2025年4月

下载安装Headscale

wget https://github.com/juanfont/headscale/releases/download/v0.25.1/headscale_0.25.1_linux_amd64.deb
dpkg -i headscale_0.25.1_linux_amd64.deb

修改Headscale配置文件

sed -i "s|^server_url:.*|server_url: https://t.wzh.kim|" /etc/headscale/config.yaml
sed -i "s|^listen_addr:.*|listen_addr: 0.0.0.0:8080|" /etc/headscale/config.yaml
sed -i "s|^\( *\)v4: 100.64.0.0/10|\1v4: 192.168.100.0/24|" /etc/headscale/config.yaml
sed -i "s|^\( *\)stun_listen_addr:.*|\1#stun_listen_addr: "0.0.0.0:3478"|" /etc/headscale/config.yaml
sed -i "s|^randomize_client_port:.*|randomize_client_port: true|" /etc/headscale/config.yaml
sed -i "s|^\( *\)urls:|\1urls: []|" /etc/headscale/config.yaml
sed -i "s|^\( *\)- https://controlplane.tailscale.com/derpmap/default|\1#- https://controlplane.tailscale.com/derpmap/default|" /etc/headscale/config.yaml
sed -i "s|^  paths:.*|  paths: /etc/headscale/derp.yaml|" /etc/headscale/config.yaml
sed -i "s|^\( *\)base_domain:.*|\1base_domain: d.wzh.kim|" /etc/headscale/config.yaml

设置自建DERP节点

cat > /etc/headscale/derp.yaml << EOF
regions:
  900:
    regionid: 900
    regioncode: cni
    regionname: Nanjing
    nodes:
      - name: 900a
        regionid: 900
        hostname: t.wzh.kim
        ipv4: 146.56.203.150
        ipv6: "2402:4e00:c021:3700:4e42:9970:228:0"
        stunport: 13478
        stunonly: false
        derpport: 12345
EOF

反向代理Headscale配置文件

#PROXY-START/
location /
{
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $server_name;
    proxy_redirect http:// https://;
    proxy_buffering off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
}
#PROXY-END/

Headscale ui配置文件

location /web
{
    alias /www/wwwroot/t.wzh.kim/web;
    try_files $uri $uri/ /index.html;
}

设置开机自启并启动

systemctl enable headscale
systemctl start headscale

生成web apikeys密钥

headscale apikeys create --expiration 365d

创建用户

headscale users create <USER>

列出现有用户

headscale users list

删除用户

headscale users destroy -n <USER>

正常的交互式登录

tailscale up --login-server <YOUR_HEADSCALE_URL>

在 Headscale 服务器上批准并注册节点

headscale nodes register --user <USER> --key <YOUR_MACHINE_KEY>

使用 preauthkey。密钥的有效期为 365天,并且可以重复使用

headscale preauthkeys create --user <USER> --expiration 365d --reusable

该命令在成功时返回 preauthkey,该密钥用于通过命令将节点连接到 headscale 实例:

tailscale up --login-server <YOUR_HEADSCALE_URL> --auth-key <YOUR_AUTH_KEY>

注册节点并使其将自身公布为出口节点,通告路由网段

tailscale up --login-server <YOUR_HEADSCALE_URL> --auth-key <YOUR_AUTH_KEY> --advertise-exit-node --advertise-routes=

检查当前主机的路由表

tailscale netcheck

查看网络状态

tailscale status

查看路由状态

headscale routes list

启用路由

-r 参数是 headscale routes list列出的路由 id

headscale route disable -r 1
headscale route disable -r 2
headscale route enable -r 1
headscale route enable -r 2

启动服务

systemctl start headscale

关闭服务

systemctl stop headscale

开机自启

systemctl enable headscale

查看状态

systemctl status headscale

下载Go

wget https://go.dev/dl/go1.24.5.linux-amd64.tar.gz

解压Go

rm -rf /usr/local/go && tar -C /usr/local -xzf go1.24.5.linux-amd64.tar.gz

将Go添加到环境变量中,开启Go安装加速

echo "export PATH=$PATH:/usr/local/go/bin" >> /etc/profile
echo "export GO111MODULE=on" >> /etc/profile
echo "export GOPROXY=https://goproxy.cn" >> /etc/profile
source /etc/profile

从源运行 DERP 服务器

go install tailscale.com/cmd/derper@latest

复制DERP文件到root目录

mkdir /root/derper
cp /root/go/bin/derper /root/derper/

上传SSL证书

SSL证书上传到 /root/derper/ 文件夹证书命名格式为 <DOMAIN>.<SUFFIX>将证书文件后缀改为 crt 密钥文件后缀改为 key

设置DERP开机启动

cat > /etc/systemd/system/derper.service << EOF
[Unit]
Description = derper
After = network.target syslog.target
Wants = network.target

[Service]
Type = simple
ExecStart = /root/derper/derper --hostname t.wzh.kim -a :12345 --http-port -1 --certdir /root/derper --certmode manual --stun-port 13478

[Install]
WantedBy = multi-user.target
EOF

启用 IP 转发

echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.conf
sudo sysctl -p /etc/sysctl.conf

设置DERP开机自启并启动

systemctl enable derper
systemctl start derper

防止被滥用,客户端注册完成后添加

--verify-clients

自定义DERP服务器添加到Tailscale

在Tailscale管理界面找到 Access Controls https://login.tailscale.com/admin/acls/file
插入代码

{
    "randomizeClientPort": true,
    "derpMap": {
        "OmitDefaultRegions": true,
        "Regions": {
            "900": {
                "RegionID":   900,
                "RegionCode": "中国",
                "RegionName": "南京",
                "Nodes": [
                    {
                        "Name":     "900a",
                        "RegionID": 900,
                        "HostName": "nj.wzh.kim",
                        "DERPPort": 12345,
                        "STUNPort": 13478,
                        "IPv4":     "175.27.252.66",
                        "IPv6":     "2402:4e00:c021:3800:52c0:2fbc:fcda:0",
                    },
                ],
            },
            "901": {
                "RegionID":   901,
                "RegionCode": "韩国",
                "RegionName": "首尔",
                "Nodes": [
                    {
                        "Name":     "901a",
                        "RegionID": 901,
                        "HostName": "kr.wzh.kim",
                        "DERPPort": 12345,
                        "STUNPort": 13478,
                        "IPv4":     "150.109.247.61",
                        "IPv6":     "240d:c000:f05f:8b00:52c0:2fbc:fcda:0",
                    },
                ],
            },
        },
    },
}

重新编译

//删掉验证证书相关内容

nano /root/go/pkg/mod/tailscale.com@v1.84.3/cmd/derper/cert.go
#//if hi.ServerName != m.hostname {
#//      return nil, fmt.Errorf("cert mismatch with hostname: %q", hi.ServerName)
#//}

//删除443端口验证 (报错control: controlhttp: forcing port 443 dial due to recent noise dial)

nano /root/go/pkg/mod/tailscale.com@v1.84.3/control/controlhttp/client.go
if d.HealthTracker.LastNoiseDialWasRecent() {
    // If we dialed recently, assume there was a recent failure and fall
    // back to HTTPS dials for the subsequent retries.
    //
    // This heuristic works around networks where port 80 is MITMed and
    // appears to work for a bit post-Upgrade but then gets closed,
    // such as seen in https://github.com/tailscale/tailscale/issues/13597.
    d.logf("controlhttp: forcing port 443 dial due to recent noise dial") 
    return true
}

//进入目录重新编译

/root/go/pkg/mod/tailscale.com@v1.84.3/cmd/derper
go build -o /root/derper/derper

设置开机启动

systemctl enable derper

启动

systemctl start derper

停止

systemctl stop derper

重启

systemctl restart derper

查看状态

systemctl status derper

启动服务

@echo off
title ollama server
set OLLAMA_MODELS=%cd%\models
set OLLAMA_HOST=0.0.0.0
ollama serve

运行模型

@echo off
title ollama deepseek-coder:6.7b
ollama run deepseek-coder:6.7b

下载vlmcsd
binaries\Linux\intel\static\ 下的 vlmcsd-x64-musl-static 上传至VPS /root/kms/vlmcsd下,添加执行权限chmod +x /root/kms/vlmcsd

安装 systemd

apt install systemd

创建 frps.service 文件

nano /etc/systemd/system/vlmcsd.service

写入内容

[Unit]
Description = vlmcsd server
After = network.target syslog.target
Wants = network.target

[Service]
Type = simple
ExecStart = /root/kms/vlmcsd -D

[Install]
WantedBy = multi-user.target

使用 systemd 命令管理 vlmcsd 服务

设置vlmcsd开机启动

systemctl enable vlmcsd

启动vlmcsd

systemctl start vlmcsd

停止vlmcsd

systemctl stop vlmcsd

重启vlmcsd

systemctl restart vlmcsd

查看vlmcsd状态

systemctl status vlmcsd