[{"data":1,"prerenderedAt":2152},["ShallowReactive",2],{"article-\u002Fblog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护":3,"article-around-\u002Fblog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护":1934},{"id":4,"title":5,"author":6,"body":7,"category":1919,"cover":1920,"date":1921,"description":5,"draft":1922,"extension":1923,"image":1924,"license":1920,"meta":1925,"minutes":233,"navigation":242,"path":1926,"pinned":1922,"seo":1927,"stem":1928,"tags":1929,"__hash__":1933},"blog\u002Fblog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护.md","飞牛安全访问与 Lucky 反代雷池防护","张萌萌",{"type":8,"value":9,"toc":1897},"minimark",[10,15,20,24,28,111,115,145,149,179,183,187,195,1520,1524,1527,1597,1600,1606,1612,1632,1637,1643,1647,1651,1654,1658,1664,1741,1746,1750,1754,1786,1790,1820,1824,1827,1832,1835,1840,1843,1848,1852,1859,1879,1887,1890,1893],[11,12,14],"h2",{"id":13},"_1-序言","1 序言",[16,17,19],"h3",{"id":18},"_11-为什么要安全防护","1.1 为什么要安全防护？",[21,22,23],"p",{},"众所周知，飞牛 OS 近期公开过安全风险，公开服务暴露在互联网上会增加被自动化扫描和异常请求利用的概率。本文记录一套临时加固方案，重点减少系统暴露面。",[16,25,27],{"id":26},"_12-安全防护建议","1.2 安全防护建议",[29,30,31,39,44,55,91,104],"ul",{},[32,33,34,38],"li",{},[35,36,37],"strong",{},"关闭飞牛 FN Connect","，也就是关闭飞牛自带的内网穿透",[32,40,41],{},[35,42,43],{},"关闭飞牛 SSH 和修改默认 22 端口",[32,45,46,47,50,51,54],{},"推荐",[35,48,49],{},"优先使用内网穿透","访问飞牛，比如 ",[35,52,53],{},"Tailscale、星空组网","等",[32,56,57,58,61,62],{},"次推荐使用",[35,59,60],{},"公网访问","飞牛",[29,63,64,71,85],{},[32,65,66,67,70],{},"使用",[35,68,69],{},"反向代理","并避免公开宣传访问域名，可以明显减少被自动化扫描的概率",[32,72,66,73,76,77,80,81,84],{},[35,74,75],{},"Lucky","反代时候 ",[35,78,79],{},"web"," 增加一个",[35,82,83],{},"账号密码验证","，那么相当于在飞牛外面加上一道锁。",[32,86,87,88],{},"如果需要更好的防护就再加上一道锁",[35,89,90],{},"雷池 WAF",[32,92,93,94,96,97,100,101,103],{},"如果增加 web ",[35,95,83],{},"，那么飞牛 ",[35,98,99],{},"APP"," 不能使用，毕竟 ",[35,102,99],{}," 不能弹出这个账号密码验证，网页端是正常的。",[32,105,106,107,110],{},"反代时候增加 ",[35,108,109],{},"IP 白名单","，我觉得没有必要，若想加也是可以的。",[16,112,114],{"id":113},"_13-防护思路","1.3 防护思路",[29,116,117,123,129],{},[32,118,119,122],{},[35,120,121],{},"雷池 WAF (Safeline)","：作为反向代理的下一跳，过滤异常请求，在官方修复发布前降低风险。",[32,124,125,128],{},[35,126,127],{},"Lucky 反代 + Basic Auth","：在入口处增加一层基础认证，把未授权请求直接拒绝。",[32,130,131,134,135,138,139,138,142],{},[35,132,133],{},"架构思路","： 外网请求 -> ",[35,136,137],{},"Lucky (SSL卸载+基础认证)"," -> ",[35,140,141],{},"雷池 WAF (过滤异常请求)",[35,143,144],{},"飞牛 OS (业务)",[11,146,148],{"id":147},"_2-准备工作","2 准备工作",[29,150,151,157],{},[32,152,153,156],{},[35,154,155],{},"硬件","：已安装飞牛 OS 的 NAS（或同局域网下的其他机器）。",[32,158,159,162,163],{},[35,160,161],{},"软件","：\n",[29,164,165,168,173],{},[32,166,167],{},"Docker 环境（飞牛自带）。",[32,169,170,172],{},[35,171,75],{},"：用于端口转发、SSL 证书管理和第一道认证。",[32,174,175,178],{},[35,176,177],{},"雷池 (Safeline)","：用于 WAF 防护（只有 x86 免费）。",[11,180,182],{"id":181},"_3-雷池-waf","3 雷池 WAF",[16,184,186],{"id":185},"_31-安装雷池-waf","3.1 安装雷池 WAF",[21,188,189,190,194],{},"我这里采用 docker 安装雷池 WAF，以下是 ",[191,192,193],"code",{},"docker-compose.yaml","文件",[196,197,202],"pre",{"className":198,"code":199,"language":200,"meta":201,"style":201},"language-yaml shiki shiki-themes github-light github-dark","# 官方文档\n# https:\u002F\u002Fdocs.waf-ce.chaitin.cn\u002F\n# web 访问 https:\u002F\u002FIP:29443\n# 账号 admin 密码在 safeline-mgt 日志\n# 重置密码 docker exec safeline-mgt resetadmin\n\n# ---\n\nname: safeline\n# 最后编辑时间：2026-02-03\nservices:\n  # -----------------------\n  # 1. 数据库\n  # -----------------------\n  postgres:\n    container_name: safeline-pg\n    restart: always\n    image: chaitin\u002Fsafeline-postgres:15.2\n    volumes:\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fpostgres\u002Fdata:\u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n    environment:\n      - POSTGRES_USER=safeline-ce\n      - POSTGRES_PASSWORD=safeline-pwd-change-me\n    networks:\n      - safeline-ce\n    command: [postgres, -c, max_connections=600]\n    healthcheck:\n      test: pg_isready -U safeline-ce -d safeline-ce\n\n  # -----------------------\n  # 2. 管理后台\n  # -----------------------\n  mgt:\n    container_name: safeline-mgt\n    restart: always\n    image: chaitin\u002Fsafeline-mgt:latest\n    volumes:\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fmgt:\u002Fapp\u002Fdata\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fnginx:\u002Fapp\u002Flog\u002Fnginx:z\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fsock:\u002Fapp\u002Fsock\n      - \u002Fvar\u002Frun:\u002Fapp\u002Frun\n    ports:\n      - 29443:1443\n    healthcheck:\n      test: curl -k -f https:\u002F\u002Flocalhost:1443\u002Fapi\u002Fopen\u002Fhealth\n    environment:\n      - MGT_PG=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n    depends_on:\n      - postgres\n      - fvm\n    logging:\n      driver: \"json-file\"\n      options:\n        max-size: \"100m\"\n        max-file: \"5\"\n    networks:\n      - safeline-ce\n\n  # -----------------------\n  # 3. 检测引擎\n  # -----------------------\n  detect:\n    container_name: safeline-detector\n    restart: always\n    image: chaitin\u002Fsafeline-detector:latest\n    volumes:\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fdetector:\u002Fresources\u002Fdetector\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fdetector:\u002Flogs\u002Fdetector\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n    environment:\n      - LOG_DIR=\u002Flogs\u002Fdetector\n    networks:\n      - safeline-ce\n\n  # -----------------------\n  # 4. 流量转发 (Tengine) \n  # -----------------------\n  tengine:\n    container_name: safeline-tengine\n    restart: always\n    image: chaitin\u002Fsafeline-tengine:latest\n    volumes:\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n      - \u002Fetc\u002Fresolv.conf:\u002Fetc\u002Fresolv.conf:ro\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fnginx:\u002Fetc\u002Fnginx\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fdetector:\u002Fresources\u002Fdetector\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fchaos:\u002Fresources\u002Fchaos\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fnginx:\u002Fvar\u002Flog\u002Fnginx:z\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fcache:\u002Fusr\u002Flocal\u002Fnginx\u002Fcache\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fsock:\u002Fapp\u002Fsock\n    environment:\n      - TCD_MGT_API=https:\u002F\u002Fsafeline-mgt:1443\u002Fapi\u002Fopen\u002Fpublish\u002Fserver\n      - TCD_SNSERVER=safeline-detector:8000\n      - CHAOS_ADDR=safeline-chaos\n    ulimits:\n      nofile: 131072\n    ports:\n      - 29080:80\n      - 28443:443\n    networks:\n      - safeline-ce\n\n  # -----------------------\n  # 5. 任务调度\n  # -----------------------\n  luigi:\n    container_name: safeline-luigi\n    restart: always\n    image: chaitin\u002Fsafeline-luigi:latest\n    environment:\n      - MGT_IP=safeline-mgt\n      - LUIGI_PG=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n    volumes:\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fluigi:\u002Fapp\u002Fdata\n    logging:\n      driver: \"json-file\"\n      options:\n        max-size: \"100m\"\n        max-file: \"5\"\n    depends_on:\n      - detect\n      - mgt\n    networks:\n      - safeline-ce\n\n  # -----------------------\n  # 6. 威胁情报\n  # -----------------------\n  fvm:\n    container_name: safeline-fvm\n    restart: always\n    image: chaitin\u002Fsafeline-fvm:latest\n    volumes:\n      - \u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n    logging:\n      driver: \"json-file\"\n      options:\n        max-size: \"100m\"\n        max-file: \"5\"\n    networks:\n      - safeline-ce\n\n  # -----------------------\n  # 7. 混沌测试\n  # -----------------------\n  chaos:\n    container_name: safeline-chaos\n    restart: always\n    image: chaitin\u002Fsafeline-chaos:latest\n    logging:\n      driver: \"json-file\"\n      options:\n        max-size: \"100m\"\n        max-file: \"10\"\n    environment:\n      - DB_ADDR=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n    volumes:\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fsock:\u002Fapp\u002Fsock\n      - \u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fchaos:\u002Fapp\u002Fchaos\n    networks:\n      - safeline-ce\n\n# 网络配置\nnetworks:\n  safeline-ce:\n    driver: bridge\n","yaml","",[191,203,204,213,219,225,231,237,244,250,255,270,276,285,291,297,302,310,321,332,343,351,360,368,376,384,392,400,408,434,442,453,458,463,469,474,482,492,501,511,518,525,533,541,549,557,565,573,580,590,597,605,613,621,629,637,648,656,667,678,685,692,697,702,708,713,721,731,740,750,757,765,773,780,787,795,802,809,814,819,825,830,838,848,857,867,874,881,889,897,904,912,920,928,935,942,950,958,966,974,986,993,1001,1009,1016,1023,1028,1033,1039,1044,1052,1062,1071,1081,1088,1096,1104,1111,1118,1126,1133,1142,1149,1158,1167,1174,1182,1190,1197,1204,1209,1214,1220,1225,1233,1243,1252,1262,1269,1276,1283,1292,1299,1308,1317,1324,1331,1336,1341,1347,1352,1360,1370,1379,1389,1396,1405,1412,1421,1431,1438,1446,1453,1460,1468,1475,1482,1487,1493,1501,1509],{"__ignoreMap":201},[205,206,209],"span",{"class":207,"line":208},"line",1,[205,210,212],{"class":211},"sJ8bj","# 官方文档\n",[205,214,216],{"class":207,"line":215},2,[205,217,218],{"class":211},"# https:\u002F\u002Fdocs.waf-ce.chaitin.cn\u002F\n",[205,220,222],{"class":207,"line":221},3,[205,223,224],{"class":211},"# web 访问 https:\u002F\u002FIP:29443\n",[205,226,228],{"class":207,"line":227},4,[205,229,230],{"class":211},"# 账号 admin 密码在 safeline-mgt 日志\n",[205,232,234],{"class":207,"line":233},5,[205,235,236],{"class":211},"# 重置密码 docker exec safeline-mgt resetadmin\n",[205,238,240],{"class":207,"line":239},6,[205,241,243],{"emptyLinePlaceholder":242},true,"\n",[205,245,247],{"class":207,"line":246},7,[205,248,249],{"class":211},"# ---\n",[205,251,253],{"class":207,"line":252},8,[205,254,243],{"emptyLinePlaceholder":242},[205,256,258,262,266],{"class":207,"line":257},9,[205,259,261],{"class":260},"s9eBZ","name",[205,263,265],{"class":264},"sVt8B",": ",[205,267,269],{"class":268},"sZZnC","safeline\n",[205,271,273],{"class":207,"line":272},10,[205,274,275],{"class":211},"# 最后编辑时间：2026-02-03\n",[205,277,279,282],{"class":207,"line":278},11,[205,280,281],{"class":260},"services",[205,283,284],{"class":264},":\n",[205,286,288],{"class":207,"line":287},12,[205,289,290],{"class":211},"  # -----------------------\n",[205,292,294],{"class":207,"line":293},13,[205,295,296],{"class":211},"  # 1. 数据库\n",[205,298,300],{"class":207,"line":299},14,[205,301,290],{"class":211},[205,303,305,308],{"class":207,"line":304},15,[205,306,307],{"class":260},"  postgres",[205,309,284],{"class":264},[205,311,313,316,318],{"class":207,"line":312},16,[205,314,315],{"class":260},"    container_name",[205,317,265],{"class":264},[205,319,320],{"class":268},"safeline-pg\n",[205,322,324,327,329],{"class":207,"line":323},17,[205,325,326],{"class":260},"    restart",[205,328,265],{"class":264},[205,330,331],{"class":268},"always\n",[205,333,335,338,340],{"class":207,"line":334},18,[205,336,337],{"class":260},"    image",[205,339,265],{"class":264},[205,341,342],{"class":268},"chaitin\u002Fsafeline-postgres:15.2\n",[205,344,346,349],{"class":207,"line":345},19,[205,347,348],{"class":260},"    volumes",[205,350,284],{"class":264},[205,352,354,357],{"class":207,"line":353},20,[205,355,356],{"class":264},"      - ",[205,358,359],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fpostgres\u002Fdata:\u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n",[205,361,363,365],{"class":207,"line":362},21,[205,364,356],{"class":264},[205,366,367],{"class":268},"\u002Fetc\u002Flocaltime:\u002Fetc\u002Flocaltime:ro\n",[205,369,371,374],{"class":207,"line":370},22,[205,372,373],{"class":260},"    environment",[205,375,284],{"class":264},[205,377,379,381],{"class":207,"line":378},23,[205,380,356],{"class":264},[205,382,383],{"class":268},"POSTGRES_USER=safeline-ce\n",[205,385,387,389],{"class":207,"line":386},24,[205,388,356],{"class":264},[205,390,391],{"class":268},"POSTGRES_PASSWORD=safeline-pwd-change-me\n",[205,393,395,398],{"class":207,"line":394},25,[205,396,397],{"class":260},"    networks",[205,399,284],{"class":264},[205,401,403,405],{"class":207,"line":402},26,[205,404,356],{"class":264},[205,406,407],{"class":268},"safeline-ce\n",[205,409,411,414,417,420,423,426,428,431],{"class":207,"line":410},27,[205,412,413],{"class":260},"    command",[205,415,416],{"class":264},": [",[205,418,419],{"class":268},"postgres",[205,421,422],{"class":264},", ",[205,424,425],{"class":268},"-c",[205,427,422],{"class":264},[205,429,430],{"class":268},"max_connections=600",[205,432,433],{"class":264},"]\n",[205,435,437,440],{"class":207,"line":436},28,[205,438,439],{"class":260},"    healthcheck",[205,441,284],{"class":264},[205,443,445,448,450],{"class":207,"line":444},29,[205,446,447],{"class":260},"      test",[205,449,265],{"class":264},[205,451,452],{"class":268},"pg_isready -U safeline-ce -d safeline-ce\n",[205,454,456],{"class":207,"line":455},30,[205,457,243],{"emptyLinePlaceholder":242},[205,459,461],{"class":207,"line":460},31,[205,462,290],{"class":211},[205,464,466],{"class":207,"line":465},32,[205,467,468],{"class":211},"  # 2. 管理后台\n",[205,470,472],{"class":207,"line":471},33,[205,473,290],{"class":211},[205,475,477,480],{"class":207,"line":476},34,[205,478,479],{"class":260},"  mgt",[205,481,284],{"class":264},[205,483,485,487,489],{"class":207,"line":484},35,[205,486,315],{"class":260},[205,488,265],{"class":264},[205,490,491],{"class":268},"safeline-mgt\n",[205,493,495,497,499],{"class":207,"line":494},36,[205,496,326],{"class":260},[205,498,265],{"class":264},[205,500,331],{"class":268},[205,502,504,506,508],{"class":207,"line":503},37,[205,505,337],{"class":260},[205,507,265],{"class":264},[205,509,510],{"class":268},"chaitin\u002Fsafeline-mgt:latest\n",[205,512,514,516],{"class":207,"line":513},38,[205,515,348],{"class":260},[205,517,284],{"class":264},[205,519,521,523],{"class":207,"line":520},39,[205,522,356],{"class":264},[205,524,367],{"class":268},[205,526,528,530],{"class":207,"line":527},40,[205,529,356],{"class":264},[205,531,532],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fmgt:\u002Fapp\u002Fdata\n",[205,534,536,538],{"class":207,"line":535},41,[205,537,356],{"class":264},[205,539,540],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fnginx:\u002Fapp\u002Flog\u002Fnginx:z\n",[205,542,544,546],{"class":207,"line":543},42,[205,545,356],{"class":264},[205,547,548],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fsock:\u002Fapp\u002Fsock\n",[205,550,552,554],{"class":207,"line":551},43,[205,553,356],{"class":264},[205,555,556],{"class":268},"\u002Fvar\u002Frun:\u002Fapp\u002Frun\n",[205,558,560,563],{"class":207,"line":559},44,[205,561,562],{"class":260},"    ports",[205,564,284],{"class":264},[205,566,568,570],{"class":207,"line":567},45,[205,569,356],{"class":264},[205,571,572],{"class":268},"29443:1443\n",[205,574,576,578],{"class":207,"line":575},46,[205,577,439],{"class":260},[205,579,284],{"class":264},[205,581,583,585,587],{"class":207,"line":582},47,[205,584,447],{"class":260},[205,586,265],{"class":264},[205,588,589],{"class":268},"curl -k -f https:\u002F\u002Flocalhost:1443\u002Fapi\u002Fopen\u002Fhealth\n",[205,591,593,595],{"class":207,"line":592},48,[205,594,373],{"class":260},[205,596,284],{"class":264},[205,598,600,602],{"class":207,"line":599},49,[205,601,356],{"class":264},[205,603,604],{"class":268},"MGT_PG=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n",[205,606,608,611],{"class":207,"line":607},50,[205,609,610],{"class":260},"    depends_on",[205,612,284],{"class":264},[205,614,616,618],{"class":207,"line":615},51,[205,617,356],{"class":264},[205,619,620],{"class":268},"postgres\n",[205,622,624,626],{"class":207,"line":623},52,[205,625,356],{"class":264},[205,627,628],{"class":268},"fvm\n",[205,630,632,635],{"class":207,"line":631},53,[205,633,634],{"class":260},"    logging",[205,636,284],{"class":264},[205,638,640,643,645],{"class":207,"line":639},54,[205,641,642],{"class":260},"      driver",[205,644,265],{"class":264},[205,646,647],{"class":268},"\"json-file\"\n",[205,649,651,654],{"class":207,"line":650},55,[205,652,653],{"class":260},"      options",[205,655,284],{"class":264},[205,657,659,662,664],{"class":207,"line":658},56,[205,660,661],{"class":260},"        max-size",[205,663,265],{"class":264},[205,665,666],{"class":268},"\"100m\"\n",[205,668,670,673,675],{"class":207,"line":669},57,[205,671,672],{"class":260},"        max-file",[205,674,265],{"class":264},[205,676,677],{"class":268},"\"5\"\n",[205,679,681,683],{"class":207,"line":680},58,[205,682,397],{"class":260},[205,684,284],{"class":264},[205,686,688,690],{"class":207,"line":687},59,[205,689,356],{"class":264},[205,691,407],{"class":268},[205,693,695],{"class":207,"line":694},60,[205,696,243],{"emptyLinePlaceholder":242},[205,698,700],{"class":207,"line":699},61,[205,701,290],{"class":211},[205,703,705],{"class":207,"line":704},62,[205,706,707],{"class":211},"  # 3. 检测引擎\n",[205,709,711],{"class":207,"line":710},63,[205,712,290],{"class":211},[205,714,716,719],{"class":207,"line":715},64,[205,717,718],{"class":260},"  detect",[205,720,284],{"class":264},[205,722,724,726,728],{"class":207,"line":723},65,[205,725,315],{"class":260},[205,727,265],{"class":264},[205,729,730],{"class":268},"safeline-detector\n",[205,732,734,736,738],{"class":207,"line":733},66,[205,735,326],{"class":260},[205,737,265],{"class":264},[205,739,331],{"class":268},[205,741,743,745,747],{"class":207,"line":742},67,[205,744,337],{"class":260},[205,746,265],{"class":264},[205,748,749],{"class":268},"chaitin\u002Fsafeline-detector:latest\n",[205,751,753,755],{"class":207,"line":752},68,[205,754,348],{"class":260},[205,756,284],{"class":264},[205,758,760,762],{"class":207,"line":759},69,[205,761,356],{"class":264},[205,763,764],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fdetector:\u002Fresources\u002Fdetector\n",[205,766,768,770],{"class":207,"line":767},70,[205,769,356],{"class":264},[205,771,772],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fdetector:\u002Flogs\u002Fdetector\n",[205,774,776,778],{"class":207,"line":775},71,[205,777,356],{"class":264},[205,779,367],{"class":268},[205,781,783,785],{"class":207,"line":782},72,[205,784,373],{"class":260},[205,786,284],{"class":264},[205,788,790,792],{"class":207,"line":789},73,[205,791,356],{"class":264},[205,793,794],{"class":268},"LOG_DIR=\u002Flogs\u002Fdetector\n",[205,796,798,800],{"class":207,"line":797},74,[205,799,397],{"class":260},[205,801,284],{"class":264},[205,803,805,807],{"class":207,"line":804},75,[205,806,356],{"class":264},[205,808,407],{"class":268},[205,810,812],{"class":207,"line":811},76,[205,813,243],{"emptyLinePlaceholder":242},[205,815,817],{"class":207,"line":816},77,[205,818,290],{"class":211},[205,820,822],{"class":207,"line":821},78,[205,823,824],{"class":211},"  # 4. 流量转发 (Tengine) \n",[205,826,828],{"class":207,"line":827},79,[205,829,290],{"class":211},[205,831,833,836],{"class":207,"line":832},80,[205,834,835],{"class":260},"  tengine",[205,837,284],{"class":264},[205,839,841,843,845],{"class":207,"line":840},81,[205,842,315],{"class":260},[205,844,265],{"class":264},[205,846,847],{"class":268},"safeline-tengine\n",[205,849,851,853,855],{"class":207,"line":850},82,[205,852,326],{"class":260},[205,854,265],{"class":264},[205,856,331],{"class":268},[205,858,860,862,864],{"class":207,"line":859},83,[205,861,337],{"class":260},[205,863,265],{"class":264},[205,865,866],{"class":268},"chaitin\u002Fsafeline-tengine:latest\n",[205,868,870,872],{"class":207,"line":869},84,[205,871,348],{"class":260},[205,873,284],{"class":264},[205,875,877,879],{"class":207,"line":876},85,[205,878,356],{"class":264},[205,880,367],{"class":268},[205,882,884,886],{"class":207,"line":883},86,[205,885,356],{"class":264},[205,887,888],{"class":268},"\u002Fetc\u002Fresolv.conf:\u002Fetc\u002Fresolv.conf:ro\n",[205,890,892,894],{"class":207,"line":891},87,[205,893,356],{"class":264},[205,895,896],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fnginx:\u002Fetc\u002Fnginx\n",[205,898,900,902],{"class":207,"line":899},88,[205,901,356],{"class":264},[205,903,764],{"class":268},[205,905,907,909],{"class":207,"line":906},89,[205,908,356],{"class":264},[205,910,911],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fchaos:\u002Fresources\u002Fchaos\n",[205,913,915,917],{"class":207,"line":914},90,[205,916,356],{"class":264},[205,918,919],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Flogs\u002Fnginx:\u002Fvar\u002Flog\u002Fnginx:z\n",[205,921,923,925],{"class":207,"line":922},91,[205,924,356],{"class":264},[205,926,927],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fcache:\u002Fusr\u002Flocal\u002Fnginx\u002Fcache\n",[205,929,931,933],{"class":207,"line":930},92,[205,932,356],{"class":264},[205,934,548],{"class":268},[205,936,938,940],{"class":207,"line":937},93,[205,939,373],{"class":260},[205,941,284],{"class":264},[205,943,945,947],{"class":207,"line":944},94,[205,946,356],{"class":264},[205,948,949],{"class":268},"TCD_MGT_API=https:\u002F\u002Fsafeline-mgt:1443\u002Fapi\u002Fopen\u002Fpublish\u002Fserver\n",[205,951,953,955],{"class":207,"line":952},95,[205,954,356],{"class":264},[205,956,957],{"class":268},"TCD_SNSERVER=safeline-detector:8000\n",[205,959,961,963],{"class":207,"line":960},96,[205,962,356],{"class":264},[205,964,965],{"class":268},"CHAOS_ADDR=safeline-chaos\n",[205,967,969,972],{"class":207,"line":968},97,[205,970,971],{"class":260},"    ulimits",[205,973,284],{"class":264},[205,975,977,980,982],{"class":207,"line":976},98,[205,978,979],{"class":260},"      nofile",[205,981,265],{"class":264},[205,983,985],{"class":984},"sj4cs","131072\n",[205,987,989,991],{"class":207,"line":988},99,[205,990,562],{"class":260},[205,992,284],{"class":264},[205,994,996,998],{"class":207,"line":995},100,[205,997,356],{"class":264},[205,999,1000],{"class":268},"29080:80\n",[205,1002,1004,1006],{"class":207,"line":1003},101,[205,1005,356],{"class":264},[205,1007,1008],{"class":268},"28443:443\n",[205,1010,1012,1014],{"class":207,"line":1011},102,[205,1013,397],{"class":260},[205,1015,284],{"class":264},[205,1017,1019,1021],{"class":207,"line":1018},103,[205,1020,356],{"class":264},[205,1022,407],{"class":268},[205,1024,1026],{"class":207,"line":1025},104,[205,1027,243],{"emptyLinePlaceholder":242},[205,1029,1031],{"class":207,"line":1030},105,[205,1032,290],{"class":211},[205,1034,1036],{"class":207,"line":1035},106,[205,1037,1038],{"class":211},"  # 5. 任务调度\n",[205,1040,1042],{"class":207,"line":1041},107,[205,1043,290],{"class":211},[205,1045,1047,1050],{"class":207,"line":1046},108,[205,1048,1049],{"class":260},"  luigi",[205,1051,284],{"class":264},[205,1053,1055,1057,1059],{"class":207,"line":1054},109,[205,1056,315],{"class":260},[205,1058,265],{"class":264},[205,1060,1061],{"class":268},"safeline-luigi\n",[205,1063,1065,1067,1069],{"class":207,"line":1064},110,[205,1066,326],{"class":260},[205,1068,265],{"class":264},[205,1070,331],{"class":268},[205,1072,1074,1076,1078],{"class":207,"line":1073},111,[205,1075,337],{"class":260},[205,1077,265],{"class":264},[205,1079,1080],{"class":268},"chaitin\u002Fsafeline-luigi:latest\n",[205,1082,1084,1086],{"class":207,"line":1083},112,[205,1085,373],{"class":260},[205,1087,284],{"class":264},[205,1089,1091,1093],{"class":207,"line":1090},113,[205,1092,356],{"class":264},[205,1094,1095],{"class":268},"MGT_IP=safeline-mgt\n",[205,1097,1099,1101],{"class":207,"line":1098},114,[205,1100,356],{"class":264},[205,1102,1103],{"class":268},"LUIGI_PG=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n",[205,1105,1107,1109],{"class":207,"line":1106},115,[205,1108,348],{"class":260},[205,1110,284],{"class":264},[205,1112,1114,1116],{"class":207,"line":1113},116,[205,1115,356],{"class":264},[205,1117,367],{"class":268},[205,1119,1121,1123],{"class":207,"line":1120},117,[205,1122,356],{"class":264},[205,1124,1125],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fluigi:\u002Fapp\u002Fdata\n",[205,1127,1129,1131],{"class":207,"line":1128},118,[205,1130,634],{"class":260},[205,1132,284],{"class":264},[205,1134,1136,1138,1140],{"class":207,"line":1135},119,[205,1137,642],{"class":260},[205,1139,265],{"class":264},[205,1141,647],{"class":268},[205,1143,1145,1147],{"class":207,"line":1144},120,[205,1146,653],{"class":260},[205,1148,284],{"class":264},[205,1150,1152,1154,1156],{"class":207,"line":1151},121,[205,1153,661],{"class":260},[205,1155,265],{"class":264},[205,1157,666],{"class":268},[205,1159,1161,1163,1165],{"class":207,"line":1160},122,[205,1162,672],{"class":260},[205,1164,265],{"class":264},[205,1166,677],{"class":268},[205,1168,1170,1172],{"class":207,"line":1169},123,[205,1171,610],{"class":260},[205,1173,284],{"class":264},[205,1175,1177,1179],{"class":207,"line":1176},124,[205,1178,356],{"class":264},[205,1180,1181],{"class":268},"detect\n",[205,1183,1185,1187],{"class":207,"line":1184},125,[205,1186,356],{"class":264},[205,1188,1189],{"class":268},"mgt\n",[205,1191,1193,1195],{"class":207,"line":1192},126,[205,1194,397],{"class":260},[205,1196,284],{"class":264},[205,1198,1200,1202],{"class":207,"line":1199},127,[205,1201,356],{"class":264},[205,1203,407],{"class":268},[205,1205,1207],{"class":207,"line":1206},128,[205,1208,243],{"emptyLinePlaceholder":242},[205,1210,1212],{"class":207,"line":1211},129,[205,1213,290],{"class":211},[205,1215,1217],{"class":207,"line":1216},130,[205,1218,1219],{"class":211},"  # 6. 威胁情报\n",[205,1221,1223],{"class":207,"line":1222},131,[205,1224,290],{"class":211},[205,1226,1228,1231],{"class":207,"line":1227},132,[205,1229,1230],{"class":260},"  fvm",[205,1232,284],{"class":264},[205,1234,1236,1238,1240],{"class":207,"line":1235},133,[205,1237,315],{"class":260},[205,1239,265],{"class":264},[205,1241,1242],{"class":268},"safeline-fvm\n",[205,1244,1246,1248,1250],{"class":207,"line":1245},134,[205,1247,326],{"class":260},[205,1249,265],{"class":264},[205,1251,331],{"class":268},[205,1253,1255,1257,1259],{"class":207,"line":1254},135,[205,1256,337],{"class":260},[205,1258,265],{"class":264},[205,1260,1261],{"class":268},"chaitin\u002Fsafeline-fvm:latest\n",[205,1263,1265,1267],{"class":207,"line":1264},136,[205,1266,348],{"class":260},[205,1268,284],{"class":264},[205,1270,1272,1274],{"class":207,"line":1271},137,[205,1273,356],{"class":264},[205,1275,367],{"class":268},[205,1277,1279,1281],{"class":207,"line":1278},138,[205,1280,634],{"class":260},[205,1282,284],{"class":264},[205,1284,1286,1288,1290],{"class":207,"line":1285},139,[205,1287,642],{"class":260},[205,1289,265],{"class":264},[205,1291,647],{"class":268},[205,1293,1295,1297],{"class":207,"line":1294},140,[205,1296,653],{"class":260},[205,1298,284],{"class":264},[205,1300,1302,1304,1306],{"class":207,"line":1301},141,[205,1303,661],{"class":260},[205,1305,265],{"class":264},[205,1307,666],{"class":268},[205,1309,1311,1313,1315],{"class":207,"line":1310},142,[205,1312,672],{"class":260},[205,1314,265],{"class":264},[205,1316,677],{"class":268},[205,1318,1320,1322],{"class":207,"line":1319},143,[205,1321,397],{"class":260},[205,1323,284],{"class":264},[205,1325,1327,1329],{"class":207,"line":1326},144,[205,1328,356],{"class":264},[205,1330,407],{"class":268},[205,1332,1334],{"class":207,"line":1333},145,[205,1335,243],{"emptyLinePlaceholder":242},[205,1337,1339],{"class":207,"line":1338},146,[205,1340,290],{"class":211},[205,1342,1344],{"class":207,"line":1343},147,[205,1345,1346],{"class":211},"  # 7. 混沌测试\n",[205,1348,1350],{"class":207,"line":1349},148,[205,1351,290],{"class":211},[205,1353,1355,1358],{"class":207,"line":1354},149,[205,1356,1357],{"class":260},"  chaos",[205,1359,284],{"class":264},[205,1361,1363,1365,1367],{"class":207,"line":1362},150,[205,1364,315],{"class":260},[205,1366,265],{"class":264},[205,1368,1369],{"class":268},"safeline-chaos\n",[205,1371,1373,1375,1377],{"class":207,"line":1372},151,[205,1374,326],{"class":260},[205,1376,265],{"class":264},[205,1378,331],{"class":268},[205,1380,1382,1384,1386],{"class":207,"line":1381},152,[205,1383,337],{"class":260},[205,1385,265],{"class":264},[205,1387,1388],{"class":268},"chaitin\u002Fsafeline-chaos:latest\n",[205,1390,1392,1394],{"class":207,"line":1391},153,[205,1393,634],{"class":260},[205,1395,284],{"class":264},[205,1397,1399,1401,1403],{"class":207,"line":1398},154,[205,1400,642],{"class":260},[205,1402,265],{"class":264},[205,1404,647],{"class":268},[205,1406,1408,1410],{"class":207,"line":1407},155,[205,1409,653],{"class":260},[205,1411,284],{"class":264},[205,1413,1415,1417,1419],{"class":207,"line":1414},156,[205,1416,661],{"class":260},[205,1418,265],{"class":264},[205,1420,666],{"class":268},[205,1422,1424,1426,1428],{"class":207,"line":1423},157,[205,1425,672],{"class":260},[205,1427,265],{"class":264},[205,1429,1430],{"class":268},"\"10\"\n",[205,1432,1434,1436],{"class":207,"line":1433},158,[205,1435,373],{"class":260},[205,1437,284],{"class":264},[205,1439,1441,1443],{"class":207,"line":1440},159,[205,1442,356],{"class":264},[205,1444,1445],{"class":268},"DB_ADDR=postgres:\u002F\u002Fsafeline-ce:safeline-pwd-change-me@safeline-pg\u002Fsafeline-ce?sslmode=disable\n",[205,1447,1449,1451],{"class":207,"line":1448},160,[205,1450,348],{"class":260},[205,1452,284],{"class":264},[205,1454,1456,1458],{"class":207,"line":1455},161,[205,1457,356],{"class":264},[205,1459,548],{"class":268},[205,1461,1463,1465],{"class":207,"line":1462},162,[205,1464,356],{"class":264},[205,1466,1467],{"class":268},"\u002Fmnt\u002Fdocker\u002Fapps\u002Fsafeline\u002Fresources\u002Fchaos:\u002Fapp\u002Fchaos\n",[205,1469,1471,1473],{"class":207,"line":1470},163,[205,1472,397],{"class":260},[205,1474,284],{"class":264},[205,1476,1478,1480],{"class":207,"line":1477},164,[205,1479,356],{"class":264},[205,1481,407],{"class":268},[205,1483,1485],{"class":207,"line":1484},165,[205,1486,243],{"emptyLinePlaceholder":242},[205,1488,1490],{"class":207,"line":1489},166,[205,1491,1492],{"class":211},"# 网络配置\n",[205,1494,1496,1499],{"class":207,"line":1495},167,[205,1497,1498],{"class":260},"networks",[205,1500,284],{"class":264},[205,1502,1504,1507],{"class":207,"line":1503},168,[205,1505,1506],{"class":260},"  safeline-ce",[205,1508,284],{"class":264},[205,1510,1512,1515,1517],{"class":207,"line":1511},169,[205,1513,1514],{"class":260},"    driver",[205,1516,265],{"class":264},[205,1518,1519],{"class":268},"bridge\n",[16,1521,1523],{"id":1522},"_32-配置雷池-waf","3.2 配置雷池 WAF",[21,1525,1526],{},"雷池不需要处理复杂的 HTTPS 证书，我们把它当做一个纯粹的 HTTP 过滤器。",[29,1528,1529,1543,1549,1563,1580,1594],{},[32,1530,1531,1532,1535,1536,138,1539,1542],{},"登录雷池后台  ",[191,1533,1534],{},"http:\u002F\u002F192.168.x.x:29443","，点击 ",[35,1537,1538],{},"【防护应用】",[35,1540,1541],{},"【添加站点】","。",[32,1544,1545,1548],{},[35,1546,1547],{},"配置关键点","：",[32,1550,1551],{},[29,1552,1553],{},[32,1554,1555,1558,1559,1562],{},[35,1556,1557],{},"域名","：填写你的公网域名（如 ",[191,1560,1561],{},"fnnas.example.com","）",[32,1564,1565],{},[29,1566,1567],{},[32,1568,1569,1572,1573,1576,1577],{},[35,1570,1571],{},"端口","：填写 ",[191,1574,1575],{},"80"," (HTTP)，把 443 那个关掉不然需要证书。",[35,1578,1579],{},"注意：这里不要开启 SSL，证书交给 Lucky 管。",[32,1581,1582],{},[29,1583,1584],{},[32,1585,1586,1589,1590,1593],{},[35,1587,1588],{},"上游服务器","：填写飞牛 NAS 的真实内网 IP + 端口（如 ",[191,1591,1592],{},"http:\u002F\u002F192.168.x.x:5666","）。",[32,1595,1596],{},"提交保存。",[21,1598,1599],{},"此时，雷池已经准备好接收流量并转发给飞牛了。",[21,1601,1602],{},[1603,1604],"img",{"alt":201,"src":1605},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583322464.avif",[21,1607,1608,1609,1548],{},"进入站点详情 -> ",[35,1610,1611],{},"【高级配置】",[29,1613,1614,1623],{},[32,1615,1616,1619,1620,1542],{},[35,1617,1618],{},"获取客户端 IP 方式","：选择 ",[35,1621,1622],{},"“从 HTTP Header 获取”",[32,1624,1625,1628,1629,1542],{},[35,1626,1627],{},"HTTP Header","：填入 ",[191,1630,1631],{},"X-Forwarded-For",[21,1633,1634],{},[1603,1635],{"alt":201,"src":1636},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583321047.avif",[21,1638,1639,1642],{},[35,1640,1641],{},"验证方法","：用手机流量访问一次 NAS，去雷池【防护日志】看一眼，如果源 IP 显示的是公网 IP，说明透传成功！",[11,1644,1646],{"id":1645},"_4-lucky-反向代理","4 Lucky 反向代理",[16,1648,1650],{"id":1649},"_41-安装-lucky","4.1 安装 Lucky",[21,1652,1653],{},"略，因为我前面文章详细说过了。",[16,1655,1657],{"id":1656},"_42-配置-lucky-反向代理","4.2 配置 Lucky 反向代理",[21,1659,1660,1661,1663],{},"这个我也详细说过了，关键接入",[35,1662,90],{},"，我着重说一下。Lucky 是流量的入口，它负责把外网的 HTTPS 流量“剥皮”成 HTTP，然后扔给雷池。",[29,1665,1666,1669,1677,1682,1703,1709,1728],{},[32,1667,1668],{},"在 Lucky 中添加一个子规则。",[32,1670,1671,1674,1675,1593],{},[35,1672,1673],{},"前端地址","：填写你的反代域名（如 ",[191,1676,1561],{},[32,1678,1679,1548],{},[35,1680,1681],{},"后端设置 (关键)",[32,1683,1684],{},[29,1685,1686],{},[32,1687,1688,1691,1692,1695,1696,1699,1700,1542],{},[35,1689,1690],{},"后端地址","：指向 ",[35,1693,1694],{},"雷池的 IP 和端口","（如 ",[191,1697,1698],{},"http:\u002F\u002F192.168.x.x:29080","），",[35,1701,1702],{},"千万不要直接指飞牛",[32,1704,1705,1708],{},[35,1706,1707],{},"SSL 证书","：在 Lucky 里配置好你的 HTTPS 证书。",[32,1710,1711,1714,1715,138,1718,1721,1722,1721,1725],{},[35,1712,1713],{},"安全设置","  ->  ",[35,1716,1717],{},"基本认证",[35,1719,1720],{},"网页认证","  -> ",[35,1723,1724],{},"认证信息设置",[191,1726,1727],{},"admin:admin123",[32,1729,1730],{},[29,1731,1732],{},[32,1733,1734,1737,1738],{},[191,1735,1736],{},"账号:密码","的格式，请注意中间有一个",[35,1739,1740],{},"英文的冒号",[21,1742,1743],{},[1603,1744],{"alt":201,"src":1745},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583315142.avif",[11,1747,1749],{"id":1748},"_5-效果验收与取舍","5 效果验收与取舍",[16,1751,1753],{"id":1752},"_51-安全性验证","5.1 安全性验证",[29,1755,1756,1773],{},[32,1757,1758,1761,1762],{},[35,1759,1760],{},"异常请求测试","：访问一个不存在的敏感路径。\n",[29,1763,1764],{},[32,1765,1766,1769,1770,1772],{},[35,1767,1768],{},"结果","：首先需要在输入",[35,1771,83],{},"，雷池直接拦截并返回 403 Forbidden。",[32,1774,1775,1778,1779],{},[35,1776,1777],{},"认证测试","：在浏览器输入错误的 Basic Auth 密码。\n",[29,1780,1781],{},[32,1782,1783,1785],{},[35,1784,1768],{},"：直接返回 401 Unauthorized，请求不会到达飞牛服务。",[16,1787,1789],{"id":1788},"_52-带来的副作用","5.2 带来的副作用",[29,1791,1792,1801],{},[32,1793,1794,1797,1798,1542],{},[35,1795,1796],{},"手机 APP 无法使用","：飞牛的手机 APP 无法处理 Basic Auth 弹窗，所以开启此功能后，",[35,1799,1800],{},"手机 APP 将无法连接",[32,1802,1803,162,1806],{},[35,1804,1805],{},"解决方案",[29,1807,1808,1814],{},[32,1809,1810,1813],{},[35,1811,1812],{},"日常使用","：电脑端网页访问（安全无忧）。",[32,1815,1816,1819],{},[35,1817,1818],{},"手机端","：建议配合 Tailscale \u002F WireGuard 等，走内网 IP 访问，不经过 Lucky 和雷池。",[16,1821,1823],{"id":1822},"_53-展示结果图","5.3 展示结果图",[21,1825,1826],{},"这是内网 oec-t 飞牛系统的相关截图",[21,1828,1829],{},[1603,1830],{"alt":201,"src":1831},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583316519.avif",[21,1833,1834],{},"这是雷池 WAF 防护到了的图",[21,1836,1837],{},[1603,1838],{"alt":201,"src":1839},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583317991.avif",[21,1841,1842],{},"这是 Lucky Auth 验证的图",[21,1844,1845],{},[1603,1846],{"alt":201,"src":1847},"https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780583319450.avif",[11,1849,1851],{"id":1850},"_6-总结","6 总结",[21,1853,1854,1855,1858],{},"通过 ",[35,1856,1857],{},"Lucky (入口+认证) -> 雷池 (清洗) -> 飞牛 (业务)"," 的三层架构，我们实现了：",[29,1860,1861,1867,1873],{},[32,1862,1863,1866],{},[35,1864,1865],{},"HTTPS 自动续期","（Lucky 负责）。",[32,1868,1869,1872],{},[35,1870,1871],{},"WAF 虚拟补丁","（拦截 SQL 注入、路径遍历等异常请求）。",[32,1874,1875,1878],{},[35,1876,1877],{},"真实 IP 限制","（解决了反代 IP 丢失问题）。",[29,1880,1881],{},[32,1882,1883,1886],{},[35,1884,1885],{},"强制身份锁","（Basic Auth 隔离）。",[21,1888,1889],{},"在官方修复发布前，这套方案可以减少 NAS 服务的公开暴露面，并增加认证与请求过滤两层防护。安全配置需要持续复查，不能只依赖一次性设置。",[21,1891,1892],{},"Created with ❤️ by 张萌萌",[1894,1895,1896],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":201,"searchDepth":215,"depth":215,"links":1898},[1899,1904,1905,1909,1913,1918],{"id":13,"depth":215,"text":14,"children":1900},[1901,1902,1903],{"id":18,"depth":221,"text":19},{"id":26,"depth":221,"text":27},{"id":113,"depth":221,"text":114},{"id":147,"depth":215,"text":148},{"id":181,"depth":215,"text":182,"children":1906},[1907,1908],{"id":185,"depth":221,"text":186},{"id":1522,"depth":221,"text":1523},{"id":1645,"depth":215,"text":1646,"children":1910},[1911,1912],{"id":1649,"depth":221,"text":1650},{"id":1656,"depth":221,"text":1657},{"id":1748,"depth":215,"text":1749,"children":1914},[1915,1916,1917],{"id":1752,"depth":221,"text":1753},{"id":1788,"depth":221,"text":1789},{"id":1822,"depth":221,"text":1823},{"id":1850,"depth":215,"text":1851},"软路由",null,"2026-02-03",false,"md","https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780564682873.avif",{"published":1921},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护",{"title":5,"description":5},"blog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护",[1930,1931,75,61,1932],"docker","WAF","远程访问","UukMJ3TyMgMvYfOG9H1KIFZ6j0Dg62N_x5a5SvLxOPc",[1935,1939,1943,1947,1950,1953,1957,1960,1964,1968,1972,1976,1980,1984,1988,1992,1996,2000,2001,2004,2008,2012,2016,2020,2023,2027,2031,2035,2039,2043,2047,2051,2055,2059,2063,2067,2071,2074,2078,2082,2086,2090,2094,2097,2100,2103,2106,2109,2112,2115,2118,2121,2124,2127,2130,2133,2136,2139,2142,2145,2148],{"path":1936,"title":1937,"date":1938},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F16.IPv6与DNS的分手协议","IPv6 与 DNS 的分手协议","2026-10-02",{"path":1940,"title":1941,"date":1942},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F04.我的-AI-入坑记","我的 AI 入坑记","2026-09-24",{"path":1944,"title":1945,"date":1946},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F01.用-Docker-部署-Ollama-与-Open-WebUI-搭建本地大模型","用 Docker 部署 Ollama 与 Open WebUI 搭建本地大模型","2026-09-23",{"path":1948,"title":1949,"date":1946},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F02.用-New-API-搭建统一-LLM-网关与-Lucky-反代外网访问","用 New API 搭建统一 LLM 网关与 Lucky 反代外网访问",{"path":1951,"title":1952,"date":1946},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F03.用-Dify-搭建本地知识库让-AI-读懂你写的博客","用 Dify 搭建本地知识库，让 AI 读懂你写的博客",{"path":1954,"title":1955,"date":1956},"\u002Fblog\u002F20-生活碎片\u002F03-2026年秋季计划","2026 年秋季计划","2026-09-19",{"path":1958,"title":1959,"date":1956},"\u002Fblog\u002F30-学习笔记\u002F02.Python入门书单","Python 入门书单：从第一行代码到写出真正的程序",{"path":1961,"title":1962,"date":1963},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F09-Cloudflare-低延迟接入方案","Cloudflare 低延迟接入方案","2026-07-22 03:17:28",{"path":1965,"title":1966,"date":1967},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F08-Cloudflare-ImgBed-免费私有图床完整部署手册","Cloudflare ImgBed 免费私有图床完整部署手册","2026-07-19 02:09:08",{"path":1969,"title":1970,"date":1971},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F07-腾讯云-EdgeOne-边缘函数实现七牛-S3-随机图床-API","腾讯云 EdgeOne 边缘函数实现七牛云 & S3 存储随机图床 API","2026-07-13 21:25:48",{"path":1973,"title":1974,"date":1975},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F06-腾讯-EdgeOne-部署-Twikoo-评论系统指南","腾讯EdgeOne部署Twikoo评论系统指南","2026-06-14 17:41:11",{"path":1977,"title":1978,"date":1979},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F05-OpenList-接入-S3-对象存储完整使用教程","OpenList 接入 S3 对象存储完整使用教程","2026-06-11 13:08:07",{"path":1981,"title":1982,"date":1983},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F04-Cloudflare-R2-图床与全球加速方案","Cloudflare R2 图床与全球加速方案","2026-06-09 13:07:35",{"path":1985,"title":1986,"date":1987},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F03-免费图床与CDN加速方案","免费图床与 CDN 加速方案","2026-06-09",{"path":1989,"title":1990,"date":1991},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F02-零基础优雅搭建静态博客全教程","零基础优雅搭建静态博客全教程","2026-06-04",{"path":1993,"title":1994,"date":1995},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F01-远古产物—博客","赛博空间的私人岛屿：博客架构与风格美学","2026-06-03",{"path":1997,"title":1998,"date":1999},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南","关于 NAT 回流与内网域名直连的终极指南","2026-05-13",{"path":1926,"title":5,"date":1921},{"path":2002,"title":2003,"date":1921},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F18.一键DD纯净系统脚本","一键 DD 纯净系统脚本",{"path":2005,"title":2006,"date":2007},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F17.Ventoy多系统启动盘制作与使用全指南","Ventoy 多系统启动盘制作与使用全指南","2026-02-02",{"path":2009,"title":2010,"date":2011},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F16.Emby元数据匹配与中文命名规范","Emby 元数据匹配与中文命名规范","2026-02-01",{"path":2013,"title":2014,"date":2015},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F15.基于PVE系统安装LXC-debian","基于 PVE 系统安装 LXC-debian","2026-01-19",{"path":2017,"title":2018,"date":2019},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F13.Lucky反向代理终极指南","Lucky 反向代理终极指南","2026-01-16",{"path":2021,"title":2022,"date":2019},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F14.OEC盒子Armbian刷机指南","OEC 盒子 Armbian 刷机指南",{"path":2024,"title":2025,"date":2026},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F13.oec-fnOS安装","OEC-Turbo (RK3566) 安装飞牛 OS","2026-01-15",{"path":2028,"title":2029,"date":2030},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F12.新的篇章，debian12的配置","新的篇章，debian12 的配置","2026-01-14",{"path":2032,"title":2033,"date":2034},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F11.飞牛OS安装后必要配置","飞牛 OS 安装后必要配置","2026-01-06",{"path":2036,"title":2037,"date":2038},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F11.NAS-导航页的终极形态","告别繁琐配置：NAS 导航页的终极形态 —— 从 Sun-Panel 到 FlatNAS","2026-01-05",{"path":2040,"title":2041,"date":2042},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F10.LogVar-弹幕-API-部署指南","LogVar 弹幕 API  (纯本地缓存版) 部署指南","2025-12-30",{"path":2044,"title":2045,"date":2046},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F10.基于Lucky与QMediaSync的飞牛远程媒体访问","基于 Lucky 与 QMediaSync 的飞牛远程媒体访问","2025-12-26",{"path":2048,"title":2049,"date":2050},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F09.新的篇章，PVE虚拟机","新的篇章，PVE虚拟机","2025-12-21",{"path":2052,"title":2053,"date":2054},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F08.Linux系统，音响有底噪","Linux 系统，音响有底噪怎么办？","2025-12-17",{"path":2056,"title":2057,"date":2058},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F07.飞牛OS的安装","飞牛 OS 的安装","2025-12-14",{"path":2060,"title":2061,"date":2062},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F06.Debian13换源","Debian13 换源","2025-11-29",{"path":2064,"title":2065,"date":2066},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F05.Kodi-CoreELEC安装指南","Kodi & CoreELEC 安装指南","2025-11-21",{"path":2068,"title":2069,"date":2070},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F09.兰空图床和高清图标库","兰空图床和高清图标库","2025-11-15",{"path":2072,"title":2073,"date":2070},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F04.N1盒子Armbian刷机与配置","N1 盒子 Armbian 刷机与配置",{"path":2075,"title":2076,"date":2077},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F08.你是否需要一个图床？","你是否需要一个图床？","2025-11-14",{"path":2079,"title":2080,"date":2081},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F03.飞牛NAS第三方应用商店安装","飞牛 NAS 第三方应用商店 (FnDepot) 安装指南","2025-10-13",{"path":2083,"title":2084,"date":2085},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F02.Hills播放器-Windows-安卓","Hills 播放器（Windows + 安卓）","2025-09-24",{"path":2087,"title":2088,"date":2089},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F01.一行代码降低服务器功耗","一行代码降低服务器功耗","2025-08-19",{"path":2091,"title":2092,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F01.容器-docker-docker-compose","容器 & docker & docker-compose","2025-08-05",{"path":2095,"title":2096,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F02.容器项目-传输类","容器项目&传输类",{"path":2098,"title":2099,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F03.容器项目-相册类","容器项目&相册类",{"path":2101,"title":2102,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F04.容器项目-媒体类","容器项目&媒体类",{"path":2104,"title":2105,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F05.Emby自有授权媒体库（一）","Emby 自有授权媒体库（一）",{"path":2107,"title":2108,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F06.Emby自有授权媒体库（二）","Emby 自有授权媒体库（二）",{"path":2110,"title":2111,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F07.Adguard-Home去广告","Adguard Home 去广告",{"path":2113,"title":2114,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F01.新的篇章，软路由","新的篇章，软路由",{"path":2116,"title":2117,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F02.如何玩公网，怎么远程访问（一）","如何玩公网，怎么远程访问（一）",{"path":2119,"title":2120,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F03.如何玩公网，怎么远程访问（二）","如何玩公网，怎么远程访问（二）",{"path":2122,"title":2123,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F04.如何玩公网，怎么远程访问（三）","如何玩公网，怎么远程访问（三）",{"path":2125,"title":2126,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F05.免费域名与远程访问","免费域名与远程访问",{"path":2128,"title":2129,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F06.没有公网如何远程访问","没有公网如何远程访问",{"path":2131,"title":2132,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F07.爱快与OpenWRT双软路由MAC地址重复问题修正","爱快与 OpenWRT 双软路由MAC地址重复问题修正",{"path":2134,"title":2135,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F08.OpenWRT扩容","OpenWRT 扩容",{"path":2137,"title":2138,"date":2093},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F09.OpenWRT旁路由一条龙教程","OpenWRT 旁路由一条龙教程",{"path":2140,"title":2141,"date":2093},"\u002Fblog\u002F20-生活碎片\u002F02.在裂缝中种满阳光","让灵魂带着光行走：在裂缝中种满太阳",{"path":2143,"title":2144,"date":2093},"\u002Fblog\u002F30-学习笔记\u002F01.Typora学习笔记","Typora学习笔记",{"path":2146,"title":2147,"date":2093},"\u002Fblog\u002F30-学习笔记\u002F02.Markdown-拓展","Markdown 拓展",{"path":2149,"title":2150,"date":2151},"\u002Fblog\u002F20-生活碎片\u002F01.拥抱生活中的光与热","拥抱生活中的光与热","2025-07-05",1791304408856]