ansible: 修改 frps 配置

- 用功能更强大的 WebDAV 代替掉 OWSS
- WebDAV 和 v2raya 服务都拆成单独的配置文件

.gitignore

@@ -1 +1,2 @@
 /.log/
+tmp/

ansible/ansible.cfg

@@ -0,0 +1,2 @@
+[defaults]
+inventory = ./inventory.ini

ansible/group_vars/vps_debian.yml

@@ -0,0 +1,4 @@
+---
+ansible_user: zedhugh
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_port: 44444

ansible/inventory.ini

@@ -0,0 +1,2 @@
+[vps_debian]
+yunyoo-tokyo

ansible/playbooks/frps.yaml

@@ -0,0 +1,86 @@
+---
+- name: 配置 frps 服务端
+  hosts: vps_debian
+  gather_facts: false
+  become: true
+  vars:
+    frp_version: "0.71.0"
+    frp_download_url: "https://github.com/fatedier/frp/releases/download/v{{ frp_version }}/frp_{{ frp_version }}_linux_amd64.tar.gz"
+    frp_tmp_dir: "{{ playbook_dir }}/../tmp"
+    frp_local_archive: "{{ frp_tmp_dir }}/frp_{{ frp_version }}_linux_amd64.tar.gz"
+    frp_local_tmp_dir: "{{ frp_tmp_dir }}/frp_{{ frp_version }}_linux_amd64"
+    frp_install_dir: "/opt/frp"
+    frp_config_dir: "/etc/frp"
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 创建 frp 目录
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0755'
+      loop:
+        - "{{ frp_install_dir }}"
+        - "{{ frp_config_dir }}"
+
+    - name: 检查本地是否已有该版本的压缩包
+      stat:
+        path: "{{ frp_local_archive }}"
+      register: local_archive
+      delegate_to: localhost
+      run_once: true
+
+    - name: 下载 frp 压缩包到本地
+      get_url:
+        url: "{{ frp_download_url }}"
+        dest: "{{ frp_local_archive }}"
+        timeout: 60
+      delegate_to: localhost
+      run_once: true
+      become: false
+      when: not local_archive.stat.exists
+
+    - name: 解压 frp 压缩包到本地
+      unarchive:
+        src: "{{ frp_local_archive }}"
+        dest: "{{ frp_tmp_dir }}"
+        creates: "{{ frp_local_tmp_dir }}"
+      delegate_to: localhost
+      run_once: true
+      become: false
+      when: not local_archive.stat.exists
+
+    - name: 复制 frps 二进制文件到目标机器
+      copy:
+        src: "{{ frp_local_tmp_dir }}/frps"
+        dest: "{{ frp_install_dir }}/frps"
+        mode: '0755'
+      notify: restart frps
+
+    - name: 生成 frps.toml 配置文件
+      template:
+        src: ../templates/frps.toml.j2
+        dest: "{{ frp_config_dir }}/frps.toml"
+        mode: '0644'
+      notify: restart frps
+
+    - name: 创建 frps 的 systemd 服务文件
+      template:
+        src: ../templates/frps.service.j2
+        dest: /etc/systemd/system/frps.service
+        mode: '0644'
+      notify: restart frps
+
+    - name: 启用并启动 frps 服务
+      systemd:
+        name: frps
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: restart frps
+      systemd:
+        name: frps
+        state: restarted

ansible/playbooks/shadowsocks-libev.yaml

@@ -0,0 +1,34 @@
+---
+- name: 配置 shadowsocks-libev 服务器
+  hosts: vps_debian
+  become: true
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 安装 shadowsocks-libev
+      apt:
+        name: shadowsocks-libev
+        state: present
+        update_cache: true
+
+    - name: 配置 shadowsocks-libev 服务器
+      template:
+        src: ../templates/ss-config.json.j2
+        dest: /etc/shadowsocks-libev/config.json
+        owner: root
+        group: root
+        mode: '0644'
+      notify: restart shadowsocks-libev server
+
+    - name: 启动 shadowsocks-libev 服务器
+      systemd:
+        name: shadowsocks-libev
+        enabled: true
+        state: started
+
+  handlers:
+    - name: restart shadowsocks-libev server
+      systemd:
+        name: shadowsocks-libev
+        state: restarted

ansible/playbooks/vps_debian_provision.yaml

@@ -0,0 +1,95 @@
+---
+- name: 新机器初始化
+  hosts: vps_debian
+  gather_facts: yes
+
+  vars:
+    ansible_user: root
+    ansible_ssh_port: 22
+
+    admin_user: zedhugh
+    ssh_port: 44444
+    timezone: Asia/Shanghai
+    ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+
+  tasks:
+    - name: 启用 BBR
+      sysctl:
+        name: net.ipv4.tcp_congestion_control
+        value: bbr
+        sysctl_set: yes
+        reload: yes
+
+    - name: 设置时区
+      timezone:
+        name: "{{ timezone }}"
+
+    - name: 创建管理员用户
+      user:
+        name: "{{ admin_user }}"
+        shell: /bin/bash
+        create_home: yes
+        state: present
+
+    - name: 确保 sudo 已安装
+      apt:
+        name: sudo
+        state: present
+
+    - name: 确保 sudoers.d 目录存在
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
+    - name: 配置 sudo 免密码
+      copy:
+        content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/{{ admin_user }}"
+        owner: root
+        group: root
+        mode: '0440'
+        validate: '/usr/sbin/visudo -cf %s'
+
+    - name: 复制 SSH 密钥
+      authorized_key:
+        user: "{{ admin_user }}"
+        key: "{{ ssh_public_key }}"
+        state: present
+
+    - name: 修改 SSH 端口
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?Port "
+        line: "Port {{ ssh_port }}"
+      notify: restart ssh
+
+    - name: 禁止 root 密码登录
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PermitRootLogin"
+        line: "PermitRootLogin prohibit-password"
+      notify: restart ssh
+
+    - name: 禁止密码认证
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PasswordAuthentication"
+        line: "PasswordAuthentication no"
+      notify: restart ssh
+
+    - name: 开启公钥认证
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PubkeyAuthentication"
+        line: "PubkeyAuthentication yes"
+      notify: restart ssh
+
+
+  handlers:
+    - name: restart ssh
+      systemd:
+        name: sshd
+        state: restarted

ansible/playbooks/xray-server.yaml

@@ -0,0 +1,45 @@
+---
+- name: 配置 xray 服务
+  hosts: vps_debian
+  become: true
+  gather_facts: false
+  vars:
+    xray_config_file: /usr/local/etc/xray/config.json
+    xray_bin: /usr/local/bin/xray
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 确保有 curl 软件包
+      apt:
+        name:
+          - curl
+        state: present
+        update_cache: true
+
+    - name: 安装 xray
+      shell: |
+        bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
+      notify: restart xray
+
+    - name: 生成 xray 配置
+      template:
+        src: ../templates/xray-config.json.j2
+        dest: "{{ xray_config_file }}"
+        owner: root
+        group: root
+        mode: '0644'
+      notify: restart xray
+
+    - name: 启动 xray 服务并添加开机启动
+      systemd:
+        name: xray
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: restart xray
+      systemd:
+        name: xray
+        state: restarted

ansible/templates/frps.service.j2

@@ -0,0 +1,13 @@
+[Uint]
+Description=Frp Server Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=5s
+ExecStart={{ frp_install_dir }}/frps -c {{ frp_config_dir }}/frps.toml
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

ansible/templates/frps.toml.j2

@@ -0,0 +1,13 @@
+bindPort = {{ vault_frps_bind_port }}
+
+vhostHTTPPort = {{ vault_frps_vhost_http_port }}
+
+auth.method = "token"
+auth.token = "{{ vault_frps_token }}"
+
+webServer.addr = "127.0.0.1"
+webServer.port = {{ vault_frps_dashboard_port }}
+webServer.user = "{{ vault_frps_dashboard_user }}"
+webServer.password = "{{ vault_frps_dashboard_password }}"
+
+log.to = "/var/log/frps.log"

ansible/templates/ss-config.json.j2

@@ -0,0 +1,9 @@
+{
+    "server": "0.0.0.0",
+    "mode": "{{ vault_ss_mode }}",
+    "server_port": {{ vault_ss_server_port }},
+    "local_port": {{ vault_ss_local_port }},
+    "password": "{{ vault_ss_password }}",
+    "timeout": 60,
+    "method": "{{ vault_ss_method }}"
+}

ansible/templates/xray-config.json.j2

@@ -0,0 +1,44 @@
+{
+  "log": {
+    "loglevel": "warning",
+    "access": "/var/log/xray/access.log",
+    "error": "/var/log/xray/error.log"
+  },
+  "inbounds": [
+    {
+      "listen": "0.0.0.0",
+      "port": {{ vault_xray_port }},
+      "protocol": "vless",
+      "settings": {
+        "clients": [
+          {
+            "id": "{{ vault_xray_uuid }}",
+            "flow": "xtls-rprx-vision"
+          }
+        ],
+        "decryption": "none",
+        "udp": true
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "reality",
+        "realitySettings": {
+          "dest": "dl.google.com:443",
+          "serverNames": ["dl.google.com"],
+          "privateKey": "{{ vault_xray_private_key }}",
+          "shortIds": ["{{ vault_xray_short_id }}"]
+        }
+      },
+      "sniffing": {
+        "enabled": true,
+        "destOverride": ["http", "tls", "quic"]
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "freedom",
+      "tag": "direct"
+    }
+  ]
+}

ansible/vars/vault.yaml

@@ -0,0 +1,33 @@
+$ANSIBLE_VAULT;1.1;AES256
+66663436363739383134313731346531623330346566326665386432313337326465356131333431
+3163636630313866616338646337643134386564376430630a336364626338613031313635346430
+64373039396132633361323438306630306663333066633733643266376138636537366336343439
+3131323430616566370a343661313836333635326131653536313063626264366239323033323931
+32656230306137373039636537373435663234363665646463626138626639643035383638373734
+63323138396365643861383235326262356536623138663035373437366131383430636339363461
+62303365396538633766353339643864633736323863666436373464376565303835383663396232
+37653239613663653632323232313331353736643935333437313563346463336165333331376433
+37646466623764306138363762663362656237653339373061633765653234363166366132306438
+33356333343234363165653635626632306531653464636462373738623330306162363861306661
+39353530663763363865336435343334336638373135313539663730323732393533306362303934
+34396632356436393234383761613539393235643936323563336531623763323565333865633134
+39393733363463336362333266333035326439613438306435336135346366336264376433393930
+35383539653863656338383666336263653333383133383738666235306563396637396664303936
+37306538626231336535656266663362343166386531613137616430666433663236343265626266
+64363334366564653665663837376238396665653663646139346536636530326261323035616362
+32306465633731313731623533323938303533376336313039656662656534643338353139663636
+33383966613430316333333630353232336461333130643634663237633835356433636661316432
+65666434616534313736393736646330363963613235333030346461626662313635656238346638
+34326263363131356465373066316464366532343165373466656132386433363466633237636432
+38383636653061396263373639643037656462623636323938353631396431663964323131636166
+65383236393961396630353963303562363535376665666136346466666236366333393564633432
+65353136663930643364343134623066623035363862366564623931663362653161653934303665
+66643234343138343866623163373033626462666263656535643830613837333632653962333231
+31393565386631353635383834366465613137623836313362663032393831653164626131393163
+39663636346163366533363063643232326537363936613362633031643863373838363330616330
+39386461333263356139346261633933636235623831333630326662616630646166323763663031
+64333735633633323030303030636539323235623833383832313935376430346365613864373038
+30653935333434353233373735313433376535616238383330306535306563326563316663333461
+37636262356334633836623763613338363237666535376361363237363562353037366262333562
+33393633386637616531376166623536336564343630643632313961636632393438636136383236
+39623838393432636631

docker/README.org

@@ -0,0 +1,16 @@
+#+title: docker 配置说明
+
+每个及其需要用到的 docker 都通过 =docker-compose.yaml= 配置，避免每次升级都自己手动写命令行。
+
+* 文件用途
+
+| 文件                 | 说明                           |
+|----------------------+--------------------------------|
+| y480.yaml            | 家用服务器 docker compose 配置 |
+| xray-config.json     | xray 服务器配置                |
+| V2RayA-RoutingA.conf | V2rayA 路由配置                |
+
+* docker 镜像对应的 git 仓库
+
+- https://github.com/ronggang/OWSS
+- https://github.com/v2rayA/v2rayA

docker/V2RayA-RoutingA.conf

@@ -0,0 +1,35 @@
+default: direct
+
+# 去广告
+domain(geosite:category-ads-all) -> block
+
+domain(geosite: gfw) -> proxy
+
+# 国外域名即使有中国IP也要优先代理
+domain(geosite:geolocation-!cn)->proxy
+
+
+default: proxy
+
+# 特定域名直连
+domain(domain: gitweb.gentoo.org, domain: zedhugh.fun, domain: www.gnu.org)->direct
+domain(geosite:codeberg) -> direct
+
+domain(domain: linuxeden.com) -> proxy
+
+# 去广告
+domain(geosite:category-ads-all) -> block
+
+# 国外域名即使有中国IP也要优先代理
+domain(geosite:geolocation-!cn)->proxy
+
+# 学术网站
+domain(geosite:google-scholar)->proxy
+domain(geosite:category-scholar-!cn, geosite:category-scholar-cn)->direct
+
+# 国内直连
+domain(geosite:cn) -> direct
+ip(geoip:cn) -> direct
+
+# 局域网直连
+ip(geoip:private) -> direct

docker/v2raya.yaml

@@ -0,0 +1,17 @@
+services:
+  v2raya:
+    image: mzz2017/v2raya:latest
+    container_name: v2raya
+    restart: always
+    privileged: true
+    network_mode: host
+    volumes:
+      - /lib/modules:/lib/modules:ro
+      - /etc/resolv.conf:/etc/resolv.conf
+      - /etc/v2raya:/etc/v2raya
+    environment:
+      # V2RAYA_V2RAY_BIN: /usr/local/bin/v2ray # 老版本用这个，要开 xray 不设置这个环境变量
+      # V2RAYA_V2RAY_BIN: /usr/bin/v2raya_core # 新版本用这个，或者不设置这个环境变量
+      V2RAYA_LOG_FILE: /tmp/v2raya.log
+      V2RAYA_NFTABLES_SUPPORT: off
+      IPTABLES_MODE: legacy

docker/webdav-config.yaml

@@ -0,0 +1,36 @@
+address: 0.0.0.0
+port: 46065
+auth: true
+prefix: /
+tls: false
+behindProxy: true
+log:
+  format: console
+  colors: true
+  outputs:
+    - /logs/webdav.log
+logLevel: info
+
+directory: /data
+permissions: R
+
+users:
+  - username: zedhugh
+    password: "{bcrypt}$2a$10$nP6GQJidzLyhwkkQGQH/KOAQq2KjNW5Fbb.I/XD2OD2oxCxEoXbUO"
+    directory: /data
+    permissions: CRUD
+
+  - username: PT
+    password: "{bcrypt}$2a$10$cK9NWvSafxne2Fv6P6ZH7.Q/tVKk5M4pqXgsuOi2bF/zsCopFHsC2"
+    directory: /data/users/PT
+    permissions: CRUD
+
+  - username: v2rayNG
+    password: "{bcrypt}$2a$10$jvjejyOea8Xqsik8a9M71.rvC/0kdFah2WuMCTKHBQJ8PxGkdFmKC"
+    directory: /data/users/v2rayNG
+    permissions: CRUD
+
+  - username: guest
+    password: "guest"
+    directory: /data/public
+    permissions: R

docker/webdav.yaml

@@ -0,0 +1,36 @@
+x-data-volume: &data-volume
+  type: bind
+  source: /var/db/webDAV
+  target: /data
+
+x-user-dirs: &user-dirs
+  /data/users/PT
+  /data/users/v2rayNG
+  /data/public
+
+services:
+  WebDAV-init:
+    image: busybox:latest
+    container_name: webdav-init
+    restart: no
+    volumes:
+      - *data-volume
+    environment:
+      DIRS: *user-dirs
+    command: sh -c "mkdir -p $$DIRS"
+
+  WebDAV:
+    image: hacdias/webdav:latest
+    container_name: webdav
+    restart: always
+    depends_on:
+      WebDAV-init:
+        condition: service_completed_successfully
+    command: ["-c", "/config.yaml"]
+    network_mode: host
+    volumes:
+      - ./webdav-config.yaml:/config.yaml:ro
+      - /var/log:/logs
+      - *data-volume
+    environment:
+      TZ: Asia/Shanghai

dot/.bashrc

@@ -48,7 +48,7 @@ if [[ -n $(type -t _comp__split_longopt) ]] && [[ -z $(type -t _split_longopt) ]
     alias _split_longopt="_comp__split_longopt"
 fi
 
-for _ in ${HOME}/.bashrc.d/*; do
+for _ in ${HOME}/.bashrc.d/manager/*; do
     if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
         source "$_"
     fi
@@ -57,3 +57,19 @@ done
 if [[ -n "$(type -t mise-activate)" ]]; then
     mise-activate
 fi
+
+for _ in ${HOME}/.bashrc.d/*; do
+    if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
+        source "$_"
+    fi
+done
+
+if [[ "$(uname)" == "FreeBSD" ]]; then
+    # ls with color
+    alias ls="ls -G"
+
+    # bash-completion need load manually in FreeBSD
+    if [[ -f /usr/local/share/bash-completion/bash_completion.sh  ]]; then
+        source /usr/local/share/bash-completion/bash_completion.sh
+    fi
+fi

dot/.bashrc.d/android-studio.bash

@@ -1,4 +1,4 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
 source "${basedir}/function.bash"
 
 unset basedir

dot/.bashrc.d/fnm.bash

@@ -1,4 +1,4 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
 source "${basedir}/function.bash"
 
 unset basedir

dot/.bashrc.d/function.bash

@@ -9,7 +9,7 @@ generate-bash-completion() {
     fi
 
     local completion_dir="${HOME}/.local/share/bash-completion/completions"
-    local completion_file="$(realpath -m "${completion_dir}/${file}")"
+    local completion_file="${completion_dir}/${file}"
 
     if [[ -d "$completion_dir" && ! -w "$completion_dir" ]]; then
         echo "ERROR: has no permission to write to directory '${completion_dir}'" >&2
@@ -64,7 +64,7 @@ load-bash-completion() {
     local completion_dir="${HOME}/.local/share/bash-completion/completions"
 
     for file in "${files[@]}"; do
-        local completion_file="$(realpath -m "${completion_dir}/${file}")"
+        local completion_file="${completion_dir}/${file}"
 
         if [[ ! -e "$completion_file" ]]; then
             if [[ "$silence" == false ]]; then

dot/.bashrc.d/llama-cpp.bash

@@ -1,4 +1,4 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
 source "${basedir}/function.bash"
 
 unset basedir

dot/.bashrc.d/manager/mise.bash

@@ -1,15 +1,14 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
-source "${basedir}/function.bash"
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
+source "${basedir}/../function.bash"
 
 unset basedir
 
 if [[ -x $(type -p mise) ]]; then
-    completion_cmd="mise completion --include-bash-completion-lib bash"
-    generate-bash-completion mise "$completion_cmd"
-    unset completion_cmd
-
     mise-activate() {
         eval "$(mise activate bash)"
+
+        local completion_cmd="mise completion --include-bash-completion-lib bash"
+        generate-bash-completion mise "$completion_cmd"
     }
 
     mise-deactivate() {

dot/.bashrc.d/manager/rust.bash

@@ -1,5 +1,5 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
-source "${basedir}/function.bash"
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
+source "${basedir}/../function.bash"
 
 unset basedir
 

dot/.bashrc.d/pnpm.bash

@@ -1,4 +1,4 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
 source "${basedir}/function.bash"
 
 unset basedir

dot/.bashrc.d/proxy.bash

@@ -1,10 +1,43 @@
-PROXY_IP="192.168.0.104"
-HTTP_PROXY="http://${PROXY_IP}:20172"
-SOCKS_PROXY="socks5://${PROXY_IP}:20170"
+proxy_ip="192.168.0.104"
+proxy_http_port="20172"
+# SOCKS_PROXY="socks5://${PROXY_IP}:20170"
+
+_proxy_config_validate() {
+    if [[ -z "$proxy_ip" && -z "$proxy_http_port" ]]; then
+        echo "error: proxy_ip and proxy_http_port is not set" >&2
+        return 1
+    fi
+    if [[ -z "$proxy_ip" ]]; then
+        echo "error: proxy_id is not set"
+        return 1
+    fi
+    if [[ -z "$proxy_http_port" ]]; then
+        echo "error: proxy_http_port is not set"
+        return 1
+    fi
+
+    if ! [[ "$proxy_http_port" =~ ^[0-9]+$ ]] || ((proxy_http_port < 1 || proxy_http_port > 65535)); then
+        echo "error: proxy_http_port is invalid: $proxy_http_port" >&2
+        return 1
+    fi
+
+    if command -v nc >/dev/null 2>&1; then
+        if ! nc -z -w2 "$proxy_ip" "$proxy_http_port" 2>/dev/null; then
+            echo "error: proxy $proxy_ip:$proxy_http_port is not reachable" >&2
+            return 1
+        fi
+    fi
+
+    return 0
+}
 
 set-shell-proxy() {
-    export http_proxy="$HTTP_PROXY"
-    export https_proxy="$HTTP_PROXY"
+    _proxy_config_validate || return 1
+
+    local http_proxy_url="http://${proxy_ip}:${proxy_http_port}"
+
+    export http_proxy="$http_proxy_url"
+    export https_proxy="$http_proxy_url"
 }
 
 unset-shell-proxy() {
@@ -13,8 +46,10 @@ unset-shell-proxy() {
 }
 
 set-git-proxy() {
-    prefix_cmd=""
-    flag="--global"
+    _proxy_config_validate || return 1
+
+    local prefix_cmd=""
+    local flag="--global"
     if [[ "$1" == "-s" ]]; then
         prefix_cmd="sudo"
         flag="--system"
@@ -22,13 +57,15 @@ set-git-proxy() {
         flag="--local"
     fi
 
-    $prefix_cmd git config $flag http.proxy $HTTP_PROXY
+    local http_proxy_url="http://${proxy_ip}:${proxy_http_port}"
+
+    $prefix_cmd git config $flag http.proxy $http_proxy_url
     $prefix_cmd git config $flag http.sslVerify false
 }
 
 unset-git-proxy() {
-    prefix_cmd=""
-    flag="--global"
+    local prefix_cmd=""
+    local flag="--global"
     if [[ "$1" == "-s" ]]; then
         prefix_cmd="sudo"
         flag="--system"
@@ -41,8 +78,12 @@ unset-git-proxy() {
 }
 
 set-npm-proxy() {
-    npm config set proxy $HTTP_PROXY
-    npm config set https-proxy $HTTP_PROXY
+    _proxy_config_validate || return 1
+
+    local http_proxy_url="http://${proxy_ip}:${proxy_http_port}"
+
+    npm config set proxy $http_proxy_url
+    npm config set https-proxy $http_proxy_url
 }
 
 unset-npm-proxy() {

dot/.bashrc.d/uv.bash

@@ -0,0 +1,12 @@
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
+source "${basedir}/function.bash"
+
+unset basedir
+
+if [[ -x "$(type -p uv)" ]]; then
+    generate-bash-completion uv "uv generate-shell-completion bash"
+fi
+
+if [[ -x "$(type -p uvx)" ]]; then
+    generate-bash-completion uvx "uvx --generate-shell-completion bash"
+fi

dot/.bashrc.d/volta.bash

@@ -1,4 +1,4 @@
-basedir=$(realpath -m $(dirname "${BASH_SOURCE[0]:-$0}"))
+basedir=$(realpath $(dirname "${BASH_SOURCE[0]:-$0}"))
 source "${basedir}/function.bash"
 
 unset basedir
@@ -6,10 +6,9 @@ unset basedir
 export VOLTA_HOME="${HOME}/.volta"
 
 if [[ -x $(type -p volta) || -x "${VOLTA_HOME}/bin/volta" ]]; then
-    generate-bash-completion volta "volta completions bash"
-
     volta-activate() {
         add-to-path "${VOLTA_HOME}/bin"
+        generate-bash-completion volta "volta completions bash"
 
         # enable pnpm support
         # export VOLTA_FEATURE_PNPM=1

dot/.mozilla/autoproxy.pac

@@ -7,12 +7,14 @@ const direct_ip_list = [
     ["192.168.0.0", "255.255.255.0"],
     ["192.168.1.0", "255.255.255.0"],
     ["192.168.2.0", "255.255.255.0"],
+    ["127.0.0.1", "255.255.255.0"],
 ];
 
 const direct_domain_list = [
     "zedhugh.fun",
     "codeberg.org",
     "gitweb.gentoo.org",
+    "localhost"
 ];
 
 /**

dot/.xprofile

@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/bin/bash
 
 #xrandr --output HDMI-1 --same-as LVDS-1
 
@@ -38,14 +38,23 @@ fcitx5 -d
 #sudo service shadowsocks.client start
 # emacs --daemon
 
-export PATH="~/.local/bin${PATH:+:}$PATH"
-# pnpm
-export PATH="~/.local/share/pnpm${PATH:+:}$PATH"
-# pnpm end
+# shell environment setup
+export PATH="${HOME}/.local/bin${PATH:+:}$PATH"
 
-# rust cargo
-export PATH="~/.cargo/bin${PATH:+:}$PATH"
-if [[ -e "$HOME/.cargo/env" ]]; then
-    . "$HOME/.cargo/env"
+for _ in ${HOME}/.bashrc.d/manager/*; do
+    if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
+        echo "$_"
+        source "$_"
     fi
-# rust cargo end
+done
+
+if [[ -n "$(type -t mise-activate)" ]]; then
+    mise-activate
+fi
+
+for _ in ${HOME}/.bashrc.d/*; do
+    echo "$_"
+    if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
+        source "$_"
+    fi
+done

gentoo_portage/ccache.conf

@@ -1,5 +1,11 @@
 # Maximum cache size to maintain
-max_size = 20.0G
+max_size = 50.0G
 
 # Allow others to run 'ebuild' and share the cache.
 umask = 002
+
+compiler_check = %compiler% -dumpversion
+
+cache_dir = /var/cache/ccache
+# chown distcc:portage /var/cache/ccache
+# chmod 2775 /var/cache/ccache

gentoo_portage/make.conf

@@ -20,10 +20,14 @@ QUICKPKG_DEFAULT_OPTS="--include-config y"
 BINPKG_FORMAT="gpkg"
 EMERGE_DEFAULT_OPTS="--buildpkg --buildpkg-exclude \"virtual/* sys-kernel/*-sources */*-bin\" ${EMERGE_DEFAULT_OPTS}"
 
-# ccache and distcc
+# distcc
 # FEATURES="distcc ${FEATURES}"
-# CCACHE_DIR="/var/cache/ccache"
-# FEATURES="ccache ${FEATURES}"
+DISTCC_DIR="/var/tmp/distcc"
+
+# ccache
+FEATURES="ccache ${FEATURES}"
+CCACHE_DIR="/var/cache/ccache"
+CCACHE_UMASK="0002"
 
 # ABI_X86="32 64"
 ALSA_CARDS="hda-intel"
@@ -34,8 +38,7 @@ VIDEO_CARDS="amdgpu dummy fbdev intel nouveau nvidia radeon radeonsi vesa"
 GENTOO_MIRRORS="
 http://distfiles.gentoo.org/
 "
-MAKEOPTS="-j9 ${MAKEOPTS}"
 
-DESKTOP_USE="X alsa apng dbus fbcon ffmpeg flac fuse gif gtk gtk2 gtk3 http2 icu jack jpeg mp3 mp4 mpeg mtp nvidia ogg opengl pdf png pipewire pulseaudio svg tiff unicode vaapi vdpau webp xinerama xv xvmc"
+DESKTOP_USE="X alsa apng dbus fbcon ffmpeg flac fuse gif gtk gtk2 gtk3 http2 icu jack jpeg mp3 mp4 mpeg mtp nvidia ogg opengl pdf png pipewire pulseaudio svg tiff unicode vaapi vdpau vulkan webp xinerama xv xvmc"
 #USE="${USE} ${DESKTOP_USE} consolekit cups policykit pulseaudio truetype udev xft xcb xkb -bluetooth -gpm -libva -modemmanager"
 USE="${USE} ${DESKTOP_USE} bluetooth cups elogind policykit truetype udev xft xcb xkb -gpm -libva -modemmanager"

gentoo_portage/package.accept_keywords

@@ -2,7 +2,6 @@
 app-editors/cursor ~amd64
 app-editors/emacs **
 app-editors/vscode ~amd64
-app-emacs/emacs-common ~amd64
 
 # imput method
 app-i18n/fcitx ~amd64
@@ -15,7 +14,7 @@ app-i18n/librime ~amd64
 # dev-libs/tree-sitter* ~amd64
 
 # audroid studio
-dev-util/android-studio::gentoo ~amd64
+dev-util/android-studio ~amd64
 
 # frp
 net-vpn/frp ~amd64
@@ -50,3 +49,6 @@ sci-ml/llama-cpp **
 
 # nvidia cuda toolkit
 dev-util/nvidia-cuda-toolkit ~amd64
+
+# proxy
+net-proxy/shadowsocks-rust ~amd64

gentoo_portage/package.license

@@ -1,4 +1,4 @@
-app-arch/p7zip unRAR
+app-arch/7zip unRAR
 app-editors/cursor cursor
 app-editors/vscode Microsoft-vscode
 app-emulation/virtualbox-bin PUEL
@@ -22,7 +22,7 @@ net-im/wemeet wemeet_license
 net-misc/anydesk AnyDesk-TOS
 net-misc/baidunetdisk BaiduNetDisk
 net-misc/teamviewer TeamViewer
-sys-kernel/linux-firmware no-source-code linux-fw-redistributable
+sys-kernel/linux-firmware linux-fw-redistributable
 www-client/google-chrome google-chrome
 www-client/microsoft-edge microsoft-edge
 www-plugins/adobe-flash AdobeFlash-11.x

gentoo_portage/package.mask

@@ -1,3 +1,2 @@
 dev-lang/rust
-net-proxy/shadowsocks-rust::gentoo-zh
 >=x11-drivers/nvidia-drivers-581

gentoo_portage/package.use

@@ -18,11 +18,11 @@ x11-terms/rxvt-unicode 256-color blink fading-colors pixbuf unicode3
 #www-servers/uwsgi cgi python
 
 # emacs
-app-editors/emacs cairo dynamic-loading gtk gui gzip-el harfbuzz json libxml2 sound source sqlite tree-sitter wide-int
+app-editors/emacs cairo dynamic-loading -gtk gui gzip-el harfbuzz json libxml2 sound source sqlite tree-sitter wide-int
 app-emacs/emacs-common gui
 
-# p7zip
-app-arch/p7zip rar -wxwidgets
+# 7zip
+app-arch/7zip rar
 
 # vim
 app-editors/vim lua python

note/docker.org

@@ -40,7 +40,7 @@ docker 拉取命令
     --network=host \
     --name v2raya \
     -e V2RAYA_LOG_FILE=/tmp/v2raya.log \
-    -e V2RAYA_V2RAY_BIN=/usr/local/bin/v2ray \
+    -e V2RAYA_V2RAY_BIN=/usr/bin/v2raya_core \
     -e V2RAYA_NFTABLES_SUPPORT=off \
     -e IPTABLES_MODE=legacy \
     -v /lib/modules:/lib/modules:ro \