Tools on Wanzi's Blog – Notes on life, tech, and DevOps.

In-depth Comparison of Enterprise Private Cloud Platforms: ZStack vs TStack

wzdushu@gmail.com (wanzi) — Sat, 14 Jun 2025 11:00:00 +0800

Comparison between ZStack and TStack (Tencent Cloud Private Cloud)

Due to the specific requirements of financial clients, a selection process for third-party private cloud platforms is necessary during private delivery. This comparison focuses primarily on ZStack and TStack:

In the private/hybrid cloud market, ZStack (Yunzhou Tech, backed by Alibaba Cloud) and TStack (Tencent Cloud’s proprietary full-stack cloud solution, now mostly integrated into the TCE/TCS ecosystem) represent two typical categories. The former is known for “productization, lightweight, independent vendor,” while the latter focuses on “full-stack capabilities, same source as public cloud, and big tech ecosystem.”

1. Core Positioning and Background

Dimension	ZStack (Yunzhou Tech)	TStack / TCE (Tencent Cloud)
Vendor Nature	Independent Software Vendor (ISV) focused on cloud platform software R&D with strong neutrality.	Cloud Service Provider (CSP) representing Tencent’s internal technology output, heavily dependent on the Tencent ecosystem.
Core Positioning	Productized Private Cloud / HCI Emphasizes “Simple, Scalable, Strong, Smart” (4S), positioning as a VMware replacement and for small-to-medium scale private clouds.	Full-Stack Private Cloud / Industry Cloud Emphasizes “public cloud experience in a private deployment,” providing full-stack IaaS+PaaS+SaaS capabilities, targeting digital transformation for large government and enterprises.
Technical DNA	Self-developed architecture (not a modified OpenStack), high code autonomy, lightweight.	Derived from Tencent Cloud (Tencent Cloud Public), deeply customized based on OpenStack/K8s, platform-heavy.
Typical Clients	SMEs, hospitals, schools, some SOEs, edge computing scenarios.	Large central SOEs, government bureaus, financial institutions, groups requiring complex PaaS capabilities.

2. Comparison of Architecture and Technical Features

2.1 Architecture Design

ZStack:
- Microservices Architecture: All components are process-based with no external dependencies (no need for separate MySQL or RabbitMQ deployment), featuring one-click installation and deployment completion within 30 minutes.
- Stateless Design: Management nodes support High Availability (HA) with automatic failover.
- Seamless Upgrades: Supports seamless online upgrades without business interruption.
TStack (TCE):
- Complex Distributed Architecture: Relies on a large number of middleware components; deployment usually requires professional team intervention with a longer cycle (days/weeks).
- Same Source as Public Cloud: Underlying technology is highly consistent with Tencent Cloud Public, suitable for scenarios requiring “hybrid cloud consistency.”
- Modular Delivery: Allows selection of Enterprise, Big Data, or AI editions, but high integration leads to relatively high coupling.

2.2 Virtualization and Containers

Feature	ZStack	TStack (TCE)
Virtualization Kernel	Deeply optimized based on KVM with a self-developed management engine, offering extremely low performance overhead.	Based on KVM, inheriting some features of Tencent Cloud Public’s Shenlong architecture, with strong performance.
Container Support	ZStack Zaku: Provides a container engine, supporting unified management of VMs and containers, lightweight K8s.	TCS (Tencent Cloud-native Suite): Enterprise-grade K8s platform with extremely rich features, supporting complex microservice governance and DevOps.
Compute-Storage Separation	Supports ZStack Cube HCI architecture with built-in distributed storage.	Supports integration with Tencent self-developed storage like CBS/CFS, as well as third-party storage.

3. Xinchuang (Localization) and Ecosystem Compatibility

With the deepening of domestic requirements, Xinchuang capabilities have become a critical factor in selection.

ZStack:
- Full-Stack Xinchuang: Claims “One Cloud, Eight Chips,” fully supporting domestic chips such as Phytium, Kunpeng, Hygon, Loongson, Zhaoxin, and Sunway.
- Ecosystem Adaptation: Adapted to 140+ domestic software and hardware products (OS, databases, middleware).
- Advantage: As an independent vendor, response speed for adaptation to niche domestic chips and operating systems is extremely fast with high flexibility.
TStack (TCE):
- Mainstream Xinchuang: Focuses on supporting mainstream domestic chips like Kunpeng and Phytium (especially vendors with strategic partnerships with Tencent).
- Ecosystem Binding: Deeply integrated with the Tencent Cloud ecosystem (e.g., TDSQL database, TDW big data), performing excellently in Tencent-based Xinchuang solutions.
- Advantage: In large Xinchuang projects for finance and government, can provide full-link backstop services from chip to application.

4. O&M and Delivery Experience

Dimension	ZStack	TStack (TCE)
Deployment Difficulty	⭐ (Extremely Simple) Single node startup, guided Web UI installation, extremely high automation.	⭐⭐⭐ (Complex) Usually requires on-site deployment by the vendor or certified partners, relying on complex pre-checks and environment preparation.
Daily O&M	⭐⭐ (Simple) Intuitive interface, focused features, fast learning curve for general ops staff.	⭐⭐⭐ (Professional) Extremely rich but complex features, requires a dedicated trained O&M team, steep learning curve.
Upgrade & Maintenance	Supports seamless online upgrades, fast version iteration.	Rigorous but cumbersome upgrade process, usually involving downtime windows or complex canary release strategies.
After-sales Service	Direct vendor service + partners, flexible response.	Relies on Tencent Cloud’s massive service system, comprehensive three-tier support mechanism, but relatively standardized processes (sometimes slightly rigid).

5. Cost Analysis (TCO)

ZStack:
- Licensing Model: Usually licensed by CPU socket or node count, transparent pricing.
- Hardware Requirements: Relatively low hardware configuration requirements, strong capability for legacy hardware reuse, can use generic x86 servers.
- Labor Cost: Simple O&M significantly reduces reliance on senior operations experts.
- Overall Assessment: Low initial investment, low long-term holding cost, suitable for budget-sensitive projects.
TStack (TCE):
- Licensing Model: Packaged total solution, including software licensing, implementation fees, and maintenance service fees, higher price.
- Hardware Requirements: Recommends dedicated hardware or high-performance servers, high requirements for network architecture (often requiring 10GbE起步).
- Labor Cost: Requires a dedicated cloud management team, high training costs.
- Overall Assessment: High initial investment, suitable for large projects with sufficient budget pursuing ultimate stability and full-stack capabilities.

6. Selection Decision Matrix

Please refer to the table below based on your actual scenario:

Scenario Characteristics	Recommended Solution	Rationale
VMware Replacement	ZStack	ZStack is designed specifically to replace VMware, with mature migration tools, low cost, lightweight architecture, and low risk.
Small/Medium Private Cloud (<50 nodes)	ZStack	Fast deployment, less O&M, high cost-performance ratio, features are fully sufficient.
Large Gov/Finance Core Cloud (>100 nodes)	TStack (TCE)	Requires extremely high stability, complex PaaS capabilities, and the brand endorsement/backstop service of a major vendor.
Need Deep PaaS/Big Data/AI Capabilities	TStack (TCE)	Tencent has natural advantages in big data, AI, and WeChat ecosystem integration; TCE can directly reuse public cloud capabilities.
Complex Xinchuang Environment (Mixed Domestic Chips)	ZStack	Independent vendors usually outperform major vendors’ standard products in compatibility and adaptation response speed for heterogeneous chips.
Hybrid Cloud Architecture (Linkage with Public Cloud)	TStack (TCE)	If there are plans to heavily use Tencent Cloud Public in the future, TCE can deliver a true “One Cloud” experience.
Limited Budget / Fast Launch	ZStack	Out-of-the-box, production-ready within days, significantly reducing TCO.

7. Summary and Recommendations

Choose ZStack if:
- You wish to rapidly build a private cloud and are tired of complex OpenStack deployments.
- Your primary goal is VMware replacement to reduce licensing costs.
- Your team size is small and lacks dedicated cloud operations experts.
- You require high autonomy/controllability and a neutral third-party software vendor.
Choose TStack (TCE) if:
- You are a large group, central SOE, or financial institution with near-stringent requirements for stability.
- You need full-stack capabilities (not just VMs, but also PaaS services like big data, AI, microservice governance).
- Your strategic direction is hybrid cloud, and you prefer using Tencent Cloud Public as the public side.
- You have sufficient budget to form a professional cloud management team and purchase advanced vendor services.

💡 Final Recommendation:

In the current market environment, “Small & Beautiful” and “Big & Complete” coexist. For 80% of generic enterprise scenarios, ZStack is often the more pragmatic and efficient choice;而对于那 20% 关乎国计民生、业务极度复杂的核心场景，TStack (TCE) 的底蕴则不可或缺。建议在选型前进行 POC 测试，重点验证部署效率、信创兼容性及实际业务负载下的性能表现。

Actually, in private deployment scenarios, ZStack and TStack already cover the IaaS layer (VMs and distributed storage) and the PaaS container layer. The only missing piece is the RDS platform. Therefore, when adding a third-party RDS platform to complement these two, attention must be paid to compatibility. Generally, ZStack is paired with Woqu, and TStack is paired with ActionTech.

After using both Woqu and ActionTech, I recommend using the Woqu platform, mainly because it performs better in terms of platform features, high availability, and UI usability. It supports MySQL, Oracle, SQL Server, PostgreSQL, Redis, MongoDB, OceanBase, TiDB, ES, RabbitMQ, Kafka, RocketMQ, etc.

Building an Enterprise-Grade VPN Network with WireGuard

wzdushu@gmail.com (wanzi) — Fri, 10 Jan 2025 14:22:42 +0800

Introduction to WireGuard

WireGuard is a modern, fast, simple, and secure Virtual Private Network (VPN) protocol designed to replace traditional VPN technologies like IPsec and OpenVPN. It is faster, simpler, leaner, and more practical than IPsec, while avoiding massive amounts of trouble. It offers higher performance compared to OpenVPN. Originally released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. Although currently under active development, it is likely already considered the most secure, easiest to use, and simplest VPN solution in the industry.

Main Use Cases:

Secure remote access to the enterprise intranet for employees working from home or traveling who need secure access to internal systems (e.g., file servers, ERP, databases).
Cross-branch interconnection (Site-to-Site), e.g., stable communication between a European office and the China headquarters.
Secure interconnection between cloud servers and local data centers, connecting business systems on Alibaba Cloud/AWS/Azure with local IDCs.
Secure interconnection between home networks and cloud servers, accessing home NAS files while traveling.
Secure communication for IoT devices, where smart cameras, industrial sensors, POS machines, etc., need to securely transmit data back to the data center.
Container and microservice network isolation, cross-host communication in container scenarios, e.g., using tools like wg-easy or Netmaker to quickly build overlay networks.

WireGuard Deployment

Installing WireGuard

WireGuard has been merged into the mainline kernel since Linux 5.6. Most modern distributions can install the userspace tools directly:

1
2

sudo apt update
sudo apt install wireguard wireguard-tools

Note: If using CentOS/RHEL, you need to enable EPEL or use the elrepo kernel module first; Windows/macOS clients can download the official GUI app from wireguard.com.

Generating Key Pairs

cd /etc/wireguard/
umask 077 # Ensure key file permissions are secure
wg genkey | tee server_private.key | wg pubkey > server_public.key # Generate server-side keys
wg genkey | tee server_private.key | wg pubkey > client1_public.key # Client A keys
wg genkey | tee server_private.key | wg pubkey > client2_public.key # Client B keys

WireGuard Configuration Management

WireGuard does not have a strict server/client distinction, but usually a node with a public IP is required to act as a relay server (Hub).

Edit the server-side (relay) configuration file /etc/wireguard/wg0.conf:

[Interface]
Address = 10.100.0.1/24
ListenPort = 51820
PrivateKey = wg genkey | tee server_private.key | wg pubkey > server_public.key # Generate server-side keys

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client A
[Peer]
PublicKey = client1_public.key
AllowedIPs = 10.100.0.2/32

# Client B
[Peer]
PublicKey = client2_public.key
AllowedIPs = 10.100.0.3/32

Enable Auto-start on Boot

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
# Check status
sudo wg show

Configure Kernel Forwarding and Firewall (CentOS/Ubuntu):

# Enable IPv4 forwarding
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

# Open firewall port (optional, adjust based on actual situation)
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.100.0.0/24 masquerade'
sudo firewall-cmd --reload
# If using iptables, refer to the PostUp/PostDown scripts above

WireGuard Dashboard

wg-easy (Lightweight Web UI)

Features: Single-page application, one-click Docker deployment, supports QR code scanning for connection, traffic monitoring, and online client toggling.
Use Cases: Small to medium teams (<50 users), quickly setting up a remote office VPN.
One-click deployment command:

docker run -d \
  --name=wg-easy \
  -e WG_HOST=your.domain.com \
  -e WG_PORT=51820 \
  -e WG_DEFAULT_ADDRESS=10.100.0.x \
  -e PASSWORD=your_admin_password \
  -v ～/.wg-easy:/etc/wireguard \
  -p 51821:51821 \
  -p 51820:51820/udp \
  weejewel/wg-easy

Note: wg-easy has no user permission isolation by default and is not suitable for multi-tenant or high-security scenarios.

Netmaker (Enterprise-grade SD-WAN Architecture)

Features:
- Supports Mesh networking (arbitrary node interconnection), Site-to-Site, and Kubernetes integration;
- Provides REST API, RBAC permission control, ACL policies, and metrics monitoring (Prometheus);
- Separation of control plane (netmaker) and data plane (netclient), supporting dynamic topology.
Architecture Components:
- Netmaker Server: Manages nodes, policies, and certificates;
- Netclient: Deployed on endpoints (servers/PCs/IoT), automatically registers and fetches configurations;
- MQTT Broker (Optional): Used for large-scale node status synchronization.
Deployment Methods: Supports Helm Chart (K8s), Docker Compose, and systemd.

Recommended for: Complex topologies such as cross-branch interconnection, hybrid cloud networking, and IoT device cluster management.

Tailscale / Headscale (Zero Trust Architecture)

Although not native WireGuard, it is based on the WireGuard protocol at the core;
Provides SSO (Google/Azure/OIDC), device authentication, and fine-grained ACLs;
Headscale is the open-source self-hosted version, suitable for enterprises with high data compliance requirements.

Tailscale is a commercial SaaS service (free version supports 3 users), while Headscale is its open-source, self-hosted alternative; the protocols are fully compatible.

Here is a strongly recommended solution: use the open-source Headscale for the server side and Tailscale for the client side.

Open Source WAF Security Protection Solution

wzdushu@gmail.com (wanzi) — Sun, 16 Jun 2024 16:22:42 +0800

Recently, after adding a CDN to the website, there have been a lot of junk requests in the early morning, some are scans, some have large model UserAgents, and some are black spiders.

To save on CDN costs and prevent various injection attacks, I started researching open-source WAF solutions (which is sufficient for my small site). For enterprise use, it is still recommended to use commercial versions, such as Alibaba Cloud’s DCDN, Tencent’s EdgeOne, or overseas options like Cloudflare (preferred for overseas business).

1. Function Introduction

Leichi (SafeLine) is an open-source WAF solution from Chaitin Technology, driven by intelligent semantic analysis algorithms.

The main function is a network security gateway, focusing on WAF, which can defend against all web attacks, such as SQL injection, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XSS, XXE, SSRF, path traversal, backdoors, brute force attacks, HTTP floods, robot abuse, etc.

I briefly reviewed the project source code; the API uses Golang, and the core WAF functionality uses Tengine + Lua, similar to OpenResty.

Project address: https://github.com/chaitin/safeline

Official website: https://waf-ce.chaitin.cn/

https://waf.chaitin.com/

Note: Other popular gateways include Apisix, Kong, Openresty, etc.

2. Installation

Download Offline Image

Since many domestic Docker Hub mirror accelerators have become unavailable recently, we can only use offline methods here.

# mkdir /opt/safeline
# cd /opt/safeline
# wget https://demo.waf-ce.chaitin.cn/image.tar.gz
# cat image.tar.gz | gzip -d | docker load
# docker ps 
REPOSITORY                                                           TAG       IMAGE ID       CREATED         SIZE
chaitin/safeline-fvm                                                 latest    d9589d01be57   3 days ago      175MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-fvm        latest    d9589d01be57   3 days ago      175MB
chaitin/safeline-mgt                                                 latest    56ef6365e4c3   3 days ago      81.6MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-mgt        latest    56ef6365e4c3   3 days ago      81.6MB
chaitin/safeline-luigi                                               latest    1423e012eef0   3 days ago      31.8MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-luigi      latest    1423e012eef0   3 days ago      31.8MB
chaitin/safeline-mario                                               latest    758fd16c3d30   3 days ago      201MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-mario      latest    758fd16c3d30   3 days ago      201MB
chaitin/safeline-bridge                                              latest    94aaed2a1b5a   3 days ago      17.9MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-bridge     latest    94aaed2a1b5a   3 days ago      17.9MB
chaitin/safeline-tengine                                             latest    c67893333287   3 days ago      140MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-tengine    latest    c67893333287   3 days ago      140MB
chaitin/safeline-detector                                            latest    f5cff5cc7e35   3 days ago      179MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-detector   latest    f5cff5cc7e35   3 days ago      179MB
chaitin/safeline-chaos                                               latest    71b05b47e3fd   3 days ago      118MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-chaos      latest    71b05b47e3fd   3 days ago      118MB
chaitin/safeline-postgres                                            15.2      bf700010ce28   13 months ago   379MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-postgres   15.2      bf700010ce28   13 months ago   379MB

Configure Environment

# cd  /opt/safeline
# vim .env
SAFELINE_DIR=/opt/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD=Pgssf201Waf
SUBNET_PREFIX=172.22.222
IMAGE_PREFIX=chaitin

SAFELINE_DIR: Leichi installation directory, configured as /opt/safeline here.
IMAGE_TAG: The version of Leichi to install, keep the default latest.
MGT_PORT: The port for the Leichi console, keep the default 9443.
POSTGRES_PASSWORD: The initial password for the database required by Leichi, please generate one randomly.
SUBNET_PREFIX: The subnet prefix for the internal network of Leichi, keep the default 172.22.222.
IMAGE_PREFIX: The prefix for the Leichi image source, keep the default chaitin.

Manage Containers with docker-compose:

# cd "/opt/safeline"
# wget "https://waf-ce.chaitin.cn/release/latest/compose.yaml"  -O docker-compose.yaml
# docker-compose  up -d
# docker-compose ps 
Name                     Command                  State                            Ports
--------------------------------------------------------------------------------------------------------------------
safeline-bridge     /app/bridge serve -n unix  ...   Up
safeline-chaos      ./entrypoint.sh                  Up             9000/tcp
safeline-detector   /detector/entrypoint.sh          Up (healthy)   8000/tcp, 8001/tcp
safeline-fvm        ./fvm /app/config.yml            Up
safeline-luigi      /bin/sh -c /app/luigi            Up             80/tcp
safeline-mario      /mario/entrypoint.sh             Up (healthy)
safeline-mgt        /docker-entrypoint.sh /bin ...   Up (healthy)   0.0.0.0:9443->1443/tcp,:::9443->1443/tcp, 80/tcp
safeline-pg         docker-entrypoint.sh postg ...   Up (healthy)   5432/tcp
safeline-tengine    entrypoint.sh nginx -g dae ...   Up

The first login to Leichi requires initializing the admin account. Execute the following command:

`1`	`docker exec safeline-mgt resetadmin`

After executing the command, the admin account password will be randomly reset, and the output will be as follows:

[SafeLine] Initial username：admin
[SafeLine] Initial password：**********
[SafeLine] Done

At this point, the basic installation is complete. You just need to open port 9443 in the cloud ACL.

You can access the Leichi console by opening a browser and visiting https://:9443/.

3. Website Configuration

SSL Certificate Configuration:

Supports both custom uploading of certificates and applying for free certificates.

Add Site:

Add a site. By default, CAPTCHA, identity verification, and dynamic protection are already enabled. Note that when adding upstream servers, the origin configuration is somewhat vague, such as the origin port and protocol.

Proxy Configuration:

Security Protection Settings:

Here, you mainly configure rate limits (similar to Nginx limit), custom rules (based on HTTP header information), and semantic analysis (related to injections).

Rate Limiting: The underlying logic is similar to Nginx’s limit_req, limit_conn, and limit_rate.

Custom Rules: Mainly based on HTTP header information to set policies, similar to common CDN access control, but this feature is more flexible.

Semantic Analysis: Mainly for identifying various injections and bot detection.

4. Summary

After two days of testing, Leichi basically meets the needs of my small site, but it also has many areas where it falls short.

For example: Free certificate application does not support wildcard domains, and the origin server protocol is vague.

Finally, here is a screenshot of the Leichi backend homepage.

References: https://docs.waf-ce.chaitin.cn/zh/home

A Powerful Tool for Operating Baidu Cloud on Linux

wzdushu@gmail.com (wanzi) — Mon, 04 Dec 2023 16:22:42 +0800

Recently, I was performing a private deployment of our company’s SAAS product at the customer site. Since the customer’s network cannot access the internet, data can only be transferred through a Linux jump server. In addition to the k8s offline deployment program and images, there are also several hundred GB of pre-cut video data, which can only be transferred via Baidu Netdisk. I wondered if it was possible to synchronize Baidu Netdisk data via the command line. A quick Google search revealed that it is indeed possible. Below, I will briefly introduce the use of bypy.

Introduction to bypy

bypy is a Python client for Baidu Cloud/Baidu Netdisk, mainly used for operating Baidu Netdisk under Linux. It provides functionalities such as file listing, downloading, uploading, comparison, upsync, and downsync. Key features include support for Unicode/Chinese, retry on failure, recursive upload/download, directory comparison, and hash caching.

Due to Baidu PCS API permission restrictions, the program can only access files and directories under the /apps/bypy directory in Baidu Cloud.

Installing bypy

Install pip

curl -O https://bootstrap.pypa.io/pip/2.7/get-pip.py
curl -O https://bootstrap.pypa.io/pip/3.6/get-pip.py
python get-pip.py

Install bypy

pip install bypy

python -m bypy info # Generate an authorization code, then open a browser to authorize and enter the authorization code

Copy and paste the authorization code into the terminal, press Enter, and you’re done.

Detailed bypy Commands

$ bypy help command # View command help
$ bypy info  # View Baidu Netdisk space
Quota: 13.294TB
Used: 1.917TB
$ bypy list # View "My Application Data" in Baidu Netdisk
/apps/bypy ($t $f $s $m $d):
D course 0 2023-12-04, 15:21:41
D k8s 0 2023-12-04, 15:47:47

$ bypy downdir k8s # Directly download the k8s directory under bypy
$ bypy syncup # Sync the current directory to the cloud
$ bypy upload # Sync the current directory to the cloud
$ bypy syncdown # Sync the cloud content to the current directory
$ bypy downdir / # Sync the cloud content to the current directory

$ bypy compare # Compare the local current directory with the root directory of the cloud (program)
$ bypy -v # Adding the -v parameter during runtime will display progress details.
$ bypy -d # Adding -d during runtime will display some debug information
$ bypy -ddd # Display more HTTP communication information

Summary

This concludes my exploration of using bypy. During my research, I found many tools based on baidupcs, but most of these projects are no longer maintained. I hope bypy can continue to be supported.

Reference: https://github.com/houtianze/bypy

Recommended Windows Package Management Tool

wzdushu@gmail.com (wanzi) — Mon, 10 Jul 2023 16:22:42 +0800

Having been used to the convenience of using Homebrew to install software packages on Mac, I recently installed a Windows system on my company’s computer and wanted to set it up similarly. The solution is Scoop, which I am recommending today.

Scoop is an open-source project that primarily uses commands to install Windows software packages. It effectively avoids permission pop-ups, hides GUI wizard installations, automatically finds and installs dependencies, and automates the installation process.

Official website: https://scoop.sh/

Open-source project address: https://github.com/ScoopInstaller/Scoop

Additionally, Scoop packages can be part of a git repository, commonly referred to as buckets. You can view these buckets on GitHub at https://scoop.sh/#/buckets. You can also easily create your own buckets.

Environment Preparation

Windows 10 Pro 19044.1586
Latest version of PowerShell or Windows PowerShell 5.1
The PowerShell execution policy must be one of the following: Unrestricted, RemoteSigned, or ByPass.

Installing Scoop

Run this command from a non-admin PowerShell to install Scoop with the default configuration. Scoop will be installed in C:\Users\<YOUR USERNAME>\scoop.

During installation, you may be prompted to change the policy:

PS C:\Users\wnote> iwr -useb get.scoop.sh | iex
Initializing...
PowerShell requires an execution policy in [Unrestricted, RemoteSigned, ByPass] to run Scoop. For example, to set the execution policy to 'RemoteSigned' please run 'Set-ExecutionPolicy RemoteSigned -Scope CurrentUser'.
Abort.
PS C:\Users\wnote> Set-ExecutionPolicy RemoteSigned -Scope CurrentUser                                                 
Execution Policy Change
The execution policy helps prevent running untrusted scripts. Changing the execution policy might expose you to security risks. For more information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170
Do you want to change the execution policy?
[Y] Yes(Y)  [A] Yes to All(A)  [N] No(N)  [L] No to All(L)  [S] Suspend(S)  [?] Help (default is "N"): Y
PS C:\Users\tarena> iwr -useb get.scoop.sh | iex
Initializing...
Downloading ...
Creating shim...
Adding ~\scoop\shims to your path.
Scoop was installed successfully!
Type 'scoop help' for instructions.

PS C:\Users\tarena> scoop update
Updating Scoop...
Updating 'main' bucket...
Scoop was updated successfully!

If your network cannot connect to the official address, you can add a proxy:

`1`	`irm get.scoop.sh -Proxy 'http://<ip:port>' \| iex`

For those who do not want to install to the default path, you can specify a custom path. Refer to install.ps1 at https://github.com/ScoopInstaller/Install/blob/master/install.ps1:

`1`	`.\install.ps1 -ScoopDir 'D:\Applications\Scoop' -ScoopGlobalDir 'F:\GlobalScoopApps' -NoProxy`

Switching to a Domestic Source

There are several domestic sources available online: https://gitee.com/squallliu/scoop https://gitee.com/glsnames/scoop-installer

1
2
3

iwr -useb https://gitee.com/glsnames/scoop-installer/raw/master/bin/install.ps1 | iex
scoop config SCOOP_REPO https://gitee.com/glsnames/scoop-installer
scoop update

Installing Software Packages

scoop install kubectl 
scoop install helm 
scoop install wget 
scoop install curl 
scoop install 7zip 
scoop install aria2 
scoop install sudo 
scoop install -g extras/windows-terminal

If the installation gets stuck, consider configuring a proxy:

1
2

scoop config proxy 127.0.0.1:18080 # Set HTTP proxy
scoop config rm proxy # Remove proxy

Configuring the Multi-threaded Download Tool Aria2

scoop config aria2-enabled false
scoop config aria2-warning-enabled false
scoop config aria2-retry-wait 4
scoop config aria2-split 16
scoop config aria2-max-connection-per-server 16
scoop config aria2-min-split-size 4M

Common Scoop Commands

scoop install "app name" # Install a package
scoop list # List installed packages
scoop status # Check for updates
scoop config # View configuration

Reference: https://github.com/ScoopInstaller/Install

Delve Version Too Low to Work with GoLand

wzdushu@gmail.com (wanzi) — Wed, 15 Mar 2023 16:22:42 +0800

Problem

While debugging code in GoLand recently, I kept encountering the following error:

`1`	`WARNING: undefined behavior - version of Delve is too old for Go version 1.19.3 (maximum supported version 1.18)`

Solution

The issue essentially means that the installed version of Delve is too old and incompatible with the current Go version.

To resolve this, update Delve. Since I’m using brew for installation, and the official documentation doesn’t provide detailed instructions for brew, we’ll install it directly.

1
2
3

git clone https://github.com/go-delve/delve
cd delve
go install github.com/go-delve/delve/cmd/dlv

Or install a specific version:

# Install the latest release
go install github.com/go-delve/delve/cmd/dlv@latest
# Install version 1.20.1
go install github.com/go-delve/delve/cmd/dlv@1.20.1

By default, go install places the binary in $GOPATH/bin.

# go env GOPATH
/Users/wanzi/go
# ./go/bin/dlv version
Delve Debugger
Version: 1.20.1
Build: $Id: 96e65b6c615845d42e0e31d903f6475b0e4ece6e $

Uninstall the existing Delve and update your PATH in zsh:

`1`	`brew uninstall delve`

Edit ~/.zshrc and add:

`1`	`export PATH="${PATH}:${HOME}/.krew/bin/:$HOME/go/bin"`

Reference: https://github.com/go-delve/delve/tree/master/Documentation/installation

Automatically Renew Free SSL Certificates for Your Blog

wzdushu@gmail.com (wanzi) — Sat, 12 Nov 2022 16:22:42 +0800

Background

If you run a website or personal blog, you need to keep track of your SSL certificate expiration every year. Recently, the SSL certificate for wnote.com is also approaching its expiry.

Obtaining an SSL certificate enables HTTPS access for your site. There are both free and paid options available. Major domestic cloud providers like Alibaba Cloud, Tencent Cloud, and UCloud offer free SSL certificate services, typically valid for one year and requiring manual renewal. If your audience is primarily overseas, consider using Cloudflare’s CDN with built-in free SSL protection.

For those who enjoy tinkering, Let’s Encrypt offers free certificates. Visit https://letsencrypt.org/ for more details. The official recommendation is to use the Certbot client, which supports the ACME protocol—though we won’t cover it here in depth.

In this guide, we’ll use acme.sh to issue free certificates. The main reasons are:

Full support for the ACME protocol.
Support for wildcard domain certificates.
Automatic renewal capability.

By default, acme.sh issues certificates from https://zerossl.com, with no usage limits. However, if you apply directly via ZeroSSL’s website, you’re limited to three free certificates.

Project repository:

https://github.com/acmesh-official/acme.sh

Install ACME

After installation, the default directory is ~/.acme.sh/, where all certificates will be stored.

1
2
3

git clone https://github.com/acmesh-official/acme.sh.git
cd ./acme.sh
./acme.sh --install -m my@example.com # Replace with your email

The installer performs three actions:

Creates and copies acme.sh to your home directory ($HOME): ~/.acme.sh/.
Sets up an alias: acme.sh=~/.acme.sh/acme.sh.
Optionally creates a daily cron job to check and update certificates.

Issue Certificates

HTTP Challenge (Webroot Method)

For a single domain:

`1`	`acme.sh --issue -d www.example.com -w /home/wwwroot/www.example.com`

Or:

`1`	`acme.sh --issue -d example.com -w /home/username/public_html`

Or:

`1`	`acme.sh --issue -d example.com -w /var/www/html`

For multiple domains in one certificate:

`1`	`acme.sh --issue -d example.com -d www.example.com -d cp.example.com -w /home/wwwroot/example.com`

The -d parameter specifies the domain(s) for which the certificate is issued. At least one domain is required, and it must correspond to the web root specified by -w.
The path after -w (e.g., /home/wwwroot/example.com, /var/www/html) is your website’s web root directory. You must have write permissions here, as acme.sh will create a .well-known directory and place verification files inside to prove ownership.

Certificates are stored by default in ~/.acme.sh/example.com/ and are automatically renewed every 60 days.

DNS API Challenge (Automatic)

If your DNS provider supports API access, you can automate certificate issuance without any manual steps!

Supported DNS providers: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

Since wnote.com uses Alibaba Cloud DNS, and it’s on the supported list, we’ll use the DNS API method.

First, generate an AccessKey pair in Alibaba Cloud RAM Console:
https://ram.console.aliyun.com/manage/ak

After creation, record your AccessKey ID and AccessKey Secret for later use. These credentials will be saved in ~/.acme.sh/account.conf after successful issuance, enabling automatic renewal via cron.

1
2
3

root@VM-0-3-ubuntu:~# export Ali_Key="LTII5t8tE4IgMFGDK6iTcs2A"
root@VM-0-3-ubuntu:~# export Ali_Secret="Ku7q3lPJMISlJqZ9OomLOfzO8LFVff"
root@VM-0-3-ubuntu:~# acme.sh --issue --dns dns_ali -d wnote.com -d *.wnote.com

Wait for the process to complete (~2 minutes). Example log output:

[Fri 11 Nov 2022 10:40:31 PM CST] Using CA: https://acme.zerossl.com/v2/DV90
[Fri 11 Nov 2022 10:40:31 PM CST] Multi domain='DNS:wnote.com,DNS:*.wnote.com'
[Fri 11 Nov 2022 10:40:31 PM CST] Getting domain auth token for each domain
[Fri 11 Nov 2022 10:40:34 PM CST] Could not get nonce, let's try again.
[Fri 11 Nov 2022 10:40:41 PM CST] Could not get nonce, let's try again.
[Fri 11 Nov 2022 10:40:47 PM CST] Could not get nonce, let's try again.
[Fri 11 Nov 2022 10:41:38 PM CST] Getting webroot for domain='wnote.com'
[Fri 11 Nov 2022 10:41:38 PM CST] Getting webroot for domain='*.wnote.com'
[Fri 11 Nov 2022 10:41:38 PM CST] Adding txt value: 9QXV-Ve3eEI-JCLjJ7RkMMvPGNaTzV3YmlaXWtwrJVM for domain:  _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:41:40 PM CST] The txt record is added: Success.
[Fri 11 Nov 2022 10:41:40 PM CST] Adding txt value: KXKFA3BChlz0c5NTHN4fmO8jo-e3DbMu0VybF-YohTw for domain:  _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:41:42 PM CST] The txt record is added: Success.
[Fri 11 Nov 2022 10:41:42 PM CST] Let's check each DNS record now. Sleep 20 seconds first.
[Fri 11 Nov 2022 10:42:03 PM CST] You can use '--dnssleep' to disable public dns checks.
[Fri 11 Nov 2022 10:42:03 PM CST] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Fri 11 Nov 2022 10:42:03 PM CST] Checking wnote.com for _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:42:06 PM CST] Domain wnote.com '_acme-challenge.wnote.com' success.
[Fri 11 Nov 2022 10:42:06 PM CST] Checking wnote.com for _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:42:07 PM CST] Domain wnote.com '_acme-challenge.wnote.com' success.
[Fri 11 Nov 2022 10:42:07 PM CST] All success, let's return
[Fri 11 Nov 2022 10:42:07 PM CST] Verifying: wnote.com
[Fri 11 Nov 2022 10:42:12 PM CST] Processing, The CA is processing your order, please just wait. (1/30)
[Fri 11 Nov 2022 10:42:20 PM CST] Processing, The CA is processing your order, please just wait. (2/30)
[Fri 11 Nov 2022 10:42:29 PM CST] Processing, The CA is processing your order, please just wait. (3/30)
[Fri 11 Nov 2022 10:42:38 PM CST] Processing, The CA is processing your order, please just wait. (4/30)
[Fri 11 Nov 2022 10:42:46 PM CST] Processing, The CA is processing your order, please just wait. (5/30)
[Fri 11 Nov 2022 10:42:55 PM CST] Processing, The CA is processing your order, please just wait. (6/30)
[Fri 11 Nov 2022 10:43:02 PM CST] Success
[Fri 11 Nov 2022 10:43:02 PM CST] Verifying: *.wnote.com
[Fri 11 Nov 2022 10:43:06 PM CST] Processing, The CA is processing your order, please just wait. (1/30)
[Fri 11 Nov 2022 10:43:13 PM CST] Processing, The CA is processing your order, please just wait. (2/30)
[Fri 11 Nov 2022 10:43:28 PM CST] Processing, The CA is processing your order, please just wait. (3/30)
[Fri 11 Nov 2022 10:43:41 PM CST] Processing, The CA is processing your order, please just wait. (4/30)
[Fri 11 Nov 2022 10:43:48 PM CST] Processing, The CA is processing your order, please just wait. (5/30)
[Fri 11 Nov 2022 10:43:52 PM CST] Processing, The CA is processing your order, please just wait. (6/30)
[Fri 11 Nov 2022 10:43:58 PM CST] Processing, The CA is processing your order, please just wait. (7/30)
[Fri 11 Nov 2022 10:44:10 PM CST] Processing, The CA is processing your order, please just wait. (8/30)
[Fri 11 Nov 2022 10:44:29 PM CST] Processing, The CA is processing your order, please just wait. (9/30)
[Fri 11 Nov 2022 10:44:59 PM CST] Success
[Fri 11 Nov 2022 10:44:59 PM CST] Removing DNS records.
[Fri 11 Nov 2022 10:44:59 PM CST] Removing txt: 9QXV-Ve3eEI-JCLmJ7RkLMvPGNaTzV3YmlaXWtwrJVM for domain: _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:45:02 PM CST] Removed: Success
[Fri 11 Nov 2022 10:45:02 PM CST] Removing txt: KXKKA3BChlz0c5NOHN4fmk8jo-e3DMMu0VybF-YohTw for domain: _acme-challenge.wnote.com
[Fri 11 Nov 2022 10:45:06 PM CST] Removed: Success
[Fri 11 Nov 2022 10:45:06 PM CST] Verify finished, start to sign.
[Fri 11 Nov 2022 10:45:06 PM CST] Lets finalize the order.
[Fri 11 Nov 2022 10:45:06 PM CST] Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/FYF3wr0jlkJarp3dFuRaKg/finalize'
[Fri 11 Nov 2022 10:45:33 PM CST] Order status is processing, lets sleep and retry.
[Fri 11 Nov 2022 10:45:33 PM CST] Retry after: 15
[Fri 11 Nov 2022 10:45:49 PM CST] Polling order status: https://acme.zerossl.com/v2/DV90/order/FYF3wr0jlkJarp3dFuRaKg
[Fri 11 Nov 2022 10:45:55 PM CST] Downloading cert.
[Fri 11 Nov 2022 10:45:55 PM CST] Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/RVtakD091ssrWC6HxgcWxQ'
[Fri 11 Nov 2022 10:46:02 PM CST] Cert success.
-----BEGIN CERTIFICATE-----
MIIGbjCCBFagAwIBAgIRAOee+mMTTeRu9hUkpcDXkQcwDQYJKoZIhvcNAQEMBQAw
SzELMAkGA1UEBhMCQVQxEDAOBgNVBAoTB1plcm9TU0wxKjAoBgNVBAMTIVZlcm9T
U0wgUlNBIERvbWFpbiBTZWN1cmUgU2l0ZSBDQTAeFw0yMjExMTEwMDAwMDBaFw0y
......
......
fH91qX3O1eXUPQEku+ZLx8hfqKKUuI0l8t6qQkDnK3N+987XdsEXN2mRHnTOfyo4
4Z8RVsC8gXep8VxsVSQ/0urED3ghLBz7Ya5pLFl0inJeLXC/MD1HETryH1iSojv2
JHNsJhGlwrhqORg91jodBBl4
-----END CERTIFICATE-----
[Fri 11 Nov 2022 10:46:02 PM CST] Your cert is in: /root/.acme.sh/wnote.com/wnote.com.cer
[Fri 11 Nov 2022 10:46:02 PM CST] Your cert key is in: /root/.acme.sh/wnote.com/wnote.com.key
[Fri 11 Nov 2022 10:46:02 PM CST] The intermediate CA cert is in: /root/.acme.sh/wnote.com/ca.cer
[Fri 11 Nov 2022 10:46:02 PM CST] And the full chain certs is there: /root/.acme.sh/wnote.com/fullchain.cer

Manual DNS Challenge

If your DNS provider isn’t supported by acme.sh, manually add TXT records:

Domain: _acme-challenge.example.com
TXT Value: 9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c

Domain: _acme-challenge.www.example.com
TXT Value: 9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Then issue the certificate:

`1`	`acme.sh --issue --dns -d example.com -d www.example.com -d cp.example.com`

Update CA Certificate Authority (CA)

Currently, acme.sh supports four official CAs: Let’s Encrypt, Buypass, ZeroSSL, and SSL.com. By default, it uses ZeroSSL.

To switch CA, use:

acme.sh --set-default-ca --server letsencrypt
acme.sh --set-default-ca --server buypass
acme.sh --set-default-ca --server zerossl
acme.sh --set-default-ca --server ssl.com
acme.sh --set-default-ca --server google

⚠️ Note: Avoid using Google Public CA for domestic websites, as many domains fail validation due to network restrictions.

Google Public CA tutorial: https://cloud.google.com/certificate-manager/docs/public-ca-tutorial

Update Docker & Nginx Configuration

After obtaining the certificate, update your docker-compose.yml and nginx.conf.

version: "3"
services:
  nginx:
    image: nginx:1.18.0
    volumes:
      - ./conf/nginx.conf:/etc/nginx/nginx.conf
      - /opt/wwwroot/wnote.com:/opt/wnote.com
      - /root/.acme.sh/wnote.com:/opt/ssl
      - ./logs:/var/log/nginx
    restart: always
    ports:
      - 443:443
      - 80:80
    networks:
      - my-nginx
networks:
  my-nginx:
    driver: bridge

server {
    listen       443 ssl http2;
    server_name  wnote.com www.wnote.com;
    root         /opt/wnote.com;
    ssl_certificate      /opt/ssl/wnote.com.cer;
    ssl_certificate_key  /opt/ssl/wnote.com.key;
    ssl_session_timeout  5m;
    ssl_session_cache    shared:SSL:1m;
    ssl_ciphers          ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:aNULL:!MD5:!ADH:!RC4;
    ssl_protocols        TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers  on;

    location / {
        root   /opt/wnote.com;
        index  index.html index.htm;
    }
}

server {
    listen 80;
    server_name wnote.com;
    rewrite ^ https://$host$1 permanent;
}

That concludes our guide on issuing and automatically renewing free SSL certificates (including wildcard domains) using acme.sh.

A Recommended Markdown Tool for Writing Books — Possibly a GitBook Alternative

wzdushu@gmail.com (wanzi) — Thu, 06 Oct 2022 21:38:52 +0800

Introduction to mdBook

mdBook is a command-line tool written in Rust for creating books using Markdown. It’s ideal for crafting product or API documentation, tutorials, course materials, or any content requiring a clean, navigable, and customizable presentation. Functionally similar to GitBook, its greatest advantage lies in speed.

Lightweight, Markdown-based syntax
Built-in search functionality
Syntax highlighting
Multiple themes for customizing output appearance
Preprocessors support — extend markdown rendering by modifying content before processing
Backend support for multiple output formats
Speed — built with Rust, performance is excellent
Even supports automated testing of Rust code

Installing mdBook

Since mdBook is developed in Rust, you need to install Rust first.

Install Rust:

# curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
......
Rust is installed now. Great!

To get started you may need to restart your current shell.
This would reload your PATH environment variable to include
Cargo's bin directory ($HOME/.cargo/bin).

To configure your current shell, run:
source "$HOME/.cargo/env"
# cargo version
cargo 1.65.0 (4bc8f24d3 2022-10-20)

After installing Rust, build and install mdBook via the command line. Once completed:

# cargo install mdbook
    Updating crates.io index
  Installing mdbook v0.4.21
  Downloaded os_str_bytes v6.4.0
  Downloaded chrono v0.4.23
  Downloaded 2 crates (210.4 KB) in 1.30s
  ......
   Compiling libc v0.2.137
   Compiling mdbook v0.4.21
    Finished release [optimized] target(s) in 1m 12s
  Installing /Users/wanzi/.cargo/bin/mdbook
   Installed package `mdbook v0.4.21` (executable `mdbook`) # Indicates successful installation
# mdbook --version
mdbook v0.4.21
# tree -L 2 ~/.cargo
/Users/wanzi/.cargo
├── bin
│   ├── cargo
│   ├── cargo-clippy
│   ├── cargo-fmt
│   ├── cargo-miri
│   ├── clippy-driver
│   ├── mdbook # Confirms installation
│   ├── rls
│   ├── rust-gdb
│   ├── rust-gdbgui
│   ├── rust-lldb
│   ├── rustc
│   ├── rustdoc
│   ├── rustfmt
│   └── rustup
├── env
└── registry
    ├── CACHEDIR.TAG
    ├── cache
    ├── index
    └── src

If you want the latest version, use this method instead:

`1`	`cargo install --git https://github.com/rust-lang/mdBook.git mdbook`

Writing an eBook with mdBook

Initialize a new book named devops-manual:

# mdbook init devops-manual
Do you want a .gitignore to be created? (y/n)
y
What title would you like to give the book?
devops-manual
2022-10-06 13:59:33 [INFO] (mdbook::book::init): Creating a new book with stub content

All done, no errors...
# tree devops-manual
devops-manual
├── book
├── book.toml
└── src
    ├── SUMMARY.md
    └── chapter_1.md

2 directories, 3 files

Start mdBook to preview locally:

# mdbook serve --open
2022-10-06 14:04:05 [INFO] (mdbook::book): Book building has started
2022-10-06 14:04:05 [INFO] (mdbook::book): Running the html backend
2022-10-06 14:04:05 [INFO] (mdbook::cmd::serve): Serving on: http://localhost:3000
2022-10-06 14:04:05 [INFO] (mdbook): Opening web browser
2022-10-06 14:04:05 [INFO] (warp::server): Server::run; addr=127.0.0.1:3000
2022-10-06 14:04:05 [INFO] (warp::server): listening on http://127.0.0.1:3000
2022-10-06 14:04:05 [INFO] (mdbook::cmd::watch): Listening for changes...

The --open flag automatically opens your default web browser to view the book.

Directory Structure of a New mdBook Project

book.toml: Configuration file describing how to build the eBook, written in TOML format
SUMMARY.md: Located at src/SUMMARY.md, this file lists all chapters in the book. You must add each chapter here before it can be viewed.
src: Contains the source files for the book. Each chapter has its own Markdown file.
book: Stores the generated HTML files. After running mdbook build, static files for the eBook are generated here, ready to be hosted on services like GitHub Pages.

Now, to write a DevOps eBook, simply define your structure, then write each chapter one by one.

For example, here’s my devops-manual/SUMMARY.md:

# Summary

[Introduction](README.md)

# DevOps Engineering

- [DevOps](xops/devops.md)

# DevOps Toolchain

- [Basic Tools](base/readme.md)
  - [Git](base/git.md)
  - [Docker](base/docker.md)
  - [Makefile](base/makefile.md)

- [Product Requirements](project/readme.md)
  - [Jira](project/jira.md)
  - [PingCode](project/jira.md)

- [Code Management](code/readme.md)
  - [GitLab](code/gitlab.md)
  - [GitHub](code/github.md)
  - [Gerrit](code/Gerrit.md)

- [Testing & Security Scanning](test/readme.md)
  - [JMeter](test/jmeter.md)
  - [SonarQube](test/sonarqube.md)
  - [Black Duck](test/blackduck.md)
  - [Fortify](test/fortify.md)

- [Build & Compilation](makebuild/readme.md)
  - [Maven](makebuild/maven.md)
  - [Gradle](makebuild/gradle.md)
  - [Node](makebuild/node.md)
  - [NPM](makebuild/npm.md)
  - [Cargo](makebuild/cargo.md)

- [Artifact Repository](hub/readme.md)
  - [Harbor](hub/harbor.md)
  - [Nexus](hub/nexus.md)
  - [JFrog Artifactory](hub/jfrog.md)

- [Automated Deployment](autodeploy/readme.md)
  - [Ansible](autodeploy/ansible.md)
  - [ArgoCD](autodeploy/argocd.md)
  - [Helm](autodeploy/helm.md)
  - [Kustomize](autodeploy/kustomize.md)

- [Logging & Monitoring Stack](logmonitor/readme.md)
  - [EFK](logmonitor/efk.md)
  - [Prometheus](logmonitor/prometheus.md)
  - [Grafana](logmonitor/grafana.md)
  - [Loki](logmonitor/loki.md)
  - [SkyWalking](logmonitor/skywalking.md)
  - [Jaeger](logmonitor/jaeger.md)
  - [Pinpoint](logmonitor/pinpoint.md)

- [Other Tools](others/readme.md)
  - [Rancher](others/rancher.md)
  - [JumpServer](others/jumpserver.md)
  - [Nacos](others/nacos.md)
  - [Consul](others/consul.md)
  - [Traefik](others/apisix.md)
  - [API7](others/apisix.md)
  - [Terraform](others/terraform.md)
  - [Pulumi](others/pulumi.md)
  - [Vault](others/vault.md)

- [Programming Languages](language/readme.md)
  - [Shell](language/shell.md)
  - [Python](language/python.md)
  - [Golang](language/golang.md)

- [Frameworks & Modules](framework/readme.md)
  - [Gin](framework/gin.md)
  - [Vue](framework/vue.md)
  - [React-antd](framework/antd.md)
  - [Django](framework/django.md)
  - [Bootstrap](framework/bootstrap.md)
  - [Swagger](framework/swagger.md)
  - [Postman](framework/postman.md)
  - [ApiPost7](framework/apipost7.md)
  - [RBAC](framework/rbac.md)
  - [JWT](framework/jwt.md)

- [XOPS](xops/xops.md)
  - [GitOps](xops/gitops.md)
  - [AI Ops](xops/aiops.md)
  - [MLOps](xops/mlops.md)
  - [FinOps](xops/finops.md)
  - [DevSecOps](xops/devsecops.md)
  - [DevDBOps](xops/devdbops.md)
  - [Chaos Engineering](xops/hundun.md)

After completing these steps, just run mdbook build, map the book directory to your Nginx root path, and configure the virtual host — isn’t that simple?

Build a Personal Blog with Hugo + GitHub

wzdushu@gmail.com (wanzi) — Tue, 10 Mar 2020 16:22:42 +0800

Introduction to Hugo

Previously, I used Hexo to build my blog. As I’ve been using Go more and more, I’ve wanted to migrate my blog to Hugo. Hugo is a static site generator written in Go—simple, easy to use, efficient, extensible, and fast to deploy.

Installing Hugo

Here’s how to install Hugo on macOS:

brew install hugo
hugo new site wanzi
cd wanzi
git clone https://github.com/xianmin/hugo-theme-jane.git --depth=1 themes/jane
cp -r themes/jane/exampleSite/content ./
cp themes/jane/exampleSite/config.toml ./

Update config.toml with your own blog information.

My website directory structure looks like this:

.
├── LICENSE
├── archetypes # Stores default.md, the template for post headers
│   └── default.md
├── config.toml
├── content # Global configuration for the entire site
│   ├── about.md
│   └── post
├── data # Stores data or configurations (JSON, TOML, YAML)
├── layouts # Contains template files for the site
├── public # Static files generated after Hugo compilation
│   ├── 404.html
│   ├── about
│   ├── atom.xml
│   ├── categories
│   ├── css
│   ├── favicon.ico
│   ├── fonts
│   ├── icons
│   ├── index.html
│   ├── js
│   ├── manifest.json
│   ├── mark
│   ├── posts
│   ├── robots.txt
│   ├── rss.xml
│   ├── sitemap.xml
│   └── tags
├── resources
│   └── _gen
├── static # Stores static assets like images, CSS, JS
└── themes # Stores website themes
    └── jane

Writing Posts

`1`	`hugo new content/posts/git-commands-base.md`

Push to GitHub

cd wanzi/public
git init 
git remote add origin https://github.com/iwz2099/wanzi
echo "wnote.com" > CNAME
git add -A
git commit -m "initialization"
git push -u origin master

If you’re using a custom domain, simply create a CNAME file in your GitHub repository and add your domain name (e.g., wnote.com). This will allow visitors to access your blog via your custom domain.

Stunning Terminal Configuration on macOS (oh-my-zsh)

wzdushu@gmail.com (wanzi) — Sat, 10 Nov 2018 10:22:42 +0800

brew Tool

Official Website: https://brew.sh

Install brew:

`1`	`/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"`

Switch brew source to domestic mirror:

git -C "$(brew --repo)" remote set-url origin https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/brew.git
git -C "$(brew --repo homebrew/core)" remote set-url origin https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/homebrew-core.git
git -C "$(brew --repo homebrew/cask)" remote set-url origin https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/homebrew-cask.git
export HOMEBREW_BOTTLE_DOMAIN=https://mirrors.aliyun.com/homebrew/homebrew-bottles # Add to ~/.zshrc
brew update  # Update Homebrew
brew upgrade # Upgrade all installed packages
brew cleanup # Clean up old versions after upgrade

iTerm2

Install iTerm2:

`1`	`brew cask install iterm2`

Configuration:

Preferences → Appearance → Theme: Choose your preferred theme (I selected Light)
Preferences → Profiles → Colors: Customize colors as desired

Oh My Zsh

Official Website: https://ohmyz.sh

Install Oh My Zsh:

`1`	`sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"`

All available Oh My Zsh themes: https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
All Oh My Zsh plugins: https://github.com/ohmyzsh/ohmyzsh/wiki/Plugins

Stylish Theme

I chose my favorite theme: spaceship-prompt

Install required font and set FiraCode:

git clone https://github.com/powerline/fonts
cd fonts
./install.sh
brew tap homebrew/cask-fonts
brew cask install font-fira-code

Font selection: Fira Code

That’s it — my stunning terminal is now ready!

Issuing Certificates Using OpenSSL

wzdushu@gmail.com (wanzi) — Fri, 25 May 2018 13:22:42 +0800

Generate Client Private Key:

`1`	`openssl genrsa -out server.key 2048`

Generate Client Certificate:

`1`	`openssl req -new -sha256 -x509 -days 3650 -key server.key -out server.crt`

Certificate Signing Request (CSR):

`1`	`openssl req -new -key server.key -out server.csr`

Generate CA Private Key

Encrypted with des3, requires a password of more than 4 characters:

`1`	`openssl genrsa -des3 -out ca.key 4096`

Generate CA Certificate

`1`	`openssl req -new -x509 -days 3650 -key ca.key -out ca.crt`

Add the following configuration to the CA config file /private/etc/ssl/openssl.cnf (macOS system):

[ ca ]
default_ca       = ca_default

[ ca_default ]
dir          = /etc/ssl/diyca
certs        = $dir/certs
crl_dir      = $dir/crl
database     = $dir/index.txt
new_certs_dir = $dir/newcerts
Certificate   = $dir/cacert.pem
serial        = $dir/serial
crl           = $dir/crl.pem
private_key   = $dir/private/cakey.pem
default_md = md5
RANDFILE      = $dir/private/.rand
policy= policy_match

[ policy_match ]
countryName            = match
stateOrProvinceName    = match
organizationName       = match
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

[ policy_anything ]
countryName            = optional
stateOrProvinceName    = optional
localityName           = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = optional

Sign Certificate with CA:

`1`	`openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -days 3650`

The signed certificate is server.pem:

`1`	`cp /etc/ssl/diyca/newcerts/00.pem server.pem`

Now you can deploy server.key and server.pem on your web server. Note: self-signed certificates are not necessarily trusted by common browsers.