124 3459384 0687966 2714276 2063255 5191281
|
||||
```
|
||||
确认
|
||||
```
|
||||
092524 880890 346580 068743 201496 519312 470431 990856
|
||||
```
|
||||
@@ -0,0 +1,28 @@
|
||||
|
||||
自制精简优化Windows 10 LTSC2021简体中文版
|
||||
—————————————————————————————————————————
|
||||
文件名称: WIN10_LTSC2021_X64_ZH-CN_19044.1387.iso
|
||||
文件大小: 3.34 GB (3,592,355,840 字节)
|
||||
修改时间: 2021年11月30日
|
||||
MD5: 9BFFE3984F14CC8F4ACA1F465636F2D3
|
||||
SHA256: B9451EE3383DAAF3C7AC21DF18DA700F9BC9BAEF310A158B4151F668B980C9CF
|
||||
CRC32: C27756CF
|
||||
—————————————————————————————————————————
|
||||
|
||||
KMS激活命令：以管理员身份运行CMD（命令提示符）
|
||||
—————————————————————————————————————————
|
||||
slmgr /skms kms.03k.org
|
||||
slmgr /ato
|
||||
—————————————————————————————————————————
|
||||
|
||||
下载链接
|
||||
—————————————————————————————————————————
|
||||
阿里云盘：https://www.aliyundrive.com/s/rVRSBYc85Xe （下载文件后去掉后缀.PDF）
|
||||
百度云盘：https://pan.baidu.com/s/1Nlh_3A-yvqZW2l6dq0hE2g（提取码: ifbs）
|
||||
—————————————————————————————————————————
|
||||
|
||||
|
||||
激活
|
||||
```
|
||||
KC4NW-4GGX6-MFFGM-RGMFD-4GDGY
|
||||
```
|
||||
@@ -0,0 +1,11 @@
|
||||
|
||||
|
||||
|
||||
# WSVC
|
||||
|
||||
Client Secret
|
||||
211073924279107589@wsvc.info
|
||||
|
||||
|
||||
wsvc project:
|
||||
211074961312382981@wsvc.info
|
||||
@@ -0,0 +1,89 @@
|
||||
|
||||
## Docker + firewalld + iptables 关系总结
|
||||
|
||||
### 1. 三者分工
|
||||
|
||||
- **iptables**：内核防火墙引擎，真正执行包过滤和 NAT。
|
||||
- **firewalld**：iptables 的“策略管理层”，按 **zone / service / masquerade** 等抽象生成规则。
|
||||
- **Docker（iptables=true）**：在 iptables 中写入 **容器相关** 的规则：
|
||||
- 容器出网 SNAT（MASQUERADE）
|
||||
- 宿主端口 → 容器端口的 DNAT
|
||||
- 容器网络之间的隔离（DOCKER-ISOLATION）
|
||||
|
||||
三者是“共用 iptables，各管一摊”，不是互相替代。
|
||||
|
||||
---
|
||||
|
||||
### 2. Docker 关键配置项
|
||||
|
||||
`/etc/docker/daemon.json`：
|
||||
|
||||
```json
|
||||
{
|
||||
"iptables": true,
|
||||
"ip-masq": true
|
||||
}
|
||||
```
|
||||
|
||||
- `"iptables": true`（默认）
|
||||
- Docker 创建/维护 DOCKER 链、端口映射、容器出网 NAT 等规则。
|
||||
- 必须开启，否则大多数容器网络功能会坏（包括端口映射、bridge 容器出网）。
|
||||
|
||||
- `"iptables": false`
|
||||
- Docker 不再改 iptables，**不再创建 DOCKER/NAT 规则**。
|
||||
- 需要你手工写所有 NAT / 端口映射规则。
|
||||
- 常见现象：宿主机 & `--network host` 容器有网，但所有 bridge 容器出不了网。
|
||||
|
||||
- `"ip-masq": true`
|
||||
- 为 Docker 私网（如 172.17.0.0/16）自动加 MASQUERADE，容器可用宿主 IP 出网。
|
||||
|
||||
---
|
||||
|
||||
### 3. firewalld 与 Docker 的协作方式
|
||||
|
||||
典型做法（推荐）：
|
||||
|
||||
1. 保持 Docker 使用 iptables：
|
||||
```json
|
||||
{
|
||||
"iptables": true,
|
||||
"ip-masq": true
|
||||
}
|
||||
```
|
||||
2. 在 firewalld 里：
|
||||
- 为 `docker0`、`br-xxxx` 等网桥分配到 `docker` zone：
|
||||
```bash
|
||||
firewall-cmd --zone=docker --add-interface=docker0 --permanent
|
||||
firewall-cmd --zone=docker --add-interface=br-xxxx --permanent
|
||||
```
|
||||
- 打开 masquerade 与 forward：
|
||||
```bash
|
||||
firewall-cmd --zone=docker --add-masquerade --permanent
|
||||
firewall-cmd --zone=docker --add-forward --permanent
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
**原则：**
|
||||
|
||||
- Docker 负责：**容器内部路由 + NAT + 端口映射的具体规则**；
|
||||
- firewalld 负责：**哪些接口/zone 允许转发、伪装、对外开放哪些端口**。
|
||||
|
||||
---
|
||||
|
||||
### 4. 典型坑点（本次踩到的）
|
||||
|
||||
- 设置：
|
||||
|
||||
```json
|
||||
{
|
||||
"iptables": false
|
||||
}
|
||||
```
|
||||
|
||||
- 结果：
|
||||
- 宿主机有网；
|
||||
- `--network host` 容器有网；
|
||||
- 所有 bridge 网络容器无外网、访问 LE 超时。
|
||||
- 根因：
|
||||
- Docker 停止管理 iptables，不再生成容器 NAT 规则；
|
||||
- firewalld 只负责 zone 和 masquerade，但**不知道容器网络细节**，无法替 Docker 完成 SNAT/端口映射。
|
||||
@@ -0,0 +1,71 @@
|
||||
|
||||
|
||||
```
|
||||
create database vaultwarden;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'windysecurity';
|
||||
GRANT ALL PRIVILEGES ON DATABASE vaultwarden TO vaultwarden;
|
||||
```
|
||||
|
||||
|
||||
```bitwarden.load
|
||||
LOAD DATABASE
|
||||
FROM sqlite:///opt/vaultwarden/vw-data/db.sqlite3
|
||||
INTO postgresql://vaultwarden:windysecurity@localhost:5432/vaultwarden
|
||||
|
||||
WITH include drop, create tables, create indexes, reset sequences
|
||||
EXCLUDING TABLE NAMES LIKE '__diesel_schema_migrations'
|
||||
ALTER SCHEMA 'main' RENAME TO 'public'
|
||||
;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
pgloader bitwarden.load
|
||||
```
|
||||
|
||||
```
|
||||
-- Grant usage and create permissions on the public schema
|
||||
GRANT USAGE ON SCHEMA public TO vaultwarden;
|
||||
GRANT CREATE ON SCHEMA public TO vaultwarden;
|
||||
|
||||
-- Optionally, grant all permissions on the public schema
|
||||
GRANT ALL ON SCHEMA public TO vaultwarden;
|
||||
|
||||
-- Transfer ownership of the public schema to vaultwarden (optional)
|
||||
ALTER SCHEMA public OWNER TO vaultwarden;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```.env
|
||||
DOMAIN="https://auth.wsvc.info/"
|
||||
DATABASE_URL=postgresql://vaultwarden:windysecurity@172.18.0.1:5432/vaultwarden
|
||||
SMTP_HOST=smtp.windy.me
|
||||
SMTP_FROM=<vnet@windy.me>
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURITY=starttls
|
||||
SMTP_USERNAME=vnet@windy.me
|
||||
SMTP_PASSWORD=windyboy2006
|
||||
```
|
||||
|
||||
```admin token
|
||||
i8aHqBZvgTjCoHKRqMqHxmbFs3JFwWnrzPuub09sUnYKTfwZ7m1VCKXABlSxRkJ6
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
echo -n "VjoM4sndg4.8uCzPmodH" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1
|
||||
```
|
||||
|
||||
```
|
||||
$argon2id$v=19$m=19456,t=2,p=1$eXhRMTBiVXRjR2pFalpRYStCQys1SmtkaGVONTFJWm9HQmNMVDg2ZGlkVT0$ssdf1xrdTwXP7S7xoRiams1R3nGeSS3dkuKcPD/sO90
|
||||
```
|
||||
|
||||
```
|
||||
ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$d3Pa5o/TrvEhaVvj/bypWSnBqIFjU/rqkRV+Th7KmHU$ZDwdhqyIrTTvnAsIAUURjN3t3bgNWJfEh8Mv2cY0gUs'
|
||||
```
|
||||
Reference in New Issue
Block a user