Ein Verne修改

git clone https://github.com/jugeekuz/HomeShare.git
cd HomeShare

docker compose up -d --build

helm repo add longhorn https://charts.longhorn.io
helm repo update
ubectl create namespace longhorn-system
helm upgrade -i longhorn longhorn/longhorn --namespace longhorn-system

kubectl -n longhorn-system get pod
kubectl get storageclass

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true

apiVersion: v1
kind: Namespace
metadata:
  name: vaultwarden
---
apiVersion: v1
kind: Secret
metadata:
  name: vaultwarden-secrets
  namespace: vaultwarden
stringData: # 使用 stringData 更易读，Kubernetes 会自动 base64 编码
  ADMIN_TOKEN: ""  # 替换为你生成的 Admin Token openssl
  SMTP_HOST: "smtp.gmail.com"             # 替换为你的 SMTP 服务器地址
  SMTP_FROM: "@gmail.com" # 替换为发件人邮箱
  SMTP_PORT: "587"                        # 替换为 SMTP 端口 (e.g., 587 for TLS)
  SMTP_SSL: "true"                        # 或 "false", 根据你的 SMTP 服务器设置 TLS/SSL
  SMTP_USERNAME: ""     # 替换为 SMTP 用户名
  SMTP_PASSWORD: ""     # 替换为 SMTP 密码
  # 注意：DOMAIN, WEBSOCKET_ENABLED, SIGNUPS_ALLOWED 将直接在 Deployment 中设置，因为它们不敏感或依赖于部署本身
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: vaultwarden-data
  namespace: vaultwarden # 假设部署在 vaultwarden 命名空间
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: 512Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vaultwarden
  namespace: vaultwarden
  labels:
    app: vaultwarden
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vaultwarden
  template:
    metadata:
      labels:
        app: vaultwarden
    spec:
      containers:
      - name: vaultwarden
        image: vaultwarden/server:1.32.7 # 使用官方镜像
        ports:
        - name: http
          containerPort: 80
        - name: websocket
          containerPort: 3012
        env:
        - name: DOMAIN # 可选，配置域名
          value: "https://bitwarden.einverne.info"
        - name: WEBSOCKET_ENABLED
          value: "true"
        - name: SIGNUPS_ALLOWED
          value: "false"
        envFrom: # 从 Secret 加载敏感环境变量
        - secretRef:
            name: vaultwarden-secrets
        volumeMounts:
        - name: data
          mountPath: /data # 挂载持久化存储
        - name: localtime
          mountPath: /etc/localtime
          readOnly: true # 挂载宿主机时区文件
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: vaultwarden-data # 引用之前创建的 PVC
      - name: localtime # 定义宿主机路径卷
        hostPath:
          path: /etc/localtime
          type: File # 确保挂载的是文件
---
apiVersion: v1
kind: Service
metadata:
  name: vaultwarden-service
  namespace: vaultwarden
spec:
  selector:
    app: vaultwarden
  ports:
  - name: http # 命名端口以便 IngressRoute 引用
    protocol: TCP
    port: 80
    targetPort: http # 对应 Deployment 中的 containerPort name: http
  - name: websocket # 暴露 websocket 端口
    protocol: TCP
    port: 3012
    targetPort: websocket # 对应 Deployment 中的 containerPort name: websocket
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: vaultwarden-certificate
  namespace: vaultwarden
spec:
  secretName: vaultwarden-tls-secret # K8s Secret 名称，用于存储证书
  dnsNames:
  - bitwarden.einverne.info # 需要签发证书的域名
  issuerRef:
    name: letsencrypt-prod # 引用之前创建的 ClusterIssuer
    kind: ClusterIssuer
---
apiVersion: traefik.io/v1alpha1 # 使用 Traefik CRD
kind: IngressRoute
metadata:
  name: vaultwarden-ingressroute
  namespace: vaultwarden
spec:
  entryPoints:
    - websecure # 指定入口点，通常是 443/HTTPS
  routes:
  - match: Host(`bitwarden.einverne.info`) && PathPrefix(`/`) # 匹配域名
    kind: Rule
    services:
    - name: vaultwarden-service # 指向 Vaultwarden Service
      port: http
    # Websocket 流量路由规则
  - match: Host(`bitwarden.einverne.info`) && PathPrefix(`/notifications/hub`)
    kind: Rule
    services:
    - name: vaultwarden-service # 指向 Vaultwarden Service
      port: websocket # 指向 Service 的 websocket 端口 (3012)
  tls:
    secretName: vaultwarden-tls-secret # 引用包含证书的 Secret

kubectl apply -f vaultwarden-deployment.yaml

kubectl get pods -n vaultwarden -w

kubectl get pods,svc,certificate,ingressroute -n vaultwarden

kubectl scale deployment vaultwarden --replicas=0 -n vaultwarden

kubectl get pods -n vaultwarden

apiVersion: v1
kind: Pod
metadata:
  name: restore-helper
  namespace: vaultwarden
spec:
  volumes:
    - name: vaultwarden-storage
      persistentVolumeClaim:
        claimName: vaultwarden-data # 确保这个名称与你的 PVC 名称一致
  containers:
    - name: helper
      image: busybox:latest # 使用一个包含基本工具的轻量级镜像
      command: ["/bin/sh", "-c", "sleep 3600"] # 让 Pod 持续运行一段时间
      volumeMounts:
        - name: vaultwarden-storage
          mountPath: /restore-data # 将 PVC 挂载到 Pod 内的 /restore-data 目录
  # 可选：如果 Vaultwarden 需要特定用户 ID 运行，可以在这里设置 securityContext
  # securityContext:
  #   runAsUser: 1000 # 示例 User ID，根据 Vaultwarden 容器实际情况调整
  #   runAsGroup: 1000 # 示例 Group ID
  #   fsGroup: 1000 # 确保挂载卷的文件系统组权限正确

kubectl apply -f restore-helper-pod.yaml -n vaultwarden

kubectl get pods -n vaultwarden

sudo tar czvf - /home/einverne/bitwarden | ssh [email protected] "cat > /home/einverne/bitwarden-2025.tgz"

# 首先检查一下当前数据
kubectl exec -n vaultwarden restore-helper -- ls -al /restore-data/

# 清空目标目录
kubectl exec -n vaultwarden restore-helper -- rm -rf /restore-data/*

# 复制本地数据到 Pod 内的卷挂载点
# 注意：源路径末尾的 "." 表示复制目录内容，而不是目录本身
kubectl cp ~/bitwarden/bw-data/. restore-helper:/restore-data/ -n vaultwarden

kubectl exec -n vaultwarden restore-helper -- rm -f /restore-data/rsa_key.pem /restore-data/rsa_key.pub.pem

kubectl delete pod restore-helper -n vaultwarden

kubectl scale deployment vaultwarden --replicas=1 -n vaultwarden

kubectl get pods -n vaultwarden -w
kubectl logs -n vaultwarden -l app=vaultwarden -f # 检查日志是否有错误

# 获取 secret
kubectl get secret vaultwarden-secrets -n vaultwarden -o yaml

# 手动重启
kubectl rollout restart deployment vaultwarden -n vaultwarden

kubectl label nodes <node-name> <label-key>=<label-value>
kubectl label nodes <node-name> <label-key>=<label-value> <label2>=<value2>

kubectl label nodes k3s-node-1 location=jp

kubectl get nodes --show-labels

k3s agent --node-label location=jp

apiVersion: v1
kind: Pod
metadata:
  name: nginx-jp
spec:
  containers:
  - name: nginx
    image: nginx
  nodeSelector:
    location: jp

apiVersion: v1
kind: Pod
metadata:
  name: nginx-jp
spec:
  containers:
  - name: nginx
    image: nginx
  nodeSelector:
    location: jp
    label2: value2

apiVersion: v1
kind: Pod
metadata:
  name: nginx-jp
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: location
            operator: In
            values:
            - jp
  containers:
  - name: nginx
    image: nginx

apiVersion: v1
kind: Pod
metadata:
  name: nginx-jp-preferred
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: location
            operator: In
            values:
            - jp
  containers:
  - name: nginx
    image: nginx

kubectl label nodes <node-name> <label-key>-

kubectl label nodes k3s-node-1 location-

kubectl label nodes <ndoe-name> <label-key>=<label-value> --overwrite

kubectl label nodes k3s-node-1 location=other --overwrite

#基础部分
#设置一个你自己的访问密码
PASSWORD=123
#配置时区
TZ=Asia/Shanghai

#ai studio部分

#将key1,key2,key3等替换为你真正拥有的gemini api key
GEMINI_API_KEYS=key1,key2,key3

#每分钟最大请求数
MAX_REQUESTS_PER_MINUTE=30

#每天每个 IP 最大请求数
MAX_REQUESTS_PER_DAY_PER_IP=600

#是否启用假流式传输
FAKE_STREAMING=true

#单api 24小时最大使用次数
API_KEY_DAILY_LIMIT=100

#空响应重试次数
MAX_EMPTY_RESPONSES=5

#是否启用伪装信息
RANDOM_STRING=true

#伪装信息长度
RANDOM_STRING_LENGTH=5

#默认的并发请求数
CONCURRENT_REQUESTS=1

#当请求失败时增加的并发请求数
INCREASE_CONCURRENT_ON_FAILURE=0

允许的最大并发请求数
MAX_CONCURRENT_REQUESTS=3

#是否启用联网模式(联网模式有严格的审核)
SEARCH_MODE=false

#联网模式提示词(用英文单引号包裹提示词)
SEARCH_PROMPT='（使用搜索工具联网搜索，需要在content中结合搜索内容）'

#vertex部分（如果您不需要vertex或不知道vertex是什么，无需配置这些内容）

#是否启用vertex
ENABLE_VERTEX=false

#vertex ai 凭证
GOOGLE_CREDENTIALS_JSON=''

helm repo add jeffresc https://charts.jeffresc.dev
helm repo update
helm install it-tools jeffresc/it-tools

helm install it-tools jeffresc/it-tools -n it-tools

helm uninstall it-tools -n it-tools

export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=it-tools,app.kubernetes.io/instance=it-tools" -o jsonpath="{.items[0].metadata.name}")
  export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT

kubectl --namespace it-tools port-forward $POD_NAME 8080:$CONTAINER_PORT --address 0.0.0.0

❯ cat it-tools-service.yml
apiVersion: v1
kind: Service
metadata:
  name: it-tools-nodeport
  namespace: default
spec:
  type: NodePort
  selector:
    app.kubernetes.io/name: it-tools
    app.kubernetes.io/instance: it-tools
  ports:
  - port: 8080
    targetPort: 8080
    nodePort: 30080  # 可选，不指定会随机分配30000-32767之间的端口

❯ cat it-tools-ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: it-tools-ingress
  namespace: default
  annotations:
    # 可选：添加Traefik特定的注解
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
  - host: tools.einverne.info
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: it-tools
            port:
              number: 8080
  tls:
  - hosts:
    - it-tools.einverne.info
    secretName: it-tools-tls-secret

kubectl get certificates -n default