hehaiguang1123
a6f05ab2d5
- Phase 0: AGENTS.md cleanup (dedup quotes, renumber sections, merge qmd) - Phase 1: typed relations (manage-relations.py, graph-search.py, check-staleness.py, detect-conflicts.py) - Phase 2: frontmatter validator, weekly lint, knowledge promotion, git hooks - Fix .gitignore to track tools/ and .githooks/ - Fix git remote URL (remove plaintext token) - New wiki pages: 504 pages, 34 raw sources
406 lines
7.0 KiB
Markdown
406 lines
7.0 KiB
Markdown
---
|
||
created: 2026-03-29
|
||
tags:
|
||
- note
|
||
- journal
|
||
para: []
|
||
---
|
||
|
||
###
|
||
|
||
## Gitea 数据库选择sqlite3
|
||
|
||
/var/packages/gitea/var/data/gitea.db
|
||
|
||
<http://192.168.123.21:8418/>
|
||
|
||
sc-gitea
|
||
|
||
/volume3/gitea-share/gitea-repositories
|
||
|
||
用户名：giteahhg
|
||
|
||
usfjdmmmgitea1123
|
||
|
||
访问地址: <https://git.haiguang.xyz/>
|
||
|
||
登录用户: giteahhg
|
||
|
||
## MariaDB10 on port 3307数据库信息（未使用）
|
||
|
||
==========================================
|
||
Gitea Database Initialization
|
||
MariaDB10 on port 3307
|
||
==========================================
|
||
|
||
Database Configuration:
|
||
|
||
Database: gitea
|
||
|
||
Username: gitea
|
||
|
||
Password: gitea_secure_2026
|
||
|
||
Port: 3307
|
||
|
||
Socket: /run/mysqld/mysqld10.sock
|
||
|
||
⚠️ Please change the password before running!
|
||
|
||
Cancelled
|
||
|
||
## **全部搞定！HTTPS 证书已自动部署。**
|
||
|
||
现在你可以浏览器打开：
|
||
|
||
**[https://git.haiguang.xyz](https://git.haiguang.xyz/)**
|
||
|
||
完成 Gitea 初始化设置，注意：
|
||
|
||
- 数据库选 **SQLite**
|
||
- **ROOT_URL** 设为 `https://git.haiguang.xyz`
|
||
- 设好管理员账号密码
|
||
|
||
HTTPS 证书到期日 2026-06-26，certbot 已配好自动续期，
|
||
|
||
## FRP 内网穿透方案详解
|
||
|
||
架构图
|
||
|
||
Copy
|
||
|
||
你的电脑/手机
|
||
|
||
│
|
||
|
||
▼
|
||
|
||
互联网
|
||
|
||
│
|
||
|
||
▼
|
||
|
||
腾讯云VPS (公网IP) ← frps 服务端
|
||
|
||
:443 / :80 ← Nginx 反代
|
||
|
||
│
|
||
|
||
FRP隧道 ← 加密通道
|
||
|
||
│
|
||
|
||
▼
|
||
|
||
群晖NAS (内网) ← frpc 客户端
|
||
|
||
:3000 (Gitea)
|
||
|
||

|
||
|
||
一、腾讯云VPS端（服务端 frps）
|
||
|
||
1. 下载安装
|
||
bash
|
||
Copy
|
||
|
||
# 下载frp（以amd64为例）
|
||
|
||
wget <https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_linux_amd64.tar.gz>
|
||
|
||
tar -xzf frp_0.61.1_linux_amd64.tar.gz
|
||
|
||
cd frp_0.61.1_linux_amd64
|
||
|
||
# 只需要 frps 和 frps.toml
|
||
|
||
2. 配置 frps.toml
|
||
toml
|
||
Copy
|
||
bindPort = 7000 # FRP通信端口（客户端连接用）
|
||
auth.token = "你的强密码" # 认证令牌，客户端必须一致
|
||
|
||
# Dashboard（可选，方便看连接状态）
|
||
|
||
webServer.addr = "0.0.0.0"
|
||
|
||
webServer.port = 7500
|
||
|
||
webServer.user = "admin"
|
||
|
||
webServer.password = "你的dashboard密码"
|
||
|
||
3. 资源占用
|
||
|
||
- 内存：约 10-20MB
|
||
- 几乎可以忽略不计，对你的VPS没压力
|
||
4. systemd 服务（开机自启）
|
||
ini
|
||
Copy
|
||
|
||
# /etc/systemd/system/frps.service
|
||
|
||
[Unit]
|
||
|
||
Description=FRP Server
|
||
|
||
After=network.target
|
||
|
||
[Service]
|
||
|
||
ExecStart=/usr/local/bin/frps -c /etc/frp/frps.toml
|
||
|
||
Restart=always
|
||
|
||
[Install]
|
||
|
||
WantedBy=multi-user.target
|
||
|
||
5. 腾讯云防火墙
|
||
|
||
- 开放 7000 端口（FRP通信）
|
||
- 7500 可选（Dashboard，建议仅限内网或白名单IP访问）
|
||

|
||
二、群晖NAS端（客户端 frpc）
|
||
6. 安装方式
|
||
- 方式A：群晖套件中心搜索 "FRP"（有第三方套件）
|
||
- 方式B：SSH 登录 NAS，手动下载 Linux ARM/x86 版本
|
||
7. 配置 frpc.toml
|
||
toml
|
||
Copy
|
||
serverAddr = "你的VPS公网IP" # 或域名
|
||
serverPort = 7000
|
||
auth.token = "你的强密码" # 与服务端一致
|
||
|
||
# Gitea HTTP 服务穿透
|
||
|
||
[[proxies]]
|
||
|
||
name = "gitea"
|
||
|
||
type = "tcp"
|
||
|
||
localIP = "127.0.0.1"
|
||
|
||
localPort = 3000 # NAS上Gitea的端口
|
||
|
||
remotePort = 0 # 不指定，服务端自动分配
|
||
|
||
# Gitea SSH（可选，git clone用SSH协议）
|
||
|
||
[[proxies]]
|
||
|
||
name = "gitea-ssh"
|
||
|
||
type = "tcp"
|
||
|
||
localIP = "127.0.0.1"
|
||
|
||
localPort = 2222 # NAS上Gitea SSH端口
|
||
|
||
remotePort = 0
|
||
|
||
3. remotePort = 0 的含义
|
||
|
||
- 让 frps 自动分配远程端口（避免端口冲突）
|
||
- 启动后 Dashboard 会显示分配的端口号
|
||
- 也可以指定固定端口，比如 remotePort = 13000
|
||

|
||
三、Nginx 反代（腾讯云VPS上，已有Nginx）
|
||
把分配到的端口反代到 80/443 + 域名：
|
||
nginx
|
||
Copy
|
||
server {
|
||
listen 443 ssl;
|
||
server_name git.yourdomain.com; # 你的域名
|
||
|
||
ssl_certificate /path/to/cert.pem;
|
||
|
||
ssl_certificate_key /path/to/key.pem;
|
||
|
||
location / {
|
||
|
||
proxy_pass <http://127.0.0.1:13000>; # frp分配的远程端口
|
||
|
||
proxy_set_header Host $host;
|
||
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
# WebSocket支持（Gitea需要）
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
|
||
}
|
||
|
||
}
|
||
|
||

|
||
|
||
四、安全加固（重要）
|
||
|
||
措施
|
||
|
||
说明
|
||
|
||
auth.token
|
||
|
||
强密码，防止别人连你的frps
|
||
|
||
限制Dashboard
|
||
|
||
7500端口不要对公网开放，或加IP白名单
|
||
|
||
TLS加密
|
||
|
||
frpc↔frps 通信建议启用 TLS
|
||
|
||
Nginx HTTPS
|
||
|
||
对外必须走HTTPS，保护Git凭证
|
||
|
||
Gitea自身认证
|
||
|
||
禁止公开注册，启用两步验证
|
||
|
||
frps 开启 TLS：
|
||
|
||
toml
|
||
|
||
Copy
|
||
|
||
# frps.toml
|
||
|
||
transport.tls.force = true
|
||
|
||

|
||
|
||
五、完整流程总结
|
||
|
||
Copy
|
||
|
||
1. VPS上装 frps → 配置 → 启动 → 开防火墙端口
|
||
2. NAS上装 Gitea → 配置 SQLite → 启动
|
||
3. NAS上装 frpc → 配置连接VPS → 启动
|
||
4. frps分配端口（如13000） → Nginx反代 + HTTPS
|
||
5. 域名解析 git.yourdomain.com → VPS IP
|
||
6. 完成！浏览器访问 git.yourdomain.com，git clone/push 走HTTPS
|
||

|
||
六、成本与资源
|
||
项目
|
||
开销
|
||
FRP软件
|
||
免费
|
||
VPS frps 内存
|
||
~15MB
|
||
NAS frpc 内存
|
||
~10MB
|
||
额外磁盘
|
||
几乎为零
|
||
域名
|
||
你已有，加一条DNS解析就行
|
||
对你现有VPS的影响： 几乎可忽略。15MB内存 + 一个端口，不会对OpenClaw产生任何影响。
|
||

|
||
七、注意事项
|
||
- Git大文件传输：速度取决于VPS带宽（腾讯云轻量服务器带宽一般不大），如果仓库有大量大文件可能偏慢
|
||
- 断线重连：frpc 会自动重连，NAS重启后也会自动恢复（配了systemd/套件自启）
|
||
- 多服务穿透：以后如果NAS还有其他服务（Jellyfin、WebDAV等），加一个 [[proxies]] 就行
|
||
|
||
## ✅ FRP 服务端部署完成
|
||
|
||
**版本：** FRP v0.68.0
|
||
|
||
**内存占用：** 9.3MB（很轻量）
|
||
|
||
**状态：** 运行中，已设为开机自启
|
||
|
||
### 🔑 NAS 端连接信息（请保密）
|
||
|
||
|参数|值|
|
||
|---|---|
|
||
|serverAddr|`82.156.57.104`|
|
||
|serverPort|`700`|
|
||
|auth.token|`deb19f52ac7fa6423efcd1a3fbf9c2b7`|
|
||
|TLS加密|必须开启（`transport.tls.enable = true`）|
|
||
|
||
### 📋 NAS 端 frpc.toml 配置模板
|
||
|
||
Copy
|
||
|
||
```toml
|
||
serverAddr = "82.156.57.104"
|
||
serverPort = 700
|
||
auth.token = "deb19f52ac7fa6423efcd1a3fbf9c2b7"
|
||
|
||
transport.tls.enable = true
|
||
|
||
# Gitea HTTP
|
||
[[proxies]]
|
||
name = "gitea"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 300
|
||
remotePort = 1300
|
||
|
||
# Gitea SSH（可选）
|
||
[[proxies]]
|
||
name = "gitea-ssh"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 222
|
||
remotePort = 13022
|
||
``
|
||
|
||
### ⚠️ 你需要手动操作
|
||
|
||
去**腾讯云控制台 → 安全组**放行以下端口：
|
||
- **TCP 700**（FRP通信，NAS必须能连上）
|
||
- 建议来源限制为 NAS 的公网IP（如果有的话）
|
||
|
||
Dashboard 750 仅本地监听，无需放行 ✅
|
||
|
||
---
|
||
|
||
配置文件和Nginx反代模板已保存到 memory 目录。NAS 端
|
||
```
|
||
|
||
serverAddr = "82.156.57.104"
|
||
|
||
serverPort = 7000
|
||
|
||
auth.token = "deb19f52ac7fa6423efcd1a3fbf9c2b7"
|
||
|
||
transport.tls.enable = true
|
||
|
||
# Gitea HTTP
|
||
|
||
[[proxies]]
|
||
|
||
name = "gitea"
|
||
|
||
type = "tcp"
|
||
|
||
localIP = "127.0.0.1"
|
||
|
||
localPort = 3000
|
||
|
||
remotePort = 13000
|
||
|
||
# Gitea SSH（可选）
|
||
|
||
[[proxies]]
|
||
|
||
name = "gitea-ssh"
|
||
|
||
type = "tcp"
|
||
|
||
localIP = "127.0.0.1"
|
||
|
||
localPort = 2222
|
||
|
||
remotePort = 13022
|