VPS新机开荒手册

一、基础测试#

1.1 融合怪性能测试#

1
bash <(wget -qO- --no-check-certificate https://gitlab.com/spiritysdx/za/-/raw/main/ecs.sh)

覆盖 CPU、内存、磁盘 I/O、网络速度、路由追踪、运营商信息。

1.2 IP 流媒体与信誉测试#

1
bash <(curl -sL IP.Check.Place)

检测 Netflix / Disney+ / YouTube 解锁、Google / Cloudflare 可用性、IP 信誉、DNS 泄露等。

二、系统更新与安全加固#

2.1 系统更新#

1
# Ubuntu / Debian
2
apt update && apt upgrade -y
3

4
# CentOS / RHEL
5
yum update -y
6

7
# AlmaLinux / Rocky Linux / openEuler
8
dnf update -y

2.2 SSH 安全加固#

修改端口（可选）：

1
sed -i 's/#Port 22/Port 2222/' /etc/ssh/sshd_config
2
systemctl restart sshd

启用密钥登录、禁用密码登录：

1
# 本地生成密钥
2
ssh-keygen -t ed25519
3

4
# 上传公钥
5
ssh-copy-id -p 22 user@your-server-ip
6

7
# 服务端调整
8
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
9
sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
10
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
11
systemctl restart sshd

关闭密码登录前务必确认密钥登录可用，避免把自己锁在门外。

2.3 防火墙#

UFW：

1
ufw allow 22/tcp
2
ufw allow 80/tcp
3
ufw allow 443/tcp
4
ufw enable
5
ufw status

Firewalld：

1
firewall-cmd --permanent --add-service=ssh
2
firewall-cmd --permanent --add-service=http
3
firewall-cmd --permanent --add-service=https
4
firewall-cmd --reload
5
firewall-cmd --list-all

2.4 Fail2Ban#

1
apt install fail2ban -y        # Debian / Ubuntu
2
yum install fail2ban -y        # CentOS / RHEL
3
systemctl enable --now fail2ban

2.5 创建普通用户#

1
adduser username
2
usermod -aG sudo username      # Debian / Ubuntu
3
usermod -aG wheel username     # CentOS / RHEL
4
su - username

三、常用工具#

3.1 基础工具包#

1
apt install -y vim curl wget git htop net-tools unzip zip tar gzip jq
2
# 或
3
yum install -y vim curl wget git htop net-tools unzip zip tar gzip jq

3.2 Zsh + Oh My Zsh#

1
apt install zsh -y
2
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
3
chsh -s $(which zsh)

3.3 Tmux#

1
apt install tmux -y
2
tmux new -s dev            # 新建会话
3
tmux attach -t dev         # 附加
4
tmux ls                    # 列表
5
# Ctrl+B D 脱离会话

四、Docker 环境#

4.1 Docker 安装#

1
curl -fsSL https://get.docker.com | bash
2
systemctl enable --now docker
3

4
# 国内镜像加速
5
mkdir -p /etc/docker
6
cat > /etc/docker/daemon.json <<EOF
7
{
8
  "registry-mirrors": [
9
    "https://docker.mirrors.ustc.edu.cn",
10
    "https://registry.docker-cn.com"
11
  ]
12
}
13
EOF
14
systemctl daemon-reload
15
systemctl restart docker
16

17
usermod -aG docker $USER
18
newgrp docker
19
docker run hello-world

4.2 Docker Compose v2#

1
mkdir -p /usr/local/lib/docker/cli-plugins
2
curl -SL https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$(uname -m) \
3
  -o /usr/local/lib/docker/cli-plugins/docker-compose
4
chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
5
docker compose version

4.3 常用容器#

Nginx Proxy Manager：

1
version: '3'
2
services:
3
  app:
4
    image: jc21/nginx-proxy-manager:latest
5
    ports:
6
      - '80:80'
7
      - '81:81'
8
      - '443:443'
9
    environment:
10
      DB_MYSQL_HOST: db
11
      DB_MYSQL_PORT: 3306
12
      DB_MYSQL_USER: npm
13
      DB_MYSQL_PASSWORD: npm
14
      DB_MYSQL_NAME: npm
15
    volumes:
16
      - ./data:/data
17
      - ./letsencrypt:/etc/letsencrypt
18
  db:
19
    image: jc21/mariadb-aria:latest
20
    environment:
21
      MYSQL_ROOT_PASSWORD: npm
22
      MYSQL_DATABASE: npm
23
      MYSQL_USER: npm
24
      MYSQL_PASSWORD: npm
25
    volumes:
26
      - ./mysql:/var/lib/mysql

Watchtower 自动更新：

1
docker run -d --name watchtower \
2
  -v /var/run/docker.sock:/var/run/docker.sock \
3
  containrrr/watchtower --cleanup --schedule "0 0 4 * * *"

五、面板服务#

5.1 1Panel#

1
bash <(curl -sSL https://linuxmirrors.cn/docker.sh)
2
bash -c "$(curl -sSL https://resource.fit2cloud.com/1panel/package/v2/quick_start.sh)"

覆盖网站、数据库（MySQL / PostgreSQL / MongoDB）、文件、备份、日志、应用商店、监控中心等。

5.2 宝塔面板#

1
# Ubuntu / Debian
2
wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh && bash install.sh
3
# CentOS
4
wget -O install.sh http://download.bt.cn/install/install_6.0.sh && bash install.sh

5.3 CasaOS（家庭服务器）#

1
curl -fsSL https://get.casaos.io | sudo bash

六、代理工具#

6.1 3X-UI#

1
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

常用命令：

1
x-ui start | stop | restart | status | update | uninstall

6.2 Sing-box#

1
docker run -d --name sing-box --network host \
2
  -v $(pwd)/config:/etc/sing-box \
3
  -v $(pwd)/certs:/root/certs \
4
  ghcr.io/sagernet/sing-box:latest

七、监控与备份#

7.1 Uptime Kuma#

1
version: '3'
2
services:
3
  uptime-kuma:
4
    image: louislam/uptime-kuma:1
5
    container_name: uptime-kuma
6
    ports:
7
      - "3001:3001"
8
    volumes:
9
      - ./uptime-kuma-data:/app/data
10
    restart: always

7.2 Prometheus + Grafana#

1
version: '3'
2
services:
3
  prometheus:
4
    image: prom/prometheus:latest
5
    ports: ["9090:9090"]
6
    volumes:
7
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
8
      - ./prometheus-data:/prometheus
9
    restart: always
10
  grafana:
11
    image: grafana/grafana:latest
12
    ports: ["3000:3000"]
13
    volumes:
14
      - ./grafana-data:/var/lib/grafana
15
    environment:
16
      - GF_SECURITY_ADMIN_USER=admin
17
      - GF_SECURITY_ADMIN_PASSWORD=your_password
18
    restart: always
19
  node-exporter:
20
    image: prom/node-exporter:latest
21
    ports: ["9100:9100"]
22
    volumes:
23
      - /proc:/host/proc:ro
24
      - /sys:/host/sys:ro
25
      - /:/rootfs:ro
26
    command:
27
      - '--path.procfs=/host/proc'
28
      - '--path.sysfs=/host/sys'
29
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
30
    restart: always

7.3 AList 网盘挂载#

1
version: '3'
2
services:
3
  alist:
4
    image: xhofe/alist:latest
5
    ports: ["5244:5244"]
6
    volumes:
7
      - ./alist-data:/opt/alist/data
8
    environment:
9
      - PUID=1000
10
      - PGID=1000
11
      - UMASK=022
12
    restart: always

7.4 Restic 增量备份#

1
apt install restic -y
2
restic init --repo /backup/restic-backup
3
restic backup /important/data --repo /backup/restic-backup
4
restic restore latest --target /restore/path --repo /backup/restic-backup
5
restic snapshots --repo /backup/restic-backup

7.5 Rclone 云同步#

1
curl https://rclone.org/install.sh | sudo bash
2
rclone config
3
rclone sync /local/path remote:bucket/path
4
# crontab 定时
5
# 0 2 * * * /usr/bin/rclone sync /local/path remote:bucket/path

7.6 Docker 卷备份脚本#

1
#!/bin/bash
2
BACKUP_DIR="/backup/docker"
3
DATE=$(date +%Y%m%d_%H%M%S)
4

5
docker run --rm \
6
  -v your_container_volume:/data:ro \
7
  -v $BACKUP_DIR:/backup \
8
  alpine tar czf /backup/volume_backup_$DATE.tar.gz -C /data .
9

10
find $BACKUP_DIR -name "volume_backup_*.tar.gz" -mtime +7 -delete

八、性能优化#

8.1 文件描述符#

1
echo "* soft nofile 65536" >> /etc/security/limits.conf
2
echo "* hard nofile 65536" >> /etc/security/limits.conf

8.2 TCP 参数#

1
cat >> /etc/sysctl.conf <<EOF
2
fs.file-max = 1000000
3
fs.inotify.max_user_instances = 8192
4

5
net.ipv4.tcp_fastopen = 3
6
net.ipv4.tcp_slow_start_after_idle = 0
7
net.ipv4.tcp_max_syn_backlog = 8192
8
net.core.netdev_max_backlog = 8192
9
net.core.somaxconn = 8192
10
net.ipv4.tcp_tw_reuse = 1
11
net.ipv4.ip_local_port_range = 1024 65535
12
net.ipv4.tcp_fin_timeout = 15
13
net.ipv4.tcp_keepalive_time = 600
14
net.ipv4.tcp_keepalive_intvl = 30
15
net.ipv4.tcp_keepalive_probes = 3
16
EOF
17
sysctl -p

8.3 Swap#

1
dd if=/dev/zero of=/swapfile bs=1M count=2048
2
chmod 600 /swapfile
3
mkswap /swapfile
4
swapon /swapfile
5
echo '/swapfile none swap sw 0 0' >> /etc/fstab
6
echo 'vm.swappiness=10' >> /etc/sysctl.conf
7
sysctl -p

8.4 BBR#

1
cat >> /etc/sysctl.conf <<EOF
2
net.core.default_qdisc=fq
3
net.ipv4.tcp_congestion_control=bbr
4
EOF
5
sysctl -p
6
sysctl net.ipv4.tcp_available_congestion_control
7
lsmod | grep bbr

九、实用脚本#

9.1 系统信息#

1
cat > ~/info.sh <<'EOF'
2
#!/bin/bash
3
echo "==========================================="
4
echo "           系统信息查询"
5
echo "==========================================="
6
echo "操作系统：$(cat /etc/os-release | grep PRETTY_NAME | cut -d '"' -f2)"
7
echo "内核版本：$(uname -r)"
8
echo "CPU 型号：$(lscpu | grep "Model name" | cut -d':' -f2 | xargs)"
9
echo "CPU 核心数：$(nproc)"
10
echo "内存总量：$(free -h | grep Mem | awk '{print $2}')"
11
echo "已用内存：$(free -h | grep Mem | awk '{print $3}')"
12
echo "磁盘空间："
13
df -h | grep -E '^/dev/'
14
echo "外网 IP：$(curl -s cip.cc)"
15
echo "==========================================="
16
EOF
17
chmod +x ~/info.sh

9.2 Docker 清理#

1
cat > ~/docker-clean.sh <<'EOF'
2
#!/bin/bash
3
docker image prune -f
4
docker container prune -f
5
docker volume prune -f
6
EOF
7
chmod +x ~/docker-clean.sh

十、注意事项#

禁用密码登录前必须先验证密钥登录
定期更新系统与容器镜像
防火墙只放行必要端口
面板端口建议改默认值并配置访问白名单
代理相关工具在部署前先确认当地合规要求
重要数据至少遵循”本地 + 异地”双副本原则

总结#

新手：1Panel / 宝塔面板，图形化管理
进阶：Docker + Compose，手写 yaml，灵活度高
家庭用户：CasaOS
企业/生产：完整监控 + 告警 + 备份方案