Linux – 0x2B|~0x2B

WordPress Hardening with Cloudflare

Posted on May 8, 2025 by gonwan — No Comments ↓

Now the site is under protection of Cloudflare. Some settings:

1. Cloudflare as CDN

Cloudflare DNS to configured to proxy the original server. The DNS is also served as CDN. It also adds IPv6, HTTP2 & HTTP3 support. Cloudflare IPs are whitelisted in the inbound rules of my upstream VPS. mod_remoteip is enabled in Apache2, and configure with RemoteIPHeader X-Forwarded-For for logging.

Go to SSL/TLS / Overview, set SSL/TLS encryption mode to Full (strict).

1.1 Redirect Rule: Redirect from root to www

Go to Rules/Overview to add a cache rule.

Request URL: https://gonwan.com/*
Target URL: https://www.gonwan.com/${1}
Preserve query string: true

Request URL: https://gonwan.com/*

Target URL: https://www.gonwan.com/${1}

Preserve query string: true

NOTE: wordpress does redirect root URL to www URL internally, to align with the Site Address settings in Settings/General. It can be observed by:

# curl -I "https://gonwan.com/" --resolve "gonwan.com:443:<original ip>"
HTTP/1.1 301 Moved Permanently
Date: Sun, 8 May 2025 17:42:48 GMT
Server: gws
X-Redirect-By: WordPress
Location: https://www.gonwan.com/
Content-Type: text/html; charset=UTF-8

# curl -I "https://gonwan.com/" --resolve "gonwan.com:443:<original ip>"

HTTP/1.1 301 Moved Permanently

Date: Sun, 8 May 2025 17:42:48 GMT

Server: gws

X-Redirect-By: WordPress

Location: https://www.gonwan.com/

Content-Type: text/html; charset=UTF-8

I just delegated this job to Cloudflare.

2. Security Settings

2.1 Security Headers

In Rules/Settings, check Add security headers. It adds 3 headers in response: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN and X-XSS-Protection: 1; mode=block.

2.2 WAF Rule: Challenge empty referer

Only pseudo code is used to describe the rules, to keep it a secret from web crawlers. Go to Security/WAF.

(!req.is_ssl && !req.is_root && !req.is_lets_encrypt)
|| (req.user_agent == "")
|| (req.referer == "" && req.url.is_wordpress_post_url && !req.is_known_bot)

(!req.is_ssl && !req.is_root && !req.is_lets_encrypt)

|| (req.user_agent == "")

|| (req.referer == "" && req.url.is_wordpress_post_url && !req.is_known_bot)

I actually merge several rules into one, since only 5 rules can be added for a free Cloudflare plan. Here, we allow Let's Encrypt to bypass the rule. Their servers renew certificates through plain Http requests.

2.3 WAF Rule: Block `xmlrpc.php`

(req.url == "/xmlrpc.php")
|| (req.url == "/wp-login.php")
|| (req.url.starts_with("/wp-config"))
|| (req.url.starts_with("/wp-admin") && (req.is_logging_in or req.is_logged_in))

(req.url == "/xmlrpc.php")

|| (req.url == "/wp-login.php")

|| (req.url.starts_with("/wp-config"))

|| (req.url.starts_with("/wp-admin") && (req.is_logging_in or req.is_logged_in))

Here, we fixed several wordpress security holes by blocking them. xmlrpc.php is only cared by malicious crawlers. wp-login.php is blocked, since I have moved the login entrance to somewhere else. wp-config* is certainly blocked. It may become wp-config.php.txt or wp-config.php.bak one day when you backup the config, and your password is exposed. /wp-admin* is certainly blocked. No wordpress plugin should access it, it is a design defect.

2.4 WAF Rule: Block bots

(req.is_baidu)
|| (req.is_ahrefsbot)
|| (req.is_mj12bot)

(req.is_baidu)

|| (req.is_ahrefsbot)

|| (req.is_mj12bot)

Here, we block 3 crawlers. Actually only Baidu spider is required, it ignores robots.txt.

2.5 WAF Rule: Block flood

(!req.url.is_wordpress_post_url and !req.url.is_one_of("css", "js", "gif", "jpg", "png", "woff"))
|| (req.url.is("php"))

1 2	(!req.url.is_wordpress_post_url and !req.url.is_one_of("css", "js", "gif", "jpg", "png", "woff")) \|\| (req.url.is("php"))

This is a rate limiting rule. Only 1 rule can be used for a free Cloudflare plan. We limit malicious access to php and uncommon resource file types. Cloudflare does have DDOS protection in the free plan. I just add one more.

3. Cache Settings

3.1 Configure Default Browser Cache TTL

In Caching/Configuration, set Browser Cache TTL to Respect Existing Headers.

3.2 Cache Rule: Cache resources

Go to Rules/Overview to add a cache rule.

(req.url.extension.is_one_of("css", "js", "gif", "jpg", "png", "svg", "ico", "woff", "woff2"))

1	(req.url.extension.is_one_of("css", "js", "gif", "jpg", "png", "svg", "ico", "woff", "woff2"))

Cache eligibility: Eligible for cache
Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not
Status code TTL: 401-404 --> 1month, 200 --> 1month

Cache eligibility: Eligible for cache

Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not

Status code TTL: 401-404 --> 1month, 200 --> 1month

Edge TTL specifies how long Cloudflare should cache the response, distinguish from Browser TTL. Default TTL for 404 is 3m, while for 200 is 120m. See here. Resource files in wordpress are request by a version parameter to invalidate themself. 120m is a too short duration for them.
Cache control can also be configured in the original server. But I choose to adopt Cloudflare.

3.3 Cache Rule: Cache major pages

(req.url.is_root)
|| (req.url.is_wordpress_post_url)

1 2	(req.url.is_root) \|\| (req.url.is_wordpress_post_url)

Cache eligibility: Eligible for cache
Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not
Status code TTL: 401-404 --> 1month, 200 --> no-cache

Cache eligibility: Eligible for cache

Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not

Status code TTL: 401-404 --> 1month, 200 --> no-cache

Yes, we cache error pages, to offload the workload of original server. Major pages are defined as root page(/) and individual wordpress post pages. Cloudflare gives 512M cache space for a free plan, see here.
Couldflare does not cache HTML by default, explicit configuration is required, see here (It does cache robots.txt). Cloudflare returns cf-cache-status: DYNAMIC response header by default. With our configuration, it returns cf-cache-status: EXPIRED. A bit strange, but this is my desired behavior. Explanation here:

HIT: The resource was served from the Cloudflare cache
MISS: There was a cache miss and the resource was served from the origin server
DYNAMIC: The resource was not eligible to be cached based on your Cloudflare cache rules
BYPASS: The resource would normally be cached, by was the behavior was overridden by a cache-control header or because the origin server set a cookie
EXPIRED: Cloudflare found a stale resource in the cache and had to fetch it again

Custom filter expression is selected for incoming requests matching. Since All incoming requests also matches php file, which is used by wordpress admin console. It will be a mess if all admin functions are cached.

3.4 Cache Rule: Cache minor pages

(!req.url.is_root)
&& (!req.url.is_wordpress_post_url)
&& (req.url.extension.is_one_of("htm", "html", ""))

(!req.url.is_root)

&& (!req.url.is_wordpress_post_url)

&& (req.url.extension.is_one_of("htm", "html", ""))

Cache eligibility: Eligible for cache
Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not
Status code TTL: 401-404 --> 1month, 200 --> 7days

Cache eligibility: Eligible for cache

Edge TTL: Use cache-control header if present, cache request with Cloudflare's default TTL for the response status if not

Status code TTL: 401-404 --> 1month, 200 --> 7days

Error pages are also cached here. Minor pages are like /tags/... and /category/.... They are updated in 7 days.

4. Conclusion

With all configurations above, the cache hit rate is about 70% – 90% in average. All configurations are monitored and adjusted this week. WordPress is a legacy monolithic application. It is all-purpose and it can do almost anything regarding content management with plugins. It mixes frontend and backend. It mixes content service and content administration. All those mess make it tricky to setup and tweak correctly.

Some alternatives are found:
Ghost: The most ideal one, with some drawbacks. a. It does not use html or markdown for contents. b. Plugin installation may require manual file operations. File overwrites are possible. c. Is a raw customized html page possible?
Kirby: It is lightweight, but I do not want php any more.
Strapi and other headless CMS: not so user friendly or costs time to adapt.

Maybe a simple SSG-based blog is the final destination. No more php, no more CDN, no more endless plugins, no more tricky config and hardening work.

Some WordPress Hardening Work

Posted on April 29, 2025 by gonwan — No Comments ↓

1. Disable File Access

<Files "wp-config.php">
  Require all denied
</Files>
<Files "xmlrpc.php">
  Require all denied
</Files>

Require all denied

</Files>

Require all denied

</Files>

2. Disable `wp-cron.php`

See here.

The default method works perfectly fine on a small site with very few visitors per hour. However, when implemented on a medium or larger site or even a site that is being scanned by bots (which is very common these days), this means you get twice fold whatever traffic you are currently handling. It becomes a rudimentary DDoS attack against yourself.

Add define('DISABLE_WP_CRON', true); to wp-config.php.

3. Disable Pingback in Comments

Go to Settings –> Discussion, uncheck Allow link notifications from other blogs (pingbacks and trackbacks) on new posts.

4. Disable Json API

Via Disable WP REST API. Activate and it just works.

5. Hide Login Page

Via WPS Hide Login.

6. Hide Server Info

Via mod_security. Install and add config in /etc/apache2/mods-enabled/security2.conf:

SecServerSignature "gws"

1	SecServerSignature "gws"

7. Disallow IFrame Embedding

To avoid clickjacking attacks:

Header always set X-Frame-Options "SAMEORIGIN"

1	Header always set X-Frame-Options "SAMEORIGIN"

8. Add reCAPTCHA

Via Advanced Google reCAPTCHA.

9. Refine `robots.txt`

Via WP Robots Txt:

User-agent: AhrefsBot
User-agent: MJ12bot
User-agent: Baiduspider
Disallow: /

User-agent: *
Disallow: /author/
Disallow: /page
Disallow: /wp-admin/

Sitemap: https://www.gonwan.com/wp-sitemap.xml

User-agent: AhrefsBot

User-agent: MJ12bot

User-agent: Baiduspider

Disallow: /

User-agent: *

Disallow: /author/

Disallow: /page

Disallow: /wp-admin/

Sitemap: https://www.gonwan.com/wp-sitemap.xml

The /wp-admin/admin-ajax.php path is allowed by default, see here and here. Simply remove it.
Updated May 8, 2025: It seems Baiduspider ignores robots.txt, since no access log for the file is found in latest 5 years. Simply blocked it in Cloudflare WAF.

10. More Fail2ban Rules

Including 400/403/404 errors, directory listing filters, and subnet bannning.

Uniform look for Qt and GTK applications

Posted on April 13, 2025 by gonwan — No Comments ↓

See: https://wiki.archlinux.org/title/Uniform_look_for_Qt_and_GTK_applications

Theme: The custom appearance of an application, widget set, etc. It usually consists of a style, an icon theme and a color theme.
Style: The graphical layout and look of the widget set.
Icon Theme: A set of global icons.
Color Theme: A set of global colors that are used in conjunction with the style.

Actually a theme also controls fonts, and native dialogs, like open file dialog. How to write a Qt style is covered here.

I’m running Linuxmint 22 with Arc theme on my desktop. Fusion theme is used by default for Qt applications. They removed qt5ct in Linuxmint 22 in a fresh install. But it seems to be the best solution so far. Following is a comparison among the possible approaches, when run a Qt application. Which means launch a Qt application by:

# QT_DEBUG_PLUGINS=1 QT_AUTO_SCREEN_SCALE_FACTOR=1 QT_QPA_PLATFORMTHEME=?? QT_STYLE_OVERRIDE=?? <app>  
# QT_DEBUG_PLUGINS=1 QT_AUTO_SCREEN_SCALE_FACTOR=1 QT_QPA_PLATFORMTHEME=qt5ct QT_STYLE_OVERRIDE= vlc

1 2	# QT_DEBUG_PLUGINS=1 QT_AUTO_SCREEN_SCALE_FACTOR=1 QT_QPA_PLATFORMTHEME=?? QT_STYLE_OVERRIDE=?? <app> # QT_DEBUG_PLUGINS=1 QT_AUTO_SCREEN_SCALE_FACTOR=1 QT_QPA_PLATFORMTHEME=qt5ct QT_STYLE_OVERRIDE= vlc

	has theme?	has style?	QT_QPA_ PLATFORMTHEME	QT_STYLE_ OVERRIDE	Description
Gtk2	Yes	Yes	gtk2	gtk2 or empty	Good for widgets, indicators in radio button and checkbox can be styled, follows current Gtk theme. But It has HiDPI issues, and certainly not maintained.
Gtk3	Yes	No	gtk3 or empty	values in qt5ct	No style plugin. Fusion is used by default, which is not consistent with other themed Gtk applications.
qt5ct	Yes	Yes	qt5ct	values in qt5ct	A proxy style used, amost no difference to the default style. Fusion is used by default, which is not consistent with other themed Gtk applications. Color scheme and font can be further customized. Button indicators are not styled.
Kvantum	Yes	Yes	qt5ct	kvantum	Use Kvantum Manager to further customize the theme. Button indicators are styled. KvArc theme is provided, but is still somehow different in visual. Kvantum also installs several KDE component, which is odd.

So my final solution is: using qt5ct with customized color scheme and font. Color scheme defined:

[ColorScheme]
active_colors=   #5c616c, #f5f6f7, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #5c616c, #000000, #5c616c, #ffffff, #f5f6f7, #000000, #5294e2, #ffffff, #5294e2, #5c616c, #f3f3f3, #000000, #4b5162, #d3dae3, #805c616c
disabled_colors= #a9acb2, #fbfcfc, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #a9acb2, #000000, #a9acb2, #f5f6f7, #fbfcfc, #000000, #5294e2, #ffffff, #5294e2, #a9acb2, #f3f3f3, #000000, #4b5162, #d3dae3, #80a9acb2
inactive_colors= #5c616c, #f5f6f7, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #5c616c, #000000, #5c616c, #ffffff, #f5f6f7, #000000, #5294e2, #ffffff, #5294e2, #5c616c, #f3f3f3, #000000, #4b5162, #d3dae3, #805c616c

[ColorScheme]

active_colors= #5c616c, #f5f6f7, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #5c616c, #000000, #5c616c, #ffffff, #f5f6f7, #000000, #5294e2, #ffffff, #5294e2, #5c616c, #f3f3f3, #000000, #4b5162, #d3dae3, #805c616c

disabled_colors= #a9acb2, #fbfcfc, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #a9acb2, #000000, #a9acb2, #f5f6f7, #fbfcfc, #000000, #5294e2, #ffffff, #5294e2, #a9acb2, #f3f3f3, #000000, #4b5162, #d3dae3, #80a9acb2

inactive_colors= #5c616c, #f5f6f7, #ffffff, #f3f3f3, #9f9d9a, #b8b5b2, #5c616c, #000000, #5c616c, #ffffff, #f5f6f7, #000000, #5294e2, #ffffff, #5294e2, #5c616c, #f3f3f3, #000000, #4b5162, #d3dae3, #805c616c

[ColorScheme]
active_colors=   #d3dae3, #383c4a, #979797, #5e5c5b, #302f2e, #4a4947, #d3dae3, #ffffff, #d3dae3, #404552, #383c4a, #000000, #5294e2, #ffffff, #5294e2, #d3dae3, #3e4350, #000000, #4b5162, #d3dae3, #80d3dae3
disabled_colors= #7c818c, #3e4350, #979797, #5e5c5b, #302f2e, #4a4947, #7c818c, #ffffff, #7c818c, #383c4a, #3e4350, #000000, #5294e2, #ffffff, #5294e2, #7c818c, #3e4350, #000000, #4b5162, #d3dae3, #807c818c
inactive_colors= #d3dae3, #383c4a, #979797, #5e5c5b, #302f2e, #4a4947, #d3dae3, #ffffff, #d3dae3, #404552, #383c4a, #000000, #5294e2, #ffffff, #5294e2, #d3dae3, #3e4350, #000000, #4b5162, #d3dae3, #80d3dae3

[ColorScheme]

active_colors= #d3dae3, #383c4a, #979797, #5e5c5b, #302f2e, #4a4947, #d3dae3, #ffffff, #d3dae3, #404552, #383c4a, #000000, #5294e2, #ffffff, #5294e2, #d3dae3, #3e4350, #000000, #4b5162, #d3dae3, #80d3dae3

disabled_colors= #7c818c, #3e4350, #979797, #5e5c5b, #302f2e, #4a4947, #7c818c, #ffffff, #7c818c, #383c4a, #3e4350, #000000, #5294e2, #ffffff, #5294e2, #7c818c, #3e4350, #000000, #4b5162, #d3dae3, #807c818c

inactive_colors= #d3dae3, #383c4a, #979797, #5e5c5b, #302f2e, #4a4947, #d3dae3, #ffffff, #d3dae3, #404552, #383c4a, #000000, #5294e2, #ffffff, #5294e2, #d3dae3, #3e4350, #000000, #4b5162, #d3dae3, #80d3dae3

Copy those 2 file into ~/.config/qt5ct/color, open qt5ct:

Go to Appearance –> Platte –> Check custom and select arc.
Go to Fonts –> Select your Gnome/Cinnamon font.
Go to Icon Theme –> Select your Gnome/Cinnamon icon theme.
Open ~/.config/qt5ct/qt5ct.conf, change standard_dialogs=default to standard_dialogs=gtk3.

See the difference:
vlc_default
vlc_themed

Updated May 4, 2025, there is a refined arc-theme called Qogir, which provides Qt & KDE themes as well. The Qt theme is based on awaita-qt.

Upgrading Ubuntu 24.04 Network Configuration

Posted on April 12, 2025 by gonwan — No Comments ↓

Debian/Ubuntu and RHEL/AlmaLinux have different network configuration utilities. RHEL 9 has deprecated ifcfg-files, and adopted NetworkManager. There is no ifup or ifdown any more after a fresh installation. Since my server was first installed using Ubuntu 14.04, it still uses these scripts. Time to move on.

1. ifupdown

Netplan is used to configure networking in Ubuntu 18.04 and later. Ubuntu Server is packaged with systemd-networkd as the backend for Netplan, while NetworkManager is used as the Netplan backend in Ubuntu Desktop. Install by:

# sudo apt-get install netplan.io

1	# sudo apt-get install netplan.io

Get current network status by:

# sudo netplan status
...
●  1: lo ethernet UNKNOWN/UP (unmanaged)
      MAC Address: 00:00:00:00:00:00
...
●  3: eth0 ethernet UP (unmanaged)
      MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)
...

# sudo netplan status

...

● 1: lo ethernet UNKNOWN/UP (unmanaged)

MAC Address: 00:00:00:00:00:00

...

● 3: eth0 ethernet UP (unmanaged)

MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)

...

eth0 is unmanaged, since ifupdown is used. The config file is /etc/network/interfaces.

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet dhcp

# This file describes the network interfaces available on your system

# and how to activate them. For more information, see interfaces(5).

# The loopback network interface

auto lo

iface lo inet loopback

# The primary network interface

auto eth0

iface eth0 inet dhcp

2. networkd

Create a config file /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true

network:

version: 2

ethernets:

eth0:

dhcp4: true

This file is create by cloud-init if fresh installed. I kept the name. networkd comes with systemd, no need to install it again. Apply it by:

# sudo netplan generate
# sudo netplan try

1 2	# sudo netplan generate # sudo netplan try

Now, eth0 should be managed by networkd:

# sudo netplan status
...
●  1: lo ethernet UNKNOWN/UP (unmanaged)
      MAC Address: 00:00:00:00:00:00
...
●  3: eth0 ethernet UP (networkd: eth0)
      MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)
...

# sudo netplan status

...

● 1: lo ethernet UNKNOWN/UP (unmanaged)

MAC Address: 00:00:00:00:00:00

...

● 3: eth0 ethernet UP (networkd: eth0)

MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)

...

The generated config file can be found in /run/systemd/network/10-netplan-eth0.network. System config files located in /etc/systemd/networkd.conf & /usr/lib/systemd/network/.

3. NetworkManager

NetworkManager can also be used for servers. Install by:

# sudo apt-get install network-manager network-manager-config-connectivity-ubuntu

1	# sudo apt-get install network-manager network-manager-config-connectivity-ubuntu

Create a config file /etc/netplan/01-network-manager-all.yaml.

# Let NetworkManager manage all devices on this system
network:
  version: 2
  renderer: NetworkManager

# Let NetworkManager manage all devices on this system

network:

version: 2

renderer: NetworkManager

This file is create by Ubuntu installer if fresh installed. I kept the name. Verify the merged config by running:

# sudo netplan get
network:
  version: 2
  renderer: NetworkManager
  ethernets:
    eth0:
      dhcp4: true

# sudo netplan get

network:

version: 2

renderer: NetworkManager

ethernets:

eth0:

dhcp4: true

NOTE, one additional step need to be performed, /etc/network/interfaces must *not* exist. NetworkManager has a plugin to parse the file. Backup it, so that you can roll back to ifupdown if something goes wrong. Apply it by:

# sudo netplan generate
# sudo netplan try

1 2	# sudo netplan generate # sudo netplan try

Now, eth0 should be managed by NetworManager:

# sudo netplan status
...
●  1: lo ethernet UNKNOWN/UP (unmanaged)
      MAC Address: 00:00:00:00:00:00
...
●  3: eth0 ethernet UP (NetworManager: eth0)
      MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)
...

# sudo netplan status

...

● 1: lo ethernet UNKNOWN/UP (unmanaged)

MAC Address: 00:00:00:00:00:00

...

● 3: eth0 ethernet UP (NetworManager: eth0)

MAC Address: f2:3c:91:6e:3b:e1 (Red Hat, Inc.)

...

The generated config file can be found in /run/NetworkManager/system-connections/netplan-eth0.nmconnection. System config files located in /etc/NetworkManager/NetworkManager.conf & /usr/lib/NetworkManager/. On systems before RHEL 9, /run may be /var/run. When NetworkManager starts and finds no connection for a device it might create an in-memory connection. No config file is created. The no-auto-default configuration disables that behavior. Check systemd log for details:

# sudo journalctl -u NetworkManager
...
ifcfg-rh: add connection in-memory (a05d8c6f-fa6f-34c9-bee0-09b029470893,"Wired connection 1")
...

# sudo journalctl -u NetworkManager

...

ifcfg-rh: add connection in-memory (a05d8c6f-fa6f-34c9-bee0-09b029470893,"Wired connection 1")

...

More info can be found in Debian documents. Useful commands include: NetworkManager --print-config, nmcli device & nmcli connection.

4. Clean ups

Now, you can safely remove ifupdown, and the networking systemd service will be removed too.

# sudo apt-get purge ifupdown

1	# sudo apt-get purge ifupdown

5. iptables

An ifupdown script was add to persist iptables rules.

# cat /etc/network/if-pre-up.d/firewall 
sudo /usr/sbin/iptables-restore < /etc/iptables.firewall.rules

1 2	# cat /etc/network/if-pre-up.d/firewall sudo /usr/sbin/iptables-restore < /etc/iptables.firewall.rules

This can be migrated by installing iptables-persistent:

# sudo apt-get install iptables-persistent

1	# sudo apt-get install iptables-persistent

11 Years of My Site

Posted on April 9, 2025 by gonwan — No Comments ↓

As the recorded by Linode, the site server was first launched on Apr 1, 2014. It was running Ubuntu 12.04. Later I setup wordpress and moved my blog here from Blogspot on Aug 16, 2024. Spurious Wakeups was my first post. Now, the server is running Ubuntu 24.04, and is using catch box theme with css customization:

@media screen and (width > 960px) {
  div#page.site {
    width: 1400px;
  }
  div#primary {
    width: calc(100% - 280px);
  }
  aside#secondary {
    width: 260px;
  }
}
.entry-content p {
  margin-bottom: 20px;
}
code {
  background-color: #f0f0f0;
  border-radius: 4px;
  padding: 4px 6px;
}

@media screen and (width > 960px) {

div#page.site {

width: 1400px;

}

div#primary {

width: calc(100% - 280px);

}

aside#secondary {

width: 260px;

}

.entry-content p {

margin-bottom: 20px;

}

code {

background-color: #f0f0f0;

border-radius: 4px;

padding: 4px 6px;

}

Just updated all plugins and found 3 problems.

1. Google Analytics 4

Google fully replaced Universal Analytics with Google Analytics 4 on July 1, 2024. Just noticed that, all visiting history are lost 🙁

2. Fail2ban not working

Fail2ban is not working anymore, due to the switch from iptables to nftables in Ubuntu 21.10. So it has broken for about 2 years, since my last upgrade to Ubuntu 22.04. Found the issue by running fail2ban-client -d. Simply revert the change in config sudo vi /etc/fail2ban/jail.d/defaults-debian.conf.

[DEFAULT]
#banaction = nftables
#banaction_allports = nftables[type=allports]
banaction = iptables-multiport
banaction_allports = iptables-allports
backend = systemd

[DEFAULT]

#banaction = nftables

#banaction_allports = nftables[type=allports]

banaction = iptables-multiport

banaction_allports = iptables-allports

backend = systemd

Since Fail2ban also updated its default backend from pyinotify to systemd(see above), backend should be also reverted in wordpress config sudo vi /etc/fail2ban/jail.d/wordpress.conf.

[wordpress-hard]
backend = pyinotify
enabled = true
filter = wordpress-hard
logpath = /var/log/auth.log
bantime = 86400
maxretry = 1
port = http,https

[wordpress-soft]
backend = pyinotify
enabled = true
filter = wordpress-soft
logpath = /var/log/auth.log
bantime = 3600
maxretry = 3
port = http,https

[wordpress-hard]

backend = pyinotify

enabled = true

filter = wordpress-hard

logpath = /var/log/auth.log

bantime = 86400

maxretry = 1

port = http,https

[wordpress-soft]

backend = pyinotify

enabled = true

filter = wordpress-soft

logpath = /var/log/auth.log

bantime = 3600

maxretry = 3

port = http,https

Make sure package python3-pyinotify and python3-systemd are installed. Restart Fail2ban.

3. Akismet not working

Akismet is reporting 500 errors. Details are found in logs: .../plugins/akismet/.htaccess: Require not allowed here. This is sloved by adding config to apache server to allow AuthConfig, in both http and https config files.

<Directory .../gonwan.com/public/>
  Require all granted
  AllowOverride AuthConfig FileInfo
</Directory>

Require all granted

AllowOverride AuthConfig FileInfo

</Directory>

Using vcpkg for C++ Package Management

Posted on September 28, 2022 by gonwan — No Comments ↓

Verified on CentOS7 and Windows 10.

1. Install v2ray and run proxy

nohup ./v2ray run config.json &
export http_proxy="socks5://localhost:xxxxx"
export https_proxy="socks5://localhost:xxxxx"

nohup ./v2ray run config.json &

export http_proxy="socks5://localhost:xxxxx"

export https_proxy="socks5://localhost:xxxxx"

v2ray unblocks github access from mainland China. Install v2ray clients and set IE proxy _only_ on Windows, bootstrap.bat & vcpkg.exe picks it automatically.

2. Download vcpkg from github and bootstrap

Download from: https://github.com/microsoft/vcpkg/releases

cd vcpkg-2022.08.15
./bootstrap-vcpkg.sh

1 2	cd vcpkg-2022.08.15 ./bootstrap-vcpkg.sh

Export vcpkg-2022.08.15 directory as ${VCPKG_ROOT}.

3. Install drogon framework for demo

The drogon framework is a high performance application framework, including client & server supports. vcpkg builds static(*.a) library by default, use x64-linux-dynamic for dynamic(*.so) library. The repo version requires g++-8 to build, install from CentOS SCL:

yum install centos-release-scl
yum install devtoolset-8
echo '. /opt/rh/devtoolset-8/enable' | tee -a /etc/profile
. /etc/profile
# export CC=/opt/rh/devtoolset-8/root/usr/bin/gcc
# export CXX=/opt/rh/devtoolset-8/root/usr/bin/g++

yum install centos-release-scl

yum install devtoolset-8

echo '. /opt/rh/devtoolset-8/enable' | tee -a /etc/profile

. /etc/profile

# export CC=/opt/rh/devtoolset-8/root/usr/bin/gcc

# export CXX=/opt/rh/devtoolset-8/root/usr/bin/g++

To build with g++-7, manually install boost-filesystem package in vcpkg, and edit ${VCPKG_ROOT}/ports/drogon/portfile.cmake and comment out:

...
    #-DCMAKE_DISABLE_FIND_PACKAGE_Boost=ON
...

...

#-DCMAKE_DISABLE_FIND_PACKAGE_Boost=ON

...

On Windows, open the command line for Visual Studio develop environment.

./vcpkg search drogon
# linux, drogon[postgres] dynamic build is not well supported on linux
./vcpkg install drogon[ctl,mysql,orm,redis] --triplet=x64-linux-dynamic
# windows
vcpkg install drogon[ctl,mysql,orm,redis] --triplet=x64-windows

./vcpkg search drogon

# linux, drogon[postgres] dynamic build is not well supported on linux

./vcpkg install drogon[ctl,mysql,orm,redis] --triplet=x64-linux-dynamic

# windows

vcpkg install drogon[ctl,mysql,orm,redis] --triplet=x64-windows

If openssl build fails, run:

yum install perl-IPC-Cmd perl-Data-Dumper

1	yum install perl-IPC-Cmd perl-Data-Dumper

If other errors, try to update to recent github ports. In my case, libmariadb build failed, that have been fixed in master.

4. Export drogon framework

./vcpkg export drogon:x64-linux-dynamic --zip
# Zip archive exported at: ${VCPKG_ROOT}/vcpkg-export-20220928-102415.zip
# To use the exported libraries in CMake projects use:
#    -DCMAKE_TOOLCHAIN_FILE=[...]/scripts/buildsystems/vcpkg.cmake

./vcpkg export drogon:x64-linux-dynamic --zip

# Zip archive exported at: ${VCPKG_ROOT}/vcpkg-export-20220928-102415.zip

# To use the exported libraries in CMake projects use:

# -DCMAKE_TOOLCHAIN_FILE=[...]/scripts/buildsystems/vcpkg.cmake

5. Add a demo program

// drogon_server.cpp
#include <drogon/drogon.h>
using namespace drogon;

int main()
{
    app().registerHandler(
        "/text",
        [](const HttpRequestPtr &,
           std::function<void(const HttpResponsePtr &)> &&callback) {
            auto resp = HttpResponse::newHttpResponse();
            resp->setBody("Hello World!");
            callback(resp);
        },
        {Get});
    app().registerHandler(
        "/json",
        [](const HttpRequestPtr &,
           std::function<void(const HttpResponsePtr &)> &&callback) {
            Json::Value json;
            json["Message"] = "Hello World!";
            auto resp = HttpResponse::newHttpJsonResponse(json);
            callback(resp);
        },
        {Get});
    LOG_INFO << "Server running on 0.0.0.0:8099";
    app().addListener("0.0.0.0", 8099)
         .setThreadNum(24)
         .enableServerHeader(false)
         .enableDateHeader(false)
         //.enableRunAsDaemon()
         .run();
}

// drogon_server.cpp

#include <drogon/drogon.h>

using namespace drogon;

int main()

{

app().registerHandler(

"/text",

[](const HttpRequestPtr &,

std::function<void(const HttpResponsePtr &)> &&callback) {

auto resp = HttpResponse::newHttpResponse();

resp->setBody("Hello World!");

callback(resp);

{Get});

app().registerHandler(

"/json",

[](const HttpRequestPtr &,

std::function<void(const HttpResponsePtr &)> &&callback) {

Json::Value json;

json["Message"] = "Hello World!";

auto resp = HttpResponse::newHttpJsonResponse(json);

callback(resp);

{Get});

LOG_INFO << "Server running on 0.0.0.0:8099";

app().addListener("0.0.0.0", 8099)

.setThreadNum(24)

.enableServerHeader(false)

.enableDateHeader(false)

//.enableRunAsDaemon()

.run();

}

# CMakeLists.txt
cmake_minimum_required(VERSION 3.15)
project(drogon_server CXX)
set(CMAKE_CXX_STANDARD 17)
message("Got CMAKE_PREFIX_PATH: ${CMAKE_PREFIX_PATH}")
find_package(Drogon CONFIG REQUIRED)
add_executable(drogon_server drogon_server.cpp)
target_link_libraries(drogon_server PRIVATE Drogon::Drogon)

# CMakeLists.txt

cmake_minimum_required(VERSION 3.15)

project(drogon_server CXX)

set(CMAKE_CXX_STANDARD 17)

message("Got CMAKE_PREFIX_PATH: ${CMAKE_PREFIX_PATH}")

find_package(Drogon CONFIG REQUIRED)

add_executable(drogon_server drogon_server.cpp)

target_link_libraries(drogon_server PRIVATE Drogon::Drogon)

Linux dynamic build is community supported, invoke cmake with:

# linux
cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-linux-dynamic
# windows
cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-windows

# linux

cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-linux-dynamic

# windows

cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-windows

Now build with make or Visual Studio.

6. Stick to a specific version

add a vcpkg.json file:

{
  "name": "drogon-server",
  "version-string": "0.1.0",
  "dependencies": [
    { "name": "drogon", "version>=": "1.7.5", "features": [ "ctl", "mysql", "orm", "redis" ] },
    "openssl"
  ],
  "overrides": [
    { "name": "drogon", "version": "1.8.0" },
    { "name": "openssl", "version-string": "1.1.1n#1" }
  ],
  "builtin-baseline": "4e73d1b47a7e5428e2ea9dbec43b136a6632a7cb"
}

{

"name": "drogon-server",

"version-string": "0.1.0",

"dependencies": [

{ "name": "drogon", "version>=": "1.7.5", "features": [ "ctl", "mysql", "orm", "redis" ] },

"openssl"

"overrides": [

{ "name": "drogon", "version": "1.8.0" },

{ "name": "openssl", "version-string": "1.1.1n#1" }

"builtin-baseline": "4e73d1b47a7e5428e2ea9dbec43b136a6632a7cb"

}

It sticks to drogon 1.8.0 and openssl 1.1.1n. ${VCPKG_ROOT} now required to be a git repository. In your project directory, install specific versions of libraries by running:

# linux
./vcpkg --feature-flags="versions" install --triplet=x64-linux-dynamic
# windows
vcpkg --feature-flags="versions" install --triplet=x64-windows

# linux

./vcpkg --feature-flags="versions" install --triplet=x64-linux-dynamic

# windows

vcpkg --feature-flags="versions" install --triplet=x64-windows

Run cmake:

# linux
cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-linux-dynamic
# windows
cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-windows
cd build
make

# linux

cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-linux-dynamic

# windows

cmake -B build -S . -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=x64-windows

cd build

make

Now ldd output shows openssl 1.1 (default build is 3.0):

ldd drogon_server
        linux-vdso.so.1 =>  (0x00007ffc1bf9c000)
        libdrogon.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libdrogon.so.1 (0x00007fbbd2329000)
        libtrantor.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libtrantor.so.1 (0x00007fbbd1ea0000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fbbd1c84000)
        libjsoncpp.so.25 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libjsoncpp.so.25 (0x00007fbbd19ed000)
        libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fbbd16e5000)
        libm.so.6 => /lib64/libm.so.6 (0x00007fbbd13e3000)
        libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fbbd11cd000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fbbd0dff000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fbbd0bfb000)
        libmariadb.so.3 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libmariadb.so.3 (0x00007fbbd098d000)
        libz.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libz.so.1 (0x00007fbbd0769000)
        libssl.so.1.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libssl.so.1.1 (0x00007fbbd04d1000)
        libcrypto.so.1.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libcrypto.so.1.1 (0x00007fbbcffd7000)
        libbrotlidec.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlidec.so.1 (0x00007fbbcfdb6000)
        libbrotlienc.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlienc.so.1 (0x00007fbbcf85c000)
        libbrotlicommon.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlicommon.so.1 (0x00007fbbcf63a000)
        libhiredis.so.1.0.0 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libhiredis.so.1.0.0 (0x00007fbbcf424000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fbbd2ebc000)
        libcares.so.2 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libcares.so.2 (0x00007fbbcf205000)

ldd drogon_server

linux-vdso.so.1 => (0x00007ffc1bf9c000)

libdrogon.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libdrogon.so.1 (0x00007fbbd2329000)

libtrantor.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libtrantor.so.1 (0x00007fbbd1ea0000)

libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fbbd1c84000)

libjsoncpp.so.25 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libjsoncpp.so.25 (0x00007fbbd19ed000)

libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fbbd16e5000)

libm.so.6 => /lib64/libm.so.6 (0x00007fbbd13e3000)

libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fbbd11cd000)

libc.so.6 => /lib64/libc.so.6 (0x00007fbbd0dff000)

libdl.so.2 => /lib64/libdl.so.2 (0x00007fbbd0bfb000)

libmariadb.so.3 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libmariadb.so.3 (0x00007fbbd098d000)

libz.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libz.so.1 (0x00007fbbd0769000)

libssl.so.1.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libssl.so.1.1 (0x00007fbbd04d1000)

libcrypto.so.1.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libcrypto.so.1.1 (0x00007fbbcffd7000)

libbrotlidec.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlidec.so.1 (0x00007fbbcfdb6000)

libbrotlienc.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlienc.so.1 (0x00007fbbcf85c000)

libbrotlicommon.so.1 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libbrotlicommon.so.1 (0x00007fbbcf63a000)

libhiredis.so.1.0.0 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libhiredis.so.1.0.0 (0x00007fbbcf424000)

/lib64/ld-linux-x86-64.so.2 (0x00007fbbd2ebc000)

libcares.so.2 => ./vcpkg_installed/x64-linux-dynamic/debug/lib/libcares.so.2 (0x00007fbbcf205000)

The only difference is the existence of vcpkg.json file, when using versioning.

7. Binary caching

If you change the root path of vcpkg, better clean up the cache, or build may fail. It’s $HOME/.cache/vcpkg/archives under Linux, and %LOCALAPPDATA%\vcpkg\archives under Windows.

Optimizing Linux Performance in Virtual Machines

Posted on April 30, 2021 by gonwan — No Comments ↓

Bad performance after upgrading to Linux Mint 20 (Ubuntu 20.04 based). Solved by disabling transparent hugepage in kernel.

The grub approach survives a restart:

# sudo vi /etc/default/grub

1	# sudo vi /etc/default/grub

Find and replace GRUB_CMDLINE_LINUX line to:

GRUB_CMDLINE_LINUX="transparent_hugepage=never"

1	GRUB_CMDLINE_LINUX="transparent_hugepage=never"

Update grub and reboot:

# sudo update-grub

1	# sudo update-grub

Updated Oct 4, 2021: if using Windows guest, also use OpenGL render to avoid high CPU usage. Edit *.vmx file and add:

mks.enableMTLRenderer = "FALSE"
mks.enableGLRenderer = "TRUE"

1 2	mks.enableMTLRenderer = "FALSE" mks.enableGLRenderer = "TRUE"

Deploying Kubernetes Cluster on CentOS 7

Posted on July 30, 2018 by gonwan — No Comments ↓

It is painful to deploying a Kubernetes cluster in mainland China. The installation requires access to Google servers, which is not so easy for every one. Fortunately, there are mirrors or alternative ways. I’ll use Docker v1.13 and Kubernetes v1.11 in the article.

1. Install Docker

CentOS SCL should be enabled first.

# yum install centos-release-scl
# yum install docker

1 2	# yum install centos-release-scl # yum install docker

2. Install Kubernetes

2.1 Add the Aliyun mirror for Kubernetes packages

# cat << EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
       http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
# yum install -y kubelet kubectl kubeadm

# cat << EOF > /etc/yum.repos.d/kubernetes.repo

[kubernetes]

name=Kubernetes

baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64

enabled=1

gpgcheck=0

repo_gpgcheck=0

gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg

http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

EOF

# yum install -y kubelet kubectl kubeadm

2.2 Precheck OS environmemt

# kubeadm init --kubernetes-version=v1.11.1

1	# kubeadm init --kubernetes-version=v1.11.1

Run the init command by specify the version, the access to Google server is avoided. The script also advices you to turn off firewalld, swap, selinux and enable kernel parameters:

# systemctl stop firewalld
# systemctl disable firewalld
# swapoff -a
# setenforce 0

# systemctl stop firewalld

# systemctl disable firewalld

# swapoff -a

# setenforce 0

Open /etc/sysconfig/selinux, change enforcing to permissive.
Create /etc/sysctl.d/k8s.conf with content:

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1

1 2	net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1

# sysctl --system

1	# sysctl --system

Remember to comment out swap volumes from /etc/fstab.

2.3 Pull Kubernates images

Pull the Kubernetes images from docker/docker-cn mirror maintained by anjia0532. These are minimal images required for a Kubernetes master installation.

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64:v1.11.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64:v1.11.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64:v1.11.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.pause:3.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.etcd-amd64:3.2.18
# docker pull registry.docker-cn.com/anjia0532/google-containers.coredns:1.1.3

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64:v1.11.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64:v1.11.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64:v1.11.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.pause:3.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.etcd-amd64:3.2.18

# docker pull registry.docker-cn.com/anjia0532/google-containers.coredns:1.1.3

These version numbers comes from the kubeadm init command if you cannot access Google servers. These images should be retagged to gcr.io ones before next steps, or the kubeadm command line would not find them:

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64:v1.11.1 k8s.gcr.io/kube-apiserver-amd64:v1.11.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64:v1.11.1 k8s.gcr.io/kube-controller-manager-amd64:v1.11.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64:v1.11.1 k8s.gcr.io/kube-scheduler-amd64:v1.11.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1 k8s.gcr.io/kube-proxy-amd64:v1.11.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.pause:3.1 k8s.gcr.io/pause:3.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.etcd-amd64:3.2.18 k8s.gcr.io/etcd-amd64:3.2.18
# docker tag registry.docker-cn.com/anjia0532/google-containers.coredns:1.1.3 k8s.gcr.io/coredns:1.1.3

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64:v1.11.1 k8s.gcr.io/kube-apiserver-amd64:v1.11.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64:v1.11.1 k8s.gcr.io/kube-controller-manager-amd64:v1.11.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64:v1.11.1 k8s.gcr.io/kube-scheduler-amd64:v1.11.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1 k8s.gcr.io/kube-proxy-amd64:v1.11.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.pause:3.1 k8s.gcr.io/pause:3.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.etcd-amd64:3.2.18 k8s.gcr.io/etcd-amd64:3.2.18

# docker tag registry.docker-cn.com/anjia0532/google-containers.coredns:1.1.3 k8s.gcr.io/coredns:1.1.3

Now the output of docker images looks like:

REPOSITORY                                                                         TAG                 IMAGE ID            CREATED             SIZE
k8s.gcr.io/kube-apiserver-amd64                                                    v1.11.1             816332bd9d11        12 days ago         187 MB
registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64            v1.11.1             816332bd9d11        12 days ago         187 MB
k8s.gcr.io/kube-controller-manager-amd64                                           v1.11.1             52096ee87d0e        12 days ago         155 MB
registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64   v1.11.1             52096ee87d0e        12 days ago         155 MB
k8s.gcr.io/kube-scheduler-amd64                                                    v1.11.1             272b3a60cd68        12 days ago         56.8 MB
registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64            v1.11.1             272b3a60cd68        12 days ago         56.8 MB
k8s.gcr.io/kube-proxy-amd64                                                        v1.11.1             d5c25579d0ff        12 days ago         97.8 MB
registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64                v1.11.1             d5c25579d0ff        12 days ago         97.8 MB
k8s.gcr.io/pause                                                                   3.1                 da86e6ba6ca1        7 months ago        742 kB
registry.docker-cn.com/anjia0532/google-containers.pause                           3.1                 da86e6ba6ca1        7 months ago        742 kB
k8s.gcr.io/etcd-amd64                                                              3.2.18              b8df3b177be2        3 months ago        219 MB
registry.docker-cn.com/anjia0532/google-containers.etcd-amd64                      3.2.18              b8df3b177be2        3 months ago        219 MB
k8s.gcr.io/coredns                                                                 1.1.3               b3b94275d97c        2 months ago        45.6 MB
registry.docker-cn.com/anjia0532/google-containers.coredns                         1.1.3               b3b94275d97c        2 months ago        45.6 MB

REPOSITORY TAG IMAGE ID CREATED SIZE

k8s.gcr.io/kube-apiserver-amd64 v1.11.1 816332bd9d11 12 days ago 187 MB

registry.docker-cn.com/anjia0532/google-containers.kube-apiserver-amd64 v1.11.1 816332bd9d11 12 days ago 187 MB

k8s.gcr.io/kube-controller-manager-amd64 v1.11.1 52096ee87d0e 12 days ago 155 MB

registry.docker-cn.com/anjia0532/google-containers.kube-controller-manager-amd64 v1.11.1 52096ee87d0e 12 days ago 155 MB

k8s.gcr.io/kube-scheduler-amd64 v1.11.1 272b3a60cd68 12 days ago 56.8 MB

registry.docker-cn.com/anjia0532/google-containers.kube-scheduler-amd64 v1.11.1 272b3a60cd68 12 days ago 56.8 MB

k8s.gcr.io/kube-proxy-amd64 v1.11.1 d5c25579d0ff 12 days ago 97.8 MB

registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64 v1.11.1 d5c25579d0ff 12 days ago 97.8 MB

k8s.gcr.io/pause 3.1 da86e6ba6ca1 7 months ago 742 kB

registry.docker-cn.com/anjia0532/google-containers.pause 3.1 da86e6ba6ca1 7 months ago 742 kB

k8s.gcr.io/etcd-amd64 3.2.18 b8df3b177be2 3 months ago 219 MB

registry.docker-cn.com/anjia0532/google-containers.etcd-amd64 3.2.18 b8df3b177be2 3 months ago 219 MB

k8s.gcr.io/coredns 1.1.3 b3b94275d97c 2 months ago 45.6 MB

registry.docker-cn.com/anjia0532/google-containers.coredns 1.1.3 b3b94275d97c 2 months ago 45.6 MB

Also KUBE_REPO_PREFIX and other environment variables can be used to customize the prefix. I have no time to verify them.

2.4 Start the Kubernetes master

Run the init script again and it will success with further guidelines:

# kubeadm init --kubernetes-version=v1.11.1
...
...
...
Your Kubernetes master has initialized successfully!

To start using your cluster, you need to run (as a regular user):

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the addon options listed at:
  http://kubernetes.io/docs/admin/addons/

You can now join any number of machines by running the following on each node
as root:

  kubeadm join 192.168.11.235:6443 --token d624xt.3eqs1udhr26w5luh --discovery-token-ca-cert-hash sha256:a0088da6f0445370457b1aeede4856caa580280e58cdea974f1110bc1b7d4a63

# kubeadm init --kubernetes-version=v1.11.1

...

Your Kubernetes master has initialized successfully!

To start using your cluster, you need to run (as a regular user):

mkdir -p $HOME/.kube

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

sudo chown $(id -u):$(id -g) $HOME/.kube/config

You should now deploy a pod network to the cluster.

Run "kubectl apply -f [podnetwork].yaml" with one of the addon options listed at:

http://kubernetes.io/docs/admin/addons/

You can now join any number of machines by running the following on each node

as root:

kubeadm join 192.168.11.235:6443 --token d624xt.3eqs1udhr26w5luh --discovery-token-ca-cert-hash sha256:a0088da6f0445370457b1aeede4856caa580280e58cdea974f1110bc1b7d4a63

Run the mkdir/cp/chown command to enable kubectl usage. Then add the weave pod network. It may take some time, since images are pulled.

# kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

1	# kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version \| base64 \| tr -d '\n')"

Now the master is finished, verify with the Ready status:

# kubectl get nodes
NAME        STATUS    ROLES     AGE       VERSION
cdh-node1   Ready     master    2h        v1.11.1

# kubectl get nodes

NAME STATUS ROLES AGE VERSION

cdh-node1 Ready master 2h v1.11.1

2.4 Start the Kubernetes node(slave)

A Kubernetes node only requires kube-proxy-amd64 and pause images, pull these ones:

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1
# docker pull registry.docker-cn.com/anjia0532/google-containers.pause:3.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1 k8s.gcr.io/kube-proxy-amd64:v1.11.1
# docker tag registry.docker-cn.com/anjia0532/google-containers.pause:3.1 k8s.gcr.io/pause:3.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1

# docker pull registry.docker-cn.com/anjia0532/google-containers.pause:3.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.kube-proxy-amd64:v1.11.1 k8s.gcr.io/kube-proxy-amd64:v1.11.1

# docker tag registry.docker-cn.com/anjia0532/google-containers.pause:3.1 k8s.gcr.io/pause:3.1

Weave images can also been prefetched:

# docker images
REPOSITORY                                                            TAG                 IMAGE ID            CREATED             SIZE
docker.io/weaveworks/weave-npc                                        2.4.0               647ad6d59818        4 days ago          49.1 MB
docker.io/weaveworks/weave-kube                                       2.4.0               86ff1a48ce14        4 days ago          131 MB

# docker images

REPOSITORY TAG IMAGE ID CREATED SIZE

docker.io/weaveworks/weave-npc 2.4.0 647ad6d59818 4 days ago 49.1 MB

docker.io/weaveworks/weave-kube 2.4.0 86ff1a48ce14 4 days ago 131 MB

Join the node to our Kubernetes master by running the command line in the kubeadm init output:

# kubeadm join 192.168.11.235:6443 --token d624xt.3eqs1udhr26w5luh --discovery-token-ca-cert-hash sha256:a0088da6f0445370457b1aeede4856caa580280e58cdea974f1110bc1b7d4a63

1	# kubeadm join 192.168.11.235:6443 --token d624xt.3eqs1udhr26w5luh --discovery-token-ca-cert-hash sha256:a0088da6f0445370457b1aeede4856caa580280e58cdea974f1110bc1b7d4a63

3. Verify Kubernetes cluster status

Verify nodes with:

# kubectl get nodes -o wide
NAME        STATUS    ROLES     AGE       VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION          CONTAINER-RUNTIME
cdh-node1   Ready     master    43m       v1.11.1   192.168.11.235           CentOS Linux 7 (Core)   3.10.0-862.el7.x86_64   docker://1.13.1
cdh-node2   Ready         41m       v1.11.1   192.168.11.236           CentOS Linux 7 (Core)   3.10.0-862.el7.x86_64   docker://1.13.1

# kubectl get nodes -o wide

NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME

cdh-node1 Ready master 43m v1.11.1 192.168.11.235 CentOS Linux 7 (Core) 3.10.0-862.el7.x86_64 docker://1.13.1

cdh-node2 Ready 41m v1.11.1 192.168.11.236 CentOS Linux 7 (Core) 3.10.0-862.el7.x86_64 docker://1.13.1

Verify internal pods with:

# kubectl get pods -o wide --all-namespaces
NAMESPACE     NAME                                    READY     STATUS    RESTARTS   AGE       IP               NODE
kube-system   coredns-78fcdf6894-f4qsc                1/1       Running   0          43m       10.32.0.3        cdh-node1
kube-system   coredns-78fcdf6894-rx48j                1/1       Running   0          43m       10.32.0.2        cdh-node1
kube-system   etcd-cdh-node1                          1/1       Running   0          42m       192.168.11.235   cdh-node1
kube-system   kube-apiserver-cdh-node1                1/1       Running   0          42m       192.168.11.235   cdh-node1
kube-system   kube-controller-manager-cdh-node1       1/1       Running   0          42m       192.168.11.235   cdh-node1
kube-system   kube-proxy-f46pz                        1/1       Running   0          43m       192.168.11.235   cdh-node1
kube-system   kube-proxy-zrdm5                        1/1       Running   0          41m       192.168.11.236   cdh-node2
kube-system   kube-scheduler-cdh-node1                1/1       Running   0          42m       192.168.11.235   cdh-node1
kube-system   weave-net-l6z9q                         2/2       Running   1          41m       192.168.11.236   cdh-node2
kube-system   weave-net-tkfrs                         2/2       Running   0          42m       192.168.11.235   cdh-node1

# kubectl get pods -o wide --all-namespaces

NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE

kube-system coredns-78fcdf6894-f4qsc 1/1 Running 0 43m 10.32.0.3 cdh-node1

kube-system coredns-78fcdf6894-rx48j 1/1 Running 0 43m 10.32.0.2 cdh-node1

kube-system etcd-cdh-node1 1/1 Running 0 42m 192.168.11.235 cdh-node1

kube-system kube-apiserver-cdh-node1 1/1 Running 0 42m 192.168.11.235 cdh-node1

kube-system kube-controller-manager-cdh-node1 1/1 Running 0 42m 192.168.11.235 cdh-node1

kube-system kube-proxy-f46pz 1/1 Running 0 43m 192.168.11.235 cdh-node1

kube-system kube-proxy-zrdm5 1/1 Running 0 41m 192.168.11.236 cdh-node2

kube-system kube-scheduler-cdh-node1 1/1 Running 0 42m 192.168.11.235 cdh-node1

kube-system weave-net-l6z9q 2/2 Running 1 41m 192.168.11.236 cdh-node2

kube-system weave-net-tkfrs 2/2 Running 0 42m 192.168.11.235 cdh-node1

If the status of a pod is not Running, get the detailed info from:

# kubectl describe pod weave-net-l6z9q -n kube-system

1	# kubectl describe pod weave-net-l6z9q -n kube-system

If something goes wrong, and you cannot restore from it, simply reset the master/node:

# kubeadm reset

1	# kubeadm reset

4. Install Kubernetes Dashboard

By default, all user pods are allocated on Kubernetes nodes(slaves). Pull the dashboard image in advance on the node machine:

# docker pull registry.docker-cn.com/anjia0532/google-containers.kubernetes-dashboard-amd64:v1.8.3
# docker tag registry.docker-cn.com/anjia0532/google-containers.kubernetes-dashboard-amd64:v1.8.3 k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3

1 2	# docker pull registry.docker-cn.com/anjia0532/google-containers.kubernetes-dashboard-amd64:v1.8.3 # docker tag registry.docker-cn.com/anjia0532/google-containers.kubernetes-dashboard-amd64:v1.8.3 k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3

Install with alternative setup, since recommended setup is not so friendly in a development envronment:

# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.8.3/src/deploy/alternative/kubernetes-dashboard.yaml

1	# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.8.3/src/deploy/alternative/kubernetes-dashboard.yaml

Refer here for remote access:

# kubectl -n kube-system edit service kubernetes-dashboard

1	# kubectl -n kube-system edit service kubernetes-dashboard

Change type: ClusterIP to type: NodePort and save file. Next we need to check port on which Dashboard was exposed.

# kubectl -n kube-system get service kubernetes-dashboard
NAME                   TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
kubernetes-dashboard   NodePort   10.106.156.70           80:31023/TCP   34m

# kubectl -n kube-system get service kubernetes-dashboard

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

kubernetes-dashboard NodePort 10.106.156.70 80:31023/TCP 34m

Now, you can access with: http://<master-ip>:31023/.
You can grant admin grant full admin privileges to Dashboard’s Service Account in the development environment for convenience:

# cat dashboard-admin.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
# kubectl create -f dashboard-admin.yaml

# cat dashboard-admin.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

labels:

k8s-app: kubernetes-dashboard

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- kind: ServiceAccount

namespace: kube-system

# kubectl create -f dashboard-admin.yaml

5. Troubleshoting

In my office environment, errors occur and the coredns are always in CrashLoopBackOff status:

Failed to list *api.Endpoints: Get https://10.96.0.1:443/api/v1/endpoints?resourceVersion=0: dial tcp 10.96.0.1:443: i/o timeout

1	Failed to list *api.Endpoints: Get https://10.96.0.1:443/api/v1/endpoints?resourceVersion=0: dial tcp 10.96.0.1:443: i/o timeout

I Googled a lot, read answers from Stackoverflow and Github, reset iptables/docker/kubernetes, but still failed to solve it. There ARE unresolved issues like #60315. So I tried to switch to flannel network instead of weave. First, Kubernetes and weave need to be reset:

# curl -L git.io/weave -o /usr/local/bin/weave
# chmod a+x /usr/local/bin/weave
# weave reset
# kubeadm reset

# curl -L git.io/weave -o /usr/local/bin/weave

# chmod a+x /usr/local/bin/weave

# weave reset

# kubeadm reset

This time, initialize kubeadm and network with:

# kubeadm init --kubernetes-version=v1.11.1 --pod-network-cidr=10.244.0.0/16
# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml

1 2	# kubeadm init --kubernetes-version=v1.11.1 --pod-network-cidr=10.244.0.0/16 # kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml

The flannel image can be pulled first:

# docker pull quay.io/coreos/flannel:v0.10.0-amd64

1	# docker pull quay.io/coreos/flannel:v0.10.0-amd64

Everything works. Also referred here.

Updated May 7, 2019: Kubernetes 1.13 finally add a command line switch to use an alternative repository. Simply run kubeadm with:

# kubeadm init --kubernetes-version=v1.14.1 --image-repository registry.aliyuncs.com/google_containers

1	# kubeadm init --kubernetes-version=v1.14.1 --image-repository registry.aliyuncs.com/google_containers

And verify with docker images.

Updated May 10, 2019: If using Ubuntu/Linuxmint, add repository with:

# curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -
# cat << EOF > /etc/apt/sources.list.d/kubernetes.list 
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main 
EOF

# curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -

# cat << EOF > /etc/apt/sources.list.d/kubernetes.list

deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main

EOF

Updated June 3, 2019: flannel seems to have a close version dependency on kubernetes version. When deploying kubernetes 1.14, a specific git version should be used, according to the official document:

# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/62e44c867a2846fefb68bd5f178daf4da3095ccb/Documentation/kube-flannel.yml

1	# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/62e44c867a2846fefb68bd5f178daf4da3095ccb/Documentation/kube-flannel.yml

Updated Jan 11, 2022: Just deployed a new cluster with docker 20.10.12 & kubernetes 1.23.1.
1. kubeadm defaults to systemd, instead of cgroupfs as the container runtime cgroup driver. In docker case, edit /etc/docker/daemon.json, and restart docker service:

{
  "exec-opts": ["native.cgroupdriver=systemd"]
}

{

"exec-opts": ["native.cgroupdriver=systemd"]

}

2. flannel script updated:

# flannel v0.16.1
# kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

1 2	# flannel v0.16.1 # kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

3. kubernetes dashboard script updated:

# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml

1	# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml

The recommended configuration enables HTTPS, and an auto-generated certificate is used. Now follow the document to create an admin user and get the login token: https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md. Get the token with:

# kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

1	# kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token \| base64decode}}"

Mount Samba Share as a Non-root User

Posted on April 9, 2015 by gonwan — No Comments ↓

I used to access windows share folders directly in nautilus, or mount them like:

# mount -t cifs -o username=<your_username>,password=<your_password> //<your_server>/<your_share> /mnt/<your_local>

1	# mount -t cifs -o username=<your_username>,password=<your_password> //<your_server>/<your_share> /mnt/<your_local>

The problem is, they can be accessed only by root. The solution is adding a simple uid option like:

# sudo mount -t cifs -o uid=<your_uid>,username=<your_username>,password=<your_password>,domain=<your_domain> //<your_server>/<your_share> /mnt/<your_local> -vvv

1	# sudo mount -t cifs -o uid=<your_uid>,username=<your_username>,password=<your_password>,domain=<your_domain> //<your_server>/<your_share> /mnt/<your_local> -vvv

See: http://wiki.centos.org/TipsAndTricks/WindowsShares

Updated June 1, 2015:

You may encounter 121 error like:

mount error(121): Remote I/O error
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

1 2	mount error(121): Remote I/O error Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

It’s a Windows side issue, set following registry value to 3. This value tells Windows to prioritize file sharing over reducing memory usage.

HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size

1	HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size

Reboot (or just restart the “Server” service in services.msc). Your problem should now be solved.

See: https://boinst.wordpress.com/2012/03/20/mount-cifs-cannot-allocate-memory-mounting-windows-share/

Switching to the Linuxmint 17.1 Theme

Posted on December 2, 2014 by gonwan — No Comments ↓

Just upgraded to Linuxmint 17.1. Themes in the distribution were greatly improved. They’ve done a better job than Ubuntu, so I switched to the mint theme.

No broken visual glitch any more in eclipse. And it seems the new themes include fixes for the black background color for tooltips issue. See eclipse FAQ here.

You can compare with the previous screenshot: Configuring Ubuntu Themes in Linuxmint 17. The only fix I want to apply is to make the theme look brighter. First, go to /usr/share/themes/Mint-X-Aqua. For gtk3 applications, patch with:

--- gtk-3.0/gtk-main.css.bak	2014-12-02 14:06:03.864745990 +0800
+++ gtk-3.0/gtk-main.css	2014-12-02 14:21:32.508879444 +0800
@@ -1,8 +1,8 @@
 /* Default Color Scheme */
 
-@define-color theme_bg_color #d6d6d6;
+@define-color theme_bg_color #e3e3e3;
 @define-color theme_fg_color #212121;
-@define-color theme_base_color #f7f7f7;
+@define-color theme_base_color #fafafa;
 @define-color theme_text_color #212121;
 @define-color theme_selected_bg_color #6cabcd;
 @define-color theme_selected_fg_color #f5f5f5;

--- gtk-3.0/gtk-main.css.bak 2014-12-02 14:06:03.864745990 +0800

+++ gtk-3.0/gtk-main.css 2014-12-02 14:21:32.508879444 +0800

@@ -1,8 +1,8 @@

/* Default Color Scheme */

-@define-color theme_bg_color #d6d6d6;

+@define-color theme_bg_color #e3e3e3;

@define-color theme_fg_color #212121;

-@define-color theme_base_color #f7f7f7;

+@define-color theme_base_color #fafafa;

@define-color theme_text_color #212121;

@define-color theme_selected_bg_color #6cabcd;

@define-color theme_selected_fg_color #f5f5f5;

For gtk2 applications, patch with:

--- gtk-2.0/gtkrc.bak	2014-12-02 14:22:07.798517093 +0800
+++ gtk-2.0/gtkrc	2014-12-02 14:22:26.575901978 +0800
@@ -1,6 +1,6 @@
 # These are the defined colors for the theme, you can change them in GNOME's appearance preferences.
 
-gtk_color_scheme = "bg_color:#d6d6d6\nselected_bg_color:#6cabcd\nbase_color:#F7F7F7" # Background, base.
+gtk_color_scheme = "bg_color:#e3e3e3\nselected_bg_color:#6cabcd\nbase_color:#fafafa" # Background, base.
 gtk_color_scheme = "fg_color:#212121\nselected_fg_color:#f5f5f5\ntext_color:#212121" # Foreground, text.
 gtk_color_scheme = "tooltip_bg_color:#fbeaa0\ntooltip_fg_color:#212121" # Tooltips.
 gtk_color_scheme = "link_color:#08c" # Hyperlinks

--- gtk-2.0/gtkrc.bak 2014-12-02 14:22:07.798517093 +0800

+++ gtk-2.0/gtkrc 2014-12-02 14:22:26.575901978 +0800

@@ -1,6 +1,6 @@

# These are the defined colors for the theme, you can change them in GNOME's appearance preferences.

-gtk_color_scheme = "bg_color:#d6d6d6\nselected_bg_color:#6cabcd\nbase_color:#F7F7F7" # Background, base.

+gtk_color_scheme = "bg_color:#e3e3e3\nselected_bg_color:#6cabcd\nbase_color:#fafafa" # Background, base.

gtk_color_scheme = "fg_color:#212121\nselected_fg_color:#f5f5f5\ntext_color:#212121" # Foreground, text.

gtk_color_scheme = "tooltip_bg_color:#fbeaa0\ntooltip_fg_color:#212121" # Tooltips.

gtk_color_scheme = "link_color:#08c" # Hyperlinks

1. Cloudflare as CDN

1.1 Redirect Rule: Redirect from root to www

2. Security Settings

2.1 Security Headers

2.2 WAF Rule: Challenge empty referer

2.3 WAF Rule: Block xmlrpc.php

2.4 WAF Rule: Block bots

2.5 WAF Rule: Block flood

3. Cache Settings

3.1 Configure Default Browser Cache TTL

3.2 Cache Rule: Cache resources

3.3 Cache Rule: Cache major pages

3.4 Cache Rule: Cache minor pages

4. Conclusion

1. Disable File Access

2. Disable wp-cron.php

3. Disable Pingback in Comments

4. Disable Json API

5. Hide Login Page

6. Hide Server Info

7. Disallow IFrame Embedding

8. Add reCAPTCHA

9. Refine robots.txt

10. More Fail2ban Rules

1. ifupdown

2. networkd

3. NetworkManager

4. Clean ups

5. iptables

1. Google Analytics 4

2. Fail2ban not working

3. Akismet not working

1. Install v2ray and run proxy

2. Download vcpkg from github and bootstrap

3. Install drogon framework for demo

4. Export drogon framework

5. Add a demo program

6. Stick to a specific version

7. Binary caching

1. Install Docker

2. Install Kubernetes

2.1 Add the Aliyun mirror for Kubernetes packages

2.2 Precheck OS environmemt

2.3 Pull Kubernates images

2.4 Start the Kubernetes master

2.4 Start the Kubernetes node(slave)

3. Verify Kubernetes cluster status

4. Install Kubernetes Dashboard

5. Troubleshoting

2.3 WAF Rule: Block `xmlrpc.php`

2. Disable `wp-cron.php`

9. Refine `robots.txt`