教程與文件

適用服務：Fachost 工廠雲｜最後更新：2025-09-07

1) Cloudflare DDNS

目標：用最小權限的 Cloudflare API Token，定期把外網 IP 同步到指定 A（選配 AAAA）紀錄。

1.1 後台 9 步驟

進入 User API Tokens → Create Token。
選模板：Edit zone DNS（Use template）。
權限最小化：Zone→DNS: Edit + Zone→DNS: Read；範圍鎖定 你的 Zone。
確認摘要 → Create Token，複製 Token（僅顯示一次）。
回到 Account home → 進入你的 Zone（如 fachost.cloud）。
在 Overview 右側複製 Zone ID。
DNS → Records → Add record，新增 A 記錄並儲存。

1.2 Linux 部署（含排程）

sudo apt update
sudo apt install -y curl jq
sudo tee /etc/cf-ddns.env >/dev/null <<'EOF'
CF_API_TOKEN=你的_token
ZONE_ID=你的_zone_id
RECORDS="vds.fachost.cloud"
PROXIED=false
TTL=120
ENABLE_IPV6=false
LOG_FILE=/var/log/cf-ddns.log
EOF
sudo chmod 600 /etc/cf-ddns.env
sudo tee /usr/local/bin/cf-ddns.sh >/dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
source /etc/cf-ddns.env
AUTH=(-H "Authorization: Bearer ${CF_API_TOKEN}" -H "Content-Type: application/json")
API="https://api.cloudflare.com/client/v4"
log(){ echo "[$(date '+%F %T')] $*"; }
get_ipv4(){ ip=$(curl -4s https://1.1.1.1/cdn-cgi/trace | awk -F= '/^ip=/{print $2}') || true; [[ -z "${ip:-}" ]] && ip=$(curl -4s https://api.ipify.org || true); echo "${ip:-}"; }
get_ipv6(){ curl -6s https://api64.ipify.org || true; }
cf_get(){ curl -s "${AUTH[@]}" "${API}/zones/${ZONE_ID}/dns_records?type=$1&name=$2"; }
cf_apply(){ local t="$1" n="$2" v="$3" rec id old data
  rec="$(cf_get "$t" "$n")"; id="$(jq -r '.result[0].id // empty' <<<"$rec")"
  old="$(jq -r '.result[0].content // empty' <<<"$rec")"
  [[ -n "$old" && "$old" == "$v" ]] && { log "$t $n 已是 $v"; return; }
  data="$(jq -nc --arg t "$t" --arg n "$n" --arg c "$v" --argjson p ${PROXIED} --argjson ttl ${TTL} '{type:$t,name:$n,content:$c,proxied:$p,ttl:$ttl}')"
  [[ -n "$id" ]] && curl -s -X PUT "${AUTH[@]}" "${API}/zones/${ZONE_ID}/dns_records/$id" --data "$data" || \
                    curl -s -X POST "${AUTH[@]}" "${API}/zones/${ZONE_ID}/dns_records" --data "$data"
}
ip4="$(get_ipv4)"; [[ -z "$ip4" ]] && { log '取 IPv4 失敗'; exit 1; }
cf_apply A "vds.fachost.cloud" "$ip4"
echo "$(date '+%F %T') OK" >> "$LOG_FILE"
EOF
sudo chmod +x /usr/local/bin/cf-ddns.sh
# systemd 每 5 分鐘
sudo tee /etc/systemd/system/cf-ddns.timer >/dev/null <<'EOF'
[Unit] Description=CF DDNS timer
[Timer] OnBootSec=30s OnUnitActiveSec=5min Persistent=true
[Install] WantedBy=timers.target
EOF
sudo tee /etc/systemd/system/cf-ddns.service >/dev/null <<'EOF'
[Unit] Description=CF DDNS service
[Service] Type=oneshot ExecStart=/usr/local/bin/cf-ddns.sh
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now cf-ddns.timer

2) 虛擬機基本操作

適用 Debian/Ubuntu；RHEL 系請把 apt 換成 dnf。

2.1 SSH 連線

ssh user@你的IP
ssh -p 2222 user@你的IP  # 指定端口

2.2 開啟 root 登入（如需）

sudo -i
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%F)
nano /etc/ssh/sshd_config
# 關鍵：
PermitRootLogin yes
PasswordAuthentication yes
PubkeyAuthentication yes
systemctl restart ssh   # 或 sshd

2.3 產生與導入 SSH 金鑰

ssh-keygen -t ed25519 -C "[email protected]"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@你的IP

2.4 dd 快速操作（高風險）

lsblk -f
sudo fdisk -l
sudo dd if=debian.iso of=/dev/sdb bs=4M status=progress oflag=direct conv=fsync

2.5 取得公網 IP

curl -4s https://api.ipify.org
curl -6s https://api64.ipify.org

3) 網路與 DNS

3.1 路由調整

ip -br addr
ip route
ip route replace default via 203.0.113.1 dev eth0 metric 100

3.2 DNS 設定推薦

A. systemd-resolved

sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/00-dns.conf >/dev/null <<'EOF'
[Resolve]
DNS=1.1.1.1 1.0.0.1 9.9.9.9
FallbackDNS=8.8.8.8
DNSOverTLS=yes
EOF
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
sudo systemctl enable --now systemd-resolved

B. dnsmasq

sudo tee /etc/dnsmasq.d/00-upstream.conf >/dev/null <<'EOF'
no-resolv
server=1.1.1.1
server=1.0.0.1
server=9.9.9.9
cache-size=10000
listen-address=127.0.0.1,::1
bind-interfaces
EOF
echo -e "nameserver 127.0.0.1\noptions timeout:2 attempts:2" | sudo tee /etc/resolv.conf
sudo systemctl enable --now dnsmasq

C. Unbound

sudo tee /etc/unbound/unbound.conf.d/forward_tls.conf >/dev/null <<'EOF'
server:
  interface: 127.0.0.1
  access-control: 127.0.0.0/8 allow
forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 1.1.1.1@853#cloudflare-dns.com
  forward-addr: 9.9.9.9@853#dns.quad9.net
EOF
echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf
sudo systemctl enable --now unbound

3.3 SS 節點（libev）

sudo apt install -y shadowsocks-libev
sudo tee /etc/shadowsocks-libev/config.json >/dev/null <<'EOF'
{
  "server": "0.0.0.0",
  "server_port": 8388,
  "password": "強隨機密碼",
  "timeout": 300,
  "method": "chacha20-ietf-poly1305",
  "fast_open": true,
  "nameserver": "1.1.1.1",
  "mode": "tcp_and_udp"
}
EOF
sudo systemctl enable --now shadowsocks-libev-server@config