iz.ink

56.项目yml

Tue, 27 Oct 2026 16:18:06 +0800

==============================================================================
vim /etc/systemd/system/alist.service
[Unit]
Description=alist
After=network.target

[Service]
Type=simple
WorkingDirectory=/lei/soft/alist
ExecStart=/lei/soft/alist/alist server
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start alist
systemctl enable alist

==============================================================================
# k3s配置alist
apiVersion: apps/v1
kind: Deployment
metadata:
  name: alist
  labels:
    app: alist
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alist
  template:
    metadata:
      labels:
        app: alist
    spec:
      nodeSelector:
        kubernetes.io/hostname: opsdev

      containers:
      - name: alist
        # 使用轻量的 ubuntu 或 alpine 基础镜像，直接运行宿主机挂载过来的二进制文件
        image: registry.cn-hangzhou.aliyuncs.com/leiuvn/ubuntu:2404
        imagePullPolicy: IfNotPresent
        workingDir: /opt/alist
        # Alist 默认监听 5244 端口
        command: ["/bin/sh", "-c", "apt-get update && apt-get install -y ca-certificates && update-ca-certificates && /opt/alist/alist server --no-prefix --data /opt/alist/data"]
        ports:
        - containerPort: 5244
          name: http

        # 资源限制
        resources:
          limits:
            cpu: "3000m"
            memory: "3Gi"
          requests:
            cpu: "10m"
            memory: "50Mi"

        # 挂载宿主机的 alist 目录
        volumeMounts:
        - mountPath: /opt/alist
          name: alist-volume

      volumes:
      - name: alist-volume
        hostPath:
          path: /lei/soft/alist
          type: Directory

---
apiVersion: v1
kind: Service
metadata:
  name: alist-service
spec:
  type: ClusterIP
  selector:
    app: alist
  ports:
  - port: 5244           # 集群内部端口
    targetPort: 5244     # 容器内部 Alist 监听端口

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alist-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    # 可选：如果希望强制将 HTTP 请求重定向到 HTTPS
    traefik.ingress.kubernetes.io/redirect-entry-point: https
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - s.lbu.cn
    secretName: s-lbu-cn-tls   # 对应刚才创建的 Secret 名称
  rules:
  - host: s.lbu.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: alist-service
            port:
              number: 5244
              
# 创建ssl证书给yaml文件用             
kubectl create secret tls s-lbu-cn-tls \
  --cert=/lei/yaml/alist/ssl/s.lbu.cn.crt \
  --key=/lei/yaml/alist/ssl/s.lbu.cn.key \
  --dry-run=client -o yaml | kubectl apply -f -

==============================================================================
vim filebrowser.yml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: filebrowser
  namespace: default
  labels:
    app: filebrowser
spec:
  replicas: 1
  selector:
    matchLabels:
      app: filebrowser
  template:
    metadata:
      labels:
        app: filebrowser
    spec:
      # 固定在 sl-19 节点运行（与你的存储目录所在节点保持一致）
      nodeSelector:
        kubernetes.io/hostname: sl-19

      # 以 root 用户运行容器，避免挂载宿主机目录出现 Permission Denied 权限问题
      securityContext:
        runAsUser: 0
        runAsGroup: 0

      containers:
        - name: filebrowser
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/filebrowser:2.63
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
              name: http

          # 资源限制
          resources:
            limits:
              cpu: "1000m"
              memory: "1Gi"
            requests:
              cpu: "50m"
              memory: "128Mi"

          # 挂载数据存储目录与配置数据库
          volumeMounts:
            - mountPath: /srv
              name: home1-volume
            - mountPath: /database
              name: db-volume

      volumes:
        - name: home1-volume
          hostPath:
            path: /lei/data/Home1
            type: DirectoryOrCreate
        - name: db-volume
          hostPath:
            path: /lei/data/filebrowser
            type: DirectoryOrCreate

---
apiVersion: v1
kind: Service
metadata:
  name: filebrowser-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: filebrowser
  ports:
    - port: 8880          # 集群内访问端口 (避免使用 80)
      targetPort: 80      # 容器内部端口
      nodePort: 30880     # NodePort 节点暴露端口
      name: http

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: filebrowser-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
spec:
  ingressClassName: traefik
  rules:
    - host: f.lbu.cn
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: filebrowser-service
                port:
                  number: 8880   # 对接 Service 的集群访问端口 (8080)

==============================================================================
vim es9pro.yml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: es9pro-pv
spec:
  capacity:
    storage: 800Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: es9pro
  local:
    path: /lei/data/es9pro
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
                - sl-19

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: es9pro-pvc
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: es9pro
  resources:
    requests:
      storage: 800Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: es9pro
  namespace: default
  labels:
    app: es9pro
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: es9pro
  template:
    metadata:
      labels:
        app: es9pro
    spec:
      nodeSelector:
        kubernetes.io/hostname: sl-19

      containers:
        - name: es9pro
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/es:9.5.5
          imagePullPolicy: IfNotPresent
          env:
            # 通过环境变量直接配置 Elasticsearch，无需改动配置文件
            - name: cluster.name
              value: "es9pro-cluster"
            - name: node.name
              value: "es9pro-node-1"
            - name: network.host
              value: "0.0.0.0"
            - name: discovery.type
              value: "single-node"
            - name: xpack.security.enabled
              value: "false"
          ports:
            - containerPort: 9200
              name: http
            - containerPort: 9300
              name: transport
          resources:
            limits:
              cpu: "4"
              memory: 8Gi
            requests:
              cpu: "500m"
              memory: 1Gi
          volumeMounts:
            - name: es9pro-data
              mountPath: /usr/share/elasticsearch/data
      volumes:
        - name: es9pro-data
          persistentVolumeClaim:
            claimName: es9pro-pvc

---

apiVersion: v1
kind: Service
metadata:
  name: es9pro-service
  namespace: default
  labels:
    app: es9pro
spec:
  type: NodePort
  selector:
    app: es9pro
  ports:
    - name: http
      port: 9200
      targetPort: 9200
      nodePort: 30920
    - name: transport
      port: 9300
      targetPort: 9300
      nodePort: 30930

==============================================================================

55.nas挂载

Wed, 21 Oct 2026 17:42:44 +0800

vmware配置高速网卡
打开主要.vmx文件添加下面一行，网卡名会更新
ethernet0.virtualDev = "vmxnet3"

nas挂载
sudo mount -t cifs //192.168.68.6/Home1/8.rustfs /lei/data/rustfs -o username=18500177779,password=2012,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose
mysql需给挂载目录权限
注意：加了后要在yml文件指定999用户运行，mysql默认999
sudo mount -t cifs //192.168.68.6/Home1/8.rustfs /lei/data/rustfs -o username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose
sudo mount -t cifs //192.168.68.6/Home1/9.db/my5db /lei/data/my5db -o username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose
sudo mount -t cifs //192.168.68.6/Home1/9.db/ck26db /lei/data/ck26db -o username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose

## 应用目录要加权限
#//192.168.68.6/Home1/8.rustfs /lei/data/rustfs cifs username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,_netdev 0 0
#//192.168.68.6/Home1/9.db/my5db /lei/data/my5db cifs username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,_netdev 0 0
#//192.168.68.6/Home1/9.db/ck26db /lei/data/ck26db cifs username=18500177779,password=2012,uid=999,gid=999,file_mode=0700,dir_mode=0700,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,_netdev 0 0
#
## 四个硬盘挂载
#//192.168.68.6/Home1 /lei/data/Home1 cifs username=18500177779,password=2012,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,uid=1000,gid=1000,nofail 0 0
#//192.168.68.6/USBshare /lei/data/disk1 cifs username=18500177779,password=2012,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,uid=1000,gid=1000,nofail 0 0
#//192.168.68.6/USBshare_1 /lei/data/disk2 cifs username=18500177779,password=2012,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,uid=1000,gid=1000,nofail 0 0
#//192.168.68.6/USBshare_2 /lei/data/disk3 cifs username=18500177779,password=2012,vers=3.0,iocharset=utf8,rsize=1048576,wsize=1048576,cache=loose,uid=1000,gid=1000,nofail 0 0

# 加入nas挂载开机启动
vim /etc/systemd/system/mnas.service 
[Unit]
Description=Mount NAS CIFS Shares at Boot
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/lei/shell/mnas.sh

[Install]
WantedBy=multi-user.target

# 修改k3s开机启动顺序
vim /etc/systemd/system/k3s.service
[Unit]
Description=Lightweight Kubernetes
Documentation=https://k3s.io
Wants=network-online.target mnas.service
After=network-online.target mnas.service

挂载百度网盘
安装rclone
sudo apt update
sudo apt install rclone
mkdir -p /mnt/baidupan
rclone mount baidu:/ /mnt/baidupan --vfs-cache-mode writes &
#启用配置权限
vim  /etc/fuse.conf
去掉#user_allow_other注释
# 解决无权限的问题，因为当前只允许指定目录如/mnt等挂载，加上自定义目录
查看
tail -n 15 /etc/apparmor.d/fusermount3
显示include if exists <local/fusermount3>说明支持
# 新建及添加挂载目录
mkdir -p /etc/apparmor.d/local
cat > /etc/apparmor.d/local/fusermount3 <<'EOF'
  mount fstype=fuse.rclone options=(rw,nosuid,nodev) -> /lei/data/baidu/,
EOF
# 重新加载配置
apparmor_parser -r /etc/apparmor.d/fusermount3
# 强制强行卸载
fusermount -u /lei/data/baidu
umount -l /lei/data/baidu
# 带上 --allow-non-empty 重新执行挂载
rclone mount baidu:/ /lei/data/baidu --vfs-cache-mode writes --allow-non-empty &

# 系统安装alist
直接下载二进制给执行权限即可
./alist admin set 修改密码
端口是域名+5244

==============================================================================
vim /etc/systemd/system/alist.service
[Unit]
Description=alist
After=network.target

[Service]
Type=simple
WorkingDirectory=/lei/soft/alist
ExecStart=/lei/soft/alist/alist server
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start alist
systemctl enable alist

==============================================================================
# k3s配置alist
apiVersion: apps/v1
kind: Deployment
metadata:
  name: alist
  labels:
    app: alist
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alist
  template:
    metadata:
      labels:
        app: alist
    spec:
      nodeSelector:
        kubernetes.io/hostname: opsdev

      containers:
      - name: alist
        # 使用轻量的 ubuntu 或 alpine 基础镜像，直接运行宿主机挂载过来的二进制文件
        image: registry.cn-hangzhou.aliyuncs.com/leiuvn/ubuntu:2404
        imagePullPolicy: IfNotPresent
        workingDir: /opt/alist
        # Alist 默认监听 5244 端口
        command: ["/bin/sh", "-c", "apt-get update && apt-get install -y ca-certificates && update-ca-certificates && /opt/alist/alist server --no-prefix --data /opt/alist/data"]
        ports:
        - containerPort: 5244
          name: http

        # 资源限制
        resources:
          limits:
            cpu: "3000m"
            memory: "3Gi"
          requests:
            cpu: "10m"
            memory: "50Mi"

        # 挂载宿主机的 alist 目录
        volumeMounts:
        - mountPath: /opt/alist
          name: alist-volume

      volumes:
      - name: alist-volume
        hostPath:
          path: /lei/soft/alist
          type: Directory

---
apiVersion: v1
kind: Service
metadata:
  name: alist-service
spec:
  type: ClusterIP
  selector:
    app: alist
  ports:
  - port: 5244           # 集群内部端口
    targetPort: 5244     # 容器内部 Alist 监听端口

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alist-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    # 可选：如果希望强制将 HTTP 请求重定向到 HTTPS
    traefik.ingress.kubernetes.io/redirect-entry-point: https
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - s.lbu.cn
    secretName: s-lbu-cn-tls   # 对应刚才创建的 Secret 名称
  rules:
  - host: s.lbu.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: alist-service
            port:
              number: 5244
              
# 创建ssl证书给yaml文件用             
kubectl create secret tls s-lbu-cn-tls \
  --cert=/lei/yaml/alist/ssl/s.lbu.cn.crt \
  --key=/lei/yaml/alist/ssl/s.lbu.cn.key \
  --dry-run=client -o yaml | kubectl apply -f -

==============================================================================
vim filebrowser.yml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: filebrowser
  namespace: default
  labels:
    app: filebrowser
spec:
  replicas: 1
  selector:
    matchLabels:
      app: filebrowser
  template:
    metadata:
      labels:
        app: filebrowser
    spec:
      # 固定在 sl-19 节点运行（与你的存储目录所在节点保持一致）
      nodeSelector:
        kubernetes.io/hostname: sl-19

      # 以 root 用户运行容器，避免挂载宿主机目录出现 Permission Denied 权限问题
      securityContext:
        runAsUser: 0
        runAsGroup: 0

      containers:
        - name: filebrowser
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/filebrowser:2.63
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
              name: http

          # 资源限制
          resources:
            limits:
              cpu: "1000m"
              memory: "1Gi"
            requests:
              cpu: "50m"
              memory: "128Mi"

          # 挂载数据存储目录与配置数据库
          volumeMounts:
            - mountPath: /srv
              name: home1-volume
            - mountPath: /database
              name: db-volume

      volumes:
        - name: home1-volume
          hostPath:
            path: /lei/data/Home1
            type: DirectoryOrCreate
        - name: db-volume
          hostPath:
            path: /lei/data/filebrowser
            type: DirectoryOrCreate

---
apiVersion: v1
kind: Service
metadata:
  name: filebrowser-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: filebrowser
  ports:
    - port: 8880          # 集群内访问端口 (避免使用 80)
      targetPort: 80      # 容器内部端口
      nodePort: 30880     # NodePort 节点暴露端口
      name: http

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: filebrowser-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
spec:
  ingressClassName: traefik
  rules:
    - host: f.lbu.cn
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: filebrowser-service
                port:
                  number: 8880   # 对接 Service 的集群访问端口 (8080)

==============================================================================
vim es9pro.yml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: es9pro-pv
spec:
  capacity:
    storage: 800Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: es9pro
  local:
    path: /lei/data/es9pro
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
                - sl-19

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: es9pro-pvc
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: es9pro
  resources:
    requests:
      storage: 800Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: es9pro
  namespace: default
  labels:
    app: es9pro
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: es9pro
  template:
    metadata:
      labels:
        app: es9pro
    spec:
      nodeSelector:
        kubernetes.io/hostname: sl-19

      containers:
        - name: es9pro
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/es:9.5.5
          imagePullPolicy: IfNotPresent
          env:
            # 通过环境变量直接配置 Elasticsearch，无需改动配置文件
            - name: cluster.name
              value: "es9pro-cluster"
            - name: node.name
              value: "es9pro-node-1"
            - name: network.host
              value: "0.0.0.0"
            - name: discovery.type
              value: "single-node"
            - name: xpack.security.enabled
              value: "false"
          ports:
            - containerPort: 9200
              name: http
            - containerPort: 9300
              name: transport
          resources:
            limits:
              cpu: "4"
              memory: 8Gi
            requests:
              cpu: "500m"
              memory: 1Gi
          volumeMounts:
            - name: es9pro-data
              mountPath: /usr/share/elasticsearch/data
      volumes:
        - name: es9pro-data
          persistentVolumeClaim:
            claimName: es9pro-pvc

---

apiVersion: v1
kind: Service
metadata:
  name: es9pro-service
  namespace: default
  labels:
    app: es9pro
spec:
  type: NodePort
  selector:
    app: es9pro
  ports:
    - name: http
      port: 9200
      targetPort: 9200
      nodePort: 30920
    - name: transport
      port: 9300
      targetPort: 9300
      nodePort: 30930

==============================================================================

54.nifi

Fri, 16 Oct 2026 16:14:27 +0800

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nifi
  namespace: default
  labels:
    app: nifi
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nifi
  template:
    metadata:
      labels:
        app: nifi
    spec:
      # 调度到指定节点（对应你的 sl-18）
      nodeSelector:
        kubernetes.io/hostname: sl-18

      containers:
        - name: nifi
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/nifi:2.12
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8443
              name: https

          # 资源限制（NiFi 相对吃内存，建议给予适当的配额）
          resources:
            limits:
              cpu: "2000m"
              memory: "3Gi"
            requests:
              cpu: "500m"
              memory: "1Gi"

          # 环境变量映射（初始化单用户后台管理员账号密码）
          env:
            - name: NIFI_WEB_PROXY_HOST
              value: "20.wiki"
            - name: NIFI_WEB_HTTPS_HOST
              value: "0.0.0.0"
            - name: NIFI_WEB_HTTPS_PORT
              value: "8443"
            - name: SINGLE_USER_CREDENTIALS_USERNAME
              value: "admin"
            - name: SINGLE_USER_CREDENTIALS_PASSWORD
              value: "Shimujiuxia" # 请修改为你的强密码（至少12位，含大小写和数字）
            - name: KEYSTORE_PATH
              value: /opt/certs/keystore.p12
            - name: KEYSTORE_TYPE
              value: PKCS12
            - name: KEYSTORE_PASSWORD
              valueFrom:
                secretKeyRef: { name: nifi-tls, key: password }
            - name: TRUSTSTORE_PATH
              value: /opt/certs/truststore.p12
            - name: TRUSTSTORE_TYPE
              value: PKCS12
            - name: TRUSTSTORE_PASSWORD
              valueFrom:
                secretKeyRef: { name: nifi-tls, key: password }

          # 挂载宿主机目录（实现数据持久化与配置管理）
          volumeMounts:
            - name: nifi-conf
              mountPath: /opt/nifi/nifi-current/conf
            - name: nifi-db
              mountPath: /opt/nifi/nifi-current/database_repository
            - name: nifi-flowfile
              mountPath: /opt/nifi/nifi-current/flowfile_repository
            - name: nifi-content
              mountPath: /opt/nifi/nifi-current/content_repository
            - name: nifi-provenance
              mountPath: /opt/nifi/nifi-current/provenance_repository
            - name: nifi-logs
              mountPath: /opt/nifi/nifi-current/logs
            - name: tls
              mountPath: /opt/certs
              readOnly: true

      volumes:
        - name: nifi-conf
          hostPath:
            path: /lei/data/nifi/conf
            type: DirectoryOrCreate
        - name: nifi-db
          hostPath:
            path: /lei/data/nifi/database_repository
            type: DirectoryOrCreate
        - name: nifi-flowfile
          hostPath:
            path: /lei/data/nifi/flowfile_repository
            type: DirectoryOrCreate
        - name: nifi-content
          hostPath:
            path: /lei/data/nifi/content_repository
            type: DirectoryOrCreate
        - name: nifi-provenance
          hostPath:
            path: /lei/data/nifi/provenance_repository
            type: DirectoryOrCreate
        - name: nifi-logs
          hostPath:
            path: /lei/data/nifi/logs
            type: DirectoryOrCreate
        - name: tls
          secret:
            secretName: nifi-tls

---
apiVersion: v1
kind: Service
metadata:
  name: nifi-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: nifi
  ports:
    - port: 8443        # 集群内部 Service 访问端口
      targetPort: 8443  # 容器内部端口（NiFi 默认 HTTPS 端口）
      nodePort: 30333   # NodePort 映射端口（可在外部通过 宿主机IP:30443 访问）

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nifi-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    # 如果你的 Traefik 后端需要走 HTTPS，可能需要根据实际情况配置后端协议注解，默认通常自动识别
    # traefik.ingress.kubernetes.io/service.serversscheme: "https"
spec:
  ingressClassName: traefik
  rules:
    - host: 20.wiki   # 请修改为你实际的 NiFi 访问域名
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: nifi-service
                port:
                  number: 8443

配置证书

mkdir -p /lei/yaml/nifi/certs && cd /lei/yaml/nifi/certs
PASS='换成你自己的强密码'

# 自签证书，SAN 包含 20.wiki 和 localhost
openssl req -x509 -newkey rsa:4096 -nodes -days 825 \
  -keyout tls.key -out tls.crt \
  -subj "/CN=20.wiki" \
  -addext "subjectAltName=DNS:20.wiki,DNS:localhost"

# keystore（NiFi 的身份）
openssl pkcs12 -export -in tls.crt -inkey tls.key -name nifi \
  -out keystore.p12 -passout pass:$PASS

# truststore（信任这张证书）
keytool -importcert -alias nifi -file tls.crt -noprompt \
  -storetype PKCS12 -keystore truststore.p12 -storepass $PASS

# 生成 truststore.p12
openssl pkcs12 -export -nokeys -in tls.crt -name nifi \
  -out truststore.p12 -passout pass:$PASS

# 创建类似docker仓库密钥
kubectl create secret generic nifi-tls -n default \
  --from-file=keystore.p12 --from-file=truststore.p12 \
  --from-literal=password="$PASS"

替换nifi.properties 
sed -i \
 -e 's|^nifi.security.keystore=.*|nifi.security.keystore=/opt/certs/keystore.p12|' \
 -e 's|^nifi.security.keystorePasswd=.*|nifi.security.keystorePasswd=Shimujiuxia|' \
 -e 's|^nifi.security.truststore=.*|nifi.security.truststore=/opt/certs/truststore.p12|' \
 -e 's|^nifi.security.truststorePasswd=.*|nifi.security.truststorePasswd=Shimujiuxia|' \
 nifi.properties

修改nifi.properties
nifi.security.keyPasswd=Shimujiuxia

配置nifi

Database Connection URL
jdbc:mysql://172.22.0.20:30336/newdb_zh?useUnicode=true&characterEncoding=utf8&serverTimezone=GMT%2B8&useSSL=false

Database Driver Class Name
com.mysql.cj.jdbc.Driver（适用于 MySQL 8.x 及以上）
com.mysql.jdbc.Driver（适用于老版本 MySQL 5.x）

Database Driver Location
/opt/nifi/nifi-current/conf/mysql-connector-java-5.1.49.jar

53.bs文档

Mon, 28 Sep 2026 10:42:41 +0800

项目仓库

bs：项目文件仓库
bs：项目文件打包后，clone到xinnet虚拟主机

更新xinnet前端脚本

#!/bin/bash

set -e

# ==================== 配置变量区 ====================
LOCAL_PATH="/lei/www/bs"
REMOTE_PORT="52222"
REMOTE_USER_HOST="app0940212022@app0940212022.xincache9.cn"
REMOTE_PATH="~/www"

# 1. 提取 Gitee 的用户名与密码变量
GIT_USER="lbucn"
GIT_PASS="Shixia2028"
GIT_REPO="https://${GIT_USER}:${GIT_PASS}@gitee.com/lbucn/bs.git"

# 2. 提取 SSH 远程服务器密码变量
SSH_PASS="Kd.?L2iWWTpx"

BRANCH="dev"
COMMIT_MSG="0"
# ====================================================

# 校验是否已安装 sshpass 工具
if ! command -v sshpass &> /dev/null; then
    echo "错误: 系统未检测到 sshpass 工具，请先安装："
    echo "  - Ubuntu/Debian: sudo apt-get install sshpass"
    echo "  - CentOS/RHEL:   sudo yum install sshpass"
    echo "  - macOS:         brew install hudochenkov/sshpass/sshpass"
    exit 1
fi

cd "$LOCAL_PATH"

echo "=========================================="
echo "1. 开始提交本地代码到 Git 仓库 ($LOCAL_PATH)..."
echo "=========================================="

git add --all
git commit -m "$COMMIT_MSG" || echo "提示: 没有检测到需要提交的改动，准备直接 push..."
git push origin $BRANCH

echo ""
echo "=========================================="
echo "2. 正在连接远程服务器并克隆最新代码..."
echo "=========================================="

# 使用 sshpass 自动带入密码进行 SSH 连接与远程命令执行
echo "rm -rf $REMOTE_PATH/* $REMOTE_PATH/.* 2>/dev/null; git -c http.sslVerify=false clone -b $BRANCH $GIT_REPO $REMOTE_PATH; exit" | sshpass -p "$SSH_PASS" ssh -tt -o StrictHostKeyChecking=no -p $REMOTE_PORT $REMOTE_USER_HOST /bin/bash

echo ""
echo "=========================================="
echo " SUCCESS: 代码克隆部署完成！"
echo "=========================================="

52.k9s

Fri, 11 Sep 2026 16:50:12 +0800

k9s常用命令

: (按冒号进入命令模式输入)
Ctrl+a (展示所有命名空间资源)
/ (按斜杠输入关键字过滤搜索)
Esc (返回上级 / 退出当前视图)

l (选中Pod看日志)
f (在日志页开启实时滚动)
s (选中Pod一键进入Shell终端)
d (选中Pod查看Describe排错事件)
x (选中Secret直接解码显示明文)
Shift+f (选中Pod一键映射端口到本地)
Ctrl+d (选中Pod按弹窗确认删除/重启)
y (查看当前资源的YAML文件)
e (编辑当前资源的YAML配置)

:pod (切换到 Pod 列表)
:deploy (切换到 Deployment 部署列表)
:svc (切换到 Service 列表)
:ing (切换到 Ingress 路由列表)
:ns (切换 Namespace 命名空间视图)
:node (切换 Node 节点页看CPU/内存占用)
:secret (切换到 Secret 密钥列表)
:cm (切换到 ConfigMap 配置列表)
:ctx (切换 K8s 集群上下文)

? (按问号打开当前页快捷键帮助)
Ctrl+c (退出 k9s)

日志操作0	回到日志顶部
$	跳到日志底部/	搜索关键字
n	下一个匹配
shift+n	上一个匹配
s	切换容器日志（多容器 Pod）
f	过滤日志
b	返回列表

将k9s放在/usr/local/bin目录

配置变量
# 1. 打开你的环境变量配置文件（例如 ~/.bashrc）
echo 'export KUBECONFIG=/etc/rancher/k3s/k3s.yaml' >> ~/.bashrc

# 2. 让环境变量生效
source ~/.bashrc

# 3. 顺便给你的用户加一个读取权限（避免每次都要 sudo）
sudo chmod 644 /etc/rancher/k3s/k3s.yaml

51.ubuntu26笔记

Mon, 07 Sep 2026 13:46:06 +0800

修改源

sudo sed -i 's|http://cn.archive.ubuntu.com/ubuntu/|http://mirrors.aliyun.com/ubuntu/|g' /etc/apt/sources.list.d/ubuntu.sources
sudo sed -i 's|http://archive.ubuntu.com/ubuntu/|http://mirrors.aliyun.com/ubuntu/|g' /etc/apt/sources.list.d/ubuntu.sources
sudo sed -i 's|http://mirrors.tuna.tsinghua.edu.cn/ubuntu/|http://mirrors.aliyun.com/ubuntu/|g' /etc/apt/sources.list.d/ubuntu.sources

修改编辑器为vim

sudo update-alternatives --config editor

修改ssh端口允许root登录

vim /etc/ssh/sshd_config.d/50-cloud-init.conf
PasswordAuthentication yes
Port 10260
PermitRootLogin yes
systemctl restart ssh.socket
systemctl restart sshd
重启

ubuntu网页登录名称前乱码

echo "unset PROMPT_COMMAND" >> ~/.bashrc
source ~/.bashrc

docker兼容build

BUILDX_NO_DEFAULT_ATTESTATIONS=1 docker compose -f cw_api build --no-cache
docker compose -f cw_api push
docker compose -f cw_api up -d

关闭鼠标支持

echo "set mouse-=a" >> ~/.vimrc

50.netbird

Tue, 11 Aug 2026 10:12:23 +0800

netbird

自动安装服务端
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash
./getting-started.sh

安装ubuntu客户端
curl -fsSL https://pkgs.netbird.io/install.sh | sh
./install.sh

客户端执行
netbird up --management-url  

启用ssh
netbird down
netbird up --management-url https://py.mba --setup-key BE39E-9AA4-40E1-BA0C-8C2D4F867BFB --allow-server-ssh --enable-ssh-root

yaml

services:
  # UI dashboard
  dashboard:
    image: registry.cn-hangzhou.aliyuncs.com/leiuvn/netbird:dashv1
    container_name: netbird-dashboard
    restart: unless-stopped
    networks:
      lbu_net:
        ipv4_address: 172.20.0.234   # 指定你在 lbu_net 中的 IP
    ports:
      - '127.0.0.1:8080:80'
    env_file:
      - ./dashboard.env
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
  # Combined server (Management + Signal + Relay + STUN)
  netbird-server:
    image: registry.cn-hangzhou.aliyuncs.com/leiuvn/netbird:serverv1
    container_name: netbird-server
    restart: unless-stopped
    networks:
      lbu_net:
        ipv4_address: 172.20.0.235   # 指定你在 lbu_net 中的 IP
    ports:
      - '127.0.0.1:8081:80'
      - '3478:3478/udp'
    volumes:
      - ./netbird_data:/var/lib/netbird
      - ./config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
volumes:
  netbird_data:
networks:
  lbu_net:
    external: true

刺猬墨客内容更新定时任务

任务：刺猬墨客后台内容更新定时任务
一.分别搜索当日以下四个分类的热点事件新闻和相关图片，使用写作技能每个分类写一篇热点事件文章及配图；
1.国际新闻（搜索新发布的国际热点新闻事件，不包含国内新闻事件）
2.历史回顾（搜索新发布且阅读量高的历史事件相关文章重新组织文本配图）
3.科技前沿（所搜新发布的科技资讯相关文章重新组织文本配图）
4.热门赛事（搜索新发布的重点热门赛事文章重新组织文本配图）
二.以上四个分类每个分类新建一篇文章，使用下面接口推送即可；
重点要求如下：
1.文章生动有趣富有阅读性，标题简短正文1000字以内，封面图片一张，正文图片两张左右，尽量使用网络下载的相关图片，AI生成图片兜底
2.总结文章正文写出小段摘要放在summary字段中
3.在新建时状态默认为published发布
4.使用utf-8的通用格式防止win平台与平台系统格式不兼容显示乱码
上传接口调用示例：
  curl -X POST https://cw.ink/api/admin/content/external-create/ \
    -F 'username=shilei' \
    -F 'password=shimujiuxia' \
    -F 'channel=tech' \
    -F 'title=含正文图片的文章' \
    -F 'summary=正文章摘要' \
    -F 'source=刺猬原创' \
    -F 'status=published' \
    -F 'content=第一段文字。
  {{image:0}}
  第二段文字。
  {{image:1}}' \
    -F 'cover_image=@/data/cover.webp' \
    -F 'content_images=@/data/body-1.jpg' \
    -F 'content_images=@/data/body-2.png'
channel可选 world、history、tech、game；status 可选 draft、published。
上传支持 JPG、PNG、GIF、WebP，最大 20 MB，图片会压缩后上传到现有七牛目录。成功会返回文章 ID、slug、封面 key 和状态。

49.k3s

Thu, 11 Jun 2026 17:22:24 +0800

更新系统并安装基础依赖

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git jq vim

执行k3s一键安装脚本
curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | INSTALL_K3S_MIRROR=cn sh -
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION="v1.31.2+k3s1" sh -

安装时指定ip等参数
curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
  INSTALL_K3S_MIRROR=cn \
  INSTALL_K3S_SKIP_SELINUX_RPM=true \
  INSTALL_K3S_EXEC="server --node-ip=10.10.1.211 --node-external-ip=115.190.123.117 --flannel-external-ip --tls-san=115.190.123.117 --flannel-iface=eth0" \
  sh -

检查k3s服务状态是否为Active
systemctl status k3s --no-pager

检查节点状态
kubectl get nodes

主节点获取密钥
sudo cat /var/lib/rancher/k3s/server/node-token
K10f863e5493e9f858a3abf647e001d3def22419e23d0136493db0d0410c53c5da0::server:a9e830465c1962e0f7cf8608d478eace
增加其他主节点
curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
  INSTALL_K3S_MIRROR=cn \
  K3S_URL=https://100.0.0.12:6443 \
  K3S_TOKEN=K10f863e5493e9f858a3abf647e001d3def22419e23d0136493db0d0410c53c5da0::server:a9e830465c1962e0f7cf8608d478eace \
  INSTALL_K3S_EXEC="server --node-ip=10.10.1.211 --node-external-ip=115.190.123.117 --flannel-external-ip --tls-san=115.190.123.117 --flannel-iface=eth0" \
  sh -

增加其他node节点
curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
  INSTALL_K3S_MIRROR=cn \
  K3S_URL=https://115.190.123.117:6443 \
  K3S_TOKEN=K10e77485e1cf9ccb72f680ff097ceb8f48038cdba82e3e8b522fb05658553b629f::server:0ebc8c026474623e219b890ee757f9f4 \
  INSTALL_K3S_EXEC="agent --node-ip=10.14.0.4 --node-external-ip=219.151.186.154 --flannel-iface=eth0" \
  sh -

给计算节点打标签

kubectl label node sl-26 node-role.kubernetes.io/worker=worker

隔离节点
kubectl cordon sl-26
驱逐节点
kubectl drain sl-26 --ignore-daemonsets --delete-emptydir-data

配置node国内节点解决下载依赖问题

sudo mkdir -p /etc/rancher/k3s
sudo vim /etc/rancher/k3s/registries.yaml
#加以下内容
mirrors:
  "docker.io":
    endpoint:
      - "https://docker.m.daocloud.io"
      - "https://huecker.io"
      - "https://dockerhub.timeweb.cloud"
      - "https://noohhub.ru"
  "registry.k8s.io":
    endpoint:
      - "https://k8s.m.daocloud.io"
      - "https://docker.1ms.run"

configs:
  "crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com":
    auth:
      username: "leius"
      password: "Shimujiuxia@2028"

重启节点	  
sudo systemctl restart k3s-agent
sudo systemctl restart k3s

查看pod详情

查看pod详情
kubectl get pod -o wide
详细事件
kubectl describe pod name

查看pod端口详情
kubectl get svc

节点删除

主节点删除node
kubectl delete node sl-bj

停止node节点
systemctl stop k3s-agent
systemctl daemon-reload
systemctl restart k3s-agent

彻底清理主节点
/usr/local/bin/k3s-uninstall.sh
rm -rf /etc/rancher/k3s /var/lib/rancher/k3s /var/lib/kubelet
rm -rf ~/.kube
rm -rf /var/lib/cni/
rm -rf /etc/cni/net.d/
ip link delete cni0 2>/dev/null
ip link delete flannel.1 2>/dev/null

清理node节点
/usr/local/bin/k3s-agent-uninstall.sh
rm -rf /var/lib/rancher/k3s/

重新加入
curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
  INSTALL_K3S_MIRROR=cn \
  K3S_URL=https://115.190.123.117:6443 \
  K3S_TOKEN=K10e77485e1cf9ccb72f680ff097ceb8f48038cdba82e3e8b522fb05658553b629f::server:0ebc8c026474623e219b890ee757f9f4 \
  INSTALL_K3S_EXEC="agent --node-ip=10.14.0.4 --node-external-ip=219.151.186.154 --flannel-iface=eth0" \
  sh -
  
删除node标签
kubectl label node sl-10 node-role.kubernetes.io/worker-

重新定义标签
kubectl label node sl-10 node-role.kubernetes.io/ali-bj-mysql=

配置镜像密钥

配置镜像密钥
kubectl create secret docker-registry aliyun-acr-secret \
  --docker-server=crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com \
  --docker-username=leius \
  --docker-password=Shimujiuxia@2028 \
  --namespace=default

查看已创建密钥
k3s kubectl get secrets
k3s kubectl get secrets -n <你的命名空间>

pod中添加imagePullSecrets
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cw-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cw-api
  template:
    metadata:
      labels:
        app: cw-api
    spec:
      # ==================== 1. 添加镜像拉取密钥 ====================
      imagePullSecrets:
      - name: aliyun-acr-secret  # 对应上面 kubectl 创建的 Secret 名称
      # ==========================================================

      containers:
      - name: cw-api
        image: crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com/leius/cw:api_2609
        imagePullPolicy: IfNotPresent
        workingDir: /app
        command: ["/app/entrypoint.sh", "uvicorn", "--host", "0.0.0.0", "--port", "8000", "cw_api.asgi:application"]
        ports:
        - containerPort: 8000
          name: http

node增加污点

kubectl taint nodes node-01 dedicated=gpu:NoSchedule
说明：
  NoSchedule（最常用）：没有对应容忍度的 Pod 无法调度到该节点。
  PreferNoSchedule：尽量不调度到该节点，如果没有其他合适节点，也可以退而求其次放进来。
  NoExecute：不仅不让新 Pod 调度进来，还会直接驱逐/杀掉当前节点上已运行且没有该容忍度的 Pod。
node查看污点
kubectl describe node node-01 | grep Taints
node解除污点
kubectl taint nodes node-01 dedicated=gpu:NoSchedule-

pod容忍度
spec:
  template:
    spec:
      # 1. 允许进入带 dedicated=gpu 污点的节点
      tolerations:
      - key: "dedicated"
        operator: "Equal"
        value: "gpu"
        effect: "NoSchedule"
      # 2. 强制指定只去打有 dedicated=gpu 标签的节点
      nodeSelector:
        dedicated: gpu
		
node亲和度
先给节点贴上标签
kubectl label nodes node-01 disktype=ssd

在pod中配置亲和度
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cw-api
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cw-api
  template:
    metadata:
      labels:
        app: cw-api
    spec:
      # ==================== 硬亲和度配置开始 ====================
      affinity:
        nodeAffinity:
          # required 代表【硬性要求】：找不到符合条件的 Node 就挂起（Pending）
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: zone               # 匹配 Node 上的标签 Key
                operator: In            # 在以下列表中
                values:
                - chengdu               # 匹配 Node 上的标签 Value（必须是 chengdu）
      # ==================== 硬亲和度配置结束 ====================

      containers:
      - name: cw-api
        image: crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com/leius/cw:api_2609

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cw-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cw-api
  template:
    metadata:
      labels:
        app: cw-api
    spec:
      # ==================== 亲和度配置开始 ====================
      affinity:
        nodeAffinity:
          # preferredDuringScheduling... 代表“软亲和性”（优先满足，不强制）
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100               # 权重，1-100，越高越优先
            preference:
              matchExpressions:
              - key: disktype         # 匹配 Node 身上的 Key
                operator: In          # 在指定列表中
                values:
                - ssd                 # 匹配 Node 身上的 Value
      # ==================== 亲和度配置结束 ====================

      containers:
      - name: cw-api
        image: crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com/leius/cw:api_2609

查看traefik端口

k3s kubectl get svc traefik -n kube-system

修改默认traefik端口
k3s kubectl edit svc traefik -n kube-system

spec:
  ports:
  - name: web
    nodePort: 30080      # <--- 修改这里：将原来的 32062 改为你想要的端口 (范围 30000-32767)
    port: 80
    protocol: TCP
    targetPort: web
  - name: websecure
    nodePort: 30443      # <--- 修改这里：将原来的 31148 改为你想要的端口
    port: 443
    protocol: TCP
    targetPort: websecure

nginx统配转发traefik
server {
    listen 80;
    server_name k3s.yourdomain.com;

    location / {
        # 将流量转给 K3s 的 Traefik 入口
        proxy_pass http://10.10.1.11:32062;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

解决traefik节点未固定nginx无法代理问题

1. 查看 traefik pod 在哪个节点
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o wide
# 或者更详细的信息
kubectl get pods -n kube-system | grep traefik

2. 固定 traefik 到指定节点
# 方法1：通过 nodeSelector 固定到 sl-11 节点
kubectl patch deployment traefik -n kube-system -p '{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"sl-11"}}}}}'
# 方法2：如果需要取消固定（恢复自动调度）
kubectl patch deployment traefik -n kube-system --type=json -p='[{"op": "remove", "path": "/spec/template/spec/nodeSelector"}]'
# 验证配置是否生效
kubectl get deployment traefik -n kube-system -o yaml | grep -A 3 nodeSelector

3. 当前使用的服务类型
kubectl get svc traefik -n kube-system
# 输出会显示：
# TYPE: NodePort（当前使用的是 NodePort，端口映射 80:30080/TCP,443:30443/TCP）
# svclb pod 已被删除（之前使用 LoadBalancer 时创建的）

4. 推荐方案：NodePort（你当前的配置）
1. nginx 容器占用了宿主机 80/443 端口，svclb 的 LoadBalancer 模式会尝试绑定这些端口，导致冲突
2. NodePort 30080/30443 不会与 nginx 冲突
3. 你的架构是：nginx (80/443) → traefik (30080/30443) → 后端服务
# 如果当前不是 NodePort，执行此命令
kubectl patch svc traefik -n kube-system -p '{"spec":{"type":"NodePort"}}'
# 查看确认
kubectl get svc traefik -n kube-system
# 应该显示：TYPE=NodePort, PORT(S)=80:30080/TCP,443:30443/TCP

5. 完整的推荐配置
kubectl patch svc traefik -n kube-system -p '{"spec":{"type":"NodePort"}}'
# 步骤2：固定 traefik 到 sl-11 节点（nginx 所在节点）
kubectl patch deployment traefik -n kube-system -p '{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"sl-11"}}}}}'
# 步骤3：验证配置
kubectl get svc traefik -n kube-system
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o wide
# 步骤4：测试连通性
curl -I  

6. 保存配置（可选）
如果你想让这个配置持久化（重新部署 traefik 也不会丢失），可以：
# 导出当前 deployment 配置
kubectl get deployment traefik -n kube-system -o yaml > /tmp/traefik-deployment.yaml

服务启停

# 启动 K3s 服务
sudo systemctl start k3s
# 查看 K3s 服务当前运行状态
sudo systemctl status k3s
# 取消开机自启动
sudo systemctl disable k3s
# 重新开启开机自启动
sudo systemctl enable k3s

# 启动 K3s Agent
sudo systemctl start k3s-agent
# 查看 K3s Agent 当前运行状态
sudo systemctl status k3s-agent

配置k3s的traefik代理

apiVersion: v1
kind: Service
metadata:
  name: service-nlbu  # 可以起个清晰的名字
spec:
  ports:
    - port: 80
      targetPort: 5224         # 对应后端服务器的实际端口 5442

---
apiVersion: v1
kind: Endpoints
metadata:
  name: service-nlbu  # 必须与上面的 Service 名称完全一致
subsets:
  - addresses:
      - ip: 172.22.0.19        # 目标服务器的实际 IP
    ports:
      - port: 5224             # 目标服务器的实际端口 5442

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-nlbu
  annotations:
    kubernetes.io/ingress.class: traefik
    # 如果该域名需要配置 HTTPS 证书，可以在这里加上对应的 TLS 规则
spec:
  rules:
  - host: n.lbu.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service-nlbu  # 必须与上面的 Service 名称完全一致
            port:
              number: 80

配置k3s证书

kubectl create secret tls s-lbu-cn-tls \
  --cert=/lei/yaml/alist/ssl/s.lbu.cn.crt \
  --key=/lei/yaml/alist/ssl/s.lbu.cn.key \
  --dry-run=client -o yaml | kubectl apply -f -
  
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alist-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    # 可选：如果希望强制将 HTTP 请求重定向到 HTTPS
    traefik.ingress.kubernetes.io/redirect-entry-point: https
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - s.lbu.cn
    secretName: s-lbu-cn-tls   # 对应刚才创建的 Secret 名称
  rules:
  - host: s.lbu.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: alist-service
            port:
              number: 5244

查看容器

查看容器
kubectl get pods
查看详情
kubectl describe pod name
实时查看日志
kubectl logs -f pod-name
进入容器内部
kubectl exec -it pod-name -- /bin/bash
查看服务端口
kubectl get svc
编辑配置
kubectl edit awx awx-demo
查看密码
kubectl get secret awx-demo-admin-password -o jsonpath='{.data.password}' | base64 -d
kubectl get secret awx-demo-admin-password -n awx -o jsonpath='{.data.password}' 2>/dev/null && echo "" | base64 -d 2>/dev/null || kubectl get secret -n awx | grep password
查看接口配置
kubectl get svc awx-demo-service -n awx -o yaml | grep -A10 "ports:"

k3s使用job构建

开始任务
kubectl apply -f cw_h5.yml
kubectl get job cw-h5-builder
构建日志
kubectl logs -f job/cw-h5-builder
构建节点
kubectl get pod -l app=cw_h5_builder -o wide
删除任务
kubectl delete job cw-h5-builder --ignore-not-found

k3s使用job构建模板

apiVersion: batch/v1
kind: Job
metadata:
  name: cs-pc-builder
spec:
  # 任务失败后的重试次数
  backoffLimit: 2
  # 任务完成后保留 Pod 日志的时间（单位：秒，3600表示1小时后自动清理已完成的 Pod）
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app: cs-pc-builder
    spec:
      # Job 必须指定重启策略：Never 或 OnFailure
      restartPolicy: Never

      dnsPolicy: "None"
      dnsConfig:
        nameservers:
          - 223.5.5.5
          - 114.114.114.11

      nodeSelector:
        kubernetes.io/hostname: sl-12

      imagePullSecrets:
      - name: aliyun-acr-secret

      containers:
      - name: builder
        image: crpi-h7tib7641zxd04p0.cn-chengdu.personal.cr.aliyuncs.com/leius/cs:pc_2610
        imagePullPolicy: IfNotPresent
        workingDir: /app

        # 1. 打包 -> 2. 推送到主节点 -> 3. 正常退出
        command:
        - /bin/sh
        - -c
        - |
          set -e
          echo "===> 检查并安装项目依赖..."
          # npm install --registry=https://registry.npmmirror.com
          npm install --registry=https://registry.npmmirror.com --no-audit --no-fund --loglevel info

          echo "===> 开始执行前端打包..."
          npm run build

          echo "===> 开始同步打包文件到主节点..."
          rsync -avz -e "ssh -p 10260 -o StrictHostKeyChecking=no" /app/dist/ root@10.10.1.11:/lei/www/cs_pc/dist/

          echo "===> 构建并传输成功，任务结束。"

        volumeMounts:
        - mountPath: /app
          name: app-volume
        # - mountPath: /app/node_modules
        #   name: node-modules-volume
        # 挂载宿主机已配置好免密 SSH 的私钥（注意宿主机 /root/.ssh/id_rsa 需提前配好）
        - mountPath: /root/.ssh
          name: ssh-key

      volumes:
      - name: app-volume
        hostPath:
          path: /lei/www/cs/wwwroot/cs_pc
          type: DirectoryOrCreate
      # - name: node-modules-volume
      #   emptyDir: {}
      - name: ssh-key
        hostPath:
          path: /root/.ssh
          type: Directory

解决各节点内网不通时使用公网ip通信要将dnspod调度到非master节点

查看endpoints的ip
kubectl get endpoints kubernetes -n default
修改endpointsip
kubectl patch endpoints kubernetes -n default --type='json' -p='[{"op": "replace", "path": "/subsets/0/addresses/0/ip", "value":"115.190.123.117"}]'
固定到dnspod节点
kubectl patch deployment coredns -n kube-system --type='json' -p='[{"op": "add", "path": "/spec/template/spec/nodeSelector", "value":{"kubernetes.io/hostname":"opsdev"}}]'
删除重新调度
kubectl delete pod -n kube-system -l k8s-app=kube-dns
查看dnspod节点
kubectl get pods -n kube-system -l k8s-app=kube-dns -o wide

解决无法获取node资源信息问题

下面两个pod在主节点，无法访问同在主节点的api，需要调度到非主节点node

kubectl get pods -n kube-system -o wide | grep -E "NAME|local-path|metrics"

调度命令

kubectl patch deployment -n kube-system metrics-server -p '{"spec":{"template":{"spec":{"nodeName":"opsdev"}}}}'
kubectl patch deployment -n kube-system local-path-provisioner -p '{"spec":{"template":{"spec":{"nodeName":"opsdev"}}}}

调度后pod所在节点node资源信息无法获取，因为metrics的pod是通过api的pod获取列表，然后获取各node资源信息，mtrics的pod无法通过公网ip访问自己node的资源信息，可忽略

解决guac无法远程win桌面问题

## 方法 1：脚本关闭forward
  
#!/bin/bash
# 临时修复 - 安装 k3s 后执行

# 1. 修改 FORWARD 链默认策略为 ACCEPT（内网环境，简单直接）
iptables -P FORWARD ACCEPT

# 2. 添加 NAT MASQUERADE 规则（容器访问 netbird 时进行源地址转换）
iptables -t nat -I POSTROUTING 1 -s 172.20.0.0/16 -o wt0 -j MASQUERADE

# 3. 验证规则
echo "验证 FORWARD 策略:"
iptables -L FORWARD -n | head -1

echo -e "\n验证 NAT MASQUERADE 规则:"
iptables -t nat -L POSTROUTING -n -v --line-numbers | head -5

# 4. 测试连通性（替换为实际的 netbird 节点 IP）
echo -e "\n测试容器连通性:"
docker exec guacamole-guacd ping -c 3 10.10.1.12


### 方法 2：持久化配置（推荐，重启后自动生效）
创建 systemd 服务：

cat > /etc/systemd/system/guac-netbird-fix.service <<'EOF'
[Unit]
Description=Fix Guacamole Docker access to Netbird network
After=network.target docker.service netbird.service k3s.service
Before=docker-compose.service

[Service]
Type=oneshot
ExecStart=/bin/bash -c '\
  # 修改 FORWARD 链默认策略为 ACCEPT \
  /usr/sbin/iptables -P FORWARD ACCEPT; \
  \
  # 添加 NAT MASQUERADE 规则 \
  /usr/sbin/iptables -t nat -C POSTROUTING -s 172.20.0.0/16 -o wt0 -j MASQUERADE 2>/dev/null || \
  /usr/sbin/iptables -t nat -I POSTROUTING 1 -s 172.20.0.0/16 -o wt0 -j MASQUERADE'
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

# 启用并启动服务
systemctl daemon-reload
systemctl enable guac-netbird-fix.service
systemctl start guac-netbird-fix.service

# 检查服务状态
systemctl status guac-netbird-fix.service

## 快速验证

# 1. 检查 FORWARD 策略（应该是 ACCEPT）
iptables -L FORWARD -n | head -1

# 2. 检查 NAT 规则（应该看到 172.20.0.0/16 -> wt0 的 MASQUERADE 规则）
iptables -t nat -L POSTROUTING -n -v | grep -E "(wt0|172.20)"

# 3. 查看 netbird 已连接的节点
netbird status --detail | grep -E "(NetBird IP|Status)" | grep -B 1 "Status: Connected"

# 4. 测试容器连通性（替换为实际的节点 IP）
docker exec guacamole-guacd ping -c 3 10.10.1.12

解决安装k3s后netbird内网下linux到win无法ping通问题

  # ============================================
  # NetBird + K3s 冲突解决方案 - 完整命令
  # ============================================

  # 步骤1: 添加 iptables 规则（立即生效）
  # ----------------------------------------

  # 1.1 FORWARD链规则 - 允许 wt0 流量绕过 k3s 规则
  iptables -I FORWARD 1 -i wt0 -j ACCEPT
  iptables -I FORWARD 1 -o wt0 -j ACCEPT

  # 1.2 INPUT/OUTPUT 规则 - 允许 WireGuard UDP 51820 端口（关键！）
  iptables -I INPUT 1 -p udp --dport 51820 -j ACCEPT
  iptables -I INPUT 1 -p udp --sport 51820 -j ACCEPT
  iptables -I OUTPUT 1 -p udp --dport 51820 -j ACCEPT
  iptables -I OUTPUT 1 -p udp --sport 51820 -j ACCEPT

  # 步骤2: 重启 netbird 使其重新建立连接
  # ----------------------------------------
  netbird down
  sleep 2
  netbird up

  # 步骤3: 验证连通性
  # ----------------------------------------
  # 等待几秒让连接建立
  sleep 5

  # 查看连接状态
  netbird status

  # 测试 ping Windows 节点（替换为你的实际IP）
  ping -c 4 10.10.1.31

  # 步骤4: 持久化规则（重启后自动生效）
  # ----------------------------------------
  cat > /etc/systemd/system/netbird-iptables.service <<'EOF'
  [Unit]
  Description=Netbird iptables rules for k3s compatibility
  After=network.target netbird.service
  Before=k3s.service

  [Service]
  Type=oneshot
  ExecStart=/bin/bash -c '\
    # FORWARD链规则 - 允许wt0流量绕过k3s规则 \
    /usr/sbin/iptables -C FORWARD -i wt0 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I FORWARD 1 -i wt0 -j ACCEPT; \
    /usr/sbin/iptables -C FORWARD -o wt0 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I FORWARD 1 -o wt0 -j ACCEPT; \
    \
    # INPUT/OUTPUT规则 - 允许WireGuard UDP 51820端口 \
    /usr/sbin/iptables -C INPUT -p udp --dport 51820 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I INPUT 1 -p udp --dport 51820 -j ACCEPT; \
    /usr/sbin/iptables -C INPUT -p udp --sport 51820 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I INPUT 1 -p udp --sport 51820 -j ACCEPT; \
    /usr/sbin/iptables -C OUTPUT -p udp --dport 51820 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I OUTPUT 1 -p udp --dport 51820 -j ACCEPT; \
    /usr/sbin/iptables -C OUTPUT -p udp --sport 51820 -j ACCEPT 2>/dev/null || /usr/sbin/iptables -I OUTPUT 1 -p udp --sport 51820 -j ACCEPT'
  RemainAfterExit=yes

  [Install]
  WantedBy=multi-user.target
  EOF

  # 启用并启动服务
  systemctl daemon-reload
  systemctl enable netbird-iptables.service
  systemctl start netbird-iptables.service

  # 检查服务状态
  systemctl status netbird-iptables.service

  # ============================================
  # 完成！现在 Linux 应该可以 ping 通 Windows 节点了
  # ============================================

  简化版（如果只想快速测试）：
  # 添加规则
  iptables -I FORWARD 1 -i wt0 -j ACCEPT
  iptables -I FORWARD 1 -o wt0 -j ACCEPT
  iptables -I INPUT 1 -p udp --dport 51820 -j ACCEPT
  iptables -I INPUT 1 -p udp --sport 51820 -j ACCEPT
  iptables -I OUTPUT 1 -p udp --dport 51820 -j ACCEPT
  iptables -I OUTPUT 1 -p udp --sport 51820 -j ACCEPT
  
  # 重启 netbird
  netbird down && sleep 2 && netbird up
  
  # 测试
  ping -c 4 10.10.1.31
  
  核心原因： k3s 的 iptables 规则阻止了 netbird 的 WireGuard UDP 51820 端口握手流量，导致无法建立隧道。

k3s部署awx容器web管理

https://codeload.github.com/ansible/awx-operator/tar.gz/refs/tags/2.19.1
mv awx-operator-2.19.1 awx-operator

编写部署配置文件
vim kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ./awx-operator/config/default

images:
  - name: quay.io/ansible/awx-operator
    newName: registry.cn-hangzhou.aliyuncs.com/leiuvn/k3s
    newTag: awx-operator-2.19.1

  - name: gcr.io/kubebuilder/kube-rbac-proxy
    newName: registry.cn-hangzhou.aliyuncs.com/leiuvn/k3s
    newTag: kube-rbac-proxy-0.15

  - name: registry.k8s.io/kubebuilder/kube-rbac-proxy
    newName: registry.cn-hangzhou.aliyuncs.com/leiuvn/k3s
    newTag: kube-rbac-proxy-0.15

# 【全量补丁】只要是 Deployment 资源，通通强行注入 aliyun-registry-secret
patches:
  - patch: |
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: all-deployments
      spec:
        template:
          spec:
            imagePullSecrets:
              - name: aliyun-registry-secret
    target:
      kind: Deployment

创建密钥
kubectl create secret docker-registry aliyun-registry-secret \
  --docker-server=registry.cn-hangzhou.aliyuncs.com \
  --docker-username=qunrcn \
  --docker-password=Shimujiuxia@2018 \
  --namespace=awx

创建命名空间
kubectl create namespace awx
作用：创建一个名为 awx 的独立"隔离空间"
类比：就像创建一个文件夹，把所有AWX相关的资源（Pod、Service、Secret等）都放进去，避免和其他应用混乱。

切换kubectl默认命名空间
kubectl config set-context --current --namespace=awx
作用：让后续所有 kubectl 命令默认都在 awx 命名空间下操作
设置前：kubectl get pods -n awx
设置后：kubectl get pods

执行部署
kubectl apply -k .
作用：基于当前目录的 kustomization.yaml 配置，部署 AWX Operator
读取 kustomization.yaml
加载 awx-operator/config/default/ 下的 YAML 模板
替换镜像
注入 imagePullSecrets
创建 CRD、RBAC、Deployment 等资源到集群

kubectl apply -f awx-operator/awx-demo.yml
作用：告诉 Operator "帮我创建一个 AWX 实例"
你提交的是一个自定义资源 (CR) 定义
Operator 监听到这个事件后：
创建 PostgreSQL 数据库
创建 Web 服务（前端界面）
创建 Task 服务（执行任务的后端）
创建 Service、Ingress、PVC 等

清理pod
kubectl delete pod -n awx --all
作用：删除 awx 命名空间下的所有 Pod
如果有 Deployment/StatefulSet 管理
K8s 会自动重新创建这些 Pod
配置修改后需要重启
排查问题时清除异常状态
更新镜像版本后触发拉取新镜像

48.v2ray

Wed, 10 Jun 2026 17:02:49 +0800

v2ray在线安装

bash <(wget -qO- -o- https://github.com/233boy/v2ray/raw/master/install.sh)
v2ray url

47.openclaw

Fri, 27 Feb 2026 10:28:49 +0800

====================================================================================
启动
openclaw gateway run
列出所有设备
openclaw devices list
查看特定设备详情（替换为实际 device-id）
openclaw devices show wsl-chrome-001
实时查看设备连接日志
openclaw devices logs WSL-Chrome --follow
查看设备详情
openclaw devices show <id>
查看网关日志
openclaw gateway logs --follow
查看网关状态
openclaw gateway status
查看配对请求
openclaw pairing list
简写
openclaw devices ls
删除设备
openclaw devices remove WSL-Chrome
在设备上执行命令
openclaw devices exec WSL-Chrome -- echo hello
查看待授权请求
openclaw pairing list
批准配对
openclaw pairing approve 3fa810aa-...
拒绝配对
openclaw pairing reject 3fa810aa-...
清除所有待授权
openclaw pairing clear
查看所有通道
openclaw channels list
查看飞书状态
openclaw channels feishu status
启动节点
openclaw node run --host qunr.cn --port 443
查看节点状态
openclaw node status
查看节点日志
openclaw node logs
停止节点
openclaw node stop
查看版本
openclaw --version
查看帮助
openclaw --help
查看智能体列表
openclaw agents list
查看技能列表
openclaw skills list
查看模型列表
openclaw models list

====================================================================================
拉取镜像
docker pull ghcr.io/openclaw/openclaw:latest
docker push registry.cn-hangzhou.aliyuncs.com/leiuvn/ai:openclaw-260225

====================================================================================
安装tailscale
第一台ubuntu
curl -fsSL https://tailscale.com/install.sh | sh
安装后执行
sudo tailscale up
等一分钟，复制如下链接到浏览器
https://login.tailscale.com/a/1f5a3596011890
第二台windows
下载客户端安装后登录
https://tailscale.com/download/windows
配置
tailscale serve --bg --https=18789 http://127.0.0.1:18789
tailscale serve --https=18789 off
设置ip
Ansible
100.64.0.3
win10-2025largh
100.64.0.2
====================================================================================
token连接
export OPENCLAW_GATEWAY_TOKEN=fb75af78457500f586ecb5989d1997afe520514bf45cde2f
openclaw node run --host qunr.cn --port 443 --tls --display-name "WSL-Chrome"
后台
nohup openclaw node run --host qunr.cn --port 443 --tls --display-name "WSL-Chrome" &

====================================================================================
飞书机器人
cli_a91561d921b85cca
lPtcuEx0wyvtTSQ4cAuezMofXozvm08Y

====================================================================================
compose
services:
  openclaw-gateway:
    image: registry.cn-hangzhou.aliyuncs.com/leiuvn/ai:openclaw-260225
    container_name: openclaw-gateway
    restart: unless-stopped
    ports:
      - "18789:18789"
    volumes:
      - /usr/openclaw/data_claw:/home/node/.openclaw
      #- /usr/openclaw/data_claw/openclaw.json:/home/node/.openclaw/openclaw.json
    environment:
      - NODE_ENV=production
      - OPENCLAW_ROLE=gateway
      - OPENCLAW_PORT=18789
    networks:
      build-network:
        ipv4_address: 172.20.0.60
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8g
networks:
  build-network:
    external: true

====================================================================================
openclaw.json	
{
  "commands": {
    "native": "auto",
    "nativeSkills": "auto"
  },
  "gateway": {
    "bind": "lan",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": "fb75af78457500f586ecb5989d1997afe520514bf45cde2f"
    },
    "trustedProxies": [
      "172.20.0.0/16",
      "127.0.0.1"
    ],
    "controlUi": {
      "dangerouslyDisableDeviceAuth": true,
      "allowedOrigins": [
        "https://qunr.cn",
        "http://qunr.cn",
        "*"
      ]
    }
  },
  "meta": {
    "lastTouchedVersion": "2026.2.17",
    "lastTouchedAt": "2026-02-26T08:58:00.000Z"
  }
}

====================================================================================	
主机 (Hostname) = 8.211.139.100
端口 (Port) = 62039
用户名 (Username) = lei
密码 (Password) = shimujiuxia
Telegram 代理配置链接 = tg://socks?server=8.211.139.100&port=62039&user=lei&pass=shimujiuxia

协议 (protocol) 	= socks
地址 (address) 		= 23.91.97.169
端口 (port) 		= 10263
用户名 (Username) 	= lei
密码 (password) 	= Shimujiuxia@2028
------------- 链接 (URL) -------------
socks://bGVpOlNoaW11aml1eGlhQDIwMjg=@23.91.97.169:10263#233boy-socks-23.91.97.169

====================================================================================
模型配置
{
  "meta": {
    "lastTouchedVersion": "2026.2.17",
    "lastTouchedAt": "2026-02-27T07:23:19.376Z"
  },
  "env": {
    "DASHSCOPE_API_KEY": "sk-f726701991d244278cb3dc35d2ad81a8"
  },
  "models": {
    "mode": "merge",
    "providers": {
      "bailian": {
        "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "apiKey": "${DASHSCOPE_API_KEY}",
        "api": "openai-completions",
        "models": [
          {
            "id": "qwen-max",
            "name": "qwen-max",
            "reasoning": false,
            "input": ["text"],
            "contextWindow": 262144,
            "maxTokens": 32768
          },
          {
            "id": "qwen3-max-2026-01-23",
            "name": "qwen3-max-2026-01-23",
            "reasoning": false,
            "input": ["text"],
            "contextWindow": 262144,
            "maxTokens": 65536
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "bailian/qwen-max",
        "fallbacks": [
          "bailian/qwen-max"
        ]
      },
      "models": {
        "bailian/qwen-max": {
          "alias": "qwen"
        }
      }
    }
  },
  "gateway": {
    "port": 18789,
    "bind": "lan",
    "controlUi": {
      "allowedOrigins": [
        "https://qunr.cn",
        "http://qunr.cn",
        "*"
      ],
      "dangerouslyDisableDeviceAuth": true
    },
    "auth": {
      "mode": "token",
      "token": "__OPENCLAW_REDACTED__"
    },
    "trustedProxies": [
      "172.20.0.0/16",
      "127.0.0.1"
    ]
  }
}

====================================================================================	
以下是ubuntu的dockerfile
FROM registry.cn-hangzhou.aliyuncs.com/leiuvn/ubuntu:2404

ENV DEBIAN_FRONTEND=noninteractive

RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources \
    && sed -i 's|http://security.ubuntu.com/ubuntu|http://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources

RUN apt-get update && apt-get install -y \
    curl \
    ca-certificates \
    nodejs \
    npm \
    build-essential \
    python3 \
    make \
    g++ \
    git \
    && rm -rf /var/lib/apt/lists/*

以下是ubuntu的compose
services:
  openclaw:
    image: registry.cn-hangzhou.aliyuncs.com/leiuvn/ai:openclaw-ubuntu
    container_name: openclaw-gateway
    restart: unless-stopped

    ports:
      - "18789:18789"
    volumes:
      - /usr/openclaw/data_claw:/root/.openclaw
    command: >
      openclaw gateway run
      --port 18789
      --allow-unconfigured
    environment:
      - TZ=Asia/Shanghai
    networks:
      build-network:
        ipv4_address: 172.20.0.60
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8g

networks:
  build-network:
    external: true

====================================================================================
以下是ubuntu的全局配置
{
  "meta": {
    "lastTouchedVersion": "2026.2.17",
    "lastTouchedAt": "2026-02-27T07:33:09.062Z"
  },
  "env": {
    "DASHSCOPE_API_KEY": "__OPENCLAW_REDACTED__"
  },
  "models": {
    "mode": "merge",
    "providers": {
      "bailian": {
        "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "apiKey": "${DASHSCOPE_API_KEY}",
        "api": "openai-completions",
        "models": [
          {
            "id": "qwen-max",
            "name": "qwen-max",
            "reasoning": false,
            "input": [
              "text"
            ],
            "cost": {
              "input": 0,
              "output": 0,
              "cacheRead": 0,
              "cacheWrite": 0
            },
            "contextWindow": 262144,
            "maxTokens": 32768
          },
          {
            "id": "qwen3-max-2026-01-23",
            "name": "qwen3-max-2026-01-23",
            "reasoning": false,
            "input": [
              "text"
            ],
            "cost": {
              "input": 0,
              "output": 0,
              "cacheRead": 0,
              "cacheWrite": 0
            },
            "contextWindow": 262144,
            "maxTokens": 65536
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "bailian/qwen-max",
        "fallbacks": [
          "bailian/qwen-max"
        ]
      },
      "models": {
        "bailian/qwen-max": {
          "alias": "qwen"
        }
      }
    }
  },
  "commands": {
    "native": "auto",
    "nativeSkills": "auto"
  },
  "gateway": {
    "mode": "local",
    "port": 18789,
    "bind": "lan",
    "controlUi": {
      "allowedOrigins": [
        "https://qunr.cn",
        "http://qunr.cn",
        "*"
      ],
      "dangerouslyDisableDeviceAuth": true
    },
    "auth": {
      "mode": "token",
      "token": "__OPENCLAW_REDACTED__"
    },
    "trustedProxies": [
      "172.20.0.0/16",
      "127.0.0.1"
    ]
  }
}
	
====================================================================================
飞书权限
{
  "scopes": {
    "tenant": [
      "contact:user.base:readonly",
      "im:chat",
      "im:chat:read",
      "im:chat:update",
      "im:message",
      "im:message.group_at_msg:readonly",
      "im:message.p2p_msg:readonly",
      "im:message:send_as_bot",
      "im:resource",
      "contact:contact.base:readonly"
    ],
    "user": [
      "docx:document:readonly"
    ]
  }
}

====================================================================================
PS：调试wsl控制windows
1.安装
sudo apt update
sudo apt install wslu
2.默认打开
wslview https://www.baidu.com

====================================================================================
PS：windows安装openclaw node
1.安装node
# 推荐安装 Node.js LTS 版本 (≥22.12.0)
# 下载地址：https://nodejs.org
# 安装时务必勾选 "Add to PATH"
# 查看版本
node -v
npm -v
2.安装C++编译工具
# 下载 Visual Studio Build Tools:
# https://visualstudio.microsoft.com/visual-cpp-build-tools/
# 安装时勾选：
# - Desktop development with C++
# - Windows SDK（默认）
3.配置PowerShell执行策略
# 以管理员身份运行 PowerShell
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
4.安装git
https://git-scm.com/download/win
5.安装openclaw
npm install -g openclaw@latest
openclaw --help
6.设置变量连接gateway
设置key
export OPENCLAW_GATEWAY_TOKEN=9b75af78457500f586ecb5989d1997afe520514bf45cde2f
openclaw node run --host qunr.cn --port 443 --tls --display-name "WSL-Chrome-Ubuntu"
连接网关
临时
$env:OPENCLAW_GATEWAY_TOKEN = "9b75af78457500f586ecb5989d1997afe520514bf45cde2f"
echo $env:OPENCLAW_GATEWAY_TOKEN
永久
[Environment]::SetEnvironmentVariable("OPENCLAW_GATEWAY_TOKEN", "9b75af78457500f586ecb5989d1997afe520514bf45cde2f", "User")
[Environment]::GetEnvironmentVariable("OPENCLAW_GATEWAY_TOKEN", "User")
通过域名连接网关
# 尝试通过 npx 运行
npx openclaw node run --host openclaw.yaozh.com --port 443 --tls --display-name "WSL-Chrome-Win"
后台运行
$lei = Start-Job -ScriptBlock {
    npx openclaw node run --host openclaw.yaozh.com --port 443 --tls --display-name "办公电脑"
}
# 查看任务状态
Get-Job -Id $lei.Id
# 实时查看输出
Receive-Job -Id $lei.Id -Wait -AutoRemoveJob

====================================================================================