Onirexus' Blog

Implementing a Simple HTTP/HTTPS Proxy Server with Golang

Tue, 09 Jun 2026 14:58:38 GMT

The complete source code for this project is available on GitHub: GitHub - KAG-Ming/simple-proxy-go

Last time we implemented a simple SOCKS5 server. Today we’re going to implement an HTTP/HTTPS proxy server. Similar to the previous project, this is for educational and practice purposes only and is not production-grade.In fact, this implementation is much simpler than SOCKS5; I probably should have started with this one.

1 HTTP/HTTPS Proxy Introduction

Technically, an HTTP proxy server is highly similar to a standard HTTP web server. Both listen for incoming TCP connections and parse HTTP request messages. However, instead of locating a static file on the local file system to serve the client, a proxy server parses the destination address from the request, establishes a new TCP connection to that target server, and forwards the data.

According to these standards, when a client configures an HTTP/HTTPS proxy, its connection life cycle and request format split into two distinct workflows depending on the scheme:

1.1 HTTP Proxy Workflow

For unencrypted HTTP requests, the client sends a request using the absolute-form uri specification. The Request-Line includes the full scheme and host:

// method(POST/GET/...) + absolute uri + http version
GET http://google.com/ HTTP/1.1

The proxy server parses the target host, establishes a TCP connection to it, forwards this entire request (including all subsequent headers), and then streams the response back to the client.

1.2 HTTPS Proxy Workflow

For encrypted HTTPS requests, the client cannot expose the plaintext uri or headers. Instead, it uses the CONNECT method to request a transparent TCP tunnel:

// CONNECT + authority + http version
CONNECT google.com:443 HTTP/1.1

The proxy server parses the authority and opens a TCP connection to the destination. Unlike the HTTP workflow, the proxy does not forward the CONNECT line. Instead, it immediately replies to the client with an HTTP status line: HTTP/1.1 200 Connection Established\r\n\r\n.

Once this response is sent, the proxy drops down to the transport layer, acting as a blind, bidirectional data forwarder for the raw TLS-encrypted traffic between the client and the destination server.

Ref

2 Overall Structure

The architecture follows a straightforward concurrent design. The main routine initializes a TCP listener on a specified port and enters a continuous loop to accept incoming client connections.

For each established connection, the server spawns a new Goroutine to handle the lifecycle independent of others.

func main() {
	addr := "127.0.0.1:8080"
	listener, err := net.Listen("tcp", addr)
	if err != nil {
		log.Fatalf("Listen failed: %v", err)
	}
	defer listener.Close()
	log.Printf("HTTP/HTTPS Server launched, listening at %s...", addr)
	
	for {
		conn, err := listener.Accept()
		if err != nil {
			log.Printf("Accept connection failed: %v", err)
			continue
		}
		go handleConnection(conn)
	}
}

The core logic inside the connection handler is split into three sequential phases:

Read and parse the initial HTTP request line from the client to determine the proxying mode and extract the destination address.
Establish a raw TCP connection to the target remote server.
Handle protocol-specific handshakes (sending a 200 OK for HTTPS, or forwarding the initial request line for HTTP) and then transition into a bidirectional data copy loop that bridges the client and upstream connections concurrently.

3 Parse the First Line of the Request

We start by creating a bufio.Reader and passing it to the parseRequestLine function.

func handleConnection(conn net.Conn) {
	defer conn.Close()
	reader := bufio.NewReader(conn)
	
	line, method, destAddr, err := parseRequestLine(reader)
	if err != nil {
		log.Printf("parse the first line error: %v", err)
		return
	}
}

We use the ReadString method to read the first line, and strings.Fields to split it into the method, address, and protocol version. Note that strings.Fields automatically strips any whitespace, including the trailing \r\n.

line, err = reader.ReadString('\n')
if err != nil {
	return "", "", "", fmt.Errorf("read the first line failed: %v", err)
}
	
fields := strings.Fields(line)
if len(fields) < 2 {
	return "", "", "", fmt.Errorf("malformed request line: %s", line)
}
method = fields[0]

Next, we extract the destination address based on the HTTP method. If the method is CONNECT, we simply return fields[1] because HTTPS requests always provide the address in a host:port format, which can be directly used later.

if method == "CONNECT" {
	// https "google.com:443"
	return line, method, fields[1], nil
}

If it is a standard HTTP request, we use url.Parse to parse the absolute URL. If the parsed host does not specify a port, we manually append the default HTTP port :80.

else {
	// http "http://google.com/"
	u, err := url.Parse(fields[1])
	if err != nil {
		return "", "", "", fmt.Errorf("parse address error: %v", err)
	}
	address = u.Host
		
	// if no port in u.Host, add :80
	if !strings.Contains(address, ":") {
		address = address + ":80"
	}
	return line, method, address, nil
}

Here is the complete function:

func parseRequestLine(reader *bufio.Reader) (line, method, address string, err error) {
	line, err = reader.ReadString('\n')
	if err != nil {
		return "", "", "", fmt.Errorf("read the first line failed: %v", err)
	}
	
	fields := strings.Fields(line)
	if len(fields) < 2 {
		return "", "", "", fmt.Errorf("malformed request line: %s", line)
	}
	method = fields[0]
	if method == "CONNECT" {
		// https "google.com:443"
		return line, method, fields[1], nil
	} else {
		// http "http://google.com/"
		u, err := url.Parse(fields[1])
		if err != nil {
			return "", "", "", fmt.Errorf("parse address error: %v", err)
		}
		address = u.Host
		
		// if no port in u.Host, add :80
		if !strings.Contains(address, ":") {
			address = address + ":80"
		}
		return line, method, address, nil
	}
}

4 Connect to the Destination Server (HTTP Forwarding & HTTPS Tunneling)

The step to establish the TCP connection to the upstream server is identical for both modes, so we keep this logic directly inside handleConnection:

// connect to the destination server
destConn, err := net.Dial("tcp", destAddr)
if err != nil {
	log.Printf("connect to the destination server error: %v", err)
	return
}
defer destConn.Close()

Then, we branch our logic depending on the method.

For HTTPS, the proxy server must intercept the request and reply with an HTTP 200 OK status line to tell the client to begin TLS negotiation.

For HTTP, the proxy must write the parsed initial request line back to the target server, as this line has already been consumed from our buffer.

if method == "CONNECT" {
	// https
	_, err = conn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
	} else {
	// http
	_, err = destConn.Write([]byte(line))
	}
	if err != nil {
		log.Printf("connect to the destination server error: %v", err)
		return
}

5 Bidirectional Data Forwarding

Finally, the proxy server functions as a transparent tunnel to forward data bidirectionally. We define a forward function to handle this:

func forward(reader io.Reader, conn, destConn net.Conn) {
	go func() {
		_, _ = io.Copy(destConn, reader)
		destConn.Close()
	}()
	_, _ = io.Copy(conn, destConn)
}

We execute io.Copy inside a new Goroutine to ensure that both data streams run concurrently.

An essential detail here is that we pass the bufio.Reader instance into the forwarding function instead of the raw conn. When we initialized bufio.NewReader(conn) to read the first line, the reader automatically prefetched and cached subsequent data bytes from the TCP buffer. Passing the raw conn would cause this buffered data to be permanently lost, corrupting the stream. Using the reader ensures that any cached bytes are drained first before io.Copy falls back to reading from the underlying socket.

6 Testing

You can validate the implementation by executing a curl command in your terminal with the proxy flag, or by configuring the proxy settings directly in your web browser.

curl -x 127.0.0.1:8080 https://google.com

7 Limitations

It handles connections strictly on a one-off basis without connection reuse.
Active connections are forcefully torn down on any error without elegant resource draining.
Standard HTTP proxies should strip hop-by-hop headers (like Proxy-Connection, Keep-Alive), which this simple implementation blindly passes through.
…

The complete source code for this project is available on GitHub: GitHub - KAG-Ming/simple-proxy-go

Implementing a Simple SOCKS5 Proxy Server with Golang

Implementing a Simple SOCKS5 Proxy Server with Golang

Sat, 06 Jun 2026 16:23:34 GMT

The complete source code for this project is available on GitHub: GitHub - KAG-Ming/simple-proxy-go

While robust, production-grade SOCKS5 libraries like GitHub - armon/go-socks5: SOCKS5 server in Golang · GitHub already exist in the Go ecosystem, I decided to build a minimalist SOCKS5 server from scratch as a learning project. Please note that this version is meant for practice and may still contain bugs.

1 SOCKS5 Introduction

SOCKS5 is a session-layer proxy protocol designed to relay diverse network protocols. It offers robust proxy capabilities, supporting both TCP and UDP (note that the UDP part is omitted here) along with flexible authentication mechanisms.

According to RFC 1928, the client initially sends its version and supported methods to negotiate with the SOCKS5 server. After authentication, it issues a connect request. The proxy server then connects to the target server and forward the data back to the client. Unlike standard TCP connections, SOCKS5 requires authentication to ensure security.

Ref: RFC 1928 - SOCKS Protocol Version 5

2 Overall Structure

Before diving into the protocol details, let’s look at the overall structure of our SOCKS5 server. We define the essential protocol constants according to RFC 1928, and implement a standard TCP listener in the main function.

To handle multiple clients concurrently, the server spawns a new Goroutine for each incoming connection, directing it to handleConnection:

const (
socks5Version = 0x05
methodNoAuth = 0x00
cmdConnect = 0x01
atypIPv4 = 0x01
atypDomain = 0x03
atypIPv6 = 0x04
statusSuccess = 0x00
statusFailure = 0x01
)
const timeoutDuration = 5 * time.Second

func main() {
	addr := "127.0.0.1:1080"
	listener, err := net.Listen("tcp", addr)
	if err != nil {
	log.Fatalf("Listen failed: %v", err)
	}

	defer listener.Close()
	log.Printf("SOCKS5 Server launched, listening at %s...", addr)  
	for {
		conn, err := listener.Accept()
		if err != nil {
		log.Printf("Accept connection failed: %v", err)
		continue
	}	
	go handleConnection(conn)
	}
}

The handleConnection function acts as the pipeline commander for each client. It perfectly mirrors the SOCKS5 life cycle by breaking it down into four distinct phases: authentication, request parsing, destination connection, and data relaying.

func handleConnection(conn net.Conn) {
	defer conn.Close()
	
	if err := socks5Auth(conn); err != nil {
		log.Printf("Auth failed from %s: %v", conn.RemoteAddr(), err)
		return
	}
	
	address, port, err := socks5ReadRequest(conn)
	if err != nil {
		log.Printf("Read request failed from %s: %v", conn.RemoteAddr(), err)
		return
	}
	  
	destConn, err := connectDestServer(conn, address, port)
	if err != nil {
		log.Printf("Connect to dest %s:%d failed: %v", address, port, err)
		return
	}
	
	defer destConn.Close()
	forward(conn, destConn)
}

With this overview in place, we can now implement each phase step by step.

3 Handshake & Authentication

The protocol begins with a negotiation phase. The client connects to the proxy server and sends an initial request specifying its protocol version and all supported authentication methods.

Field	VER	NMETHODS	METHODS
Bytes	1	1	1 to 255
Value	fixed to 0x05	Number of supported auth methods	List of supported auth method IDs

METHODS means specific methods to authenticate. For example, 0x00 for NO AUTHENTICATION, 0x02 for USERNAME/PASSWORD.

Upon receiving this request, the server must first validate the protocol version. If verified, it parses the method list to select an acceptable authentication method.

Here we create a [2]byte variable to serve as a buffer, receiving the VERSION and NMETHODS field. Notice that we use io.ReadFull rather than a standard Read. This ensures that our server blocks and waits until both bytes are completely read from the socket, preventing errors caused by partial tcp reads. If the protocol version is incorrect, we abort the connection immediately.

var buf [2]byte
if _, err := io.ReadFull(conn, buf[:2]); err != nil {
	return fmt.Errorf("read header failed: %w", err)
}
// verify VERSION == 0x05
if buf[0] != socks5Version {
	return fmt.Errorf("unsupported version: 0x%02x", buf[0])
}  
numMethods := int(buf[1])

Next, we need to read the METHODS field. Since NMETHODS is represented by a single byte, its maximum value can never exceed 255. Therefore, we can safely allocate a 256-byte array on the stack. By slicing it down to the exact length needed (methodsBuf[:numMethods]), we can efficiently read the data without triggering any dynamic dynamic-heap allocation.

var methodsBuf [256]byte
methods := methodsBuf[:numMethods]
if _, err := io.ReadFull(conn, methods); err != nil {
	return fmt.Errorf("read methods failed: %w", err)
} 
	
if !slices.Contains(methods, methodNoAuth) {
	return errors.New("no acceptable auth methods")
}

To keep it simple, here I just used the no-auth method. Finally, the handshake ends with the server sending its choice back to the client.

Field	VER	METHOD
Size	1	1
Value	0x05	Chosen method (e.g., 0x00)

We construct this 2-byte response packet and write it back to the client connection to complete the handshake:

if _, err := conn.Write([]byte{socks5Version, methodNoAuth}); err != nil {
	return fmt.Errorf("write auth response failed: %w", err)
}
return nil

The whole function is like this:

func socks5Auth(conn net.Conn) error {
	_ = conn.SetReadDeadline(time.Now().Add(timeoutDuration))
	
	// receive VERSION and NMETHODS
	var buf [2]byte
	if _, err := io.ReadFull(conn, buf[:2]); err != nil {
		return fmt.Errorf("read header failed: %w", err)
	}
	
	if buf[0] != socks5Version {
		return fmt.Errorf("unsupported version: 0x%02x", buf[0])
	}  
	numMethods := int(buf[1])
	
	// choose a method to authenticate
	var methodsBuf [256]byte
	methods := methodsBuf[:numMethods]
	if _, err := io.ReadFull(conn, methods); err != nil {
		return fmt.Errorf("read methods failed: %w", err)
	} 
	
	if !slices.Contains(methods, methodNoAuth) {
		return errors.New("no acceptable auth methods")
	}
	
	_ = conn.SetReadDeadline(time.Time{}) 
	
	// write back to the client
	if _, err := conn.Write([]byte{socks5Version, methodNoAuth}); err != nil {
		return fmt.Errorf("write auth response failed: %w", err)
	}
	return nil
}

Once the handshake is complete, usually an authentication sub-negotiation stage would occur here. However, since we selected the no-auth method, we skip straight to parsing the client’s connection request.

4 Client Request Parsing

According to RFC 1928, the client sends a request packet formatted as follows:

Field	VER	CMD	RSV	ATYP	DST.ADDR	DST.PORT
Bytes	1	1	1	1	Variable	2
Value	`0x05`	CONNECT `0x01` BIND `0x02` UDP ASSOCIATE `0x03`	`0x00`	IPV4 `0x01` DOMAIN `0x03` IPV6 `0x04`	desired destination address	desired destination port in network octet order
To begin parsing, we read the first 4 bytes (`VER`, `CMD`, `RSV`, and `ATYP`) into a static buffer and validate the flags immediately.

var buf [4]byte
if _, err := io.ReadFull(conn, buf[:4]); err != nil {
	return "", 0, fmt.Errorf("read request header failed: %w", err)
}
// validate version, command (CONNECT only), and the reserved
if buf[0] != socks5Version || buf[1] != cmdConnect || buf[2] != 0x00 {
	return "", 0, errors.New("invalid request header flags")
}

Next, we extract the destination host based on the address type. Since the length and structure of DST.ADDR depend entirely on ATYP, we use a switch statement to process each case.

var host string
atyp := buf[3]

switch atyp {
case atypIPv4:
	// ipv4 address has a fixed size of 4 bytes
	var ipBuf [4]byte
	if _, err := io.ReadFull(conn, ipBuf[:]); err != nil {
		return "", 0, fmt.Errorf("read IPv4 failed: %w", err)
	}
	host = net.IP(ipBuf[:]).String() 

case atypDomain:
	// for domain names, the first byte indicates the length of the domain string
	var lenBuf [1]byte
	if _, err := io.ReadFull(conn, lenBuf[:]); err != nil {
		return "", 0, fmt.Errorf("read domain length failed: %w", err)
	}
			
	domainLen := int(lenBuf[0])
	domainBuf := make([]byte, domainLen)
	if _, err := io.ReadFull(conn, domainBuf); err != nil {
		return "", 0, fmt.Errorf("read domain name failed: %w", err)
	}
	host = string(domainBuf)

case atypIPv6:
	// ipv6 address has a fixed size of 16 bytes
	var ipBuf [16]byte
	if _, err := io.ReadFull(conn, ipBuf[:]); err != nil {
		return "", 0, fmt.Errorf("read IPv6 failed: %w", err)
	}
	host = net.IP(ipBuf[:]).String()

default:
	return "", 0, fmt.Errorf("unsupported address type: 0x%02x", atyp)
}

Finally, we read the last 2 bytes containing the destination port. Because network protocols transmit data using Big-Endian byte order, we leverage Go’s binary.BigEndian.Uint16 to decode the raw bytes into a standard native integer.

var portBuf [2]byte
if _, err := io.ReadFull(conn, portBuf[:]); err != nil {
	return "", 0, fmt.Errorf("read port failed: %w", err)
}
	
port := int(binary.BigEndian.Uint16(portBuf[:]))
return host, port, nil

The function in this part:

func socks5ReadRequest(conn net.Conn) (string, int, error) {
	// Set a read deadline to prevent slow-loris attacks or hung connections
	_ = conn.SetReadDeadline(time.Now().Add(timeoutDuration))
	
	// read and validate the fixed 4-byte header
	var buf [4]byte
	if _, err := io.ReadFull(conn, buf[:4]); err != nil {
		return "", 0, fmt.Errorf("read request header failed: %w", err)
	}
	if buf[0] != socks5Version || buf[1] != cmdConnect || buf[2] != 0x00 {
		return "", 0, errors.New("invalid request header flags")
	}
	
	// parse the target destination address based on ATYP
	var host string
	atyp := buf[3]
	switch atyp {
		case atypIPv4:
			var ipBuf [4]byte
			if _, err := io.ReadFull(conn, ipBuf[:]); err != nil {
				return "", 0, fmt.Errorf("read IPv4 failed: %w", err)
			}
			host = net.IP(ipBuf[:]).String() 
			
		case atypDomain:
			var lenBuf [1]byte
			if _, err := io.ReadFull(conn, lenBuf[:]); err != nil {
				return "", 0, fmt.Errorf("read domain length failed: %w", err)
			}
			
			domainLen := int(lenBuf[0])
			domainBuf := make([]byte, domainLen)
			if _, err := io.ReadFull(conn, domainBuf); err != nil {
				return "", 0, fmt.Errorf("read domain name failed: %w", err)
			}
			host = string(domainBuf)
			
		case atypIPv6:
			var ipBuf [16]byte
			if _, err := io.ReadFull(conn, ipBuf[:]); err != nil {
				return "", 0, fmt.Errorf("read IPv6 failed: %w", err)
			}
			host = net.IP(ipBuf[:]).String()
			
		default:
			return "", 0, fmt.Errorf("unsupported address type: 0x%02x", atyp)
	}
	
	// read and decode the 2-byte port number
	var portBuf [2]byte
	if _, err := io.ReadFull(conn, portBuf[:]); err != nil {
		return "", 0, fmt.Errorf("read port failed: %w", err)
	}
	
	// reset the deadline before returning control to the connection pipeline
	_ = conn.SetReadDeadline(time.Time{})
	
	port := int(binary.BigEndian.Uint16(portBuf[:]))
	return host, port, nil
}

5 Connecting & Replying

Now that the target address and port have been successfully extracted from the client’s request, our proxy server enters the execution phase. Its mission here is two-fold: establish a real tcp connection to the remote destination server, and report the outcome back to the client.

First, we combine the destination address and integer port into a standard network string using net.JoinHostPort (which handles both IPv4 and IPv6 formatting gracefully). Then, we initiate a standard tcp connection using net.DialTimeout to prevent the proxy worker from hanging indefinitely on dead remote servers.

destAddr := net.JoinHostPort(address, strconv.Itoa(port))
destConn, err := net.DialTimeout("tcp", destAddr, timeoutDuration)

If the connection attempt fails (e.g., due to a network timeout, a blocked port, or an invalid address), the proxy server must inform the client before aborting. This error reporting is done by sending a reply packet back to the client with an appropriate error status code (0x01 for general failure).

According to RFC 1928, the server’s reply packet is structured as follows:

Field	VER	REP	RSV	ATYP	BND.ADDR	BND.PORT
Bytes	1	1	1	1	Variable	2
Value	fixed to 0x05	succeeded `0x00`	`0x00`	`0x01` `0x03` `0x04`	server bound address	server bound port in network octet order

The final 2 fields represent the specific local IP address and ephemeral port that the proxy server used on its outbound interface to connect to the target server. In a minimalist implementation, the client rarely needs to know which local port the proxy assigned for the outbound connection. Therefore, we can safely set ATYP to 0x01 and fill both BND.ADDR and BND.PORT entirely with zeros.

if err != nil {
	_, _ = conn.Write([]byte{socks5Version, statusFailure, 0x00, atypIPv4, 0, 0, 0, 0, 0, 0})
	return nil, err
}

If the proxy server successfully establishes the tcp connection with the target server, it must send a success reply to the client. This handshake reply allows the client to know that the control channel is ready to transition into a pure data-relaying pipeline.

if _, err := conn.Write([]byte{0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0}); err != nil {
destConn.Close()
	return nil, fmt.Errorf("write success reply failed: %w", err)
}
return destConn, nil

The complete function in this part:

func connectDestServer(conn net.Conn, address string, port int) (net.Conn, error) {
	// format the destination address and dial the target server
	destAddr := net.JoinHostPort(address, strconv.Itoa(port))
	destConn, err := net.DialTimeout("tcp", destAddr, timeoutDuration)
	// handle connection failure by replying to the client
	if err != nil {
		_, _ = conn.Write([]byte{socks5Version, statusFailure, 0x00, atypIPv4, 0, 0, 0, 0, 0, 0})
		return nil, err
	}
	
	// confirm success to the client
	if _, err := conn.Write([]byte{0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0}); err != nil {
	destConn.Close()
		return nil, fmt.Errorf("write success reply failed: %w", err)
	}
	
	return destConn, nil
}

6 Data Forwarding

After establishing the connection to the destination server, the proxy server just needs to do bidirectional data forwarding.

Go provides io.Copy(dst, src), which is ideal for this task. It continuously reads data from a source and writes it to a destination until it encounters an EOF or a network error.

Since a tcp connection is full-duplex, we need to handle the two separate data streams simultaneously. Because io.Copy is a synchronous, blocking function, it will not return until the stream is closed. If we try to run both copy operations sequentially in a single execution thread, the first line will block the program, and the second line will never execute:

io.Copy(destConn, conn)
io.Copy(conn, destConn)

To enable both data streams to run concurrently, we use a new Goroutine, which offloads one of the io.Copy operations to the background, allowing both upload and download traffic to flow at the same time:

func forward(conn, destConn net.Conn) {
	go func() {
		_, _ = io.Copy(destConn, conn)
		destConn.Close() // close the destination connection when the upload ends
	}()
	
	_, _ = io.Copy(conn, destConn)
}

Now we’ve completed this simple SOCKS5 server with Golang.

7 Testing

To verify that the server works correctly, execute the following command in your local terminal (adjust the address if your proxy server is running on a different host or port):

curl --socks5 127.0.0.1:1080 http://httpbin.org/ip

If the command successfully returns the proxy server’s outbound ip address and no error logs appear in your server’s console, your simple SOCKS5 server is fully functional.

8 Limitations

The server only supports the unauthenticated method and lacks the capability to verify user credentials.
The routing pipeline strictly processes TCP streams and lacks the mechanism to handle UDP associations.
Active connections are instantly severed when the process terminates, lacking a proper resource draining and connection-closing lifecycle.
…

The complete source code for this project is available on GitHub: GitHub - KAG-Ming/simple-proxy-go

Implementing a Simple HTTP/HTTPS Proxy Server with Golang

DN42 Peering Information

Mon, 01 Jun 2026 18:19:54 GMT

Welcome to my DN42 network page. I am open to peering with other nodes to expand the network and experiment with BGP routing. If you’d like to peer with me, please check the details below and feel free to reach out.

My Network Info

ASN: AS4242423423
IPv4: 172.20.210.96/27
IPv6: fd36:5c96:7310::/48

Nodes

Node 1: US01

Endpoint/Port: Please contact me to exchange endpoint details.
Tunnel Type: WireGuard
Supported Protocols: IPv4/IPv6 Link-Local, Multiprotocol BGP (MP-BGP)
BGP Software: Bird2

If you want to peer with me, please provide your ASN, DN42 IPs, WireGuard Public Key, Endpoint, and Port when contacting me.

Core Vector Calculus Theorems and Operational Rules

Mon, 01 Jun 2026 17:51:32 GMT

Source: Reddit - I made a little graphic for the Fundamental Theorems of Calc III

1 Unified Framework: Generalized Stokes’ Theorem

All fundamental theorems of vector calculus are specific dimensional cases of the Generalized Stokes’ Theorem:

$\int_{\Omega} d\omega = \int_{\partial \Omega} \omega$

Where $\Omega$ represents the interior region, $\partial \Omega$ denotes its boundary, and $d\omega$ represents the exterior derivative. The core principle is that the integration of a derivative over a domain equals the integration of the original form over its boundary.

1D: Fundamental Theorem of Calculus

Formula: $\int_a^b f'(x) \, dx = f(b) - f(a)$
Domain: 1D interval $[a, b]$ with 0D boundary endpoints $a$ and $b$ .

2D: Green’s Theorem

Formula: $\iint_D \left( \frac{\partial Q}{\partial x} - \frac{\partial P}{\partial y} \right) \, dxdy = \oint_C (P\,dx + Q\,dy)$
Domain: 2D planar region $D$ bounded by a 1D closed curve $C$ .

3D Surfaces: Stokes’ Theorem (Curl Theorem)

Formula: $\iint_S (\nabla \times \mathbf{F}) \cdot d\mathbf{S} = \oint_{\partial S} \mathbf{F} \cdot d\mathbf{r}$
Interpretation: The surface integral of the curl of a vector field $\mathbf{F}$ over an open surface $S$ equals the line integral of $\mathbf{F}$ along the boundary curve $\partial S$ .

3D Volumes: Gauss’s Theorem (Divergence Theorem)

Formula: $\iiint_V (\nabla \cdot \mathbf{F}) \, dV = \oiint_{\partial V} \mathbf{F} \cdot d\mathbf{S}$
Interpretation: The volume integral of the divergence of a vector field $\mathbf{F}$ over a solid $V$ equals the net flux of $\mathbf{F}$ passing through the closed bounding surface $\partial V$ .

2 Operational Rules of the Del ( $\nabla$ ) Operator

The del operator $\nabla$ functions simultaneously as a vector and a differential operator. When applied to products, it follows the product rule (Leibniz rule) rather than the chain rule.

Vector Identity: $\nabla \times (\varphi \mathbf{A})$

$\nabla \times (\varphi \mathbf{A}) = \varphi (\nabla \times \mathbf{A}) + (\nabla \varphi) \times \mathbf{A}$

Derivation and Structural Mechanics:
By applying the product rule, $\nabla$ differentiates $\varphi$ and $\mathbf{A}$ sequentially:

When differentiating $\mathbf{A}$ , the scalar field $\varphi$ acts as a constant coefficient and is factored out, yielding $\varphi (\nabla \times \mathbf{A})$ .
When differentiating $\varphi$ , $\nabla$ operates directly on the scalar to produce the gradient vector $\nabla \varphi$ . The underlying cross product structure ( $\times$ ) with the remaining vector field $\mathbf{A}$ must be preserved, yielding $(\nabla \varphi) \times \mathbf{A}$ .

This can be verified by expanding the $x$ -component using partial derivatives:
$\left[\nabla \times (\varphi \mathbf{A})\right]_x = \frac{\partial}{\partial y}(\varphi A_z) - \frac{\partial}{\partial z}(\varphi A_y)$
Applying the standard product rule:
$= \left( \varphi \frac{\partial A_z}{\partial y} + A_z \frac{\partial \varphi}{\partial y} \right) - \left( \varphi \frac{\partial A_y}{\partial z} + A_y \frac{\partial \varphi}{\partial z} \right)$
Rearranging the terms:
$= \varphi \left( \frac{\partial A_z}{\partial y} - \frac{\partial A_y}{\partial z} \right) + \left( \frac{\partial \varphi}{\partial y}A_z - \frac{\partial \varphi}{\partial z}A_y \right) = \left[ \varphi (\nabla \times \mathbf{A}) + (\nabla \varphi) \times \mathbf{A} \right]_x$

3 Summary

Theorem	Interior ( $\Omega$ )	Boundary ( $\partial \Omega$ )	Operator
Fundamental Theorem	1D Segment	0D Endpoints	$d/dx$
Stokes’ Theorem	2D Surface	1D Curve	Curl ( $\nabla \times$ )
Divergence Theorem	3D Volume	2D Closed Surface	Divergence ( $\nabla \cdot$ )

Basic Latin Grammar

Mon, 01 Jun 2026 09:00:02 GMT

Verb Conjugations

Latin verbs change their endings on the subject.

1st person singular: -o
2nd person singular: -is/-es
3rd person singular: -t
infinitive form(to do): -re
eg:

Subject	studere	scribere	legere	dormire	laborare	docere	videre
ego	studeo	scribo	lego	dormio	laboro	doceo	video
tu	studes	scribis	legis	dormis	laboras	doces	vides
(it)	studet	scribit	legit	dormit	laborat	docet	videt

Sentence Structure

Latin uses word endings to show that role a noun plays in a sentence. Object: -m
eg:

Magistra discipulam docet.
Poeta epistulam scribit.

Possession

To show ownership or relationships(“of”), Latin changes the ending to -ae.
eg:

Discipulae magistra=Magistra discipulae
Discipula epistulam magistrae scribit.

Adjectives and Noun-adjectives

eg:

Longam epistulam scribo.
Magistra magnam discipulam docet.
Magistra magna discipulam docet.

Conjunctions and Adverbs

et=and
sed=but
quod=because
non = not
qui=who
nemo=no one

Migrating ShokaX Theme Blog From Hexo to Astro

Thu, 28 May 2026 00:05:02 GMT

Seeing that shokaX-hexo is planning to migrate to Astro, I decided to migrate my own blog as well. Astro offers superior performance compared to Hexo and represents modern best practices, whereas Hexo is becoming a bit outdated.

Following the recommendations from ShokaX, I performed the migration roughly in the following order. You can refer to the official. ShokaX Astro Blog Theme

Setting Up the Astro Environment

Locally install bun.sh:

curl -fsSL https://bun.sh/install | bash
# or
npm install -g bun

Then fork the ShokaX github repo to your own account, then git clone it.

git clone https://github.com/your-user-name/astro-blog-shokax.git
cd astro-blog-shokax

Install requirements and launch the development environment:

bun install
bun run dev

Now you can visit http://localhost:4321 in your browser to preview your blog.

Copying Articles To New Directory

Hexo articles reside in source/_posts/, while Astro stores them in src/posts. The directory structures are mostly similar. Just copy your markdown files to the new directory (the existing subdirectory structure can be preserved). Move pictures to src/assets/images.

After doing this, you may encounter several build errors. While most solutions can be found in the official docs, some undocumented issues I occurred are recorded below:

Front-matter: Cover, Tags & Categories

Cover can’t be a remote URL. You can download the images and use the relative path. Or ShokaX may add this feature in the future.

And Tags and Categories must be wrapped by [] now.

Callouts Only Render In .mdx

If you use callouts in a plain .md file, the styling and effects will not render properly. Use .mdx extensions for these files.

Configuring Astro

It’s highly recommended that not to modify the default setting src/toolkit/themeConfig.defaults.ts directly. Instead, copy it to src/theme.config.ts and edit here. And change export const DEFAULT_THEME_CONFIG: ShokaXThemeConfig = { to export default defineConfig({.

While editing this configuration file, you might encounter unexpected build errors. If that happens, you can manually clear the cache and rebuild: rm -rf .astro && bun run build.

Most configurations are detailed in the official documentation, so I will only highlight the unlisted ones here:

The official docs mention that href cannot be null. To prevent a parent navigation menu from triggering a redirect when clicked, configure it with href: "javascript:void(0);". Here is an example of a plain drop-down menu:

  {
      text: "Tools",
      href: "javascript:void(0);",
      icon: "i-ri-tools-line",
      dropbox: {
        enable: true,
        items: [
          {
            href: "url1",
            text: "Server Status",
            icon: "i-ri-server-line",
          },
          {
            href: "url2",
            text: "Online Clipboard",
            icon: "i-ri-clipboard-line",
          },
          {
            href: "url3",
            text: "Temporary Email",
            icon: "i-ri-mail-open-line",
          },
        ],
      },
    },

Changing Favicon

To replace the default favicon, create a public folder and place your favicon.svg inside it. If your icon is not in SVG format, you can either convert it or replace the filename and update the corresponding link tag in src/layouts/Layout.astro:

<link rel="icon" type="image/svg+xml" href="/favicon.svg" />

Modifying the Site Establishment Time

In hyacine.plugin.ts edit siteCreatedAt:

  plugins: [
    SiteUpTime({
      siteCreatedAt: "2025-03-03T00:00:00Z",
    }),
    MouseFirework({
      colors: [
        "rgba(255,182,185,.9)",
        "rgba(250,227,217,.9)",
        "rgba(187,222,214,.9)",
        "rgba(138,198,209,.9)",
      ],
      count: 30,
      radius: 16,
    }),
  ],
});

Deploy to CloudFlare Pages

Commit your changes to git:

git add . && git commit

If you forgot to fork the official repository initially, you can create a completely empty repository on GitHub and update your remote URL as follows:

git remote set-url origin git@github.com:/your-user-name/your-repo-name.git

And push to github:

git push -u origin main

Log in to cloudflare dashboard, select Pages, and Connect to Git. Select github and your repo, Framework preset select Astro, Build command : bun install && bun run build. This selection is detailed in official docs.

Managing Future Upgrades

Add official repo to upstream:

git remote add upstream https://github.com/theme-shoka-x/astro-blog-shokax.git

When there is a new official version, run this:

git fetch upstream

git checkout main

git merge upstream/main

Resolve any potential merge conflicts, then commit and push the updates:

git add . && git commit && git push -u origin main

Extensions

RSS

Add this extension:

bun add @astrojs/rss

Create a new file src/pages/rss.xml.ts:

import rss from '@astrojs/rss';
import { getCollection } from 'astro:content';
import type { APIContext } from 'astro';

export async function GET(context: APIContext) {
  const posts = await getCollection('posts', ({ data }) => {
    return data.draft !== true;
  });

  const sortedPosts = posts.sort((a, b) => b.data.date.getTime() - a.data.date.getTime());

  return rss({
    title: "Onirexus' Blog",
    description: '',

    site: context.site ?? 'https://blog.onirexus.com',

    items: sortedPosts.map((post) => ({
      title: post.data.title,
      pubDate: post.data.date,
      description: post.data.description || '',

      link: `/posts/${post.id}/`, 
    })),

    customData: `<language>en</language>`,
  });
}

The subscription URL is https://yourdomain.com/rss.xml.

Waline Comments

The official docs is here: Waline | Waline

At first, I considered using the Vercel + Neon setup mentioned in the quick start guide since it’s very convenient. However, a persistent and mysterious 500 error kept bothering me no matter what I tried. As a result, I switched to a self-hosted plan. But soon after, other annoying bugs occurred, leading me to suspect there might be issues with their official JS scripts or Docker images.

The latest official docker image version 1.40.0 has some bugs, so I downgraded to 1.39.3:

services:
  waline:
    container_name: waline
    image: lizheming/waline:1.39.3
    restart: unless-stopped
    ports:
      - 127.0.0.1:8360:8360
    volumes:
      - ./data:/app/data
    environment:
      TZ: 'Asia/Shanghai'
      SQLITE_PATH: '/app/data'
      JWT_TOKEN: 'your token'
      SITE_NAME: 'waline'
      SITE_URL: 'waline site url'
      SECURE_DOMAINS: 'walinedomain.com, blogdomain.com'
      AUTHOR_EMAIL: 'mail@example.com'

Next, I set up an Nginx reverse proxy and configured Cloudflare Origin Certificates, then filled in the comment fields in the Shokax configuration file.

However, if you stop here, you’ll encounter a no such table: wl_Comment error when attempting to post a comment. You can fix this by manually downloading the official SQLite template:

sudo curl -L -o ./data/waline.sqlite https://github.com/walinejs/waline/raw/main/assets/waline.sqlite

sudo chmod 666 ./data/waline.sqlite

Unfortunately, I later found that the /ui/ page failed to render, displaying only a blank screen. Since I couldn’t resolve this issue, I decided to give up on the web dashboard and now manually manage the comments directly inside the SQLite database instead.

Configuring IPV6-only VPS

Wed, 27 May 2026 20:35:06 GMT

Some VPSs only offer IPv6 access, which introducing several routing and connectivity challenges. Below are four practical methods to configure an IPv6-only VPS to grant it seamless IPv4 outbound access.

1 Install Cloudflare WARP

WARP is a wireguard-based VPN service offered by Cloudflare. It creates a network interface that routes IPv4 traffic through Cloudflare’s global network.

You can deploy it using a popular shell script:

wget -N [https://gitlab.com/fscarmen/warp/-/raw/main/menu.sh](https://gitlab.com/fscarmen/warp/-/raw/main/menu.sh) && bash menu.sh

Note: If your VPS cannot bootstrap the network to fetch the remote script due to IPv4 limitations, download the script locally first and transfer it via SFTP, or use an IPv6-supported mirror.

2 Utilizing Public NAT64 DNS

Certain public DNS providers offer DNS64/NAT64 translation, enabling IPv6-only hosts to synthesize IPv6 addresses for IPv4-only domains.

For systems managed by systemd-resolved (e.g., modern Ubuntu/Debian), edit the configuration directly:

# Edit /etc/systemd/resolved.conf to append DNS under the [Resolve] section
sudo sed -i 's/#DNS=/DNS=2001:67c:2b0::4 2001:67c:2b0::6/' /etc/systemd/resolved.conf

# Restart the service to apply changes
sudo systemctl restart systemd-resolved

3 Modifying the Static Hosts File

If your specific use case only requires accessing targeted IPv4 domains (such as GitHub for developer environments), mapping domain names directly via fixed NAT64 translated prefixes inside the /etc/hosts file is an efficient, zero-overhead solution.

cat << EOF >> /etc/hosts
2a01:4f8:c010:d56::2 github.com
2a01:4f8:c010:d56::3 api.github.com
2a01:4f8:c010:d56::4 codeload.github.com
2a01:4f8:c010:d56::6 ghcr.io
2a01:4f8:c010:d56::7 pkg.github.com npm.pkg.github.com maven.pkg.github.com nuget.pkg.github.com rubygems.pkg.github.com
2a01:4f8:c010:d56::8 uploads.github.com
2606:50c0:8000::133 objects.githubusercontent.com [www.objects.githubusercontent.com](https://www.objects.githubusercontent.com) release-assets.githubusercontent.com gist.githubusercontent.com repository-images.githubusercontent.com camo.githubusercontent.com private-user-images.githubusercontent.com avatars0.githubusercontent.com avatars1.githubusercontent.com avatars2.githubusercontent.com avatars3.githubusercontent.com cloud.githubusercontent.com desktop.githubusercontent.com support.github.com
2606:50c0:8000::154 support-assets.githubassets.com github.githubassets.com opengraph.githubassets.com github-registry-files.githubusercontent.com github-cloud.githubusercontent.com
EOF

Warning: These IPv6 mapping addresses are bound to generic NAT64 translation gateways and can break if upstream routing parameters or CDN infrastructure changes.

Beautifying Terminal Under Bash: starship+ble.sh

Wed, 27 May 2026 06:12:55 GMT

The default Linux terminal prompt is often plain and inconvenient, making terminal beautification a highly rewarding task. While most online tutorials focus heavily on oh-my-zsh, running complex Bash scripts under Zsh can occasionally introduce syntax bugs. That’s why I stick to Bash. My lightweight yet powerful combo of choice is starship + ble.sh.

All configuration steps below are performed on the VPS, not your local machine (except for installing the font in the final step).

Here is my end result, and it feels incredibly smooth.

1 Forcing a Color Prompt

By default, many Linux distributions ship with a monochrome (black and white) prompt. This step ensures that at least your username and hostname are highlighted in color.

Open your ~/.bashrc, find the force_color_prompt variable, and set it to yes. If it doesn’t exist, append the following snippet:

force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
        color_prompt=yes
    else
        color_prompt=
    fi
fi

Then source ~/.bashrc.

2 ble.sh

ble.sh brings syntax highlighting and auto-completion to standard Bash. Download and install it using the following commands:

curl -L https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly.tar.xz | tar xJf -
mkdir -p ~/.local/share/blesh
cp -Rf ble-nightly/* ~/.local/share/blesh/
rm -rf ble-nightly

Note: This installation applies only to the current user, not globally.

In ~/.bashrc add：

[[ -f ~/.local/share/blesh/ble.sh ]] && source ~/.local/share/blesh/ble.sh

To enable intelligent searching, add this in ~/.blerc：

cat << 'EOF' > ~/.blerc
ble-bind -f 'up' 'history-search-backward'
ble-bind -f 'down' 'history-search-forward'
EOF

We all know the standard arrow keys let you cycle through history. However, this bind introduces prefix-based searching. For example, if you type curl and press the Up arrow key, it will only cycle through past commands that start with curl.

3 starship

Starship is a minimal, blazing-fast, and infinitely customizable prompt for any shell. It instantly modernizes your command line interface.

Run the official installation script:

curl -sS https://starship.rs/install.sh | sudo sh -s -- -y

In ~/.bashrc add：

if command -v starship &> /dev/null; then
    eval "$(starship init bash)"
fi

Tip: If you are using ble.sh, make sure the Starship initialization block is placed below the ble.sh line.

Starship comes with various preset themes, or you can craft your own configuration:

mkdir -p ~/.config

# list available presets
starship preset --list

# apply one
starship preset catppuccin-powerline > ~/.config/starship.toml

Preview different presets here: https://starship.rs/presets/

Keep in mind that many themes rely heavily on special glyphs. You must install a Nerd Font in your local terminal emulator; otherwise, the icons sent by the VPS will render as broken characters.

I highly recommend picking up a font like JetBrains Mono Nerd Font from Nerd Fonts - Iconic font aggregator, glyphs/icons collection, & fonts patcher and setting it as the default font in your local terminal app.

Finally, reload your shell configuration: source ~/.bashrc.

Bonus: All-in-One Automated Script

I have wrapped up the entire process into a single script. After execution, remember to manually run source ~/.bashrc to apply the changes.

#!/bin/bash
curl -sS https://starship.rs/install.sh | sh -s -- -y
curl -L https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly.tar.xz | tar xJf -
mkdir -p ~/.local/share/blesh
cp -Rf ble-nightly/* ~/.local/share/blesh/
rm -rf ble-nightly

cat <<EOF >> ~/.bashrc
force_color_prompt=yes

if [ -n "\$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
        color_prompt=yes
    else
        color_prompt=
    fi
fi

[[ -f ~/.local/share/blesh/ble.sh ]] && source ~/.local/share/blesh/ble.sh

if command -v starship &> /dev/null; then
    eval "\$(starship init bash)"
fi
EOF

cat << 'EOF' > ~/.blerc
ble-bind -f 'up' 'history-search-backward'
ble-bind -f 'down' 'history-search-forward'
EOF

mkdir -p ~/.config
starship preset catppuccin-powerline > ~/.config/starship.toml

Configuring Rclone to Automatically Backup VPS to a Cloud Drive

Wed, 27 May 2026 05:46:04 GMT

Until recently, my backup routine was simple: tarring files and using rclone copy to push them to Google Drive. However, I recently learned that directly tarring an active database may cause data corruption. While the safest workaround is to stop the service before performing the backup, that feels a bit clunky and disruptive. To solve this, I modified my script for a cleaner approach.

By the way, since my current projects only rely on SQLite — without more complex ones like MySQL or Redis — I just took SQLite into account. Maybe I’ll add PGP encryption and support for other databases in the future.

1 Configuring Rclone

Run the official Rclone installation script and rclone config to config corresponding cloud drive. I’m sure that’s esay to you so I’ll skip this part :-)

2 The Backup Script

The script compressing Nginx configurations, Docker data and most files in home directories, while retaining the last 5 days of backups. The logic to handle db is straightforward: it scans for specific file extensions and utilizes SQLite’s native command to backup. Once the archive is uploaded to cloud, the script deletes all temp files generated during the process. And for sure, you need to sudo apt install sqlite first.

#!/bin/bash

DATE=$(date +"%Y%m%d_%H%M%S")
BACKUP_TEMP_DIR="/root/backup_tmp"
ARCHIVE_NAME="netcup_backup_$DATE.tar.gz"
RCLONE_REMOTE="gdrive:Backups/netcup"
RETAIN_DAYS=5

USER_HOME="/home/user"    # alter to your username
BACKUP_PATHS="/opt/docker /etc/nginx $USER_HOME/src"

mkdir -p "$BACKUP_TEMP_DIR"

SAFE_FILES_LOG="$BACKUP_TEMP_DIR/safe_files.txt"
EXCLUDE_FILE_LIST="$BACKUP_TEMP_DIR/exclude_list.txt"
touch "$SAFE_FILES_LOG" "$EXCLUDE_FILE_LIST"

echo "=========================================="
echo "generating db copy..."
echo "=========================================="

find /opt/docker -type f \( -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" \) | while read -r file_path; do
        SAFE_COPY_PATH="${file_path}.bak"

        echo "Safely backing up: $file_path -> and generating .bak copy"
        sqlite3 "$file_path" ".backup '$SAFE_COPY_PATH'"

        if [ -s "$SAFE_COPY_PATH" ]; then
            echo "$SAFE_COPY_PATH" >> "$SAFE_FILES_LOG"
            echo "$file_path" >> "$EXCLUDE_FILE_LIST"
            echo "${file_path}-wal" >> "$EXCLUDE_FILE_LIST"
            echo "${file_path}-shm" >> "$EXCLUDE_FILE_LIST"
        else
            echo "⚠️Warning: $file_path failed to generate db copy!"
        fi
done

echo "=========================================="
echo "tar..."
echo "=========================================="
if [ -f "$EXCLUDE_FILE_LIST" ]; then
    TMP_EXCLUDE=$(mktemp)
    while read -r banned_file; do
        if [[ "$banned_file" == *.db || "$banned_file" == *.sqlite || "$banned_file" == *.sqlite3 ]]; then
            if [ ! -f "${banned_file}.bak" ]; then
                continue
            fi
        fi
        echo "$banned_file" >> "$TMP_EXCLUDE"
    done < "$EXCLUDE_FILE_LIST"
    mv "$TMP_EXCLUDE" "$EXCLUDE_FILE_LIST"
fi

tar -czf "$BACKUP_TEMP_DIR/$ARCHIVE_NAME" \
    -X "$EXCLUDE_FILE_LIST" \
    --exclude="/home/user/.cache" \
    --exclude="/home/user/.npm" \
    --exclude="/home/user/.dotnet" \
    --exclude="/home/user/.local/share/GitKrakenCLI" \
    /etc/nginx \
    /opt/docker \
    /home/user \
    "$BACKUP_TEMP_DIR/safe_files.txt" \
    "$BACKUP_TEMP_DIR/exclude_list.txt" \
    --ignore-failed-read \
    --warning=no-file-changed

echo "=========================================="
echo "Uploading..."
echo "=========================================="
rclone copy "$BACKUP_TEMP_DIR/$ARCHIVE_NAME" "$RCLONE_REMOTE" -P
UPLOAD_RESULT=$?

echo "=========================================="
echo "Cleaning up local temp files..."
echo "=========================================="
if [ -f "$SAFE_FILES_LOG" ]; then
    while read -r safe_file; do
        rm -f "$safe_file"
    done < "$SAFE_FILES_LOG"
fi

if [ $UPLOAD_RESULT -eq 0 ]; then
    echo "Upload success!..."
    rclone delete "$RCLONE_REMOTE" --min-age "${RETAIN_DAYS}d"
    rm -rf "$BACKUP_TEMP_DIR"
    echo "Done！"
else
    echo "Failed！"
    rm -rf "$BACKUP_TEMP_DIR"
    exit 1
fi

3 Setting Up the Cron Job

Run the script as root user for convenience.
First, install crontab：

sudo apt update && sudo apt install cron -y
sudo systemctl enable --now cron

Edit task：

30 3 * * * /bin/bash /root/scripts/backup.sh >> /var/log/vps_backup.log 2>&1

You can set the trigger time to the next minute to check the effect, and check the log：

tail -f /var/log/vps_backup.log

Linux Command Path Behaviors: Trailing Slashes and Wildcards

Wed, 27 May 2026 05:38:43 GMT

The way common Linux commands handle trailing slashes is a frequent source of confusion, often leading to unintended directory nesting or accidental data loss. To clarify these behaviors, I categorize standard commands into Path-Insensitive and Path-Sensitive patterns, highlights critical pitfalls, and provides a set of clean best practices for daily operations.

1 Pattern 1: Path-Insensitive (mv, cp, rm, chmod, chown, find)

For these commands, a trailing slash on the source path makes no difference; dir1 is treated exactly the same as dir1/. The outcome depends entirely on the status of the destination path:

1.1 Destination Does Not Exist

No trailing slash on destination (e.g., mv dir1 dir2): Renames dir1 to dir2 (the same logic applies to cp).
Trailing slash on destination (e.g., mv dir1 dir2/): Throws an error. A trailing slash explicitly indicates that the destination must be an already existing directory.

1.2 Destination Already Exists

1.2.1 Specifying the parent directory directly

e.g., mv dir1 dir2/, rm -rf dir1/, chmod -R 755 dir1/

Transfer operations (mv/cp): Moves or copies the entire dir1 directory into dir2, resulting in ./dir2/dir1/.
Maintenance operations (rm/chmod/chown/find): Appled directly to the dir1 directory itself and all of its contents.

1.2.2 Specifying a subdirectory with the same name

e.g., mv dir1 dir2/dir1

If dir2/dir1 does not exist: Moves normally, resulting in ./dir2/dir1/.
If dir2/dir1 already exists: Directory protection is triggered. The source dir1 will be nested inside the target, causing unintended nesting, resulting in ./dir2/dir1/dir1/.

1.3 Destination Is a Regular File

mv dir1 existing_file.txt $\rightarrow$ Error. Linux does not allow a directory to overwrite a regular file.

2 Pattern 2: Path-Sensitive (rsync, ln, scp)

These commands enforce strict logic regarding trailing slashes. Adding or omitting a slash can lead to completely different results.

2.1 rsync

Assuming the destination directory dir2 already exists:

No trailing slash on source (rsync -a dir1 dir2/): Operates on the directory as a whole, creating dir1 inside dir2.
Trailing slash on source (rsync -a dir1/ dir2/): Operates only on the contents of the directory, flattening and syncing the files directly into dir2.
Aligned names (Safest Practice) (rsync -a dir1/ dir2/dir1/): Adding trailing slashes to both ends ensures an exact overwrite/sync of the contents without accidental nesting.

2.2 ln -s and rm (Symlinks)

Creating a symlink (ln -s /path/to/source_dir link_name): Never add a trailing slash to either path. Doing so can cause the link to point to an incorrect path or nest inside the target.
Deleting a symlink (rm my_link): Never add a trailing slash.

If you mistakenly run rm -rf my_link/, the shell resolves the trailing slash
as “the contents of the source directory.” The system will bypass the shortcut
and completely wipe out all data inside the actual source directory, leaving
the symlink itself intact.

2.3 scp

Avoid adding a trailing slash to the source path (write it as scp -r dir1 user@host:/path/dir2). On some legacy Unix systems, adding a trailing slash to the source path is misinterpreted as “copy contents only,” which can break the remote directory structure.

3 The Wildcard (`*`) Problem

When you use dir1/* (such as mv dir1/* dir2/ or rm -rf dir1/*), the underlying shell expands * into a list of every individual item inside that directory.

By default, the Shell’s * does not match hidden files. Therefore, when running mv dir1/* dir2/ or rm -rf dir1/*, all hidden files (e.g., .env, .git) will be skipped and left behind in the original directory.

4 Best Practices

## 1. For archiving, copying, moving, deleting, and changing permissions (mv, cp, rm, chmod, chown):
##    Write the source path without a trailing slash. Always append a trailing slash to the destination if it is known to exist.
mv dir1 dir2/
cp -r dir1 dir2/
rm -rf dir1
chmod -R 755 dir1

## 2. For renaming a directory:
##    Do not add a trailing slash to either end.
mv old_dir new_dir

## 3. For managing symlinks (creating or deleting):
##    Strictly prohibit trailing slashes at the end of the paths.
ln -s /absolute/path/source_dir my_link   # Create
rm my_link                                # Delete

## 4. For rsync syncing directories with the same name:
##    Append trailing slashes to both the source and destination paths.
rsync -avz dir1/ dir2/dir1/

Syncing Configuration Between VSCode Remote-SSH and Code-server

Wed, 27 May 2026 04:59:55 GMT

I use VSCode Remote-SSH to connect to VPS to code, so that I can use the same environment in a new PC. However, a problem arises when I only have a tablet on hand, as there is no desktop version of VSCode available for tablets. To bridge this gap, I turned to the code-server project, which provides a browser-based VSCode client. Naturally, my next step was to sync my configurations between Remote-SSH and code-server.

1 Installing VSCode Remote-SSH

Install Remote-SSH extension in local VSCode and click the blue button in the bottom left corner to install the VSCode server on your VPS.

2 Installing Code-server

To make syncing the environments easier, I chose a native installation over Docker. Simply run the official installation script.

curl -fsSL https://code-server.dev/install.sh | sh

3 Linking Extensions and Configurations

mkdir -p ~/.local/share/code-server/User/

# link extensions
ln -s ~/.vscode-server/extensions ~/.local/share/code-server/extensions

# link configurations
ln -s ~/.vscode-server/data/Machine/settings.json ~/.local/share/code-server/User/settings.json

# link snippets
ln -s ~/.vscode-server/data/User/snippets ~/.local/share/code-server/User/snippets

In practice, I found that the settings.json formats between the two are slightly incompatible. However, since I rarely change these configurations, I just ignored this minor issue.

4 Using the Microsoft Official Marketplace

First, edit environment variables:

sudo systemctl edit code-server@$USER

Insert the following snippet inside the specified block (as indicated by the systemd comments):

[Service]
Environment='EXTENSIONS_GALLERY={"serviceUrl":"https://marketplace.visualstudio.com/_apis/public/gallery","itemUrl":"https://marketplace.visualstudio.com/items","resourceUrlTemplate":"https://%%7Bpublisher%%7D.vscode-unpkg.net/%%7Bpublisher%%7D/%%7Bname%%7D/%%7Bversion%%7D/%%7Bpath%%7D","controlUrl":"","recommendationsUrl":""}'

Restart the service：

sudo systemctl daemon-reload
sudo systemctl restart code-server@$USER

5 Configuring Code-server

Open the configuration file：

vim ~/.config/code-server/config.yaml

Edit port and passsword. For security reasons, I bound the address to 127.0.0.1 so it isn’t exposed directly to the public web. I will handle external access using an Nginx reverse proxy later.

bind-addr: 127.0.0.1:8080
auth: password
password: "YourPassword"
cert: false

Manually start the service:

sudo systemctl enable --now code-server@$USER
sudo systemctl status code-server@$USER

6 Setting Up the Nginx Reverse Proxy

I’m using a Cloudflare origin certificate, stored in /etc/nginx/ssl/example_com.

Edit Nginx’s configuration:

sudo vim /etc/nginx/conf.d/codeserver.conf

server {
    listen 80;
    server_name code.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name code.example.com;

    ssl_certificate /etc/nginx/ssl/example_com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example_com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;

    client_max_body_size 0;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_connect_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_read_timeout 3600s;

    access_log /var/log/nginx/codeserver.access.log;
    error_log  /var/log/nginx/codeserver.error.log;

    location / {
        proxy_pass http://127.0.0.1:8080;

        proxy_set_header Host $host;
        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
        proxy_set_header X-Real-IP $http_cf_connecting_ip;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Verify the syntax:

sudo nginx -t

Reload Nginx:

sudo systemctl reload nginx

Turing an Old Android Phone to NAS: AList & Cloudflare Tunnel

Fri, 11 Jul 2025 21:47:56 GMT

Disclaimer: I have recently migrated my setup to a dedicated mini-PC.
Smartphones are fundamentally not designed for 24/7 server workloads due to
battery and thermal constraints. Unless you have a specific use case, I do not
recommend running this as a permanent solution.

Lately, I’ve had some spare time and decided to repurpose an old Android phone into a lightweight NAS by installing AList. Here is a brief guide sharing my hands-on experience and configurations. If you spot any mistakes, feel free to point them out in the comments section below!

1 Installing AList

For this project, I used AList-lite, a native Android app built on the open-source OList project. It requires no complex command-line setup—just install the APK, and you are good to go. Since there are plenty of basic installation tutorials online, I won’t re-invent the wheel here. You can refer to these links for step-by-step setup:

Once installed, follow the official documentation to complete the basic setup. The UI is clean and self-explanatory. Once the service starts, you can easily access it within your local area network (LAN) from any device connected to the same Wi-Fi network or mobile hotspot. Alternatively, you can share the connection via USB tethering.

Note: My university network does not behave like a standard LAN environment, which brought up some unique routing challenges.

2 External Access

Since I don’t have a public IPv4 address and my university network enforces strict firewall rules on IPv6, traditional port forwarding was out of the question. Funnily enough, I noticed that simply connecting both my primary phone and the old phone to the campus VPN allowed them to communicate, though I haven’t deep-dived into the underlying routing mechanics yet.

2.1 P2P Hole Punching (Tailscale / ZeroTier)

Initially, I tried utilizing mesh VPN services like Tailscale to establish a peer-to-peer connection, following a guide on Coolapk:

Coolapk - Old Phone into NAS

While the setup was straightforward, my remote download speeds capped out at a miserable few hundred KB/s. After checking our campus forum, I realized our wireless network uses a strict Symmetric NAT (NAT4). In a NAT4 environment, direct P2P hole punching almost always fails, forcing traffic to relay through overseas DERP servers, which introduces severe latency and throttling.

I also looked into commercial solutions like PeanutHull (花生壳), but the free tier only offers 1 GB of monthly data—practically useless for storage traffic.

2.2 Cloudflare Tunnel

2.2.1 Register a Domain on Cloudflare

You will need a Cloudflare account and a custom domain. If your domain is currently with another registrar, migrate your DNS nameservers to Cloudflare.

Cloudflare Dashboard

Once you add your site, Cloudflare will provide two custom nameservers. Update your domain settings at your registrar to point to these servers.

I highly recommend setting up a subdomain (e.g., pan.yourdomain.com) for the
tunnel traffic instead of your root domain.

The following steps are executed entirely inside Termux.

2.2.2 Installing cloudflared in Termux

Update your packages and install the required tools:

pkg update && pkg upgrade
pkg install wget curl cloudflared

2.2.3 Creating the Tunnel

Authenticate your Cloudflare account inside Termux:

cloudflared tunnel login

The command will output a authentication URL:

Please open the following URL and re-run this command with the returned certificate:
https://dash.cloudflare.com/argotunnel?callback=https%3A%2F%2Flogin.cloudflareaccess.org%2F...

Copy and paste this URL into your browser, select your domain, and authorize the connection. Back in Termux, a successful login will output:

You have successfully logged in.
If you wish to copy your credentials to a server, they have been saved to:
/data/data/com.termux/files/home/.cloudflared/cert.pem

(If the authentication fails due to network timeout, simply hit Ctrl+C and retry the login command).

Now, spin up a new tunnel daemon:

cloudflared tunnel create my-android-tunnel

Upon creation, Termux will generate a credentials JSON file:

Tunnel credentials written to /data/data/com.termux/files/home/.cloudflared/12345678-1234-1234-1234-123456789abc.json
Created tunnel my-android-tunnel with id 12345678-1234-1234-1234-123456789abc

Make a note of this generated Tunnel ID; we will need it for the configuration
file.

You can verify the status by running:

cloudflared tunnel list

2.2.4 Configuring the Tunnel

nano ~/.cloudflared/config.yml

tunnel: 12345678-1234-1234-1234-123456789abc
credentials-file: /data/data/com.termux/files/home/.cloudflared/12345678-1234-1234-1234-123456789abc.json

ingress:
  - hostname: yourdomain.com
    service: http://localhost:5244

  - service: http_status:404

2.2.5 Routing DNS and Launching

cloudflared tunnel route dns my-android-tunnel yourdomain.com

cloudflared tunnel run my-android-tunnel

At this point, your AList server is exposed securely to the web. Open a browser and verify by navigating to https://pan.yourdomain.com. To terminate the session, simply hit Ctrl+C.

3 Real-Time Hardware Monitoring via MacroDroid

The tutorial mentioned earlier inspired me to take telemetry a step further. I configured MacroDroid to periodically dump system metrics into a JSON file stored on the server. Then, I injected a custom JavaScript floating widget into the AList global header to parse and display this real-time system status.

3.1 MacroDroid Configuration

Create a new macro in MacroDroid:Trigger: Every 5 minutes.Action: Write File $\rightarrow$ Name: device_status.json $\rightarrow$ Option: Overwrite file.

{
  "battery": {
    "level": "{battery}",
    "temperature": "{battery_temp}"
  },
  "memory": {
    "total": "{ram_total}",
    "available": "{ram_available}"
  },
  "storage": {
    "total": "{storage_internal_total}",
    "free": "{storage_internal_free}"
  },
  "time": {
    "formatted": "{hour_0}:{minute}:{second}"
  }
}

3.2 AList Admin Setting Injection

Navigate to your AList Admin Dashboard $\rightarrow$ Settings $\rightarrow$ Style, and inject the components into their respective sections.

<style>
  /* Floating Action Button Style */
  .device-monitor-fab {
      position: fixed;
      left: 20px;
      top: 75%;
      transform: none;
      width: 48px;
      height: 48px;
      background: #007bff;
      border: none;
      border-radius: 50%;
      cursor: pointer;
      box-shadow: 0 4px 12px rgba(0, 123, 255, 0.3);
      z-index: 9999;
      display: flex;
      align-items: center;
      justify-content: center;
      font-size: 20px;
      transition: all 0.3s ease;
  }
  .device-monitor-fab:hover {
      transform: translateY(-50%) scale(1.1);
      box-shadow: 0 6px 16px rgba(0, 123, 255, 0.4);
  }

  /* Telemetry Panel Style */
  .device-info-panel {
      position: fixed;
      left: 80px;
      top: 50%;
      transform: translateY(-50%);
      width: 280px;
      background: rgba(255, 255, 255, 0.95);
      border: 1px solid rgba(0, 0, 0, 0.1);
      border-radius: 12px;
      padding: 16px;
      box-shadow: 0 8px 24px rgba(0, 0, 0, 0.15);
      z-index: 9998;
      backdrop-filter: blur(10px);
      display: none;
  }

  .device-info-panel.dark {
      background: rgba(30, 30, 30, 0.95);
      border-color: rgba(255, 255, 255, 0.1);
      color: #ffffff;
  }

  .device-info-header {
      text-align: center;
      margin-bottom: 12px;
      font-size: 14px;
      font-weight: 600;
      opacity: 0.8;
  }

  .device-info-list {
      display: flex;
      flex-direction: column;
      gap: 8px;
  }

  .device-info-item {
      display: flex;
      align-items: center;
      padding: 6px 0;
  }

  .device-info-icon {
      width: 20px;
      margin-right: 8px;
      text-align: center;
      font-size: 14px;
  }

  .device-info-content {
      flex: 1;
      min-width: 0;
  }

  .device-info-value {
      font-size: 12px;
      font-weight: 500;
      margin-bottom: 3px;
      opacity: 0.9;
  }

  .progress-bar {
      width: 100%;
      height: 3px;
      background: rgba(128, 128, 128, 0.2);
      border-radius: 1.5px;
      overflow: hidden;
  }

  .progress-fill {
      height: 100%;
      border-radius: 1.5px;
      transition: width 0.3s ease;
  }

  .battery-progress {
      background: linear-gradient(90deg, #ff4757, #ffa502, #2ed573);
  }

  .memory-progress {
      background: linear-gradient(90deg, #3742fa, #5352ed);
  }

  .storage-progress {
      background: linear-gradient(90deg, #ff6b6b, #feca57);
  }

  .device-status-offline {
      text-align: center;
      padding: 12px;
      opacity: 0.5;
      font-style: italic;
      font-size: 11px;
  }

  .last-update {
      text-align: center;
      font-size: 10px;
      opacity: 0.4;
      margin-top: 8px;
      border-top: 1px solid rgba(128, 128, 128, 0.2);
      padding-top: 8px;
  }

  .close-btn {
      position: absolute;
      top: 8px;
      right: 8px;
      width: 20px;
      height: 20px;
      border: none;
      background: none;
      cursor: pointer;
      font-size: 16px;
      opacity: 0.5;
      display: flex;
      align-items: center;
      justify-content: center;
  }

  .close-btn:hover {
      opacity: 1;
  }
  }
</style>

Global Body Content:

<button id="deviceMonitorFab" class="device-monitor-fab" title="Device Status">
  &#x1F4F1;
</button>

<div id="deviceInfoPanel" class="device-info-panel">
  <button class="close-btn" onclick="closeDevicePanel()">&times;</button>
  <div class="device-info-header">Device Status</div>
  <div id="deviceInfoList" class="device-info-list">
    <!-- Device info will be loaded here -->
  </div>
  <div
    id="deviceOfflineMsg"
    class="device-status-offline"
    style="display: none;"
  >
    Device offline or data unavailable
  </div>
  <div id="lastUpdateTime" class="last-update"></div>
</div>

<script>
  (function () {
    // Get base URL
    function getBaseUrl() {
      const currentUrl = window.location.href;
      const urlParts = currentUrl.split("/");
      return `${urlParts[0]}//${urlParts[2]}`;
    }

    // Format storage size
    function formatStorage(total, free) {
      const totalNum = parseFloat(total);
      const freeNum = parseFloat(free);
      const used = totalNum - freeNum;
      const usedPercent = Math.round((used / totalNum) * 100);
      return {
        total: total,
        free: free,
        used: used.toFixed(1) + total.slice(-2),
        usedPercent: usedPercent,
      };
    }

    // Format memory size
    function formatMemory(total, available) {
      const totalNum = parseFloat(total);
      const availableNum = parseFloat(available);
      const used = totalNum - availableNum;
      const usedPercent = Math.round((used / totalNum) * 100);
      return {
        total: total,
        available: available,
        used: used.toFixed(2) + total.slice(-2),
        usedPercent: usedPercent,
      };
    }

    // Render device info
    function renderDeviceInfo(data) {
      const storage = formatStorage(data.storage.total, data.storage.free);
      const memory = formatMemory(data.memory.total, data.memory.available);
      const batteryLevel = parseInt(data.battery.level);

      document.getElementById("deviceInfoList").innerHTML = `
            <div class="device-info-item">
                <div class="device-info-icon">&#x1F50B;</div>
                <div class="device-info-content">
                    <div class="device-info-value">${data.battery.level}%</div>
                    <div class="progress-bar">
                        <div class="progress-fill battery-progress" style="width: ${batteryLevel}%"></div>
                    </div>
                </div>
            </div>
            <div class="device-info-item">
                <div class="device-info-icon">&#x1F321;</div>
                <div class="device-info-content">
                    <div class="device-info-value">${data.battery.temperature}&deg;C</div>
                </div>
            </div>
            <div class="device-info-item">
                <div class="device-info-icon">&#x1F9E0;</div>
                <div class="device-info-content">
                    <div class="device-info-value">${memory.used}/${memory.total}</div>
                    <div class="progress-bar">
                        <div class="progress-fill memory-progress" style="width: ${memory.usedPercent}%"></div>
                    </div>
                </div>
            </div>
            <div class="device-info-item">
                <div class="device-info-icon">&#x1F4BF;</div>
                <div class="device-info-content">
                    <div class="device-info-value">${storage.used}/${storage.total}</div>
                    <div class="progress-bar">
                        <div class="progress-fill storage-progress" style="width: ${storage.usedPercent}%"></div>
                    </div>
                </div>
            </div>
            <div class="device-info-item">
                <div class="device-info-icon">&#x1F552;</div>
                <div class="device-info-content">
                    <div class="device-info-value">${data.time.formatted}</div>
                </div>
            </div>
        `;
    }

    // Fetch device status
    async function fetchDeviceStatus() {
      try {
        const baseUrl = getBaseUrl();
        const response = await fetch(
          `${baseUrl}/d/DeviceStatus/device_status.json?t=${Date.now()}`,
        );

        if (!response.ok) {
          throw new Error("Network response was not ok");
        }

        const data = await response.json();

        document.getElementById("deviceInfoList").style.display = "flex";
        document.getElementById("deviceOfflineMsg").style.display = "none";

        renderDeviceInfo(data);

        const now = new Date();
        document.getElementById("lastUpdateTime").textContent =
          `Last update: ${now.getHours().toString().padStart(2, "0")}:${now
            .getMinutes()
            .toString()
            .padStart(2, "0")}:${now.getSeconds().toString().padStart(2, "0")}`;
      } catch (error) {
        console.log("Failed to fetch device status:", error);
        document.getElementById("deviceInfoList").style.display = "none";
        document.getElementById("deviceOfflineMsg").style.display = "block";
        document.getElementById("lastUpdateTime").textContent =
          "Connection failed";
      }
    }

    // Toggle panel visibility
    function togglePanel() {
      const panel = document.getElementById("deviceInfoPanel");
      const isVisible = panel.style.display === "block";

      if (isVisible) {
        panel.style.display = "none";
      } else {
        panel.style.display = "block";
        fetchDeviceStatus();
      }
    }

    // Close panel
    window.closeDevicePanel = function () {
      document.getElementById("deviceInfoPanel").style.display = "none";
    };

    // Detect dark theme
    function updateTheme() {
      const panel = document.getElementById("deviceInfoPanel");
      const isDark =
        document.documentElement.classList.contains("hope-ui-dark") ||
        document.body.classList.contains("dark") ||
        document.body.classList.contains("hope-ui-dark") ||
        window.matchMedia("(prefers-color-scheme: dark)").matches;

      if (isDark) {
        panel.classList.add("dark");
      } else {
        panel.classList.remove("dark");
      }
    }

    // Click outside to close
    document.addEventListener("click", function (event) {
      const panel = document.getElementById("deviceInfoPanel");
      const fab = document.getElementById("deviceMonitorFab");

      if (
        panel.style.display === "block" &&
        !panel.contains(event.target) &&
        !fab.contains(event.target)
      ) {
        panel.style.display = "none";
      }
    });

    // Initialize
    function init() {
      const fab = document.getElementById("deviceMonitorFab");
      if (fab) {
        fab.addEventListener("click", togglePanel);
      }

      updateTheme();

      // Watch for theme changes
      const observer = new MutationObserver(updateTheme);
      observer.observe(document.documentElement, {
        attributes: true,
        attributeFilter: ["class"],
      });
      observer.observe(document.body, {
        attributes: true,
        attributeFilter: ["class"],
      });

      // Auto refresh when panel is open
      setInterval(() => {
        const panel = document.getElementById("deviceInfoPanel");
        if (panel && panel.style.display === "block") {
          fetchDeviceStatus();
        }
      }, 30000);
    }

    // Start when DOM is ready
    if (document.readyState === "loading") {
      document.addEventListener("DOMContentLoaded", init);
    } else {
      init();
    }
  })();
</script>

In my environment, the macro runs every 5 minutes to minimize battery drain, while the frontend dashboard fetches updates every 30 seconds when open. You can tune these intervals to fit your needs.

4. Visual Customization

I didn’t heavily customize the AList interface, opting instead for a minimalist, fully transparent UI. If you want to replicate the look, check out this styling breakthrough from the Moe Community:

萌社区 moe.one

5. Battery Preservation (TODO)

I will soon expand this post to include efficient daemon process management (keeping cloudflared alive automatically) and advanced power-saving solutions to protect the battery from overheating during prolonged server runtimes.

Golang Basic

Mon, 03 Mar 2025 23:14:31 GMT

Command-Line Arguments

os.Args: slice. os.Args[0] refers to the program itself, and we often use os.Args[1:].

package main

import (
	"fmt"
	"os"
	"strings"
)
func main() {
    fmt.Println(strings.Join(os.Args[1:], " ")) // "s +" is inefficient
}

Format Output `fmt.Printf()`

Verbs

Verb	Meaning	Example
%v	Print the value in its default format
%+v	If printing a struct, it adds the field names.	{Name Age }
%#v	Prints the value as it would be written in Go code.	main.User{Name:“Alice”, Age }
%T	The type of the value.
%%	Prints %	%
%s	String
%q	Quoted string	”Hello, world”
%x	Hexadecimal dump of the string’s bytes (lowercase).
%b	Binary
%d	Decimal
%o	Octal
%x	Hex(Lowercase)
%X	Hex(Uppercase)
%f	Defaults to 6 decimal places.
%.2f	Restricts the output to exactly n decimal places.	3.14
%g	Drops trailing zeros and decides between %f or %e based on size.	3.14159
%e	Scientific notation (exponential).	3.141590e+00
%t	bool	true
%p	pointer	0xc0000b2008

Index Explicitly `[n]`

Reuses the $n$ -th argument past the format string. Saves you from typing the same variable over and over.
eg: o:=0666; %[1]o $\rightarrow$ 666

Alternative Format `#`

Forces the output to include its sharp, recognizable base prefix (0 for octal, 0x for hex).
eg: o:=0666; %#o $\rightarrow$ 0666

Sizing and Padding

You can insert numbers between the % and the verb to control spacing and alignment, which is great for building text-based tables or logs.

fmt.Printf("|%5s|\n", "Go")   // Right-aligned, width 5:  |   Go|
fmt.Printf("|%-5s|\n", "Go")  // Left-aligned, width 5:   |Go   |
fmt.Printf("|%05d|\n", 42)    // Pad with leading zeros:  |00042|

`iota`

Rules:

Only can be used in const group.
From 0, every line +1.

`crypto/sha256`

Short Text Encryption

sum := sha256.Sum256([]byte(password))

Return a [32]byte array.

Add salt:

sha256.Sum256([]byte(password + "Random_Salt_#9823"))

Large Files Streaming

package main

import (
	"crypto/sha256"
	"fmt"
	"io"
	"strings"
)

func main() {
	// Emulate a large file source
	largeData := strings.NewReader("Large data 1...Large data 2...")

	// 1. Create a hash writer
	h := sha256.New()

	// 2. Use io.Copy to transmit chunked data to the hash writer
	if _, err := io.Copy(h, largeData); err != nil {
		fmt.Println("Failed to read data:", err)
		return
	}

	// 3. h.Sum(nil) to get final result
	result := h.Sum(nil)

	fmt.Printf("Large files' SHA256 is: %x\n", result)
}

Recursively Adding Data

h := sha256.New()
for {
    buf := make([]byte, 1024)
    n, err := file.Read(buf)
    if n > 0 {
        h.Write(buf[:n])
    }
    if err == io.EOF {
        break
    }
}

finalHash := h.Sum(nil)

eg1: Write a function that counts the number of bits that are different in two SHA256
hashes.

package main

import {
	"fmt"
	"crypto/sha256"
}

func diffBits (s1, s2 []byte) int {
	count := 0
	for i := 0; i < len(s1); i++ {
		xorResult := s1[i] ^ s2[i]
		count += popCount(xorResult)
	}
	return count
}

// A helper function to count '1' bits in a single byte
func popCount(b byte) int {
	bits := 0
	for b > 0 {
		if b&1 == 1 {
			bits++
		}
		b >>= 1 // shift right to check the next bit
	}
	return bits
}

func main() {
	c1 := sha256.Sum256([]byte("x"))
	c2 := sha256.Sum256([]byte("X"))
	fmt.Printf("Different bits: %d\n", diffBits(c1, c2))
}

eg2: Write a program that prints the SHA256 hash of its standard input by default but
supports a command-line flag to print the SHA384 or SHA512 hash instead.

package main

import (
	"crypto/sha256"
	"crypto/sha512"
	"flag"
	"fmt"
	"hash"
	"io"
	"os"
)

func main() {
	// 1. Define the command-line flag
	// -algo is the flag name, "sha256" is the default value
	algoPtr := flag.String("algo", "sha256", "The hash algorithm to use (sha256, sha384, sha512)")

	// 2. Parse the flags from the command line
	flag.Parse()

	// 3. Declare a generic hash interface variable
	var h hash.Hash

	// 4. Select the algorithm based on the user's flag input
	switch *algoPtr {
	case "sha384":
		h = sha512.New384() // SHA384 lives inside the sha512 package
	case "sha512":
		h = sha512.New()
	case "sha256":
		h = sha256.New()
	default:
		// If the user types something invalid, print an error and exit
		fmt.Fprintf(os.Stderr, "Error: unsupported algorithm '%s'\n", *algoPtr)
		os.Exit(1)
	}

	// 5. Pipe standard input (os.Stdin) into our hash object
	// This streams the data efficiently without overloading memory
	if _, err := io.Copy(h, os.Stdin); err != nil {
		fmt.Fprintf(os.Stderr, "Error reading input: %v\n", err)
		os.Exit(1)
	}

	// 6. Calculate and print the final checksum
	// h.Sum(nil) extracts the bytes, and %x formats them into a hex string
	fmt.Printf("%x\n", h.Sum(nil))
}

String & []byte & Rune

In golang, a string is actually a []byte, len() returns the number of bytes not runes. To get runes, use utf8.RuneCountInString().

bytes.Buffer

The data in it is ASCII code.Used when string is frequently extended.

Slice

When delivering a slice to a function, the copied slice also has its pointer pointed to the original array, so any change of the slice in the function will cause the original slice to change.

Maps

K[V]

K must be comparable using == , floating number and NaN are bad choices
K & V can’t be the same type
The zero value for a map type is nil.

Basic Operations

Create

ages := make(map[string]int)
ages["alice"] = 31
ages["charlie"] = 34

ages := map[string]int {
	"alice": 31,
	"charlie": 34,
}

A empty map: map[string]int{}

Delete

delete(ages, "alice")

Enumerate

Go intentionally to “shuffle” the map, so the result will be different in every run:

for name, age := range ages {
	fmt.Printf("%s\t%d\n", name, age)
}

To enumerate the key/value pairs in order, we must sort
the keys explicitly.

keys := make([]string, 0, len(ages))
for name := range ages {
    keys = append(keys, name)
}
sort.Strings(key)
for _, name := range keys {
    fmt.Printf("%s\t%d\n", name, ages[name])
}

Safety

If the element isn’t in the map, the map will returns the zero value for its type.

And a map element is not a variable, and we cannot take its address:

_ = &ages["bob"] // compile error: cannot take address of map element

Most operations on maps are safe to perform on a nil map reference, but storing to a nil map causes a panic:

ages["carol"] = 21 // panic: assignment to entry in nil map

You must allocate the map before you can store into it.

To distinguish between a nonexistent element and an element that happens to have the value zero:

age, ok := ages["bob"]
if !ok { /* "bob" is not a key in this map; age == 0. */}

Act Like `set`

// Using a map as a set
registeredUsers := map[string]bool{
    "alice": true,
    "bob":   true,
}

To check one element:

if registeredUsers["alice"] {
    fmt.Println("Alice is registered!")
}

However, not all map[string]bool values are simple sets; some may contain both true and false values. To check a element in this kind of map, run this:

_, ok := userStatus["bob"]

Ref

edu.anarcho-copy.org/Programming Languages/Go/The Go Programming Language - Donovan, Alan A. A. _ Kernigha_6127.pdf

Hexo ShokaX Theme: Troubleshooting Notes

Mon, 03 Mar 2025 15:56:50 GMT

During the process of configuring my Hexo blog, I ran into a few standard hurdles. Inspired by several troubleshooting posts shokaX 主题插件配置踩坑指北 , I decided to compile my own solutions and workarounds to save others some time.

ShokaX Default Markdown Settings Filtering HTML Tags

Ref：Hexo-Shoka 主题拓展、美化及常见问题详解 - Hexo - 博客 | starsei = 猫不吃鱼 = 夜色难免黑凉，前行必有曙光。
In the official ShokaX documentation, the default Markdown renderer configuration looks like this:

markdown:
  render:
    html: false
    xhtmlOut: true
    breaks: true
    linkify: true
    typographer:
    quotes: "“”‘’"
  plugins:
    - plugin:
        name: markdown-it-toc-and-anchor
        enable: true
        options:
          tocClassName: "toc"
          anchorClassName: "anchor"
    - plugin:
        name: markdown-it-multimd-table
        enable: true
        options:
          multiline: true
          rowspan: true
          headerless: true
    - plugin:
        name: ./markdown-it-furigana
        enable: true
        options:
          fallbackParens: "()"
    - plugin:
        name: ./markdown-it-spoiler
        enable: true
        options:
          title: "你知道得太多了"

Because html is set to false by default, any embedded raw HTML code will fail to render unless it is wrapped in an explicit Hexo raw block:

&#123;% raw %&#125;
&#123;% endraw %&#125;

Alternatively, you can simply change the html configuration option to true.

Note: Characters like {} are reserved tokens in Hexo’s Markdown engine. If you want to display them as plain text without triggering rendering errors, replace them with their HTML entities: { and }.

Live2D

I use this: GitHub - EYHN/hexo-helper-live2d: Add the Sseexxyyy live2d to your hexo!
This particular plugin provides minimal, lightweight functionality. If you are looking for advanced interactive features, you might want to look into alternatives like live2d-widget.

Install the core plugin dependency:

npm install --save hexo-helper-live2d

I opted to load custom character assets. If you prefer to use default pre-configured models, the plugin repo has detailed instructions.
Download BangDream models: 如何将 Mygo 人物导入 Live2DViewerEx - 哔哩哔哩。其中 Ave Mujica 的模型编号是 337-341。懒得自己整理也可以直接用这里的链接, 包含 bangdream 截至 2024 年 4 月的所有模型文件（若链接失效请在下方留言或以主页其他方式与我联系！）：BanG Dream 全团 live2d-截至 2024-04.zip - 1.4 GB密码：lihua

Once you extract the assets, create a new directory named live2d_models at the root of your Hexo project. Organize them by character folders (e.g., live2d_models/sakiko/ and live2d_models/mutsumi/).

Next, open your root _config.yml and configure the module properties as follows:

live2d:
  enable: true
  scriptFrom: local
  pluginRootPath: live2dw/ # 插件在站点上的根目录 (相对路径)
  pluginJsPath: lib/ # 脚本文件相对与插件根目录路径
  pluginModelPath: assets/ # 模型文件相对与插件根目录路径
  #scriptFrom: xxx/lib/L2Dwidget.min.js # 你的自定义 url
  tagMode: false # 标签模式，是否仅替换 live2d tag 标签而非插入到所有页面中
  debug: false # 调试，是否在控制台输出日志
  model:
    # use: live2d-widget-model-haru # 使用的 Live2d 模型名称
    use: sakiko # 你的自定义 url
  display:
    position: left #显示位置
    width: 300
    height: 600
    hOffset: 0
    vOffset: -50
  mobile:
    show: false # 手机中是否展示
  react:
    opacity: 1.0 # 模型透明度
  dialog:
    enable: false
    hitokoto: true

Integrating the hexo-graph Plugin

hexo-graph generates beautiful visual analytics for your blog, capturing post heatmaps, monthly frequency, category distributions, and tag weight clouds. It functions similarly to the official hexo-shokax-posts-statistics add-on but scales with a sleeker ECharts design aesthetic.

You can grab the setup documentation directly from their source repository GitHub - codepzj/hexo-graph: hexo-graph，一个基于 echarts，集成博客热力图，博客月份统计图，分类统计图，标签统计图的多元化插件。

Algolia

Here is a quick tip regarding a rookie mistake I made during initial setup: when you register a fresh Algolia account, you are required to complete their “Get Started” onboarding sequence before unlocking API control. Instead of pulling your hair out trying to import custom production schemas, simply select their “load example data” option to bypass the wizard instantly.

For integration, the ShokaX configuration block requires the following setup:

algolia:
  appId: #Your appId
  apiKey: #Your apiKey
  adminApiKey: #Your adminApiKey
  chunkSize: 5000
  indexName: #"shokaX"
  fields:
    - title #必须配置
    - path #必须配置
    - categories #推荐配置
    - content:strip:truncate,0,2000
    - gallery
    - photos
    - tags

Make sure you explicitly declare fields.title, fields.pathdirectly under the fields array structure exactly as shown above.

Troubleshooting hexo-shokax-create-time Discrepancy

I made another silly oversight here: I copy-pasted the documentation string createTime: "YYYY/MM/DD HH:MM:SS" blindly into my config, only to find the site rendering component blank. It took me a while to realize that this value is a placeholder meant to be replaced with your actual site creation timestamp!

Furthermore, make sure this parameter is placed inside _config.shokax.yml, not the global _config.yml. If you wish to customize the label string, you can modify the template directly inside ./viewers/create-time.pug.

hexo-shokax-busuanzi

After configuring the standard Busuanzi visitor counter (hexo-shokax-busuanzi), the view metrics simply refused to render. This occurs due to a script loading conflict with the Live2D plugin.

To fix this, edit your local template file at ./node_modules/hexo-shokax-busuanzi/busuanzi.pug and strip out the element IDs inside the span parentheses. The modified layout code should look like this:

script(src='https://unpkg.com/busuanzi@2.3.0/bsz.pure.mini.js')
div(id="busuanzi-wrap")
    if !theme.busuanzi || theme.busuanzi.pv.enable
        span(class='ic i-eye')
        span()
            != (theme.busuanzi && theme.busuanzi.pv.title) || '本站访问量'
            != ' '
            span(id="busuanzi_value_site_pv")
            != ' '
            != (theme.busuanzi && theme.busuanzi.pv.quantifier) || '次'
    if !theme.busuanzi || (theme.busuanzi.pv.enable && theme.busuanzi.uv.enable)
        != ' | '
    if !theme.busuanzi || theme.busuanzi.uv.enable
        span(class='ic i-user')
        span()
            != (theme.busuanzi && theme.busuanzi.uv.title) || '本站访客量'
            != ' '
            span(id="busuanzi_value_site_uv")
            != ' '
            != (theme.busuanzi && theme.busuanzi.uv.quantifier) || '次'

Once reloaded, the counters should trigger properly.

Note: When debugging on http://localhost:4000/, your analytics count might show an astronomically high fallback number. Don’t worry about it—the counter will normalize once pushed to production.

Unresolved Bug: The Busuanzi counter currently breaks and drops packets when accessing the site through a proxy/VPN. The theme author suggested self-hosting the tracking API backend, which I might look into when I have some free time. :-P

Customizing Core Pug Templates

Completely Removing the Cat Loading Animation

Even though the theme allows you to toggle off the loading overlay via configuration properties, the asset overhead scripts still run behind the scenes. To completely eliminate the cat layout component:

Navigate to themes/shokax/layout/_partials/loading.pug and comment out or remove the div(class="cat") block entirely:

div(id="loading")
    //- div(class="cat")
    //-     div(class="body")
    //-     div(class="head")
    //-         div(class="face")
    //-     div(class="foot")
    //-         div(class="tummy-end")
    //-         div(class="bottom")
    //-         div(class="legs left")
    //-         div(class="legs right")
    //-     div(class="paw")
    //-         div(class="hands left")
    //-         div(class="hands right")

Modifying the Browser Tab Title Hover Format

After configuring title and alternate strings across the setup files, I noticed that the default mouse-hover title format renders clunkily as alternate=title. To change the delimiter to a clean pipe (|), adjust the corresponding evaluation statement inside themes/shokax/layout/_partials/layout.pug: !=${alternate?alternate + " | ":""}${title}${subtitle?" | "+subtitle:""}

Asset Optimization Tools

For matching multi-platform favicons and general images, here are some incredibly helpful asset-conversion utilities that I use during layout builds:

TODO

Self-hosting a custom Busuanzi API counter endpoint.
Refactoring the underlying CSS theme color variables.

Hello World!

Mon, 03 Mar 2025 00:00:00 GMT

This is the initial hello world post to demonstrate the blog structure. You can now start creating your own posts in the src/posts/ directory.

Onirexus' Blog

Implementing a Simple HTTP/HTTPS Proxy Server with Golang

1 HTTP/HTTPS Proxy Introduction

1.1 HTTP Proxy Workflow

1.2 HTTPS Proxy Workflow

Ref

2 Overall Structure

3 Parse the First Line of the Request

4 Connect to the Destination Server (HTTP Forwarding & HTTPS Tunneling)

5 Bidirectional Data Forwarding

6 Testing

7 Limitations

Related Reading

Implementing a Simple SOCKS5 Proxy Server with Golang

1 SOCKS5 Introduction

Ref: RFC 1928 - SOCKS Protocol Version 5

2 Overall Structure

3 Handshake & Authentication

4 Client Request Parsing

5 Connecting & Replying

6 Data Forwarding

7 Testing

8 Limitations

Related Reading

DN42 Peering Information

My Network Info

Nodes

Node 1: US01

Core Vector Calculus Theorems and Operational Rules

1 Unified Framework: Generalized Stokes’ Theorem

1D: Fundamental Theorem of Calculus

2D: Green’s Theorem

3D Surfaces: Stokes’ Theorem (Curl Theorem)

3D Volumes: Gauss’s Theorem (Divergence Theorem)

2 Operational Rules of the Del (∇\nabla∇) Operator

Vector Identity: ∇×(φA)\nabla \times (\varphi \mathbf{A})∇×(φA)

3 Summary

Basic Latin Grammar

Verb Conjugations

Sentence Structure

Possession

Adjectives and Noun-adjectives

Conjunctions and Adverbs

Migrating ShokaX Theme Blog From Hexo to Astro

Setting Up the Astro Environment

Copying Articles To New Directory

Front-matter: Cover, Tags & Categories

Callouts Only Render In .mdx

Configuring Astro

Disabling Navigation Bar Link Actions

Changing Favicon

Modifying the Site Establishment Time

Deploy to CloudFlare Pages

Managing Future Upgrades

Extensions

RSS

Waline Comments

Configuring IPV6-only VPS

1 Install Cloudflare WARP

2 Utilizing Public NAT64 DNS

3 Modifying the Static Hosts File

Beautifying Terminal Under Bash: starship+ble.sh

1 Forcing a Color Prompt

2 ble.sh

3 starship

Bonus: All-in-One Automated Script

Configuring Rclone to Automatically Backup VPS to a Cloud Drive

1 Configuring Rclone

2 The Backup Script

3 Setting Up the Cron Job

Linux Command Path Behaviors: Trailing Slashes and Wildcards

1 Pattern 1: Path-Insensitive (mv, cp, rm, chmod, chown, find)

1.1 Destination Does Not Exist

1.2 Destination Already Exists

1.2.1 Specifying the parent directory directly

1.2.2 Specifying a subdirectory with the same name

1.3 Destination Is a Regular File

2 Pattern 2: Path-Sensitive (rsync, ln, scp)

2.1 rsync

2.2 ln -s and rm (Symlinks)

2 Operational Rules of the Del ( $\nabla$ ) Operator

Vector Identity: $\nabla \times (\varphi \mathbf{A})$

3 The Wildcard (`*`) Problem

Format Output `fmt.Printf()`

Index Explicitly `[n]`

Alternative Format `#`

`iota`

`crypto/sha256`

Act Like `set`