Linux

1.安装 curl sudo apt update sudo apt install curl 2.创建 SSH 登录成功通知脚本 创建: sudo mkdir /usr/local/sbin/script sudo vim /usr/local/sbin/script/gotify-ssh-login.sh 写入: #!/bin/bash # 只处理 SSH session 建立 [ "$PAM_TYPE" = "open_session" ] || exit 0 GOTIFY_URL="https://gotify.example.com" GOTIFY_TOKEN="AbCdEf123456..." HOSTNAME=$(hostname) USER_NAME="${PAM_USER:-unknown}" REMOTE_IP="${PAM_RHOST:-unknown}" TIME=$(date '+%Y-%m-%d %H:%M:%S %Z') MESSAGE="服务器：${HOSTNAME} 用户：${USER_NAME} IP：${REMOTE_IP} 时间：${TIME}" curl -fsS \ --max-time 5 \ -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \ -F "title=🔐 SSH Login" \ -F "message=${MESSAGE}" \ -F "priority=5" \ "${GOTIFY_URL}/message" \ >/dev/null 2>&1 exit 0 注意修改： GOTIFY_URL GOTIFY_TOKEN 修改权限: sudo chmod 700 /usr/local/sbin/script/gotify-ssh-login.sh 3.让 SSH 登录时执行脚本 编辑: ...

1.用户管理 创建用户 sudo adduser newuser 将用户添加到 sudo 组 sudo usermod -aG sudo newuser 安装 sudo（如果尚未安装） sudo apt update sudo apt install sudo 2.密钥登录和更改端口 编辑 sudo vim /etc/ssh/sshd_config 如果是dd系统 编辑 sudo vim /etc/ssh/sshd_config.d/01-permitrootlogin.conf 更改 Port 22 PasswordAuthentication no PermitRootLogin prohibit-password 重启 SSH 服务以应用更改 sudo systemctl restart ssh 3.更改主机名 sudo hostnamectl set-hostname debian-server 在 /etc/hostname 添加 debian-server 在 /etc/hosts 添加 127.0.1.1 debian-server 重启或应用更改 sudo systemctl restart systemd-logind.service 使用 hostnamectl 查看详细信息 hostnamectl 4.创建swap虚拟内存 创建一个1G的swap文件 sudo fallocate -l 1G /swapfile 修改权限 ...

1.下载 wget https://github.com/fish-shell/fish-shell/releases/download/4.8.1/fish-4.8.1-linux-x86_64.tar.xz 2.解压 tar -xf fish-4.8.1-linux-x86_64.tar.xz 3.安装 sudo mv fish /usr/local/bin 4.加入系统 Shell 列表 echo "/usr/local/bin/fish" | sudo tee -a /etc/shells 查看： cat /etc/shells 5.设置 Fish 为默认 Shell chsh -s /usr/local/bin/fish 最后重新登录 SSH

1.安装 Git sudo apt update sudo apt install git git --version 2.设置Git身份 git config --global user.name "你的名字" git config --global user.email "你的邮箱" git config --list 3.生成SSH密钥 ssh-keygen -t ed25519 -f ~/.ssh/forgejo_ed25519 -C "你的邮箱" windows: ssh-keygen -t ed25519 -f "$HOME\.ssh\forgejo_ed25519" -C "你的邮箱" 4.添加公钥到Forgejo cat ~/.ssh/forgejo_ed25519.pub 5.使用 SSH Config 管理 vim ~/.ssh/config 添加: Host git.test.com HostName git.test.com User git IdentityFile ~/.ssh/forgejo_ed25519 IdentitiesOnly yes 6.测试 ssh -T git.test.com

3台节点示例 1.安装 WireGuard（3台都要） sudo apt update sudo apt install wireguard -y 2.生成密钥（每台执行） umask 077 wg genkey | tee privatekey | wg pubkey > publickey 3.节点配置 A（中心节点）配置 /etc/wireguard/wg0.conf [Interface] PrivateKey = A的私钥 Address = 10.0.0.1/24 ListenPort = 51820 # B [Peer] PublicKey = B的公钥 AllowedIPs = 10.0.0.2/32 # C [Peer] PublicKey = C的公钥 AllowedIPs = 10.0.0.3/32 A 必须开启转发 echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf sysctl -p B 节点配置 /etc/wireguard/wg0.conf [Interface] PrivateKey = B的私钥 Address = 10.0.0.2/24 [Peer] PublicKey = A的公钥 Endpoint = 1.1.1.1:51820 AllowedIPs = 10.0.0.0/24 PersistentKeepalive = 25 C 节点配置 /etc/wireguard/wg0.conf ...

备份 假设用户为：xxxx Forgejo容器为：forgejo PostgreSQL容器为：forgejo-db 1.创建备份目录 sudo mkdir -p /home/xxxx/backup/forgejo sudo chown xxxx:xxxx /home/xxxx/backup/forgejo 2.创建脚本目录以及脚本文件 mkdir -p /home/xxxx/script mkdir -p /home/xxxx/log vim /home/xxxx/script/forgejo-backup.sh 脚本： #!/bin/bash set -Eeuo pipefail # ===================== # Forgejo Backup Config # ===================== DATE=$(date +%F-%H%M) # 备份用户 BACKUP_USER="xxxx" # 备份目录 BACKUP_DIR="/home/xxxx/backup/forgejo" # 日志目录 LOG_DIR="/home/xxxx/log" LOG_FILE="$LOG_DIR/forgejo-backup.log" # Forgejo 数据目录 FORGEJO_DATA="/opt/docker/forgejo/data" # Docker 容器 FORGEJO_CONTAINER="forgejo" POSTGRES_CONTAINER="forgejo-db" # PostgreSQL DB_USER="forgejo" DB_NAME="forgejo" # 最低剩余空间 GB MIN_FREE_GB=5 # 保留最近备份数量 RETENTION_COUNT=7 # ===================== # Logging # ===================== mkdir -p "$LOG_DIR" touch "$LOG_FILE" chown "$BACKUP_USER:$BACKUP_USER" "$LOG_FILE" exec > >(tee -a "$LOG_FILE") 2>&1 echo echo "================================================" echo "Forgejo backup start: $(date '+%F %T')" echo "================================================" # ===================== # Variables # ===================== DATA_BACKUP="$BACKUP_DIR/forgejo-data-$DATE.tar.gz" DB_BACKUP="$BACKUP_DIR/forgejo-db-$DATE.sql" # ===================== # Check backup directory # ===================== if [[ ! -d "$BACKUP_DIR" ]]; then echo "ERROR: Backup directory not found:" echo "$BACKUP_DIR" exit 1 fi # ===================== # Check disk space # ===================== FREE_KB=$(df -Pk "$BACKUP_DIR" | awk 'NR==2 {print $4}') FREE_GB=$((FREE_KB / 1024 / 1024)) echo "Available disk space: ${FREE_GB}GB" if (( FREE_GB < MIN_FREE_GB )); then echo "ERROR: Need at least ${MIN_FREE_GB}GB free space." exit 1 fi # ===================== # Check containers # ===================== if ! docker ps --format '{{.Names}}' | grep -qx "$FORGEJO_CONTAINER"; then echo "ERROR: Forgejo container is not running." exit 1 fi if ! docker ps --format '{{.Names}}' | grep -qx "$POSTGRES_CONTAINER"; then echo "ERROR: PostgreSQL container is not running." exit 1 fi # ===================== # Stop Forgejo # ===================== echo "[1/6] Stop Forgejo..." docker stop "$FORGEJO_CONTAINER" # 无论成功失败，都启动 Forgejo cleanup() { echo "Restart Forgejo..." docker start "$FORGEJO_CONTAINER" >/dev/null 2>&1 || true } trap cleanup EXIT # ===================== # Backup Forgejo data # ===================== echo "[2/6] Backup Forgejo data..." tar czf \ "$DATA_BACKUP" \ -C "$(dirname "$FORGEJO_DATA")" \ "$(basename "$FORGEJO_DATA")" # ===================== # Backup PostgreSQL # ===================== echo "[3/6] Backup PostgreSQL..." docker exec "$POSTGRES_CONTAINER" \ pg_dump -U "$DB_USER" "$DB_NAME" \ > "$DB_BACKUP" # ===================== # Verify backups # ===================== echo "[4/6] Verify backup files..." if [[ ! -s "$DATA_BACKUP" ]]; then echo "ERROR: Forgejo data backup failed." exit 1 fi if [[ ! -s "$DB_BACKUP" ]]; then echo "ERROR: PostgreSQL backup failed." exit 1 fi echo "Backup verified." # ===================== # Remove old backups # ===================== echo "[5/6] Remove old backups..." echo "Removing old Forgejo data backups..." ls -1t "$BACKUP_DIR"/forgejo-data-*.tar.gz 2>/dev/null \ | tail -n +$((RETENTION_COUNT + 1)) \ | xargs -r rm -f echo "Removing old database backups..." ls -1t "$BACKUP_DIR"/forgejo-db-*.sql 2>/dev/null \ | tail -n +$((RETENTION_COUNT + 1)) \ | xargs -r rm -f # ===================== # Fix ownership # ===================== echo "[6/6] Fix ownership..." chown "$BACKUP_USER:$BACKUP_USER" \ "$DATA_BACKUP" \ "$DB_BACKUP" # ===================== # Summary # ===================== echo echo "Backup files:" ls -lh "$DATA_BACKUP" ls -lh "$DB_BACKUP" echo echo "Current backups:" ls -lh "$BACKUP_DIR" echo echo "================================================" echo "Forgejo backup finished: $(date '+%F %T')" echo "================================================" echo 3.添加执行权限 chmod +x /home/xxxx/script/forgejo-backup.sh 4.测试 sudo /home/xxxx/script/forgejo-backup.sh # 查看备份数据 ls /home/xxxx/backup/forgejo 5.定时执行（每天凌晨） 编辑： ...

1.查看现有规则 DOCKER-USER 链的规则是否生效与 链的优先级 和 规则顺序相关 sudo iptables -L DOCKER-USER --line-numbers 2.添加规则 允许已建立的连接（必须放在最前面） sudo iptables -I DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 允许 192.168.1.100 访问所有 Docker 容器： sudo iptables -I DOCKER-USER -s 192.168.1.100 -j ACCEPT 允许 192.168.1.100 访问 Docker 容器时，仅允许访问 TCP 80 端口 sudo iptables -I DOCKER-USER -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT 添加规则到指定位置 sudo iptables -I DOCKER-USER 3 -p tcp --dport 80 -s 192.168.1.101 -j ACCEPT 参数说明: -I在最前面插入 3.禁止其他所有 IP 的访问 注意iptables规则是从上往下执行的所以这条命令要放在最下面 ...