搭建内网DNS

sudo pacman -S unbound

sudo nano /etc/unbound/unbound.conf

server:
    interface: 0.0.0.0
    port: 53
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes
    access-control: 192.168.1.0/24 allow
    verbosity: 1
    cache-max-ttl: 86400
    cache-min-ttl: 3600
    harden-dnssec-stripped: yes
    harden-referral-path: yes

    # Local zone for yuanzhou.site
    local-zone: "yuanzhou.site." static
    local-data: "yuanzhou.site. IN A 192.168.1.4"
    local-data: "reposity.yuanzhou.site. IN A 192.168.1.4"
    local-data: "git.yuanzhou.site. IN A 192.168.1.4"
    local-data: "oss.yuanzhou.site. IN A 192.168.1.4"
forward-zone:
    name: "."
    forward-addr: 223.5.5.5
    forward-first: yes

# 确保权限争取
sudo chown unbound:unbound /etc/unbound/unbound.conf
sudo chmod 644 /etc/unbound/unbound.conf
# 设置自启
sudo systemctl enable unbound
sudo systemctl start unbound
# 配置域名解析
sudo bash -c 'echo "nameserver 127.0.0.1" > /etc/resolv.conf'

dig yuanzhou.site
;; ANSWER SECTION:
yuanzhou.site.          3600    IN      A       192.168.1.4
dig jd.com
;; ANSWER SECTION:
jd.com.                 1638    IN      A       211.144.27.126
jd.com.                 1638    IN      A       106.39.171.134
jd.com.                 1638    IN      A       111.13.149.108
jd.com.                 1638    IN      A       211.144.24.218

#!/bin/bash
# DNS Server Setup Script for Arch Linux

# Install Unbound
sudo pacman -S unbound

# Backup original config
sudo mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.bak 2>/dev/null

# Create Unbound configuration
sudo bash -c 'cat > /etc/unbound/unbound.conf' << 'EOF'
server:
    interface: 0.0.0.0
    port: 53
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes
    access-control: 192.168.1.0/24 allow
    verbosity: 1
    cache-max-ttl: 86400
    cache-min-ttl: 3600
    harden-dnssec-stripped: yes
    harden-referral-path: yes

    # Local zone for yuanzhou.site
    local-zone: "yuanzhou.site." static
    local-data: "yuanzhou.site. IN A 192.168.1.4"
    local-data: "reposity.yuanzhou.site. IN A 192.168.1.4"
    local-data: "git.yuanzhou.site. IN A 192.168.1.4"
    local-data: "oss.yuanzhou.site. IN A 192.168.1.4"
forward-zone:
    name: "."
    forward-addr: 223.5.5.5
    forward-first: yes
EOF

# Set permissions
sudo chown unbound:unbound /etc/unbound/unbound.conf
sudo chmod 644 /etc/unbound/unbound.conf

# Enable and start Unbound service
sudo systemctl enable unbound
sudo systemctl start unbound

# Configure local DNS resolution
sudo bash -c 'echo "nameserver 127.0.0.1" > /etc/resolv.conf'

# Prevent resolv.conf from being overwritten
sudo chattr +i /etc/resolv.conf

# Test configuration
echo "Testing DNS resolution..."
dig yuanzhou.site @127.0.0.1
dig jd.com @127.0.0.1

echo "DNS server setup complete. Please verify the dig output above."

# 创建私钥
openssl genrsa -out yuanzhou.site.key 2048
# 创建证书签名请求
openssl req -new -key yuanzhou.site.key -out yuanzhou.site.csr
# 生成自签名证书（有效期 365 天）
openssl x509 -req -days 365 -in yuanzhou.site.csr \
  -signkey yuanzhou.site.key -out yuanzhou.site.crt

services:
  ## 部署nginx,映射配置文件个密钥
  nginx:
    image: nginx
    container_name: nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf:/etc/nginx/conf.d
      - ./nginx/cert:/etc/nginx/cert
    networks:
      - dev
  gitea:
    image: gitea/gitea:nightly
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
    networks:
      - dev
    volumes:
      - gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "22:22"
  runner:
    image: gitea/act_runner
    container_name: runner
    volumes:
      - ./data/act_runner:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - GITEA_INSTANCE_URL=http://gitea:3000
      - GITEA_RUNNER_REGISTRATION_TOKEN=2eKpHJ3uUFu5kyv0C6HXFDQ3MOQKcqxHuhtuP172
    networks:
      - dev
networks:
  dev:
    driver: bridge
    name: dev

# /etc/nginx/conf.d/registry.conf
upstream gitea {
  server gitea:3000;  # gitea容器的端口
}

server {
  listen 80;
  server_name git.yuanzhou.site;

  location / {
    proxy_pass http://gitea;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # 客户端上传镜像超时设置
    client_max_body_size 0;
    proxy_read_timeout 900;
    proxy_send_timeout 900;
  }
}

server {
  listen 443 ssl;
  server_name git.yuanzhou.site;

  ssl_certificate /etc/nginx/cert/yuanzhou.site.crt;
  ssl_certificate_key /etc/nginx/cert/yuanzhou.site.key;
  
  # 强化的SSL配置
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;

  location / {
    proxy_pass http://gitea;

    # Docker客户端特殊配置
    proxy_set_header X-Forwarded-Proto "https";
    proxy_set_header X-Forwarded-Port $server_port;
    
    # 大文件传输配置
    client_max_body_size 0;
    chunked_transfer_encoding on;
  }
}