更新广告列表

Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records)

01.PVE系统安装.md

@@ -6,7 +6,7 @@ PVE 系统正式安装之前，需要准备 PVE 的安装镜像和一些必要
 
 PVE 下载地址：[Proxmox Virtual Environment](https://www.proxmox.com/en/downloads/proxmox-virtual-environment/iso)  
 
-页面中有多个 PVE 相关文件，本文以目前最新的 `Proxmox VE 8.2-1 ISO Installer` 作为演示。  
+页面中有多个 PVE 相关文件，本文以目前最新的 `Proxmox VE 8.3-1 ISO Installer` 作为演示。  
 
 点击 `Proxmox VE 8.x ISO Installer` 链接，进入 PVE 下载页面。  
 

03.PVE系统调整.md

@@ -59,8 +59,9 @@ $ nano /etc/chrony/chrony.conf
 # pool 2.debian.pool.ntp.org iburst    ## 在这行前面增加注释符 # 来注释
 
 # Use Custom vendor zone.
-pool ntp.tencent.com iburst
 pool ntp.aliyun.com iburst
+pool ntp.tencent.com iburst
+pool cn.pool.ntp.org iburst
 
 ```
 
@@ -76,8 +77,12 @@ $ chronyc sources -V
 #### 系统 NTP 服务器示例输出
 MS Name/IP address         Stratum Poll Reach LastRx Last sample
 ===============================================================================
-^+ 106.55.184.199                2   6    17    11   +752us[ +273us] +/-   40ms
+^- 203.107.6.88                  2   6     7     2   +987us[+1251us] +/-   23ms
-^* 203.107.6.88                  2   6    17    11  -1868us[-2348us] +/-   17ms
+^? 106.55.184.199                2   6    11     1   -501us[ -501us] +/-   60ms
+^- electrode.felixc.at           2   6     7     2  +3532us[ +663us] +/-  121ms
+^* 119.28.206.193                2   6    15     1   +184us[-2686us] +/-   53ms
+^- 119.28.183.184                2   6     7     2   +512us[-2358us] +/-   47ms
+^+ time.cloudflare.com           3   6    13     1    -85us[-2955us] +/-  106ms
 ```
 
 ## 2. CPU 调度器
@@ -125,9 +130,9 @@ analyzing CPU 0:
 
 这里面主要关注两个点：
 
-- driver: `intel_cpufreq` 或 `intel_pstate`
+- driver: `intel_cpufreq` 或 `intel_pstate`  
 
-- current policy: `governor "ondemand"` 或 `governor "performance"`
+- current policy: `governor "ondemand"` 或 `governor "performance"`  
 
 还有另外一个命令可用来显示 CPU 当前调度器。  
 
@@ -565,7 +570,64 @@ $ find /sys/kernel/iommu_groups/ -type l
 /sys/kernel/iommu_groups/9/devices/0000:00:1c.6
 ```
 
-## 6.系统清理
+## 6. BTRFS 调整
+
+**额外说明：**  
+
+1. 本节专为 `BTRFS` 单盘 `RAID0`（条带模式）安装的 PVE 系统设计，使用其他安装模式时，请跳过此节。  
+
+2. `BTRFS` 文件系统当前仍为技术预览状态，请谨慎操作。  
+
+3. 有关在 PVE 中使用 `BTRFS` 的详情，请参阅 [Proxmox VE - BTRFS](https://pve.proxmox.com/wiki/BTRFS) 。
+
+安装 PVE 时，若使用了 `BTRFS` 单盘 `RAID0` 的安装模式，系统默认未启用 swap 和 zstd 压缩，需要手动开启。  
+
+通常情况下，内存与 swap 的 **推荐** 比例为 `1:1` 。本机具有 `16GB` 内存，因此设置 `16GB` swap 空间。  
+
+执行以下命令，在 `BTRFS` 文件系统中创建子卷，并配置激活 swapfile 。  
+
+```bash
+## 创建用于存放交换文件的子卷
+$ btrfs subvolume create /swap
+
+## 在子卷中创建 16GB 的交换文件
+$ btrfs filesystem mkswapfile --size 16g --uuid clear /swap/swapfile
+
+## 激活交换文件
+$ swapon /swap/swapfile
+```
+
+此时还需进一步修改系统的 `fstab` 配置文件，以启用 `BTRFS` 的 zstd 压缩功能并确保 swap 在系统启动时自动激活。  
+
+```bash
+## 编辑 fstab 配置文件
+$ nano /etc/fstab
+```
+
+`fstab` 为系统关键配置文件，直接影响系统启动，修改此文件时，请注意以下几点：
+
+- 仅修改根目录 `/` 对应的挂载选项，添加 `compress=zstd` 参数。  
+
+- 在文件末尾新增一行，添加 swap 的自动挂载。  
+
+- 请 **不要** 修改其余配置参数，尤其是设备的唯一标识符（ `UUID` ），切勿修改。  
+
+修改完成后，示例如下。  
+
+```bash
+#### 系统 fstab 示例配置
+
+# <file system> <mount point> <type> <options> <dump> <pass>
+
+UUID=<DO-NOT-EDIT-YOUR-UUID> / btrfs defaults,compress=zstd 0 1
+
+UUID=<YOUR-UUID> /boot/efi vfat defaults 0 1
+proc /proc proc defaults 0 0
+
+/swap/swapfile none swap defaults 0 0
+```
+
+## 7.系统清理
 
 PVE 系统配置完成后，可执行以下命令，对系统进行清理。  
 

05.PVE制作虚拟机模板.md

@@ -142,7 +142,7 @@ $ lsattr /etc/apt/sources.list.d/debian.sources
 
 ```bash
 ## 清理不必要的包
-$ sudo apt clean && sudo apt autoclean && sudo apt autoremove --purge
+$ sudo bash -c 'apt clean && apt autoclean && apt autoremove --purge'
 
 ## 更新软件源
 $ sudo apt update
@@ -188,13 +188,17 @@ kernel.panic = 20
 kernel.panic_on_oops = 1
 
 net.core.default_qdisc = fq_codel
-net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_congestion_control = cubic
 
 # Other adjustable system parameters
 
 net.core.netdev_budget = 600
 net.core.netdev_budget_usecs = 20000
 
+net.core.somaxconn = 8192
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+
 net.ipv4.conf.all.log_martians = 1
 
 net.ipv4.igmp_max_memberships = 256
@@ -202,7 +206,9 @@ net.ipv4.igmp_max_memberships = 256
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
-net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_notsent_lowat = 131072
+net.ipv4.tcp_rmem = 16384 262144 8388608
+net.ipv4.tcp_wmem = 32768 524288 16777216
 
 net.ipv6.conf.all.use_tempaddr = 0
 net.ipv6.conf.default.use_tempaddr = 0
@@ -250,7 +256,7 @@ $ sudo nvim /etc/systemd/timesyncd.conf.d/10-server-ntp.conf
 # Optimize system NTP server.
 
 [Time]
-NTP=ntp.tencent.com ntp.aliyun.com
+NTP=ntp.aliyun.com ntp.tencent.com cn.pool.ntp.org
 
 ```
 
@@ -270,20 +276,20 @@ $ sudo systemctl status systemd-timesyncd.service
 #### NTP 服务示例输出
 ● systemd-timesyncd.service - Network Time Synchronization
      Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; preset: enabled)
-     Active: active (running) since Mon 2023-06-26 16:16:00 CST; 16s ago
+     Active: active (running) since Mon 2024-10-07 18:06:29 CST; 9s ago
        Docs: man:systemd-timesyncd.service(8)
-   Main PID: 18829 (systemd-timesyn)
+   Main PID: 1706 (systemd-timesyn)
-     Status: "Contacted time server 106.55.184.199:123 (ntp.tencent.com)."
+     Status: "Contacted time server 203.107.6.88:123 (ntp.aliyun.com)."
-      Tasks: 2 (limit: 2355)
+      Tasks: 2 (limit: 2315)
      Memory: 1.4M
-        CPU: 37ms
+        CPU: 113ms
      CGroup: /system.slice/systemd-timesyncd.service
-             └─18829 /lib/systemd/systemd-timesyncd
+             └─1706 /lib/systemd/systemd-timesyncd
 
-Jun 26 16:48:00 DNST01 systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
+Oct 07 18:06:29 DNS01 systemd[1]: Starting systemd-timesyncd.service - Network Time Synchronization...
-Jun 26 16:48:00 DNST01 systemd[1]: Started systemd-timesyncd.service - Network Time Synchronization.
+Oct 07 18:06:29 DNS01 systemd[1]: Started systemd-timesyncd.service - Network Time Synchronization.
-Jun 26 16:48:00 DNST01 systemd-timesyncd[18829]: Contacted time server 106.55.184.199:123 (ntp.tencent.com).
+Oct 07 18:06:29 DNS01 systemd-timesyncd[1706]: Contacted time server 203.107.6.88:123 (ntp.aliyun.com).
-Jun 26 16:48:00 DNST01 systemd-timesyncd[18829]: Initial clock synchronization to Mon 2023-06-26 16:16:16.000000 CST.
+Oct 07 18:06:29 DNS01 systemd-timesyncd[1706]: Initial clock synchronization to Mon 2024-10-07 18:06:29.499548 CST.
 ```
 
 ### 1.6.配置自动更新
@@ -441,13 +447,13 @@ Debian 模板虚拟机已经配置完成，在将其转换为模板前需要对
 
 ```bash
 ## 清理系统软件包
-$ sudo apt clean && sudo apt autoclean && sudo apt autoremove --purge
+$ sudo bash -c 'apt clean && apt autoclean && apt autoremove --purge'
 
 ## 清理系统缓存
-$ sudo rm -rvf /var/cache/apt/* /var/lib/apt/lists/* /tmp/*
+$ sudo bash -c 'find /var/cache/apt /var/cache/smartdns /var/lib/apt/lists /tmp -type f -print -delete'
 
 ## 清理系统日志
-$ sudo find /var/log/ -type f | xargs sudo rm -rvf
+$ sudo find /var/log/ -type f -print -delete
 
 ## 清理命令历史记录文件
 $ rm -rvf ~/.bash_history ~/.zsh_history ~/.zcompdump* && history -c

06.PVE制作DNS服务器.md

@@ -65,7 +65,7 @@
 
 `启动/关机顺序` 为 `2` ，表示该虚拟机第 `2` 个启动，倒数第 `2` 个关机。  
 
-`启动延时` 为 `10` ，表示该虚拟机在 PVE 启动后，延迟 `10` 秒后自动启动。  
+`启动延时` 为 `10` ，表示该虚拟机启动后，延迟 `10` 秒再启动下一个虚拟机。  
 
 ![克隆虚拟机自动启动顺序](img/p06/vm_clone_autostart_order.jpeg)
 
@@ -252,7 +252,7 @@ $ sudo systemctl enable smartdns.service
 $ sudo mkdir -p /etc/smartdns.d
 
 ## 下载广告规则配置文件
-$ sudo curl -LR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
+$ sudo curl -LR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
 ```
 
 `SmartDNS` 的加速规则通过 `bash` 脚本安装，脚本生成的配置文件位于 `/etc/smartdns.d` 目录。  
@@ -284,7 +284,7 @@ $ sudo bash /opt/smartdns-plugin.sh
 $ sudo systemctl stop smartdns.service
 
 ## 清理缓存
-$ sudo rm -rvf /var/cache/smartdns
+$ sudo rm -rvf /var/cache/smartdns*
 
 ## 清理进程标识文件
 $ sudo rm -rvf /var/run/smartdns.pid /run/smartdns.pid
@@ -312,8 +312,6 @@ $ sudo nvim /etc/smartdns/smartdns.conf
 
 - `SmartDNS` 端口监听参数为 `6053@lo` ，请根据实际情况进行调整  
 
-- `edns-client-subnet` 为 EDNS 客户端子网，演示中 `202.103.24.68` 为湖北武汉市 DNS 服务器地址，请根据实际情况进行调整  
-
 - 检查配置文件中关于本地域名及其上游 DNS 服务器相关配置，请根据实际情况进行调整  
 
 ```bash
@@ -325,44 +323,44 @@ $ sudo nvim /etc/smartdns/smartdns.conf
 # your network environment.
 #
 # eg:
-#       server 119.29.29.29
 #       server 223.5.5.5
+#       server 180.184.1.1
+#       server 119.29.29.29
 #       server 114.114.114.114
 #       server 2402:4e00::
 #       server 2400:3200::1
 
 conf-file /etc/smartdns.d/*.conf
 
-cache-file /tmp/smartdns.cache
-
 log-level notice
 
 bind [::]:6053@lo
 bind-tcp [::]:6053@lo
 
+cache-size 32768
+max-query-limit 1024
+max-reply-ip-num 24
+
+prefetch-domain yes
+
 serve-expired yes
 serve-expired-ttl 129600
 serve-expired-reply-ttl 30
-prefetch-domain yes
+serve-expired-prefetch-time 28800
-serve-expired-prefetch-time 21600
 
-force-qtype-SOA 65
+rr-ttl-min 60
-max-query-limit 1024
+rr-ttl-max 28800
-edns-client-subnet 202.103.24.68
+rr-ttl-reply-max 14400
-
-server-tcp 119.29.29.29 -group dnspod -exclude-default-group
-server-tcp 2402:4e00:: -group dnspod -exclude-default-group
-nameserver /doh.pub/dnspod
-nameserver /dot.pub/dnspod
-
-server-tcp 223.5.5.5 -group alidns -exclude-default-group
-server-tcp 2400:3200::1 -group alidns -exclude-default-group
-nameserver /dns.alidns.com/alidns
 
 server 172.16.1.1 -group intranet -exclude-default-group
 nameserver /fox.home.arpa/intranet
 domain-rules /fox.home.arpa/ -speed-check-mode none -no-cache
 
+server-tcp 180.184.2.2 -bootstrap-dns
+server-tcp 114.114.115.115 -bootstrap-dns
+server-tcp 2400:3200:baba::1 -bootstrap-dns
+server-tcp 2400:7fc0:849e:200::4 -bootstrap-dns
+
 server-tls dot.pub
 server-tls dns.alidns.com
 
@@ -385,7 +383,7 @@ $ sudo crontab -e
 ```bash
 ## 定时任务配置项
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
 
 30 9 * * * /usr/bin/systemctl restart smartdns.service
 
@@ -396,7 +394,7 @@ $ sudo crontab -e
 ```bash
 ## 定时任务配置项
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
 
 30 9 * * * /usr/bin/bash /opt/smartdns-plugin.sh
 ```
@@ -440,9 +438,8 @@ log-facility=/var/log/dnsmasq.log
 log-async=20
 
 cache-size=2048
-max-cache-ttl=10800
+max-cache-ttl=7200
 fast-dns-retry=1800
-edns-packet-max=1232
 rebind-domain-ok=/fox.home.arpa/
 
 bind-dynamic
@@ -450,6 +447,7 @@ bogus-priv
 domain-needed
 local-service
 no-hosts
+no-negcache
 no-resolv
 no-round-robin
 rebind-localhost-ok

07.PVE制作TS服务器.md

@@ -113,7 +113,7 @@ $ curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring
 
 ```bash
 ## 清理不必要的包
-$ sudo apt clean && sudo apt autoclean && sudo apt autoremove --purge
+$ sudo bash -c 'apt clean && apt autoclean && apt autoremove --purge'
 
 ## 更新软件源
 $ sudo apt update
@@ -178,7 +178,7 @@ $ sudo nvim /etc/sysctl.d/99-sysctl.conf
 kernel.panic = 20
 kernel.panic_on_oops = 1
 
-net.core.default_qdisc = cake
+net.core.default_qdisc = fq_codel
 net.ipv4.tcp_congestion_control = bbr
 
 net.ipv4.ip_forward = 1
@@ -192,6 +192,9 @@ net.core.netdev_budget = 600
 net.core.netdev_budget_usecs = 20000
 
 net.core.rps_sock_flow_entries = 32768
+net.core.somaxconn = 8192
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
 
 net.ipv4.conf.all.accept_redirects = 0
 net.ipv4.conf.default.accept_redirects = 0
@@ -218,7 +221,9 @@ net.ipv4.route.redirect_silence = 2048
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
-net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_notsent_lowat = 131072
+net.ipv4.tcp_rmem = 16384 262144 8388608
+net.ipv4.tcp_wmem = 32768 524288 16777216
 
 net.ipv6.conf.all.accept_ra = 0
 net.ipv6.conf.default.accept_ra = 0
@@ -276,7 +281,7 @@ $ sudo nvim /etc/systemd/timesyncd.conf.d/10-server-ntp.conf
 # Optimize system NTP server.
 
 [Time]
-NTP=ntp.tencent.com ntp.aliyun.com
+NTP=ntp.aliyun.com ntp.tencent.com cn.pool.ntp.org
 
 ```
 
@@ -514,9 +519,8 @@ log-facility=/var/log/dnsmasq.log
 log-async=20
 
 cache-size=2048
-max-cache-ttl=10800
+max-cache-ttl=7200
 fast-dns-retry=1800
-edns-packet-max=1232
 rebind-domain-ok=/fox.home.arpa/
 
 bind-dynamic
@@ -524,6 +528,7 @@ bogus-priv
 domain-needed
 local-service
 no-hosts
+no-negcache
 no-round-robin
 rebind-localhost-ok
 stop-dns-rebind

README.md

@@ -3,13 +3,13 @@
 ## 介绍
 PVE 虚拟化平台的安装以及折腾手记。  
 
-- PVE ISO 版本：8.2-1 (更新时间: 2024-04-24)
+- PVE ISO 版本：8.3-1 (更新时间: 2024-11-21)
 
 - 演示机：
-    - CPU：英特尔奔腾 Silver N6005 处理器
+    - CPU：N6005
-    - 内存：16 GB
+    - 内存：16GB DDR4
-    - 网卡：英特尔以太网控制器 I226-V
+    - 网卡：I226-V
-    - 硬盘：500 GB NVMe 固态硬盘
+    - 硬盘：500GB NVMe
 
 - PVE 网络：
     - IPv4 网络

src/debian/debian_dns_99_sysctl.conf

@@ -5,13 +5,17 @@ kernel.panic = 20
 kernel.panic_on_oops = 1
 
 net.core.default_qdisc = fq_codel
-net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_congestion_control = cubic
 
 # Other adjustable system parameters
 
 net.core.netdev_budget = 600
 net.core.netdev_budget_usecs = 20000
 
+net.core.somaxconn = 8192
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+
 net.ipv4.conf.all.log_martians = 1
 
 net.ipv4.igmp_max_memberships = 256
@@ -19,7 +23,9 @@ net.ipv4.igmp_max_memberships = 256
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
-net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_notsent_lowat = 131072
+net.ipv4.tcp_rmem = 16384 262144 8388608
+net.ipv4.tcp_wmem = 32768 524288 16777216
 
 net.ipv6.conf.all.use_tempaddr = 0
 net.ipv6.conf.default.use_tempaddr = 0

src/debian/debian_dns_dnsmasq.conf

@@ -10,9 +10,8 @@ log-facility=/var/log/dnsmasq.log
 log-async=20
 
 cache-size=2048
-max-cache-ttl=10800
+max-cache-ttl=7200
 fast-dns-retry=1800
-edns-packet-max=1232
 rebind-domain-ok=/fox.home.arpa/
 
 bind-dynamic
@@ -20,6 +19,7 @@ bogus-priv
 domain-needed
 local-service
 no-hosts
+no-negcache
 no-resolv
 no-round-robin
 rebind-localhost-ok

src/debian/debian_dns_dnsmasq_cron.conf

@@ -1,18 +1,18 @@
 ## 下载加速规则安装脚本
-$ sudo curl -LR -o /opt/dnsmasq_plugin.sh https://gitee.com/felixonmars/dnsmasq-china-list/raw/master/install.sh
+$ sudo curl -LR -o /opt/dnsmasq-plugin.sh https://gitee.com/felixonmars/dnsmasq-china-list/raw/master/install.sh
 
 ## 设置脚本可执行权限
-$ sudo chmod +x /opt/dnsmasq_plugin.sh
+$ sudo chmod +x /opt/dnsmasq-plugin.sh
 
 ## 设置脚本文件防篡改
-$ sudo chattr +i /opt/dnsmasq_plugin.sh
+$ sudo chattr +i /opt/dnsmasq-plugin.sh
 
 ## 执行脚本
-$ sudo bash /opt/dnsmasq_plugin.sh
+$ sudo bash /opt/dnsmasq-plugin.sh
 
 ## 设置 crontab
 
 25 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/dnsmasq.d/anti-ad.dnsmasq.conf https://anti-ad.net/anti-ad-for-dnsmasq.conf
 
-35 9 * * * /usr/bin/bash /opt/dnsmasq_plugin.sh
+35 9 * * * /usr/bin/bash /opt/dnsmasq-plugin.sh
 

src/debian/debian_dns_smartdns.conf

@@ -6,44 +6,44 @@
 # your network environment.
 #
 # eg:
-#       server 119.29.29.29
 #       server 223.5.5.5
+#       server 180.184.1.1
+#       server 119.29.29.29
 #       server 114.114.114.114
 #       server 2402:4e00::
 #       server 2400:3200::1
 
 conf-file /etc/smartdns.d/*.conf
 
-cache-file /tmp/smartdns.cache
-
 log-level notice
 
 bind [::]:6053@lo
 bind-tcp [::]:6053@lo
 
+cache-size 32768
+max-query-limit 1024
+max-reply-ip-num 24
+
+prefetch-domain yes
+
 serve-expired yes
 serve-expired-ttl 129600
 serve-expired-reply-ttl 30
-prefetch-domain yes
+serve-expired-prefetch-time 28800
-serve-expired-prefetch-time 21600
 
-force-qtype-SOA 65
+rr-ttl-min 60
-max-query-limit 1024
+rr-ttl-max 28800
-edns-client-subnet 202.103.24.68
+rr-ttl-reply-max 14400
-
-server-tcp 119.29.29.29 -group dnspod -exclude-default-group
-server-tcp 2402:4e00:: -group dnspod -exclude-default-group
-nameserver /doh.pub/dnspod
-nameserver /dot.pub/dnspod
-
-server-tcp 223.5.5.5 -group alidns -exclude-default-group
-server-tcp 2400:3200::1 -group alidns -exclude-default-group
-nameserver /dns.alidns.com/alidns
 
 server 172.16.1.1 -group intranet -exclude-default-group
 nameserver /fox.home.arpa/intranet
 domain-rules /fox.home.arpa/ -speed-check-mode none -no-cache
 
+server-tcp 180.184.2.2 -bootstrap-dns
+server-tcp 114.114.115.115 -bootstrap-dns
+server-tcp 2400:3200:baba::1 -bootstrap-dns
+server-tcp 2400:7fc0:849e:200::4 -bootstrap-dns
+
 server-tls dot.pub
 server-tls dns.alidns.com
 

src/debian/debian_dns_smartdns_cron.conf

@@ -1,14 +1,14 @@
 # This configuration file is customized by fox,
 # Optimize SmartDNS crontab for local DNS server.
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
 
 30 9 * * * /usr/bin/systemctl restart smartdns.service
 
 
 ## Or when the smartdns plugin is installed
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
 
 30 9 * * * /usr/bin/bash /opt/smartdns-plugin.sh
 

src/debian/debian_dns_smartdns_plugin.conf

@@ -3,7 +3,7 @@ set -e
 
 WORKDIR="$(mktemp -d)"
 CONFDIR="/etc/smartdns.d"
-SERVERS=(223.5.5.5 180.184.1.1 119.29.29.29 114.114.114.114)
+SERVERS=(223.5.5.5 180.184.1.1 119.29.29.29 114.114.114.114 2402:4e00:: 2400:3200::1)
 GROUP=(flash)
 # Others: 223.6.6.6 119.28.28.28
 # Not using best possible CDN pop: 1.2.4.8 210.2.4.8

src/debian/debian_ts_99_sysctl.conf

@@ -4,7 +4,7 @@
 kernel.panic = 20
 kernel.panic_on_oops = 1
 
-net.core.default_qdisc = cake
+net.core.default_qdisc = fq_codel
 net.ipv4.tcp_congestion_control = bbr
 
 net.ipv4.ip_forward = 1
@@ -18,6 +18,9 @@ net.core.netdev_budget = 600
 net.core.netdev_budget_usecs = 20000
 
 net.core.rps_sock_flow_entries = 32768
+net.core.somaxconn = 8192
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
 
 net.ipv4.conf.all.accept_redirects = 0
 net.ipv4.conf.default.accept_redirects = 0
@@ -44,7 +47,9 @@ net.ipv4.route.redirect_silence = 2048
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
-net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_notsent_lowat = 131072
+net.ipv4.tcp_rmem = 16384 262144 8388608
+net.ipv4.tcp_wmem = 32768 524288 16777216
 
 net.ipv6.conf.all.accept_ra = 0
 net.ipv6.conf.default.accept_ra = 0

src/debian/debian_ts_dnsmasq.conf

@@ -10,9 +10,8 @@ log-facility=/var/log/dnsmasq.log
 log-async=20
 
 cache-size=2048
-max-cache-ttl=10800
+max-cache-ttl=7200
 fast-dns-retry=1800
-edns-packet-max=1232
 rebind-domain-ok=/fox.home.arpa/
 
 bind-dynamic
@@ -20,6 +19,7 @@ bogus-priv
 domain-needed
 local-service
 no-hosts
+no-negcache
 no-round-robin
 rebind-localhost-ok
 stop-dns-rebind

src/debian/debian_ts_nftables.conf

@@ -24,25 +24,24 @@ table inet router {
 
     chain input {
         type filter hook input priority filter; policy drop;
+        ct state established,related accept comment "defconf: handle inbound flows"
         iif "lo" accept comment "defconf: accept traffic from loopback"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
+        ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
-        tcp flags syn / fin,syn,rst,ack counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
         iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        ct state established,related flow add @ft comment "defconf: track forwarded flows"
+        ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
         iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
 
     chain output {
         type filter hook output priority filter; policy accept;
+        ct state established,related accept comment "defconf: handle outbound flows"
         oif "lo" accept comment "defconf: accept traffic towards loopback"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
         oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
         oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }
@@ -54,18 +53,23 @@ table inet router {
     }
 
     chain syn_flood {
-        limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit"
+        limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
-        counter drop comment "defconf: drop excess packets"
+        counter drop comment "defconf: drop excess new TCP connections"
+    }
+
+    chain handle_offload {
+        flow add @ft accept comment "defconf: track forwarded flows"
+        accept
     }
 
     chain input_lan {
-        ct status dnat counter accept comment "lanconf: accept port redirect"
+        ct status dnat accept comment "lanconf: accept port redirect"
         jump accept_from_lan
     }
 
     chain forward_lan {
         jump accept_to_tailscale comment "tsconf: accept LAN to TS forward"
-        ct status dnat counter accept comment "lanconf: accept port forward"
+        ct status dnat accept comment "lanconf: accept port forward"
         jump accept_to_lan
     }
 
@@ -77,7 +81,7 @@ table inet router {
     }
 
     chain accept_from_lan {
-        iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+        iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
     chain accept_to_lan {