首页 » 标签："网站"

innobackupex吃光root分区

2024-02-29 作者： Fisherworks

Take a look at this if your innobackupex insists on eating up most (or all) of your root partition, as playing hide and seek with you especially.

近两天总收到奇怪的推送，磁盘占用超90%，没采取人为任何措施，又自动降至正常……就很离谱。去翻了一下云监控的磁盘使用率，发现居然是系统盘，而非数据盘（后者占用率不高，多日无明显变化），就更奇怪了。

前者么，不逮住问题发生时的话，根本无从查起；考虑其发生规律，基本跟mysql冷备的时间周期比较吻合。

所以先去看mysql冷备文件的状态，就开始出问题了（截图欠奉）。

每个备份文件的结束时间都很早，从以往常见的上午9~10点提前到了凌晨4~5点。
且文件的大小也不太对劲，降了一半不止（在未删除数据的前提下）。

好办，备份文件会定期rotate但log不会，不删就会一直存，看log就好。

一看不要紧，近两天备份都是失败告终。

..........
240209 05:05:01 >> log scanned up to (58627078203151)
240209 05:05:03 >> log scanned up to (58627086878169)
innobackupex: Error writing file '/tmp/xbtempPr6mT8' (Errcode: 28 - No space left on device)
xtrabackup: Error: write to logfile failed
xtrabackup: Error: xtrabackup_copy_logfile() failed.

..........

240209 05:05:01 >> log scanned up to (58627078203151)

240209 05:05:03 >> log scanned up to (58627086878169)

innobackupex: Error writing file '/tmp/xbtempPr6mT8' (Errcode: 28 - No space left on device)

xtrabackup: Error: write to logfile failed

xtrabackup: Error: xtrabackup_copy_logfile() failed.

这里的 /tmp 就很迷，我印象中所有临时文件都不应该去系统默认的temp目录，索性检查一下。

完整阅读本篇»

从lxd迁移到incus

2024-02-27 作者： Fisherworks

Let’s talk about migration from lxd to incus. As for the reason, well I guess we have seen too much of this kinda “show” in the past half decade (just like CentOS to Rocky) so here is what happened in case you’re interested.

Technically I won’t take this as a tutorial since with the well-prepared tool lxd-to-incus by Stéphane Graber (Author of both lxd and incus) there’s nothing to do but simply running it, then everything seems working well.

PS: Tested PASS on both Debian Bookworm AMD64 (on Linux KVM based vm) and Armbian Bookworm ARM64 (on RK3566 based SBC).

这些年，同类剧本真是没少看。一言不合就闭源，一言不合就拉分支，完全不新鲜，具体就不多说了，开工干活。其实吧，作者给了迁移工具 lxd-to-incus ，所以实话说没啥可干的，执行一下就可以验证迁移后的结果了。

先检查系统现状。Check the system status at first.

# root @ bookworm-vm-host in ~ [17:55:15]
$ uname -a
Linux bookworm-vm-host 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux

# root @ bookworm-vm-host in ~ [17:55:20]
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

# root @ bookworm-vm-host in ~ [17:55:28]
$ lxc --version
5.0.2

# root @ bookworm-vm-host in ~ [17:55:35]
$ lxc list -c nsum4N
+-------------+---------+-----------+--------------+------------------------+-----------+
|    NAME     |  STATE  | CPU USAGE | MEMORY USAGE |          IPV4          | PROCESSES |
+-------------+---------+-----------+--------------+------------------------+-----------+
| d10-test    | RUNNING | 5s        | 94.54MiB     | 192.168.143.138 (eth0) | 6         |
+-------------+---------+-----------+--------------+------------------------+-----------+
| d12-ngx     | RUNNING | 6s        | 107.81MiB    | 192.168.143.2 (eth0)   | 19        |
+-------------+---------+-----------+--------------+------------------------+-----------+
| r8-app1     | RUNNING | 8s        | 213.93MiB    | 192.168.143.129 (eth0) | 235       |
+-------------+---------+-----------+--------------+------------------------+-----------+
| u18-redmine | RUNNING | 19s       | 402.67MiB    | 192.168.143.158 (eth0) | 16        |
+-------------+---------+-----------+--------------+------------------------+-----------+

# root @ bookworm-vm-host in ~ [17:55:39]
$

# root @ bookworm-vm-host in ~ [17:55:15]

$ uname -a

Linux bookworm-vm-host 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux

# root @ bookworm-vm-host in ~ [17:55:20]

$ cat /etc/os-release

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"

NAME="Debian GNU/Linux"

VERSION_ID="12"

VERSION="12 (bookworm)"

VERSION_CODENAME=bookworm

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

# root @ bookworm-vm-host in ~ [17:55:28]

$ lxc --version

5.0.2

# root @ bookworm-vm-host in ~ [17:55:35]

$ lxc list -c nsum4N

+-------------+---------+-----------+--------------+------------------------+-----------+

+-------------+---------+-----------+--------------+------------------------+-----------+

| d10-test | RUNNING | 5s | 94.54MiB | 192.168.143.138 (eth0) | 6 |

+-------------+---------+-----------+--------------+------------------------+-----------+

| d12-ngx | RUNNING | 6s | 107.81MiB | 192.168.143.2 (eth0) | 19 |

+-------------+---------+-----------+--------------+------------------------+-----------+

| r8-app1 | RUNNING | 8s | 213.93MiB | 192.168.143.129 (eth0) | 235 |

+-------------+---------+-----------+--------------+------------------------+-----------+

| u18-redmine | RUNNING | 19s | 402.67MiB | 192.168.143.158 (eth0) | 16 |

+-------------+---------+-----------+--------------+------------------------+-----------+

# root @ bookworm-vm-host in ~ [17:55:39]

然后根据文档，安装incus。Now install the incus (by Zabbly) according to the documentation.

从安装过程看，至少创建了一个用户，两个组，以及不少于6个systemd服务。

完整阅读本篇»

Acme.sh全自动获取SSL通配符证书

2021-03-01 作者： Fisherworks

Here I’m gonna show you a quick how-to on obtaining a wildcard SSL cert from Let’s Encrypt with the “pure shell written” acme.sh, which is simple, light-weight and far beyond flexible.

And you may already aware that I’ve an earlier post on doing this with another tool called certbot-auto, well, unfortuantely it’s… kinda still working… but having no support or further update anymore. As for the “official successor” of the certbot-auto? It seems the official guys have decided to walk step and step closer into the mire, with that good-looking but evil-inside snapd… oh, don’t even say that word again. It’s weird enough – I saw nothing around Canonical brand on sponsors list from homepage of Let’s Encrypt. That’s another topic anyway, a wildcard SSL cert for free is still worth my sincere appreciation in this case.

今天简单聊下如何使用acme.sh来获取通配符证书，纯shell工具比之前聊过的certbot-auto更为简单、轻量且灵活。此外不幸的是，半年不见certbot已然走上邪路，奇怪的是Let’s Encrypt首页赞助商清单里并未发现Canonical在列，让我倍感意外。

废话少叙，先装为敬。

[root@aqui-test ~]# curl https://get.acme.sh | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   937    0   937    0     0    445      0 --:--:--  0:00:02 --:--:--   445
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  204k  100  204k    0     0  33335      0  0:00:06  0:00:06 --:--:-- 28373
[Sat Feb 27 23:14:42 CST 2021] Installing from online archive.
[Sat Feb 27 23:14:42 CST 2021] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz
[Sat Feb 27 23:15:47 CST 2021] Extracting master.tar.gz
[Sat Feb 27 23:15:47 CST 2021] It is recommended to install socat first.
[Sat Feb 27 23:15:47 CST 2021] We use socat for standalone server if you use standalone mode.
[Sat Feb 27 23:15:47 CST 2021] If you don't use standalone mode, just ignore this warning.
[Sat Feb 27 23:15:47 CST 2021] Installing to /root/.acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installed to /root/.acme.sh/acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.bashrc'
[Sat Feb 27 23:15:47 CST 2021] OK, Close and reopen your terminal to start using acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.cshrc'
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.tcshrc'
[Sat Feb 27 23:15:47 CST 2021] Installing cron job
[Sat Feb 27 23:15:48 CST 2021] Good, bash is found, so change the shebang to use bash as preferred.
[Sat Feb 27 23:15:49 CST 2021] OK
[Sat Feb 27 23:15:49 CST 2021] Install success!
[root@aqui-test ~]#

[root@aqui-test ~]# curl https://get.acme.sh | sh

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 937 0 937 0 0 445 0 --:--:-- 0:00:02 --:--:-- 445

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 204k 100 204k 0 0 33335 0 0:00:06 0:00:06 --:--:-- 28373

[Sat Feb 27 23:14:42 CST 2021] Installing from online archive.

[Sat Feb 27 23:14:42 CST 2021] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz

[Sat Feb 27 23:15:47 CST 2021] Extracting master.tar.gz

[Sat Feb 27 23:15:47 CST 2021] It is recommended to install socat first.

[Sat Feb 27 23:15:47 CST 2021] We use socat for standalone server if you use standalone mode.

[Sat Feb 27 23:15:47 CST 2021] If you don't use standalone mode, just ignore this warning.

[Sat Feb 27 23:15:47 CST 2021] Installing to /root/.acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installed to /root/.acme.sh/acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.bashrc'

[Sat Feb 27 23:15:47 CST 2021] OK, Close and reopen your terminal to start using acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.cshrc'

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.tcshrc'

[Sat Feb 27 23:15:47 CST 2021] Installing cron job

[Sat Feb 27 23:15:48 CST 2021] Good, bash is found, so change the shebang to use bash as preferred.

[Sat Feb 27 23:15:49 CST 2021] OK

[Sat Feb 27 23:15:49 CST 2021] Install success!

[root@aqui-test ~]#

安装过程中会自动创建cronjob，如果不想自动创建，安装时要加个参数，也可以手动把cronjob删掉（则证书不会自动展期）。

[root@aqui-test ~]# crontab -l
# m h  dom mon dow   command
47 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[root@aqui-test ~]#

[root@aqui-test ~]# crontab -l

# m h dom mon dow command

47 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

[root@aqui-test ~]#

此时把阿里云key和secret填入环境变量（建议使用RAM账户，风险最小化）。

[root@aqui-test ~]# export Ali_Key="L123456789q"
[root@aqui-test ~]# export Ali_Secret="j123456789l"

1 2	[root@aqui-test ~]# export Ali_Key="L123456789q" [root@aqui-test ~]# export Ali_Secret="j123456789l"

然后一句话申请wildcard（通配符）证书。

完整阅读本篇»

CentOS7免费SSL证书及自动展期

2020-06-14 作者： Fisherworks

This post shows you how to obtain a wildcard SSL certificate for free (which values at least $50) from Let’s Encrypt on CentOS 7.x Linux, and get it setup to renew by itself with an automated script.

至于什么是SSL证书，有什么用，这里不赘述了。大致上，一个泛域名（通配符）DV证书，价值怎么也在CNY 2000/年开外，注意是按年缴费；企业型（OV）证书则更贵，年费肯定不下万。因此别嫌命令行操作不好搞，有免费午餐已然相当给力，还要啥自行车。

按规矩，周知一下，证书发行方是Let’s Encrypt。之所以能送免（bai）费（piao）证书，据说主要是全自动。证书生成、发放、展期等操作，都经shell脚本完全自动化 —— 无人工就成本低，蛮好理解；至于抢了那几家拦路收费的生意，咱也捧个人场，起码希望他们能一直坚持做下去。

证书自动获取

来一台阿里云上的CentOS7，以非root（但具备sudo权限）用户连接，先下载certbot-auto脚本，并授以执行权限。

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto 
--2020-06-11 22:57:34--  https://dl.eff.org/certbot-auto
正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201 
正在连接 dl.eff.org ... 已连接。 
已发出HTTP 请求，正在等待回应... 200 OK
长度：79897 (78K) [application/octet-stream]
正在保存至: “certbot-auto”
 
100%[===============================>] 79,897      5.73KB/s 用时13s
 
2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto

--2020-06-11 22:57:34-- https://dl.eff.org/certbot-auto

正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201

正在连接 dl.eff.org ... 已连接。

已发出HTTP 请求，正在等待回应... 200 OK

长度：79897 (78K) [application/octet-stream]

正在保存至: “certbot-auto”

100%[===============================>] 79,897 5.73KB/s 用时13s

2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

然后以手工完成“挑战”（challenge）的方式，获取泛域名（通配符）DV证书，其中挑战选择DNS，也即按脚本要求，手工在域名解析中增加TXT记录 —— 以此证明此域名归属于申请者。

[py27@fisher-test ~]$ ./certbot-auto certonly  -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory
Requesting to rerun ./certbot-auto with root privileges...
./certbot-auto has insecure permissions!
To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/
Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for fisher.cn
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
 
Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）
 
MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88
 
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】
Waiting for verification...
Cleaning up challenges
 
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）
   /etc/letsencrypt/live/fisher.cn/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/fisher.cn/privkey.pem
   Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
 
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[py27@fisher-test ~]$ ./certbot-auto certonly -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

Requesting to rerun ./certbot-auto with root privileges...

./certbot-auto has insecure permissions!

To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/

Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）

Plugins selected: Authenticator manual, Installer None

Obtaining a new certificate

Performing the following challenges:

dns-01 challenge for fisher.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

NOTE: The IP of this machine will be publicly logged as having requested this

certificate. If you're running certbot in manual mode on a machine that is not

your server, please ensure you're okay with that.

Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please deploy a DNS TXT record under the name

_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）

MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88

Before continuing, verify the record is deployed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）

/etc/letsencrypt/live/fisher.cn/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/fisher.cn/privkey.pem

Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）

version of this certificate in the future, simply run certbot-auto

again. To non-interactively renew *all* of your certificates, run

"certbot-auto renew"

- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

那么证书如何将http通信升级为https，不同的后端有不同的代码实现方式。但就目前主流做法，大家倾向于让https通信脱离开发范畴，直接配置在httpd中，比如nginx config（或者apache之类均可）：

完整阅读本篇»

回退http被Chrome拒绝了？

2020-03-16 作者： Fisherworks

长话短说，今天想试图把wordpress用certbot-nginx直接升到https。

开始一切顺利，站点前台展示基本正常，Chrome继续说“不安全”，理由是图片资源没有走https。登后台发现编辑器无法加载文章，vm上php-fpm的cpu占用时而飙高。

就我这脾气来说，如果是工作项目，一则是测试环境上起码测过一轮再上生产，二则遇山开路逢水搭桥，毕竟靠逻辑吃饭的人。但就这么一块自留地而言，纯赔钱的货，投恁多精力不值当。何况wordpress这种退休返聘的blog engine，再撑几年还得看心情。于是把准备好的vm snapshot做回滚（QA习惯），零风险，服务起来后一切如初（443端口不监听不服务）。

这时候Chrome开始扯淡了，坚持访问443，地址栏强输http就不给过。Safari则没这么轴，指哪打哪。找台别的机器Chrome也没这毛病，所以确定是Chrome本地留了记录，对本站域名（fisherworks.cn）坚持不走80端口。

于是开始找解决方案，什么“https 重定向 http”，结果你们懂的，都是反的，所有博文都是http request强制301到https嘛，这才是大势所趋，何况教程文向来天下一抄。

怎么说呢，尽管是中国人讲普通话，但效率起见，技术搜索用英语搜，通常省钱省时间——关键字“force chrome to open http instead of https”，有效的返回只要一条就够。搜索结果就不截了，点进这个链接，看了顶赞答案621 upvote，心放下一半。

How to stop an automatic redirect from “http://” to “https://” in Chrome

做法很简单，打开 chrome://net-internals/#hsts 找到最底部 Delete domain security policies，输入需要回退http访问的域名，提交一下；出门清理cookie和cache，搞定收工。

对浏览器行家而言，可能分分钟。对我来说，一文钱难倒英雄汉。

这么说吧，stackoverflow，stackexchange，superuser，askubuntu，不要指望这些专业问答站给你任何架构意识，或从零开始搭建服务or提升能力的建议。但术业有专攻，解决这种掐脖子的一文钱问题，可谓无出其右，外科手术式精准打击。

完整阅读本篇»

微信oAuth错误码10003最速解法

2018-04-06 作者： Fisherworks

服务号code两年没更新，最近花时间做了彻底重构，说白了差不多重新开发

填坑无数，信心上线后，点公号菜单跳页面时，遇到如下问题

redirect_uri域名与后台配置不一致，错误码:10003

OK，梳理一下，我的后台配置成啥了？（more）

完整阅读本篇»

innobackupex吃光root分区

从lxd迁移到incus

Acme.sh全自动获取SSL通配符证书

CentOS7免费SSL证书及自动展期

证书自动获取

回退http被Chrome拒绝了？

微信oAuth错误码10003最速解法

关于Fisherworks

最近文章

功能

本站友链

实时天气

2024年十一月
一	二	三	四	五	六	日
« 10月
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30