本地服务器搭建详细步骤

# 装完后的标准初始化动作
sudo apt update && sudo apt upgrade -y
sudo timedatectl set-timezone Asia/Shanghai
sudo hostnamectl set-hostname home-server
sudo apt install -y vim curl wget git net-tools htop iotop iftop tmux
hostnamectl            # 确认主机名生效
timedatectl status | grep -E 'NTP|Time zone'

ip -br link show
ip route show default     # 记下默认网关，通常是 192.168.1.1

# /etc/netplan/00-installer-config.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    enp3s0:                       # 改成你的实际网卡名
      dhcp4: no
      dhcp6: no
      addresses:
        - 192.168.1.100/24        # 静态内网 IP，建议选 DHCP 池之外的地址
      routes:
        - to: default
          via: 192.168.1.1        # 路由器网关地址
      nameservers:
        addresses:
          - 192.168.1.1
          - 223.5.5.5
          - 8.8.8.8

sudo chmod 600 /etc/netplan/00-installer-config.yaml   # netplan 要求权限不过于开放
sudo netplan generate
sudo netplan apply

# 验证：IP 已生效、网关可达、DNS 正常
ip -4 addr show enp3s0
ip route show default
ping -c 3 192.168.1.1
ping -c 3 -W 2 223.5.5.5
resolvectl status | grep -A3 'DNS Servers'

sudo apt install -y openssh-server
sudo systemctl enable --now ssh
sudo ss -lntup | grep sshd        # 确认监听状态

# 生成密钥（在你的日常电脑上执行）
ssh-keygen -t ed25519 -C "home-server"
ssh-copy-id user@192.168.1.100

sudo tee /etc/ssh/sshd_config.d/99-hardening.conf <<'EOF'
Port 2222
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

# Ubuntu 24.04 的 ssh.socket 会覆盖端口，需同步修改
sudo systemctl edit ssh.socket

[Socket]
ListenStream=
ListenStream=2222

sudo systemctl daemon-reload
sudo systemctl restart ssh
sudo ss -lntup | grep 2222

# 防火墙只放行内网访问 SSH
sudo ufw default deny incoming
sudo ufw allow from 192.168.1.0/24 to any port 2222 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# 在手机或另一网络的电脑上执行
nc -vz 你的公网IP 2222
ssh -p 2222 user@你的公网IP
curl -v http://你的公网IP:8080

# 1. 确认自己是否拥有公网 IPv4（对比两个值是否一致）
curl -s -4 ifconfig.me                          # 公网看到的 IP
ip route get 1.1.1.1 | awk '{print $7; exit}'   # 本机出网使用的地址

# 2. 在路由器后台（网络参数 / DDNS）填写服务商账号，多数路由器内置支持
#    若路由器不支持，则在服务器上用脚本定时更新（以 Cloudflare API 为例）
sudo mkdir -p /etc/ddns
sudo tee /usr/local/bin/ddns-update.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
CF_TOKEN="你的API令牌"
ZONE_ID="你的ZoneID"
RECORD_ID="你的记录ID"
NAME="home.example.com"
IP=$(curl -s -4 ifconfig.me)
curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records/${RECORD_ID}" \
  -H "Authorization: Bearer ${CF_TOKEN}" \
  -H "Content-Type: application/json" \
  --data "{\"type\":\"A\",\"name\":\"${NAME}\",\"content\":\"${IP}\",\"ttl\":120,\"proxied\":false}"
EOF
sudo chmod 700 /usr/local/bin/ddns-update.sh

# 3. 每 5 分钟检查一次，IP 变化即更新
echo '*/5 * * * * /usr/local/bin/ddns-update.sh >> /var/log/ddns.log 2>&1' | sudo tee /etc/cron.d/ddns
dig +short home.example.com