# TCP 扫描（正常）
for port in 22 80 8888; do nc -zv -w 2 100.64.0.5 $port; done

# UDP 扫描（有猫腻）
nc -uvz -w 2 100.64.0.5 8888  # 显示 success，但收不到回程包

# jump-host 执行
sudo tcpdump -i any udp port 8888 -n

# target01 执行
nc -u 100.64.0.5 8888 <<< "test"

curl -v http://100.64.0.5:8888
# 响应：< Proxy-Agent: gost/2.12.0

systemctl stop chronyd
systemctl disable chronyd

# 提取 HTTP Header 中的 Date 字段并设置系统时间
HTTP_DATE=$(curl -sI http://100.64.0.5 | grep -i "^Date:" | cut -d" " -f2-)
[ -n "$HTTP_DATE" ] && date -s "$HTTP_DATE"

(crontab -l 2>/dev/null; echo '0 * * * * HTTP_DATE=$(curl -sI http://100.64.0.5 | grep -i "^Date:" | cut -d" " -f2-) && [ -n "$HTTP_DATE" ] && date -s "$HTTP_DATE"') | crontab -

 readonly='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.cc.fd



   value='-global'/>
   value='q35-pcihost.pci-hole64-size=2048G'/>

# 旧 MAC
52:54:00:a9:a2:11

 unit='KiB'>268435456
 unit='KiB'>268435456

nvidia-smi -L
nvidia-smi topo -m
nvidia-smi nvlink -s

kubectl get nodes -o wide
kubectl get pods -A

curl http://127.0.0.1:9090/api/v1/query?query=DCGM_FI_DEV_SM_CLOCK

# /etc/systemd/system/containerd.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=http://100.64.0.5:8888"
Environment="HTTPS_PROXY=http://100.64.0.5:8888"
Environment="NO_PROXY=127.0.0.1,localhost,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10"

helm upgrade --install gpu-operator nvidia/gpu-operator \
  -n gpu-operator --create-namespace \
  --set driver.enabled=false --set dcgmExporter.enabled=true

helm upgrade --install kube-prometheus-stack prometheus-community/kube-prometheus-stack \
  -n monitoring --create-namespace

# ServiceMonitor 需要有与 Prometheus release 一致的标签
kubectl -n gpu-operator label servicemonitor nvidia-dcgm-exporter release=kube-prometheus-stack --overwrite

wget -qO - https://dl.xanmod.org/archive.key | gpg --dearmor | tee /usr/share/keyrings/xanmod-archive-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/share/keyrings/xanmod-archive-keyring.gpg] http://deb.xanmod.org releases main' | tee /etc/apt/sources.list.d/xanmod-kernel.list
apt update && apt install linux-xanmod-edge-x64v3 -y

# 开启 MGLRU 所有优化层，显著降低小内存下的 OOM 风险
@reboot echo 7 > /sys/kernel/mm/lru_gen/enabled

# 开启 KSM 内存页合并，减少 Docker 容器间的重复内存占用
@reboot echo 1 > /sys/kernel/mm/ksm/run

# 开启 zswap 收缩器，允许内核更积极地在压缩区与物理 Swap 间平衡数据
@reboot echo Y > /sys/module/zswap/parameters/shrinker_enabled

stream {
    map $ssl_preread_server_name $stream_map {
        api.ferstar.org api;   # 微信机器人 -> 转发至本地 8444
        fm.ferstar.org  fm;    # 文件服务器 -> 转发至本地 8445
        default         ssh;   # 非 SSL 或未知域名默认转发至本地 22 (SSH)
    }
    upstream ssh  { server 127.0.0.1:22; }
    upstream api  { server 127.0.0.1:8444; }
    upstream fm   { server 127.0.0.1:8445; }
    
    server {
        listen 443 reuseport;
        proxy_pass $stream_map;
        ssl_preread on;
    }
}

ufw reset
ufw default deny incoming
ufw default allow outgoing
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 443/udp
ufw allow 18443:18445/udp  # 供代理服务使用
ufw enable

post_hook = systemctl reload nginx && docker restart hysteria hysteria2 tuic-server

services:
  hysteria:
    image: tobyxdd/hysteria:v1.3.5
    container_name: hysteria
    logging:
      driver: "json-file"
      options: {max-size: "10m", max-file: "3"}
    restart: unless-stopped
    command: ["-config", "/etc/config.json", "server"]
    volumes:
      - ./config.json:/etc/config.json
      - /etc/letsencrypt:/etc/letsencrypt:ro
    ports: ["18443:443/udp"]
    sysctls: {net.ipv4.tcp_congestion_control: bbr}

{
  "listen": ":443",
  "cert": "/etc/letsencrypt/live/DOMAIN/fullchain.pem",
  "key": "/etc/letsencrypt/live/DOMAIN/privkey.pem",
  "auth": { "mode": "passwords", "config": ["PASSWORD"] },
  "up_mbps": 1000,
  "down_mbps": 1000
}

services:
  hysteria2:
    image: tobyxdd/hysteria:latest
    container_name: hysteria2
    restart: unless-stopped
    command: ["server", "-c", "/etc/hysteria/config.yaml"]
    logging:
      driver: "json-file"
      options: {max-size: "10m", max-file: "3"}
    volumes:
      - ./config.yaml:/etc/hysteria/config.yaml:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
    ports: ["18445:443/udp"]
    sysctls: {net.ipv4.tcp_congestion_control: bbr}

listen: :443
tls:
  cert: /etc/letsencrypt/live/DOMAIN/fullchain.pem
  key: /etc/letsencrypt/live/DOMAIN/privkey.pem
auth:
  type: password
  password: "PASSWORD"
bandwidth:
  up: 1 gbps
  down: 1 gbps

services:
  tuic:
    image: ghcr.io/itsusinn/tuic-server:1.4.5
    container_name: tuic-server
    logging:
      driver: "json-file"
      options: {max-size: "10m", max-file: "3"}
    restart: always
    ports: ["18444:443/udp"]
    volumes:
      - ./config.json:/etc/tuic/config.json:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro

{
    "server": "[::]:443",
    "users": { "UUID": "PASSWORD" },
    "certificate": "/etc/letsencrypt/live/DOMAIN/fullchain.pem",
    "private_key": "/etc/letsencrypt/live/DOMAIN/privkey.pem",
    "alpn": ["h3"],
    "udp_relay_ipv6": true,
    "zero_rtt_handshake": false,
    "dual_stack": true,
    "log_level": "warn"
}

services:
  filebrowser:
    image: filebrowser/filebrowser:latest
    container_name: filebrowser
    logging:
      driver: "json-file"
      options: {max-size: "10m", max-file: "3"}
    user: 0:0
    ports: ["127.0.0.1:1122:80"]
    volumes:
      - /root/fm/filebrowser/srv:/srv
      - /root/fm/filebrowser/database.db:/database.db
    command: ["--address", "0.0.0.0", "--port", "80", "--database", "/database.db", "--root", "/srv"]
    restart: unless-stopped

# teleport.yaml
auth_service:
  proxy_listener_mode: multiplex

# /etc/yum.repos.d/teleport.repo
[teleport]
proxy=http://[堡垒机VIP]:8888

proxy_pass https://127.0.0.1:3080;  # 必须 https
proxy_ssl_verify off;                # 自签名证书
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

iptables -F DOCKER-USER
# 只允许本地和 Tailscale 网段
iptables -A DOCKER-USER -s 127.0.0.1 -p tcp --dport 3080 -j ACCEPT
iptables -A DOCKER-USER -s 100.64.0.0/10 -p tcp --dport 3080 -j ACCEPT
iptables -A DOCKER-USER -p tcp --dport 3080 -j DROP

# 示例：节点打标（供应商名称已脱敏）
labels:
  vendor: vendor-x
  env: prod

# 示例：角色限制（供应商账号与可见节点）
kind: role
spec:
  allow:
    logins: ["vendor-user"]
    node_labels:
      vendor: "vendor-x"
  deny:
    logins: ["root"]

services:
  teleport:
    ports:
      - '3080:3080'
      - '127.0.0.1:3025:3025'  # 管理 API 只本地

proxy_service:
  public_addr: [teleport.example.com:443, 100.64.0.x:3080]

app_service:
  enabled: "yes"
  apps:
  - name: app-ui
    uri: http://10.120.0.0:32000/
    public_addr: app-ui.example.com

# /etc/systemd/system/teleport.service
Environment="NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,100.64.0.0/10"

proxy_set_header Host $host;

NOTE: I am not responsible for any expired content.
Created at: 2026-01-03T03:58:20+08:00
Updated at: 2026-01-03T05:55:29+08:00
Origin issue: https://github.com/ferstar/blog/issues/95

AI 写代码的水平 = 你提供上下文的水平

AI 交付质量 = 上下文质量 × 验证自动化 × 任务适配度

投入产出比：Project >> Task >> Session

Project：8h 投入 → 所有任务受益（复利）
Task：5-10min → 当次任务
Session：0 → 当次对话

# CLAUDE.md

## Project Overview        # 项目是干什么的
## Technology Stack        # 技术栈：Litestar + PostgreSQL + Redis + OpenDAL + Celery
## Basic Rules             # 基本规则：先激活 venv，用 uv 管理依赖
## Development Commands    # 常用命令：just lint, just test
## Architecture Overview   # 架构：DDD 分层，src/domain/ 下按业务组织
## Coding Style            # 风格：ruff 格式化，150 字符行宽
## Testing Guidelines      # 测试：pytest（fail-fast，warnings-as-errors）
## CLI Commands            # CLI：litestar database upgrade, litestar run

import tempfile
from pathlib import Path

def process_pdf(content: bytes) -> str:
    # 使用 delete=False 以便后续处理
    with tempfile.NamedTemporaryFile(suffix=".pdf", delete=False) as tmp:
        tmp_path = Path(tmp.name)
        tmp.write(content)

    try:
        result = parse_pdf(tmp_path)
        return result
    finally:
        tmp_path.unlink(missing_ok=True)  # 手动清理

$ git commit -m "feat: add pdf processor"
error[no-tempfile-delete-false]: NamedTemporaryFile with delete=False is forbidden
  --> src/utils/pdf.py:6:10
   |
 6 |     with tempfile.NamedTemporaryFile(suffix=".pdf", delete=False) as tmp:
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

def process_pdf(content: bytes) -> str:
    with tempfile.NamedTemporaryFile(suffix=".pdf") as tmp:  # 默认 delete=True
        tmp_path = Path(tmp.name)
        tmp.write(content)
        tmp.flush()  # 确保写入磁盘

        result = parse_pdf(tmp_path)
        return result
    # 退出 with 块时自动清理，无泄漏风险

# AI 生成了 Python 3.10 的 match/case
match value:
    case 1:
        return "one"
    case _:
        return "other"

src/domain/
  users/
    controller.py
    service.py
    repository.py
    schema.py
  files/
    controller.py
    service.py
    repository.py
    schema.py

我需要开发 [功能]。请按以下步骤：
1. 先读相关代码了解架构
2. 制定实现计划
3. 实现核心功能
4. 写测试
每完成一步暂停等我确认。

我：这个接口太慢了，帮我优化
AI：加预加载 / 加缓存 / 加索引...（缺少证据，很可能无效）

1. 人：在测试环境执行 EXPLAIN (ANALYZE, BUFFERS)，拿到查询计划
2. AI（分析型）：根据计划定位瓶颈（例如某子查询导致重复扫描）
3. 人：确认改写思路 + 需要的索引/迁移策略
4. AI（执行型）：生成代码 + 迁移脚本 + 对应测试
5. 人：跑 `just test` 并做简单压测对比

# AI "简化"前（正确）
if server_session_id != request.session["id"].encode():

# AI "简化"后（错误）
if server_session_id != request.session["id"]:
# bytes vs str 比较，永远不相等，所有用户被踢出登录

# AI 生成的代码
async def update_user_email_task(session, repo, user_id: int, email: str):
    await repo.update_email(user_id, email)
    # 忘记 await session.commit() ← 更新不会落库
    return {"status": "success"}

# AI 在 CLI 文件里写了全局导入
from src.domain.users.service import UserService  # ❌ 违反规则

# 应该用局部导入
def create_user():
    from src.domain.users.service import UserService  # ✅

1. 承认焦虑是合理的
2. 但焦虑不解决问题
3. 要么卷（学 Prompt、学架构、往上走）
4. 要么换赛道（AI 不擅长的领域）
5. 要么接受（成为"AI 协作者"，放下对"手写代码"的执念）

source .venv/bin/activate
uv sync --group=dev
just lint
just test

NOTE: I am not responsible for any expired content.
Created at: 2025-12-31T21:46:31+08:00
Updated at: 2026-01-03T03:58:25+08:00
Origin issue: https://github.com/ferstar/blog/issues/94

# 接收端
iperf3 -s

# 发送端
iperf3 -c  -t 10

iperf3 -c  -u -b 20M -t 10

iperf3 -c  -t 10 -M 1400  # 坍缩，重传爆炸
iperf3 -c  -t 10 -M 1350  # 瞬间恢复 ~49Mbps

#!/bin/bash
set -euo pipefail

# --- 配置 ---
PHY_IF="ens3"
REMOTE_NET="10.0.0.0/24"

# 1. 物理层优化（会增加 CPU 开销，按需开）
ip link set dev "$PHY_IF" mtu 1400
ethtool -K "$PHY_IF" tso off gso off gro off

# 2. MSS 钳制
# 转发流量：1280（保守）
iptables -t mangle -C FORWARD -p tcp -d "$REMOTE_NET" --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1280 2>/dev/null || \
iptables -t mangle -I FORWARD -p tcp -d "$REMOTE_NET" --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1280

# 本地发起：1350（略激进但本案例可用）
iptables -t mangle -C OUTPUT -p tcp -d "$REMOTE_NET" --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1350 2>/dev/null || \
iptables -t mangle -I OUTPUT -p tcp -d "$REMOTE_NET" --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1350

tcpdump -ni  -vv 'tcp[tcpflags] & tcp-syn != 0 and host '

iptables -t mangle -vnL FORWARD --line-numbers
iptables -t mangle -vnL OUTPUT  --line-numbers

# 删 mangle 规则（按行号）
iptables -t mangle -D FORWARD <行号>
iptables -t mangle -D OUTPUT <行号>

# 恢复 MTU/offload
ip link set dev  mtu 1500
ethtool -K  tso on gso on gro on

NOTE: I am not responsible for any expired content.
Created at: 2025-12-31T12:09:54+08:00
Updated at: 2026-01-03T06:10:01+08:00
Origin issue: https://github.com/ferstar/blog/issues/93

echo "sch_dualpi2" | sudo tee /etc/modules-load.d/dualpi2.conf

ACTION=="add", SUBSYSTEM=="net", NAME=="ens3", RUN+="/sbin/tc qdisc replace dev ens3 root dualpi2"

sudo sysctl -p
sudo tc qdisc replace dev ens3 root dualpi2

tc -s qdisc show dev ens3
# 观察 target 值，默认 5ms

# 客户端：打满带宽
iperf3 -c  -t 60

# 服务端：观察内核 RTT
ss -tni
# 关注 rtt:X/Y — X 是平均 RTT，Y 是抖动(mdev)

NOTE: I am not responsible for any expired content.
Created at: 2025-12-18T06:30:04+08:00
Updated at: 2025-12-18T12:06:30+08:00
Origin issue: https://github.com/ferstar/blog/issues/92

# 冻结系统更新
pm disable com.xxx.ota

# hosts 屏蔽云控域名
echo "127.0.0.1 cloud.manufacturer.com" >> /system/etc/hosts

# LSPosed hook 系统服务拦截配置下发

XposedHelpers.setStaticObjectField(Build.class, "MODEL", "SM-G9980");
XposedHelpers.setStaticObjectField(Build.class, "MANUFACTURER", "samsung");

// Hook 微信支付成功回调
findAndHookMethod("com.tencent.mm.plugin.wallet...", "onPaySuccess", 
    new XC_MethodHook() {
        protected void afterHookedMethod(MethodHookParam param) {
            // 拿到金额、商户等信息直接入库
            saveTransaction(param);
        }
    });

# iptables 拦截广告域名
iptables -A OUTPUT -d ad.xxx.com -j REJECT

# 或者透明代理 + AdGuard DNS

原厂：大核 3.2GHz @ 1.05V, GPU 680MHz @ 0.90V
降压：大核 3.2GHz @ 0.98V (-70mV), GPU 680MHz @ 0.85V (-50mV)
效果：续航提升约 18%，温度降 2-3℃

# 查看温控策略
cat /sys/class/thermal/thermal_zone*/temp

# 修改降频阈值（需要改内核或开机脚本）
echo 55000 > /sys/class/thermal/thermal_zone0/trip_point_0_temp

# 限制充电电流 2A
echo 2000000 > /sys/class/power_supply/battery/constant_charge_current_max

# 充到80%停止
echo 80 > /sys/class/power_supply/battery/charge_control_limit

# 完整 Linux 发行版
proot-distro install debian

# 抓包分析
tcpdump -i wlan0 -w capture.pcap

# 跑 nginx 绑定 80 端口
nginx -c /data/nginx.conf

# 备份分区
dd if=/dev/block/by-name/boot of=/sdcard/boot.img

# 刷自编译内核
dd if=/sdcard/custom_boot.img of=/dev/block/by-name/boot

NOTE: I am not responsible for any expired content.
Created at: 2025-10-04T14:42:47+08:00
Updated at: 2025-11-02T06:59:10+08:00
Origin issue: https://github.com/ferstar/blog/issues/90

#!/bin/sh /etc/rc.common

START=99

SERVICE_DAEMONIZE=1
SERVICE_WRITE_PID=1
USE_PROCD=1
COMMAND="/etc/clash/tools/tuic -c /etc/clash/config.json"

start_service() {
        procd_open_instance
        procd_set_param user root
        procd_set_param respawn
        procd_set_param command $COMMAND
        procd_set_param stderr 0
        procd_set_param stdout 0
        procd_close_instance
        
}
stop_service(){
        procd_close_instance
}

root@XiaoQiang:~# /etc/init.d/tuic
Syntax: /etc/init.d/tuic [command]

Available commands:
        start   Start the service
        stop    Stop the service
        restart Restart the service
        reload  Reload configuration files (or restart if service does not implement reload)
        enable  Enable service autostart
        disable Disable service autostart

NOTE: I am not responsible for any expired content.
Created at: 2025-05-05T06:38:18+08:00
Updated at: 2026-01-04T06:10:00+08:00
comment@https://github.com/ferstar/blog/issues/89

git clone git@github.com:ferstar/kernel_manifest.git
cd kernel_manifest
chmod +x build.sh
./build.sh

sudo curl https://mirrors.tuna.tsinghua.edu.cn/git/git-repo > /usr/bin/repo
sudo chmod +x /usr/bin/repo

mkdir kernel
cd kernel
export REPO_URL='https://mirrors.tuna.tsinghua.edu.cn/git/git-repo' 
repo init --repo-rev=v2.16 --depth=1 -u https://github.com/ferstar/kernel_manifest.git -b realme/sm8650 -m gt5pro_v.xml
repo sync --no-tags
cd kernel_platform
# 这个必须删，不然内核启动后没法驱动WiFi、蓝牙和4/5G
rm common/android/abi_gki_protected_exports_*
# 编译
python build_with_bazel.py -t pineapple gki  --lto=thin --config=fast --disk_cache=$HOME/.cache/bazel --//msm-kernel:skip_abi=true --//msm-kernel:skip_abl=true -o "$(pwd)/out" || true

NOTE: I am not responsible for any expired content.
Created at: 2025-01-25T10:45:41+08:00
Updated at: 2025-01-27T16:26:43+08:00
Origin issue: https://github.com/ferstar/blog/issues/88

NOTE: I am not responsible for any expired content.
Created at: 2025-01-13T07:45:39+08:00
Updated at: 2025-01-25T10:21:24+08:00
Origin issue: https://github.com/ferstar/blog/issues/86

sudo pacman -S ideapad-laptop-tb-dkms

# 编译并安装DKMS模块
git clone https://github.com/ferstar/ideapad-laptop-tb.git
cd ideapad-laptop-tb-dkms
sudo dkms add .
sudo dkms install ideapad-laptop-tb/6.10  # 版本号需匹配内核版本

# 禁用原生冲突模块
sudo cp dkms/blacklist-ideapad-laptop-tb-dkms.conf /etc/modprobe.d/

# 重启生效
sudo reboot

sudo dkms remove ideapad-laptop-tb/6.10 --all
sudo rm /etc/modprobe.d/blacklist-ideapad-laptop-tb-dkms.conf
sudo reboot

NOTE: I am not responsible for any expired content.
Created at: 2025-01-13T07:15:03+08:00
Updated at: 2025-05-24T03:21:49+08:00
Origin issue: https://github.com/ferstar/blog/issues/85

NOTE: I am not responsible for any expired content.
Created at: 2025-01-13T02:01:49+08:00
Updated at: 2025-01-25T10:03:22+08:00
Origin issue: https://github.com/ferstar/blog/issues/84

OS: Ubuntu oracular 24.10 x86_64
Host: 21D0 (ThinkBook 14 G4+ ARA)
Kernel: Linux 6.12.9-bigv
Uptime: 1 day, 53 mins
Packages: 2800 (dpkg), 7 (flatpak)
Shell: zsh 5.9
Display (AUOC391): 2880x1800 @ 90 Hz in 14"
DE: GNOME
WM: Mutter (X11)
WM Theme: Yaru
Theme: Yaru [GTK2/3/4]
Icons: Yaru [GTK2/3/4]
Font: Cantarell (11pt) [GTK2/3/4]
Cursor: DMZ-White (48px)
Terminal: tmux 3.4
CPU: AMD Ryzen 7 6800H (16) @ 4.79 GHz
GPU: AMD Radeon 680M [Integrated]
Memory: 12.95 GiB / 29.55 GiB (44%)
Swap: 5.25 MiB / 32.00 GiB (0%)
Disk (/): 312.72 GiB / 414.32 GiB (75%) - btrfs
Local IP (wlan0): 192.168.31.157/24
Battery (AP16L5J): 77% [AC Connected]
Locale: en_US.UTF-8

NOTE: I am not responsible for any expired content.
Created at: 2025-01-12T16:58:10+08:00
Updated at: 2025-01-12T17:04:21+08:00
Origin issue: https://github.com/ferstar/blog/issues/83

# 安装依赖
sudo apt install wget

# 下载脚本
wget https://raw.githubusercontent.com/pimlie/ubuntu-mainline-kernel.sh/master/ubuntu-mainline-kernel.sh

# 赋予执行权限
chmod +x ubuntu-mainline-kernel.sh

# 移动到系统路径
sudo mv ubuntu-mainline-kernel.sh /usr/local/bin/

# 列出所有远程版本
ubuntu-mainline-kernel.sh -r

# 包括 RC 版本
ubuntu-mainline-kernel.sh -r --rc

# 搜索特定版本
ubuntu-mainline-kernel.sh -r 6.8

# 安装指定版本
sudo ubuntu-mainline-kernel.sh -i 6.8.0

# 包括 RC 版本
sudo ubuntu-mainline-kernel.sh -i 6.8-rc5 --rc

# 安装 low-latency 版本（低延迟优化）
sudo ubuntu-mainline-kernel.sh -i 6.8.0 --low-latency

# 列出已安装的内核
ubuntu-mainline-kernel.sh -l

# 卸载指定版本
sudo ubuntu-mainline-kernel.sh -u 6.8.0

# 本地编译并安装
sudo ubuntu-mainline-kernel.sh -b 6.8.0

# 安装依赖
sudo apt install git docker.io

# 把自己加到 docker 组（避免每次 sudo）
sudo usermod -aG docker $USER
# 需要重新登录生效

# 预留空间：源码约 3GB，编译过程可能 10GB+
df -h /var/lib/docker

# 克隆源码（脚本会自动做，这里是手动方式）
git clone --depth=1 --branch v6.8 \
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git \
  linux-6.8

cd linux-6.8

# 示例：打个驱动补丁
cd linux-6.8
patch -p1 < ~/my-driver.patch

# 或者直接修改源码文件
vim drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c

# 复制当前系统内核配置
cp /boot/config-$(uname -r) .config

# 更新配置（使用默认值）
make olddefconfig

# 或者手动配置
make menuconfig

# -b 参数会自动拉取 Docker 镜像并编译
sudo ubuntu-mainline-kernel.sh -b 6.8.0

# 编译完成后会自动安装

# 手动 Docker 编译方式
docker run --rm -it \
  -v $(pwd):/build \
  tuxinvader/focal-mainline-builder:latest \
  /bin/bash

# 在容器内
cd /build
make -j$(nproc) bindeb-pkg LOCALVERSION=-custom

# 如果是手动编译，会在上层目录生成 .deb 文件
cd ..
ls -lh *.deb

# 安装
sudo dpkg -i linux-*.deb

# 更新 GRUB
sudo update-grub

# 创建密钥目录
mkdir -p ~/sb-keys
cd ~/sb-keys

# 生成 MOK 密钥对
openssl req -new -x509 -newkey rsa:2048 \
  -keyout MOK.priv \
  -outform DER \
  -out MOK.der \
  -days 36500 \
  -subj "/CN=My Kernel Signing Key/" \
  -nodes

# 注册 MOK 密钥（重启后会提示输入密码）
sudo mokutil --import MOK.der
# 设置一个临时密码，重启时输入

# 签名内核和模块
sudo sbsign --key MOK.priv --cert MOK.der \
  /boot/vmlinuz-6.8.0-custom

# 签名模块（如果需要）
sudo find /lib/modules/6.8.0-custom -name "*.ko" -exec \
  sbsign --key MOK.priv --cert MOK.der {} \;

# 拉取最新镜像
docker pull tuxinvader/focal-mainline-builder:latest

# 或者手动编译不用 Docker
sudo apt install build-essential libncurses-dev \
  bison flex libssl-dev libelf-dev
make -j$(nproc) bindeb-pkg

sudo apt install linux-firmware

# 更新 GRUB
sudo update-grub

# 检查是否生成
grep menuentry /boot/grub/grub.cfg

NOTE: I am not responsible for any expired content.
Created at: 2025-01-12T16:16:49+08:00
Updated at: 2025-11-02T07:01:28+08:00
Origin issue: https://github.com/ferstar/blog/issues/82

P_SKIP_CI = re.compile(r"\[(skip\s*ci|ci\s*skip|no\s*ci)]", re.IGNORECASE)

@dataclass
class CommitCache:
    path: Path = Path(tempfile.gettempdir()) / "commits_cache.txt"
    max_size: int = 100
    ids: list[str] = field(default_factory=list)

    def __post_init__(self):
        if self.path.exists():
            self.ids = [i.strip() for i in self.path.read_text().split("\n") if i.strip()]

    def add(self, *ids):
        self.ids = (self.ids + [i for i in ids if i not in self.ids])[-self.max_size :]
        self.path.write_text("\n".join(self.ids))


@dataclass
class CommitDiff:
    rev: str
    author: str
    content: str
    parent_rev: str = field(init=False)

    def __post_init__(self):
        self.parent_rev = run(f"git rev-parse {self.rev}^", hide=True).stdout.strip()

    @property
    def changes(self):
        return f"""```
{run(f"git diff --name-only {self.rev}^!", hide=True).stdout.strip()}
```"""

    @property
    def msg(self):
        return run(f"git log {self.rev}^! --format=%B", hide=True).stdout.strip()

    @property
    def need_review(self):
        return any(
            i.startswith("diff --git") and i.endswith((".py", ".sh")) for i in self.content.split("\n")
        ) and not P_SKIP_CI.search(self.msg)

def prepare_commit_diff(log_range: int = 10, commit_range: int = 3) -> Iterable[CommitDiff]:
    """从指定(默认为最近10次)的提交中提取各 author 最近(默认为最近3次)的修改内容"""
    result = run(f'git log -n {log_range} --pretty=format:"%an" | sort | uniq', hide=True)
    commit_cache = CommitCache()
    for author in result.stdout.split("\n"):
        if not author:
            continue
        result = run(f"""git log --author="{author}" --pretty=format:'%H' -n {commit_range}""", hide=True).stdout
        for commit_id in (i for i in result.split("\n") if i):
            if commit_id not in commit_cache.ids:
                # 避免重复检查
                commit_cache.add(commit_id)
                diff = CommitDiff(
                    author=author,
                    rev=commit_id,
                    content=run(
                        f"git diff --ignore-all-space --diff-algorithm=minimal --function-context --no-ext-diff --no-color {commit_id}^!",
                        hide=True,
                    ).stdout,
                )
                if diff.need_review:
                    yield diff

system_instruction = """你是一位资深的 IT 编程专家，精通 `Python 3.12`、`FastAPI`、`Pydantic`、`Shell` 和 `SQL`。你的任务是**严格审查**给定的 `diff` 内容，并找出其中存在的**重大问题**。

**重大问题** 定义如下：

*   **安全漏洞：** 例如 SQL 注入、跨站脚本 (XSS)、未授权访问等。
*   **关键功能缺失：** 例如核心业务逻辑的缺失或错误实现。
*   **语法/编译/运行时错误：** 导致代码无法运行或崩溃的错误。
*   **性能瓶颈：**  导致程序运行缓慢或占用过多资源的瓶颈。
*   **资源泄露：** 例如内存泄漏、文件句柄未关闭等。
*   **关键逻辑错误：** 导致程序产生错误结果或行为的关键性错误。

**请忽略**以下类型的问题：

*   **一般问题：** 代码结构、可读性、潜在性能问题、代码风格、注释、未使用变量等不影响代码功能的因素。
*   **存疑问题：**  需要更多上下文才能确认的问题。
*   **`import` 语句相关的更改或缺失:** 例如新增、删除或修改 `import` 语句。

**请仅按以下格式回复：**

1. 重大问题：

    <重大问题列表，如果没有则回复“无”>

2. 建议：

    <针对重大问题的具体建议，如果没有则回复“无”>

**重要：** 严格按照上述格式输出，只关注重大问题和建议，不要包含任何其他内容。
"""

quality_prompt = """
__insert_diff__
"""


def init_openai_client() -> AsyncOpenAI:
    return AsyncOpenAI(
        api_key=get_config("ai.openai.api_key"),
        base_url=get_config("ai.openai.base_url"),
        default_headers={"Accept": "text/event-stream"},
    )


async def openai_chat_iter(
    messages: list[dict[str, str]], *, client: AsyncOpenAI = None, model: str = None, **options
) -> AsyncIterator[str]:
    client = client or init_openai_client()
    stream = client.chat.completions.create(
        messages=messages,
        model=model or get_config("ai.openai.model"),
        **{
            "temperature": get_config("ai.openai.temperature"),
            "timeout": get_config("ai.openai.timeout") or 10,
            "stream": True,
            **options,
        },
    )
    async for chunk in await stream:
        if chunk.choices and (content := chunk.choices[0].delta.content):
            yield content


async def openai_chat(messages: list[dict[str, str]]) -> str:
    reply = []
    async for chunk in openai_chat_iter(messages):
        reply.append(chunk)
    return "".join(reply)

@lru_cache(maxsize=1)
def get_repository_name():
    return run(r"git remote get-url origin | xargs basename | sed 's/\.git$//'", hide=True).stdout.strip()

async def quality_check(diff: CommitDiff):
    """质量检查&发送通知"""
    messages = [
        {"role": "system", "content": system_instruction},
        {"role": "user", "content": quality_prompt.replace("__insert_diff__", diff.content)},
    ]
    try:
        reply = await openai_chat(messages)
    except Exception as e:
        reply = f"Error: {e}"

    changes = f"xxx.git.com/{get_repository_name()}/-/compare/{diff.parent_rev}...{diff.rev}"
    content = f"""@{diff.author} [Show changes]({changes})

{diff.changes}

{reply}"""
    # 发送 review 通知
    send_notify(xxx)

NOTE: I am not responsible for any expired content.
Created at: 2025-01-06T14:55:44+08:00
Updated at: 2025-01-26T03:59:13+08:00
Origin issue: https://github.com/ferstar/blog/issues/81

# NOTE: I am not responsible for any expired content.
create@2024-01-10T03:10:50+08:00
update@2024-01-10T03:13:34+08:00
comment@https://github.com/ferstar/blog/issues/80

version: '3.8'
services:
  worker:
    image: myoung34/github-runner:ubuntu-bionic
    environment:
      REPO_URL: ${RUNNER_REPO}
      RUNNER_NAME: ${RUNNER_NAME}
      RUNNER_TOKEN: ${RUNNER_TOKEN}
      CONFIGURED_ACTIONS_RUNNER_FILES_DIR: ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}
      DISABLE_AUTOMATIC_DEREGISTRATION: ${DISABLE_AUTOMATIC_DEREGISTRATION}
      RUNNER_WORKDIR: /tmp/runner/work
      ORG_RUNNER: 'false'
      LABELS: linux,x64,home-1
    security_opt:
      # needed on SELinux systems to allow docker container to manage other docker containers
      - label:disable
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/tmp/runner:/tmp/runner'
      - './data:/data'
      # note: a quirk of docker-in-docker is that this path
      # needs to be the same path on host and inside the container,
      # docker mgmt cmds run outside of docker but expect the paths from within

RUNNER_REPO=https://github.com/user/repo
RUNNER_TOKEN=NOT THE GITHUB ACCESS TOKEN
RUNNER_NAME=foo
CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/data
DISABLE_AUTOMATIC_DEREGISTRATION=true

docker-compose up
Recreating github-actions_worker_1 ... done
Attaching to github-actions_worker_1
worker_1  | Runner reusage is disabled
worker_1  | Configuring
worker_1  |
worker_1  | --------------------------------------------------------------------------------
worker_1  | |        ____ _ _   _   _       _          _        _   _                      |
worker_1  | |       / ___(_) |_| | | |_   _| |__      / \   ___| |_(_) ___  _ __  ___      |
worker_1  | |      | |  _| | __| |_| | | | | '_ \    / _ \ / __| __| |/ _ \| '_ \/ __|     |
worker_1  | |      | |_| | | |_|  _  | |_| | |_) |  / ___ \ (__| |_| | (_) | | | \__ \     |
worker_1  | |       \____|_|\__|_| |_|\__,_|_.__/  /_/   \_\___|\__|_|\___/|_| |_|___/     |
worker_1  | |                                                                              |
worker_1  | |                       Self-hosted runner registration                        |
worker_1  | |                                                                              |
worker_1  | --------------------------------------------------------------------------------
worker_1  |
worker_1  | # Authentication
worker_1  |
worker_1  |
worker_1  | √ Connected to GitHub
worker_1  |
worker_1  | # Runner Registration
worker_1  |
worker_1  |
worker_1  |
worker_1  |
worker_1  | √ Runner successfully added
worker_1  | √ Runner connection is good
worker_1  |
worker_1  | # Runner settings
worker_1  |
worker_1  |
worker_1  | √ Settings Saved.
worker_1  |
worker_1  |
worker_1  | √ Connected to GitHub
worker_1  |
worker_1  | Current runner version: '2.308.0'
worker_1  | 2023-09-02 03:22:29Z: Listening for Jobs
worker_1  | 2023-09-02 03:23:08Z: Running job: build_deb
worker_1  | 2023-09-02 03:26:51Z: Job build_deb completed with result: Succeeded

# NOTE: I am not responsible for any expired content.
create@2023-09-02T04:23:11+08:00
update@2023-09-02T05:21:40+08:00
comment@https://github.com/ferstar/blog/issues/79

    return await self._protocol.query(query, timeout)
  File "asyncpg/protocol/protocol.pyx", line 338, in query
asyncpg.exceptions.FeatureNotSupportedError: UNLISTEN statement is not yet supported.

ProgrammingError: syntax error at or near "ON  CONFLICT ("

# NOTE: I am not responsible for any expired content.
create@2023-06-15T06:19:44+08:00
update@2023-06-15T06:19:44+08:00
comment@https://github.com/ferstar/blog/issues/78

import asyncio
import tornado


class MainHandler(tornado.web.RequestHandler):
    def get(self):
        self.write("Hello, world")


def make_app():
    return tornado.web.Application([
        (r"/api/v1/", MainHandler),
    ])


async def main():
    app = make_app()
    app.listen(8888)
    await asyncio.Event().wait()


if __name__ == "__main__":
    asyncio.run(main())

import asyncio
import contextvars
import functools
import urllib.parse as urllib_parse
from asyncio import Future
from typing import Any, List, Tuple

import tornado
import uvicorn
from a2wsgi.types import Environ, StartResponse
from a2wsgi.wsgi import Body, WSGIResponder, build_environ
from fastapi import FastAPI
from starlette.types import Receive, Scope, Send
from tornado import httputil
from tornado.escape import native_str
from tornado.web import Application


# WSGI has no facilities for flow control, so just return an already-done
# Future when the interface requires it.
def _dummy_future():
    f = Future()
    f.set_result(None)
    return f


class _WSGIRequestContext:
    def __init__(self, remote_ip, protocol):
        self.remote_ip = remote_ip
        self.protocol = protocol

    def __str__(self):
        return self.remote_ip


class _WSGIConnection(httputil.HTTPConnection):
    def __init__(self, method, start_response, context):
        self.method = method
        self.start_response = start_response
        self.context = context
        self._write_buffer = []
        self._finished = False
        self._expected_content_remaining = None
        self._error = None

    def set_close_callback(self, callback):
        # WSGI has no facility for detecting a closed connection mid-request,
        # so we can simply ignore the callback.
        pass

    def write_headers(self, start_line, headers, chunk=None, callback=None):
        if self.method == "HEAD":
            self._expected_content_remaining = 0
        elif "Content-Length" in headers:
            self._expected_content_remaining = int(headers["Content-Length"])
        else:
            self._expected_content_remaining = None
        self.start_response(
            "%d %s" % (start_line.code, start_line.reason),
            [(native_str(k), native_str(v)) for (k, v) in headers.get_all()],
        )
        if chunk is not None:
            self.write(chunk, callback)
        elif callback is not None:
            callback()
        return _dummy_future()

    def write(self, chunk, callback=None):
        if self._expected_content_remaining is not None:
            self._expected_content_remaining -= len(chunk)
            if self._expected_content_remaining < 0:
                self._error = httputil.HTTPOutputError(
                    "Tried to write more data than Content-Length"
                )
                raise self._error
        self._write_buffer.append(chunk)
        if callback is not None:
            callback()
        return _dummy_future()

    def finish(self):
        if (
            self._expected_content_remaining is not None
            and self._expected_content_remaining != 0
        ):
            self._error = httputil.HTTPOutputError(
                f"Tried to write {self._expected_content_remaining} bytes less than Content-Length"
            )
            raise self._error
        self._finished = True


class WSGIAdapter:
    def __init__(self, app):
        self.app = app

    async def __call__(
        self, environ: Environ, start_response: StartResponse
    ) -> List[bytes]:
        method = environ["REQUEST_METHOD"]
        uri = urllib_parse.quote(environ.get("SCRIPT_NAME", ""))
        uri += urllib_parse.quote(environ.get("PATH_INFO", ""))
        if environ.get("QUERY_STRING"):
            uri += "?" + environ["QUERY_STRING"]
        headers = httputil.HTTPHeaders()
        if environ.get("CONTENT_TYPE"):
            headers["Content-Type"] = environ["CONTENT_TYPE"]
        if environ.get("CONTENT_LENGTH"):
            headers["Content-Length"] = environ["CONTENT_LENGTH"]
        for key in environ:
            if key.startswith("HTTP_"):
                headers[key[5:].replace("_", "-")] = environ[key]
        if headers.get("Content-Length"):
            body = await environ["wsgi.input"].aread(int(headers["Content-Length"]))
        else:
            body = b""
        protocol = environ["wsgi.url_scheme"]
        remote_ip = environ.get("REMOTE_ADDR", "")
        if environ.get("HTTP_HOST"):
            host = environ["HTTP_HOST"]
        else:
            host = environ["SERVER_NAME"]
        connection = _WSGIConnection(
            method, start_response, _WSGIRequestContext(remote_ip, protocol)
        )
        request = httputil.HTTPServerRequest(
            method,
            uri,
            "HTTP/1.1",
            headers=headers,
            body=body,
            host=host,
            connection=connection,
        )
        request._parse_body()
        await self.app(request)
        if connection._error:
            raise connection._error
        if not connection._finished:
            raise Exception("request did not finish synchronously")
        return connection._write_buffer


class TornadoMiddleware:
    def __init__(self, app) -> None:
        self.app = WSGIAdapter(app)
        self.executor = None

    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
        if scope["type"] == "http":
            responder = _WSGIResponder(self.app, self.executor)
            return await responder(scope, receive, send)

        if scope["type"] == "websocket":
            await send({"type": "websocket.close", "code": 1000})
            return None


class _Body(Body):
    async def _areceive_more_data(self) -> bytes:
        if not self._has_more:
            return b""
        message = await self.receive()
        self._has_more = message.get("more_body", False)
        return message.get("body", b"")

    async def aread(self, size: int = -1) -> bytes:
        while size == -1 or size > len(self.buffer):
            self.buffer.extend(await self._areceive_more_data())
            if not self._has_more:
                break
        if size == -1:
            result = bytes(self.buffer)
            self.buffer.clear()
        else:
            result = bytes(self.buffer[:size])
            del self.buffer[:size]
        return result


class _WSGIResponder(WSGIResponder):
    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
        body = _Body(self.loop, receive)
        environ = build_environ(scope, body)
        sender = None
        try:
            sender = self.loop.create_task(self.sender(send))
            context = contextvars.copy_context()
            func = functools.partial(context.run, self.awsgi)
            await func(environ, self.start_response)
            self.send_queue.append(None)
            self.send_event.set()
            await asyncio.wait_for(sender, None)
            if self.exc_info is not None:
                raise self.exc_info[0].with_traceback(
                    self.exc_info[1], self.exc_info[2]
                )
        finally:
            if sender and not sender.done():
                sender.cancel()  # pragma: no cover

    def start_response(
        self,
        status: str,
        response_headers: List[Tuple[str, str]],
        exc_info: Any = None,
    ) -> None:
        self.exc_info = exc_info
        if not self.response_started:
            self.response_started = True
            status_code_string, _ = status.split(" ", 1)
            status_code = int(status_code_string)
            headers = [
                (name.strip().encode("latin1").lower(), value.strip().encode("latin1"))
                for name, value in response_headers
            ]
            self.send(
                {
                    "type": "http.response.start",
                    "status": status_code,
                    "headers": headers,
                }
            )

    async def awsgi(self, environ: Environ, start_response: StartResponse) -> None:
        for chunk in await self.app(environ, start_response):
            self.send({"type": "http.response.body", "body": chunk, "more_body": True})

        self.send({"type": "http.response.body", "body": b""})


class HandleDelegate(tornado.web._HandlerDelegate):
    def execute(self):
        if not self.application.settings.get("compiled_template_cache", True):
            with tornado.web.RequestHandler._template_loader_lock:
                for loader in tornado.web.RequestHandler._template_loaders.values():
                    loader.reset()
        if not self.application.settings.get("static_hash_cache", True):
            tornado.web.StaticFileHandler.reset()

        self.handler = self.handler_class(
            self.application, self.request, **self.handler_kwargs
        )
        transforms = [t(self.request) for t in self.application.transforms]

        return self.handler._execute(transforms, *self.path_args, **self.path_kwargs)


class TornadoApplication(Application):
    def get_handler_delegate(
        self,
        request,
        target_class,
        target_kwargs=None,
        path_args=None,
        path_kwargs=None,
    ):
        return HandleDelegate(
            self, request, target_class, target_kwargs, path_args, path_kwargs
        )


class MainHandler(tornado.web.RequestHandler):
    def get(self):
        self.write("Hello, world")


def make_app():
    return TornadoApplication([(r"/api/v1/", MainHandler)])


async def main():
    app = make_app()
    app.listen(8888)
    await asyncio.Event().wait()


app = FastAPI()
app.mount("/api/v1", TornadoMiddleware(make_app()))


@app.get("/api/v2/")
def hello_world():
    return {"message": "Hello, World!"}


if __name__ == "__main__":
    uvicorn.run(app, host="127.0.0.1", port=8888)