Librehat的部落格

Category: 網路

  • Soft AP on Linux with WPS

    I’ve recently upgraded my home WiFi setup with Ubiquiti (UniFi) access points (I bought a U7 Pro AP). All is good, except that UniFi doesn’t support WPS. On the other hand, my old Canon TS3150 printer can only be setup using WPS. Now, it wouldn’t have been an issue, had I not changed the SSID. The easiest workaround seems to be setting up a WiFi that has the same SSID and password, and supports WPS (so the printer can connect to it).

    Some people on the Internet have suggested buying a cheap router/AP that supports WPS, which seems like a waste to me. Not only it costs minimally £30 or so, but also it’ll literally become an e-waste one minute later. Bad for the environment!

    With the help of Gemini 2.0, and this post on StackExchange, I’ve managed to open a Hotspot by using SoftAP via hostapd that supports WPS (WiFi Protected Setup), and my printer is now happily connected to the WiFi network created by my UniFi AP.

    (more…)

  • Home Assistant Core Setup on Banana Pi M5

    There is no support for BananaPi M5 from Home Assistant OS, which leaves me either the container or the core version. Originally I was going to use the container image, however, it needs too much disk space (7GB was not enough as it maxed out my onboard storage). I went for Home Assistant Core instead, and this post records my journey setting it up.

    1. Install uv (a Python environment manager)
    2. Install latest Python (3.13 at the time of writing), because Home Assistant Core has deprecated the support for older versions of Python
    3. Install Home Assistant Core (official documentation as a reference). I’m using uv to manage the virtual environment (note that I’ll enable ISAL for better performance).
    cd /srv/homeassistant/
uv venv pyenv --python 3.13
source pyenv/bin/activate
uv pip install homeassistant==2024.12.3
uv pip install isal  # ISAL for faster gzip and zlib
    1. Install and configure Cloudflare Zero Trust Tunnel (official documentation for remote tunnel). To expose my Home Assistant access to the public Internet, so that I can access it everywhere. Besides, some cloud-based services require that access because they use callbacks (the alternative is to pay for Nabu Casa which is a subscription-based service). Configure the access control in Cloudflare Zero Trust so that only verified emails from a restricted list have access (additional policies can be set for a new application that bypasses any control for cloud services callbacks)
      • Worth noting that the cloudflared add-on cannot be used because Home Assistant Core doesn’t support add-ons.
    2. Setup a new service in systemd for Home Assistant’s hass so that it starts on boot and restarts on failures. I created this file /etc/systemd/system/ha@homeassistant.service (systemctl enable and systemctl start afterwards):
    [Unit]
Description=Home Assistant
After=network-online.target
After=network.target

[Service]
Type=simple
User=homeassistant
ExecStart=/srv/homeassistant/pyenv/bin/hass
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

  • A New Termux Mirror

    TL; DR. https://termux.librehat.com is a new Termux packages mirror! Maintained by me, synchronised every six hours, located in the United Kingdom, hosted by Oracle Cloud.

    In the full article below, I’ll write up how to set up a Termux mirror (or in general, a Debian packages repository mirror).

    (more…)

  • Virtual Linux Desktop Experience in Azure

    I wouldn’t believe that I will be writing this 10 years ago. It’s 2020 though. Microsoft has improved a lot of services for Linux, ranging from developer tools like Visual Studio Code, to the protagonist today: Azure (cloud computing). Azure has steadfastly become a real credible alternative to Amazon EC2 (or AWS in general). Today, I want to share my experience of using a virtual machine on Microsoft Azure cloud. To be more specific, it is a Linux desktop virtual machine (SLES 15).

    (more…)

  • 讓你的WordPress小站搭上WebP的快車

    Google家開源的WebP圖形編碼格式出來已經好幾年了，瀏覽器支援率現在也是非常高的了（現代瀏覽器就Safari不支持）。相比於常用的JPEG和PNG，使用WebP可以節省高達80%的空間（在今天行動網路的時代，這意味着更快的載入）。

    當然了，還是不想拋棄堅守Internet Explorer和蘋果家Safari的用戶，所以我們需要一個聰明的外掛程式，在支援WebP的瀏覽器上使用WebP圖形，不支援的話則提供JPEG或者PNG檔案。隨便Google到的一個頗爲流行的免費開源程式WebP Express就是這輛帶我們上路的快車。

    在WordPress後臺Plugins頁面搜尋下載好WebP Express並啓用。如果你使用的是Apache，它開箱即可用。如果你使用的是nginx，則需要按照說明稍微配置一下。這裏用的是nginx，而我選的是簡單的CDN Friendly選項，然後批量將全部圖形檔案轉換成了WebP（原始檔案是不會動的）。Alter HTML那個選項一定要開啓不然什麼也不會發生……

    用此前的日本兩京遊記做了一下對比，未啓用掛件的時候頁面大小爲1.8MB，加載用時4.32秒。啓用掛件後頁面大小減少到了1.4MB，加載用時3.52秒。對比提升效果還算明顯，當然了，那篇文章裏面照片很多，一般的文章頁面效果估計甚微。

  • WireGuard初體驗

    工作和生活很忙的緣故，一直沒有好好維護Shadowsocks的Qt/C++分支，最近下定決心索性聲明好放棄維護了。偶然看到關於WireGuard的新聞，宣稱是一款現代、快速、安全的VPN工具，今天總算抽出來一點時間來試驗一番，下面來分享一下WireGuard之初體驗。

    首先，在伺服器和客戶端安裝好WireGuard，官方文檔寫的很詳細。

    然後在伺服器和客戶端都創建好一套密鑰文件，命令如下：

    (more…)

  • 修復WordPress更新出現的Inconsistent Permission錯誤

    最近部落格的WordPress更新頻頻提示出現錯誤，log就簡單地說一句inconsistent permission error，就這樣在網路上搜尋了一會兒才發現，同樣的錯誤提示很可能是有不同的underlying issue，比如可能文件與目錄的權限有被人為修改過（文件必須是644，而目錄必須是755，可以用find指令批量更改），又或者可能是owner和group不一致（chown -R批量更改）。而發生在我的VPS的卻是第三種情況，SELinux導致某些文件無法寫入……

    甄別此情況很簡單，在WordPress目錄下執行ls -Z（注意是大寫Z）查看一下WordPress目錄和其內文件，比如被我強制用unzip解壓最新的WordPress替換過的目錄就顯示：

    drwxr-xr-x. nginx nginx unconfined_u:object_r:user_home_t:s0 wordpress

    我們關心的是第四列SELinux的標籤設定，這樣的權限是不夠的，在終端執行下面這條語句把WordPress目錄和其內容遞歸性地更新好便解決了問題！

    chcon -R -t httpd_sys_rw_content_t wordpress

    知其然還需知其所以然，繼續Google了一下，在Red Hat的文檔庫找到配置Apache HTTP Server的權限管理文章，裡面有提到httpd_sys_rw_content_t標籤（以及其他標籤），任何有此標籤的文件都可以被有httpd_sys_script_exec_t標籤的腳本修改，但不能被其他腳本修改。

  • libQtShadowsocks项目介绍和备忘

    shadowsocks应该是继各种VPN和GoAgent之后，目前最受欢迎的代理协议了。VPN不灵活，而且能够被防火墙识别特征，能够轻松封锁，GoAgent则面临可用IP越来越少的困境。懒得介绍原项目了，不知道shadowsocks的自己去Google查吧。

    libQtShadowsocks就像名字暗示的一样，是一个Library（库），用Qt（C++）写的，实现了shadowsocks的各项功能。

    (more…)

  • 即日起提供Google学术搜索反向代理服务

    Google在大陆是彻底沦陷了，虽然鄙人马上就肉翻了，但是不能置广大同胞于水深火热之中啊，特别是目前无可替代的Google学术搜索（有关部门也真是弱智，居然一口气直接封*.google.com……）。并不是每个人都会爬墙出去的，所以临走前送一个小福利，让大家能顺利访问Google学术搜索，助力科研！

    先上普罗大众小白都能看懂的使用指南，技术部分在文章后半段。

    (more…)

  • IPv6开启转发并保持自动获取PPP提供的IPv6地址

    标题想了好久……请不要吐槽晦涩难懂

    先说一下应用场景：

    • 一台Linux-based box（ARM开发板如ODROID U3、Raspberry Pi，或者OpenWRT神马的）当作Host + Router，通过有线网卡连接交换机Hub作为局域网网关和服务器，再通过PPPoE拨号连接外网（PPPoE能自动配置并获取IPv6地址）。
    • 局域网PC配置好本地的IPv6地址透过局域网网关（上面那台Linux Box）连接外网，要求能以IPv4和IPv6协议访问Internet，但是获得的IPv4和IPv6地址都是内网地址

    (more…)