RK3566流畅运行X64 win应用？

2024-04-05 作者： Fisherworks

Well, Windows x64 binaries now mostly seem to be working well on Wine (x64, Dynarec for ARM64) on Incus/LXC containers on Armbian aarch64 on an ARM SBC like RasPi or its counterparts with Rockchip RK3xxx series processors.

Btw, let’s celebrate the 1st LTS release of Incus, version 6.0.

在Linux平台使用wine运行win32程序？

Wine项目距今30多年历史了，完全不稀奇。

如果是跑在Linux arm64/aarch64上呢？

也还好……纯软件转译x86指令集，应该跑的像幻灯片吧？之前你不是KVM装过一次Win7 x64，玩成了行为艺术咩？

如果是一张价钱不足100块的RK3566 sbc，先跑Armbian，其上跑incus（lxc）容器，再跑Wine x64，最后运行Win64程序，然后我说除了启动慢点儿（毕竟emmc就那点io），运行还蛮流畅，您怎么想？

完整阅读本篇»

RK3566之armvirt转发能力

2024-03-02 作者： Fisherworks

一言以蔽之，同用双核，略逊Pi 4B，明显不如RK3399。虽然制程和频率双双强过BCM2711（Pi 4B），但A55相比A72应该还是有明显差距的…吧，当然发行版对比也略有差异（尽管都基于debian），无法精确对比哈。

至于想劝俺上什么iStoreOS就算了，原因在之前提过，尽管估计物理跑NAT（开启软件流量分载）大概率能接近跑满千兆转发，但选型喜好是很个人的事情，总觉得所谓all-in-one在架构上反过来（upside down）不好玩。

数据上，iperf3上行700左右，下行850，看起来即使另外两核跑个容器带点儿负载，保障个500Mbps宽带应该没啥鸭梨。

完整阅读本篇»

nginx控制iptables芝麻开门

2022-02-10 作者： Fisherworks

During maintenance of a production server, we use to encounter a problem like this – an internet-access-blocked port, say 3306 (mysql), is about to be open for a little while due to debugging needs, which is not uncommon, right? So how to make this easily operated, mostly secure, and automatically disabled after working – I guess this’s gonna help somehow.

A Linux server with whatever the distribution including iptables (e.g. CentOS, Rocky for now as example), Nginx, fcgiwrap, a simple shell script and a commonly used web browser, let’s say chrome, will be major ingredients on the recipe.

常做运维，总会遇到某些线上服务器，为了便于调试，在符合安全要求的基础上，需要相对便利的对公网短时定向开放某些端口。

昨天想了一招，用nginx操作shell脚本，对特定公网IP开口子，叫一声“芝麻开门”，便捷又安全。举例端口3306（mysql），系统是Rocky Linux 8（原CentOS 8）。

Doors of Durin

先查一下现有的防火墙规则，需要的话可以保存一下。换句话说，搞芝麻开门之前，先确定门是隐藏的；也即已经有相应（且持久化）的iptables rule确保到被保护端口的连接是DROP/REJECT状态。

[root@localhost ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
48772 9041K ACCEPT     tcp  --  *      *       10.0.0.0/8           0.0.0.0/0            tcp
    6   376 DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3306

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

1

2

3

4

5

6

7

8

9

10

11

[root@localhost ~]# iptables -nvL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

48772 9041K ACCEPT tcp -- * * 10.0.0.0/8 0.0.0.0/0 tcp

6 376 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

然后就是fcgiwrap的安装，此处就不写nginx安装过程了，默认安装即可。

安装后增加两个systemd服务文件，并测试fcgiwrap服务生效。

【注】那俩服务文件，在Redhat之外的发行版上，fcgiwrap安装包可能自带，请针对所用版本自行检查。

[root@localhost ~]# dnf install fcgiwrap
上次元数据过期检查：2:45:15 前，执行于 2022年02月09日 星期三 20时00分42秒。
依赖关系解决。
（……部分省略）

已安装:
  fcgi-2.4.0-36.el8.x86_64           fcgiwrap-1.1.0-12.20181108git99c942c.el8.x86_64

完毕！

[root@localhost ~]#
[root@localhost ~]# cat /usr/lib/systemd/system/fcgiwrap.service
[Unit]
Description=Simple CGI Server
After=nss-user-lookup.target
Requires=fcgiwrap.socket

[Service]
EnvironmentFile=/etc/sysconfig/fcgiwrap
ExecStart=/usr/sbin/fcgiwrap ${DAEMON_OPTS} -c ${DAEMON_PROCS}
User=nginx
Group=nginx

[Install]
Also=fcgiwrap.socket
[root@localhost ~]# cat /usr/lib/systemd/system/fcgiwrap.socket
[Unit]
Description=fcgiwrap Socket

[Socket]
ListenStream=/run/fcgiwrap.socket

[Install]
WantedBy=sockets.target

[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl enable fcgiwrap.service —now
Created symlink /etc/systemd/system/sockets.target.wants/fcgiwrap.socket → /usr/lib/systemd/system/fcgiwrap.socket.
[root@localhost ~]# systemctl status fcgiwrap.service
● fcgiwrap.service - Simple CGI Server
   Loaded: loaded (/usr/lib/systemd/system/fcgiwrap.service; indirect; vendor preset: disable>
   Active: active (running) since Wed 2022-02-09 22:54:17 CST; 4s ago
 Main PID: 814486 (fcgiwrap)
    Tasks: 1 (limit: 23712)
   Memory: 492.0K
   CGroup: /system.slice/fcgiwrap.service
           └─814486 /usr/sbin/fcgiwrap -f -c 1

2月 09 22:54:17 localhost.localdomain systemd[1]: Started Simple CGI Server.
[root@localhost ~]#

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

[root@localhost ~]# dnf install fcgiwrap

上次元数据过期检查：2:45:15 前，执行于 2022年02月09日星期三 20时00分42秒。

依赖关系解决。

（……部分省略）

已安装:

fcgi-2.4.0-36.el8.x86_64 fcgiwrap-1.1.0-12.20181108git99c942c.el8.x86_64

完毕！

[root@localhost ~]#

[root@localhost ~]# cat /usr/lib/systemd/system/fcgiwrap.service

[Unit]

Description=Simple CGI Server

After=nss-user-lookup.target

Requires=fcgiwrap.socket

[Service]

EnvironmentFile=/etc/sysconfig/fcgiwrap

ExecStart=/usr/sbin/fcgiwrap ${DAEMON_OPTS} -c ${DAEMON_PROCS}

User=nginx

Group=nginx

[Install]

Also=fcgiwrap.socket

[root@localhost ~]# cat /usr/lib/systemd/system/fcgiwrap.socket

[Unit]

Description=fcgiwrap Socket

[Socket]

ListenStream=/run/fcgiwrap.socket

[Install]

WantedBy=sockets.target

[root@localhost ~]# systemctl daemon-reload

[root@localhost ~]# systemctl enable fcgiwrap.service —now

Created symlink /etc/systemd/system/sockets.target.wants/fcgiwrap.socket → /usr/lib/systemd/system/fcgiwrap.socket.

[root@localhost ~]# systemctl status fcgiwrap.service

● fcgiwrap.service - Simple CGI Server

Loaded: loaded (/usr/lib/systemd/system/fcgiwrap.service; indirect; vendor preset: disable>

Active: active (running) since Wed 2022-02-09 22:54:17 CST; 4s ago

Main PID: 814486 (fcgiwrap)

Tasks: 1 (limit: 23712)

Memory: 492.0K

CGroup: /system.slice/fcgiwrap.service

└─814486 /usr/sbin/fcgiwrap -f -c 1

2月 09 22:54:17 localhost.localdomain systemd[1]: Started Simple CGI Server.

[root@localhost ~]#

接下来为一个新的nginx server准备个根目录，存放网页和之后控制iptables的脚本。

完整阅读本篇»

OpenWrt测试双WAN和双机高可用

2021-12-03 作者： Fisherworks

So here’s a quick example. OpenWrt shows capability to provide business-level internet access reliabilities – with not only load balancing/failover between 2 or more ISPs, but also VRRP based hardware (dual x86 vm in this experiment) level redundancy.

从以下的例子可以看出，OpenWrt基本满足了提供小型商业级Internet访问可靠性的初步要求。它不仅可以在多个ISP之间实现负载均衡以及故障切换，在此基础上同时提供基于VRRP的硬件冗余（本实验中为双x86虚拟机）。

先开仨虚拟机，前两台做OpenWrt，可以先做1台，复制1台。注意要安装mwan3和keepalived。

双WAN做好后，断开一路wan做测试。这里的wanb，用的是楼道里的不可靠wifi，通过Raspberry Pi向下路由一层转成有线网，能体现出不稳定的ISP接入状态。

本来是两路负载均衡的策略，wanb断开后，5s之内可以让所有对外请求都稳定落在wan上。

下一步，把MASTER的br-lan断开，模拟一个路由器硬件直接宕掉。

这个切换时间很短，还没反应过来，BACKUP就接管了VIP地址，对外请求几乎不受什么影响。

完整阅读本篇»

Acme.sh全自动获取SSL通配符证书

2021-03-01 作者： Fisherworks

Here I’m gonna show you a quick how-to on obtaining a wildcard SSL cert from Let’s Encrypt with the “pure shell written” acme.sh, which is simple, light-weight and far beyond flexible.

And you may already aware that I’ve an earlier post on doing this with another tool called certbot-auto, well, unfortuantely it’s… kinda still working… but having no support or further update anymore. As for the “official successor” of the certbot-auto? It seems the official guys have decided to walk step and step closer into the mire, with that good-looking but evil-inside snapd… oh, don’t even say that word again. It’s weird enough – I saw nothing around Canonical brand on sponsors list from homepage of Let’s Encrypt. That’s another topic anyway, a wildcard SSL cert for free is still worth my sincere appreciation in this case.

今天简单聊下如何使用acme.sh来获取通配符证书，纯shell工具比之前聊过的certbot-auto更为简单、轻量且灵活。此外不幸的是，半年不见certbot已然走上邪路，奇怪的是Let’s Encrypt首页赞助商清单里并未发现Canonical在列，让我倍感意外。

废话少叙，先装为敬。

[root@aqui-test ~]# curl https://get.acme.sh | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   937    0   937    0     0    445      0 --:--:--  0:00:02 --:--:--   445
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  204k  100  204k    0     0  33335      0  0:00:06  0:00:06 --:--:-- 28373
[Sat Feb 27 23:14:42 CST 2021] Installing from online archive.
[Sat Feb 27 23:14:42 CST 2021] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz
[Sat Feb 27 23:15:47 CST 2021] Extracting master.tar.gz
[Sat Feb 27 23:15:47 CST 2021] It is recommended to install socat first.
[Sat Feb 27 23:15:47 CST 2021] We use socat for standalone server if you use standalone mode.
[Sat Feb 27 23:15:47 CST 2021] If you don't use standalone mode, just ignore this warning.
[Sat Feb 27 23:15:47 CST 2021] Installing to /root/.acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installed to /root/.acme.sh/acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.bashrc'
[Sat Feb 27 23:15:47 CST 2021] OK, Close and reopen your terminal to start using acme.sh
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.cshrc'
[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.tcshrc'
[Sat Feb 27 23:15:47 CST 2021] Installing cron job
[Sat Feb 27 23:15:48 CST 2021] Good, bash is found, so change the shebang to use bash as preferred.
[Sat Feb 27 23:15:49 CST 2021] OK
[Sat Feb 27 23:15:49 CST 2021] Install success!
[root@aqui-test ~]#

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

[root@aqui-test ~]# curl https://get.acme.sh | sh

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 937 0 937 0 0 445 0 --:--:-- 0:00:02 --:--:-- 445

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 204k 100 204k 0 0 33335 0 0:00:06 0:00:06 --:--:-- 28373

[Sat Feb 27 23:14:42 CST 2021] Installing from online archive.

[Sat Feb 27 23:14:42 CST 2021] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz

[Sat Feb 27 23:15:47 CST 2021] Extracting master.tar.gz

[Sat Feb 27 23:15:47 CST 2021] It is recommended to install socat first.

[Sat Feb 27 23:15:47 CST 2021] We use socat for standalone server if you use standalone mode.

[Sat Feb 27 23:15:47 CST 2021] If you don't use standalone mode, just ignore this warning.

[Sat Feb 27 23:15:47 CST 2021] Installing to /root/.acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installed to /root/.acme.sh/acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.bashrc'

[Sat Feb 27 23:15:47 CST 2021] OK, Close and reopen your terminal to start using acme.sh

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.cshrc'

[Sat Feb 27 23:15:47 CST 2021] Installing alias to '/root/.tcshrc'

[Sat Feb 27 23:15:47 CST 2021] Installing cron job

[Sat Feb 27 23:15:48 CST 2021] Good, bash is found, so change the shebang to use bash as preferred.

[Sat Feb 27 23:15:49 CST 2021] OK

[Sat Feb 27 23:15:49 CST 2021] Install success!

[root@aqui-test ~]#

安装过程中会自动创建cronjob，如果不想自动创建，安装时要加个参数，也可以手动把cronjob删掉（则证书不会自动展期）。

[root@aqui-test ~]# crontab -l
# m h  dom mon dow   command
47 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[root@aqui-test ~]#

1

2

3

4

[root@aqui-test ~]# crontab -l

# m h dom mon dow command

47 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

[root@aqui-test ~]#

此时把阿里云key和secret填入环境变量（建议使用RAM账户，风险最小化）。

[root@aqui-test ~]# export Ali_Key="L123456789q"
[root@aqui-test ~]# export Ali_Secret="j123456789l"

1 2	[root@aqui-test ~]# export Ali_Key="L123456789q" [root@aqui-test ~]# export Ali_Secret="j123456789l"

然后一句话申请wildcard（通配符）证书。

完整阅读本篇»

使用PBS备份PVE物理机特定路径

2020-10-13 作者： Fisherworks

This post shows you how to use PBS (Proxmox Backup Server) to backup a specific directory (or mount point) of a PVE (Proxmox Virtual Environment) server, which is NOT exactly same thing in my mind – to backup a physical PVE machine and restore to be another new one (with all my personal settings in) though, but still somehow interesting and worth a try.

本文简介如何使用PBS（Proxmox Backup Server）进行PVE物理机备份。

本以为，这功能可以把pve物理机clone一份然后秒恢复成一台新物理机（类似硬盘dd但更简单）。但实际并非如此，该功能是把特定路径（比如根目录）下的文件整体打包备份（不含已挂载别的分区的路径）；而恢复时也不是整分区恢复，而是按文件恢复，且文件已经存在时会报错。

虽然跟想的不太一样，至少这货有一点好处，简便易操作。相当于给PVE物理机磁盘打了个snapshot，而且PBS的管理界面可以把备份解开，只下载（恢复）其中某一个文件，有一定的实用价值。

现在看下备份过程，在PVE物理机上执行如下命令 –

root@pve-test-pbs:~# proxmox-backup-client backup 121-root.pxar:/ --repository 192.168.1.122:test-store-01
Starting backup: host/pve-test-pbs/2020-10-13T03:06:41Z
Client name: pve-test-pbs
Starting backup protocol: Tue Oct 13 11:06:41 2020
Upload directory '/' to '192.168.1.122:test-store-01' as 121-root.pxar.didx
121-root.pxar: had to upload 1.67 GiB of 1.87 GiB in 23.20s, average speed 73.54 MiB/s).
121-root.pxar: backup was done incrementally, reused 208.00 MiB (10.9%)
Uploaded backup catalog (1.00 MiB)
Duration: 23.28s
End Time: Tue Oct 13 11:07:04 2020

root@pve-test-pbs:~#

1

2

3

4

5

6

7

8

9

10

11

12

root@pve-test-pbs:~# proxmox-backup-client backup 121-root.pxar:/ --repository 192.168.1.122:test-store-01

Starting backup: host/pve-test-pbs/2020-10-13T03:06:41Z

Client name: pve-test-pbs

Starting backup protocol: Tue Oct 13 11:06:41 2020

Upload directory '/' to '192.168.1.122:test-store-01' as 121-root.pxar.didx

121-root.pxar: had to upload 1.67 GiB of 1.87 GiB in 23.20s, average speed 73.54 MiB/s).

121-root.pxar: backup was done incrementally, reused 208.00 MiB (10.9%)

Uploaded backup catalog (1.00 MiB)

Duration: 23.28s

End Time: Tue Oct 13 11:07:04 2020

root@pve-test-pbs:~#

其中 –

backup指备份操作。
121-root.pxar是备份到具体的文件名，而pxar是pbs使用的备份文件格式。上一篇PBS初体验中提到了PBS中特殊的存储方式，这里也不例外，121-root.pxar文件名在pbs中也只是个索引文件，具体数据存储也是打散在.chunks下的65536个子目录中。
:/ 指要备份root挂载点（之下比如/var挂载了别的分区，则不会被备份到）。
--repository 告诉备份命令，要备份到远端的PBS服务器。
192.168.1.122:test-store-01 给出PBS服务器的具体IP（端口默认8007）和存储池名字。

备份完成后，从PBS管理界面，可以看到备份信息。

更有意思的是，备份可以展开，甚至可以下载某一具体文件。

# root @ pbs-test in /mnt/datastore/test-store-01 [11:29:24]
$ ll
total 24K
drwxr-xr-x 4 backup backup 4.0K Oct 13 11:06 host
drwx------ 2 root   root    16K Oct 12 15:29 lost+found
drwxr-xr-x 3 backup backup 4.0K Oct 12 16:02 vm

# root @ pbs-test in /mnt/datastore/test-store-01 [11:29:36]
$ ll host/pve-test-pbs/2020-10-13T03:06:41Z
total 40K
-rw-r--r-- 1 backup backup  25K Oct 13 11:07 121-root.pxar.didx
-rw-r--r-- 1 backup backup 4.2K Oct 13 11:07 catalog.pcat1.didx
-rw-r--r-- 1 backup backup  399 Oct 13 11:07 index.json.blob

1

2

3

4

5

6

7

8

9

10

11

12

13

# root @ pbs-test in /mnt/datastore/test-store-01 [11:29:24]

$ ll

total 24K

drwxr-xr-x 4 backup backup 4.0K Oct 13 11:06 host

drwx------ 2 root root 16K Oct 12 15:29 lost+found

drwxr-xr-x 3 backup backup 4.0K Oct 12 16:02 vm

# root @ pbs-test in /mnt/datastore/test-store-01 [11:29:36]

$ ll host/pve-test-pbs/2020-10-13T03:06:41Z

total 40K

-rw-r--r-- 1 backup backup 25K Oct 13 11:07 121-root.pxar.didx

-rw-r--r-- 1 backup backup 4.2K Oct 13 11:07 catalog.pcat1.didx

-rw-r--r-- 1 backup backup 399 Oct 13 11:07 index.json.blob

那么如果从PVE上列出PBS的备份，从而检查内容和恢复呢？

完整阅读本篇»

RK3566流畅运行X64 win应用？

RK3566之armvirt转发能力

nginx控制iptables芝麻开门

OpenWrt测试双WAN和双机高可用

Acme.sh全自动获取SSL通配符证书

使用PBS备份PVE物理机特定路径

关于Fisherworks

最近文章

功能

本站友链

实时天气

2024年四月
一	二	三	四	五	六	日
« 3月
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30