Git 客户端基本配置项

xxxxxxxxxx
# 执行方式：命令行执行即可
# 支持 utf-8 编码，显示中文文件名
git config --global core.quotepath false
# 提交/检出 不转换
git config --global core.autocrlf false
# 拒绝提交包含混合换行符的文件
git config --global core.safecrlf true
git config --global alias.st status
git config --global alias.co checkout
git config --global alias.ct commit
git config --global alias.df diff
git config --global alias.br branch
git config --global color.ui true
git config --global alias.lg "log --color --graph --pretty=format:'%Cred%h%Creset %C(bold blue)<%an>%Creset ---%C(yellow)%d%Creset %s %Cgreen(%cr)' --abbrev-commit"
# 指定 vim 作为默认的编辑器
git config core.editor vim --global
git config --global user.name xx
git config --global user.email xx@xxx.cn

Git .gitignore

xxxxxxxxxx
# From https://github.com/github/gitignore

# Prerequisites
*.d

# Compiled Object files
*.slo
*.lo
*.o
*.obj

# Precompiled Headers
*.gch
*.pch

# Compiled Dynamic libraries
*.so
*.dylib
*.dll

# Fortran module files
*.mod
*.smod

# Compiled Static libraries
*.lai
*.la
*.a
*.lib

# Executables
*.exe
*.out
*.app

# CMake
CMakeCache.txt
CMakeFiles
CMakeScripts
Testing
Makefile
cmake_install.cmake
install_manifest.txt
compile_commands.json
CTestTestfile.cmake

# Config
*.conf

# Log
log/
*.log

# Generated binary file/directory
debug/
release/
bin/
debug

VIM 基础配置

VIM 配置文件位置：~/.vimrc

点此下载：vimrc（下载后重命名为 .vimrc）

xxxxxxxxxx
set nocompatible
set backspace=indent,eol,start
set incsearch
set number
set hlsearch
set ignorecase
set tabstop=4
set shiftwidth=4
set softtabstop=4
set expandtab
set fileencodings=utf-8,gbk
set relativenumber " show relative line number
set ruler          " show the current line number and column number
set showcmd        " show the current typing command
set scrolloff=7    " Set 7 lines to the cursor - when moving vertically using j/k
set encoding=utf-8
set fileencodings=utf-8,ucs-bom,cp936,gb18030,big5,euc-jp,euc-kr,latin1
set helplang=en
set termencoding=utf-8
set laststatus=2
set cursorline

set guifont=Courier_New:h14:cANSI
set history=9999
set selection=exclusive
set selectmode=mouse,key
set fillchars=vert:\ ,stl:\ ,stlnc:\
set showmatch
set matchtime=1
set linebreak
set colorcolumn=100
set wrap
set tw=100

let mapleader = "\<Space>"
nmap <Leader><Leader> V
nnoremap <Leader>w :wq!<CR> "save file"
nmap <leader><Space><Space> :%s/\s\+$//<CR> "trimTrailingWhitespace"

" 自动补全 "
" inoremap ( ()<ESC>i<CR><CR><ESC>k
" inoremap [ []<ESC>i<CR><CR><ESC>k
" inoremap { {}<ESC>i<CR><CR><ESC>k
" inoremap " ""<ESC>i
" inoremap ' ''<ESC>i
" inoremap /* /* */<ESC>i

imap jj <ESC>

VS Code 基础配置

入口：文件 -> 首选项 -> 配置

备注：前两个配置项根据实际情况设置

xxxxxxxxxx
{
    "go.gopath": "d:\\go",
    "terminal.integrated.shell.windows": "C:\\Program Files\\Git\\bin\\bash.exe",
    "editor.wordWrapColumn": 100,
    "files.eol": "\n",
    "editor.insertSpaces": true,
    "editor.tabSize": 4,
    "files.trimTrailingWhitespace": true,
    "files.autoSave": "afterDelay",
    "editor.formatOnSave": true,
    "editor.formatOnPaste": true,
    "explorer.confirmDelete": true,
    "editor.detectIndentation": true,
    "team.showWelcomeMessage": false,
    "python.linting.flake8Enabled": true,
    "files.autoGuessEncoding": true
}

VS Code 快捷键

• 打开命令面板：Ctrl Alt P

• 查找文件：Ctrl P

• 结构导航：Alt N

• 跳转到指定行：Alt G

• 查找：Ctrl F

• 替换：Ctrl H

• 放大/缩小：Ctrl +/Ctrl -

VS Code 插件

EditorConfig for Visual Studio Code

设置文件编码、换行、去除行末空白、Tab 等

1. 安装插件

2. 项目文件夹根目录创建这个文件 .editorconfig，内容如下

xxxxxxxxxx
root = true

[*]
charset = utf-8
indent_style = space
indent_size = 4
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true

Clang-Format

1. 安装插件

2. 设置编码风格（以谷歌编码风格为例，可以个性化调整）

在 setting.json 中添加如下配置项即可

xxxxxxxxxx
"C_Cpp.clang_format_fallbackStyle": "{BasedOnStyle: Google, IndentWidth: 4, ColumnLimit: 150, AlignConsecutiveAssignments: true, AccessModifierOffset: -4}",

C/C++ 开发环境简易配置

xxxxxxxxxx
{
    "explorer.confirmDelete": false,
    "editor.formatOnPaste": false,
    "files.trimTrailingWhitespace": true,
    "editor.formatOnSave": false,
    "files.autoSave": "afterDelay",
    "files.autoSaveDelay": 100,
    "files.eol": "\n",
    "editor.fontSize": 16,
    "C_Cpp.clang_format_style": "{BasedOnStyle: Google, IndentWidth: 4, ColumnLimit: 150 , AlignConsecutiveAssignments: true, AccessModifierOffset: -4}",
    "editor.insertSpaces": true,
    "editor.tabSize": 4,
    "C_Cpp.updateChannel": "Insiders",
    "[cpp]": {
        "editor.defaultFormatter": "ms-vscode.cpptools"
    },
    "files.trimFinalNewlines": true
}

Typora Han 主题配置

在 Typora 主题配置目录新建 han，将如下内容保存为 han.css，点此下载，目录如下所示

xxxxxxxxxx
@charset "utf-8";

:root {
  --active-file-bg-color: #dadada;
  --active-file-bg-color: rgba(32, 43, 51, 0.63);
  --active-file-text-color: white;
  --bg-color: #fff;
  --text-color: #333;
  --side-bar-bg-color: #f5f5f5;
  --control-text-color: #666;
}

/* 防止用户自定义背景颜色对网页的影响，添加让用户可以自定义字体 */
html {
  color: #333;
  background: #fff;
  -webkit-text-size-adjust: 100%;
  -ms-text-size-adjust: 100%;
  text-rendering: optimizelegibility;
  font-size: 14px;
  -webkit-font-smoothing: initial;
}

#write {
  max-width: 960px;
  padding-top: 2em;
  padding-left: 60px;
  padding-right: 60px;
  min-height: calc(100vh - 6em);
  -webkit-font-smoothing: antialiased;
  font-size: 16px;
}

.typora-node #write {
  min-height: calc(100% - 6em);
}

pre.md-meta-block {
  background: #f5f5f5;
  padding: 1em;
  border-radius: 3px;
  font-size: 14px;
}

@media screen and (max-width: 800px) {
    html {
      font-size: 14px;
    }

    #write {
      padding-left: 30px;
      padding-right: 30px;
      font-size: 14px;
    }
}

@media screen and (min-width: 1100px) {
    body, #footer-word-count-info {
      background: #f5f5f5;
    }

    body.pin-outline,
    .pin-outline #footer-word-count-info,
    .pin-outline footer {
      background: #fff;
    }

    #write {
      max-width: 1000px;
      padding: 40px 60px;
      background: #fff;
      margin: 3em auto 3em;
      border: 1px solid #ddd;
      border-width: 0 1px;
    }

    .pin-outline #write {
      max-width: 1000px;
      background: #fff;
      margin: 0 0 0;
      border: 0;
      padding-left: 60px;
      padding-right: 60px;
    }

    footer {
      background-color: transparent;
    }
}

@media screen and (min-width: 1300px) {
    body.pin-outline,
    .pin-outline #footer-word-count-info,
    .pin-outline footer {
      background: #f5f5f5;
    }

    .pin-outline  #write {
      max-width: 1000px;
      padding: 40px 60px;
      background: #fff;
      margin: 3em auto 3em;
      border: 1px solid #ddd;
      border-width: 0 1px;
    }

    .pin-outline footer {
      background-color: transparent;
    }

    #footer-word-count-info {
      background: #f5f5f5;
    }
}


/* 如果你的项目仅支持 IE9+ | Chrome | Firefox 等，推荐在 <html> 中添加 .borderbox 这个 class */
html.borderbox *, html.borderbox *:before, html.borderbox *:after {
  -moz-box-sizing: border-box;
  -webkit-box-sizing: border-box;
  box-sizing: border-box;
}

/* 内外边距通常让各个浏览器样式的表现位置不同 */
body, dl, dt, dd, ul, ol, li, h1, h2, h3, h4, h5, h6, code, form, fieldset, legend, input, textarea, p, blockquote, th, td, hr, button, article, aside, details, figcaption, figure, footer, header, menu, nav, section {
  margin: 0;
  padding: 0;
}

/* 重设 HTML5 标签, IE 需要在 js 中 createElement(TAG) */
article, aside, details, figcaption, figure, footer, header, menu, nav, section {
  display: block;
}

/* HTML5 媒体文件跟 img 保持一致 */
audio, canvas, video {
  display: inline-block;
}

/* 要注意表单元素并不继承父级 font 的问题 */
body, button, input, select, textarea {
  font: 300 1em/1.8 "PingFang SC", "Lantinghei SC", "Microsoft Yahei", "Hiragino Sans GB", "Microsoft Sans Serif", "WenQuanYi Micro Hei", sans;
}

body {
  font-family: "PingFang SC", "Lantinghei SC", "Microsoft Yahei", "Hiragino Sans GB", "Microsoft Sans Serif", "WenQuanYi Micro Hei", sans;
}

h1, h2, h3, h4, h5, h6 {
  font-family: "TimesNewRomanPS-ItalicMT", "PingFang SC", "Lantinghei SC", "Microsoft Yahei", "Hiragino Sans GB", "Microsoft Sans Serif", "WenQuanYi Micro Hei", sans;
  /*font-family: "PingFang SC", "Lantinghei SC", "Microsoft Yahei", "Hiragino Sans GB", "Microsoft Sans Serif", "WenQuanYi Micro Hei", sans;*/
  -webkit-font-smoothing: initial;
  font-weight: 100;
  color: var(--text-color);
  line-height: 1.35;
  font-variant-numeric: lining-nums;
  margin-bottom: 1em;
}

em {
  font-family: Georgia-Italic, STSongti-SC-Light, serif;
}

strong em,
em strong {
  font-family: Georgia-BoldItalic, STSongti-SC-Regular, serif;
}

button::-moz-focus-inner,
input::-moz-focus-inner {
  padding: 0;
  border: 0;
}

/* 去掉各Table cell 的边距并让其边重合 */
table {
  border-collapse: collapse;
  border-spacing: 0;
}

/* 去除默认边框 */
fieldset, img {
  border: 0;
}

/* 块/段落引用 */
blockquote {
  position: relative;
  color: #999;
  font-weight: 400;
  border-left: 1px solid #1abc9c;
  padding-left: 1em;
  margin: 1em 3em 1em 2em;
}

@media only screen and ( max-width: 640px ) {
  blockquote {
    margin: 1em 0;
  }
}

/* Firefox 以外，元素没有下划线，需添加 */
acronym, abbr {
  border-bottom: 1px dotted;
  font-variant: normal;
}

/* 添加鼠标问号，进一步确保应用的语义是正确的（要知道，交互他们也有洁癖，如果你不去掉，那得多花点口舌） */
abbr {
  cursor: help;
}

address, caption, cite, code, dfn, th, var {
  font-style: normal;
  font-weight: 400;
}

/* 去掉列表前的标识, li 会继承，大部分网站通常用列表来很多内容，所以应该当去 */
ul, ol {
  list-style: none;
}

/* 对齐是排版最重要的因素, 别让什么都居中 */
caption, th {
  text-align: left;
}

q:before, q:after {
  content: '';
}

/* 统一上标和下标 */
sub, sup {
  font-size: 75%;
  line-height: 0;
  position: relative;
}

:root sub, :root sup {
  vertical-align: baseline; /* for ie9 and other modern browsers */
}

sup {
  top: -0.5em;
}

sub {
  bottom: -0.25em;
}

/* 让链接在 hover 状态下显示下划线 */
a {
  color: #1abc9c;
}

a:hover {
  text-decoration: underline;
}

#write a {
  border-bottom: 1px solid #1abc9c;
}

#write a:hover {
  border-bottom-color: #555;
  color: #555;
  text-decoration: none;
}

/* 默认不显示下划线，保持页面简洁 */
ins, a {
  text-decoration: none;
}

/* 标记，类似于手写的荧光笔的作用 */
mark {
  background: #fffdd1;
  border-bottom: 1px solid #ffedce;
  padding: 2px;
  margin: 0 5px;
}

/* 代码片断 */
pre, code, pre tt {
  font-family: Courier, 'Courier New', monospace;
}

#write .md-fences {
  border: 1px solid #ddd;
  padding: 1em 0.5em;
  display: block;
  -webkit-overflow-scrolling: touch;
}

/* 一致化 horizontal rule */
hr {
  border: none;
  border-bottom: 1px solid #cfcfcf;
  margin-bottom: 0.8em;
  height: 10px;
}

#write strong {
  font-weight: 900;
  color:#383838;
  /*font-weight: bloder;
  /*color: #000;*/
}

.code-tooltip.md-hover-tip strong {
  color: white;
}

/* 保证块/段落之间的空白隔行 */
#write p, #write .md-fences, #write ul, #write ol, #write dl, #write form, #write hr, #write figure,
#write-p, #write-pre, #write-ul, #write-ol, #write-dl, #write-form, #write-hr, #write-table, blockquote {
  margin-bottom: 1.2em
}

html {
  font-family: PingFang SC, Verdana, Helvetica Neue, Microsoft Yahei, Hiragino Sans GB, Microsoft Sans Serif, WenQuanYi Micro Hei, sans-serif;
}

/* 标题应该更贴紧内容，并与其他块区分，margin 值要相应做优化 */
#write h1, #write h2, #write h3, #write h4, #write h5, #write h6,
#write-h1, #write-h2, #write-h3, #write-h4, #write-h5, #write-h6 {
  margin-top: 1.2em;
  margin-bottom: 0.6em;
  line-height: 1.35;
  color: #000;
}

#write h1, #write-h1 {
  font-size: 2.4em;
  padding-bottom: 1em;
  border-bottom: 3px double #eee;
}

#write h2, #write-h2 {
  font-size: 1.8em;
}

#write h3, #write-h3 {
  font-size: 1.6em;
}

#write h4, #write-h4 {
  font-size: 1.4em;
}

#write h5, #write h6, #write-h5, #write-h6 {
  font-size: 1.2em;
}

/* 在文章中，应该还原 ul 和 ol 的样式 */
#write ul, #write-ul {
  margin-left: 1.3em;
  list-style: disc;
}

#write ol, #write-ol {
  list-style: decimal;
  margin-left: 1.9em;
}

#write li ul, #write li ol, #write-ul ul, #write-ul ol, #write-ol ul, #write-ol ol {
  margin-bottom: 0.8em;
  margin-left: 2em;
}

#write li ul, #write-ul ul, #write-ol ul {
  list-style: circle;
}

#write table th, #write table td {
  border: 1px solid #ddd;
  padding: 0.5em 1em;
  color: #666;
}

#write table .md-table-edit th {
  border: none;
  padding: 0;
  color: inherit;
}

#write table th, #write-table th {
  background: #fbfbfb;
}

#write table thead th, #write-table thead th {
  background: #f1f1f1;
}

#write table caption {
  border-bottom: none;
}

#write em {
  font-weight: inherit;
  font-style: inherit;
}

li>p {
    margin-bottom: 0 !important;
}

/* Responsive images */
#write img {
  max-width: 100%;
}

a.md-toc-inner {
    border-bottom: 0 !important;
}

.md-toc-h1:first-of-type:last-of-type{
  display: none;
}

.md-toc {
  font-size: inherit;
}

.md-toc-h1 .md-toc-inner {
  font-weight: normal;
}

.md-table-edit th {
  padding: 0 !important;
  border: 0 !important;
}

.mac-seamless-mode #write {
  min-height: calc(100vh - 6em - 20px);
}

.typora-quick-open-item.active {
    color: var(--active-file-text-color);
}

*.in-text-selection, ::selection {
    background: var(--active-file-bg-color);
    text-shadow: none;
    color: white;
}

.btn-primary {
    background-color: #2d2d2d;
    border-color: #020202;
}

.btn-primary:hover, .btn-primary:focus, .btn-primary.focus, .btn-primary:active, .btn-primary.active, .open > .dropdown-toggle.btn-primary {
    background-color: #4e4c4e;
    border: #4e4c4e;
}

#preference-dialog .modal-content{
  background: #6e757a;
  --bg-color: #6e757a;
  --text-color: #f1f1f1;
  color: #f1f1f1;
}

#typora-source,
.typora-sourceview-on  {
  --bg-color: #eee;
  background: #eee;
}

.cm-s-typora-default .cm-header, .cm-s-typora-default .cm-property {
    color: #116098;
}

.cm-s-typora-default .cm-link {
    color: #11987d;
}

.cm-s-typora-default .cm-em {
  font-family: Georgia-Italic, STSongti-SC-Light, serif;
  color: #6f6400;
}

.cm-s-typora-default .cm-em{
    color: rgb(0, 22, 45);
}

.CodeMirror.cm-s-typora-default div.CodeMirror-cursor{
    border-left: 3px solid #6e757a;
}

.cm-s-typora-default .CodeMirror-selectedtext,
.typora-sourceview-on .CodeMirror-focused .CodeMirror-selected {
    background: #6e757a;
    color: white;
}

.file-node-icon.fa.fa-folder:before {
  color: rgba(32, 43, 51, 0.49);
}

#preference-dialog .megamenu-menu-panel h1 {
  margin-bottom: 1em;
}

::-webkit-scrollbar-corner {
  display: none;
  background: transparent;
}

.cm-s-inner {
  background-color: #263238;
  color: rgba(233, 237, 237, 1);
}
.cm-s-inner .CodeMirror-gutters {
  background: #263238;
  color: rgb(83,127,126);
  border: none;
}
.cm-s-inner .CodeMirror-guttermarker, .cm-s-inner .CodeMirror-guttermarker-subtle, .cm-s-inner .CodeMirror-linenumber { color: rgb(83,127,126); }
.cm-s-inner .CodeMirror-cursor { border-left: 1px solid #f8f8f0; }
.cm-s-inner div.CodeMirror-selected { background: rgba(255, 255, 255, 0.15); }
.cm-s-inner.CodeMirror-focused div.CodeMirror-selected { background: rgba(255, 255, 255, 0.10); }
.cm-s-inner .CodeMirror-line::selection, .cm-s-inner .CodeMirror-line > span::selection, .cm-s-inner .CodeMirror-line > span > span::selection { background: rgba(255, 255, 255, 0.10); }
.cm-s-inner .CodeMirror-line::-moz-selection, .cm-s-inner .CodeMirror-line > span::-moz-selection, .cm-s-inner .CodeMirror-line > span > span::-moz-selection { background: rgba(255, 255, 255, 0.10); }

.cm-s-inner .CodeMirror-activeline-background { background: rgba(0, 0, 0, 0); }
.cm-s-inner .cm-keyword { color: rgba(199, 146, 234, 1); }
.cm-s-inner .cm-operator { color: rgba(233, 237, 237, 1); }
.cm-s-inner .cm-variable-2 { color: #80CBC4; }
.cm-s-inner .cm-variable-3 { color: #82B1FF; }
.cm-s-inner .cm-builtin { color: #DECB6B; }
.cm-s-inner .cm-atom { color: #F77669; }
.cm-s-inner .cm-number { color: #F77669; }
.cm-s-inner .cm-def { color: rgba(233, 237, 237, 1); }
.cm-s-inner .cm-string { color: #C3E88D; }
.cm-s-inner .cm-string-2 { color: #80CBC4; }
.cm-s-inner .cm-comment { color: #546E7A; }
.cm-s-inner .cm-variable { color: #82B1FF; }
.cm-s-inner .cm-tag { color: #80CBC4; }
.cm-s-inner .cm-meta { color: #80CBC4; }
.cm-s-inner .cm-attribute { color: #FFCB6B; }
.cm-s-inner .cm-property { color: #80CBAE; }
.cm-s-inner .cm-qualifier { color: #DECB6B; }
.cm-s-inner .cm-variable-3 { color: #DECB6B; }
.cm-s-inner .cm-tag { color: rgba(255, 83, 112, 1); }
.cm-s-inner .cm-error {
  color: rgba(255, 255, 255, 1.0);
  background-color: #EC5F67;
}
.cm-s-inner .CodeMirror-matchingbracket {
  text-decoration: underline;
  color: white !important;
}

/**apply to code fences with plan text**/
.md-fences {
  background-color: #263238;
  color: rgba(233, 237, 237, 1);
  border: none;
}

.md-fences .code-tooltip {
  background-color: #263238;
}

Makefile 模板

xxxxxxxxxx
INCLUDES := -I. -I./include -I/opt/Ice-3.5.1/include
LIBS := -Wl,--enable-new-dtags -Wl,-rpath,/opt/Ice-3.5/lib64
LIBS += -Wl,-Bstatic  -L./lib -lcpp_redis -ltacopie
LIBS += -Wl,-Bdynamic -L/opt/Ice-3.5.1/lib64 -lIce -lIceUtil

CXX := g++ -std=c++11
CXXFLAGS := -rdynamic -m64 -Wall -Wextra -pthread -fPIC -g $(INCLUDES)
# 把所有警告当做错误：-Werror，支持 C++ 11：-std=c++11
CXXFLAGS +=  -Werror -std=c++11

TARGETS := server
TARGETS += client

all: $(TARGETS)

db.cpp db.h: db.ice
  slice2cpp $^

server: db.o dbi.o server.o
  $(CXX) -o $@ $^ $(LIBS)

client: db.o dbi.o client.o
  $(CXX) -o $@ $^ $(LIBS)

clean:
  rm -f *.o $(TARGETS)

Lets Encrypt 证书制作、使用

证书制作

1. 获取 certbot 客户端

xxxxxxxxxx
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto

2. 生成证书

同时生成支持 i-deer.com 和 www.i-deer.com 的证书

xxxxxxxxxx
#!/bin/bash

/opt/cert/certbot-auto --no-self-upgrade certonly --webroot -w /usr/share/nginx/html --agree-tos --email c.r2009@163.com -d i-deer.com -d www.i-deer.com

3. 查看证书文件

xxxxxxxxxx
tree /etc/letsencrypt/live/

4. 证书更新

证书默认 90 有效，更新不能太频繁，同一域名一周之内最多只能更新 5 次

xxxxxxxxxx
#!/bin/bash

#./certbot-auto renew 
./certbot-auto renew --no-self-upgrade

使用 snap 制作证书

certbot-auto 不再支持所有的操作系统。certbot 团队认为维护 certbot-auto 在几乎所有流行的 UNIX 系统以及各种环境上的正常运行是一项繁重的工作，加之 certbot-auto 是基于 python 2 编写的，而 python 2 即将寿终正寝，将 certbot-auto 迁移至 python 3 需要大量工作，这非常困难，因此团队决定放弃 certbot-auto 的维护，certbot 团队使用了基于 snap 的新的分发方法。

1. 安装 snapd

xxxxxxxxxx
yum install epel-release -y
yum install snapd -y

2. 启用 snapd.socket

xxxxxxxxxx
systemctl enable --now snapd.socket

3. 创建 /var/lib/snapd/snap 和 /snap 之间的链接

xxxxxxxxxx
ln -s /var/lib/snapd/snap /snap

4. 退出账号并重新登陆，或者重启系统，确保 snap 启用

5. 更新 snap

xxxxxxxxxx
snap install core
snap refresh core

6. 卸载已安装的certbot。

如果之前在系统上已经部署过 certbot，则需要先将其进行卸载。

a. 卸载certbot

xxxxxxxxxx
yum remove certbot

b. 根据 certbot 安装位置删除相关文件

xxxxxxxxxx
rm /usr/local/bin/certbot-auto

c. 删除 certbot 附加软件包

xxxxxxxxxx
rm -rf /opt/eff.org/certbot

安装certbot

7. 通过snap安装certbot。

xxxxxxxxxx
snap install --classic certbot

8. 创建/snap/bin/certbot 软链接，方便 certbot 命令的使用

xxxxxxxxxx
ln -s /snap/bin/certbot /usr/bin/certbot

9. 生成证书

cert-name 指生成的证书文件的名称，可以与域名无关

xxxxxxxxxx
certbot certonly --nginx --email <email> --cert-name <cert-file-name> -d hello.com -d word.com

certbot 使用第一个域名作为证书中的 CN(common name)，如果先前申请证书由于子域名传参的顺序导致 CN 与预期不符合，可以通过强制更新重新调整域名参数顺序达到更改 CN 的目的

xxxxxxxxxx
certbot certonly --force-renew -d word.com -d hello.com

10. 更新证书

xxxxxxxxxx
certbot renew

Amazon Linux 2023 安装 certbot

xxxxxxxxxx
dnf remove certbot
dnf install python3 augeas-libs
python3 -m venv /opt/certbot/
/opt/certbot/bin/pip install --upgrade pip
/opt/certbot/bin/pip install certbot certbot-nginx
ln -s /opt/certbot/bin/certbot /usr/bin/certbot

综合使用

基础环境：Nginx 1.12.2/CentOS 7.6

域名解析：i-deer.com（同时添加 @ 和 www 两条解析）

证书：同时支持 i-deer.com 和 www.i-deer.com

目标：

• www.i-deer.com 跳转 i-deer.com

• http 跳转 https

即，http://i-deer.com 和 http://www.i-deer.com 和 https://i-deer.com 和 https://www.i-deer.com 最终都跳转到 https://i-deer.com

xxxxxxxxxx
  server {
        listen       80;
        server_name i-deer.com www.i-deer.com;
        return 301 https://i-deer.com$request_uri;
    }

    server {
        listen 443;
        server_name www.i-deer.com;
        return 301 https://i-deer.com$request_uri;
    }

    server {
        listen 443 default_server ssl;
        server_name  i-deer.com;
        ssl on;

        gzip on;
        gzip_disable "msie6";
        
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        gzip_http_version 1.1;
        gzip_min_length 256;
        gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon image/jpeg image/gif image/png;


        #ssl                     on;
        #error_page 497          https://$host:443$uri;
        #error_page 497         https://$host:443$request_uri?$args;

        ssl_certificate "/etc/letsencrypt/live/i-deer.com/fullchain.pem";
        ssl_certificate_key "/etc/letsencrypt/live/i-deer.com/privkey.pem";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location /download {
            alias /opt/rplab-download;
            index  h5DownLoad.html index.html index.htm;
        }

        location /yljdownload {
            alias /opt/ylj-download;
            index  h5DownLoad.html index.html index.htm;
        }

        location / {
            root /opt/ideer-website;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

安装 CURL 支持 http2

基础环境

• CentOS 6.8

• Python 2.6.6

• CURL 7.19.7

安装依赖库

xxxxxxxxxx
yum install -y readline-devel sqlite-devel lz4 lz4-devel gdbm gdbm-devel bzip2 openssl openssl-devel libdbi-devel ncurses-libs zlib-devel _bsddb bz2 dl

安装 Python 2.7.3

nghttp2 依赖 Python 2.7.x

xxxxxxxxxx
# 下载、安装 Python 2.7.3
wget http://python.org/ftp/python/2.7.3/Python-2.7.3.tar.bz2
tar -jxvf Python-2.7.3.tar.bz2
cd Python-2.7.3
./configure
make -j4 all
make install

# 修复其他服务（如，YUM）对旧版本 Python 2.6.6 的依赖
mv /usr/bin/python /usr/bin/python-2.6.6
ln -sf /usr/local/bin/python2.7 /usr/bin/python
sed -i "s/#\!\/usr\/bin\/python/#\!\/usr\/bin\/python-2.6.6/" /usr/bin/yum

安装 nghttp2 v1.14.x

CURL 依赖 nghttp2 提供对 http2 的支持，因此，需要先安装 nghttp2

xxxxxxxxxx
git clone https://github.com/tatsuhiro-t/nghttp2.git
cd nghttp2

# 默认 master 分支，切换到特定的分支，例如 v1.14.x
git checkout -b v1.14.x origin/v1.14.x

autoreconf -i
automake
autoconf
./configure
make -j4
make install
echo '/usr/local/lib' > /etc/ld.so.conf.d/local.conf
ldconfig

# 查看 nghttp2
[root@localhost curl-7.46.0]# whereis libnghttp2
libnghttp2: /usr/local/lib/libnghttp2.a /usr/local/lib/libnghttp2.la /usr/local/lib/libnghttp2.so

安装 CURL 7.46.0

xxxxxxxxxx
# 安装 CURL 7.46.0
wget http://curl.haxx.se/download/curl-7.46.0.tar.bz2
tar -xvjf curl-7.46.0.tar.bz2
cd curl-7.46.0
./configure --with-nghttp2=/usr/local --with-ssl
make -j4
make install

# 替换旧版本
ln -sf /usr/local/bin/curl /usr/bin/curl

确认 CURL 版本以及是否支持 http2

xxxxxxxxxx
# 查看 CURL 版本以及所有支持的协议、特性
[root@localhost curl-7.46.0]# curl --version
curl 7.46.0 (x86_64-pc-linux-gnu) libcurl/7.46.0 OpenSSL/1.0.1e zlib/1.2.3 nghttp2/1.14.1
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: IPv6 Largefile NTLM NTLM_WB SSL libz HTTP2 UnixSockets

# 如下提示则表明此版本 CURL 支持 http2
[root@localhost curl-7.46.0]# curl --http2 -I https://nghttp2.org/
HTTP/2.0 200
date:Thu, 12 Apr 2018 16:31:22 GMT
content-type:text/html
last-modified:Thu, 12 Apr 2018 15:17:17 GMT
etag:"5acf787d-19d8"
accept-ranges:bytes
content-length:6616
x-backend-header-rtt:0.001775
strict-transport-security:max-age=31536000
server:nghttpx
via:2 nghttpx
x-frame-options:SAMEORIGIN
x-xss-protection:1; mode=block
x-content-type-options:nosniff

Mail 发送邮件

1. 配置 /etc/mail.rc

xxxxxxxxxx
set from=xuchao@bigsillybear.com smtp="smtp.bigsillybear.com"
set smtp-auth-user="xuchao@bigsillybear.com" smtp-auth-password="HiBigsillybear"
set smtp-auth=login

2. 发送邮件

xxxxxxxxxx
# 发送主题为 test，邮件正文为 ca.pem 文件内容，包含附件 ca.pem 的邮件到 cloud_dev@bigsillybear.com
mail -s "test" -a ca.pem cloud_dev@bigsillybear.com < ca.pem

# 发送主题为 test，邮件正文为 hello world 的邮件到 cloud_dev@bigsillybear.com
echo "hello world"|mail -s "test" cloud_dev@bigsillybear.com

Visual Studio Code 配置 GoLang 开发环境

1. 官网下载 GoLang 安装包，安装之后 go version 查看版本

xxxxxxxxxx
$ go version
go version go1.10.1 windows/amd64

安装时勾选添加环境变量，不需要单独添加环境变量；否则，需要新添加环境变量，如下：

计算机（右键）-> 属性 -> 高级系统设置 -> 高级 -> 环境变量 -> 系统变量

• 添加 变量名 GOROOT，值为安装目录，如 C:\app\Go\

• 变量名 Path，追加值 C:\app\Go\bin;

2. 设置环境变量 GOPATH，具体操作如步骤 1 所示，值为后续你存放源码的目录，如 D:\go

3. 打开 Git Bash，设置 Go Module 全局代理，依次安装如下依赖项

xxxxxxxxxx
# Enable the go modules feature
export GO111MODULE=on
# Set the GOPROXY environment variable
export GOPROXY=https://goproxy.io

xxxxxxxxxx
go get -u -v github.com/nsf/gocode
go get -u -v github.com/rogpeppe/godef
go get -u -v github.com/golang/lint/golint
go get -u -v github.com/lukehoban/go-outline
go get -u -v sourcegraph.com/sqs/goreturns
go get -u -v golang.org/x/tools/cmd/gorename
go get -u -v github.com/tpng/gopkgs
go get -u -v github.com/newhook/go-symbols
go get -u -v golang.org/x/tools/cmd/guru

# 可选择性下载
# protobuf 相关，需要安装 protoc
go get -u -v github.com/golang/protobuf/protoc-gen-go
go get -u -v github.com/golang/protobuf/proto
# grpc
go get -u -v google.golang.org/grpc

4. 安装 VS Code

5. 安装 VS Code 各种插件，打开 VS Code，按 Ctrl+Shift+P，输入 install ext，输入 go，选中安装即可

VS Code 支持各种语法，同理，安装对应的插件即可，如，需要支持 C++，安装 C++ 插件即可

Shell 终端提示符设置

xxxxxxxxxx
PS1 是 linux 里头的一个默认的环境变量，用来设置命令提示符的环境变量。
    \d ：代表日期，格式为 weekday month date，例如："Mon Aug 1"
    \H ：完整的主机名称。例如：我的机器名称为：fc4.linux，则这个名称就是 fc4.linux
    \h ：仅取主机的第一个名字，如上例，则为 fc4，.linux 则被省略
    \t ：显示时间为 24 小时格式，如：HH：MM：SS
    \T ：显示时间为 12 小时格式
    \A ：显示时间为 24 小时格式：HH：MM
    \u ：当前用户的账号名称
    \v ：BASH 的版本信息
    \w ：完整的工作目录名称。家目录会以 ~ 代替
    \W ：利用 basename 取得工作目录名称，所以只会列出最后一个目录
    \# ：下达的第几个命令
    \$ ：提示字符，如果是 root 时，提示符为：# ，普通用户则为：$

目标：让 shell 只显示最后一个目录名而不显示完整的路径，并且不显示主机名

1. 编辑 ~/.bashrc，将所有的 PS1 中的 \w 替换为 \W，并去掉 @\h

2. 重新打开终端即可生效

修改前

xxxxxxxxxx
root@ibc-VirtualBox:~/chaincode/tmp#

修改后

xxxxxxxxxx
root:fabric#

阿里云挂载磁盘

1. 查看系统分件格式

xxxxxxxxxx
[root@ ~]# df -h -T
/dev/vda1      ext4       40G  4.6G   33G  13% /
devtmpfs       devtmpfs  7.5G     0  7.5G   0% /dev
tmpfs          tmpfs     7.6G     0  7.6G   0% /dev/shm
tmpfs          tmpfs     7.6G  344K  7.6G   1% /run
tmpfs          tmpfs     7.6G     0  7.6G   0% /sys/fs/cgroup
tmpfs          tmpfs     1.6G     0  1.6G   0% /run/user/0

2. 查看未挂载磁盘

xxxxxxxxxx
[root@ ~]# fdisk -l

Disk /dev/vda: 42.9 GB, 42949672960 bytes, 83886080 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000d2717

   Device Boot      Start         End      Blocks   Id  System
/dev/vda1   *        2048    83884031    41940992   83  Linux

Disk /dev/vdb: 1099.5 GB, 1099511627776 bytes, 2147483648 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

3. 挂载磁盘

xxxxxxxxxx
[root@ ~]# mount /dev/vdb /data

如果挂载出现如下错误：

xxxxxxxxxx
mount: /dev/vdb is write-protected, mounting read-only
mount: unknown filesystem type '(null)'

需要对磁盘进行初始化，如下所示：

xxxxxxxxxx
mkfs.ext4 /dev/vdb

4. 确认已挂载

卸载磁盘 umount /data 即可

xxxxxxxxxx
[root@ ~]# df -h -T
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/vda1      ext4       40G  4.6G   33G  13% /
devtmpfs       devtmpfs  7.5G     0  7.5G   0% /dev
tmpfs          tmpfs     7.6G     0  7.6G   0% /dev/shm
tmpfs          tmpfs     7.6G  344K  7.6G   1% /run
tmpfs          tmpfs     7.6G     0  7.6G   0% /sys/fs/cgroup
tmpfs          tmpfs     1.6G     0  1.6G   0% /run/user/0
/dev/vdb       ext4     1008G   40G  918G   5% /data

阿里云添加 swap 交换分区

阿里云 ECS 服务器的 swap 功能默认没有开启，因为 swap 功能会增加磁盘 IO 的占用率，降低磁盘寿命和性能，另一方面也可以借此让用户购买更大的内存。启用 swap 分区，一定程度上可以降低物理内存的使用压力，但如果云服务器上运行的应用确实需要更多的内存，还是需要购买物理内存。

1. 创建分区文件

xxxxxxxxxx
# 以创建 4G 为例，可自行调整
[root@ ~]# dd if=/dev/zero of=/mnt/swap bs=4M count=1024
1024+0 records in
1024+0 records out
4294967296 bytes (4.3 GB) copied, 37.8632 s, 113 MB/s

2. 设置交换分区文件

xxxxxxxxxx
[root@ ~]# mkswap /mnt/swap

3. 修改内核参数

值越大，表示越积极使用 swap 分区，越小表示越积极使用物理内存

默认值 swappiness=60，表示内存使用率超过 100-60=40% 时开始使用交换分区

swappiness=0 的时候表示最大限度使用物理内存，然后才是 swap 空间`

swappiness＝100 的时候表示积极使用 swap 分区，并把内存上的数据及时搬运到 swap空间

xxxxxxxxxx
[root@ ~]# vim /etc/sysctl.conf
vm.swappiness = 60

4. 使内核参数修改生效

xxxxxxxxxx
[root@ ~]# sysctl -p

5. 启用此交换分区的交换功能

xxxxxxxxxx
[root@ ~]# swapon /mnt/swap
swapon: /mnt/swap: insecure permissions 0644, 0600 suggested.
[root@ ~]# chmod 0600 /mnt/swap

6. 设置开机时自动启用 swap 分区

xxxxxxxxxx
[root@ ~]# echo "/mnt/swap swap swap defaults 0 0" >> /etc/fstab

7. 确认 swap 分区是否生效

xxxxxxxxxx
[root@ ~]# cat /proc/swaps
Filename                                Type            Size    Used    Priority
/mnt/swap                               file            4194300 0       -2
[root@wwhs-application ~]# 
[root@ ~]# free -m
              total        used        free      shared  buff/cache   available
Mem:           1838        1308          80           0         449         368
Swap:          4095           0        4095

8. 如果需要关闭 swap 分区，修改 /etc/fstab 文件，删除或注释相关配置，取消 swap 的自动挂载

xxxxxxxxxx
[root@ ~]# swapoff /mnt/swap

阿里云系统盘扩容

系统：CentOS 7.x

控制台扩容之后一定要通过控制台重启服务器，命令行重启无效

1. 安装工具

xxxxxxxxxx
yum install -y cloud-utils-growpart

2. 查看现有磁盘大小

xxxxxxxxxx
fdisk -l

3. 查看磁盘分区大小

xxxxxxxxxx
df -h

4. 为系统盘的第一个分区扩容

xxxxxxxxxx
growpart /dev/vda 1

5. 为系统盘的 /dev/vda1 分区扩容文件系统

xxxxxxxxxx
 resize2fs /dev/vda1

6. 确认磁盘分区大小已变更

xxxxxxxxxx
df -h

阿里云数据盘扩容

系统：CentOS 7.x

控制台扩容之后一定要通过控制台重启服务器，命令行重启无效

如果挂载多个数据盘，修改对应的设备名称即可（例如，vdc1）

使用 df -hT 查看系统类型，如果是 xfs 系统，扩容文件系统 resize2fs 替换为 xfs_growfs

1. 安装工具

xxxxxxxxxx
yum install -y cloud-utils-growpart

2. 查看现有磁盘大小

xxxxxxxxxx
fdisk -l

3. 查看磁盘分区大小

xxxxxxxxxx
df -h

4. 为系统盘的第一个分区扩容

xxxxxxxxxx
growpart /dev/vdb 1

5. 为系统盘的 /dev/vdb1 分区扩容文件系统

如果失败，尝试 resize2fs /dev/vdb

xxxxxxxxxx
 resize2fs /dev/vdb1

6. 确认磁盘分区大小已变更

xxxxxxxxxx
df -h

AWS CloudFront

整体逻辑：用户最终访问的域名 -> 域名解析中 CNAME 解析找到分配器对应的域名 -> 分配器访问源站点

1. 配置分配器

AWS CloudFront 分配器对应的域名 https://d123bfsrk43iz.cloudfront.net，备用域名填写用户最终访问的域名 X，换言之，用户通过访问 X 来访问通过 AWS CloudFront 实现加速的站点

在域名解析添加 CNAME 别名解析

2. 配置源

3. 配置行为

如果要实现用户通过 http 访问站点自动跳转到 https，则选择 Redirect HTTP to HTTPS 策略

Prometheus+Grafana 监控告警

系统：CentOS 7.6

安装 prometheus

1. 添加用户和组

xxxxxxxxxx
groupadd prometheus
mkdir -p /opt/prometheus
useradd -g prometheus prometheus -d /opt/prometheus

2. 下载并解压 prometheus

xxxxxxxxxx
cd ~
wget https://github.com/prometheus/prometheus/releases/download/v2.5.0/prometheus-2.5.0.linux-amd64.tar.gz
tar -xvf prometheus-2.5.0.linux-amd64.tar.gz
cd prometheus-2.5.0.linux-amd64/
mv * /opt/prometheus/

3. 创建运行目录

xxxxxxxxxx
cd /opt/prometheus/
mkdir {data,cfg,logs,bin} -p
mv prometheus promtool bin/
mv prometheus.yml cfg/

4. 目录授权

xxxxxxxxxx
chown -R prometheus.prometheus /opt/prometheus

5. 添加环境变量

xxxxxxxxxx
vim /etc/profile
export PATH=/opt/prometheus/bin:$PATH:$HOME/bin
source /etc/profile

6. 创建启动服务

xxxxxxxxxx
vim /etc/systemd/system/prometheus.service

[Unit]
Description=Prometheus
Documentation=https://prometheus.io/
After=network.target

[Service]
Type=simple
User=prometheus
ExecStart=/opt/prometheus/bin/prometheus --config.file=/opt/prometheus/cfg/prometheus.yml --storage.tsdb.path=/opt/prometheus/data
Restart=on-failure

[Install]
WantedBy=multi-user.target

7. 启动服务

xxxxxxxxxx
systemctl daemon-reload
systemctl enable prometheus.service
systemctl start prometheus.service

8. 验证服务

通过 http://<host>:9090 可以访问 prometheus，并查看信息

安装 grafana

1. 下载并安装

xxxxxxxxxx
wget https://dl.grafana.com/oss/release/grafana-5.4.0-1.x86_64.rpm
yum localinstall grafana-5.4.0-1.x86_64.rpm

2. 启动服务

xxxxxxxxxx
systemctl daemon-reload
systemctl enable grafana-server.service
systemctl start grafana-server.service

3. 验证服务

通过 http://<host>:3000 可以访问 grafana，默认账户密码 admin/admin，并查看信息

4. 添加 prometheus 数据源

选择 prometheus 数据源

填写 URL，点击测试并保存

配置监控面板

添加监控面板有两种方式，其一为新建，其二使用之前面板的配置文件，导入即可。此处，使用导入原配置文件。

可以选择上传本地配置文件或者粘贴配置文件内容

选择之前配置好的 prometheus 数据源

将数据可视化效果如下所示

配置告警

点击添加通道

配置钉钉告警通道

添加钉钉告警通道，可以先测试一次

测试结果如下所示

配置邮件告警通道

在 grafana 配置文件 /etc/grafana/grafana.ini 配置邮件告警发送邮箱信息

添加邮件告警，包含告警接收邮箱信息

查看告警通道列表

配置告警规则

配置每 5 秒钟检测一次，如果 CPU 使用率超过 30% 就告警的规则

如果检测到状态为健康，如下所示（默认，红色代表不健康）

绑定告警通道，可以同时绑定多个通道，触发告警之后多个通道通知

DockerHub 上传镜像

1. https://hub.docker.com/ 注册账户，并创建镜像仓库

2. 基于已有容器创建镜像

镜像仓库为 dudebing99/u18，镜像 tag 为 v1

xxxxxxxxxx
➜  ~ docker commit 512411c00fb4 dudebing99/u18:v1
sha256:a51369e90faf0ff8be95942e6999613ba8e3081f9ad66e7e1ae092a75b46aa29

3. 查看本地镜像

xxxxxxxxxx
➜  ~ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
dudebing99/u18      v1                  a51369e90faf        43 seconds ago      745MB
ubuntu              16.04               56bab49eef2e        2 months ago        123MB
ubuntu              18.04               775349758637        2 months ago        64.2MB
centos              latest              0f3e07c0138f        3 months ago        220MB
ubuntu              14.04               2c5e00d77a67        8 months ago        188MB
mysql               5.7.21              5195076672a7        22 months ago       371MB

3. 上传镜像到 DockerHub

命令格式：docker push <hub-user>/<repo-name>:<tag>

xxxxxxxxxx
➜  ~ docker push dudebing99/u18:v1
The push refers to repository [docker.io/dudebing99/u18]
ec2f7e3800b2: Pushed
v1: digest: sha256:6643590adf8bd4301008e6fc72ad0443c1a1cc21510e050ba8ec5445a15a9ef1 size: 1365

4. 查看镜像

查看镜像详情，拉取镜像命令 docker pull dudebing99/u18:v1

5. 从 DockerHub 拉取镜像

xxxxxxxxxx
root@ubuntu:~# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
root@ubuntu:~# docker pull dudebing99/u18:v1
v1: Pulling from dudebing99/u18
7ddbc47eeb70: Pull complete 
c1bbdc448b72: Pull complete 
8c3b70e39044: Pull complete 
45d437916d57: Pull complete 
97b648407d44: Pull complete 
Digest: sha256:6643590adf8bd4301008e6fc72ad0443c1a1cc21510e050ba8ec5445a15a9ef1
Status: Downloaded newer image for dudebing99/u18:v1
root@ubuntu:~# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
dudebing99/u18      v1                  a51369e90faf        5 hours ago         745MB
root@ubuntu:~# docker search dudebing99
NAME                DESCRIPTION         STARS               OFFICIAL            AUTOMATED
dudebing99/u18      Ubuntu 18 Dev       0 

CentOS 安装 vsftpd

CentOS 7.6/vsftpd 3.0.2

1. 按照 vsftpd

xxxxxxxxxx
yum install vsftpd ftp -y

2. 添加用户

xxxxxxxxxx
useradd -d /home/ftp -g ftp -s /sbin/nologin kevin -p 123456
passwd kevin

3. 配置 vsftpd

xxxxxxxxxx
[root@wwhs ~]# cat /etc/vsftpd/vsftpd.conf 
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
xferlog_std_format=YES
xferlog_file=/var/log/vsftpd.log
ftpd_banner=Welcome to FTP service.
listen=YES

pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd/user_list
tcp_wrappers=YES
download_enable=YES

connect_from_port_20=YES

pasv_enable=YES
pasv_promiscuous=YES
pasv_min_port=10000
pasv_max_port=20000

# 限速 500KByte
local_max_rate=500000

4. 配置 user_list

xxxxxxxxxx
[root@wwhs ~]# cat /etc/vsftpd/user_list 
# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
#
kevin

5. 配置 pam

xxxxxxxxxx
[root@wwhs ~]# cat /etc/pam.d/vsftpd 
#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
#auth       required    pam_shells.so
auth       include      password-auth
account    include      password-auth
session    required     pam_loginuid.so
session    include      password-auth

6. 防火墙开放 21、20、30000-31000 端口

xxxxxxxxxx
-A INPUT -p tcp -m multiport --dport 20,21  -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp --dport 30000:31000 -j ACCEPT

7. 启动服务

xxxxxxxxxx
service vsftpd start

CentOS 安装 Apache Tomcat 9，支持 http2

xxxxxxxxxx
#!/bin/sh

PWD=`pwd`
ROOT=$PWD

echo "install gcc"
yum install gcc -y

echo "install expect"
yum install expect -y

echo "yum install curl"
yum install curl -y

echo "install jdk"
tar -zxvf jdk-8u111-linux-x64.tar.gz
mv jdk1.8.0_111/ /usr/local

cat >> /etc/profile << EOF
#add jdk related environment variables
JAVA_HOME=/usr/local/jdk1.8.0_111
CLASSPATH=.:\$JAVA_HOME/jre/lib/rt.jar:\$JAVA_HOME/lib/dt.jar:\$JAVA_HOME/lib/tools.jar
JRE_HOME=\$JAVA_HOME/jre

export JAVA_HOME=\$JAVA_HOME
export CLASSPATH=\$CLASSPATH
export JRE_HOME=\$JRE_HOME
export PATH=\$PATH:\$JAVA_HOME/bin
EOF

echo "set env temporary"
JAVA_HOME=/usr/local/jdk1.8.0_111
CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
JRE_HOME=$JAVA_HOME/jre
export JAVA_HOME=$JAVA_HOME
export CLASSPATH=$CLASSPATH
export JRE_HOME=$JRE_HOME
export PATH=$PATH:$JAVA_HOME/bin

echo "install apr"
tar -xzvf apr-1.5.2.tar.gz
cd apr-1.5.2
./configure --prefix=/usr/local/apr
make -j4
make install
cd -
rm -rf apr-1.5.2

echo "install apr-util"
tar -xzvf apr-util-1.5.4.tar.gz
cd apr-util-1.5.4
./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
make -j4
make install
cd -
rm -rf apr-util-1.5.4

echo "install openssl"
tar -xzvf openssl-1.0.2h.tar.gz
cd openssl-1.0.2h
./config shared --prefix=/usr/local/openssl
make depend
make -j4
make install
cd -
rm -rf openssl-1.0.2h

echo "install apache tomcat"
tar -xzvf apache-tomcat-9.0.0.M17.tar.gz
mv apache-tomcat-9.0.0.M17 /usr/local
cd /usr/local/apache-tomcat-9.0.0.M17/bin
tar -xzvf tomcat-native.tar.gz
cd tomcat-native-1.2.10-src/native
./configure --prefix=/usr/local/native --with-apr=/usr/local/apr --with-ssl=/usr/local/openssl
make -j4
make install

cat >> /etc/profile << EOF
#add native related environment variables
NATIVE_HOME=/usr/local/native

export NATIVE_HOME=\$NATIVE_HOME
export LD_LIBRARY_PATH=\$LD_LIBRARY_PATH:\$NATIVE_HOME/lib
EOF

NATIVE_HOME=/usr/local/native
export NATIVE_HOME=$NATIVE_HOME
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$NATIVE_HOME/lib

echo "gen cert related"
mkdir $ROOT/cert
cd $ROOT/cert
openssl genrsa -out server.key 2048
openssl rsa -in server.key -out server.key

cat > gen_cert.sh << EOF
#!/usr/bin/expect -f

set timeout 30

spawn openssl req -new -x509 -key server.key -out ca.crt -days 3650
expect {
    "Country Name (2 letter code)" {
        send "cn\r";
        exp_continue
    }

    "State or Province Name (full name)" {
        send "Guang Dong\r";
        exp_continue
    }

    "Locality Name (eg, city)" {
        send "Shen Zhen\r";
        exp_continue
    }

    "Organization Name (eg, company)" {
        send "xxx.com\r";
        exp_continue
    }

    "Organizational Unit Name (eg, section)" {
        send "Dev\r";
        exp_continue
    }

    "Common Name (eg, your name or your server's hostname)" {
        send "stream service\r";
        exp_continue
    }

    "Email Address" {
        send "dev@xxx.com\r";
        exp_continue
    }
}
EOF

chmod +x gen_cert.sh
./gen_cert.sh
cd $ROOT
cp -r $ROOT/cert/* /usr/local/apache-tomcat-9.0.0.M17/conf
rm -rf $ROOT/cert

echo "modify tomcat conf"
cat > /usr/local/apache-tomcat-9.0.0.M17/conf/server.xml << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!-- Note:  A "Server" is not itself a "Container", so you may not
     define subcomponents such as "Valves" at this level.
     Documentation at /docs/config/server.html
 -->
<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <!-- Security listener. Documentation at /docs/config/listeners.html
  <Listener className="org.apache.catalina.security.SecurityListener" />
  -->
  <!--APR library loader. Documentation at /docs/apr.html -->
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

  <!-- Global JNDI resources
       Documentation at /docs/jndi-resources-howto.html
  -->
  <GlobalNamingResources>
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users
    -->
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

  <!-- A "Service" is a collection of one or more "Connectors" that share
       a single "Container" Note:  A "Service" is not itself a "Container",
       so you may not define subcomponents such as "Valves" at this level.
       Documentation at /docs/config/service.html
   -->
  <Service name="Catalina">

    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
    <!--
    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
        maxThreads="150" minSpareThreads="4"/>
    -->


    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         Java HTTP Connector: /docs/config/http.html
         Java AJP  Connector: /docs/config/ajp.html
         APR (HTTP/AJP) Connector: /docs/apr.html
         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
    -->
    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    <!-- A "Connector" using the shared thread pool-->
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    -->
    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
         This connector uses the NIO implementation. The default
         SSLImplementation will depend on the presence of the APR/native
         library and the useOpenSSL attribute of the
         AprLifecycleListener.
         Either JSSE or OpenSSL style configuration may be used regardless of
         the SSLImplementation selected. JSSE style configuration is used below.
    -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true">
        <SSLHostConfig>
            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>
    -->
    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
         This connector uses the APR/native implementation which always uses
         OpenSSL for TLS.
         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
         configuration is used below.
    -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
                         certificateFile="conf/localhost-rsa-cert.pem"
                         certificateChainFile="conf/localhost-rsa-chain.pem"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>
    -->

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeyFile="conf/server.key"
                certificateFile="conf/ca.crt"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />


    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host).
         Documentation at /docs/config/engine.html -->

    <!-- You should set jvmRoute to support load-balancing via AJP ie :
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
    -->
    <Engine name="Catalina" defaultHost="localhost">

      <!--For clustering, please take a look at documentation at:
          /docs/cluster-howto.html  (simple how to)
          /docs/config/cluster.html (reference documentation) -->
      <!--
      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
      -->

      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
           via a brute-force attack -->
      <Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI
             resources under the key "UserDatabase".  Any edits
             that are performed against this UserDatabase are immediately
             available for use by the Realm.  -->
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase"/>
      </Realm>

      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
        -->

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html
             Note: The pattern used is equivalent to using pattern="common" -->
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="localhost_access_log" suffix=".txt"
               pattern="%h %l %u %t &quot;%r&quot; %s %b" />

      </Host>
    </Engine>
  </Service>
</Server>
EOF

echo "start tomcat"
cd /usr/local/apache-tomcat-9.0.0.M17/bin
./startup.sh

sleep 5

echo "test tomcat"
curl -k -I https://localhost:8443

echo "stop tomcat"
cd /usr/local/apache-tomcat-9.0.0.M17/bin
./shutdown.sh

echo ""
echo "ATTENTION: RUN 'source /etc/profile'"
echo ""