给家中的服务器, 分配 IPv6公网地址

条件:

中国电信光猫, Openwrt 路由器, 阿里云域名

Step 1: 路由器升级, 最新版 OpenWrt / 23.05.03

Step 2: 从电信获得 宽带帐号/宽带密码

Step 3: 设置光猫为Bridge 模式

Step 4: 路由器 Lan 接口 IPv4 地址设置为 10.0.0.1

Step 5: 路由器 Wan 接口 修改为 PPPoE 模式, PAP/CHAP username/password 填入从电信获得的 宽带帐号/宽带密码

Step 6: 因为PPPoE 拨号会同时获得 IPv4 和 IPv6地址,wan6 接口没用,删除wan6接口

Step 7: 重起wan接口,会自动拨号,若成功,自动增加wan_6虚拟接口,IPv6 和IPv6-PD

Step 8: 修改Lan接口Advanced Setting:

Delegate IPv6 prefixes = yes

IPv6 assignment length = 60

IPv6 prefix filter = wan_6

Step 9: 修改路由器 network/dhcp/Static Leases, 为每个IPv6公网网卡增加一项纪录:

包括: Hostname, Mac 地址,IPv4,IPv6-Suffix,

为方便记忆,我选择 IPv4 最后一栏与IPv6-Suffix 相同,

比如,mpd IPv4=10.0.0.222, mpd的IPv6-Suffix 设置为0222

Step 10: 根据应用需要,修改基于端口的防火墙:Network/Firewall/TrafficRules 增加纪录

至此,路由器设置完毕

域名更新

由于每次拨号,都会获得一个不同的IPv6-PD值

可以使用脚本程序,监控路由器中的IPv6-PD值,若有变化,调用域名服务商的API接口,更新IPv6值

https://github.com/zhengleic/ddns-aliyun

存在问题

发现重新拨号,IPv6-PD变化后,应用服务器可以自动获得新的IPv6,并访问外部网络,但无法从外部网络访问应用服务器

原因不详, 应用服务器为Debian 10

解决办法:

更新域名后,同时将应用服务器的网卡down/up一次: ifdown dev / ifup dev

myMPD Local Playback

Add a httpd audio output in mpd.conf, refer to https://jcorporation.github.io/myMPD/references/local-playback

# myMPD local playback
audio_output {
    type        "httpd"
    name        "HTTP Stream"
    encoder     "vorbis"
    port        "8000"
    quality     "10.0"
    format      "44100:16:1"
    always_on   "yes"
    tags        "yes"
}

Enable Local playback in mympd menu:

Settings/Features/Local playback/Enable

Launch browser, play the selected music by both:

play button: control the mpd play

local button: link to the httpd output

Test Environment:

mpd: v0.23.15

mympd: v14.1.1

server os: Ubuntu 18.04.1

client os: Android 13

client browse: chrome/firefox

Live Streaming with Android Handset

引用

Create your own streaming server with nginx

FWD: CamOn Living Streaming

Note: Have been verified on Redmi-6/MiUi 14, and openresty + RTMP Module + Linux

We saw how to setup a streaming server with MistServer in this post, let’s see how to do the same with nginx.

nginx, pronounced “engine X“, is a web server that can also be used as a reverse proxy, load balancer, mail proxy, HTTP cache and, why not, RTMP server. It is free and open-source software, released under the terms of the 2-clause BSD license.

For the purpose of this trial, we will see how to install and configure the server on a Raspberry Pi board running Raspberry Pi OS Lite.


Install nginx with RTMP support

First, we must install the server and an add-on module that will allow it to handle the RTMP protocol. sudo apt install nginxsudo apt install libnginx-mod-rtmp

After the installation is complete, we should be able to reach the welcome page simply by entering the IP address of the server in our favorite browser, http://192.168.1.18/ for us.


Configure the RTMP server

The way nginx and its modules work is determined in the configuration file. By default, the configuration file is named nginx.conf and placed in the directory /etc/nginx. For details, please check out the Beginner’s Guide and other resources available in the nginx documentation.

To enable the RTMP protocol, edit the configuration file sudo nano /etc/nginx/nginx.conf

then add these few lines at the very end # protocol imap; # proxy on; # } #}
rtmp { server { listen 1935; application live { live on;
hls on; hls_path /tmp/hls; } } }

finally save the file and restart the server so that the new configuration will be loaded sudo nginx -s reload

In this example, we are configuring the RTMP server to listen on the port 1935 (the default RTMP port), and to handle an application named live. This application has the live mode (one-to-many broadcasting) enabled. The HLS output is also enabled, the playlist and the fragments will be saved in /tmp/hls (if the directory does not exist it will be created).

The complete reference about the available RTMP directives can be found here.


Configure the HTTP server

We need to configure the HTTP server so that it can access the files in /tmp/hls for clients to play HLS. nginx uses the so called Server Blocks to serve multiple sites in parallel, let’s change the configuration of the default one sudo nano /etc/nginx/sites-enabled/default

by adding a new location entry according to the documentation location / { # First attempt to serve request as file, then # as directory, then fall back to displaying a 404. try_files $uri $uri/ =404; } location /hls { types { application/vnd.apple.mpegurl m3u8; } root /tmp; add_header Cache-Control no-cache; add_header Access-Control-Allow-Origin *; } # pass PHP scripts to FastCGI server #

then save the file and restart the server once again sudo nginx -s reload


Configure the app

From CamON Live Streaming app settings, enable the Live streaming adapter and configure it

  • in he Server field, specify the RTMP URL for the application we configured, rtmp://192.168.1.18/live in this example
  • in the Stream field enter a streaming key of your choice, let’s use spynet

TIP: the streaming key will be used by nginx as the base name for the HLS files

To start the stream use the arrow icon in the bottom-right corner of the main screen. By tapping on it a countdown will be shown, at the end of which the device will connect to nginx.

TIP: during the countdown, tap on the arrow again if you wish to abort


Let’s see it in action

To verify that everything is working as expected, we can use VLC as the client to see the nginx broadcast.

It is possible to see the HLS output using the URL http://192.168.1.18/hls/spynet.m3u8, where hls is the location we configured for the HTTP server to find the files and spynet is the streaming key we have chosen.

It is also possible to see the RTMP output using the URL rtmp://192.168.1.18/live/spynet, where live is the name of the application we configured and spynet is the streaming key.


Embed the player

For a better user experience, we may want to embed the player in our web page, This way the broadcast will be available with no extra effort. As the player, Video.js is a good choice to see the HLS broadcast.

Let’s create our index.html page in /var/www/html sudo nano /var/www/html/index.html

with the following HTML code

TIP: the key point is to set the correct source, src=”/hls/spynet.m3u8″, as described above

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32<!DOCTYPE html> <html lang=”en”> <head> <link href=”https://vjs.zencdn.net/7.17.0/video-js.css” rel=”stylesheet” /> <!– If you’d like to support IE8 (for Video.js versions prior to v7) –> <script src=”https://vjs.zencdn.net/ie8/1.1.2/videojs-ie8.min.js”></script> </head> <body> <h1>My nginx streaming server</h1> <video id=”my-video” class=”video-js” controls preload=”auto” width=”640″ height=”360″ data-setup=”{}” > <source src=”/hls/spynet.m3u8″ type=”application/vnd.apple.mpegurl m3u8″ /> <p class=”vjs-no-js”> To view this video please enable JavaScript, and consider upgrading to a web browser that <a href=”https://videojs.com/html5-video-support/” target=”_blank”> supports HTML5 video </a> </p> </video> <script src=”https://vjs.zencdn.net/7.17.0/video.js”></script> </body> </html>

After the file has been saved (no need to restart the server), by navigating to address of the server, http://192.168.1.18/, we can see the new homepage in action


Some small tweaks

Since we are planning to broadcast our video over the Internet, we should make the server publicly reachable. To keep it simple, we should consider setting up port forwarding and the Dynamic DNS as described in this post.

In summary, if the router supports the UPnP protocol, we can use the command line utility upnpc to forward the HTTP port directly from the server. If not, we can manually configure the router. sudo apt install miniupnpcupnpc -a server_ipserver_portexternal_port tcpupnpc -a 192.168.1.18 80 8282 tcp

This way the server will be reachable from anywhere at http://public_ip_address:8282/ or http://myserver.dyndns.org:8282/.

As discussed, HLS is continuously writes files to disk while updating the playlist and the fragments. This consumes resources and can dramatically reduce the life of the SD card used by the server as storage. A better solution is to use a ramdisk to temporary store those files.

Examine the available memory to find out how much we can use. free -h

Examine the typical HLS disk usage to find out how much memory we expect to need. sudo du -sh /tmp/hls/

Create a folder where to mount the ramdisk. sudo mkdir -p /mnt/ramdisk

Add an entry to fstab to configure the ramdisk (50M is enough for this example). sudo nano /etc/fstabproc /proc proc defaults 0 0 PARTUUID=4b551375-01 /boot vfat defaults 0 2 PARTUUID=4b551375-02 / ext4 defaults,noatime 0 1 tmpfs /mnt/ramdisk tmpfs nodev,nosuid,noexec,nodiratime,size=50M 0 0

Reboot the server. sudo reboot

Verify that the ramdisk was mounted. sudo df -hFilesystem Size Used Avail Use% Mounted on /dev/root 3.4G 1.7G 1.6G 52% / devtmpfs 87M 0 87M 0% /dev tmpfs 215M 0 215M 0% /dev/shm tmpfs 86M 632K 86M 1% /run tmpfs 5.0M 4.0K 5.0M 1% /run/lock tmpfs 50M 0 50M 0% /mnt/ramdisk /dev/mmcblk0p1 253M 49M 204M 20% /boot tmpfs 43M 0 43M 0% /run/user/1000

Change the nginx configuration so that HLS files will be saved in /mnt/ramdisk/hls instead of in /tmp/hls. sudo nano /etc/nginx/nginx.confrtmp { server { listen 1935; application live { live on; hls on; hls_path /mnt/ramdisk/hls; } } }

Change the nginx configuration so that the HTTP server will know where to find the HLS files. sudo nano /etc/nginx/sites-enabled/default location /hls { types { application/vnd.apple.mpegurl m3u8; } root /mnt/ramdisk; add_header Cache-Control no-cache; add_header Access-Control-Allow-Origin *; }

Restart the server. sudo nginx -s reload

Verify that the ramdisk is now used. sudo df -hFilesystem Size Used Avail Use% Mounted on /dev/root 3.4G 1.7G 1.6G 52% / devtmpfs 87M 0 87M 0% /dev tmpfs 215M 0 215M 0% /dev/shm tmpfs 86M 632K 86M 1% /run tmpfs 5.0M 4.0K 5.0M 1% /run/lock tmpfs 50M 12M 39M 24% /mnt/ramdisk /dev/mmcblk0p1 253M 49M 204M 20% /boot tmpfs 43M 0 43M 0% /run/user/1000

Your server should now run much smoother!

gallery.zhenglei.net is online

The personal photo gallery is online at the end of 2022.

The open source piwigo suite is used to build the gallery, same as the blog site, the whole software stack, except the linux kernel layer, is built from souce, i.e, LFS (linux from scratch)

Thanks to the LFS technology, the who software image can be run on almost any linux X64 enviroment. keep the file level compability, and cloned to the other machine with rsync, backup and restore with easy.

Deploy draw.io app website on local LAN

Create a new ESXi host with 2G RAM/ 20G disk, Debian 10

# Install java JRE

sudo apt install openjdk-11-jre
java –version

# Install apache ant

wget https://downloads.apache.org/ant/binaries/apache-ant-1.10.12-bin.tar.xz
tar xvfJ apache-ant-1.10.12-bin.tar.xz
sudo mv apache-ant-1.10.12/ /usr/local/ant
sudo bash -c ” cat >>/etc/profile ” << EOF
ANT_HOME=”/usr/local/ant”
PATH=”$PATH:/usr/local/ant/bin”
export ANT_HOME
export PATH
EOF
source /etc/profile
ant –version

# Install Tomcat

sudo apt-get install tomcat9 tomcat9-admin

http://127.0.0.1:8080/
http://${SERVER_IP}:8080/
ls -l /var/lib/tomcat9/webapps/ROOT/

# Build drawio, war package

wget https://github.com/jgraph/drawio/archive/refs/tags/v17.1.3.tar.gz
tar xvfz v17.1.3.tar.gz
cd drawio-17.1.3
( cd etc/build && ant war )

# Install drwaio

sudo cp build/draw.war /var/lib/tomcat9/webapps

http://127.0.0.1:8080/draw
http://${SERVER_IP}:8080/draw

# Change draw as the root of tomcat

cd /var/lib/tomcat9/webapps
sudo rm -rf ROOT
sudo mv draw.war ROOT.war

http://127.0.0.1:8080
http://${SERVER_IP}:8080

# Change tomcat to the http default port: 80

sudo grep 8080 /etc/tomcat9/*
sudo sed -i “s/8080/80/g” /etc/tomcat9/server.xml

http://127.0.0.1
http://${SERVER_IP}

Web audio codec guide

https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Audio_codecs

Type

audio/ogg

codecs= FLAC

codecs= Opus

codecs= Vorbis

audio/mp4

codecs= AAC

codecs= FLAC

codecs= mp3

codecs= Opus

codecs= ALAC

audio/wave

audio/wav

audio/x-wav

audio/x-pn-wav

audio/mp3

audio/mpeg

audio/webm

codecs= Opus

codecs= Vorbis

audio/3gpp

audio/3gpp2

audio/aac

audio/flac

audio/x-flac

Ogg/opus is great for music over internet:

High quality, Simple software implementation, and Free.

but not support by iPad/iPhone

Mp4/AAC LC is the best selection for music over internet for Apple mobile product.

In LAN, we can select Loseloss codec:

Android: Ogg/FLAC

iPad/iPhone: Mp4/ALAC

Install DenyHosts on Linux VPS

#!/bin/bash
PKG_VER=2.10
PKG_DIR=denyhosts-${PKG_VER}
PKG_TAR=${PKG_DIR}.tar.gz
PKG_URL=https://sourceforge.net/projects/denyhosts/files/denyhosts/${PKG_VER}

rm ${PKG_TAR}
rm -rf ${PKG_DIR}
wget –no-check-certificate  ${PKG_URL}/${PKG_TAR}
tar xvfz ${PKG_TAR}

sudo mv ${PKG_DIR}/ /usr/share/denyhosts

cd /usr/share/denyhosts/
sudo cp denyhosts.conf /etc

CFG=/etc/denyhosts.conf
sudo sed -i “s/DENY_THRESHOLD_ROOT = 1/DENY_THRESHOLD_ROOT = 8/” ${CFG}
sudo sed -i “s/ADMIN_EMAIL = root@localhost/ADMIN_EMAIL = /” ${CFG}

sudo cp denyhosts.py /usr/sbin/denyhosts
sudo mv daemon-control-dist daemon-control

cd /etc/init.d
sudo ln -s /usr/share/denyhosts/daemon-control denyhosts
sudo touch /var/log/auth.log
sudo update-rc.d denyhosts start
sudo /etc/init.d/denyhosts start

 

 

Encrypt WordPress Server with Let’s Encrypt SSL certificate

# Install acme.sh tool
git clone https://github.com/Neilpang/acme.sh.git

cd acme.sh

./acme.sh --install

#install cert
cd ~/.acme.sh
# issue a RSA cert
sudo ./acme.sh --issue --d blog.zhenglei.net -w /var/www/html/wordpress

# issue a ECC cert
./acme.sh --issue -d blog.zhenglei.net -w /var/www/html/wordpress --keylength ec-256

# Copy the cert into target directory
sudo mkdir -p /etc/nginx/ssl

sudo ./acme.sh --installcert -d blog.zhenglei.net --key-file /etc/nginx/ssl/blog.zhenglei.net.ecc.key --fullchain-file /etc/nginx/ssl/blog.zhenglei.net.ecc.bundle --ecc
sudo ./acme.sh --installcert -d blog.zhenglei.net --key-file /etc/nginx/ssl/blog.zhenglei.net.key --fullchain-file /etc/nginx/ssl/blog.zhenglei.net.bundle
# Update nginx config
server { #listen 80; listen 443; ssl on; ssl_certificate ssl/blog.zhenglei.net.bundle; ssl_certificate_key ssl/blog.zhenglei.net.key; ssl_session_timeout 5m; ssl_protocols SSLv3 TLSv1; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; ssl_prefer_server_ciphers on; ... }
server {
listen 80 default_server; server_name blog.zhenglei.net;

# Let's Encrypt, http method
location ~ \.well-known
{
root /var/www/html/wordpress/;
allow all;
access_log on;
log_not_found on;
} return 301 https://$server_name$request_uri; }