Operations on Margrop Blog

Restart Is Not Magic: Why Turning a Computer Off and On Seems to Fix 99% of Its Problems

Wed, 29 Jul 2026 08:00:00 +0800

The short version A restart is not magic, and it does not repair every fault. It is closer to emptying a room that has been used for months without cleaning: borrowed items are collected, people take fresh queue numbers, temporary notes disappear, and doors and appliances are initialized again. The system returns to a cleaner and more predictable starting point. When “restart fixed it” is true, the fault is often in volatile state, not in permanently damaged hardware, a configuration that is always wrong, or an application whose root cause has disappeared.

Take Back Your Remote Desktop: Deploying an All-in-One RustDesk Server Safely

Fri, 10 Jul 2026 22:00:00 +0800

The short version

RustDesk is an open-source remote desktop application designed with self-hosting in mind. When two clients can reach each other directly, screen and input traffic can use a peer-to-peer path. When that direct path fails, a relay server forwards the encrypted traffic. Hosting the server yourself does not eliminate servers; it puts device registration, relay routing, keys, accounts, and logs back under your control.

This guide uses the community-maintained lejianwen/rustdesk-server-s6 image to place the RustDesk OSS hbbs and hbbr services together with a community API and web administration layer in one container. It is a convenient option for homes, labs, and small teams, but it is not an official RustDesk all-in-one distribution. Evaluate the community image, pin a tested tag or digest, back up its persistent data, and rehearse upgrades and rollbacks before treating it as production infrastructure.

Every address in this article uses example.com. No real IP address, private domain, hostname, device ID, account, key, token, cookie, or private registry is shown. The screenshots come from public official or community project pages.

I Put Docker in a Control Room: Portainer CE 2.39.4 Deployment, Daily Use, and Real Traps

Fri, 10 Jul 2026 15:30:00 +0800

Bottom line first

Portainer does not replace Docker. It is a control room for a Docker host. Docker Engine remains the machinery; Portainer organizes containers, images, networks, volumes, and Compose stacks into a web dashboard.

I ran an isolated deployment of portainer/portainer-ce:2.39.4, initialized it, connected the local Docker environment, inspected the dashboard, filtered a disposable container, and created a demonstration stack. The installation is one docker run command. The important lessons are broader: persist /data, understand that /var/run/docker.sock is highly privileged, and never expose the management interface to an untrusted network without protection.

This article contains no complete IP address, real host name, private domain, administrator password, token, cookie, private registry address, or production container name. The screenshots use disposable names, and the container address is redacted.

The Self-Hosted Web Clipboard I Kept Is Just One Text Box

Fri, 10 Jul 2026 15:30:00 +0800

Short version

After trying many cross-device clipboard and note tools, the one I kept for personal use is almost embarrassingly small: minimalist-web-notepad. When you open it, there is essentially one text box. It supports plain text only. There is no account system, no rich text editor, no image upload, no folder tree, no dashboard, and no collaboration layer.

That is exactly why it works as a lightweight self-hosted web clipboard. It is good for moving a short command from one device to another, dropping a temporary note into a browser, reading or writing a tiny text value with curl, or keeping a disposable piece of text for a few minutes. It is not a knowledge base. It is not a password vault. It is a piece of scratch paper on the network.

This post uses the ahfeil/minimalist-web-notepad:latest image with Docker Compose. It also includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26, plus two operating modes: manual automatic execution and agent-driven configuration. No private network address, private domain, full machine name, or real secret is shown in this article.

Do Not Just Copy QingLong Into BaiHu: A Real Safe Migration Drill

Thu, 09 Jul 2026 10:30:00 +0800

Bottom line first

Migrating from QingLong Panel to BaiHu Panel is not a directory-copy exercise. I ran a real migration drill in an isolated Docker environment: a fresh QingLong instance with sample environment variables, scripts, labels, and cron jobs; then a fresh BaiHu instance; then an actual conversion and verification pass.

The reliable migration unit is not the whole QingLong data directory. It is a set of assets: script files, environment variables, scheduled tasks, tags, enabled/disabled state, and task-variable relations. QingLong uses numeric IDs; BaiHu uses string IDs and relation tables. QingLong commands such as task daily_check.py also need to become executable BaiHu commands such as python /app/data/scripts/qinglong-migrated/daily_check.py.

This article contains no full private IP address, private registry address, host name, token, cookie, or production secret. The screenshots come from a disposable lab, and the variables are redacted sample data.

Should QingLong Panel Still Face the Public Internet? After the 2026 Bypass, I Would Start With BaiHu

Thu, 09 Jul 2026 10:00:00 +0800

Bottom line first

QingLong Panel used to be the default answer for many self-hosted scheduled-script setups. It can run scripts, manage environment variables, show logs, synchronize repositories, and wrap crontab-like workflows in a friendly web UI. But the critical QingLong issues publicly discussed in early 2026 changed the risk calculation: a task scheduler panel is not just another web admin page. It often holds scripts, secrets, notification tokens, and execution privileges. If authentication can be bypassed, the attacker is not merely viewing a dashboard; they may be standing in front of a machine that can run jobs.

For new lightweight deployments, I would now evaluate BaiHu Panel first. BaiHu is a Go + Vue3 automation task scheduling platform focused on low overhead and high performance. Its public README describes Docker / Docker Compose deployment, Mise-based runtime management, repository task synchronization, logs, notifications, and secret handling. It is not a perfect one-to-one replacement for every QingLong workflow, but it is a better starting point for many personal script-hosting cases.

If you must keep using QingLong temporarily because of old jobs, migration cost, or compatibility constraints, do not expose it directly to the public Internet. Put a protection layer in front of it: VPN, zero-trust access, reverse-proxy Basic Auth, an allowlist, WAF rules, or equivalent access control. This article includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. They deploy BaiHu by default, require an explicit switch to deploy QingLong, and put either panel behind Caddy Basic Auth.

Is Your Computer Always Full? Use an AI Agent to Safely Clean Junk Files on Windows 11, Ubuntu 26.04, and macOS 26

Sun, 28 Jun 2026 07:15:00 +0800

Short version

Junk cleanup is risky not because it is hard to delete files, but because it is easy to delete too much. On Windows 11, Ubuntu 26.04, and macOS 26, the safe cleanup targets are usually temporary directories, package caches, old logs, recycle bin or trash contents, and files that can be regenerated. A cleanup script should not casually touch documents, photos, browser profiles, keys, certificates, virtual machine images, or application data.

This article gives you two paths: manual automation, where you run the scripts yourself, inspect the dry-run output, and then explicitly enable deletion; and Agent-driven automation, where Codex, Claude, OpenClaw, HermesAgent, or another AI Agent performs the same scan, review, execution, and verification flow for you. The three scripts cover Windows 11, Ubuntu 26.04, and macOS 26. They do not depend on third-party services, do not download cleanup utilities, and do not contain real private addresses, computer names, private domains, or secrets.

macOS 26 Boot Daemons: Put frp and EasyTier in LaunchDaemons, Not Login Items

Sat, 27 Jun 2026 17:12:00 +0800

Short version

If you want frp, EasyTier, a sync agent, a collector, a bot, or a proxy daemon to start automatically on macOS 26, the key is not “where can I hide this command?” The key is “which native service manager owns its lifecycle?” This article is about unattended background services, not ordinary desktop login apps.

On macOS 26, a daemon that must start before user login belongs in /Library/LaunchDaemons. Login items and LaunchAgents are tools opened after a person enters the room. LaunchDaemons are more like the building’s elevator or water pump: they should run as the machine comes up.

I will show two paths: manual configuration, for understanding every moving part, and agent / one-click automation, for cases where you already know where the binary and config file live. The scripts are self-contained, use built-in OS mechanisms, do not download third-party wrappers, and do not include real addresses, hostnames, private domains, or secrets.

Windows 11/10 Background Autostart: Run frp and EasyTier Unattended Without Third-Party Wrappers

Sat, 27 Jun 2026 17:11:00 +0800

Short version

If you want frp, EasyTier, a sync agent, a collector, a bot, or a proxy daemon to start automatically on Windows 11/10, the key is not “where can I hide this command?” The key is “which native service manager owns its lifecycle?” This article is about unattended background services, not ordinary desktop login apps.

On Windows, the first decision is whether the executable is a real Windows Service. Common command-line daemons such as frp and EasyTier are usually better handled by Task Scheduler at system startup, because it is built in and does not require NSSM, WinSW, or another wrapper.

I will show two paths: manual configuration, for understanding every moving part, and agent / one-click automation, for cases where you already know where the binary and config file live. The scripts are self-contained, use built-in OS mechanisms, do not download third-party wrappers, and do not include real addresses, hostnames, private domains, or secrets.

Ubuntu 26.04 Boot Services Done Right: Let systemd Run frp and EasyTier for You

Sat, 27 Jun 2026 17:10:00 +0800

Short version

If you want frp, EasyTier, a sync agent, a collector, a bot, or a proxy daemon to start automatically on Ubuntu 26.04, the key is not “where can I hide this command?” The key is “which native service manager owns its lifecycle?” This article is about unattended background services, not ordinary desktop login apps.

On Ubuntu 26.04, the standard answer for a background daemon is not a shell startup hack. It is a systemd unit. systemd can wait for the network, start the process before login, collect logs, restart on failure, and stop it in order during shutdown.

I will show two paths: manual configuration, for understanding every moving part, and agent / one-click automation, for cases where you already know where the binary and config file live. The scripts are self-contained, use built-in OS mechanisms, do not download third-party wrappers, and do not include real addresses, hostnames, private domains, or secrets.

Stop Letting Agents Burn Tokens: Wiring Headroom into NewAPI, OpenClaw, and HermesAgent

Sat, 20 Jun 2026 12:30:00 +0800

TL;DR

I did not replace NewAPI, and I did not point OpenClaw or HermesAgent at an unproven gateway. The actual design is simpler: place Headroom in front of NewAPI, then move only the already validated OpenAI-compatible providers to http://<headroom-host>:8787/v1. The original NewAPI endpoint stays available. Long agent context now goes through Headroom first, gets compressed, then continues to NewAPI for the same routing and model management as before.

The rule that kept the rollout boring was: test first, edit second; migrate only OpenAI-compatible providers that pass; leave non-OpenAI fallbacks alone. This post is both a write-up and a runbook you can hand to an Agent or follow manually.

Ubuntu shutdown stuck for 90 seconds? A Python asyncio service that won't honour SIGTERM, and how to fix it

Fri, 19 Jun 2026 10:58:00 +0800

TL;DR

After upgrading my home proxy box to Ubuntu 24.04, systemctl reboot stopped being fast: SSH would hang on for 90 seconds before the box actually shut down. journalctl made it obvious: smart-proxy.service: State 'stop-sigterm' timed out. Killing. — systemd sent SIGTERM, waited 90 seconds, nobody reacted, and SIGKILL was the only option left.

The root cause is not systemd’s fault and not Ubuntu’s fault. It is Python’s asyncio runtime not actually ending its child tasks when SIGTERM arrives — it is parked on a socket.recv and never voluntarily looks at the signal queue.

The fix has two halves, both required: (1) a systemd drop-in that lowers TimeoutStopSec from the default 90s down to 20s on the affected Python units; (2) inside the Python service itself, walk asyncio.all_tasks(), .cancel() the in-flight connection handlers on SIGTERM, and wrap self.stop() in asyncio.wait_for(..., timeout=10) as a safety net. After both halves, the same reboot drops from 90 seconds to one second.

Why HermesAgent Would Not Reply in WeChat or WeCom: The Real Culprit Was a Local Relay With a 3-Second Timeout

Sun, 31 May 2026 08:00:00 +0800

The short version This incident looked like a model problem or a broken messaging channel, but the real failure happened one layer lower: my local relay cut the upstream request off after 3 seconds. That was fine for quick health checks, but it was wrong for real WeChat and WeCom turns, which often take longer to produce a complete answer from the NewAPI gateway. Once the relay disconnected too early, HermesAgent could only see Connection error, RemoteProtocolError, and then exhausted fallback attempts.

OpenClaw Upgrade Guide: From Beginner to Expert

Fri, 29 May 2026 09:00:00 +0800

The short version

OpenClaw is a powerful personal AI assistant that supports multiple messaging channels and AI models. Upgrading OpenClaw is actually very simple — the most recommended way is to use the openclaw update command. This article will详细介绍 various upgrade methods, including switching from npm package installation to git source installation, as well as verification and rollback strategies after upgrading.

All examples in this article use public projects, public links, and placeholders. No real server addresses, accounts, tokens, business configuration, or private network details are included. The figures are taken from the official OpenClaw repository and documentation, and are referenced under the project’s MIT license.

Proxmox VE 9.2 Is Out: Not Just a New Kernel, but a Cluster That Can Start Balancing Itself

Sat, 23 May 2026 12:46:00 +0800

Short version

Proxmox VE 9.2 was officially released on May 21, 2026. On the surface it is a platform refresh: Debian 13.5 Trixie, Linux kernel 7.0, QEMU 11.0, LXC 7.0, ZFS 2.4, and updated Ceph options. The more interesting story is operational: dynamic load balancing through CRS, safer HA maintenance with arm/disarm, a much stronger SDN fabric story, web-based custom CPU model management, and many smaller fixes around guests, storage, security, and automation.

If you run a single-node homelab, Proxmox VE 9.2 may not feel dramatic on day one. If you operate a multi-node cluster with HA resources, Ceph, software-defined networking, custom CPU compatibility requirements, Windows secure boot, external automation, or strict maintenance windows, this release deserves a careful read.

This article summarizes the official Proxmox VE 9.2 release and adds an operator’s view: what changed, what problem each change addresses, what to test before upgrading, and when it is reasonable to wait. All hostnames, addresses, cluster names, accounts, and command outputs are placeholders. No private environment details are included.

Upgrading PVE 8 to 9 Without Brute Force: Let an Agent Drive It, or Follow This Manual Checklist

Tue, 12 May 2026 19:00:00 +0800

Short version

Upgrading Proxmox VE 8 to 9 is not just copying a few commands. It is a major system upgrade from Debian Bookworm to Trixie, from PVE 8.4 to PVE 9.x, with kernel, storage, networking, Ceph, and HA behavior in the blast radius. The fastest practical path is to let Codex, Claude, OpenClaw, HermesAgent, or a similar Agent handle checks, command sequencing, logging, and post-upgrade verification. The human operator still needs to approve repository changes, package removals, configuration prompts, reboot timing, and recovery decisions. If you prefer doing everything by hand, the second half of this article gives a concrete manual checklist.

This article is for two groups of operators. The first group already uses Agents over SSH and wants a scoped one-sentence task for upgrading PVE. The second group prefers typing every command manually and wants a clear, ordered procedure with the main risk points called out.

All hostnames, addresses, repositories, tokens, and accounts in this article are placeholders. Replace values such as <PVE_NODE>, <BACKUP_TARGET>, and <ADMIN_CONSOLE> with your own environment. Before touching a production host, read the official Proxmox documentation and verify that your backups are restorable.

[Transfer] Installing and Configuring an ImmortalWrt Bypass Router

Mon, 11 May 2026 21:10:55 +0800

This article is a full English translation of Egg Targaryen’s “ImmortalWrt旁路由安装与配置”. The original article is published under the CC BY-NC-SA 4.0 license. The operation order and screenshots are preserved, with minor formatting adjustments for this site.

[Transfer] Synology DiskStation Administration CLI Guide: Reading Notes and Command Cheatsheet

Thu, 30 Apr 2026 18:14:05 +0800

Short version

Synology’s official CLI administration guide is not a beginner manual for the DSM web interface. It is a compact reference for scripting, automation, and system integration. The useful parts cover local users, local groups, shared folders, network configuration, service management, Windows workgroup or ADS domain settings, and DSM error numbers.

This post is an English reading note and command cheatsheet based on Synology’s official PDF, CLI Administrator Guide for Synology NAS. Because the original PDF is a copyrighted Synology document, this post does not reproduce or translate the full document verbatim. Instead, it reorganizes the material into a bilingual blog-friendly guide for quick reading and daily operations. For exact wording, parameter definitions, version-specific behavior, and legal notices, use the official PDF linked at the end.

Resize the disk of an Ubuntu VM in PVE — the complete workflow from Web UI to guest OS

Mon, 23 Mar 2026 10:30:00 +0800

Preface When you manage a virtualized environment with Proxmox VE, running out of disk space is only a matter of time. Maybe your Ubuntu VM keeps pulling more Docker images, or maybe database logs fill up the root partition. In short, disk expansion is a must-have skill for PVE operations. This article walks through the entire process, from resizing the virtual disk in the PVE Web UI to expanding LVM inside the Ubuntu guest, step by step.

1 Why do we need to resize?

PVE usually allocates a fixed-size virtual disk when a VM is created, for example 32 GB. As the workload grows, that space may no longer be enough. Fortunately, PVE supports online disk expansion, and Ubuntu’s default LVM setup also supports dynamic logical volume expansion. Together, they make the process very convenient.

The past and present life of SSH key algorithm Ed25519 and RSA, and how to use it today

Mon, 02 Mar 2026 09:00:00 +0800

Many people’s first contact with SSH starts with a line of commands: There is nothing wrong with this command, but there is an often overlooked issue behind it: Are we talking about “RSA key type” or ssh-rsa “signature algorithm”? These two concepts are used interchangeably in many old tutorials, leading many people to think that they are “still using old and unsafe solutions” and at the same time don’t know how to migrate, and even repeatedly step into pitfalls between new systems and old devices.