Dejavu Moe修改

36nc176411667619
36nc176411667618
36nc176411667617
36nc176411667616
36nc176411667615
36nc176411667614
36nc176411667613
36nc176411667612
36nc176411667611
36nc176411667610

36nc17641166769
36nc17641166768
36nc17641166767
36nc17641166766
36nc17641166765
36nc17641166764
36nc17641166763
36nc17641166762
36nc17641166761
36nc17641166760

curl -fLO https://raw.githubusercontent.com/bohanyang/debi/master/debi.sh

chmod +x debi.sh

sudo ./debi.sh \
  --version 13 \
  --architecture arm64 \
  --cloudflare \
  --user viamoe \
  --authorized-keys-url https://github.com/githubUserName.keys \
  --ssh-port 22122 \
  --bbr

sudo reboot

sudo apt update
sudo apt install \
    ca-certificates \
    apt-transport-https \
    man \
    build-essential \
    git \
    curl \
    wget \
    screen \
    btop \
    net-tools \
    tree \
    neovim

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl status docker

# install the prerequisites
sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring

# import gpg key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
    
# verify gpg key
mkdir -m 700 ~/.gnupg
gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

# install nginx
sudo apt update
sudo apt install nginx

# start nginx
sudo systemctl start nginx

sudo nvim /etc/ssh/sshd_config

sudo systemctl restart sshd

sudo apt update
sudo apt install fail2ban

sudo nvim /etc/fail2ban/jail.local

[DEFAULT]
# 忽略 IP 地址：防止将自己封禁。
# 如果您使用动态 IP，不要设置您的公网 IP。
# 127.0.0.1/8 和 ::1 忽略本地回环地址。
ignoreip = 127.0.0.1/8 ::1

# 封禁时间：封禁 1 小时（3600 秒）
bantime  = 1h

# 查找时间：在 10 分钟内（600 秒）
findtime = 10m

# 最大重试次数：如果在 findtime (10 分钟) 内失败了 3 次，则封禁。
maxretry = 3

[sshd]
# 启用 SSH 保护
enabled = true

# SSH 服务的监听端口：确保这里设置为您的自定义端口 22122
port    = 22122

# 日志文件路径：Debian/Ubuntu/CentOS 通常使用 auth.log，默认配置会自动检测。
# logpath = /var/log/auth.log 
# filter：使用默认的 sshd 过滤器（无需修改）
# filter = sshd

sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

sudo fail2ban-client status sshd
sudo fail2ban-client status

sudo apt install ufw

sudo ufw default deny incoming

sudo ufw default allow outgoing

sudo sed -i 's/IPV6=no/IPV6=yes/' /etc/default/ufw

# 替换为实际 SSH 端口
sudo ufw allow 22122/tcp

sudo nvim /usr/local/bin/ufw-cf-whitelist

#!/bin/bash

# Cloudflare 官方 IP 列表
IPV4_URL="https://www.cloudflare.com/ips-v4"
IPV6_URL="https://www.cloudflare.com/ips-v6"

echo "=== 1. 清除现有的 Cloudflare UFW 规则..."
# 清除旧的规则（通过删除带有 "Cloudflare" 注释的规则）
# 注意：UFW 不直接支持注释删除，所以这个步骤需要手动或使用更复杂的工具，
# 这里我们采用简单的清理，如果规则不多，可以手动检查 `ufw status numbered`。
# 更好的方法是在每次运行前删除所有 80/443 的 ALLOW 规则，但风险更高。

# 暂时只删除明确的 Cloudflare 规则，以防万一
# sudo ufw delete allow in on any to any port 80/tcp
# sudo ufw delete allow in on any to any port 443/tcp


echo "=== 2. 下载最新的 Cloudflare IP 范围列表..."
# 使用 tempfile 确保下载的文件安全
IPV4_TEMP=$(mktemp)
IPV6_TEMP=$(mktemp)

curl -s $IPV4_URL -o $IPV4_TEMP
curl -s $IPV6_URL -o $IPV6_TEMP

echo "=== 3. 添加 IPv4 规则 (80/443)..."
while read ip; do
    if [[ ! -z "$ip" ]]; then
        sudo ufw allow proto tcp from $ip to any port 80 comment 'Cloudflare IPv4 HTTP'
        sudo ufw allow proto tcp from $ip to any port 443 comment 'Cloudflare IPv4 HTTPS'
    fi
done < $IPV4_TEMP

echo "=== 4. 添加 IPv6 规则 (80/443)..."
while read ip; do
    if [[ ! -z "$ip" ]]; then
        sudo ufw allow proto tcp from $ip to any port 80 comment 'Cloudflare IPv6 HTTP'
        sudo ufw allow proto tcp from $ip to any port 443 comment 'Cloudflare IPv6 HTTPS'
    fi
done < $IPV6_TEMP

echo "=== 5. 清理临时文件..."
rm $IPV4_TEMP $IPV6_TEMP

echo "=== 6. 完成 Cloudflare 白名单配置。"
ufw status numbered

sudo chmod +x /usr/local/bin/ufw-cf-whitelist

sudo ufw-cf-whitelist

sudo ufw enable
sudo ufw reload

Command may disrupt existing ssh connections. Proceed with operation (y|n)?

sudo ufw status numbered

sudo crontab -e

0 3 * * * /usr/local/bin/ufw-cf-whitelist.sh > /dev/null 2>&1

#!/usr/bin/env bash
# ===============================================================
# check-docker-ports.sh
# 检查 Docker 容器端口暴露与 UFW 状态
# ===============================================================

RED="\033[0;31m"
GREEN="\033[0;32m"
YELLOW="\033[1;33m"
RESET="\033[0m"

echo "🔍 正在检查 Docker 端口暴露情况..."
echo "=============================================================="

# 获取 docker ps 输出
docker_ps=$(docker ps --format '{{.Names}}|{{.Ports}}')

if [ -z "$docker_ps" ]; then
  echo "❌ 没有正在运行的容器。"
  exit 0
fi

printf "%-25s %-25s %-20s\n" "容器名" "绑定地址" "状态"
echo "--------------------------------------------------------------"

while IFS='|' read -r name ports; do
  if [[ -z "$ports" ]]; then
    printf "%-25s %-25s ${GREEN}%-20s${RESET}\n" "$name" "无对外端口" "安全"
    continue
  fi

  # 分析每个映射
  for port in $(echo "$ports" | tr ',' '\n'); do
    port=$(echo "$port" | sed 's/ //g')

    if [[ "$port" =~ 0\.0\.0\.0 ]]; then
      printf "%-25s %-25s ${RED}%-20s${RESET}\n" "$name" "$port" "⚠️ 公网暴露"
    elif [[ "$port" =~ 127\.0\.0\.1 ]]; then
      printf "%-25s %-25s ${GREEN}%-20s${RESET}\n" "$name" "$port" "本机安全"
    else
      printf "%-25s %-25s ${YELLOW}%-20s${RESET}\n" "$name" "$port" "内部网络"
    fi
  done
done <<< "$docker_ps"

echo "--------------------------------------------------------------"
echo "🧱 检查宿主机端口监听状态..."
ss -tlnp | grep -E 'docker|LISTEN' | awk '{print $4, $6}' | sed 's/users://g' | sed 's/"//g' | sed 's/,//g' | sed 's/\[::\]://g'
echo "--------------------------------------------------------------"

echo "🧩 检查 UFW 规则..."
sudo ufw status numbered

echo "=============================================================="
echo "✅ 检查完成。绿色=安全，黄色=内部安全，红色=公网暴露。"

mkdir -p ~/container/cloudreve && cd $_

services:
  pro:
    image: cloudreve.azurecr.io/cloudreve/pro:latest
    container_name: cloudreve-pro-backend
    depends_on:
      - postgresql
      - redis
    restart: unless-stopped
    ports:
      - "127.0.0.1:5212:5212"
      # for magnet/bt download
      #- "6888:6888"
      #- "6888:6888/udp"
    environment:
      - CR_CONF_Database.Type=postgres
      - CR_CONF_Database.Host=postgresql
      - CR_CONF_Database.User=cloudreve
      - CR_CONF_Database.Name=cloudreve
      - CR_CONF_Database.Port=5432
      - CR_CONF_Redis.Server=redis:6379
      - CR_LICENSE_KEY=${CR_LICENSE_KEY}
    volumes:
      - ./data:/cloudreve/data

  postgresql:
    image: postgres:17
    container_name: cloudreve-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=cloudreve
      - POSTGRES_DB=cloudreve
      - POSTGRES_HOST_AUTH_METHOD=trust
    volumes:
      - ./db:/var/lib/postgresql/data
      - /etc/localtime:/etc/localtime:ro

  redis:
    image: redis:latest
    container_name: cloudreve-redis
    restart: unless-stopped
    volumes:
      - ./redis:/data

sudo docker login -u <用户名> -p <密码> cloudreve.azurecr.io

sudo docker compose pull

export CR_LICENSE_KEY=你的授权密钥

sudo -E docker compose up -d

sudo docker compose logs -f

server {
    listen 80;
    listen [::]:80;
    # change it to your domain
    server_name pan.via.moe;
    # force https
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    # change it to your domain
    server_name pan.via.moe;

    # logs
    access_log /var/log/nginx/cloudreve.access.log;
    error_log /var/log/nginx/cloudreve.error.log;

    # Cloudflare Origin CA
    ssl_certificate /etc/nginx/cert/wild.via.moe.pem;
    ssl_certificate_key /etc/nginx/cert/wild.via.moe.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # for Cloudflare SSL ciphers
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
 
    # upload limit 10GB
    client_max_body_size 10G; 
  
    # nerver cache rules
    location ~* ^/(sw\.js|index\.html|manifest\.json)$ {
        proxy_pass http://127.0.0.1:5212;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        
        # cloudflare real ip
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # no cache
        add_header Cache-Control "no-cache, no-store, must-revalidate, max-age=0";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    location / {
        proxy_pass http://127.0.0.1:5212;
        proxy_redirect off;
        
        # Header
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        
        # cloudflare real ip
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # WebSocket 
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo nginx -s reload

  ports:
    - "127.0.0.1:5212:5212"
    # uncomment below for magnet/bt download
    - "6888:6888"
    - "6888:6888/udp"

APN: giffgaff.com
Username: 留空/不填
Password: 留空/不填
Server: http://mmsc.mediamessaging.co.uk:8002
MMSC: http://mmsc.mediamessaging.co.uk:8002
Proxy: 留空/不填
MMS proxy: 留空/不填
MMS port: 留空/不填
MCC: 234
MNC: 10
Authentication type: 留空/不填
APN Type: mms

# n8n data dir
cd ~/container/n8n

mkdir -p n8n_data postgres_data
# node user
sudo chown -R 1000:1000 ./n8n_data

# postgres user
sudo chown -R 999:999 ./postgres_data

chmod -R 700 ./postgres_data
chmod -R 755 ./n8n_data

services:
  postgres:
    image: postgres:17.6-alpine
    container_name: n8n-postgres
    restart: unless-stopped
    user: "999:999"
    environment:
      POSTGRES_USER: n8n  # 数据库用户名
      POSTGRES_PASSWORD: n8npass  # 数据库密码
      POSTGRES_DB: n8n  # 数据库名称
      LANG: en_US.UTF-8
      LC_ALL: en_US.UTF-8
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n -d n8n || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    user: "1000:1000"
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n  # 数据库名称
      - DB_POSTGRESDB_USER=n8n  # 数据库用户名
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
      - N8N_RUNNERS_ENABLED=true
      - N8N_HOST=n8n.dejavu.moe
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.dejavu.moe/  # 替换你的域名
      - N8N_EDITOR_BASE_URL=https://n8n.dejavu.moe/  # 替换你的域名
      - N8N_PROXY_HOPS=1
      - GENERIC_TIMEZONE=Asia/Shanghai
      - TZ=Asia/Shanghai
    ports:
      - "127.0.0.1:5678:5678"
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./n8n_data:/home/node/.n8n

sudo docker compose up -d

server {
    listen 80;
    listen [::]:80;
    server_name n8n.dejavu.moe;  # 替换你的域名

    # HTTP to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name n8n.dejavu.moe;  # 替换你的域名

    ssl_certificate /etc/nginx/cert/wild.dejavu.moe.pem;  # SSL
    ssl_certificate_key /etc/nginx/cert/wild.dejavu.moe.key;  # SSL

    # Cloudflare Origin SSL cipher suites
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve X25519:P-256:P-384;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256:ECDHE+3DES:RSA+3DES;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # logs
    access_log /var/log/nginx/n8n.dejavu.moe.access.log;
    error_log /var/log/nginx/n8n.dejavu.moe.error.log;
    location / {
        proxy_pass http://127.0.0.1:15678;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_buffering off;
        chunked_transfer_encoding off;
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
    }

    location ~ ^/(webhook|webhook-test)/ {
        proxy_pass http://127.0.0.1:15678;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

services:
  ollama:
    container_name: ollama
    image: ollama/ollama:latest
    restart: unless-stopped
    environment:
      - OLLAMA_HOST=0.0.0.0
      - OLLAMA_KEEP_ALIVE=1h
    volumes:
      - ./ollama:/root/.ollama

  postgres:
    image: postgres:17.6-alpine
    container_name: n8n-postgres
    restart: unless-stopped
    user: "999:999"
    environment:
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: n8npassword
      POSTGRES_DB: n8n
      LANG: en_US.UTF-8
      LC_ALL: en_US.UTF-8
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n -d n8n || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    user: "1000:1000"
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
      - N8N_RUNNERS_ENABLED=true
      - N8N_HOST=n8n.dejavu.moe
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.dejavu.moe/
      - N8N_EDITOR_BASE_URL=https://n8n.dejavu.moe/
      - N8N_PROXY_HOPS=1
      - GENERIC_TIMEZONE=Asia/Shanghai
      - TZ=Asia/Shanghai
    ports:
      - "127.0.0.1:15678:5678"
    extra_hosts:  # <添加这个>
      - "host.docker.internal:host-gateway"  # <以及这个>
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./n8n_data:/home/node/.n8n

sudo docker compose up -d

sudo docker exec -it ollama bash

ollama pull llama3.1:8b

sudo docker compose down && sudo docker compose up -d