Hi there 👋

環境與模型 硬體：NVIDIA GB10 模型：Qwen 3.6 27B（Q4_K_M 量化） 推理引擎實測結論 引擎 結果 vLLM ✅ 多人同時連線 8 線、16 線都撐得住——唯一通過考驗 SGLang 理論上更強，但 demo 和實際上線是兩回事，實戰未驗證 Ollama 很快掛掉，必須自己建 queue 排隊處理 LM Studio 單人測試正常，多人一測就爆，試多次都爆 測試過程 一開始放棄 Ollama，改用 LM Studio 先測 OCR：找到可用模型、設定正確的 threads 寫一個循環 Windows script，上網抓發票、表格圖片至少二、三十張 打到 LM Studio API，一張一張跑，單人全部正常 打包給 MIS 相關人員與預使用人員同時測試 → 多人一測，LM Studio 直接爆掉（試多次都爆） 改用 vLLM 版本 → 不再爆 改成無限循環版本（打開就一直送不停），單一 PC 開 4 線、8 線，從週五下班跑到週一早上 → 完全正常，辨識也正確 只有這樣才證明撐得過高峰並發多人使用，這才是企業內真正的實際運用。 應用場景 會計大量作帳、內部文件 OCR：不定時、大量文件 未來：現場設定即時不斷辨識，壓力更大——每 1 分鐘跑一次；30~50 台設備同時上線，沒有高並發直接爆 文件類型 客戶報價單、公司報價單回填、材料相關表格 MES / WMS / SCM 相關文件、產生履歷文件（目標：減少打字時間） 跟發票這種千奇百怪的類型不同：手寫單據、出場、驗收——人寫的，這些真的要靠 AI 高並發 真實場景 一車來三櫃驗收單，一次來二十車，不同廠區同時運作

查了一下，發現，辨門號不是問題，主要是辨銀行帳號 最簡單辨是 五通碼頭 廈門銀行 然後 當日船票 台胞證 台灣身分證 至少 1,000 元人民幣 但問題是 廈門銀行 在大陸分點不多，將來帶人民幣要存，也不能跨行存，大陸四大，最多的是 工商銀行 建設銀行 中國銀行 農業銀行 所以要辨成就是四大行 ….. 如果是刷信用卡，目前支付寶、微信 現在有200人民幣以下是免3%手續費，但這是階段性的推廣優惠 但實際上 信用卡本身還有海外手續費，匯率比較差的問題 200人民幣，看fb討論，是可以請商家分開刷，就可以免掉這3% 信用卡要找海外手續費有優的，匯率就沒有辨法避免了！ 所以要嘛有銀行帳戶，要不然就是請認識的人轉匯存到餘額、錢包 但我必須說，人在大陸請人協助轉匯，也是有風險，因為國家含台灣 是不允許私下轉匯的，這點一定要了解 總之看討論，如果短期，用信用卡，200人民以上分開刷，找信用卡要海外手續費低或減免，這樣是可行的 不過 就像之前說的，很有可能碰到個別小店家無法付款的情況，這時候又需要餘額、錢包、現金來支付！ 在 2026 年，台灣人使用支付寶或微信支付綁定台灣信用卡，在信用卡的挑選上有一個最致命的盲點：許多銀行在 2026 年縮減了權益，將加碼回饋限定在「海外實體商店」。由於手機綁定 App 掃碼在大陸請款時，在系統中多會被歸類為「海外網路交易（網購）」而非實體刷卡，因此如果選錯卡，將完全拿不到加碼回饋 2026 網購與海外無腦神卡推薦 台新銀行 FlyGo卡 / Richart系列卡：核心優勢：在 2026 年依然維持極具競爭力的 3.3% 海外消費回饋。最重要的是它不限實體通路，屬於海外無腦刷的代表，綁定支付寶與微信支付能穩定拿到 3.3%。省錢實算：扣除 1.5% 台灣銀行海外手續費後，每一筆 200 元人民幣以下的消費，您還能淨賺 1.8% 的現金回饋。 富邦銀行 J卡：核心優勢：2026 年最新的權益特別針對「中港澳地區」進行大加碼，實體與指定網路消費最高享 6% 回饋（內含基本回饋與限額加碼）。富邦 J 卡在兩岸三地的系統對接一向非常穩定，是目前專攻大陸旅遊的首選之一。 Richart系列卡 就是那個黑狗之前辨的，然後切換到 玩旅刷，這樣的話，刷信用卡，還能賺錢 1.8% 現金回鐀 還有一些注意事項要看，而且這方案期限內 PS: 大額消費絕不連續「切西瓜」分刷：如果在海鮮餐廳吃大餐總共 600 元人民幣，網路上常有人教「分成 3 次 200 元刷免 3% 手續費」。千萬不要在同一個商家連續分刷！ 支付寶與微信的風控系統非常嚴格，短時間內連續刷同一張台灣卡，會直接判定為盜刷並將卡片鎖定，在外地會非常麻煩 [threads.com]。如果是大額消費，建議直接支付 4.5% 的綜合手續費，或是改用現金支付。 ...

「算力女粉絲」頻道分享 Box 創辦人 Aaron Levie 對 AI 裁員議題的看法。 重點整理 AI 能自動化中間很多步驟，但很難獨立承擔完整責任——事情的開始與結尾仍然需要人 Agent 越多，人類越要背鍋：AI Agent 進入企業流程後，出錯時負責的還是人，人類從執行者變成要為 AI 流程失誤負責的角色 AI 改變的是技能，不是整個職位：真正被改變的往往不是職位突然消失，而是職位需要的技能被自動化 為什麼 AI 寫程式很強，企業還是不滿意：企業要的不是更多程式碼，而是可以運行、維護、審計並承擔責任的系統 現實決策仍需要人：AI 會改變工作、縮編部分職位，但關鍵決策與責任歸屬短期內離不開人 影片章節 03:41 軟體工程師的失業焦慮 04:38 Agent 進入企業流程，風險在哪裡 05:35 Agent 越多，人越要負責 07:07 AI 裁員應該怎麼看 08:12 哪些工作最容易被 AI 縮編 08:42 為什麼現實決策仍然需要人 影片連結：https://www.youtube.com/watch?v=kMo5512mm5k

Bilibili 中配版，原片為 Tech With Soleyman《AI Layoffs Have Completely Backfired (here’s the proof)》（2026-04-04）。 重點整理 數據面：引用高德納、弗雷斯特、麥肯錫三家機構的調研，企業用 AI 裁員普遍未達預期效果 亞馬遜案例：強制要求工程師使用 AI 工具並納入考核後，發生多次大規模生產故障、損失數百萬訂單，最後被迫重啟嚴格安全審核 失敗核心原因：流程治理缺失、資深工程師被裁造成經驗斷層、AI 與複雜生產場景適配度不足——本質是企業營運決策失誤，而非 AI 已能完全替代工程師 企業堅持裁員的真實動機：撐股價、為 AI 基礎設施騰資金、維護 CEO 形象、仿效馬斯克裁員降本模式；數據顯示僅不到 5% 的裁員真正與 AI 替代能力相關 給技術從業者的建議：成為具全局視野的系統思考者、把 AI 當輔助工具但不依賴、掌握雲工程核心技能——雲人才缺口仍巨大 影片連結：https://www.bilibili.com/video/BV1i1RLBuEPC

當服務使用 8000 3000 這種時，traefik 會出現 2026-Mar-27 05:14:29 2026-03-27T05:14:29Z ERR error="service \"api-gkm2zpl2acc7zs\" error: port is missing" container=api-gkm2zplmrpaf8963173b209f481ca6e3baefcefbf2e52607f8465 providerName=docker 就需要加上 expose: - "8000" 附上完整的 version: '3.8' services: web: build: context: . dockerfile: Dockerfile.web api: image: node:24-alpine environment: - DATABASE_URL=postgres://user:password@db:5432/mydb - REDIS_URL=redis://redis:6379 - SERVICE_URL_API_8000 expose: - "8000" command: > node -e " const http = require('http'); const server = http.createServer((req, res) => { res.setHeader('Access-Control-Allow-Origin', '*'); // 允許前端跨域 res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ status: 'success', message: 'API is working!', env: { db: process.env.DB_HOST, redis: process.env.REDIS_HOST } })); }); server.listen(8000, () => console.log('API listening on 8000')); " depends_on: - db - redis db: image: postgres:15-alpine environment: - POSTGRES_USER=user - POSTGRES_PASSWORD=password - POSTGRES_DB=mydb volumes: - db-data:/var/lib/postgresql/data redis: image: redis:7-alpine volumes: db-data: 基本上再連就能正確連接 ...

Windows 使用 Docker Desktop 時， 虛擬交換器 -> 外路網路 選擇實體網卡 例：Intel(R) Wifi … 會在 控制台\網路和網際網路\網路連線 產生橋接器 和 一個 vEthernet(ooxx (Hyper-V firewall)) 的虛擬網路相關設定 其中 vEthernet 需要調整 checksum 打開 vEthernet -> 內容 -> 設定 -> 進階 Large Send Offload Version 2 (IPv4) Enabled -> Disabled Large Send Offload Version 2 (IPv6) Enabled -> Disabled 基本上就能解決速度過慢的問題 https://blog.darkthread.net/blog/hyperv-virtual-switch-wifi-slow/ https://learn.microsoft.com/en-us/answers/questions/88989/windows-server-2016-hyper-v-external-switch-really

https://turso.tech/ https://github.com/tursodatabase/libsql self host binary https://virtala.dev/posts/libsql-self-hosting/ docker https://github.com/tursodatabase/libsql/blob/main/docs/DOCKER.md

waf

#!/usr/sbin/nft -f # From https://wiki.gbe0.com/en/linux/firewalling-and-filtering/nftables/template-inbound-outbound ## Clear/flush all existing rules flush ruleset # 定義變數 define DOCKER_SUBNETS = { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16 } define PRIVATE_SUBNETS = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } # Main inet family filtering table table inet filter { # Rules for forwarded traffic chain forward { type filter hook forward priority 0; policy drop # 防止 IP 欺騙攻擊 iifname "docker0" ip saddr != $DOCKER_SUBNETS counter drop comment "防止 Docker IP 欺騙" iifname "br-*" ip saddr != $DOCKER_SUBNETS counter drop comment "防止 Docker 橋接網路 IP 欺騙" # 允許 Docker 容器網路轉發 # 允許從 Docker 網橋到任何地方的轉發，但有來源 IP 檢查 iifname "docker0" ip saddr $DOCKER_SUBNETS counter accept comment "允許來自 Docker 的轉發流量" iifname "br-*" ip saddr $DOCKER_SUBNETS counter accept comment "允許來自 Docker 網橋的轉發流量" # 允許已建立連接的回應流量 oifname { "docker0", "br-*" } ct state established,related counter accept comment "允許返回 Docker 的回應流量" meta l4proto { tcp, udp } th dport 53 counter accept comment "允許 DNS 查詢轉發" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "Forward - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for input traffic chain input { type filter hook input priority 0; policy drop ## Permit inbound traffic to loopback interface iif lo \ accept \ comment "Permit all traffic in from loopback interface" # 允許來自 Docker 網路的連接 iifname { "docker0", "br-*" } counter accept comment "允許來自 Docker 網路的流量" # 添加針對常見掃描攻擊的防禦 tcp flags & (fin|syn|rst|ack) == 0 counter drop comment "空封包丟棄" # 防止 TCP 探測掃描 tcp flags syn tcp option maxseg size 0 counter drop comment "丟棄異常的 MSS 值封包" # SYN flood 防護 tcp flags syn tcp dport { 22, 80, 443 } ct state new limit rate 10/second counter accept comment "防止 SYN flood" tcp flags syn tcp dport { 22, 80, 443 } ct state new counter drop comment "丟棄超出速率的 SYN 封包" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Log and drop new TCP non-SYN packets tcp flags != syn ct state new \ limit rate 100/minute burst 150 packets \ log prefix "IN - New !SYN: " \ comment "Rate limit logging for new connections that do not have the SYN TCP flag set" tcp flags != syn ct state new \ counter \ drop \ comment "Drop new connections that do not have the SYN TCP flag set" ## Log and drop TCP packets with invalid fin/syn flag set tcp flags & (fin|syn) == (fin|syn) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP FIN|SIN: " \ comment "Rate limit logging for TCP packets with invalid fin/syn flag set" tcp flags & (fin|syn) == (fin|syn) \ counter \ drop \ comment "Drop TCP packets with invalid fin/syn flag set" ## Log and drop TCP packets with invalid syn/rst flag set tcp flags & (syn|rst) == (syn|rst) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP SYN|RST: " \ comment "Rate limit logging for TCP packets with invalid syn/rst flag set" tcp flags & (syn|rst) == (syn|rst) \ counter \ drop \ comment "Drop TCP packets with invalid syn/rst flag set" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)" tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN|PSH|URG:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "IN - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit inbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit inbound UDP traceroute limited to 500 PPS" ## Permit inbound SSH tcp dport ssh ct state new \ counter \ accept \ comment "Permit inbound SSH connections" ## Permit inbound HTTP and HTTPS tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit inbound HTTP and HTTPS connections" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "IN - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for output traffic chain output { type filter hook output priority 0; policy drop ## Permit outbound traffic to loopback interface oif lo \ accept \ comment "Permit all traffic out to loopback interface" # 允許 Docker 相關的輸出流量 oifname { "docker0", "br-*" } counter accept comment "允許 Docker 網路輸出" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "OUT - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit outbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit outbound UDP traceroute limited to 500 PPS" ## Allow outbound HTTP and HTTPS connections tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit outbound HTTP and HTTPS connections" ## Permit outbound DNS requests meta l4proto { tcp, udp } th dport 53 \ counter \ accept \ comment "Permit outbound TCP and UDP DNS requests" ## Allow outbound NTP requests udp dport 123 \ counter \ accept \ comment "Permit outbound NTP requests" # 在日誌記錄前添加額外的計數器以便監控 counter comment "計數即將丟棄的流量" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "OUT - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } } # 在主要表格後添加 table inet nat { chain prerouting { type nat hook prerouting priority -100; policy accept; } chain postrouting { type nat hook postrouting priority 100; policy accept; # 正確處理 Docker 網路 NAT ip saddr $DOCKER_SUBNETS oifname != { "docker0", "br-*" } masquerade comment "Docker 容器 NAT" } }

#!/usr/sbin/nft -f # From https://wiki.gbe0.com/en/linux/firewalling-and-filtering/nftables/template-inbound-outbound ## Clear/flush all existing rules flush ruleset # Main inet family filtering table table inet filter { # Rules for forwarded traffic chain forward { type filter hook forward priority 0; policy drop # 允許 Docker 容器網路轉發 # 允許從 Docker 網橋到任何地方的轉發 iifname "docker0" counter accept comment "允許來自 Docker 的轉發流量" iifname "br-*" counter accept comment "允許來自 Docker 網橋的轉發流量" # 允許已建立連接的回應流量 oifname { "docker0", "br-*" } ct state established,related counter accept comment "允許返回 Docker 的回應流量" meta l4proto { tcp, udp } th dport 53 counter accept comment "允許 DNS 查詢轉發" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "Forward - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for input traffic chain input { type filter hook input priority 0; policy drop ## Permit inbound traffic to loopback interface iif lo \ accept \ comment "Permit all traffic in from loopback interface" # 允許來自 Docker 網路的連接 iifname { "docker0", "br-*" } counter accept comment "允許來自 Docker 網路的流量" # 允許來自 Docker 網路的連接 iifname { "docker0", "br-*" } counter accept comment "允許來自 Docker 網路的流量" # 添加針對常見掃描攻擊的防禦 tcp flags & (fin|syn|rst|ack) == 0 counter drop comment "空封包丟棄" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Log and drop new TCP non-SYN packets tcp flags != syn ct state new \ limit rate 100/minute burst 150 packets \ log prefix "IN - New !SYN: " \ comment "Rate limit logging for new connections that do not have the SYN TCP flag set" tcp flags != syn ct state new \ counter \ drop \ comment "Drop new connections that do not have the SYN TCP flag set" ## Log and drop TCP packets with invalid fin/syn flag set tcp flags & (fin|syn) == (fin|syn) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP FIN|SIN: " \ comment "Rate limit logging for TCP packets with invalid fin/syn flag set" tcp flags & (fin|syn) == (fin|syn) \ counter \ drop \ comment "Drop TCP packets with invalid fin/syn flag set" ## Log and drop TCP packets with invalid syn/rst flag set tcp flags & (syn|rst) == (syn|rst) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP SYN|RST: " \ comment "Rate limit logging for TCP packets with invalid syn/rst flag set" tcp flags & (syn|rst) == (syn|rst) \ counter \ drop \ comment "Drop TCP packets with invalid syn/rst flag set" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)" tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN|PSH|URG:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "IN - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit inbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit inbound UDP traceroute limited to 500 PPS" ## Permit inbound SSH tcp dport ssh ct state new \ counter \ accept \ comment "Permit inbound SSH connections" ## Permit inbound HTTP and HTTPS tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit inbound HTTP and HTTPS connections" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "IN - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for output traffic chain output { type filter hook output priority 0; policy drop ## Permit outbound traffic to loopback interface oif lo \ accept \ comment "Permit all traffic out to loopback interface" # 允許 Docker 相關的輸出流量 oifname { "docker0", "br-*" } counter accept comment "允許 Docker 網路輸出" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "OUT - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit outbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit outbound UDP traceroute limited to 500 PPS" ## Allow outbound HTTP and HTTPS connections tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit outbound HTTP and HTTPS connections" ## Permit outbound DNS requests meta l4proto { tcp, udp } th dport 53 \ counter \ accept \ comment "Permit outbound TCP and UDP DNS requests" ## Allow outbound NTP requests udp dport 123 \ counter \ accept \ comment "Permit outbound NTP requests" # 在日誌記錄前添加額外的計數器以便監控 counter comment "計數即將丟棄的流量" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "OUT - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } }

https://github.com/hanggrian/markdown-pdf-styles/tree/main samples includes css .vscode/setting.json { "markdown-pdf.styles": ["./markdown-pdf.css"] } markdown-pdf.css mix css

You want Build time use .env setting context. Two way: source .env package.json > “build”: “source .env && nuxt build” eval $(grep ‘^NUXT_’ .env) package.json > “build”: “eval $(grep ‘^PROD_’ .env) && nuxt build” ^RROD_ can replace by yourself .env file inside PROD_API_URL=https://ooxxooxx

file download const pdf = async () => { const download_url = new URL("/api/pdf") download_url.search = new URLSearchParams({'order_id': '20241101001'}).toString(); try { const blob = await $fetch(download_url.toString(), { method: 'GET', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, }) const link = document.createElement('a'); link.href = URL.createObjectURL(blob); link.setAttribute('download', '20241101001.pdf'); document.body.appendChild(link); link.click() document.body.removeChild(link); } catch (error) { console.log(error) } } file print var iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.src = url; document.body.appendChild(iframe); iframe.contentWindow.focus(); iframe.contentWindow.print();

> apk add qemu-guest-agent ERROR: unable to select packages: qemu-guest-agent (no such package): required by: world[qemu-guest-agent] Only way: Change Alpine repositores. # https://wiki.alpinelinux.org/wiki/Repositories > setup-apkrepos -cf or http://alpine.ccns.ncku.edu.tw/alpine/v3.20/main #http://dl-cdn.alpinelinux.org/alpine/v3.20/community http://alpine.cs.nycu.edu.tw/v3.20/main http://alpine.cs.nycu.edu.tw/v3.20/community

[轉]How to prepare Alpine Linux image with Cloud-Init ready for Proxmox https://5wire.co.uk/how-to-prepare-alpine-linux-image-with-cloud-init-ready-for-proxmox/ [轉]Enable cloud-init for a Alpine VM on proxmox https://gist.github.com/longtian/499261f4c68f0fb40b481bb1e74aa8ca

Create /etc/systemd/system/wstunnel.service [Unit] Description=Wstunnel Server Service After=network.target [Service] Type=simple Restart=on-failure RestartSec=5s LimitNOFILE=1048576 ExecStart=/usr/bin/wstunnel server wss://[::]:1234 -r aabbccddeeff [Install] WantedBy=multi-user.target systemctl daemon-reload systemctl enable wstunnel.service systemctl start wstunnel.service systemctl status wstunnel.service

https://blog.cyberfront.org/index.php/2021/10/27/debian-fail2ban/

https://gist.github.com/dasgoll/5c7c02f363e7aeaff2837d650d985cc7 EX: *.ccdd.com openssl req -subj "/C=cd/CN=*.ccdd.com" -x509 -nodes -days 365 -newkey rsa:2048 -keyout ccdd-wildcard-selfsigned.key -out ccdd-wildcard-selfsigned.crt # /etc/fail2ban/jail.local [DEFAULT] default_backend = systemd logtarget = SYSTEMD-JOURNAL # /etc/fail2ban/jail.d/named.conf [named-refused-tcp] backend = systemd How to check journalctl -r less /var/log/fail2ban.log fail2ban-client status or fail2ban-client status sshd or fail2ban-client status ooxxooxx

https://github.com/anderspitman/awesome-tunneling

https://wiki.gbe0.com/en/linux/firewalling-and-filtering/nftables/template-inbound-outbound #!/usr/sbin/nft -f ## Clear/flush all existing rules flush ruleset # Main inet family filtering table table inet filter { # Rules for forwarded traffic chain forward { type filter hook forward priority 0; policy drop ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "Forward - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for input traffic chain input { type filter hook input priority 0; policy drop ## Permit inbound traffic to loopback interface iif lo \ accept \ comment "Permit all traffic in from loopback interface" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Log and drop new TCP non-SYN packets tcp flags != syn ct state new \ limit rate 100/minute burst 150 packets \ log prefix "IN - New !SYN: " \ comment "Rate limit logging for new connections that do not have the SYN TCP flag set" tcp flags != syn ct state new \ counter \ drop \ comment "Drop new connections that do not have the SYN TCP flag set" ## Log and drop TCP packets with invalid fin/syn flag set tcp flags & (fin|syn) == (fin|syn) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP FIN|SIN: " \ comment "Rate limit logging for TCP packets with invalid fin/syn flag set" tcp flags & (fin|syn) == (fin|syn) \ counter \ drop \ comment "Drop TCP packets with invalid fin/syn flag set" ## Log and drop TCP packets with invalid syn/rst flag set tcp flags & (syn|rst) == (syn|rst) \ limit rate 100/minute burst 150 packets \ log prefix "IN - TCP SYN|RST: " \ comment "Rate limit logging for TCP packets with invalid syn/rst flag set" tcp flags & (syn|rst) == (syn|rst) \ counter \ drop \ comment "Drop TCP packets with invalid syn/rst flag set" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)" tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)" ## Log and drop invalid TCP flags tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ limit rate 100/minute burst 150 packets \ log prefix "IN - FIN|PSH|URG:" \ comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \ counter \ drop \ comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "IN - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other inbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit inbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit inbound UDP traceroute limited to 500 PPS" ## Permit inbound SSH tcp dport ssh ct state new \ counter \ accept \ comment "Permit inbound SSH connections" ## Permit inbound HTTP and HTTPS tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit inbound HTTP and HTTPS connections" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "IN - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } # Rules for output traffic chain output { type filter hook output priority 0; policy drop ## Permit outbound traffic to loopback interface oif lo \ accept \ comment "Permit all traffic out to loopback interface" ## Permit established and related connections ct state established,related \ counter \ accept \ comment "Permit established/related connections" ## Drop traffic with invalid connection state ct state invalid \ limit rate 100/minute burst 150 packets \ log flags all prefix "OUT - Invalid: " \ comment "Rate limit logging for traffic with invalid connection state" ct state invalid \ counter \ drop \ comment "Drop traffic with invalid connection state" ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS ip protocol icmp icmp type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv4 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv4 ICMP ip protocol icmp \ counter \ accept \ comment "Permit all other IPv4 ICMP" ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS icmpv6 type { echo-reply, echo-request } \ limit rate 2000/second \ counter \ accept \ comment "Permit outbound IPv6 echo (ping) limited to 2000 PPS" ## Permit all other outbound IPv6 ICMP meta l4proto { icmpv6 } \ counter \ accept \ comment "Permit all other IPv6 ICMP" ## Permit outbound traceroute UDP ports but limit to 500 PPS udp dport 33434-33524 \ limit rate 500/second \ counter \ accept \ comment "Permit outbound UDP traceroute limited to 500 PPS" ## Allow outbound HTTP and HTTPS connections tcp dport { http, https } ct state new \ counter \ accept \ comment "Permit outbound HTTP and HTTPS connections" ## Permit outbound DNS requests meta l4proto { tcp, udp } th dport 53 \ counter \ accept \ comment "Permit outbound TCP and UDP DNS requests" ## Allow outbound NTP requests udp dport 123 \ counter \ accept \ comment "Permit outbound NTP requests" ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute ## The default policy will be applied to unmatched traffic limit rate 60/minute burst 100 packets \ log prefix "OUT - Drop: " \ comment "Log any unmatched traffic" ## Count the unmatched traffic counter \ comment "Count any unmatched traffic" } }