Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CallMeR
|
12b5a4aec4 | ||
|
CallMeR
|
a41bd56bc3 | ||
|
CallMeR
|
f8cc6a7689 | ||
|
CallMeR
|
966660a77f | ||
|
CallMeR
|
7ebf3c80c8 | ||
|
CallMeR
|
fbd1e44d11 | ||
|
CallMeR
|
f991ec8525 | ||
|
CallMeR
|
996959f740 | ||
|
CallMeR
|
ed7f9c5fc9 | ||
|
CallMeR
|
730225be93 | ||
|
CallMeR
|
e29dc62978 | ||
|
CallMeR
|
13b46590d0 | ||
|
CallMeR
|
1984f7689e | ||
|
CallMeR
|
698969cadb |
@@ -114,23 +114,23 @@ Microsoft 官方终端工具，可以在 Github 平台或 Microsoft 应用商店
|
||||
|
||||
使用 `方向键` 选择第一项 `Install Proxmox VE (Graphical)` 图形化安装界面，按键盘 `Enter` 进入下一步骤。
|
||||
|
||||
|
||||
|
||||
|
||||
设备将继续跑码，直到出现最终用户许可协议 EULA ，按键盘组合键 `ALT + N ` 进入下一步骤。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.3. PVE 硬盘选项
|
||||
|
||||
此时会出现 `Target Harddisk` 选项，会显示出设备中存在的硬盘列表，可通过下拉框选择安装 PVE 的目标硬盘。
|
||||
|
||||
|
||||
|
||||
|
||||
点击硬盘列表右侧的 `Options` ，对 PVE 的硬盘安装参数进行一些调整。
|
||||
|
||||
推荐将 `Filesystem` 也就是硬盘的文件系统，设置成 `xfs` 。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.4. PVE 时区选项
|
||||
|
||||
@@ -138,7 +138,7 @@ Microsoft 官方终端工具，可以在 Github 平台或 Microsoft 应用商店
|
||||
|
||||
在 `Contry` 处手动输入 `China` ，下方的 `Time zone` 将自动变更为 `Asia/Shanghai` 。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.5. PVE 账户与邮箱
|
||||
|
||||
@@ -146,7 +146,7 @@ PVE 为最关键的虚拟化层，建议使用强密码，包含大小写字母
|
||||
|
||||
`Email` 必须为一个 “合法” 的邮箱地址，不然系统会判定邮箱地址不合法并拒绝继续安装。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.6. PVE 网络设置
|
||||
|
||||
@@ -154,7 +154,7 @@ PVE 为最关键的虚拟化层，建议使用强密码，包含大小写字母
|
||||
|
||||
而某些设备，其物理网口顺序与该页面显示的网口顺序 **不一致** ，因此保持默认设置即可。
|
||||
|
||||
|
||||
|
||||
|
||||
FQDN 为 PVE 的域，PVE 将使用 FQDN 中的二级域名作为其主机名。
|
||||
|
||||
@@ -173,17 +173,17 @@ PVE 安装完成后，可通过其提供的 Web 管理界面，进一步调整
|
||||
|Gateway|`172.16.1.1`|设置 PVE IPv4 网关|
|
||||
|DNS Server|`172.16.1.1`|设置 PVE IPv4 DNS |
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.7. PVE 参数确认
|
||||
|
||||
该页面会显示当前 PVE 的安装配置总览，确认无误后即可开始安装。
|
||||
|
||||
|
||||
|
||||
|
||||
安装完成后，PVE 会告知用户登录的 `IP 地址` 和 `端口` 。
|
||||
|
||||
|
||||
|
||||
|
||||
## 2. PVE 安装后检查
|
||||
|
||||
@@ -209,7 +209,7 @@ $ cat /etc/os-release
|
||||
|
||||
此处显示出 PVE 底层使用的是 Debian 的系统，代号为 `trixie` ，该代号后续会使用到。
|
||||
|
||||
|
||||
|
||||
|
||||
至此 PVE 的安装步骤已经完成。
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
在上一篇文章 [01.PVE系统安装](./01.PVE系统安装.md) 中，从刚装好的 PVE 系统中获取了系统的一些参数。
|
||||
|
||||
|
||||
|
||||
|
||||
此处显示出 PVE 底层使用的是 Debian 的系统，代号为 `trixie` 。
|
||||
|
||||
@@ -32,11 +32,10 @@ Components: main contrib non-free-firmware
|
||||
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
|
||||
```
|
||||
|
||||
这里将使用 [中国科技大（USTC）](http://mirrors.ustc.edu.cn/help/proxmox.html) 的镜像仓库进行替换，使用如下命令。
|
||||
这里将使用 [中国科技大（USTC）](http://mirrors.ustc.edu.cn/help/proxmox.html) 的镜像仓库进行替换，执行以下命令。
|
||||
|
||||
```bash
|
||||
## 配置 PVE 系统默认软件源脚本
|
||||
|
||||
$ cat > /etc/apt/sources.list.d/debian.sources <<EOF
|
||||
Types: deb
|
||||
URIs: https://mirrors.ustc.edu.cn/debian
|
||||
@@ -62,7 +61,6 @@ EOF
|
||||
|
||||
```bash
|
||||
## 配置 PVE 系统免订阅软件源脚本
|
||||
|
||||
$ cat > /etc/apt/sources.list.d/pve-no-subscription.sources <<EOF
|
||||
Types: deb
|
||||
URIs: https://mirrors.ustc.edu.cn/proxmox/debian/pve
|
||||
@@ -80,7 +78,6 @@ EOF
|
||||
|
||||
```bash
|
||||
## 配置 PVE Ceph 免订阅软件源脚本
|
||||
|
||||
$ if [ -f /etc/apt/sources.list.d/ceph.sources ]; then
|
||||
CEPH_CODENAME=`ceph -v | grep ceph | awk '{print $(NF-1)}'`
|
||||
source /etc/os-release
|
||||
@@ -161,7 +158,7 @@ $ apt full-upgrade
|
||||
$ apt update
|
||||
|
||||
## 安装系统软件
|
||||
$ apt install btop lm-sensors curl tmux neovim unzip unattended-upgrades powermgmt-base sshguard knot-dnsutils
|
||||
$ apt install btop lm-sensors curl tmux neovim unattended-upgrades powermgmt-base sshguard knot-dnsutils
|
||||
|
||||
## 安装 CPU 调度调整工具
|
||||
$ apt install linux-cpupower
|
||||
@@ -216,7 +213,7 @@ $ journalctl --update-catalog
|
||||
|
||||
接下来将修改 PVE 网络配置，在修改完成前， **请不要点击 “应用配置”** ，否则会导致 PVE 无法访问。
|
||||
|
||||
|
||||
|
||||
|
||||
### 3.1.修改 vmbr0
|
||||
|
||||
@@ -232,7 +229,7 @@ $ journalctl --update-catalog
|
||||
|
||||
点击左上角的 `创建` 选项，选择 `Linux Bridge` 。
|
||||
|
||||
|
||||
|
||||
|
||||
桥接端口填写顺序的第二个网卡名称，演示中为 `nic1` ，在备注处填写 `lan1` ，并点击 `创建` 。
|
||||
|
||||
@@ -274,7 +271,7 @@ $ journalctl --update-catalog
|
||||
|
||||
在 PVE 内部网络设置完成后，将如图所示。
|
||||
|
||||
|
||||
|
||||
|
||||
## 4.配置 PVE DNS
|
||||
|
||||
|
||||
@@ -24,6 +24,20 @@ Press <enter> to keep the current choice[*], or type selection number: 2
|
||||
update-alternatives: using /usr/bin/nvim to provide /usr/bin/editor (editor) in manual mode
|
||||
```
|
||||
|
||||
若需完全禁用 `neovim` 鼠标功能；即关闭所有鼠标交互，右键行为完全交给终端 / 控制台处理，需执行以下命令。
|
||||
|
||||
```bash
|
||||
## 创建 nvim 配置目录
|
||||
$ mkdir -p /etc/xdg/nvim
|
||||
|
||||
## 配置 nvim 鼠标交互行为脚本
|
||||
$ tee /etc/xdg/nvim/sysinit.vim << 'EOF'
|
||||
set mouse=
|
||||
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
## 1.系统时区
|
||||
|
||||
如果在安装 PVE 系统时选错了时区，导致系统时间和北京时间不一致，可以执行以下命令修正。
|
||||
@@ -210,15 +224,13 @@ WantedBy=multi-user.target
|
||||
$ systemctl daemon-reload
|
||||
```
|
||||
|
||||
执行以下命令让 `cpupower` 服务开机自启动。
|
||||
执行以下命令让 `cpupower` 服务立即启动并置为开机自启状态。
|
||||
|
||||
```bash
|
||||
## 设置 cpupower 服务开机自启
|
||||
$ systemctl enable cpupower.service
|
||||
$ systemctl enable --now cpupower.service
|
||||
```
|
||||
|
||||
修改完成后，需重启 PVE 服务器，并再次查看 CPU 调度器，检验配置文件是否生效。
|
||||
|
||||
这里提供两个额外命令，方便实时查看 CPU 当前频率和温度状况。
|
||||
|
||||
```bash
|
||||
@@ -248,7 +260,7 @@ $ crontab -e
|
||||
```bash
|
||||
## 定时任务配置项
|
||||
|
||||
30 2 1,16 * * /usr/sbin/reboot
|
||||
30 2 1,16 * * /usr/sbin/shutdown --reboot now
|
||||
|
||||
```
|
||||
|
||||
@@ -258,7 +270,7 @@ $ crontab -e
|
||||
|
||||
配置系统自动更新之前，需检查系统当前定时器状态。
|
||||
|
||||
后续将手动调整该定时器的时间，使其每 `5` 天的 `01:30` 进行触发。
|
||||
后续将手动调整该定时器的时间，使其每 `10` 天的 `01:30` 进行触发。
|
||||
|
||||
```bash
|
||||
## 检查系统定时器
|
||||
@@ -267,12 +279,12 @@ $ systemctl status apt-daily-upgrade.timer
|
||||
#### 系统定时器示例输出
|
||||
● apt-daily-upgrade.timer - Daily apt upgrade and clean activities
|
||||
Loaded: loaded (/usr/lib/systemd/system/apt-daily-upgrade.timer; enabled; preset: enabled)
|
||||
Active: active (waiting) since Wed 2025-08-27 13:41:10 CST; 1h 37min ago
|
||||
Invocation: 26ebb62a4f6545998522fff8c4104b3e
|
||||
Trigger: Thu 2025-08-28 06:14:37 CST; 14h left
|
||||
Active: active (waiting) since Mon 2026-08-10 09:51:05 CST; 27min ago
|
||||
Invocation: edb5962fda4c4a8395cb2c04c736db45
|
||||
Trigger: Tue 2026-08-11 06:21:38 CST; 20h left
|
||||
Triggers: ● apt-daily-upgrade.service
|
||||
|
||||
Aug 27 13:41:10 node01 systemd[1]: Started apt-daily-upgrade.timer - Daily apt upgrade and clean activities.
|
||||
Aug 10 09:51:05 node01 systemd[1]: Started apt-daily-upgrade.timer - Daily apt upgrade and clean activities.
|
||||
```
|
||||
|
||||
### 4.2.配置更新策略
|
||||
@@ -289,25 +301,22 @@ $ dpkg-reconfigure -plow unattended-upgrades
|
||||
<Yes>
|
||||
```
|
||||
|
||||
进一步调整 `20auto-upgrades` 配置文件。
|
||||
开始调整 `20auto-upgrades` 配置文件。
|
||||
|
||||
```bash
|
||||
## 进入 apt 的配置目录
|
||||
$ cd /etc/apt/apt.conf.d
|
||||
|
||||
## 编辑 20auto-upgrades 配置文件
|
||||
$ editor /etc/apt/apt.conf.d/20auto-upgrades
|
||||
```
|
||||
|
||||
清空当前全部配置项后，输入以下内容，并保存。
|
||||
|
||||
配置文件中，用来控制更新周期的参数为 `APT::Periodic::Unattended-Upgrade` ，`5` 表示更新周期为 `5` 天。
|
||||
配置文件中，用来控制更新周期的参数为 `APT::Periodic::Unattended-Upgrade` ，`10` 表示更新周期为 `10` 天。
|
||||
|
||||
```bash
|
||||
## 系统更新周期配置项
|
||||
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "5";
|
||||
APT::Periodic::Unattended-Upgrade "10";
|
||||
APT::Periodic::AutocleanInterval "1";
|
||||
APT::Periodic::CleanInterval "1";
|
||||
|
||||
@@ -408,13 +417,14 @@ $ systemctl status apt-daily-upgrade.timer
|
||||
Loaded: loaded (/usr/lib/systemd/system/apt-daily-upgrade.timer; enabled; preset: enabled)
|
||||
Drop-In: /etc/systemd/system/apt-daily-upgrade.timer.d
|
||||
└─override.conf
|
||||
Active: active (waiting) since Wed 2025-08-27 15:23:29 CST; 8s ago
|
||||
Invocation: e38354f06d284894b084a52e1f19af73
|
||||
Trigger: Thu 2025-08-28 01:30:00 CST; 10h left
|
||||
Active: active (waiting) since Mon 2026-08-10 10:35:09 CST; 5s ago
|
||||
Invocation: e73c9dd167cc4814836a1da4dab015db
|
||||
Trigger: Tue 2026-08-11 01:30:00 CST; 14h left
|
||||
Triggers: ● apt-daily-upgrade.service
|
||||
|
||||
Aug 27 15:23:29 node01 systemd[1]: Stopping apt-daily-upgrade.timer - Daily apt upgrade and clean activities...
|
||||
Aug 27 15:23:29 node01 systemd[1]: Started apt-daily-upgrade.timer - Daily apt upgrade and clean activities.
|
||||
Aug 10 10:35:09 node01 systemd[1]: Stopping apt-daily-upgrade.timer - Daily apt upgrade and clean activities...
|
||||
Aug 10 10:35:09 node01 systemd[1]: Stopped apt-daily-upgrade.timer - Daily apt upgrade and clean activities.
|
||||
Aug 10 10:35:09 node01 systemd[1]: Started apt-daily-upgrade.timer - Daily apt upgrade and clean activities.
|
||||
```
|
||||
|
||||
## 5.硬件直通
|
||||
|
||||
@@ -18,45 +18,45 @@
|
||||
|
||||
勾选底部 `高级` 选项，显示完整的配置参数，节点即 “本机” ，`VM ID` 和 `名称` 可自定义。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.2.操作系统
|
||||
|
||||
无需使用任何安装介质，客户机操作系统类别选择 `Linux` ， 版本选择 `6.x - 2.6 Kernel` 即可。
|
||||
无需使用任何安装介质，客户机操作系统类别选择 `Linux` ， 版本选择 `7.x - 2.6 Kernel` 即可。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.3.系统
|
||||
|
||||
SCSI 控制器保持默认 `VirtIO SCSI single` ，机型可选 `q35` ，并勾选 `Qemu代理` 选项。
|
||||
SCSI 控制器保持默认 `VirtIO SCSI single` ，机型可选 `q35` ，并勾选 `Qemu 代理` 选项。
|
||||
|
||||
固件可选 `OVMF (UEFI)` ，并勾选 `添加 TPM` 选项，存储路径需根据实际情况进行调整，演示为 `local-lvm` 。
|
||||
|
||||
`预注册密钥` 可启用，启用后将预装特定于发行版和 Microsoft 标准的安全启动密钥。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.4.磁盘
|
||||
|
||||
因使用 Debian 云镜像制作虚拟机模板，此处需删除所有 `磁盘` 。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.5.CPU
|
||||
|
||||
CPU `类别` 选择 `host` ，`插槽` 与 `核心` 数根据物理 CPU 核心数进行酌情设置。
|
||||
CPU `类型` 选择 `host` ，`插槽` 与 `核心` 数根据物理 CPU 核心数进行酌情设置。
|
||||
|
||||
若 PVE 服务器内有多颗物理 CPU ，则推荐勾选 `启用NUMA` 选项。
|
||||
若 PVE 服务器内有多颗物理 CPU ，则推荐勾选 `启用 NUMA` 选项。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.6.内存
|
||||
|
||||
内存一般 `2G` 足够使用，取消勾选 `Ballooning设备` 。
|
||||
内存一般 `2G` 足够使用，取消勾选 `Ballooning 设备` 。
|
||||
|
||||
对于 `Kernel Samepage Merging (KSM)` 内核同页合并功能，建议保留勾选状态。
|
||||
对于 `允许 KSM` 内核同页合并功能，建议保留勾选状态。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.7.网络
|
||||
|
||||
@@ -64,7 +64,7 @@ CPU `类别` 选择 `host` ，`插槽` 与 `核心` 数根据物理 CPU 核心
|
||||
|
||||
因在 [02.PVE初始化配置](./02.PVE初始化配置.md) 中曾创建未桥接物理网口的内部网桥，故可根据实际需求选择是否使用纯内部网桥作为该参数值。
|
||||
|
||||
|
||||
|
||||
|
||||
多数情况下，无需使用 PVE 内建防火墙，因此 **取消勾选** 网络设备的 `防火墙` 选项。
|
||||
|
||||
@@ -72,13 +72,13 @@ CPU `类别` 选择 `host` ，`插槽` 与 `核心` 数根据物理 CPU 核心
|
||||
|
||||
即有 n 个 CPU 核心，此处多队列也设置为 n 。
|
||||
|
||||
|
||||
|
||||
|
||||
### 1.8.确认
|
||||
|
||||
接下来查看设置总览，确认无误后即可点击 `完成` 。
|
||||
|
||||
|
||||
|
||||
|
||||
## 2.调整硬件参数
|
||||
|
||||
@@ -86,9 +86,33 @@ CPU `类别` 选择 `host` ，`插槽` 与 `核心` 数根据物理 CPU 核心
|
||||
|
||||
查看虚拟机详情页，在虚拟机 `硬件` 配置页面，移除其 `CD/DVD驱动器` 。
|
||||
|
||||
|
||||
|
||||
|
||||
### 2.2.导入镜像文件
|
||||
### 2.2.添加 VirtIO RNG
|
||||
|
||||
为确保系统拥有充足的可用熵，需为模板虚拟机添加 `VirtIO RNG` 熵源。
|
||||
|
||||
点击顶部 `新增` 菜单，选择 `VirtIO RNG` 。
|
||||
|
||||
|
||||
|
||||
`熵源` 选择 `/dev/urandom` ，其余参数保持默认即可。
|
||||
|
||||
|
||||
|
||||
### 2.3.添加串行端口
|
||||
|
||||
在基于 Debian Cloud Image 创建 VM 时，须在虚拟机硬件列表中添加 `串行端口` 设备 `serial0` 。
|
||||
|
||||
补全串口硬件可避免系统因缺失 `/dev/ttyS0` 而无限循环报 `agetty` 输入/输出错误，同时可启用 PVE 的 `xterm.js` 控制台（支持原生复制粘贴）。
|
||||
|
||||
|
||||
|
||||
`串行端口` 设置为 `0` 即可。
|
||||
|
||||
|
||||
|
||||
### 2.4.导入镜像文件
|
||||
|
||||
使用终端工具登录 PVE 服务器，并进入 `/tmp` 目录，执行以下命令创建一个目录。
|
||||
|
||||
@@ -131,17 +155,17 @@ unused0: successfully imported disk 'local-lvm:vm-1001-disk-2'
|
||||
|
||||
磁盘导入成功后，虚拟机硬件列表中将显示一块未使用的磁盘设备，可鼠标 **双击** 该设备进行配置调整。
|
||||
|
||||
|
||||
|
||||
|
||||
当宿主机使用 SSD 作为物理存储设备，并且虚拟磁盘采用 Thin Provisioning （精简置备）模式时，可考虑开启以下选项：
|
||||
|
||||
- `Discard` （ `丢弃` ） 选项，有助于存储空间回收。
|
||||
- `丢弃` （ `Discard` ） 选项，有助于存储空间回收。
|
||||
|
||||
- `SSD Emulation` （ `SSD 仿真` ） 选项，让虚拟机将虚拟磁盘视为 SSD 存储设备。
|
||||
- `SSD 仿真` （ `SSD Emulation` ） 选项，让虚拟机将虚拟磁盘视为 SSD 存储设备。
|
||||
|
||||
在弹出的对话框中，确认 `IO thread` 选项为 **勾选** 状态，并点击 `添加` 。
|
||||
在弹出的对话框中，确认 `IO thread` 选项为 **勾选** 状态，并点击 `新增` 。
|
||||
|
||||
|
||||
|
||||
|
||||
导入的镜像仅具备 `3G` 磁盘空间，为方便后续使用，可通过 `qm` 命令直接将该磁盘调整至目标容量。
|
||||
|
||||
@@ -156,39 +180,27 @@ $ qm disk resize 1001 scsi0 24G
|
||||
|
||||
或鼠标 **单击** 选中该磁盘，选择页面顶部 `磁盘操作` 菜单的子菜单 `调整大小` 。
|
||||
|
||||
|
||||
|
||||
|
||||
在弹出的对话框中，给该磁盘增加 `21G` 磁盘空间。
|
||||
|
||||
|
||||
|
||||
|
||||
### 2.3.添加 CloudInit
|
||||
### 2.5.添加 CloudInit
|
||||
|
||||
为确保 Cloud-Init 能正常初始化系统，需为模板虚拟机添加 `CloudInit 设备` 。
|
||||
|
||||
点击顶部 `添加` 菜单，选择 `CloudInit 设备` 。
|
||||
同样通过 `新增` 菜单，选择 `CloudInit 设备` 。
|
||||
|
||||
|
||||
|
||||
|
||||
`总线/设备` 选择 `SCSI` ，编号为 `1` ，存储路径需根据实际情况进行调整，演示为 `local-lvm` 。
|
||||
|
||||
|
||||
|
||||
### 2.4.添加 VirtIO RNG
|
||||
|
||||
为确保系统拥有充足的可用熵，需为模板虚拟机添加 `VirtIO RNG` 熵源。
|
||||
|
||||
点击顶部 `添加` 菜单，选择 `VirtIO RNG` 。
|
||||
|
||||
|
||||
|
||||
`熵源` 选择 `/dev/urandom` ，其余参数保持默认即可。
|
||||
|
||||
|
||||
|
||||
|
||||
虚拟机硬件设备修改完成后，如下图所示。
|
||||
|
||||
|
||||
|
||||
|
||||
## 3.调整配置参数
|
||||
|
||||
@@ -208,15 +220,15 @@ $ qm disk resize 1001 scsi0 24G
|
||||
|
||||
鼠标 **双击** `引导顺序` 选项，进入编辑界面。
|
||||
|
||||
在 `scsi0` 设备处勾选 “已启用” 复选框，并通过排序功能将其拖拽至首位，点击 `OK` 即可。
|
||||
在 `scsi0` 设备处勾选 “已启用” 复选框，并通过排序功能将其拖拽至首位，点击 `确定` 即可。
|
||||
|
||||
|
||||
|
||||
|
||||
### 3.2.设置平板指针
|
||||
|
||||
关闭 `使用平板指针` 选项，可以一定程度上降低虚拟机的 CPU 使用率。
|
||||
|
||||
|
||||
|
||||
|
||||
## 4.设置 Cloud-Init
|
||||
|
||||
@@ -281,7 +293,7 @@ IPv6 使用 `静态` 地址后，并不影响虚拟机通过主路由获取 IPv6
|
||||
|
||||
- 系统： Debian 13
|
||||
|
||||
- 用途： 内网 DNS 服务器 ( 模板 )
|
||||
- 用途： 内网服务器 ( 模板 )
|
||||
|
||||
- 自启： 否
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
因为 Debian 的云镜像默认使用 SSH 秘钥登录，因此切换到左侧菜单的 `控制台` 进行登录。
|
||||
|
||||
|
||||
|
||||
|
||||
在虚拟机的命令行界面，使用 `vim` 编辑器编辑 `sshd` 服务的配置文件，执行以下命令。
|
||||
|
||||
@@ -53,7 +53,6 @@ $ sudo systemctl restart ssh.service
|
||||
|
||||
```bash
|
||||
## 配置 Debian 系统默认软件源脚本
|
||||
|
||||
$ sudo bash -c 'cat > /etc/apt/sources.list.d/debian.sources <<EOF
|
||||
Types: deb
|
||||
URIs: https://mirrors.ustc.edu.cn/debian
|
||||
@@ -162,6 +161,20 @@ Press <enter> to keep the current choice[*], or type selection number: 2
|
||||
update-alternatives: using /usr/bin/nvim to provide /usr/bin/editor (editor) in manual mode
|
||||
```
|
||||
|
||||
若需完全禁用 `neovim` 鼠标功能；即关闭所有鼠标交互，右键行为完全交给终端 / 控制台处理，需执行以下命令。
|
||||
|
||||
```bash
|
||||
## 创建 nvim 配置目录
|
||||
$ sudo mkdir -p /etc/xdg/nvim
|
||||
|
||||
## 配置 nvim 鼠标交互行为脚本
|
||||
$ sudo tee /etc/xdg/nvim/sysinit.vim << 'EOF'
|
||||
set mouse=
|
||||
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
### 1.6.调整内核参数
|
||||
|
||||
由于该虚拟机将作为内网 DNS 服务器的克隆模板，需调整内核参数以优化性能。
|
||||
@@ -177,7 +190,7 @@ $ sudo editor /etc/sysctl.d/99-sysctl.conf
|
||||
|
||||
```bash
|
||||
# This configuration file is customized by fox,
|
||||
# Optimize sysctl parameters for local DNS server.
|
||||
# Optimize sysctl parameters for local TPL server.
|
||||
|
||||
kernel.panic = 20
|
||||
kernel.panic_on_oops = 1
|
||||
@@ -226,7 +239,7 @@ $ sudo timedatectl set-timezone Asia/Shanghai
|
||||
$ date -R
|
||||
|
||||
#### 系统时间示例输出
|
||||
Wed, 27 Aug 2025 17:02:17 +0800
|
||||
Mon, 10 Aug 2026 11:23:56 +0800
|
||||
```
|
||||
|
||||
Debian 云镜像默认使用 `systemd-timesyncd.service` 同步时间，且需要调整为使用国内 NTP 服务器。
|
||||
@@ -268,21 +281,21 @@ $ sudo systemctl status systemd-timesyncd.service
|
||||
#### NTP 服务示例输出
|
||||
● systemd-timesyncd.service - Network Time Synchronization
|
||||
Loaded: loaded (/usr/lib/systemd/system/systemd-timesyncd.service; enabled; preset: enabled)
|
||||
Active: active (running) since Wed 2025-08-27 17:03:13 CST; 6s ago
|
||||
Invocation: 7dcb974725ac43638a4ae3df51644f84
|
||||
Active: active (running) since Mon 2026-08-10 11:24:43 CST; 5s ago
|
||||
Invocation: 95cd4555913e45d8a7235347cf3d571a
|
||||
Docs: man:systemd-timesyncd.service(8)
|
||||
Main PID: 4540 (systemd-timesyn)
|
||||
Main PID: 6516 (systemd-timesyn)
|
||||
Status: "Contacted time server 203.107.6.88:123 (ntp.aliyun.com)."
|
||||
Tasks: 2 (limit: 2317)
|
||||
Memory: 1.5M (peak: 2.2M)
|
||||
CPU: 261ms
|
||||
Tasks: 2 (limit: 2189)
|
||||
Memory: 1.6M (peak: 2.3M)
|
||||
CPU: 136ms
|
||||
CGroup: /system.slice/systemd-timesyncd.service
|
||||
└─4540 /usr/lib/systemd/systemd-timesyncd
|
||||
└─6516 /usr/lib/systemd/systemd-timesyncd
|
||||
|
||||
Aug 27 17:03:12 DNST01 systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
|
||||
Aug 27 17:03:13 DNST01 systemd[1]: Started systemd-timesyncd.service - Network Time Synchronization.
|
||||
Aug 27 17:03:13 DNST01 systemd-timesyncd[4540]: Contacted time server 203.107.6.88:123 (ntp.aliyun.com).
|
||||
Aug 27 17:03:13 DNST01 systemd-timesyncd[4540]: Initial clock synchronization to Wed 2025-08-27 17:03:13.200663 CST.
|
||||
Aug 10 11:24:43 TPL01 systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
|
||||
Aug 10 11:24:43 TPL01 systemd[1]: Started systemd-timesyncd.service - Network Time Synchronization.
|
||||
Aug 10 11:24:43 TPL01 systemd-timesyncd[6516]: Contacted time server 203.107.6.88:123 (ntp.aliyun.com).
|
||||
Aug 10 11:24:43 TPL01 systemd-timesyncd[6516]: Initial clock synchronization to Mon 2026-08-10 11:24:43.569158 CST.
|
||||
```
|
||||
|
||||
### 1.8.配置自动更新
|
||||
@@ -306,7 +319,7 @@ $ sudo dpkg-reconfigure -plow unattended-upgrades
|
||||
<Yes>
|
||||
```
|
||||
|
||||
进一步调整 `20auto-upgrades` 配置文件。
|
||||
开始调整 `20auto-upgrades` 配置文件。
|
||||
|
||||
```bash
|
||||
## 编辑 20auto-upgrades 配置文件
|
||||
@@ -334,7 +347,7 @@ APT::Periodic::CleanInterval "1";
|
||||
$ sudo editor /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
```
|
||||
|
||||
因为该配置文件很长，完整的配置文件可查看 [debian_dns_50unattended_upgrades.conf](./src/debian/debian_dns_50unattended_upgrades.conf) 以便对比。
|
||||
因为该配置文件很长，完整的配置文件可查看 [debian_tpl_50unattended_upgrades.conf](./src/debian/debian_tpl_50unattended_upgrades.conf) 以便对比。
|
||||
|
||||
```bash
|
||||
## 删除以下行前面的注释符 // ，代表启用
|
||||
@@ -405,7 +418,7 @@ $ sudo crontab -e
|
||||
```bash
|
||||
## 定时任务配置项
|
||||
|
||||
30 4 8,24 * * /usr/sbin/reboot
|
||||
30 4 8,24 * * /usr/sbin/shutdown --reboot now
|
||||
|
||||
```
|
||||
|
||||
@@ -418,7 +431,7 @@ Debian 模板虚拟机已经配置完成，在将其转换为模板前需要对
|
||||
$ sudo bash -c 'apt clean && apt autoclean && apt autoremove --purge'
|
||||
|
||||
## 清理系统缓存
|
||||
$ sudo bash -c 'find /var/cache/apt/ /var/cache/smartdns/ /var/lib/apt/lists/ /tmp/ -type f -print -delete'
|
||||
$ sudo bash -c 'find /var/cache/apt/ /var/lib/apt/lists/ /tmp/ -type f -print -delete'
|
||||
|
||||
## 重置机器标识符
|
||||
$ sudo truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id
|
||||
@@ -426,11 +439,8 @@ $ sudo truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id
|
||||
## 清理系统日志
|
||||
$ sudo bash -c 'find /var/log/ -type f -print -delete'
|
||||
|
||||
## 清理命令历史记录文件
|
||||
$ rm -rvf ~/.bash_history ~/.zsh_history ~/.zcompdump* && history -c
|
||||
|
||||
## 关闭系统
|
||||
$ sudo shutdown now
|
||||
## 清理命令历史记录文件并关闭系统
|
||||
$ rm -rvf ~/.bash_history ~/.zsh_history ~/.zcompdump* && history -c && sudo shutdown now
|
||||
```
|
||||
|
||||
## 2.虚拟机转为模板
|
||||
@@ -443,7 +453,7 @@ $ sudo shutdown now
|
||||
|
||||
若系统配置存在问题，仅能在该模板克隆的新虚拟机中修改，或删除现有模板并重新制作。
|
||||
|
||||
|
||||
|
||||
|
||||
至此 Debian 虚拟机模板制作完成。
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
鼠标 **右键单击** 虚拟机模板，在弹出的菜单中选择 `克隆` 。
|
||||
|
||||
|
||||
|
||||
|
||||
在弹出的虚拟机克隆对话框中，根据实际情况及下方表格内容，修改虚拟机参数。
|
||||
|
||||
@@ -209,33 +209,18 @@ $ sudo systemctl stop dnsmasq.service
|
||||
下载 `SmartDNS` 当前最新版本时，请根据系统架构选择合适的版本，执行以下命令。
|
||||
|
||||
```bash
|
||||
## 创建存放 SmartDNS 安装包的临时目录
|
||||
$ mkdir -p /tmp/SmartDNS
|
||||
|
||||
## 进入目录
|
||||
$ cd /tmp/SmartDNS
|
||||
|
||||
## 下载 SmartDNS 安装包
|
||||
$ curl -LR -O https://github.com/pymumu/smartdns/releases/download/Release48.2/smartdns.1.2026.06.28-1614.x86_64-linux-all.tar.gz
|
||||
|
||||
## 解压缩 SmartDNS 安装包
|
||||
$ tar zxf smartdns.*.x86_64-linux-all.tar.gz
|
||||
|
||||
## 进入安装包目录
|
||||
$ cd smartdns
|
||||
|
||||
## 设置脚本可执行权限
|
||||
$ chmod +x ./install
|
||||
$ curl -LR https://github.com/pymumu/smartdns/releases/download/Release48.4/smartdns.1.2026.08.05-0921.x86_64-linux-all.tar.gz | tar -xz -C /tmp
|
||||
|
||||
## 安装 SmartDNS
|
||||
$ sudo ./install -i
|
||||
$ sudo /tmp/smartdns/install -i
|
||||
```
|
||||
|
||||
后续 `SmartDNS` 推出新版本需原位升级时：先下载最新版本，再将以下命令替代原安装命令执行，升级后现有配置不会丢失。
|
||||
|
||||
```bash
|
||||
## 升级 SmartDNS
|
||||
$ sudo ./install -U
|
||||
$ sudo /tmp/smartdns/install -U
|
||||
```
|
||||
|
||||
修改 `SmartDNS` 配置之前，需检查 `smartdns.service` 服务状态，确保该服务开机自启。
|
||||
@@ -268,16 +253,16 @@ $ sudo curl -LR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/ant
|
||||
|
||||
```bash
|
||||
## 下载加速规则安装脚本
|
||||
$ sudo curl -LR -o /usr/local/bin/smartdns-plugin.sh https://gitee.com/callmer/smartdns_china_list_installer/raw/main/smartdns_plugin.sh
|
||||
$ sudo curl -LR -o /usr/local/bin/smartdns-cnlist https://gitee.com/callmer/smartdns_china_list_installer/raw/main/smartdns-china-list-installer.sh
|
||||
|
||||
## 设置脚本可执行权限
|
||||
$ sudo chmod +x /usr/local/bin/smartdns-plugin.sh
|
||||
$ sudo chmod +x /usr/local/bin/smartdns-cnlist
|
||||
|
||||
## 设置脚本文件防篡改
|
||||
$ sudo chattr +i /usr/local/bin/smartdns-plugin.sh
|
||||
$ sudo chattr +i /usr/local/bin/smartdns-cnlist
|
||||
|
||||
## 执行脚本
|
||||
$ sudo /usr/local/bin/smartdns-plugin.sh
|
||||
$ sudo /usr/local/bin/smartdns-cnlist
|
||||
```
|
||||
|
||||
### 6.2.定时任务
|
||||
@@ -307,7 +292,7 @@ $ sudo crontab -e
|
||||
|
||||
20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
|
||||
|
||||
30 9 * * * /usr/local/bin/smartdns-plugin.sh
|
||||
30 9 * * * /usr/local/bin/smartdns-cnlist
|
||||
```
|
||||
|
||||
### 6.3. SmartDNS 主配置
|
||||
@@ -402,15 +387,21 @@ server-tcp 101.226.4.6 -bootstrap-dns
|
||||
server-tcp 2400:3200::1 -bootstrap-dns
|
||||
server-tcp 2400:3200:baba::1 -bootstrap-dns
|
||||
|
||||
server-tls dot.360.cn -fallback
|
||||
server-quic dns.alidns.com -fallback
|
||||
server-https https://doh.360.cn/dns-query -fallback
|
||||
|
||||
server-tls dot.pub
|
||||
server-tls dns.alidns.com
|
||||
server-https https://doh.pub/dns-query
|
||||
server-https https://dns.alidns.com/dns-query
|
||||
|
||||
server-h3 h3://dns.alidns.com/dns-query -fallback
|
||||
server-https https://doh.360.cn/dns-query -fallback
|
||||
|
||||
```
|
||||
|
||||
`SmartDNS` 主配置文件配置完成后，执行以下命令修正文件权限
|
||||
|
||||
```bash
|
||||
## 修正 SmartDNS 主配置文件权限
|
||||
$ sudo chmod 0640 /etc/smartdns/smartdns.conf
|
||||
```
|
||||
|
||||
### 6.4.配置 Dnsmasq
|
||||
@@ -491,5 +482,24 @@ server=127.0.0.1#6053
|
||||
|
||||
```
|
||||
|
||||
至此，新虚拟机已配置完成，重启后即可作为内网 DNS 服务器使用。
|
||||
## 7.清理系统
|
||||
|
||||
内网 DNS 服务器已部署配置完毕，正式投产前，可按需对系统进行清理优化。
|
||||
|
||||
```bash
|
||||
## 清理系统软件包
|
||||
$ sudo bash -c 'apt clean && apt autoclean && apt autoremove --purge'
|
||||
|
||||
## 清理系统缓存
|
||||
$ sudo bash -c 'find /var/cache/apt/ /var/lib/apt/lists/ /tmp/ -type f -print -delete'
|
||||
|
||||
## 清理 SmartDNS 缓存、持久化数据文件（WebUI 自定义密码存储于此文件）
|
||||
$ sudo bash -c 'find /var/cache/smartdns/ /var/lib/smartdns/ -type f -print -delete'
|
||||
|
||||
## 清理系统日志
|
||||
$ sudo bash -c 'find /var/log/ -type f -print -delete'
|
||||
|
||||
## 清理命令历史记录文件并关闭系统
|
||||
$ rm -rvf ~/.bash_history ~/.zsh_history ~/.zcompdump* && history -c && sudo shutdown now
|
||||
```
|
||||
|
||||
|
||||
@@ -56,7 +56,6 @@ $ sudo systemctl restart ssh.service
|
||||
|
||||
```bash
|
||||
## 配置 Debian 系统默认软件源脚本
|
||||
|
||||
$ sudo bash -c 'cat > /etc/apt/sources.list.d/debian.sources <<EOF
|
||||
Types: deb
|
||||
URIs: https://mirrors.ustc.edu.cn/debian
|
||||
@@ -112,7 +111,7 @@ $ sudo apt install qemu-guest-agent btop curl tmux logrotate cron neovim zsh git
|
||||
$ sudo apt install unattended-upgrades powermgmt-base
|
||||
|
||||
## 安装网络工具
|
||||
$ sudo apt install ethtool dnsmasq conntrack nftables sshguard lsof knot-dnsutils
|
||||
$ sudo apt install nftables sshguard lsof knot-dnsutils ethtool dnsmasq conntrack
|
||||
|
||||
## 安装 TS
|
||||
$ curl -fsSL https://tailscale.com/install.sh | sh
|
||||
@@ -168,6 +167,20 @@ Press <enter> to keep the current choice[*], or type selection number: 2
|
||||
update-alternatives: using /usr/bin/nvim to provide /usr/bin/editor (editor) in manual mode
|
||||
```
|
||||
|
||||
若需完全禁用 `neovim` 鼠标功能；即关闭所有鼠标交互，右键行为完全交给终端 / 控制台处理，需执行以下命令。
|
||||
|
||||
```bash
|
||||
## 创建 nvim 配置目录
|
||||
$ sudo mkdir -p /etc/xdg/nvim
|
||||
|
||||
## 配置 nvim 鼠标交互行为脚本
|
||||
$ sudo tee /etc/xdg/nvim/sysinit.vim << 'EOF'
|
||||
set mouse=
|
||||
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
### 1.6.调整内核模块
|
||||
|
||||
编辑 **内核模块** 配置文件，执行以下命令。
|
||||
@@ -327,7 +340,7 @@ $ sudo dpkg-reconfigure -plow unattended-upgrades
|
||||
<Yes>
|
||||
```
|
||||
|
||||
进一步调整 `20auto-upgrades` 配置文件。
|
||||
开始调整 `20auto-upgrades` 配置文件。
|
||||
|
||||
```bash
|
||||
## 编辑 20auto-upgrades 配置文件
|
||||
@@ -336,13 +349,13 @@ $ sudo editor /etc/apt/apt.conf.d/20auto-upgrades
|
||||
|
||||
清空当前全部配置项后，输入以下内容，并保存。
|
||||
|
||||
配置文件中，用来控制更新周期的参数为 `APT::Periodic::Unattended-Upgrade` ，`7` 表示更新周期为 `7` 天。
|
||||
配置文件中，用来控制更新周期的参数为 `APT::Periodic::Unattended-Upgrade` ，`5` 表示更新周期为 `5` 天。
|
||||
|
||||
```bash
|
||||
## 系统更新周期配置项
|
||||
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "7";
|
||||
APT::Periodic::Unattended-Upgrade "5";
|
||||
APT::Periodic::AutocleanInterval "1";
|
||||
APT::Periodic::CleanInterval "1";
|
||||
|
||||
@@ -425,18 +438,13 @@ $ sudo systemctl status nftables.service
|
||||
$ sudo systemctl enable nftables.service
|
||||
```
|
||||
|
||||
修改 `nftables` 配置文件，执行以下命令。
|
||||
由于防火墙规则内容较多，请打开文件 [debian_ts_nftables.conf](./src/debian/debian_ts_nftables.conf) ，复制全文内容，完整替换 `nftables` 配置文件中的现有配置。
|
||||
|
||||
```bash
|
||||
## 备份 nftables 配置文件
|
||||
$ sudo mv /etc/nftables.conf /etc/nftables.conf.bak
|
||||
|
||||
## 创建新的 nftables 配置文件
|
||||
## 编辑 nftables 配置文件
|
||||
$ sudo editor /etc/nftables.conf
|
||||
```
|
||||
|
||||
由于防火墙配置文件很长，因此请查阅文件 [debian_ts_nftables.conf](./src/debian/debian_ts_nftables.conf) 进行复制。
|
||||
|
||||
配置完成后，需重启 `nftables.service` 服务。
|
||||
|
||||
```bash
|
||||
@@ -594,13 +602,17 @@ $ sudo systemctl restart dnsmasq.service
|
||||
|
||||
```bash
|
||||
## 创建 tailscale-nic-optim 优化脚本
|
||||
$ sudo editor /usr/local/bin/tailscale-nic-optim.sh
|
||||
$ sudo editor /usr/local/bin/tailscale-nic-optim
|
||||
```
|
||||
|
||||
在脚本文件中输入以下内容，并保存。
|
||||
|
||||
```bash
|
||||
#!/bin/sh
|
||||
#
|
||||
# This script is customized by fox,
|
||||
# Optimize NIC offload parameters for local TS server.
|
||||
#
|
||||
|
||||
ETHTOOL_PATH=$(command -v ethtool)
|
||||
|
||||
@@ -634,10 +646,10 @@ fi
|
||||
|
||||
```bash
|
||||
## 设置脚本可执行权限
|
||||
$ sudo chmod +x /usr/local/bin/tailscale-nic-optim.sh
|
||||
$ sudo chmod +x /usr/local/bin/tailscale-nic-optim
|
||||
|
||||
## 设置脚本文件防篡改
|
||||
$ sudo chattr +i /usr/local/bin/tailscale-nic-optim.sh
|
||||
$ sudo chattr +i /usr/local/bin/tailscale-nic-optim
|
||||
```
|
||||
|
||||
进一步创建 `tailscale-nic-optim` 服务配置文件，以满足系统自动化设置需求。
|
||||
@@ -662,7 +674,7 @@ Before=tailscaled.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/tailscale-nic-optim.sh
|
||||
ExecStart=/usr/local/bin/tailscale-nic-optim
|
||||
RemainAfterExit=yes
|
||||
StandardOutput=journal
|
||||
|
||||
@@ -678,7 +690,7 @@ WantedBy=multi-user.target
|
||||
$ sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
执行以下命令让 `tailscale-nic-optim` 服务开机自启动。
|
||||
执行以下命令让 `tailscale-nic-optim` 服务立即启动并置为开机自启状态。
|
||||
|
||||
```bash
|
||||
## 设置 tailscale-nic-optim 服务开机自启
|
||||
|
||||
|
Before Width: | Height: | Size: 261 KiB |
|
After Width: | Height: | Size: 544 KiB |
|
Before Width: | Height: | Size: 310 KiB |
|
After Width: | Height: | Size: 594 KiB |
|
Before Width: | Height: | Size: 218 KiB |
|
After Width: | Height: | Size: 828 KiB |
|
Before Width: | Height: | Size: 152 KiB |
|
After Width: | Height: | Size: 588 KiB |
|
Before Width: | Height: | Size: 156 KiB |
|
After Width: | Height: | Size: 508 KiB |
|
Before Width: | Height: | Size: 273 KiB |
|
After Width: | Height: | Size: 463 KiB |
|
Before Width: | Height: | Size: 94 KiB |
|
After Width: | Height: | Size: 373 KiB |
|
Before Width: | Height: | Size: 307 KiB |
|
After Width: | Height: | Size: 580 KiB |
|
Before Width: | Height: | Size: 266 KiB |
|
After Width: | Height: | Size: 224 KiB |
|
Before Width: | Height: | Size: 603 KiB |
|
After Width: | Height: | Size: 586 KiB |
|
Before Width: | Height: | Size: 136 KiB |
|
After Width: | Height: | Size: 470 KiB |
|
Before Width: | Height: | Size: 196 KiB |
|
After Width: | Height: | Size: 192 KiB |
|
Before Width: | Height: | Size: 180 KiB |
|
After Width: | Height: | Size: 177 KiB |
|
After Width: | Height: | Size: 244 KiB |
|
Before Width: | Height: | Size: 302 KiB |
|
After Width: | Height: | Size: 203 KiB |
|
Before Width: | Height: | Size: 222 KiB |
|
After Width: | Height: | Size: 178 KiB |
|
Before Width: | Height: | Size: 362 KiB |
|
After Width: | Height: | Size: 255 KiB |
|
Before Width: | Height: | Size: 259 KiB |
|
After Width: | Height: | Size: 199 KiB |
|
Before Width: | Height: | Size: 447 KiB |
|
After Width: | Height: | Size: 315 KiB |
|
Before Width: | Height: | Size: 328 KiB |
|
After Width: | Height: | Size: 235 KiB |
|
Before Width: | Height: | Size: 168 KiB |
|
After Width: | Height: | Size: 166 KiB |
|
Before Width: | Height: | Size: 391 KiB |
|
After Width: | Height: | Size: 286 KiB |
|
Before Width: | Height: | Size: 114 KiB |
|
After Width: | Height: | Size: 70 KiB |
|
Before Width: | Height: | Size: 343 KiB |
|
After Width: | Height: | Size: 263 KiB |
|
Before Width: | Height: | Size: 219 KiB |
|
After Width: | Height: | Size: 174 KiB |
|
Before Width: | Height: | Size: 166 KiB |
|
After Width: | Height: | Size: 140 KiB |
|
Before Width: | Height: | Size: 126 KiB |
|
After Width: | Height: | Size: 84 KiB |
|
Before Width: | Height: | Size: 222 KiB |
|
After Width: | Height: | Size: 143 KiB |
|
Before Width: | Height: | Size: 187 KiB |
|
After Width: | Height: | Size: 124 KiB |
|
Before Width: | Height: | Size: 161 KiB |
|
After Width: | Height: | Size: 98 KiB |
|
Before Width: | Height: | Size: 385 KiB |
|
After Width: | Height: | Size: 219 KiB |
|
Before Width: | Height: | Size: 240 KiB |
|
After Width: | Height: | Size: 148 KiB |
|
After Width: | Height: | Size: 227 KiB |
|
After Width: | Height: | Size: 133 KiB |
|
Before Width: | Height: | Size: 200 KiB |
|
After Width: | Height: | Size: 139 KiB |
|
Before Width: | Height: | Size: 275 KiB |
|
After Width: | Height: | Size: 194 KiB |
|
Before Width: | Height: | Size: 318 KiB |
|
After Width: | Height: | Size: 254 KiB |
|
Before Width: | Height: | Size: 127 KiB |
|
After Width: | Height: | Size: 91 KiB |
|
Before Width: | Height: | Size: 202 KiB |
|
After Width: | Height: | Size: 208 KiB |
|
Before Width: | Height: | Size: 41 KiB |
|
After Width: | Height: | Size: 136 KiB |
@@ -53,12 +53,11 @@ server-tcp 101.226.4.6 -bootstrap-dns
|
||||
server-tcp 2400:3200::1 -bootstrap-dns
|
||||
server-tcp 2400:3200:baba::1 -bootstrap-dns
|
||||
|
||||
server-tls dot.360.cn -fallback
|
||||
server-quic dns.alidns.com -fallback
|
||||
server-https https://doh.360.cn/dns-query -fallback
|
||||
|
||||
server-tls dot.pub
|
||||
server-tls dns.alidns.com
|
||||
server-https https://doh.pub/dns-query
|
||||
server-https https://dns.alidns.com/dns-query
|
||||
|
||||
server-h3 h3://dns.alidns.com/dns-query -fallback
|
||||
server-https https://doh.360.cn/dns-query -fallback
|
||||
|
||||
|
||||
@@ -10,5 +10,5 @@
|
||||
|
||||
20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
|
||||
|
||||
30 9 * * * /usr/local/bin/smartdns-plugin.sh
|
||||
30 9 * * * /usr/local/bin/smartdns-cnlist
|
||||
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SmartDNS China List Installer
|
||||
# Install and update China domain rules for SmartDNS.
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
WORKDIR="$(mktemp -d)"
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# This configuration file is customized by fox,
|
||||
# Optimize sysctl parameters for local DNS server.
|
||||
# Optimize sysctl parameters for local TPL server.
|
||||
|
||||
kernel.panic = 20
|
||||
kernel.panic_on_oops = 1
|
||||
@@ -1,5 +1,5 @@
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "7";
|
||||
APT::Periodic::Unattended-Upgrade "5";
|
||||
APT::Periodic::AutocleanInterval "1";
|
||||
APT::Periodic::CleanInterval "1";
|
||||
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
#
|
||||
# This configuration file is customized by fox,
|
||||
# Optimize nftables rules for local TS server.
|
||||
#
|
||||
|
||||
table inet router
|
||||
flush table inet router
|
||||
@@ -26,26 +27,25 @@ table inet router {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
iif "lo" accept comment "defconf: accept traffic from loopback"
|
||||
ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
|
||||
ct state established,related accept comment "defconf: handle inbound flows"
|
||||
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "defconf: rate limit new TCP connections"
|
||||
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
|
||||
iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
|
||||
iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 input traffic"
|
||||
iifname "tailscale0" goto accept_from_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
ct state established,related flow add @ft;
|
||||
ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
|
||||
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
|
||||
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
|
||||
ct state established,related flow add @ft accept comment "defconf: offload and accept forwarded flows"
|
||||
iifname "eth0" goto forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
|
||||
iifname "tailscale0" goto forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority filter; policy accept;
|
||||
oif "lo" accept comment "defconf: accept traffic towards loopback"
|
||||
ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
|
||||
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
|
||||
oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
|
||||
ct state established,related accept comment "defconf: handle outbound flows"
|
||||
oifname "eth0" goto accept_to_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
|
||||
oifname "tailscale0" goto accept_to_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
|
||||
}
|
||||
|
||||
chain syn_flood {
|
||||
@@ -53,51 +53,30 @@ table inet router {
|
||||
counter drop comment "defconf: drop excess new TCP connections"
|
||||
}
|
||||
|
||||
chain input_lan {
|
||||
ct status dnat accept comment "lanconf: accept port redirect"
|
||||
jump accept_from_lan
|
||||
}
|
||||
|
||||
chain forward_lan {
|
||||
jump accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
|
||||
oifname "tailscale0" goto accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
|
||||
ct status dnat accept comment "lanconf: accept port forwards"
|
||||
jump accept_to_lan
|
||||
}
|
||||
|
||||
chain output_lan {
|
||||
jump accept_to_lan
|
||||
}
|
||||
|
||||
chain accept_from_lan {
|
||||
iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
|
||||
}
|
||||
|
||||
chain accept_to_lan {
|
||||
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
|
||||
oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
|
||||
}
|
||||
|
||||
chain input_tailscale {
|
||||
jump accept_from_tailscale
|
||||
oifname "eth0" goto accept_to_lan
|
||||
}
|
||||
|
||||
chain forward_tailscale {
|
||||
jump accept_to_lan comment "tsconf: accept TS to LAN forwarding"
|
||||
jump accept_to_tailscale
|
||||
oifname "eth0" goto accept_to_lan comment "tsconf: accept TS to LAN forwarding"
|
||||
oifname "tailscale0" goto accept_to_tailscale
|
||||
}
|
||||
|
||||
chain output_tailscale {
|
||||
jump accept_to_tailscale
|
||||
chain accept_to_lan {
|
||||
meta nfproto ipv4 ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
|
||||
accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
|
||||
}
|
||||
|
||||
chain accept_from_tailscale {
|
||||
meta nfproto ipv4 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
|
||||
meta nfproto ipv6 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
|
||||
meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic"
|
||||
meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic"
|
||||
}
|
||||
|
||||
chain accept_to_tailscale {
|
||||
meta nfproto ipv4 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
|
||||
meta nfproto ipv6 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
|
||||
meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic"
|
||||
meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic"
|
||||
}
|
||||
|
||||
|
||||
@@ -107,21 +86,17 @@ table inet router {
|
||||
|
||||
chain dstnat {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
|
||||
iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain goto redirect_dns comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
|
||||
}
|
||||
|
||||
chain srcnat {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
|
||||
oifname "eth0" meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
|
||||
}
|
||||
|
||||
chain dstnat_lan {
|
||||
meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv4 DNS redirect"
|
||||
meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv6 DNS redirect"
|
||||
}
|
||||
|
||||
chain srcnat_lan {
|
||||
meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
|
||||
chain redirect_dns {
|
||||
meta nfproto ipv4 counter redirect comment "lanconf: LAN IPv4 DNS redirect"
|
||||
meta nfproto ipv6 counter redirect comment "lanconf: LAN IPv6 DNS redirect"
|
||||
}
|
||||
|
||||
|
||||
@@ -131,12 +106,12 @@ table inet router {
|
||||
|
||||
chain mangle_postrouting {
|
||||
type filter hook postrouting priority mangle; policy accept;
|
||||
oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
|
||||
oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
|
||||
}
|
||||
|
||||
chain mangle_forward {
|
||||
type filter hook forward priority mangle; policy accept;
|
||||
iifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
|
||||
iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -1,4 +1,8 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This script is customized by fox,
|
||||
# Optimize NIC offload parameters for local TS server.
|
||||
#
|
||||
|
||||
ETHTOOL_PATH=$(command -v ethtool)
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ Before=tailscaled.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/tailscale-nic-optim.sh
|
||||
ExecStart=/usr/local/bin/tailscale-nic-optim
|
||||
RemainAfterExit=yes
|
||||
StandardOutput=journal
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "5";
|
||||
APT::Periodic::Unattended-Upgrade "10";
|
||||
APT::Periodic::AutocleanInterval "1";
|
||||
APT::Periodic::CleanInterval "1";
|
||||
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
# This configuration file is customized by fox,
|
||||
# Optimize for X550-T1: advertise 100M / 1G / 2.5G / 5G / 10G.
|
||||
|
||||
iface nic1 inet manual
|
||||
pre-up /usr/sbin/ethtool -s nic1 autoneg on advertise 0x1800000001028 || true
|
||||
|
||||