Sysadmin on Margrop Blog

Cross-Border VPS Feels Glacial? One Kernel Sysctl Speeds International Links 20×

Thu, 02 Jul 2026 20:00:00 +0800

The short version

You’re accessing your overseas VPS from within China. SSH feels snappy. curl on a small JSON endpoint returns instantly. But downloading a 2 MB HTML file takes over a minute. Convinced it’s “peak-hour international link congestion”? Probably not — you’re being sabotaged by Linux’s default CUBIC congestion control. CUBIC treats every packet loss as “the road ahead is jammed” and immediately backs off. But international links have baseline 5–15% loss from physical-layer imperfections, not congestion. So your TCP flow gets permanently stuck in slow-mo. Switch to Google’s BBR algorithm and the exact same physical path, same moment, same loss rate delivers 15–24× more throughput.

This post walks through a real mesh-VPN investigation: pulling a 2.3 MB page from a US VPS across a Chinese home connection went from 30 KB/s to 500–1000 KB/s after four shell commands. It ships three one-shot scripts (Windows 11 / Ubuntu 26.04 / macOS 26), covering both manual execution and AI-agent-driven deployment. All internal IPs, hostnames, and public IPs have been redacted.

VPN Connected, But Internal Hostnames Won't Resolve? A Complete macOS Routing Table Walkthrough

Mon, 01 Jun 2026 18:00:00 +0800

TL;DR:

When two VPNs run side-by-side on macOS (e.g. utun0 and utun15), an aggregate 10.0.0.0/8 route pushed by one of them can silently “swallow” every address in the 10.x.x.x range — including the one you actually wanted to reach on the other VPN. DNS resolves fine; TCP/ICMP just hangs. route -n get is the first knife you should reach for.

Home Network 1000Mbps but Games Stutter? A Complete Guide to Diagnosing and Fixing Bufferbloat

Sat, 30 May 2026 09:00:00 +0800

The Short Version

Your router has a hidden enemy called Bufferbloat — and it’s likely the reason your games lag even when your bandwidth test shows perfect speeds. When a router buffers too aggressively, download traffic fills up the queue and real-time traffic (games, video calls) gets stuck waiting behind thousands of buffered packets. Your speedtest stays at 950Mbps, but your game ping explodes from 50ms to 500ms.

In this article, I walk through the complete diagnosis and resolution of a Bufferbloat problem in a real home network environment using a multi-WAN iKuai gateway + ImmortalWrt soft router setup. The fix: deploying SQM (Smart Queue Management) + Cake qdisc on the ImmortalWrt layer, which reduced latency under full-speed download from ~300ms+ down to a stable ~12ms with zero configuration complexity.

All internal IP addresses, device hostnames, and network topologies have been sanitized for privacy.

Python App in macOS LaunchAgent Can't Reach the Internet? Here's the httpx Proxy Trap You Need to Know

Sat, 30 May 2026 09:00:00 +0800

TL;DR:

When a Python application using httpx with trust_env=True runs inside a macOS LaunchAgent, it silently picks up the system proxy settings from scutil --proxy. But the LaunchAgent process may not be able to reach that proxy server at all — resulting in All connection attempts failed or No route to host errors.

The fix is one line: add NO_PROXY=* to the LaunchAgent’s plist EnvironmentVariables.

This article documents the full debugging journey: from discovering that my AI Agent’s WeChat Enterprise (WeCom) messages weren’t being replied to, through methodical proxy troubleshooting, to finally pinning down the root cause — macOS system proxy + LaunchAgent network isolation. We’ll dive deep into Python httpx source code, macOS proxy architecture, and the many gotchas of LaunchAgent runtime environments.

The Complete AI Agent Migration Guide: A Real-World Journey from Scratch with 9 Pitfalls and Fixes

Sat, 30 May 2026 08:00:00 +0800

TL;DR:

Migrating from one AI Agent platform to another sounds like a “copy and paste” job. In reality, it’s a systems engineering challenge involving data migration, channel integration, scheduled tasks, auto-start configuration, proxy settings, and module compatibility.

This article documents my complete migration journey: from installing the new platform, migrating memories and skills, configuring messaging channels, debugging mysterious failures, to achieving fully automated operation. 9 pitfalls encountered, 9 solutions found — all shared here.

Seamless Homelab Networking: Deploying Tailscale on Ubuntu 26.04 for Effortless Remote Access

Tue, 26 May 2026 14:00:00 +0800

The Short Version

Cross-carrier connectivity, lack of public IPv4 addresses, and multi-device connection management have always been the ultimate pain points for Homelab enthusiasts and enterprise sysadmins alike. This article provides a comprehensive, step-by-step guide on how to cleanly and securely install and configure the latest version of Tailscale on the newly released Ubuntu 26.04 (Resolute Raccoon) using the modern APT Keyring standards. Beyond a clean command-line install walkthrough, we delve into the architectural design of Tailscale, Subnet Router routing, and Exit Node proxying to establish a seamless, encrypted mesh network linking your home Synology NAS, Proxmox VE hypervisors, remote laptops, and mobile devices.

All setups and commands documented here have been rigorously tested on a clean Ubuntu 26.04 (Resolute Raccoon) environment. To prioritize safety and avoid leakage, all internal IP addresses, access tokens, routing tables, and server domains have been fully masked using generic placeholders.