本文将介绍一种更加简单友好的方式生成本地https证书，并且信任自签CA的方案——mkcert。

安装

先安装certutil：

yum install nss-tools

再安装mkcert：

curl -JLO "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert-v1.4.4-linux-amd64
mv mkcert-v1.4.4-linux-amd64 /usr/local/bin/mkcert

运行mkcert，看到下面内容就表示安装成功：

Usage of mkcert:

$ mkcert -install
Install the local CA in the system trust store.

$ mkcert example.org
Generate "example.org.pem" and "example.org-key.pem".

$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1
Generate "example.com+4.pem" and "example.com+4-key.pem".

$ mkcert "*.example.it"
Generate "_wildcard.example.it.pem" and "_wildcard.example.it-key.pem".

$ mkcert -uninstall
Uninstall the local CA (but do not delete it).

使用install将mkcert使用的根证书加入了本地可信CA中，以后由该CA签发的证书在本地都是可信的。

mkcert -install
Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)! 🦊

生成证书

mkcert -key-file localhost.key -cert-file localhost.cert localhost 127.0.0.1 ::1

Note: the local CA is not installed in the system trust store.
Note: the local CA is not installed in the Firefox and/or Chrome/Chromium trust store.
Run "mkcert -install" for certificates to be trusted automatically ⚠️

Created a new certificate valid for the following names 📜
- "localhost"
- "127.0.0.1"
- "::1"

The certificate is at "localhost.cert" and the key at "localhost.key" ✅

It will expire on 27 September 2026 🗓

可以看到生成了localhost.key和localhost.cert，直接在server中使用就可以了

mkcert 自签名证书最先出现在wqh博客。

拉取镜像

docker pull mongodb/mongodb-community-server

配置文件

创建文件/mnt/mongodb/mongo.conf

systemLog:
  destination: file
  path: /var/log/mongodb/mongod.log
  logAppend: true
storage:
  dbPath: /data/db
net:
  port: 27017
  bindIp: 0.0.0.0
security:
  authorization: enabled

systemLog 写入日志文件的地址是容器中的路径
storage 数据库目录是容器中的路径
net 指定容器mongodb启动监听27017端口, 0.0.0.0 是为了让宿主机可以访问容器的mongodb服务
security 开启账号密码登录验证方式

运行镜像

docker run --name mongodb -p 27017:27017 -e TZ=Asia/Shanghai -v /mnt/mongodb/mongo.conf:/etc/conf/mongo.conf -v /data/mongodb:/data -d mongodb/mongodb-community-server:latest -f /etc/conf/mongo.conf

新增账号

 docker exec -it mongo mongosh

切换的admin

test> use admin
switched to db admin
admin> db.createUser({user:"账号",pwd:"密码",roles:["root"]})
{ ok: 1 }

验证账号

admin> db.auth("账号","密码")
{ ok: 1 }

Docker运行MongoDB最先出现在wqh博客。

Linux环境

首先找出容器ID，使用命令docker ps -a

找到容器的ID，这里是b7cf937a67e857aa04a120e172b79d152d5946b93f2851068cdaa4c054cd4941 然后找到config.v2.json配置文件

/var/lib/docker/containers/b7cf937a67e857aa04a120e172b79d152d5946b93f2851068cdaa4c054cd4941/config.v2.json

在ExposedPorts下面新增"9848/tcp":{},"9849/tcp":{}，9848和9849就是新增的服务器端口

“ExposedPorts”:{……"9848/tcp":{},"9849/tcp":{}}

最后修改hostconfig.json配置文件

/var/lib/docker/containers/b7cf937a67e857aa04a120e172b79d152d5946b93f2851068cdaa4c054cd4941/hostconfig.json

在PortBindings下面新增"9848/tcp":[{"HostIp":"","HostPort":"11006"}],"9849/tcp":[{"HostIp":"","HostPort":"11007"}]

9848和9849就是新增的服务器端口，11006和11007就是映射出来的端口

"PortBindings":{......"9848/tcp":[{"HostIp":"","HostPort":"11006"}],"9849/tcp":[{"HostIp":"","HostPort":"11007"}] }

修改完之后，重启docker

systemctl restart docker

Windows环境

找到配置文件路径

\\wsl.localhost\docker-desktop-data\data\docker\containers\

其它操作和linux下面是一样的

Docker如何增加端口映射最先出现在wqh博客。

接下来使用npm安装

npm install -g typescript

added 1 package, and audited 2 packages in 10s
found 0 vulnerabilities

使用下面命令验证是否安装成功

tsc --version

Version 5.0.4

tsc --help

tsc: The TypeScript Compiler - Version 5.0.4
TS
COMMON COMMANDS

tsc
Compiles the current project (tsconfig.json in the working directory.)

tsc app.ts util.ts
Ignoring tsconfig.json, compiles the specified files with default compiler options.

tsc -b
Build a composite project in the working directory.

tsc --init
Creates a tsconfig.json with the recommended settings in the working directory.

tsc -p ./path/to/tsconfig.json
Compiles the TypeScript project located at the specified path.

tsc --help --all
An expanded version of this information, showing all possible compiler options

tsc --noEmit
tsc --target esnext
Compiles the current project, with additional settings.

COMMAND LINE FLAGS

--help, -h Print this message.

--watch, -w Watch input files.

--all Show all compiler options.

--version, -v Print the compiler's version.

--init Initializes a TypeScript project and creates a tsconfig.json file.

--project, -p Compile the project given the path to its configuration file, or to a folder with a 'tsconfig.json'.

--build, -b Build one or more projects and their dependencies, if out of date

--showConfig Print the final configuration instead of building.

COMMON COMPILER OPTIONS

--pretty Enable color and formatting in TypeScript's output to make compiler errors easier to read.
type: boolean
default: true

--declaration, -d Generate .d.ts files from TypeScript and JavaScript files in your project.
type: boolean
default: `false`, unless `composite` is set

--declarationMap Create sourcemaps for d.ts files.
type: boolean
default: false

--emitDeclarationOnly Only output d.ts files and not JavaScript files.
type: boolean
default: false

--sourceMap Create source map files for emitted JavaScript files.
type: boolean
default: false

--target, -t Set the JavaScript language version for emitted JavaScript and include compatible library declarations.
one of: es3, es5, es6/es2015, es2016, es2017, es2018, es2019, es2020, es2021, es2022, esnext
default: es5

--module, -m Specify what module code is generated.
one of: none, commonjs, amd, umd, system, es6/es2015, es2020, es2022, esnext, node16, nodenext
default: undefined

--lib Specify a set of bundled library declaration files that describe the target runtime environment.
one or more: es5, es6/es2015, es7/es2016, es2017, es2018, es2019, es2020, es2021, es2022, es2023, esnext, dom, dom.iterable, webworker, webworker.importscript
s, webworker.iterable, scripthost, es2015.core, es2015.collection, es2015.generator, es2015.iterable, es2015.promise, es2015.proxy, es2015.reflec
t, es2015.symbol, es2015.symbol.wellknown, es2016.array.include, es2017.object, es2017.sharedmemory, es2017.string, es2017.intl, es2017.typedarra
ys, es2018.asyncgenerator, es2018.asynciterable/esnext.asynciterable, es2018.intl, es2018.promise, es2018.regexp, es2019.array, es2019.object, es
2019.string, es2019.symbol/esnext.symbol, es2019.intl, es2020.bigint/esnext.bigint, es2020.date, es2020.promise, es2020.sharedmemory, es2020.stri
ng, es2020.symbol.wellknown, es2020.intl, es2020.number, es2021.promise/esnext.promise, es2021.string, es2021.weakref/esnext.weakref, es2021.intl
, es2022.array, es2022.error, es2022.intl, es2022.object, es2022.sharedmemory, es2022.string/esnext.string, es2022.regexp, es2023.array/esnext.ar
ray, esnext.intl, decorators, decorators.legacy
default: undefined

--allowJs Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files.
type: boolean
default: false

--checkJs Enable error reporting in type-checked JavaScript files.
type: boolean
default: false

--jsx Specify what JSX code is generated.
one of: preserve, react, react-native, react-jsx, react-jsxdev
default: undefined

--outFile Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output.

--outDir Specify an output folder for all emitted files.

--removeComments Disable emitting comments.
type: boolean
default: false

--noEmit Disable emitting files from a compilation.
type: boolean
default: false

--strict Enable all strict type-checking options.
type: boolean
default: false

--types Specify type package names to be included without being referenced in a source file.

--esModuleInterop Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility.
type: boolean
default: false

You can learn about all of the compiler options at https://aka.ms/tsc

Centos安装TypeScript环境最先出现在wqh博客。

dnf module list nodejs

CentOS Linux 8 - AppStream
Name Stream Profiles Summary
nodejs 10 [d] common [d], development, minimal, s2i Javascript runtime
nodejs 12 common [d], development, minimal, s2i Javascript runtime
nodejs 14 common [d], development, minimal, s2i Javascript runtime
nodejs 16 common [d], development, minimal, s2i Javascript runtime

Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

可以看到一个有4个版本，分别是10、12、14和16，这里选择切换到最新的16版本

dnf module enable nodejs:16

命令安装

切换到16版本，然后使用下面命令安装即可：

dnf install nodejs

等待安装完成之后 ，使用下面命令验证安装是否成功：

node --version
v16.13.1

如果想安装其他版本，可以使用下面命令进行安装

curl -fsSL https://rpm.nodesource.com/setup_18.x | bash -

等repo更新完成，直接安装即可

yum install nodejs

修改国内镜像

npm config set registry https://registry.npmmirror.com

验证命令

npm config get registry

如果返回https://registry.npmmirror.com，说明镜像配置成功。

安装yarn

Yarn 是为了弥补 npm 的一些缺陷而出现的：

npm 安装包（packages）的速度不够快，拉取的 packages 可能版本不同

npm 允许在安装 packages 时执行代码，这就埋下了安全隐患

npm install --global yarn

卸载nodejs

yum remove nodejs && rm -r /etc/yum.repos.d/nodesource*.repo && yum clean all

Centos安装nodejs稳定版(LTS)最先出现在wqh博客。

查看Swap分区

用free命令可以查看内存情况和交换区大的情况

$ free -h
total used free shared buff/cache available
Mem: 7.6Gi 5.5Gi 124Mi 65Mi 2.0Gi 1.8Gi
Swap: 0B 0B 0B

创建Swap分区

使用下命命令创建分区：

fallocate -l 1G /swapfile

如果报错fallocate failed: Operation not supported，可以使用下面的命令：

dd if=/dev/zero of=/swapfile bs=1024 count=1048576

设置只有root用户才可以读写：

chmod 600 /swapfile

把swapfile文件设置为Linux交换区域

mkswap /swapfile

启动交换区

swapon /swapfile

用free再查看，就可以看到swap交换区：

total used free shared buff/cache available
Mem: 7.6Gi 5.6Gi 129Mi 73Mi 1.9Gi 1.7Gi
Swap: 1Gi 0.0Ki 1Gi

配置永久生效

打开/etc/fstab，加入下面代码：

/swapfile swap swap defaults 0 0

删除Swap分区

首先关闭交换区：

swapoff -v /swapfile

然后在/etc/fstab中，删除/swapfile swap swap defaults 0 0这一行

最后删除swapfile文件即可：

rm /swapfile

Linux命令| Swap分区操作最先出现在wqh博客。

按照大小拆分

 split -b 100m log.txt newfile

每个文件大小100m，生成的新文件的文件名是newfile后面加上按照aa，ab，ac……来排序的

新文件名也可以不设置，系统默认新文件以字母x开头，那么文件名就是xaa，xab，axc

数字后缀

如果觉得aa，ab，ac不好看，也可以使用数字后缀

split -b 100m -d log.txt newfile

生成的文件就是newfile00，newfile01，newfile02

按照行数拆分

除了按照大小，也可以按照行数进行拆分

split -1000 -d log.txt newfile

把log.txt按照每1000行拆分

合并命令

在Linux下的合并命令是：

cat newfile* > orifile

如果是在 Windows 下的话，先运行 cmd，然后用 copy 命令来进行文件的合并：

copy /b xaa + xab log.txt

Linux命令| Split文件拆分最先出现在wqh博客。

安装

Elasticsearch8.4自带了openjdk，所以不需要再安装java环境

首先安装GPG-KEY

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

第一种方式，使用root用户，进入目录/etc/yum.repos.d/，新建文件elasticsearch.repo，内容如下 ：

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=0
type=rpm-md

最后用yum命令安装即可：

yum install --enablerepo=elasticsearch elasticsearch

系统会自动完成安装最新release版本

第二种方式，使用root用户wget手动下载需要的版本进行安装

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.1-x86_64.rpm
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.4.1-x86_64.rpm.sha512
shasum -a 512 -c elasticsearch-8.4.1-x86_64.rpm.sha512
rpm --install elasticsearch-8.4.1-x86_64.rpm

如果找不到命令shasum command not found，请先执行下面命令安装shasum

yum install perl-Digest-SHA -y

配置

安装完成之后，可以找到系统自动生成的密码

The generated password for the elastic built-in superuser is : OKzrWoarTW8mnpfTcf_z

也可以使用/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic重新自动生成密码

使用systemctl执行命令

systemctl enable elasticsearch.service

这里需要修改/usr/lib/systemd/system/elasticsearch.service中的TimeoutStartSec和ExecStart

ExecStart默认是前台启动，这里需要改成后台启动，不然用systemctl启动之后，到了TimeoutStartSec的时间，Elasticsearch服务就会超时关闭

ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -d -p ${PID_DIR}/elasticsearch.pid

TimeoutStartSec默认在是75秒，可以改成150秒，因为第一次加载的时间比较长，否则如果用systemctl start elasticsearch.service命令启动 ，会报错Start operation timed out. Terminating

 TimeoutStartSec=150

修改/etc/elasticsearch/elasticsearch.yml，注释掉cluster.initial_master_nodes，并把集群设置为单结点

cluster.name: test-cluster
node.name: test-node-1
discovery.type: single-node
#cluster.initial_master_nodes: ["9a1ae7a91a36"]

运行

一切就绪就好，就可以启动Elasticsearch

systemctl daemon-reload
systemctl start elasticsearch.service

启动完成之后，systemctl有可能提示失败，这不影响Elasticsearch，可以使用命令查看Elasticsearch是否启动成功

curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200

输入上面自动生成的密码，看到如下的输出就表示启动成功了：
{
  "name" : "test-node-1",
  "cluster_name" : "test-cluster",
  "cluster_uuid" : "2_iEDUKHSR-EqsYkAKlZog",
  "version" : {
    "number" : "8.4.1",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "2bd229c8e56650b42e40992322a76e7914258f0c",
    "build_date" : "2022-08-26T12:11:43.232597118Z",
    "build_snapshot" : false,
    "lucene_version" : "9.3.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

如果启动失败，可以查看/var/log/elasticsearch/test-cluster.log日志文件来追踪问题。

Elasticsearch（一）| Centos 安装 Elasticsearch 8.4最先出现在wqh博客。

[Chrome]
name=Google Chrome - x86_64
baseurl=http://dl.google.com/linux/rpm/stable/x86_64
enabled=1
gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub

如果要装32位，使用下面内容：

[Chrome]
name=Google Chrome - i386
baseurl=http://dl.google.com/linux/rpm/stable/i386
enabled=1
gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub

保存之后执行下面命令即可：

如果要安装stable(稳定版)
yum install google-chrome-stable

如果要安装beta
yum install google-chrome-beta

如果要安装unstable
yum install google-chrome-unstable

如果环境无法访问https://dl-ssl.google.com/linux/linux_signing_key.pub，可以使用命令跳过gpgcheck

 yum install google-chrome-stable --nogpgcheck

Centos 安装Chrome最先出现在wqh博客。

PublicKey认证的基础在于一对密钥，public key和private key，public key对数据进行加密而且只能用于加密，private key 只能对所匹配的public key加密过的数据进行解密。

.ssh目录

在登录账号的目录下面新建.ssh目录，例如登录账号是test，就在/home/test目录下面新建并修改目录权限：

mkdir .ssh
chmod 700 .ssh

生成密钥

进入.ssh目录，使用ssh-keygen命令生成密钥：

ssh-keygen -t rsa -b 4096

需要输入密钥文件名和密钥的密码，密钥文件名默认回车即可：

Generating public/private rsa key pair.
Enter file in which to save the key (/home/test/.ssh/id_rsa): //回车即可
Enter passphrase (empty for no passphrase): //密钥文件的密码
Enter same passphrase again: //密码确认

执行完毕之后，可以看到两个文件id_rsa.pub和id_rsa，重命名id_rsa.pub

mv id_rsa.pub authorized_keys
chmod 600 authorized_keys

把id_rsa文件下载到本地，之后就可以使用这个文件登录。

sshd_config

修改/etc/ssh/sshd_config文件的配置:

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
X11Forwarding no
AuthorizedKeysFile .ssh/authorized_keys

PermitRootLogin 使用root账号登录
PubkeyAuthentication pubkey登录
PasswordAuthentication 密码登录
X11Forwarding 如果不使用图形界面，可以把这个禁掉
AuthorizedKeysFile 就是开始生成的密钥文件路径，一般不用修改
保存修改之后，就可以重启sshd:

systemctl restart sshd

id_rsa

打开远程连接的客户端，比如这里使用的是xshell，配置publiekey登录，把下载到本地的id_rsa文件导入即可，导入时需要输入密钥文件的密码：

Centos SSH PublicKey证书登录最先出现在wqh博客。