GzDyi's Blog

Tianyi TEWA-7500V ONT: Super Password & IPv6 Firewall

Sun, 30 Aug 2026 00:00:00 GMT

Tested & verified on 2026-08-30. For personal home-network tuning only. Do not use for illegal purposes; obtaining root-level access carries risks — evaluate on your own (ISP may throttle or suspend your line, you’ve been warned).

Part 1: Reproducible Walkthrough#

0. Confirm You Have the Same Firmware#

This guide targets China Mobile ONTs running the HiSilicon hsan platform + HGS new Web firmware. Quick verification:

Check	Command / Method	Typical Result
Web homepage size	`curl -s http://192.168.1.1/	wc -c`
Config dict exists	`curl -s http://192.168.1.1/json/config.json	wc -c`
Old firmware backdoors	`getpage.gch` / `cgi-bin/telnetenable.cgi`	All 404 (old guides on the web do NOT apply)
telnet banner	`telnet 192.168.1.1` after enabling	`hsan login:` (HiSilicon banner, no `load_cli factory`)

Applicable devices: Tianyi TEWA-7500V (10G XG-PON ONT, HiSilicon hsan platform). Other TEWA-700 / 7500 series HiSilicon ONTs from China Mobile can likely follow the same path (Broadcom variants use load_cli factory — not covered here).

Prerequisites:

Normal user credentials printed on the ONT label (usually user / <8-char alphanumeric>)
A Linux box on the same LAN that can reach 192.168.1.1, with Python 3 (use docker exec <container> python3 if no host interpreter)
The ONT HTTP stack is very brittle (see caveats below) — every request must be wrapped in retries

1. Normal-User Login (Challenge-Response)#

Login uses challenge-response: fetch a challenge first, then reply with md5(challenge:password). No cookies required — the server tracks sessions by source IP.

1
import urllib.request, urllib.parse, hashlib, json
2

3
BASE = "http://192.168.1.1"
4
USER = "user"
5
PWD  = "the normal-user password on your ONT label"
6

7
op = urllib.request.build_opener()
8
op.addheaders = [("User-Agent", "Mozilla/5.0"), ("Referer", BASE + "/")]
9

10
d = json.loads(op.open(BASE + "/getChallengeStr", timeout=10).read().decode())
11
# returns: {"challenge": "...", "session": "..."}
12
resp = hashlib.md5((d["challenge"] + ":" + PWD).encode()).hexdigest()
13
url = (BASE + "/lgDevice?userName=" + urllib.parse.quote(USER)
14
       + "&responseChallenge=" + resp
15
       + "&session=" + urllib.parse.quote(str(d.get("session", ""))))
16
r = json.loads(op.open(url, timeout=10).read().decode())
17
# r["errorCode"] == 0 means login OK

展开收起

Gotcha: the response is tab-indented pretty JSON ("errorCode":\t0). Never string-match 'errorCode": 0' — always use json.loads.

2. Find the Hidden TELNET Page#

The TELNET toggle is actually present in the main page HTML, just hidden by a CSS class:

Terminal window

1
curl -s http://192.168.1.1/ -o index.html
2
grep -o 'FEATURE_TELNET[^>]*' index.html
3
grep -o 'hgs_key="Telnet[A-Za-z]*"' index.html
4
# You'll see: TelnetEnable / TelnetWANEnable / TelnetUserName / TelnetPassword

Pull the config dictionary to confirm the object name and R/W paths:

Terminal window

1
curl -s http://192.168.1.1/json/config.json -o config.json
2
grep -A 20 'HGS_TELNET_CFG' config.json

Key info (/json/config.json + /json/tableCfg.json are the authoritative dictionaries for every object / path):

Object: HGS_TELNET_CFG, lives under InternetGatewayDevice.DeviceInfo.X_CMCC_ServiceManage.
customerCheckout msgType=220 (POST /getObjs), customerCheckin msgType=221 (POST /setObjs)

3. Call the API to Enable Telnet#

Read the current state first (endpoint on port 80, not 8080):

1
full = "InternetGatewayDevice.DeviceInfo.X_CMCC_ServiceManage."
2
body = [{"fullPath": full}]
3
POST("http://192.168.1.1/getObjs?waitTimeoutMs=5000", body)

Typical factory response:

1
[{"fullPath": "InternetGatewayDevice.DeviceInfo.X_CMCC_ServiceManage.",
2
  "TelnetEnable": "0", "TelnetWANEnable": "0",
3
  "TelnetUserName": "CMCCAdmin", "TelnetPassword": "aDm8H%MdA",
4
  "TelnetPort": "23", "SSHEnable": "0", ...}]

Write to enable telnet (all values are strings; set your own credentials):

1
body = [{"fullPath": full,
2
         "TelnetEnable": "1",
3
         "TelnetWANEnable": "0",
4
         "TelnetUserName": "your-telnet-username",
5
         "TelnetPassword": "your-strong-password"}]
6
POST("http://192.168.1.1/setObjs?waitTimeoutMs=5000", body)
7
# Returns [0] on success, telnetd starts immediately

The generic cgi-bin/telnetenable.cgi?telnetenable=1&key=MAC trick returns 404 on new firmware. The Fh@+last6ofMAC default telnet password belongs to older / other firmwares. Set your own on the new HGS builds.

Verify with nc -zv 192.168.1.1 23, then telnet in.

4. Telnet In & Read the Super Password from Config#

Terminal window

1
telnet 192.168.1.1
2
# login: <your-telnet-username>   Password: <your-telnet-password>

You land in HiSilicon hsan busybox ash (prompt / $). There is no load_cli factory, cfg_cmd, qoecmd, or cli, and su’s password can’t be computed with Broadcom-style algorithms. Don’t waste time — just read the raw config file:

Terminal window

1
cat /config/work/lastgood.xml

This is the plaintext running config XML (~166KB). Note that busybox grep doesn’t support \{0,400\} range regexes. The most reliable approach is to cat the whole file into your terminal log, copy it back locally, then grep:

Terminal window

1
grep -n 'SYSMNG_ACCOUNT_ATTR_TAB' -A 10 lastgood.log

You’ll hit the account table:

1
<Dir Name="SYSMNG_ACCOUNT_ATTR_TAB">
2
  <Value Name="ucTeleAccountEnable" Value="1"/>
3
  <Value Name="aucTeleAccountName" Value="CMCCAdmin"/>
4
  <Value Name="aucTeleAccountPassword" Value="SUPER_PASSWORD_HERE"/>   ← super-admin password
5
  <Value Name="aucUserAccountName" Value="user"/>
6
  <Value Name="aucUserAccountPassword" Value="matches_your_ONT_label"/>   ← sanity check
7
</Dir>

The super password is very often randomized by TR069 (if the defaults like aDm8H%MdA don’t work, that’s exactly what happened). Always read the file for the real value; never guess.

5. Log Into the Web Backend as Super Admin#

Use the same challenge-response login from step 1, but swap userName to CMCCAdmin and the password to the one you just extracted. Then open http://192.168.1.1 in your browser — all hidden menus (Security, Telnet, WAN, etc.) are now visible.

6. Read & Modify Security Config (Loosen IPv6 Ingress)#

Security config lives at the hbus://mdm/InternetGatewayDevice.X_CMCC_Security. node via the hbus protocol (append the path as-is to the URL, do NOT urlencode it):

1
HBUS = "hbus://mdm/InternetGatewayDevice.X_CMCC_Security."
2

3
# Read (msgType=211)
4
GET(f"http://192.168.1.1/getHbusData?path={HBUS}&msgType=211")
5

6
# Write (msgType=212, method=set, body carries path+para)
7
body = {"path": HBUS, "para": {"FirewallLevel": "0"}}
8
POST(f"http://192.168.1.1/setHbusData?path={HBUS}&method=set&msgType=212", body)

All fields and reference values:

Field	Meaning	Factory Value	Recommendation
FirewallEnable	Global firewall toggle	1	1 (keep it on)
FirewallLevel	Level: 0=Low / 1=Medium / 2=High	1 (Medium)	0 (Low) (loosens IPv4 ingress filter)
DoSEnable	DoS protection	1	1 (keep it on)
PortScanEnable	Port-scan protection	0	0
IPv6SessionSecurityEnable	IPv6 session security (v6 ingress filter)	0	0 (already off; leave alone)
IPFilterIn/OutEnable, UrlFilter, MacFilter	Various filters	0	0
LockNetEnable	ISP line lock	0	0

Read back to confirm FirewallLevel is "0", then test ingress from outside (disconnect from WiFi, use mobile data).

Part 2: Caveats & Lessons Learned#

Stability Pitfalls (Scripts Must Handle These)#

Brittle HTTP stack. Large downloads and rapid requests hit ConnectionReset constantly — even a dozen consecutive failures is normal. Wrap every request in retries (15 attempts × 2s interval worked for me). A single curl -s is a coin flip.
Response format. JSON is tab-indented pretty-print. Use json.loads to check success, never string matching.
No cookies / tokens. Session is bound to source IP. Complete the whole “login → action” chain in one script; never switch your egress IP mid-flight (Docker container, host, and mobile hotspot all have different ones).
Login rate-limiting. 3 wrong passwords per minute → 60s lockout (lgErrCnt counter). /lgDevice?task=logout counts toward your quota — never use it. Use a 65s wait in retry loops.
Stale session lock. If another device is already logged into the Web UI, getChallengeStr returns errorCode 1 (“another device is logged in”). Ask household members to close the ONT admin page before running.
Connection contention. Telnet and Web sessions generally don’t interfere, but after toggling telnet repeatedly, wait a couple seconds before hitting port 23 again.

Methodological Pitfalls#

Identify your firmware before copying guides. The online classics — telnetenable.cgi, load_cli factory, Fh@+last6ofMAC, Tianyi Broadcom SU-password generators — all fail on HiSilicon hsan + HGS new firmware. The path in this guide (hidden page → setObjs → read lastgood.xml) is the current general-purpose approach.
Busybox tools are castrated. Grep has no range regex support; 2>/dev/null redirection can error with can't create /dev/null: Permission denied in the restricted shell (the command still runs though). Don’t rely on shell tricks — just cat the file back to your local machine and analyze there.
/json/config.json is the master key. With it, you know exactly which object, which hbus path, and which msgType to use for every feature. Anything the Web UI can do, you can API-ize.
Reading the file beats guessing passwords. TR069 randomizing the default super password (aDm8H%MdA etc.) is the norm. The file always holds the truth.

Security & Cleanup#

Telnet cuts both ways. telnetd -b 192.168.1.1 -p 23 only binds to LAN, but plaintext + weak creds is still a risk. When done, flip TelnetEnable back to "0" via setObjs.
Don’t expose your Web UI. After loosening ingress, downstream DNAT6 rules on your router/host may accidentally forward admin ports too — check with ip6tables -t nat -S. Keep only the ports you actually need; delete or block the rest.
TR069 / RMS will roll you back. The ISP can push configs remotely. If a few days later your firewall level reverts to “Medium” or telnet turns off by itself, that’s RMS overwriting — just re-run your script, it’s normal.
Cost of lowering firewall level. Setting to “Low” reduces the ONT’s IPv4 protection (NAT still saves you, mostly). Keep DoS enabled. Audit other exposed services (Alist, PhotoPrism, etc.) after the change.
ONT-side loosen ≠ ingress works. The Web UI comments say firewall level only controls IPv4, and IPv6SessionSecurityEnable is already off — so the ONT itself might not be your blocker. If external tests still fail, check in order: your downstream router’s “IPv6 firewall” toggle → upstream ISP ACL (cross-validate by swapping ports).
Write down your changes. Typical set: FirewallLevel 1→0, TelnetEnable 1, custom telnet credentials. Anything you did via hbus API can be reverted the same way.

Three Years After Graduation: A Second Look

Wed, 19 Aug 2026 00:00:00 GMT

Three Years After Graduation: A Second Look#

A sudden urge to write — to capture the shifts in my mindset over the three years since graduating.

It seems we always put a filter over our past environments and stages of life. In university, I compared it to vocational school. Fresh out of college, I compared it to campus. After switching companies, I started comparing the new one to the old. The good things about a new environment never quite hit as hard, while the bad parts of the old one get romanticized over time — because those unpleasant things no longer poke at you every day. Meanwhile, the downsides of the present, sharpened by contrast, loom larger than they really are.

So now, looking back at university, I think of myself back then as someone who was remarkably disciplined.

But if I’m being honest, that’s not the whole story.

During those three years in college, my environment was fairly stable — nothing like the constant change I experience now. Where I went each day, where I sat, who I saw, what I did — it all followed a steady rhythm. And when your environment is stable, habits settle in naturally.

For example, I used to bring my laptop to the library every day. The library had limited power outlets, so to secure a spot with one, I gradually found a very concrete reason to wake up early.

It wasn’t that I loved waking up early. It was that I knew if I went later, there’d be no outlet left.

Looking back, that’s pretty interesting.

A lot of so-called discipline isn’t born out of sheer willpower. You need a reason, a stable environment, something that gives you immediate feedback. Back in university, I went to the library every day, got to know the regulars, and eventually even landed a part-time job there because I was always around.

The job was simple — cleaning up before the library closed. Thirteen yuan an hour, but it was easy, took about ten minutes, and let me stay a little longer in the library every day.

On top of that, the campus was locked down during the pandemic, so there wasn’t anywhere else to go anyway. I worked almost every single month.

I even interviewed for a librarian position later on.

But my family’s business was busy at the time, and they thought the pay was too low. They couldn’t understand why I’d spend time on something like that, so they talked me out of it. I never explained the real reason to the teacher who interviewed me. Looking back, I still feel a bit bad about it — the teacher probably thought I’d just flaked after passing the interview.

Now, when I look back, life was really simple back then.

Every day, I went to the library. I had a fixed spot, familiar faces, books to read, online courses to study, and my own things to work on. Around 9<30> PM, I’d finish cleaning the library and go out for a five-kilometer run.

The feeling after those runs was incredible. My body was tired, but my mind felt amazing.

Now, if someone told me to run five kilometers at 9<30> PM, I’d first think about what time I’d finish work, then whether I had anything else to do at home, then probably end up sitting on my bed scrolling through my phone, telling myself I’ll run tomorrow.

Your environment really changes you.

I used to think discipline was mostly about willpower. Now I’m increasingly convinced that environment plays a much bigger role.

There’s a saying: “Heaven’s timing, earthly advantage, human harmony.” I used to understand it superficially, but now I believe “earthly advantage” is exactly that — your environment. When you’re in a good environment, human effort becomes exponentially more effective. The environment itself helps you form habits.

When the environment isn’t right, you need to expend much more “human harmony” just to push against the current.

I didn’t truly understand this until after graduation.

In the first six months after graduating, I tried to maintain the lifestyle I had in university. I thought, if I could run, study, and read every day back then, surely I could do the same while working.

But reality hit hard. Work drained most of my energy, and overtime was not uncommon. By the time I got home, there was hardly any time left that truly belonged to me. So to reclaim some of that time, I started staying up late.

At first, it was just a little later. Slowly, it became later and later.

The most ironic part? I used to think “going to bed early” was the most natural thing in the world. Then I realized I’d lost even that most basic form of discipline.

I even forced myself to keep exercising during those first six months. But then my chest started hurting — a pain that lasted for months before gradually fading. I had no idea what was wrong at the time. Looking back, I think I was experiencing a kind of inner burnout — maybe even a somatic manifestation of emotional and psychological stress.

The old me would have just said I wasn’t trying hard enough.

Now I can’t help but wonder: maybe it wasn’t about persistence. Maybe the environment itself was constantly draining me.

In university, finishing my cleaning at 9<30> PM and going for a five-kilometer run felt amazing.

After graduation, the same routine felt like a chore I had to grit my teeth through.

These two versions of “discipline” looked the same on the surface, but they were completely different states of being.

Now, sitting at a desk all day, I exercise less, my weight has crept up, and my digestion has gotten worse.

But here’s the funny thing: when I go home for a long holiday, eating and drinking without a care, doing nothing productive — theoretically less healthy — I actually lose a bit of weight and my stomach feels better.

This has made me realize that our bodies and minds are more honest than we give them credit for.

They know whether you’re tired or comfortable long before your brain does.

So now, looking back at my university self, I feel a mix of emotions.

I envy that version of me.

He could go to the library every day, immerse himself in books, watch online courses, run, and slowly build good habits.

But I also know that version of me had his own pressures.

I wasn’t exactly carefree when I woke up each morning back then. It’s just that, years later, the daily stress has faded, and what’s left are the beautiful memories.

Maybe that’s why we always put a filter on the past.

I still go to the library occasionally.

But one thing has changed noticeably: I can’t stay focused as long as I used to.

Back then, I could sit for hours — reading slowly, learning at my own pace.

Now, after a short while, my mind starts wandering to my phone, to other things, to work.

It’s in moments like these that I realize how much more those university years left me than I ever knew at the time.

I watched countless courses and read many books back then — etiquette, public speaking, communication, and a lot of professional knowledge.

At the time, I thought I was just “learning.”

But after graduation, I discovered that some of those things have been quietly shaping me ever since.

My professional knowledge, in particular, continues to benefit me to this day.

Sometimes I suddenly notice that the way I handle a situation, communicate with someone, or choose my words — it all traces back to those seemingly useless accumulations from university.

I used to think of them as “techniques.”

How to learn, how to express yourself, how to manage time, how to improve yourself — all techniques.

But now I feel that the things that truly stay with you don’t announce themselves.

The ideas that have genuinely become part of you don’t remind you every day, “I am now practicing this principle.”

They’ve become part of who you are.

What society and the workplace have taught me is different.

If university taught me how to enrich myself, accumulate knowledge, and build foundational habits, then entering society taught me about boundaries.

Back in school, relationships were simple.

You went to class together, ate together, went to the library together — sometimes you spent most of your day in the same circle.

After entering society, I realized that people need boundaries.

What to say, what not to say. What to help with, what not to take on. How to separate work and life. The difference between others’ expectations of you and your own responsibilities.

These aren’t things you can learn directly from a university textbook.

But society will teach you — fast.

It’s just that society’s lessons are rarely as gentle as the library’s.

Three years after graduation, I’ve noticed myself being gradually assimilated by my environment.

Sometimes, reflecting on how I handle things, I even catch traces of behaviors I used to criticize as “bureaucratic” or “phony.”

That’s actually quite interesting.

I used to stand on the sidelines and judge others — “How can this person be like this?”

Then one day, I realized I was starting to act the same way.

That’s just how it is.

You think you’re observing your environment, but your environment is also observing you — slowly, piece by piece, turning you into part of it.

So now I find myself agreeing more and more with the importance of environment.

Of course, you can’t blame everything on your environment.

A bad environment doesn’t mean you have to go with the flow.

But if an environment is slowly making you less like yourself, it’s worth asking: is it really you who’s the problem, or is the environment simply not right for you?

Sometimes we feel we’re not disciplined enough, not hardworking enough, not ambitious enough, and we keep piling on expectations.

But maybe what we really need to do isn’t just push ourselves harder — it’s to change our environment.

Because in a good environment, your efforts multiply. In a bad one, you’re spending all your willpower just fighting the current.

In the end, it comes back to you.

We want too much and do too little.

And more often than not, what we think we want isn’t really what we want.

It’s what society told you to want. What your parents told you. What your relatives and friends expected.

How much money you should make, what position you should reach, how you should live, when you should get married, how excellent you should become.

With all these “shoulds” piling up, it’s easy to forget the simplest question:

What do I actually want?

Three years after graduation, I haven’t found the answer.

In fact, I feel like I’ve only just started learning to ask the question.

I hope that from now on, in my actions and my dealings with others, I can have fewer “what others think I should do” and more “what I truly want to do.”

The pure “me” might not be someone completely free from environmental influence. Rather, it’s someone who, even after being shaped by the environment, can still tell the difference:

What I truly want.

What others want me to have.

What’s worth holding onto.

What I can let go of.

What those three years in university taught me is still shaping me today.

Three years after graduation, I think what I want to learn is no longer more “techniques.”

It’s to slowly hold onto what truly matters, and find an environment that fits.

And then — become the person I truly want to be.

Random Thoughts: Three Years After Graduation

Wed, 19 Aug 2026 00:00:00 GMT

Random Thoughts: Three Years After Graduation#

A sudden urge to write — to capture how I feel right now, and how my mindset has shifted over the three years since graduation. It seems we always look at our past environment through a filter. In university, I compared it to vocational school. Fresh out of college, I compared it to campus life. After switching companies, I compared the new one to the old. The good parts of a new environment never quite hit as hard, while the bad parts of the old one get romanticized — because I no longer have to deal with them. And the drawbacks of the present? They loom larger, sharpened by direct contrast.

From being a fresh graduate intern to someone who now mentors interns, I’ve noticed myself gradually being assimilated by my surroundings. Sometimes I catch a certain “bureaucratic” tone in how I handle things, and it forces me to recognize just how much environment shapes a person. The saying “Heaven’s timing, earthly advantage, human harmony” — I’ve come to believe that “earthly advantage” is exactly this: the environment. When the environment is right, human effort becomes exponentially more effective. But when the environment can’t be changed, you need a tenfold dose of “human harmony” just to push against the current.

I often find myself nostalgic for the discipline I had in university — how I admired that version of myself. But I also remember the weight I woke up with every single day back then. The details may blur, but the feeling is etched into my bones. Right after graduation, when my salary was low, I still held onto that discipline. But as work stabilized, as life got comfortable and the pay improved, my discipline crumbled like a dam bursting open. Success, I think, is sometimes just about holding on a little longer than others. I read a lot in college, picked up many good habits and techniques — yet none of them seem to have stuck. Then again, the ideas that truly become part of you, flowing in your blood, you don’t even notice them anymore.

We want too much and do too little. We let ourselves be pushed around by society’s standards, parents’ expectations, the yardsticks of relatives and friends. I hope that from now on — in my actions and my dealings with others — I can be a pure person, standing and speaking from the standard of a genuine “me.”

Docker Pull Stuck on Windows: A Proxy Configuration Horror Story

Sun, 02 Aug 2026 00:00:00 GMT

Docker Pull Stuck on Windows: A Proxy Configuration Horror Story#

Pulling a single image (snowdreamtech/frpc) ate my whole afternoon today. docker pull would either sit at Waiting and never move, or die with a dial tcp ... timeout. My first instinct was “bad network, retry,” but after the third attempt with no progress I started to suspect something more interesting was going on.

Trap 1: TUN mode doesn’t touch Docker Desktop#

I run sing-box on Windows with TUN mode on, and browsing was perfectly fine, so I assumed my proxy covered everything. Nope. TUN mode intercepts traffic on the host’s network stack, but the Docker daemon runs inside the WSL2 VM — and the VM’s outbound traffic never goes through the host’s TUN interface. A working browser proves nothing about Docker. The daemon needs its own proxy configuration.

Trap 2: The real config file is settings-store.json#

The old tutorials all tell you to edit settings.json, but modern Docker Desktop reads %APPDATA%\Docker\settings-store.json. I had to add three keys:

1
"ProxyHTTPMode": "manual",
2
"OverrideProxyHTTP": "http://127.0.0.1:49456",
3
"OverrideProxyHTTPS": "http://127.0.0.1:49456"

One thing that caught me: restarting containers isn’t enough. You need docker desktop restart for the new settings to actually apply. Also, Docker Desktop has two proxy layers — an app proxy and a containers proxy — and docker pull goes through the containers one. Configure the wrong layer and nothing happens.

Trap 3: Which port is an actual proxy?#

Before configuring anything you need to know which local port is a real proxy. sing-box and v2rayN listen on a bunch of ports, and not all of them are meant for proxying. I first tried port 10814, and still got 405s everywhere.

The test is dead simple: open a raw TCP connection and send a CONNECT request:

Terminal window

1
printf 'CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\n\r\n' | nc 127.0.0.1 49456

A real proxy answers 200 Connection established — in my case that was xray’s port 49456. Port 10814 turned out to be a local HTTP service that replies to CONNECT with 405 Method Not Allowed and an Allow: GET header. It was never a proxy. Don’t assume a listening port is a proxy port.

Trap 4: Dead mirror registries are still in daemon.json#

With the proxy working it was still slow, which made me look at ~/.docker/daemon.json and its registry-mirrors entry. Two of my three mirrors (USTC and 163) had quietly died — connections time out — and docker pull was hanging on those timeouts. One of the survivors (daocloud) even answers requests carrying a ?ns=docker.io parameter with 405 Method Not Allowed. In the end I deleted registry-mirrors entirely and went straight to Docker Hub through the proxy. Fastest and most reliable.

Bonus trap: host.docker.internal resolved to IPv6#

Finally got the image, only to see frpc containers fail to reach the backend, with frps logging 503s. The culprit: inside the container host.docker.internal resolved to an IPv6 address in the fdc4:... range, and IPv6 routing in the container network simply doesn’t work — the packets went nowhere. Switching to the host’s actual IPv4 address, or the Docker Desktop VM gateway (192.168.65.254), fixed it instantly.

If I had to boil this afternoon down to two lessons: TUN mode can’t see inside the WSL2 VM, so configure a proxy for Docker itself; and when you’re unsure whether a port is a proxy, send it a CONNECT and read the response.

Running frpc in Docker on Windows: Every Pitfall I Hit

Sun, 02 Aug 2026 00:00:00 GMT

Running frpc in Docker on Windows: Every Pitfall I Hit#

In my last post I documented the ordeal of pulling images with Docker Desktop on Windows. This one is a direct sequel: once the images finally came down, I had to actually get frp working — and the tunnel itself turned out to be its own little minefield.

The setup: a local Windows machine running a RuoYi admin system (Vue dev server on port 80) that I wanted to expose to the public internet via frp. The frps server ran in a Docker container on a Tencent Cloud VPS, and frpc ran locally in another Docker container. Sounds straightforward. It cost me most of an afternoon.

Pitfall 1: Proxies are defined on the frpc side, not the frps side#

Like most people (including me at first), I assumed that opening a new tunnel meant editing the frps config and restarting its container. Wrong. In frp’s architecture, all proxies are defined on the frpc client. frps just receives and forwards traffic, and by default it accepts any port unless you’ve configured an allowPorts whitelist. Adding a new tunnel is now just a config edit plus a reload on the client; the server stays untouched.

It’s genuinely counterintuitive — the server looks like the side that should control ports, but the client holds all the power.

Pitfall 2: The frpc config path is hardcoded#

The snowdreamtech/frpc image hardcodes its startup script to read /etc/frp/frpc.toml. My first attempt mounted my config somewhere arbitrary, and the container immediately complained it couldn’t find the file. You have to mount to that exact path:

Terminal window

1
docker run -d --name frpc --restart unless-stopped -v C:\frp\frpc.toml:/etc/frp/frpc.toml snowdreamtech/frpc:0.70.1-debian

Pitfall 3: host.docker.internal resolved to IPv6 inside the container#

I initially set localIP to host.docker.internal — the usual way for a container to reach its host. The frps side kept reporting 503/403, backend unreachable.

The culprit was IPv6: inside the container, host.docker.internal resolved to an address in the fdc4:... range, and IPv6 routing in the container network simply doesn’t work, so the packets were silently dropped. The fix is to just hardcode an IPv4 address:

1
[[proxies]]
2
name = "win-ruoyi"
3
type = "tcp"
4
localIP = "192.168.65.254"
5
localPort = 80
6
remotePort = 6100

192.168.65.254 is the Docker Desktop VM gateway — containers can reach the host through it. Your host’s actual LAN IP works too.

Pitfall 4: Docker Desktop’s HTTP proxy hijacked traffic to the host’s port 80#

Remember the manual proxy I configured for Docker Desktop in the previous post (to pull images)? It came back to bite me. Containers hitting the host’s port 80 were being intercepted by Docker Desktop’s transparent HTTP proxy — responses came back with a Proxy-Connection header and a 503/403, the error text even containing Windows-flavored connectex wording. Port 9000 (non-standard) worked fine.

To detect it: exec into the container, curl the host on port 80, and check the response headers. If you see Proxy-Connection, the proxy layer is intercepting. The fix is annoyingly simple — once your images are pulled, clear the Docker Desktop proxy config (remove OverrideProxyHTTP / OverrideProxyHTTPS / ProxyHTTPMode from %APPDATA%\Docker\settings-store.json) and container traffic goes straight to the host again. This one was the sneakiest and took the longest to pin down.

Pitfall 5: The cloud firewall needs its own port opened#

At this point the whole chain was working locally: frps logs showed get a user connection, and curling from the VPS itself returned 200. But from the public internet it was still a timeout. The last culprit was the Tencent Cloud lightweight-server console firewall — port 6100 simply wasn’t allowed in. One inbound rule later, done.

Lesson: the tunnel crosses three firewall layers — OS firewall (ufw/iptables), cloud security group, and frps itself. Any one of them can silently kill your connection, and all three look like “network problems” from the outside.

Wrap-up: debug the tunnel in three segments#

The biggest takeaway was a debugging method: split the frp tunnel into three segments — public internet → frps, frps → frpc, frpc → local service. Each segment has its own symptoms: timeouts point to network/firewall issues, 403 is frp’s internal error page, 503 means frpc can’t reach the backend. Map the symptom to a segment and you’ll find the problem much faster. Three of my five pitfalls lived in the last segment (frpc → local service) — the easiest one to overlook.

Battling Google Search Console with OpenCode: Taking Over a Real Chrome Browser

Wed, 29 Jul 2026 00:00:00 GMT

The Backstory#

I had just set up two new blogs (one Chinese, one English) and needed to add them to Google Search Console, then invite a service account as a user. One “Add User” dialog. A couple of clicks. Simple enough.

Let OpenCode automate it, I thought.

The built-in browser-control MCP (backed by playwright-core) fired up a headless browser, navigated to Search Console, and — captcha. Switched to Puppeteer. Still captcha. Tried Playwright’s stealth plugin. Same thing.

After half an hour of banging my head against automation detection, it dawned on me: My real Chrome was already logged into Google right there on my desktop. Why was I trying to open a new one?

The Solution: stealth-chrome MCP#

The idea is embarrassingly simple once you say it out loud: don’t spin up a new browser, take over the one that’s already running.

Chrome DevTools Protocol (CDP) exists exactly for this. Your login sessions, cookies, extensions — all of them are already there, no setup needed.

I wrote a ~50-line MCP server using chrome-launcher, wrapped the CDP connection, and registered it in OpenCode’s MCP config:

~/.config/opencode/opencode.jsonc

1
{
2
  "mcp": {
3
    "stealth-chrome": {
4
      "type": "local",
5
      "command": [
6
        "node",
7
        "/path/to/stealth-mcp-server.mjs"
8
      ],
9
      "enabled": true,
10
      "description": "Real Chrome takeover, persistent session"
11
    }
12
  }
13
}

Then I removed the old browser-control entry entirely.

First connection: Search Console opened already logged in. Zero captchas. Zero friction. It just worked — like I was clicking around myself.

War Stories#

Of course it wasn’t all smooth sailing. Here are five real gotchas I hit.

1. Click That Wouldn’t Click#

The “Add User” button in Search Console — clicking it with stealth-chrome_click navigated to a completely unrelated page every single time. I retried four times before giving up.

Switched to stealth-chrome_evaluate and called element.click() from JavaScript. The dialog popped right open.

Lesson: SPA event handlers don’t always respond to synthesized CDP clicks. When click fails, evaluate + native element.click() is your fallback.

2. Ref IDs Are Ephemeral#

Every time you snapshot a page, elements get fresh ref IDs (e42, e106, etc.). Navigate away and back? Different refs.

First time I hit this I thought I was losing my mind.

Lesson: Don’t hardcode refs across page transitions. Use JS selectors for anything that spans multiple interactions.

3. You Picked the Wrong Dialog#

Search Console has two [role="dialog"] elements on the same page — one for the sidebar nav, one for the actual modal dialog. document.querySelector('[role="dialog"]') consistently grabbed the sidebar.

Lesson: Use document.querySelectorAll(...) and grab the last one.

4. Input Value Set, SPA Didn’t Care#

I set input.value = 'service-account@...' and clicked “Add”. It told me the email was invalid. The value was clearly there in the DOM.

SPA frameworks listen for input events, not property changes. Setting .value silently doesn’t fire anything.

The fix:

1
input.value = 'blog-seo@xxx.iam.gserviceaccount.com';
2
input.dispatchEvent(new Event('input', { bubbles: true }));
3
input.dispatchEvent(new Event('change', { bubbles: true }));

5. Link or Button? Guess.#

In Search Console’s settings page, “Users and Permissions” looks like something you click to expand a section. Turns out it’s an honest-to-god <a href="..."> link that navigates to a different page entirely.

Lesson: Inspect a.href before you click. Not everything in a SPA is SPA-routed.

Tools I Actually Used#

Tool	What For
`stealth-chrome_navigate`	Go to Search Console
`stealth-chrome_snapshot`	See what’s clickable
`stealth-chrome_click`	Simple buttons
`stealth-chrome_evaluate`	Workhorse — JS for everything tricky
`stealth-chrome_screenshot`	Verify state visually

When to Use This#

Any site that needs you to be logged in — Search Console, Cloudflare Dashboard, Gmail, you name it. Stealth-chrome handles it because it is your browser. Just keep Chrome running.

TL;DR#

Don’t fight browser automation detection. Use the browser you’re already logged into.

Set it up once, leave the MCP server running, and never think about headless Chrome again. Just don’t close your browser.

2025 Year in Review

Thu, 23 Jul 2026 00:00:00 GMT

2025 Year in Review#

Memory is like a glass of water, time like an open faucet — the water in the glass grows fainter with each passing day. Before I knew it, it was the end of 2025 again. I’d planned a mid-year review back in 2024, but procrastination got the better of me. Life settled into a comfort zone — work consumed most of my days under fluorescent office lights, blurring the line between day and night. What little free time I had, I wanted to spend outdoors with friends. Today is the fourth day of my sick leave from the flu, and I hope to capture some memorable and meaningful moments before the clarity that illness brings is washed away by the joy of recovery.

Work#

Work this year was steady — methodical, rigorous, improving technically, and striving for excellence. Compared to last year, the biggest change has been how AI tools have transformed coding. With major improvements in context awareness, agent capabilities, and automated search, the hottest trend right now is vibe coding — completing coding, debugging, and testing entirely through natural language conversations. This has freed up a lot of mental bandwidth, letting AI handle repetitive, predictable tasks perfectly. On the backend, complex logic still needs careful checking, but on the frontend, simply articulating your ideas clearly can often yield perfect results from AI in one pass.

While AI has dramatically boosted productivity, new tools always bring disruption. AI has leveled the playing field for experience to a large extent, without creating many new job opportunities. As an ordinary person riding this wave, the best approach is probably to embrace change as much as possible and build a financial cushion for the uncertainties ahead.

Learning#

This year’s learning was decent — I passed four exams in my self-study program. Not that I expect these credentials to be particularly useful, but they give me tangible milestones on my lifelong learning journey. Through exam preparation, I systematically revisited modern Chinese history and Marxist principles. While I only scratched the surface, I gained a lot. Marxist philosophy taught me to look at problems from a more abstract, higher-dimensional perspective, and modern Chinese history gave me a fresh understanding of the timeline and the role of key conferences.

I also learned about personal finance and savings, and my savings goals for the year are on track. My investments had ups and downs, but overall I’m in the green — though unrealized gains are just paper profits.

On learning methods: for unfamiliar domains, I now start with videos and beginner-friendly articles, saving books for in-depth reference and gap-filling. I try to apply the principle of negation of negation when encountering differing viewpoints.

Health#

Exercise this year was a mess — otherwise I wouldn’t have caught colds repeatedly within a month. After getting two impacted wisdom teeth pulled during summer break, I completely gave up on working out. My annual checkup showed various minor abnormalities — partly from poor diet, partly from staying up late. Living alone gives too much freedom, and the combination of constant air conditioning, lack of outdoor activity, and late-night doom-scrolling took its toll.

Improving my fitness will be a core priority for 2026: regular作息, creating a calorie deficit to lose weight, and disciplining my diet and exercise.

Books#

Money Money Money (Kira and the Kurrawong Club)#

When you set a big goal, you must put in much more effort than others.

A children’s book, but an excellent introduction for anyone completely new to personal finance. Following the methods in this book, I completed my savings plan two months ahead of schedule.

You Are What You Eat 2#

Don’t be extreme in your diet — eat a diverse mix of everything.

This book reinforced my belief that matter determines consciousness and consciousness acts on matter. I’ve been gaining weight since starting work, mainly because of prolonged sitting, slow metabolism, and the habit of treating myself after work. Lack of sunlight in the office leads to vitamin D deficiency and a weakened immune system.

MongoDB: Advanced Practices#

MongoDB’s indexing, storage engine, concurrency (MVCC), locking mechanism, and oplog design share many principles with MySQL.

You never miss knowledge until you need it. Taking time to fill gaps in my understanding made working with related documentation much smoother.

Zen and the Art of Motorcycle Maintenance#

When you’re in a hurry to get something done, it means you no longer care about it and want to do something else.

The book is about a motorcycle road trip and repairs, but the philosophy applies to all technical work. A deeply insightful read.

A Short History of Chinese Philosophy#

One must first speak many words, then remain silent.

I picked this up when I had ideological conflicts with my parents, hoping to understand why they think the way they do. Many of their ideas are deeply ingrained in their upbringing, and this book helped me connect the dots.

Games#

Aokana: Four Rhythm Across the Blue: Top-tier story and music across the board. All four heroines are exceptionally well-written. Appreciating art like this is a genuine pleasure.

Honor of Kings: I play a couple of matches every month or two as a lunch-break pastime. Ranking up too high brings out the try-hard mentality.

Delta Force: Hawk Ops: About 90 hours played. A great way to decompress on days off. No pay-to-win pressure, and bot matches make it easy to pick up.

At the end of the day, gaming is best when shared with friends.

Anime#

I watched quite a lot this year. I realized I don’t dislike anime — I’m just not into most new seasonal shows. Most of what I watched were older series.

Yamada-kun and the Seven Witches
The Rising of the Shield Hero
The Magical Revolution of the Reincarnated Princess and the Genius Young Lady
Classroom of the Elite Season 3
A Mortal’s Journey to Immortality
Shrouding the Heavens
Wandering Witch: The Journey of Elaina
The Eminence in Shadow
My Teen Romantic Comedy SNAFU (rewatch)
Knight’s & Magic (rewatch)
That Time I Got Reincarnated as a Slime
Onimai: I’m Now Your Sister! (rewatch)
Uncle from Another World
Puella Magi Madoka Magica series

Movies#

Detective Conan: Crossroad in the Ancient Capital
Nezha: The Devil’s Child Stirs Up the Sea
Malignant
Detective Conan: The Afterimage of a Single Eye
Final Destination: Bloodlines
Dream Cure
Operation蛟龙
Demon Slayer: Infinity Castle
Zootopia 2
Scent of a Woman
Detective Chinatown 1900
Under the Haze (play at Luojia Mountain Theater)
Happy Dinner (play at Hubei Theater)

Travel#

The more you go out, the more you suffer along the way — but the novelty you encounter on the road is something you’ll never experience close to home.

Mount Lu, Jiangxi: I went during the off-season when it was free. The sun was warm at the foot of the mountain, but the summit was covered in snow. The ice on the steps forced us to walk on tiptoe. Unfortunately, the trip was rushed — after climbing the Five Old Men Peak, we were too exhausted to reach the Three Fold Spring.

Changsha, Hunan: I took an overnight green-train after work. The smell of feet and smoke on the train is still unforgettable. My second visit to Changsha opened a whole new door — I experienced what nightlife really means: 24-hour hotpot restaurants, 24-hour Mixue ice cream shops. This time I made it to the top of Yuelu Mountain, which I’d missed before. The mountain breeze and the panoramic view of downtown Changsha were unmatched.

Tiantangzhai (Heavenly Village), Anhui: I went during National Day. On the way up, the road disappeared into thick clouds with terrible visibility and rain. Then, after passing through a tunnel, the sky suddenly cleared. The walkways were built along cliff faces, swaying with the crowds — quite scary. The air at the summit was the freshest I’ve ever breathed. The cable car ride down was a bit too thrilling for someone who’d just read about cable car mechanics two days earlier.

Request Wildcard SSL Certificates with acme.sh

Thu, 23 Jul 2026 00:00:00 GMT

Request Wildcard SSL Certificates with acme.sh#

Let’s Encrypt provides free wildcard certificates. Combined with the acme.sh script, you can fully automate issuance and renewal — perfect for personal sites.

Install acme.sh#

Terminal window

1
curl https://get.acme.sh | sh -s email=my@example.com

Issue a Certificate (Cloudflare DNS API)#

1. Get Your Cloudflare API Key#

2. Configure the API Key#

Terminal window

1
export CF_Key="your-cloudflare-api-key"
2
export CF_Email="your-cloudflare-email"

3. Issue the Wildcard Certificate#

Terminal window

1
# Replace with your domain
2
./acme.sh --issue --dns dns_cf -d example.com -d *.example.com

4. Verification#

The certificate will be installed to ~/.acme.sh/. Check the auto-renewal cron job:

Terminal window

1
crontab -l

acme.sh automatically adds a scheduled task for renewal before expiration.

Working with Nginx Proxy Manager#

Copy the generated certificate files to NPM’s directory, or upload them manually through NPM’s web interface.

Notes#

Alibaba Cloud DNS, Tencent Cloud DNS, etc., also have their own DNS API scripts available in the acme.sh official repository
Wildcard certificates only support DNS verification, not HTTP
Certificates are valid for 90 days; acme.sh handles renewal automatically

References#

Docker Image and Container Export/Import Commands Explained

Thu, 23 Jul 2026 00:00:00 GMT

Docker Image and Container Export/Import Commands Explained#

Docker provides several commands for exporting and importing images and containers, which can be confusing for beginners. This article breaks down the key differences.

docker export / docker import#

These operate on containers and export a snapshot of the container’s current filesystem.

Terminal window

1
# Export container snapshot
2
docker export container-id > snapshot.tar
3

4
# Import as an image
5
docker import snapshot.tar new-image-name:tag

Characteristics:

Only retains filesystem changes made from container start to export — discards history layers and metadata
Smaller file size (single filesystem layer)
Must specify a new image name and tag on import
Imported images require /bin/bash or another entrypoint on start

Use case: Creating base images. For example, start a container from ubuntu, install software, then export it as a distributable base image.

docker commit#

Operates on containers, saving modifications as a new image.

Terminal window

1
docker commit container-id new-image-name:tag

Common options:

-a: Author information
-m: Commit message
-p: Pause the container during commit

Characteristics:

Preserves the container’s writable layer plus the original image’s history layers
An N-layer image becomes N+1 layers after commit
Retains metadata like the entrypoint command

Use case: Quickly save changes from a debugging environment to create a reusable image.

docker save / docker load#

Operate on images, exporting the complete layer structure.

Terminal window

1
# Save an image
2
docker save -o image.tar image-name:tag
3

4
# Load an image
5
docker load -i image.tar

Characteristics:

Preserves the full layer structure and metadata
Larger file size than export (includes all history layers)
load cannot rename the image, while import can assign a new name

Use case: Offline image migration. On a server without internet, pull the image on a connected machine, save it, copy the archive, then load it on the target server.

Comparison Summary#

Command	Target	History Layers	File Size	Rename on Import
`docker export`	Container	❌ Single layer only	Small	✅
`docker commit`	Container	✅ Adds one layer	Medium	✅
`docker save`	Image	✅ Full preservation	Large	❌
`docker load`	Image	✅ Full preservation	Large	❌
`docker import`	Snapshot file	❌ Single layer only	Small	✅

Quick memory aid: save/load work with images, export/import work with containers, and commit is the bridge from container → image.

Deploy a Nacos Cluster with Docker

Thu, 23 Jul 2026 00:00:00 GMT

Deploy a Nacos Cluster with Docker#

Pull the Image#

Terminal window

1
docker pull nacos/nacos-server:v2.2.0

Avoid pulling the latest tag — always pin a specific version for production.

Database Setup#

Nacos cluster requires MySQL to store configuration data. MySQL 5.7 is recommended.

Create a database named nacos_config and run the official initialization script (located in the Nacos source at distribution/conf/nacos-mysql.sql, which creates config_info, config_info_aggr, users, roles, and other core tables).

Create Nacos Containers#

Create three Nacos instances to form the cluster. Replace IP addresses in the commands below with your server’s IP.

Node 1 (Port 8848)#

Terminal window展开收起

1
docker run -d \
2
  -e PREFER_HOST_MODE=hostname \
3
  -e MODE=cluster \
4
  -e NACOS_APPLICATION_PORT=8848 \
5
  -e NACOS_SERVERS="your-server-ip:8848 your-server-ip:8858 your-server-ip:8868" \
6
  -e SPRING_DATASOURCE_PLATFORM=mysql \
7
  -e MYSQL_SERVICE_HOST=your-server-ip \
8
  -e MYSQL_SERVICE_PORT=3306 \
9
  -e MYSQL_SERVICE_USER=root \
10
  -e MYSQL_SERVICE_PASSWORD=your-password \
11
  -e MYSQL_SERVICE_DB_NAME=nacos_config \
12
  -e NACOS_SERVER_IP=your-server-ip \
13
  -p 8848:8848 -p 9848:9848 -p 9849:9849 \
14
  --name my-nacos1 \
15
  nacos/nacos-server:v2.2.0

展开收起

Node 2 (Port 8858)#

Terminal window展开收起

1
docker run -d \
2
  -e PREFER_HOST_MODE=hostname \
3
  -e MODE=cluster \
4
  -e NACOS_APPLICATION_PORT=8858 \
5
  -e NACOS_SERVERS="your-server-ip:8848 your-server-ip:8858 your-server-ip:8868" \
6
  -e SPRING_DATASOURCE_PLATFORM=mysql \
7
  -e MYSQL_SERVICE_HOST=your-server-ip \
8
  -e MYSQL_SERVICE_PORT=3306 \
9
  -e MYSQL_SERVICE_USER=root \
10
  -e MYSQL_SERVICE_PASSWORD=your-password \
11
  -e MYSQL_SERVICE_DB_NAME=nacos_config \
12
  -e NACOS_SERVER_IP=your-server-ip \
13
  -p 8858:8858 -p 9858:9858 -p 9859:9859 \
14
  --name my-nacos2 \
15
  nacos/nacos-server:v2.2.0

展开收起

Node 3 (Port 8868)#

Terminal window展开收起

1
docker run -d \
2
  -e PREFER_HOST_MODE=hostname \
3
  -e MODE=cluster \
4
  -e NACOS_APPLICATION_PORT=8868 \
5
  -e NACOS_SERVERS="your-server-ip:8848 your-server-ip:8858 your-server-ip:8868" \
6
  -e SPRING_DATASOURCE_PLATFORM=mysql \
7
  -e MYSQL_SERVICE_HOST=your-server-ip \
8
  -e MYSQL_SERVICE_PORT=3306 \
9
  -e MYSQL_SERVICE_USER=root \
10
  -e MYSQL_SERVICE_PASSWORD=your-password \
11
  -e MYSQL_SERVICE_DB_NAME=nacos_config \
12
  -e NACOS_SERVER_IP=your-server-ip \
13
  -p 8868:8868 -p 9868:9868 -p 9869:9869 \
14
  --name my-nacos3 \
15
  nacos/nacos-server:v2.2.0

展开收起

Verify the Cluster#

Visit http://ip:port/nacos on any node. The default credentials are nacos/nacos. You should see all three nodes listed in the Cluster Management page.

Nginx Load Balancing#

Configure the Upstream#

Create a custom configuration in your Nginx Proxy Manager installation directory:

/path/to/npm/data/nginx/custom/http.conf

1
upstream nacos {
2
    server your-server-ip:8848;
3
    server your-server-ip:8858;
4
    server your-server-ip:8868;
5
}

Configure the Reverse Proxy#

Add a proxy in NPM’s web interface:

1
Domain: nacos.your-domain.com
2
Forward Hostname: 127.0.0.1
3
Forward Port: 80

Then add this in the Advanced tab:

1
location / {
2
    proxy_pass http://nacos;
3
}

After configuring an SSL certificate, you can access the Nacos console at https://nacos.your-domain.com/nacos.

Note: When using Nginx Proxy Manager, create http.conf under the nginx/custom/ directory in the container mount. NPM will automatically include this file in the global configuration.

References#

Switch Java (JDK) Versions Freely with Scoop

Thu, 23 Jul 2026 00:00:00 GMT

Switch Java (JDK) Versions Freely with Scoop#

In daily development, you often need to switch between different JDK versions like Java 8, Java 11, Java 17, or Java 21. Manual uninstallation and cleanup of registry entries is painful. Scoop makes this effortless.

Install Scoop#

Open PowerShell and run:

Terminal window

1
# Allow local script execution
2
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
3

4
# Install Scoop
5
iwr -useb get.scoop.sh | iex
6

7
# Verify installation
8
scoop help

Install Multiple JDK Versions#

1. Add the Java Bucket#

Terminal window

1
scoop bucket add java

2. List Available JDK Versions#

Terminal window

1
scoop search jdk

3. Install Different Versions#

Terminal window

1
# Install OpenJDK 8
2
scoop install openjdk8-redhat
3

4
# Install OpenJDK 21
5
scoop install openjdk21

4. Switch JDK Versions#

Terminal window

1
# Switch to JDK 8
2
scoop reset openjdk8-redhat
3

4
# Switch to JDK 21
5
scoop reset openjdk21
6

7
# Switch to GraalVM 21
8
scoop reset graalvm21-jdk21

If you previously installed JDK manually, consider removing the system JAVA_HOME environment variable — Scoop manages user-level JAVA_HOME automatically.

How It Works#

scoop reset updates the user’s JAVA_HOME and PATH environment variables to point to the selected JDK directory. Changes take effect immediately in new terminal windows — no restart needed.

Similarly, Python, Ruby, Node.js, and other runtimes can be managed with Scoop for effortless version switching.

Server Initialization Guide

Thu, 23 Jul 2026 00:00:00 GMT

Server Initialization Guide#

1. System Update#

Terminal window

1
apt update
2
apt upgrade -y

2. Security Hardening#

Change the SSH Port#

Edit the SSH config file /etc/ssh/sshd_config and change the default port 22:

Terminal window

1
vim /etc/ssh/sshd_config
2
# Find #Port 22, change to Port your-port
3
# Save and restart the service
4
systemctl restart ssh

Create a Non-root User#

Terminal window

1
# Create a new user
2
adduser your-username
3

4
# Install sudo
5
apt install sudo
6

7
# Add the user to the sudo group
8
usermod -aG sudo your-username
9

10
# Or edit /etc/sudoers to add:
11
# your-username ALL=(ALL) NOPASSWD: ALL

Disable Root Remote Login#

Terminal window

1
# In /etc/ssh/sshd_config, set:
2
PermitRootLogin no

SSH Key Authentication + Disable Passwords#

Terminal window

1
# Generate a key pair locally, then copy the public key to the server
2
ssh-copy-id your-username@your-server-ip
3

4
# In /etc/ssh/sshd_config:
5
PasswordAuthentication no
6
PubkeyAuthentication yes
7

8
# Restart the service
9
sudo systemctl restart ssh

3. Install Common Software#

Docker#

Refer to the official Docker documentation for installation.

Nginx Proxy Manager#

Install NPM via Docker for a web UI to manage reverse proxies and SSL certificates.

SSL Certificates#

Use acme.sh + Cloudflare DNS API to issue wildcard certificates with auto-renewal.

Internal Network Tunneling (frp)#

Use frp for internal network tunneling. Newer versions use TOML configuration.

Alist#

Multi-storage mounting tool with one-click Docker deployment. See Alist documentation for details.

Firewall#

Remember to allow the new SSH port in the firewall
Use iptables to mitigate SYN and CC attacks
Only expose necessary ports (80, 443, SSH, etc.)

SpringBoot Email Sending with @Async Optimization

Thu, 23 Jul 2026 00:00:00 GMT

SpringBoot Email Sending with @Async Optimization#

Basic Configuration#

1. Add the Dependency#

1
<dependency>
2
    <groupId>org.springframework.boot</groupId>
3
    <artifactId>spring-boot-starter-mail</artifactId>
4
</dependency>

2. Configure Mail Properties#

1
spring:
2
  mail:
3
    username: your-email@example.com
4
    password: your-auth-code
5
    host: smtp.163.com

The password field requires an authorization code, not your email login password. For 163 mail, enable POP3/SMTP/IMAP in settings and generate an auth code.

3. Send a Simple Email#

1
@RestController
2
@RequiredArgsConstructor
3
public class EmailController {
4

5
    private final JavaMailSender javaMailSender;
6

7
    @GetMapping("/send-email")
8
    public String sendEmail(String email) {
9
        SimpleMailMessage message = new SimpleMailMessage();
10
        message.setFrom("your-name<your-email@example.com>");
11
        message.setTo(email);
12
        message.setSubject("Verification Code");
13
        message.setText("Your code is: 123456");
14
        javaMailSender.send(message);
15
        return "ok";
16
    }
17
}

展开收起

Async Sending with @Async#

Synchronous email sending blocks the request thread. For high-concurrency scenarios, async is recommended.

1. Enable Async Support#

1
@SpringBootApplication
2
@EnableAsync
3
public class Application {
4
    public static void main(String[] args) {
5
        SpringApplication.run(Application.class, args);
6
    }
7
}

2. Async Email Service#

1
@Component
2
@Slf4j
3
public class EmailService {
4

5
    @Autowired
6
    private JavaMailSender javaMailSender;
7

8
    @Autowired
9
    private StringRedisTemplate stringRedisTemplate;
10

11
    @Async
12
    public void sendVerificationCode(String email) {
13
        String code = UUID.randomUUID().toString().substring(0, 6);
14
        SimpleMailMessage message = new SimpleMailMessage();
15
        message.setFrom("your-name<your-email@example.com>");
16
        message.setTo(email);
17
        message.setSubject("Verification Code");
18
        message.setText(code);
19

20
        stringRedisTemplate.boundValueOps("code:" + email)
21
            .set(code, 5, TimeUnit.MINUTES);
22
        javaMailSender.send(message);
23
        log.info("Verification code sent to: {}", email);
24
    }
25
}

展开收起

3. Custom Thread Pool#

The default async thread pool has a core pool size of 8. Adjust it as needed:

1
spring:
2
  task:
3
    execution:
4
      pool:
5
        core-size: 50

Or via Java configuration:

1
@Bean
2
public ThreadPoolTaskExecutor threadPoolExecutor() {
3
    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
4
    executor.setCorePoolSize(20);
5
    executor.setMaxPoolSize(50);
6
    executor.setQueueCapacity(200);
7
    executor.setThreadNamePrefix("mail-executor-");
8
    executor.initialize();
9
    return executor;
10
}

Common @Async Pitfalls#

@Async won’t work in these cases:

The method is not public
Return type is not void or Future
The method is static
Spring cannot scan the class (missing @Component/@Service etc.)
Caller and callee are in the same class — Spring AOP proxies can’t intercept internal calls
Creating the object with new instead of dependency injection
Adding @Transactional directly on an @Async method — put @Transactional on the called method instead

Reference: https://blog.csdn.net/u011413452/article/details/124844941

Send SMS via Tencent Cloud API with Spring Boot

Thu, 23 Jul 2026 00:00:00 GMT

Send SMS via Tencent Cloud API with Spring Boot#

Step 1: Apply for SMS Service#

Open the Tencent Cloud console, apply for an SMS application, signature, and template.

Step 2: API Debugging#

You can quickly generate calling code on the Tencent Cloud API Explorer page.

Add the Dependency#

1
<dependency>
2
    <groupId>com.tencentcloudapi</groupId>
3
    <artifactId>tencentcloud-sdk-java</artifactId>
4
    <version>3.1.838</version>
5
</dependency>

Raw Calling Code#

1
public class SendSms {
2
    public static void main(String[] args) {
3
        try {
4
            Credential cred = new Credential("SecretId", "SecretKey");
5
            HttpProfile httpProfile = new HttpProfile();
6
            httpProfile.setEndpoint("sms.tencentcloudapi.com");
7

8
            ClientProfile clientProfile = new ClientProfile();
9
            clientProfile.setHttpProfile(httpProfile);
10

11
            SmsClient client = new SmsClient(cred, "ap-beijing", clientProfile);
12

13
            SendSmsRequest req = new SendSmsRequest();
14
            String[] phoneNumberSet1 = {"your-phone-number"};
15
            req.setPhoneNumberSet(phoneNumberSet1);
16
            req.setSmsSdkAppId("1400849908");
17
            req.setSignName("your-sign-name");
18
            req.setTemplateId("1907520");
19

20
            String[] templateParamSet1 = {"6666"};
21
            req.setTemplateParamSet(templateParamSet1);
22

23
            SendSmsResponse resp = client.SendSms(req);
24
            System.out.println(SendSmsResponse.toJsonString(resp));
25
        } catch (TencentCloudSDKException e) {
26
            System.out.println(e.toString());
27
        }
28
    }
29
}

展开收起

Example response:

1
{
2
  "SendStatusSet": [
3
    {
4
      "SerialNo": "3369:294906593316931104718082751",
5
      "PhoneNumber": "your-phone-number",
6
      "Fee": 1,
7
      "Code": "Ok",
8
      "Message": "send success",
9
      "IsoCode": "CN"
10
    }
11
  ],
12
  "RequestId": "69aceba9-a43d-434c-9021-e7320ef52d49"
13
}

Step 3: Wrap as a Spring Boot Utility#

1. Configuration Properties#

1
myapp:
2
  secretId: your-secret-id
3
  secretKey: your-secret-key
4
  smsSdkAppId: your-sdk-app-id
5
  signName: your-sign-name
6
  templateId: your-template-id

2. Configuration Binding Class#

1
@Component
2
@ConfigurationProperties(prefix = "myapp")
3
public class MyAppProperties {
4
    private String secretId;
5
    private String secretKey;
6
    private String smsSdkAppId;
7
    private String signName;
8
    private String templateId;
9

10
    // getters and setters
11
}

Note: Don’t make set methods static, or @ConfigurationProperties won’t inject values properly.

3. SMS Utility Class#

1
@Component
2
@Slf4j
3
public class SmsUtil {
4
    private static SmsClient client = null;
5

6
    @PostConstruct
7
    public void init() {
8
        client = createClient(
9
            MyAppProperties.getSecretId(),
10
            MyAppProperties.getSecretKey()
11
        );
12
    }
13

14
    public static void sendVerificationCode(String phone, String code) {
15
        SendSmsRequest req = new SendSmsRequest();
16
        req.setPhoneNumberSet(new String[]{phone});
17
        req.setSmsSdkAppId(MyAppProperties.getSmsSdkAppId());
18
        req.setSignName(MyAppProperties.getSignName());
19
        req.setTemplateId(MyAppProperties.getTemplateId());
20
        req.setTemplateParamSet(new String[]{code});
21

22
        try {
23
            SendSmsResponse resp = client.SendSms(req);
24
            log.info("SMS send result: {}", SendSmsResponse.toJsonString(resp));
25
        } catch (TencentCloudSDKException e) {
26
            log.error("Failed to send SMS", e);
27
            throw new RuntimeException(e);
28
        }
29
    }
30

31
    private static SmsClient createClient(String secretId, String secretKey) {
32
        Credential cred = new Credential(secretId, secretKey);
33
        HttpProfile httpProfile = new HttpProfile();
34
        httpProfile.setEndpoint("sms.tencentcloudapi.com");
35
        ClientProfile clientProfile = new ClientProfile();
36
        clientProfile.setHttpProfile(httpProfile);
37
        return new SmsClient(cred, "ap-beijing", clientProfile);
38
    }
39
}

展开收起

4. API Endpoint#

1
@RestController
2
public class SmsController {
3
    @GetMapping("/sms")
4
    public String sendSms() {
5
        SmsUtil.sendVerificationCode("your-phone", "1234");
6
        return "ok";
7
    }
8
}

Summary#

The evolution: API debugging (raw SDK) → externalized configuration (ConfigurationProperties) → static utility class (@PostConstruct initialization). In daily development, the wrapped utility class approach is recommended to avoid duplicating SDK calling logic across business code.

Deploying Mx Space + Shiro with Nginx Proxy Manager Reverse Proxy

Thu, 01 May 2025 00:00:00 GMT

Deploying Mx Space + Shiro with Nginx Proxy Manager Reverse Proxy#

Introduction#

Mix Space is a simple yet powerful personal blog system — fast, modern, and clean. You can use it to build your own personal space, record your life, and share knowledge.

Mix Space Official Docs

This tutorial uses Nginx Proxy Manager to reverse-proxy both frontend and backend.

Frontend domain: zinzin.top
Backend domain: mx.zinzin.top

Prerequisites#

You’ll need the following:

A server (Linux kernel version > 4.18, RAM > 1GiB; this tutorial uses Debian 11)
A domain name mapped to your server’s IP
Docker installed

Install Nginx Proxy Manager#

Create a docker-compose.yml file in any directory:

1
services:
2
  app:
3
    image: 'jc21/nginx-proxy-manager:latest'
4
    restart: unless-stopped
5
    ports:
6
      - '80:80'
7
      - '81:81'
8
      - '443:443'
9
    volumes:
10
      - ./data:/data
11
      - ./letsencrypt:/etc/letsencrypt

Save the file and start the service:

Terminal window

1
docker-compose up -d
2

3
# Or
4
docker compose up -d

If you’re a first-time user, refer to these guides:
- A recommended nginx management tool: Nginx Proxy Manager
- Official guide

Deploy the Backend#

Pull the configuration file:

Terminal window

1
cd && mkdir -p mx-space/core && cd $_
2

3
# Download docker-compose.yml
4
wget https://fastly.jsdelivr.net/gh/mx-space/core@master/docker-compose.yml

Edit the environment fields in docker-compose.yml:
- JWT_SECRET: A string of 16 to 32 characters used to encrypt user JWTs.
- ALLOWED_ORIGINS: Usually the frontend domain; separate multiple domains with commas.
- ENCRYPT_ENABLE: Change false to true if encryption is needed, and fill in the encryption key.
- ENCRYPT_KEY: Must be 64 characters long.

Here’s an example configuration — set the JWT secret and allowed domains according to your own setup:

1
services:
2
  app:
3
    container_name: mx-server
4
    image: innei/mx-server:latest
5
    environment:
6
      - TZ=Asia/Shanghai
7
      - NODE_ENV=production
8
      - DB_HOST=mongo
9
      - REDIS_HOST=redis
10
      - ALLOWED_ORIGINS=zinzin.top
11
      - JWT_SECRET=Yy14003252791400325279
12
    volumes:
13
      - ./data/mx-space:/root/.mx-space
14
    ports:
15
      - '2333:2333'
16
    depends_on:
17
      - mongo
18
      - redis
19
    networks:
20
      - mx-space
21
    restart: unless-stopped
22
    healthcheck:
23
      test: ['CMD', 'curl', '-f', 'http://127.0.0.1:2333/api/v2/ping']
24
      interval: 1m30s
25
      timeout: 30s
26
      retries: 5
27
      start_period: 30s
28

29
  mongo:
30
    container_name: mongo
31
    image: mongo
32
    volumes:
33
      - ./data/db:/data/db
34
    networks:
35
      - mx-space
36
    restart: unless-stopped
37

38
  redis:
39
    image: redis:alpine
40
    container_name: redis
41
    volumes:
42
      - ./data/redis:/data
43
    healthcheck:
44
      test: ['CMD-SHELL', 'redis-cli ping | grep PONG']
45
      start_period: 20s
46
      interval: 30s
47
      retries: 5
48
      timeout: 3s
49
    networks:
50
      - mx-space
51
    restart: unless-stopped
52

53
networks:
54
  mx-space:
55
    driver: bridge

展开收起

Start the backend service:

Terminal window

1
docker-compose up -d
2

3
# Or
4
docker compose up -d

Once done, you’ll see a screen like this:

core setup complete

Reverse Proxy the Mx Space Backend with Nginx Proxy Manager#

Open the Nginx Proxy Manager admin panel and follow these steps:

nginx step 1

nginx step 2

Note: On servers in mainland China, automatic certificate issuance may fail due to network issues. Try a few times, or upload a certificate manually.
After it succeeds, visit https://mx.zinzin.top/proxy/qaqdmin for initial setup:

initial backend setup page
The admin panel after successful deployment:

backend admin panel

Deploy the Shiro Frontend#

1. Configure the Theme#

In the admin panel, go to “Extras – Config & Cloud Functions” and fill in the following:

Name: shiro
Reference: theme
Data type: JSON
Data: See the JSON config below.

json

1
{
2
  "footer": {
3
    "otherInfo": {
4
      "date": "2020-{{now}}",
5
      "icp": {
6
        "text": "萌 ICP 备 20236136 号",
7
        "link": "https://icp.gov.moe/?keyword=20236136"
8
      }
9
    },
10
    "linkSections": [
11
      {
12
        "name": "About",
13
        "links": [
14
          {
15
            "name": "About this site",
16
            "href": "/about-site"
17
          },
18
          {
19
            "name": "About me",
20
            "href": "/about"
21
          },
22
          {
23
            "name": "About this project",
24
            "href": "https://github.com/innei/Shiro",
25
            "external": true
26
          }
27
        ]
28
      },
29
      {
30
        "name": "More",
31
        "links": [
32
          {
33
            "name": "Timeline",
34
            "href": "/timeline"
35
          },
36
          {
37
            "name": "Friends",
38
            "href": "/friends"
39
          },
40
          {
41
            "name": "Monitor",
42
            "href": "https://status.innei.in/status/main",
43
            "external": true
44
          }
45
        ]
46
      },
47
      {
48
        "name": "Contact",
49
        "links": [
50
          {
51
            "name": "Leave a message",
52
            "href": "/message"
53
          },
54
          {
55
            "name": "Send email",
56
            "href": "mailto:i@innei.ren",
57
            "external": true
58
          },
59
          {
60
            "name": "GitHub",
61
            "href": "https://github.com/innei",
62
            "external": true
63
          }
64
        ]
65
      }
66
    ]
67
  },
68
  "config": {
69
    "color": {
70
      "light": [
71
        "#33A6B8",
72
        "#FF6666",
73
        "#26A69A",
74
        "#fb7287",
75
        "#69a6cc",
76
        "#F11A7B",
77
        "#78C1F3",
78
        "#FF6666",
79
        "#7ACDF6"
80
      ],
81
      "dark": [
82
        "#F596AA",
83
        "#A0A7D4",
84
        "#ff7b7b",
85
        "#99D8CF",
86
        "#838BC6",
87
        "#FFE5AD",
88
        "#9BE8D8",
89
        "#A1CCD1",
90
        "#EAAEBA"
91
      ]
92
    },
93

94
    "bg": [
95
      "https://github.com/Innei/static/blob/master/images/F0q8mwwaIAEtird.jpeg?raw=true",
96
      "https://github.com/Innei/static/blob/master/images/IMG_2111.jpeg.webp.jpg?raw=true"
97
    ],
98
    "custom": {
99
      "css": [],
100
      "styles": [],
101
      "js": [],
102
      "scripts": []
103
    },
104
    "site": {
105
      "favicon": "/innei.svg",
106
      "faviconDark": "/innei-dark.svg"
107
    },
108
    "hero": {
109
      "title": {
110
        "template": [
111
          {
112
            "type": "h1",
113
            "text": "Hi, I'm ",
114
            "class": "font-light text-4xl"
115
          },
116
          {
117
            "type": "h1",
118
            "text": "Innei",
119
            "class": "font-medium mx-2 text-4xl"
120
          },
121
          {
122
            "type": "h1",
123
            "text": "👋。",
124
            "class": "font-light text-4xl"
125
          },
126
          {
127
            "type": "br"
128
          },
129
          {
130
            "type": "h1",
131
            "text": "A NodeJS Full Stack ",
132
            "class": "font-light text-4xl"
133
          },
134
          {
135
            "type": "code",
136
            "text": "<Developer />",
137
            "class": "font-medium mx-2 text-3xl rounded p-1 bg-gray-200 dark:bg-gray-800/0 hover:dark:bg-gray-800/100 bg-opacity-0 hover:bg-opacity-100 transition-background duration-200"
138
          },
139
          {
140
            "type": "span",
141
            "class": "inline-block w-[1px] h-8 -bottom-2 relative bg-gray-800/80 dark:bg-gray-200/80 opacity-0 group-hover:opacity-100 transition-opacity duration-200 group-hover:animation-blink"
142
          }
143
        ]
144
      },
145
      "description": "An independent developer coding with love."
146
    },
147
    "module": {
148
      "activity": {
149
        "enable": true,
150
        "endpoint": "/fn/ps/update"
151
      },
152
      "donate": {
153
        "enable": true,
154
        "link": "https://afdian.net/@Innei",
155
        "qrcode": [
156
          "https://cdn.jsdelivr.net/gh/Innei/img-bed@master/20191211132347.png",
157
          "https://cdn.innei.ren/bed/2023/0424213144.png"
158
        ]
159
      },
160
      "bilibili": {
161
        "liveId": 1434499
162
      }
163
    }
164
  }
165
}

展开收起

theme configuration

Tip: For detailed configuration, refer to the official docs: Config Options.

2. Deploy Shiro with Docker Compose#

Create and enter the shiro directory:
Terminal window
```
1
mkdir shiro
2
cd shiro
```

Download the required files:

Terminal window

1
wget https://raw.githubusercontent.com/Innei/Shiro/main/docker-compose.yml
2
wget https://raw.githubusercontent.com/Innei/Shiro/main/.env.template
3
mv .env.template .env

Update the backend URL in the .env file:
Terminal window
```
1
vim .env # Edit your ENV variables
```
set the backend URL in env

After saving, start the service:
Terminal window
```
1
docker compose up -d
2

3
# Or
4
docker-compose up -d
```
To update the image later:
Terminal window
```
1
docker compose pull
```

3. Reverse Proxy Shiro with Nginx Proxy Manager#

Shiro reverse proxy 1

Shiro reverse proxy 2

Follow the prompts to configure the reverse proxy. If all services run on the same machine, you can use internal IP addresses directly.

Access the Main Site#

Once everything is deployed, visit https://zinzin.top to see the main site:

main site

Done!!

If you run into other issues during deployment, check the community:

Community

Additional notes for mainland China servers

Notes#

If automatic certificate issuance keeps failing with network errors on a mainland China server, you can manually apply for a certificate from your domain registrar and upload it to Nginx Proxy Manager.

certificate upload