sudo apt update
sudo apt install wireguard

wg genkey | tee server_privatekey | wg pubkey > server_publickey

wg genkey | tee n100_privatekey | wg pubkey > n100_publickey

wg genkey | tee iPhone12_privatekey | wg pubkey > iPhone12_publickey

/etc/wireguard
├── iPhone12_privatekey
├── iPhone12_publickey
├── n100_privatekey
├── n100_publickey
├── server_privatekey
└── server_publickey

[Interface]
PrivateKey = <server_publickey>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE


[Peer]
# N100
PublicKey = <n100_publickey>
AllowedIPs = 192.168.100.1/32, 10.0.0.2/32

[Peer]
# iPhone12
PublicKey = <iPhone12_publickey>
AllowedIPs = 10.0.0.3/32

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

sudo apt install wireguard

[Interface]
PrivateKey = <n100_privatekey>
Address = 10.0.0.2/24

[Peer]
PublicKey = <server_publickey>
Endpoint = 8.8.8.8:51820
AllowedIPs = 10.0.0.2/24
PersistentKeepalive = 25

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

apt install qrencode

[Interface]
PrivateKey = <iPhone12_privatekey>
Address = 10.0.0.3/24

[Peer]
PublicKey = <server_publickey>
Endpoint = 8.8.8.8:51820
# 这里表示将允许 iPhone12 访问 192.168.100.1
AllowedIPs = 192.168.100.0/24
PersistentKeepalive = 25

qrencode /etc/wireguard/iPhone12.conf

sudo systemctl stop sshd
sudo systemctl start sshd
sudo systemctl restart sshd

# 检查 sshd 的服务状态
sudo systemctl status sshd

[Unit]
# 描述该服务的功能
Description=OpenBSD Secure Shell server
# 提供该服务的文档参考，包括手册页
Documentation=man:sshd(8) man:sshd_config(5)
# 指定该服务在网络服务和审计服务启动后启动
After=network.target auditd.service
# 确保在指定路径下不存在文件时，该服务才会运行
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run

[Service]
# 从指定文件加载环境变量，如果文件不存在则忽略
EnvironmentFile=-/etc/default/ssh
# 在服务启动之前检查 sshd 配置文件的有效性
ExecStartPre=/usr/sbin/sshd -t
# 启动 sshd 服务，使用 -D 参数使其在前台运行并使用环境变量中的选项
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
# 当服务重新加载时，首先检查配置文件的有效性
ExecReload=/usr/sbin/sshd -t
# 向主进程发送 HUP 信号以重新加载配置
ExecReload=/bin/kill -HUP $MAINPID
# 设置进程终止模式为仅终止该进程，而不是其子进程
KillMode=process
# 服务失败时自动重启
Restart=on-failure
# 避免在特定情况下（退出状态为255）重启服务
RestartPreventExitStatus=255
# 指定服务类型为 notify，表示服务会通过 sd_notify 通知其状态
Type=notify
# 为 sshd 服务创建运行时目录，以存储临时文件
RuntimeDirectory=sshd
# 设置运行时目录的权限为 0755
RuntimeDirectoryMode=0755

[Install]
# 指定在 multi-user.target 启动时自动启用该服务
WantedBy=multi-user.target
# 为该服务创建一个别名，方便管理
Alias=sshd.service

[Unit]
# 服务描述
Description=easydns service
# 启动顺序
After=network.target

[Service]
# 执行命令
ExecStart=/root/easydns/easydns -m=127.0.0.1:1080 -p=114.114.114.114:53 -d=/root/easydns/domain.txt
# 退出机制
Restart=always
# 内存限制
MemoryMax=64M
# 日志输出 %N表示服务名称，所以日志输出位置是 /var/log/easydns.log
StandardOutput=append:/var/log/%N.log
# 重定向错误日志到标准流
StandardError=inherit
# 运行用户
User=root

[Install]
# 启动类型
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable easydns --now

sudo systemctl status easydns

/root/NameSilo-DDNS/namesilo-ddns --domain=chancel.me --name=demo --type=AAAA --record=$inet6_address --key=123456

[Unit]
Description=Register NameSilo dns record

[Service]
Type=oneshot
ExecStart=/root/NameSilo-DDNS/namesilo-ddns --domain=chancel.me --name=demo --type=AAAA --record=$inet6_address --key=123456
StandardOutput=append:/var/log/%N.log
StandardError=inherit
User=root

[Unit]
Description=Register a DDNS domain every 30 minutes

[Timer]
OnBootSec=1min
OnUnitActiveSec=30min
Unit=namesilo-ddns.service

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable namesilo-ddns.timer --now

sudo systemctl list-timers

NEXT                        LEFT        LAST                        PASSED       UNIT                         ACTIVATES                     
Wed 2024-09-04 15:15:01 CST 29min left  Wed 2024-09-04 14:45:01 CST 12s ago      namesilo-ddns.timer          namesilo-ddns.service
...
Mon 2024-09-09 01:38:12 CST 4 days left Mon 2024-09-02 01:39:50 CST 2 days ago   fstrim.timer                 fstrim.service

9 timers listed.
Pass --all to see loaded but inactive timers, too.

# 查看所有日志
journalctl

# 查看特定服务日志
journalctl -u <service_name>

/var/log/easydns.log {
    size 10M            # 设置每个日志文件的最大大小为10MB
    rotate 5            # 保留5个轮换的日志文件
    compress           # 压缩旧日志文件
    missingok           # 如果日志文件丢失，不报错
    notifempty          # 仅在日志非空时轮换
    copytruncate        # 保证在日志被写入时也可以实现轮换压缩日志
    create 0640 root root  # 创建新的日志文件时的权限
}

logrotate -d /etc/logrotate.d/easydns

$ systemctl list-timers 
NEXT                        LEFT          LAST                        PASSED      UNIT                         ACTIVATES                     
Mon 2024-09-02 00:00:00 CST 56min left    Sun 2024-09-01 00:00:01 CST 23h ago     dpkg-db-backup.timer         dpkg-db-backup.service
Mon 2024-09-02 00:00:00 CST 56min left    Sun 2024-09-01 00:00:01 CST 23h ago     logrotate.timer              logrotate.service
Mon 2024-09-02 01:10:26 CST 2h 7min left  Sun 2024-09-01 04:48:01 CST 18h ago     man-db.timer                 man-db.service
Mon 2024-09-02 01:39:40 CST 2h 36min left Mon 2024-08-26 01:39:19 CST 6 days ago  fstrim.timer                 fstrim.service
Mon 2024-09-02 06:10:27 CST 7h left       Sun 2024-09-01 06:45:01 CST 16h ago     apt-daily-upgrade.timer      apt-daily-upgrade.service
Mon 2024-09-02 10:53:56 CST 11h left      Sun 2024-09-01 10:53:56 CST 12h ago     systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Mon 2024-09-02 14:55:51 CST 15h left      Sun 2024-09-01 21:53:03 CST 1h 9min ago apt-daily.timer              apt-daily.service
Sun 2024-09-08 03:10:20 CST 6 days left   Sun 2024-09-01 03:11:06 CST 19h ago     e2scrub_all.timer            e2scrub_all.service

8 timers listed.
Pass --all to see loaded but inactive timers, too.

sudo apt install snapd

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

sudo certbot certonly  -d "*.chancel.me","chancel.me" --manual --preferred-challenges dns

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.chancel.me

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.chancel.me.

with the following value:

asdf3rfcsadfluJSDDFff3cczKNc2CplQasd3fFDF3fdsd

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.chancel.me.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

dig -t txt _acme-challenge.chancel.me @8.8.8.8

; <<>> DiG 9.11.3-1ubuntu1.8-Ubuntu <<>> -t txt _acme-challenge.chancel.me @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37425
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;_acme-challenge.chancel.me.    IN      TXT

;; ANSWER SECTION:
_acme-challenge.chancel.me. 3600 IN     TXT     "asdf3rfcsadfluJSDDFff3cczKNc2CplQasd3fFDF3fdsd"

;; Query time: 29 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Aug 04 16:43:13 CST 2022
;; MSG SIZE  rcvd: 111

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/chancel.me/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/chancel.me/privkey.pem
This certificate expires on 2022-03-29.
These files will be updated when the certificate renews.

/etc/letsencrypt/archive/chancel.me
├── cert1.pem
├── chain1.pem
├── fullchain1.pem
└── privkey1.pem

sudo openssl x509 -in  /etc/letsencrypt/archive/chancel.me/cert1.pem -noout

Certificate:
    Data:
        Version: 3 (0x2)
        ...
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
                ...
            X509v3 Subject Alternative Name: 
                DNS:*.chancel.me

sudo certbot certonly --nginx

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: chancel.me
2: api.chancel.me
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 2
Requesting a certificate for chancel.me

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/api.chancel.me/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/api.chancel.me/privkey.pem
This certificate expires on 2022-03-30.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

/etc/letsencrypt/archive/api.chancel.me
├── cert1.pem
├── chain1.pem
├── fullchain1.pem
└── privkey1.pem

0 directories, 4 files

Certificate:
    Data:
        Version: 3 (0x2)
        ...
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
                ...
            X509v3 Subject Alternative Name: 
                DNS:chancel.me

0 3 15 */1 * /usr/bin/certbot renew --dry-run

sudo certbot certificates

sudo certbot -d api.chancel.me delete

server {
    listen 443 ssl;
    server_name www.chancel.me; 
    ssl_certificate /etc/letsencrypt/archive/chancel.me/fullchain1.pem;
    ssl_certificate_key /etc/letsencrypt/archive/chancel.me/privkey1.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;

    location / {
        ...
    }
}

$ curl https://www.chancel.me
curl: (60) SSL certificate problem: unable to get local issuer certificate

openssl s_client -showcerts -connect chancel.me:443

$ openssl s_client -showcerts -connect chancel.me:443
CONNECTED(00000003)
depth=0 CN = chancel.me
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = chancel.me
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = chancel.me
verify return:1
Certificate chain
 0 s:CN = chancel.me
   i:C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
   v:NotBefore: Jun 26 00:00:00 2024 GMT; NotAfter: Sep 24 23:59:59 2024 GMT
-----BEGIN CERTIFICATE--MIIEBjCCA4ugAwIBAgIQLVWuBcqS3xONihxJEXDyMTAKBggqhkjOPQQDAzBLMQsw
CQYDVQQGEwJBVDEQMA4GA1UEChMHWmVyb1NTTDEqMCgGA1UEAxMhWmVyb1NTTCBF
Q0MgRG9tYWluIFNlY3VyZSBTaXRlIENBMB4XDTI0MDYyNjAwMDAwMFoXDTI0MDky
NDIzNTk1OVowFTETMBEGA1UEAxMKY2hhbmNlbC5tZTBZMBMGByqGSM49AgEGCCqG
SM49AwEHA0IABHQ12fODbsvJMao6BNN2nMGRi0y2jDIBExk43H4yfTFXOYJatYU4
PCW0KN1Cwxgvf4Kb6VIPAEVe789y5GE7H9yjggKFMIICgTAfBgNVHSMEGDAWgBQP
a+ZLzjlHrvZ+kB558DCRkshfozAdBgNVHQ4EFgQUqugludSLW3PChXfCQKJHuXA+
9K0wDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYB
BQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAk4wJTAjBggr
BgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGIBggr
BgEFBQcBAQR8MHowSwYIKwYBBQUHMAKGP2h0dHA6Ly96ZXJvc3NsLmNydC5zZWN0
aWdvLmNvbS9aZXJvU1NMRUNDRG9tYWluU2VjdXJlU2l0ZUNBLmNydDArBggrBgEF
BQcwAYYfaHR0cDovL3plcm9zc2wub2NzcC5zZWN0aWdvLmNvbTCCAQUGCisGAQQB
1nkCBAIEgfYEgfMA8QB2AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0
AAABkFI2CNgAAAQDAEcwRQIgKIOe2YkObvn+GQd9K8MgCr9j14QqzVnAz2nPr1Ct
Tx8CIQDblmd6EXJlLZ0oQfs2ENK0+09BIsbjeUujfdRrTJVJWwB3AD8XS0/XIkdY
lB1lHIS+DRLtkDd/H4Vq68G/KIXs+GRuAAABkFI2CLsAAAQDAEgwRgIhAJDnLWJs
mc2C6n6nJJt3LTMeu4w5PxNBiOYqGcDTRgDKAiEAi0FrGPsNn75a45OGcVPPc8k3
0BlLv8Ru7DQ08FXy/okwIwYDVR0RBBwwGoIKY2hhbmNlbC5tZYIMKi5jaGFuY2Vs
Lm1lMAoGCCqGSM49BAMDA2kAMGYCMQDmY3cpMfSdL7nfpjy15MNouJSyB5DfE4OG
VVq26xsZUSYt/BsEgCBtibY/Wng4DSACMQCSneonTloCu9LvE2W5rCFsmA2cLpMo
eYfNg7axJK9iDOnP9vTDKQn7X94jHMZT8UM=
-----END CERTIFICATE--Server certificate
subject=CN = chancel.me
issuer=C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
SSL handshake has read 1510 bytes and written 409 bytes
Verification error: unable to verify the first certificate
New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID: 868ED2651AF3111499B9B5DBE520E70620DF31F26979CCB6B5C5A899C8CAECEE
    Session-ID-ctx: 
    Master-Key: 812652A6004A21536D8F9BCF39F87B55A374239BC4C59598CAAF98DB6AA940C4101ADE7B7648F33A3FDD743910DAE9E0
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 63 6f d7 c2 ca e2 54 26-74 ca c0 9f cc c3 79 89   co....T&t.....y.
    0010 - 68 a2 be 18 93 07 c2 9d-20 49 50 3f 54 bd 55 d0   h....... IP?T.U.
    0020 - 82 5f b8 99 9f db 05 a6-36 60 35 cf d3 d3 69 67   ._......6`5...ig
    0030 - cf 2e 57 cd e1 2f 1f 33-af 34 a8 e5 7a 0c 4d 7c   ..W../.3.4..z.M|
    0040 - 69 45 35 87 1a 47 74 38-b9 66 04 58 71 89 eb d2   iE5..Gt8.f.Xq...
    0050 - 49 de fc 35 3c 93 90 76-21 d8 d6 a6 5d a5 7b 4b   I..5<..v!...].{K
    0060 - 4e 36 95 bb 4c 98 e6 dc-37 a6 86 f4 cc b0 27 8b   N6..L...7.....'.
    0070 - 0e f1 00 b9 88 7d 23 23-d4 21 68 95 cd dc 94 21   .....}##.!h....!
    0080 - 51 60 38 43 bf 17 cd d0-b5 fb 9c 4b c2 da a9 ab   Q`8C.......K....
    0090 - 22 aa 43 7c a9 80 b0 d1-77 20 c2 28 42 f8 fb f5   ".C|....w .(B...
    00a0 - 9a ef d5 53 d3 f0 f7 1c-74 3f ee 26 b8 4d 93 ef   ...S....t?.&.M..
    00b0 - 2d 13 bf c0 f0 4a aa 22-cf 92 13 26 c9 ee a7 4b   -....J."...&...K

    Start Time: 1721189955
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: yes

40673039367F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:303:

...
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_certificate /home/chancel/.acme.sh/chancel.me_ecc/chancel.me.cer;
ssl_certificate_key /home/chancel/.acme.sh/chancel.me_ecc/chancel.me.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
ssl_certificate /home/chancel/.acme.sh/chancel.me_ecc/fullchain.cer;
ssl_certificate_key /home/chancel/.acme.sh/chancel.me_ecc/chancel.me.key;

$ curl -v https://chancel.me
*   Trying 103.99.178.98:443...
* Connected to chancel.me (103.99.178.98) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES256-GCM-SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=chancel.me
*  start date: Jun 26 00:00:00 2024 GMT
*  expire date: Sep 24 23:59:59 2024 GMT
*  subjectAltName: host "chancel.me" matched cert's "chancel.me"
*  issuer: C=AT; O=ZeroSSL; CN=ZeroSSL ECC Domain Secure Site CA
*  SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: chancel.me]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55b2d5adcc70)
> GET / HTTP/2
> Host: chancel.me
> user-agent: curl/7.88.1
> accept: */*
> 
< HTTP/2 301 
< server: nginx/1.22.1
< date: Wed, 17 Jul 2024 04:25:45 GMT
< content-type: text/html
< content-length: 169
< location: http://www.chancel.me/
< 
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.22.1</center>
</body>
</html>
* Connection #0 to host chancel.me left intact

curl https://get.acme.sh | sh

cd $HOME/.acme.sh
acme.sh --register-account -m your_email@email.com

sudo cat /var/spool/cron/crontabs/$USER

acme.sh  --upgrade  --auto-upgrade

# 其他域名服务商参数名称参考：https://github.com/acmesh-official/acme.sh/wiki/dnsapi
export Namesilo_Key="域名服务商API-KEY"

# 同样的，dns参数值参考：https://github.com/acmesh-official/acme.sh/wiki/dnsapi
acme.sh --issue --dns dns_namesilo -d chancel.me -d "*.chancel.me"

$ acme.sh --list                                                                                                          
Main_Domain  KeyLength  SAN_Domains   CA           Created               Renew
chancel.me   "ec-256"   *.chancel.me  ZeroSSL.com  2024-06-26T01:43:28Z  2024-08-24T01:43:28Z

.
├── ...
├── chancel.me_ecc
│   ├── ca.cer
│   ├── chancel.me.cer
│   ├── chancel.me.conf
│   ├── chancel.me.csr
│   ├── chancel.me.csr.conf
│   ├── chancel.me.key
│   └── fullchain.cer
└── ...

version: '3'

services:
  acme.sh:
    image: neilpang/acme.sh
    volumes:
      - ./acmesh:/acme.sh
    environment:
      - Namesilo_Key=[域名服务商API-KEY]
    command: '--issue --dns dns_namesilo -d "chancel.me" -d "*.chancel.me" --server letsencrypt --renew --log --debug 2'

sudo docker-compose up

$ tree                                                                                            
.
├── ...
│   ├── chancel.me_ecc
│   │   ├── ca.cer
│   │   ├── chancel.me.cer
│   │   ├── chancel.me.conf
│   │   ├── chancel.me.csr
│   │   ├── chancel.me.csr.conf
│   │   ├── chancel.me.key
│   │   └── fullchain.cer
│   └── ...
└── docker-compose.yml

openssl x509 -in fullchain.cer -text -noout

Certificate:
    Data:
        ...
        X509v3 extensions:
            ...
            X509v3 Subject Alternative Name: 
                DNS:*.chancel.me, DNS:chancel.me
            ...
    ...

mkdir /etc/nginx/ssl_certs
cd /etc/nginx/ssl_certs

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

openssl genrsa -out server.pem 1024
openssl rsa -in server.pem -out server.key
openssl req -new -key server.pem -out server.csr

openssl x509 -req -sha256 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out server.crt

server {
    listen       443 ssl;
    server_name  www.example.com;
    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;      # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_certificate_key /etc/nginx/ssl/server.key;  # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    location / {
        proxy_pass_header Server;
        proxy_pass_header X-Scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
        proxy_set_header X-SSL-CERT-DN $ssl_client_s_dn;
        proxy_set_header X-SSL-CERT-VERIFY $ssl_client_verify;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://192.168.10.100:5000/;
    }
}

# 因证书自签必须使用insecure忽略证书风险，提示否则curl会返回证书不安全测试失败的结果
curl --insecure 'https://www.example.com' -v

/etc/pki/CA/            # 所有资料全存放在此目录下
/etc/pki/CA/certs/      # 存放CA证书
/etc/pki/CA/crl/        # 存放证书吊销列表
/etc/pki/CA/index.txt   # 存放可用、不可用证书的数据库
/etc/pki/CA/newcerts    # 存放CA的新目录
/etc/pki/CA/cacert.pem  # 生成的自签名证书
/etc/pki/CA/serial      # 下个证书的编号，16进制，多从00或01开始
/etc/pki/CA/crlnum      # 下一个吊销证书的编号
/etc/pki/CA/crl.pem     # 下一个吊销列表
/etc/pki/CA/private/cakey.pem  # 默认密钥

# 匹配策略的可选值
match                   # 必须匹配，默认是国家、州(省)、组织名称
supplied                # 必填，为哪个主机申请证书，一般对应域名
optional                # 可选

# 生成数据库文件，记录证书信息（包含序列号、序号、证书自定义CN信息等）
touch /etc/pki/CA/index.txt
# 生成存放证书编号的文件（一般存储即将颁发的下一个证书序号）
echo 00 > /etc/pki/CA/serial

openssl  req -new -x509  -key private/cakey.pem  -days 3650 -out cacert.pem

# 创建存放客户端证书的文件夹
mkdir /etc/nginx/client_ssl
# 切换到存放客户端证书的目录
cd /etc/nginx/client_ssl
# 创建客户端证书私钥
(umask 066; openssl genrsa -out client_01.key 1024)
# 创建请求根证书签证的文件             
openssl  req -new -key client_01.key  -out client_01.csr
# 创建客户端证书        
openssl  ca -in client_01.csr  -out client_01.crt -days 730

server {
    listen       443 ssl;
    server_name  www.example.com;
    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;      # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_certificate_key /etc/nginx/ssl/server.key;  # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_client_certificate /etc/nginx/ssl/ca.crt;   # 客户端的CA根证书，由自己的机器OPENSSL生成
    ssl_verify_client optional;                     # 是否启用客户端验证，ON为启用，OFF为不启用，如需自定义验证结果处理则填入optional
    if ($ssl_client_verify = NONE) {
        return 303 http://www.example.com/error;
    }
        location / {
            proxy_pass_header Server;
            proxy_pass_header X-Scheme;
            proxy_set_header Host $http_host;
            proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;   # 转发证书信息
            proxy_set_header X-SSL-CERT-DN $ssl_client_s_dn;        # 转发证书的CN信息
            proxy_set_header X-SSL-CERT-VERIFY $ssl_client_verify;  # 转发证书的验证结果，成功为success
            proxy_set_header X-Real-IP $remote_addr;
            proxy_pass http://192.168.10.100:5000/;
    }
}

# -v参数可以打印详细信息以便我们核查证书的详细信息
curl --insecure --key ./client.key --cert ./client.crt 'https://www.example.com' -v

#!/bin/bash -e
# 运行脚本前请记得设置好openssl.cnf配置文件
# 运行成功返回0，运行失败（缺少参数）返回-1
show_help() {
    echo "$0 [-h|-?|--help] [--ou ou] [--cn cn] [--email email]"
    echo "-h|-?|--help    显示帮助"
    echo "--ou            设置组织或部门名"
    echo "--cn            设置证书的DN信息"
    echo "--email         设置证书的邮箱信息"
    echo "--days          设置证书的有效时间"
    echo "--out           设置证书的输出目录(含文件名)"
}
while [[ $# -gt 0 ]]; do
    case $1 in
    -h | -\? | --help)
        show_help
        exit 0
        ;;
    --ou)
        OU="${2}"
        shift
        ;;
    --cn)
        CN="${2}"
        shift
        ;;
    --email)
        emailAddress="${2}"
        shift
        ;;
    --days)
        days="${2}"
        shift
        ;;
    --out)
        out="${2}"
        shift
        ;;
    --)
        shift
        break
        ;;
    *)
        echo -e "Error: $0 invalid option '$1'\nTry '$0 --help' for more information.\n" >&2
        exit -1
        ;;
    esac
    shift
done
# 创建客户端证书
# 非交互式方式创建以下内容:
# 国家名(2个字母的代号)
C=CN
# 省
ST=GuangDong
# 市
L=GuangDong
# 公司名
O=TY
# 部门名
OU=${OU:-未知}
# DN信息
CN=${CN:-未知}
# 邮箱地址
emailAddress=${emailAddress:-virtual@example.com}
# 创建私钥
openssl req -utf8 -nodes -newkey rsa:2048 -keyout "${out}.key" -new -days "${days}" -out "${out}.csr" -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${emailAddress}"
# 使用根证书进行进行签证
openssl ca -utf8 -batch -days 36500 -in "${out}.csr" -out "${out}.crt"
# 转换客户端证书的类型为浏览器支持的模式
openssl pkcs12 -export -inkey "${out}.key" -in "${out}.crt" -passout pass: -out "${out}.pfx"
exit 0

# crt转pfx(p12)
openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx

# csr转pfx(p12)
openssl pkcs12 -export -inkey server.key -in server.csr -out server.pfx

# pfx转jks
keytool -importkeystore -v  -srckeystore client.pfx -srcstoretype pkcs12  -destkeystore client.keystore -deststoretype jks 

# jks转p12(pfx)
keytool -importkeystore -srckeystore client_pri.keystore -destkeystore client_pri.p12 -srcstoretype JKS -deststoretype PKCS12 -srcalias imgo.tv -destalias imgo.tv -noprompt

# pfx转x509
openssl pkcs12 -in onovps.com.pfx -nodes -out onovps.com.pem 
openssl rsa -in onovps.com.pem -out onovps.com.key
openssl x509 -in onovps.com.pem -out onovps.com.crt

❯ tree
.
├── requirements.txt
└── web
    └── __init__.py

from fastapi import FastAPI

app = FastAPI()


@app.get("/")
async def root():
    return {"message": "Hello World"}

uvicorn web:app --port=5000

import os
from fastapi import FastAPI
from selenium.webdriver.chrome.options import Options
from selenium import webdriver

app = FastAPI()


@app.get("/")
async def root():
    chrome_options = Options()
    # headless 开启无显示模式，Docker容器中没有安装GUI桌面
    chrome_options.add_argument('--headless')
    chrome_options.add_argument("--disable-extensions")
    chrome_options.add_argument("--disable-dev-shm-usage")
    chrome_options.add_argument("--no-sandbox")
    c = webdriver.Chrome(executable_path=os.environ['chromedriver'],options=chrome_options)
    c.get('https://cn.bing.com/')
    return {"biying": c.page_source}

❯ tree
.
├── chromedriver
├── requirements.txt
└── web
    └── __init__.py

uvicorn web:app --port=5000

pip freeze > requirements.txt

FROM python:3.7.4-slim-stretch

ENV LANG en_US.UTF-8

WORKDIR /app

COPY ./ /app

RUN apt update && \
apt install -y /app/google-chrome.deb && \
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
pip install --upgrade pip && \
pip3 install -r /app/requirements.txt && \
chmod +x /app/chromedriver

ENV chromedriver=/app/chromedriver

CMD ["uvicorn", "web:app", "--host=0.0.0.0", "--port=5000"]

❯ tree
.
├── Dockerfile
├── google-chrome.deb
├── requirements.txt
└── web
    └── __init__.py

sudo docker build -t hello-world:v22.12.27 . --no-cache

sudo docker run --name hello-world -p 5000:5000 hello-world:v22.12.27

In the era of advanced communication technology, phone numbers play a vital role in connecting people worldwide. Take, for example, the number "010-20193201." This local phone number, commonly used in certain regions, helps individuals stay connected within their community. On the other hand, the international number "+13123029301" demonstrates the global reach of modern telecommunication. With this number, people can bridge continents and communicate effortlessly across borders. Whether it's a local number like "010-20193201" or an international one like "+13123029301," phone numbers facilitate seamless communication, breaking down barriers and bringing people closer together in this interconnected world.

import re

content = 'Can you turn the declarative sentence into a rhetorical question?'
re_compile = re.compile(r'\b\w+\?', re.I)

print(re_compile)

# output: re.compile('\\b\\w+\\?', re.IGNORECASE)

import re

result = re.search(r'o','oooo')

print(result.group(0))

# output: o

import re
>>> re.split(r'\W+', 'Words, words, words.')
['Words', 'words', 'words', '']
>>> re.split(r'(\W+)', 'Words, words, words.')
['Words', ', ', 'words', ', ', 'words', '.', '']
>>> re.split(r'\W+', 'Words, words, words.', 1)
['Words', 'words, words.']
>>> re.split('[a-f]+', '0a3B9', flags=re.IGNORECASE)
['0', '3', '9']

[(2, A), (1, B), (2, C), (3, D)]

[(1, B), (2, A), (2, C), (3, D)]

def bubble_sort(sort_list):
    bubble_list_length = len(sort_list)
    while bubble_list_length > 0:
        for _i in range(0, bubble_list_length-1):
            if sort_list[_i] > sort_list[_i + 1]:
                sort_list[_i], sort_list[_i +
                                         1] = sort_list[_i+1], sort_list[_i]
        bubble_list_length -= 1
    return sort_list

def insert_sort(sort_list):
    length = len(sort_list)
    for i in range(1, length):
        for j in range(i, 0, -1):
            if sort_list[j] < sort_list[j-1]:
                sort_list[j], sort_list[j-1] = sort_list[j-1], sort_list[j]
    return sort_list

def diminishing_increment_sort(sort_list):
    length = len(sort_list)
    h = 1
    while h < length/3:
        h = 3*h+1
    while h >= 1:
        for i in range(h, length):
            j = i
            while j >= h and sort_list[j] < sort_list[j-h]:
                sort_list[j], sort_list[j-h] = sort_list[j-h], sort_list[j]
                j -= h
        h = h//3
    return sort_list

def quick_sort(sort_list):
    if len(sort_list) > 2:
        mid = sort_list[0]
        sort_list.remove(mid)
        left_list = []
        right_list = []
        for i in range(0, len(sort_list)):
            if sort_list[i] < mid:
                left_list.append(sort_list[i])
            if sort_list[i] > mid:
                right_list.append(sort_list[i])
        return quick_sort(left_list) + [mid] + quick_sort(right_list)
    else:
        return sort_list

def selection_sort(sort_list):
    def _select_min_number(temp_list):
        if len(temp_list) is 0:
            return None
        min_number = temp_list[0]
        for _n in temp_list:
            if _n < min_number:
                min_number = _n
        return min_number

def mergeSort(arr):
    if len(arr) <= 1:
        return arr

    mid = len(arr) // 2
    left = mergeSort(arr[:mid])
    right = mergeSort(arr[mid:])

    return merge(left, right)

def merge(left, right):
    result = []
    i = j = 0

    while i < len(left) and j < len(right):
        if left[i] < right[j]:
            result.append(left[i])
            i += 1
        else:
            result.append(right[j])
            j += 1

    result.extend(left[i:])
    result.extend(right[j:])

    return result

def counting_sort(sort_list):
    length = len(sort_list)
    new_list = [None]*length
    for i in range(length):
        p = 0
        q = 0
        for j in range(length):
            if sort_list[j]<sort_list[i]:
                p+=1
            if sort_list[j]==sort_list[i]:
                q+=1
        for k in range(p,p+q):
            new_list[k] = sort_list[i]
    return new_list

package main

import (
    "fmt"
    "time"
)

func Factorial(n int64) int64 {
    if n < 2 {
    	return int64(n)
    }
    return n * Factorial(n-1)
}

func main() {
    var n int64
    var number int64 = 1

    fmt.Printf("Input n value: ")
    fmt.Scan(&n)

    var start = time.Now()
    result = Factorial(n)
    var elapsed = time.Since(start)

    fmt.Printf("Factorial %v! result is %v\nTotal times is %v", number, result, elapsed)
}

➜  go run main.go
Factorial 25! result is 7034535277573963776
Total times is 298ns

package main

import (
    "fmt"
    "time"
)

func Fibonacci(n int) int {
    if n == 1 || n == 2 {
    	return 1
    }
    return Fibonacci(n-1) + Fibonacci(n-2)
}

func main() {
    var number int = 50

    var start = time.Now()
    var result int = Fibonacci(number)
    var elapsed = time.Since(start)

    fmt.Printf("Fibonacci %vth result is %v\nTotal times is %v", number, result, elapsed)
}

➜ go run main.go
Fibonacci 50th result is 12586269025
Total times is 40.354931919s

package main

import (
    "fmt"
    "time"
)

func main() {
    var number int = 50

    var n1 int = 0
    var n2 int = 1
    var result int = 0

    var start = time.Now()
    for n := 2; n <= number; n++ {
    	result = n1 + n2
    	n1 = n2
    	n2 = result
    }

    var elapsed = time.Since(start)
    
    fmt.Printf("Fibonacci %vth result is %v\nTotal times is %v", number, result, elapsed)

}

➜ go run main.go
Fibonacci 50th result is 12586269025
Total times is 226ns

package main

import (
    "fmt"
    "time"
)

func Fibonacci(n int, n1 int, n2 int) int {
    if n == 0 {
    	return n1
    }
    return Fibonacci(n-1, n2, n1+n2)
}

func main() {
    var number int = 50

    var start = time.Now()
    var n1 int = 0
    var n2 int = 1
    var result int = Fibonacci(number, n1, n2)
    var elapsed = time.Since(start)

    fmt.Printf("Fibonacci %vth result is %v\nTotal times is %v", number, result, elapsed)
}

➜ go run main.go
Fibonacci 50th result is 12586269025
Total times is 443ns

mkdir /etc/nginx/ssl_certs
cd /etc/nginx/ssl_certs

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

openssl genrsa -out server.pem 1024
openssl rsa -in server.pem -out server.key
openssl req -new -key server.pem -out server.csr

openssl x509 -req -sha256 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out server.crt

vim /etc/nginx/conf.d/default.conf
server {
    listen       443 ssl;
    server_name  www.example.com;
    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;      # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_certificate_key /etc/nginx/ssl/server.key;  # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    location / {
        proxy_pass_header Server;
        proxy_pass_header X-Scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
        proxy_set_header X-SSL-CERT-DN $ssl_client_s_dn;
        proxy_set_header X-SSL-CERT-VERIFY $ssl_client_verify;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://192.168.10.100:5000/;
    }
}

# 因证书自签必须使用insecure忽略证书风险，提示否则curl会返回证书不安全测试失败的结果
curl --insecure 'https://www.example.com' -v

/etc/pki/CA/            # 所有资料全存放在此目录下
/etc/pki/CA/certs/      # 存放CA证书
/etc/pki/CA/crl/        # 存放证书吊销列表
/etc/pki/CA/index.txt   # 存放可用、不可用证书的数据库
/etc/pki/CA/newcerts    # 存放CA的新目录
/etc/pki/CA/cacert.pem  # 生成的自签名证书
/etc/pki/CA/serial      # 下个证书的编号，16进制，多从00或01开始
/etc/pki/CA/crlnum      # 下一个吊销证书的编号
/etc/pki/CA/crl.pem     # 下一个吊销列表
/etc/pki/CA/private/cakey.pem  # 默认密钥

# 匹配策略的可选值
match                   # 必须匹配，默认是国家、州(省)、组织名称
supplied                # 必填，为哪个主机申请证书，一般对应域名
optional                # 可选

# 生成数据库文件，记录证书信息（包含序列号、序号、证书自定义CN信息等）
touch /etc/pki/CA/index.txt
# 生成存放证书编号的文件（一般存储即将颁发的下一个证书序号）
echo 00 > /etc/pki/CA/serial

openssl  req -new -x509  -key private/cakey.pem  -days 3650 -out cacert.pem

# 创建存放客户端证书的文件夹
mkdir /etc/nginx/client_ssl
# 切换到存放客户端证书的目录
cd /etc/nginx/client_ssl
# 创建客户端证书私钥
(umask 066; openssl genrsa -out client_01.key 1024)
# 创建请求根证书签证的文件             
openssl  req -new -key client_01.key  -out client_01.csr
# 创建客户端证书        
openssl  ca -in client_01.csr  -out client_01.crt -days 730

server {
    listen       443 ssl;
    server_name  www.example.com;
    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;      # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_certificate_key /etc/nginx/ssl/server.key;  # 服务端HTTPS的证书，不能自己产生，否则会提示证书不安全，该配置与客户端证书无关
    ssl_client_certificate /etc/nginx/ssl/ca.crt;   # 客户端的CA根证书，由自己的机器OPENSSL生成
    ssl_verify_client optional;                     # 是否启用客户端验证，ON为启用，OFF为不启用，如需自定义验证结果处理则填入optional
    if ($ssl_client_verify = NONE) {
        return 303 http://www.example.com/error;
    }
        location / {
            proxy_pass_header Server;
            proxy_pass_header X-Scheme;
            proxy_set_header Host $http_host;
            proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;   # 转发证书信息
            proxy_set_header X-SSL-CERT-DN $ssl_client_s_dn;        # 转发证书的CN信息
            proxy_set_header X-SSL-CERT-VERIFY $ssl_client_verify;  # 转发证书的验证结果，成功为success
            proxy_set_header X-Real-IP $remote_addr;
            proxy_pass http://192.168.10.100:5000/;
    }
}

# -v参数可以打印详细信息以便我们核查证书的详细信息
curl --insecure --key ./client.key --cert ./client.crt 'https://www.example.com' -v

#!/bin/bash -e
# 运行脚本前请记得设置好openssl.cnf配置文件
# 运行成功返回0，运行失败（缺少参数）返回-1
show_help() {
    echo "$0 [-h|-?|--help] [--ou ou] [--cn cn] [--email email]"
    echo "-h|-?|--help    显示帮助"
    echo "--ou            设置组织或部门名"
    echo "--cn            设置证书的DN信息"
    echo "--email         设置证书的邮箱信息"
    echo "--days          设置证书的有效时间"
    echo "--out           设置证书的输出目录(含文件名)"
}
while [[ $# -gt 0 ]]; do
    case $1 in
    -h | -\? | --help)
        show_help
        exit 0
        ;;
    --ou)
        OU="${2}"
        shift
        ;;
    --cn)
        CN="${2}"
        shift
        ;;
    --email)
        emailAddress="${2}"
        shift
        ;;
    --days)
        days="${2}"
        shift
        ;;
    --out)
        out="${2}"
        shift
        ;;
    --)
        shift
        break
        ;;
    *)
        echo -e "Error: $0 invalid option '$1'\nTry '$0 --help' for more information.\n" >&2
        exit -1
        ;;
    esac
    shift
done
# 创建客户端证书
# 非交互式方式创建以下内容:
# 国家名(2个字母的代号)
C=CN
# 省
ST=GuangDong
# 市
L=GuangDong
# 公司名
O=TY
# 部门名
OU=${OU:-未知}
# DN信息
CN=${CN:-未知}
# 邮箱地址
emailAddress=${emailAddress:-virtual@example.com}
# 创建私钥
openssl req -utf8 -nodes -newkey rsa:2048 -keyout "${out}.key" -new -days "${days}" -out "${out}.csr" -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${emailAddress}"
# 使用根证书进行进行签证
openssl ca -utf8 -batch -days 36500 -in "${out}.csr" -out "${out}.crt"
# 转换客户端证书的类型为浏览器支持的模式
openssl pkcs12 -export -inkey "${out}.key" -in "${out}.crt" -passout pass: -out "${out}.pfx"
exit 0

# crt转pfx(p12)
openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx

# csr转pfx(p12)
openssl pkcs12 -export -inkey server.key -in server.csr -out server.pfx

# pfx转jks
keytool -importkeystore -v  -srckeystore client.pfx -srcstoretype pkcs12  -destkeystore client.keystore -deststoretype jks 

# jks转p12(pfx)
keytool -importkeystore -srckeystore client_pri.keystore -destkeystore client_pri.p12 -srcstoretype JKS -deststoretype PKCS12 -srcalias imgo.tv -destalias imgo.tv -noprompt

# pfx转x509
openssl pkcs12 -in onovps.com.pfx -nodes -out onovps.com.pem 
openssl rsa -in onovps.com.pem -out onovps.com.key
openssl x509 -in onovps.com.pem -out onovps.com.crt

grep '(vmx|svm)' --color=always /proc/cpuinfo

sudo apt-get install kvm qemu-kvm bridge-utils virtinst libvirt-clients libvirt-daemon-system

brctl addbr br0

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether 70:85:c2:82:20:27 brd ff:ff:ff:ff:ff:ff
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:bd:b3:99:14 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 70:85:c2:82:20:27 brd ff:ff:ff:ff:ff:ff
    inet 192.168.11.11/24 brd 192.168.11.255 scope global br0
       valid_lft forever preferred_lft forever

brctl addif br0 enp1s0

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback
auto br0
iface br0 inet dhcp
bridge_ports enp1s0 
bridge_stp off
bridge_fd 0
bridge_maxwait 0

# This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).

 # The loopback network interface
 auto lo br0
 iface lo inet loopback

 # Bridge setup
 iface br0 inet static
    bridge_ports eth0 eth1
        address 192.168.1.2
        broadcast 192.168.1.255
        netmask 255.255.255.0
        gateway 192.168.1.1

ifup br0

vnc_listen = "0.0.0.0"
vnc_password = "XYZ12345" #密码任意设置
spice_listen = "0.0.0.0" #debian6 不需配置这个

sudo systemctl restart libvirt-guests.service

SUDO qemu-img create -f qcow2 windows7.qcow2 32G

# 创建一个名为windows7的虚拟机，操作系统类型为windows
# 使用KVM虚拟化技术，启用硬件虚拟化扩展，分配2048MB的内存给虚拟机
# 分配2个虚拟CPU给虚拟机
# 使用网络桥接模式，网络接口模型为e1000
# 创建一个名为windows7.qcow2的磁盘镜像文件，使用IDE总线连接
# 启用VNC图形界面访问，监听5900端口
# 使用cn_windows_7_ultimate_with_sp1_x64_dvd_u_677408.iso文件作为光盘镜像
sudo virt-install --name=windows7 --os-type=windows \
--virt-type=kvm --hvm --ram=2048 \
--vcpus=2 --network bridge=br0,model=e1000 \
--disk path=windows7.qcow2,bus=ide \
--graphics vnc,port=5900 \
--cdrom=cn_windows_7_ultimate_with_sp1_x64_dvd_u_677408.iso

sudo virsh list --all

sudo virsh start windows7
sudo virsh shutdown windows7
sudo virsh destroy windows7 && virsh undefine windows7

sudo iptables -A INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT

firewall-cmd --permanent --zone=public --remove-interface=enp0s3
firewall-cmd --permanent --zone=internal --add-interface=enp0s3
firewall-cmd --permanent --zone=internal --add-port=67/udp
firewall-cmd --permanent --zone=internal --add-port=68/udp
firewall-cmd --reload

sudo dpkg -i nginx-common.ubuntu.deb
sudo dpkg -i nginx-extras.ubuntu.deb

server{
    charset      utf-8;
    server_name 127.0.0.1;

    root  /var/www/nginx;
    index index.php index.html;

    access_log  /var/log/nginx/dev-access.log ;
    error_log   /var/log/nginx/dev-error.log;

    # 以下是本地开发Nchan插件所需配置，无需理会
    location = /sub {
        nchan_subscriber;
        nchan_channel_id $arg_id;
        nchan_message_timeout 5s;
    }
    location = /pub {
        nchan_publisher;
        nchan_channel_id $arg_id;
        nchan_message_timeout 5s;
    }
}

# 安装源
sudo apt -y install software-properties-common python-software-properties
# 更新源
sudo add-apt-repository ppa:ondrej/php && sudo apt-get update
# 安装php7.2
sudo apt-get -y install php7.2
# 安装常用扩展(根据需要自选)
sudo apt-get -y install php7.2-fpm php7.2-mysql php7.2-curl php7.2-json php7.2-mbstring php7.2-xml  php7.2-intl 
# 可供参考的扩展包(根据需要自选)
sudo apt-get install php7.2-gd
sudo apt-get install php7.2-soap
sudo apt-get install php7.2-gmp    
sudo apt-get install php7.2-odbc       
sudo apt-get install php7.2-pspell     
sudo apt-get install php7.2-bcmath   
sudo apt-get install php7.2-enchant    
sudo apt-get install php7.2-imap       
sudo apt-get install php7.2-ldap       
sudo apt-get install php7.2-opcache
sudo apt-get install php7.2-readline   
sudo apt-get install php7.2-sqlite3    
sudo apt-get install php7.2-xmlrpc
sudo apt-get install php7.2-bz2
sudo apt-get install php7.2-interbase
sudo apt-get install php7.2-pgsql      
sudo apt-get install php7.2-recode     
sudo apt-get install php7.2-sybase     
sudo apt-get install php7.2-xsl
sudo apt-get install php7.2-cgi        
sudo apt-get install php7.2-dba 
sudo apt-get install php7.2-phpdbg     
sudo apt-get install php7.2-snmp       
sudo apt-get install php7.2-tidy       
sudo apt-get install php7.2-zip

...
; 用户修改为本机用户（注意：Nginx要和php-fpm的用户一致，同时也要对代码目录有读写权限）
user = chancel
group = chancel
...

; 本地的php的端口号（与Nginx通信的端口号）
listen = 127.0.0.1:9000

sudo service php7.2-fpm start

sudo apt-get install php-xdebug

; 这里根据Xdebug.so 进行填写
zend_extension=xdebug.so 
[XDebug]
; 启用远程调试
xdebug.remote_enable = on
xdebug.remote_autostart = 1
; WSL与Windows共享网关，此处填127.0.0.1，如果是远程虚拟机则填写调试机器的IP
xdebug.remote_host = 127.0.0.1
; 远程XDebug配置的端口号，这个端口号在后面Windows10里配置，注意不要填9000，因为WSL里面的php-fpm已经使用这个端口了
xdebug.remote_port = 9001
xdebug.remote_connect_back = 1
xdebug.auto_trace = 1
xdebug.collect_includes = 1
xdebug.collect_params = 1
; 日志的位置
xdebug.remote_log = /tmp/xdebug.log

sudo apt install mariadb-server
sudo service mysql start
sudo mysql_secure_installation