欢迎来到我的博客

Hugo Usage Guide Applies to Hugo v0.168.0 (Extended). Commands use the macOS/Linux shell as examples. Compiled from the official Hugo documentation. Theme-specific private configuration should follow the actual theme repository. 1. Installation and Version Check macOS (Homebrew): brew install hugo hugo version hugo env On Linux, use the corresponding distribution package or the binary officially released by Hugo. When using SCSS/Sass or certain theme asset pipelines, confirm that the installed version includes the Extended feature. ...

Accessing mTLS Websites with Client Certificates on macOS and iOS This article explains how to configure client certificates on macOS and iOS devices to access HTTPS websites that enable mutual TLS (mTLS). The examples use a private CA, step-ca, Nginx, PKCS#12, and a PIV smart card. All domain names, certificate names, filenames, and IP addresses in this article are examples; replace them with your actual values. 1. mTLS Authentication Process With ordinary HTTPS, the client primarily validates the server certificate; mTLS additionally requires the server to validate the client certificate. ...

Accessing mTLS Websites with Client Certificates on Mac and iPhone This article documents how to use client certificates to access an internal mTLS website on macOS and iPhone. It covers CanoKey PIV, step-ca, Nginx, and installing system certificates on iOS. 1. Environment and Authentication Flow The current environment is as follows: CA: The existing CX-Homelab-CA Root CA and CX-Homelab-CA Intermediate CA. Certificate issuance: step-ca. Web server: Nginx 1.25.0. Test site: https://www.home.arpa. Mac client: CanoKey PIV 9A. iPhone client: A client certificate and private key imported through a PKCS#12 file. The difference between mTLS and ordinary HTTPS is that the server validates the client certificate, while the client must also validate the server certificate. The client certificate must contain the corresponding private key; installing a .crt file alone is generally insufficient to complete client authentication. ...

Git repository authentication and commit signing are two independent stages: the former determines whether code can be pulled and pushed, while the latter enables recipients to verify which key signed a commit. This article uses two separate pairs of FIDO2 SSH keys to manage the two uses independently. Git supports signing commits and tags with SSH keys, so when working exclusively with Git, you can use YubiKey’s FIDO2 functionality directly without deploying GnuPG. For projects that require an OpenPGP signature-verification workflow, choose GPG signing according to the project’s requirements. ...

WAN6 had obtained an IPv6 address, but when pinging a public IPv6 address on OpenWrt, it immediately returned: ping: sendto: Network unreachable The cause turned out to be an unreachable rule with a mark that was consistent with mwan3. After deleting it, IPv6 connectivity was restored. This case demonstrates that seeing a default route does not mean actual traffic will necessarily use it. This article documents an actual troubleshooting session. The public source address has been replaced with an example address used in the document; device names, rule priorities, and marks should be based on your own device. The uninstallation commands apply to OpenWrt installations that use opkg. ...

On an Armbian machine used as a bypass router, both sing-box and WireGuard are running side by side. The router itself resolves internal domain names fine, yet downstream clients that point at it as their DNS server time out every time. The root cause turned out not to be the DNS matching rules, but rather that the traffic sing-box sends to its upstream DNS was choosing the wrong egress interface. ...

When Docker uses HTTPS certificates issued by a private CA (such as step-ca), it is important to distinguish between Docker Engine pulling images and an application inside a container accessing HTTPS. Their certificate trust stores may not be the same. I. Docker Engine Trusting a Private CA This applies to docker login, docker pull, and docker push when accessing a private image registry. Trust Only the Specified Registry (Recommended) Assume the registry address is registry.example.com:5000: ...

After deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: IPv6 ping works, but IPv6 HTTPS connections time out after enabling auto_redirect. The eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the Linux loopback interface lo was missing the ::1/128 address. This article documents the diagnostic process and the fix. Environment Linux: Armbian, ARM64, 6.18-series kernel sing-box: 1.14.x Network management: Netplan + NetworkManager Transparent proxy: TUN, auto_route: true, auto_redirect: true IPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route To protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes. ...

When running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted. This article documents an actually observed cause and a fix pending regression validation. All examples use documentation-reserved addresses and do not correspond to a real network. ...

Automatically Banning Malicious IPs on a Debian Server with CrowdSec Public-facing servers face all kinds of automated scanning every single day. Even when you never advertise a service address, your SSH port still routinely receives login attempts against usernames like root, admin and test. Web services may get probed for paths such as .env, wp-admin and phpinfo.php. Most of these requests come from automated scanners. They may not amount to an actual intrusion, but they generate a huge amount of pointless log noise and widen the exposed attack surface. ...