Posts

Hugo Usage Guide Applies to Hugo v0.168.0 (Extended). Commands use the macOS/Linux shell as examples. Compiled from the official Hugo documentation. Theme-specific private configuration should follow the actual theme repository. 1. Installation and Version Check macOS (Homebrew): brew install hugo hugo version hugo env On Linux, use the corresponding distribution package or the binary officially released by Hugo. When using SCSS/Sass or certain theme asset pipelines, confirm that the installed version includes the Extended feature. ...

The Go backend of LibreSpeed includes a web interface and provides HTTP endpoints for measuring download speed, upload speed, and latency. This article runs the backend on Debian as a non-root user with systemd, while Caddy on the same host provides a public HTTPS entry point. Installing the Prebuilt Binary on Debian This guide uses LibreSpeed speedtest-go v1.1.6; the commands apply to Debian amd64 and arm64. The speedtest-backend in the release archive already includes the default frontend assets. For other architectures, see the official release page. ...

After connecting to WireGuard, you may sometimes want only internal domain names to be resolved through the DNS in the tunnel, while other domain names continue to use public DNS. On Linux systems already using systemd-resolved, you can directly configure DNS routing domains and then apply them automatically through wg-quick’s PostUp, without installing an additional DNS forwarding service. ...

A home gateway can make the initial routing decision while a VPS performs an additional IP-based check. When the VPS resolves a destination to an address covered by geoip:cn, it sends the connection back through a reverse tunnel. Xray on the home gateway then connects to the destination through the home Internet connection. This arrangement handles traffic that the initial routing rules did not identify. It adds a round trip through the VPS to the forwarding path, so destinations already known to require home egress should preferably be routed locally. ...

On a Debian server with limited memory, I originally used CrowdSec to analyze SSH and web logs, then used Firewall Bouncer to synchronize ban decisions to nftables. This setup could dynamically ban IP addresses based on attack behavior. However, for a server with only a few hundred MiB of RAM running several personal services, its resource overhead needed to be reconsidered. I ultimately adopted the following combination: Website: Caddy GeoIP and a manual IP allowlist, with an option to exempt CDN-to-origin traffic on a per-site basis. SSH: Fail2ban reads the systemd journal and bans anomalous sources through nftables. This article documents the complete migration procedure, as well as the log-source and startup-ordering issues encountered during deployment. All domains, addresses, and host identifiers have been replaced with examples. Commands are run as the root user. ...

A First Look, a First Impression 1 - Entering the Shop 2 - The Girls 3 - Service 4 - Gratitude

Accessing mTLS Websites with Client Certificates on macOS and iOS This article explains how to configure client certificates on macOS and iOS devices to access HTTPS websites that enable mutual TLS (mTLS). The examples use a private CA, step-ca, Nginx, PKCS#12, and a PIV smart card. All domain names, certificate names, filenames, and IP addresses in this article are examples; replace them with your actual values. 1. mTLS Authentication Process With ordinary HTTPS, the client primarily validates the server certificate; mTLS additionally requires the server to validate the client certificate. ...

Accessing mTLS Websites with Client Certificates on Mac and iPhone This article documents how to use client certificates to access an internal mTLS website on macOS and iPhone. It covers CanoKey PIV, step-ca, Nginx, and installing system certificates on iOS. 1. Environment and Authentication Flow The current environment is as follows: CA: The existing CX-Homelab-CA Root CA and CX-Homelab-CA Intermediate CA. Certificate issuance: step-ca. Web server: Nginx 1.25.0. Test site: https://www.home.arpa. Mac client: CanoKey PIV 9A. iPhone client: A client certificate and private key imported through a PKCS#12 file. The difference between mTLS and ordinary HTTPS is that the server validates the client certificate, while the client must also validate the server certificate. The client certificate must contain the corresponding private key; installing a .crt file alone is generally insufficient to complete client authentication. ...

Git repository authentication and commit signing are two independent stages: the former determines whether code can be pulled and pushed, while the latter enables recipients to verify which key signed a commit. This article uses two separate pairs of FIDO2 SSH keys to manage the two uses independently. Git supports signing commits and tags with SSH keys, so when working exclusively with Git, you can use YubiKey’s FIDO2 functionality directly without deploying GnuPG. For projects that require an OpenPGP signature-verification workflow, choose GPG signing according to the project’s requirements. ...

WAN6 had obtained an IPv6 address, but when pinging a public IPv6 address on OpenWrt, it immediately returned: ping: sendto: Network unreachable The cause turned out to be an unreachable rule with a mark that was consistent with mwan3. After deleting it, IPv6 connectivity was restored. This case demonstrates that seeing a default route does not mean actual traffic will necessarily use it. This article documents an actual troubleshooting session. The public source address has been replaced with an example address used in the document; device names, rule priorities, and marks should be based on your own device. The uninstallation commands apply to OpenWrt installations that use opkg. ...