我自己搭建的 Nginx Web Server 想要提供 HTTPS 连接方式，但是觉得不想花钱去找知名 CA 证书中心 (e.g. AWS Certificate Manager) 购买证书。于是我想通过 Self-Signed 的方式来解决我的需求：



1. 首先生成 Self-Signed CA 证书：
```shell
openssl req \
        -newkey rsa:2048 -nodes -keyout self-ca.key \
        -x509 -days 365 -out self-ca.crt
```
2. 生成 Nginx Web Server 需要的 Private Key & CSR ：
```shell
openssl req \
        -newkey rsa:2048 -nodes -keyout nginx.key \
        -out nginx.csr
```
3. 利用 Self-Signed CA 证书，来签发业务所需要的 CRT 证书：
```shell
openssl x509 \
        -req -in nginx.csr \
        -out nginx.crt \
        -CAcreateserial -days 365 \
        -CA self-ca.crt -CAkey self-ca.key
```

经过了上面 3 个步奏后，你就得到了 self-ca.crt & self-ca.key ，以及由它签发出来的 nginx.crt & nginx.key 。
如何使用上面 4 个文件：首先将 nginx.crt & nginx.key 部署在 Nginx Web Server 上，然后将 self-ca.crt 发布给客户端即可。客户端就可以通过 self-ca.crt 与业务服务器建立 SSL/TLS 安全连接。


### 生成私钥及证书
```shell
openssl req -newkey rsa:4096 -nodes -keyout server.key -x509 -days 365 -out server.crt -subj "/C=CN/ST=st/L=l/O=o/OU=ou/CN=cn/emailAddress=xxx@xxx.com"
```


### 生成随机密码
```shell
openssl rand -base64 32
```

OpenSSL 一些笔记

### 软件源的替换
```shell
# sed -i 's_https\?://mirrors.vsean.net/openwrt_https://mirrors.tuna.tsinghua.edu.cn/openwrt_' /etc/opkg/distfeeds.conf
# sed -i 's_https\?://downloads.openwrt.org_https://mirrors.tuna.tsinghua.edu.cn/openwrt_' /etc/opkg/distfeeds.conf

sed -e 's,https://downloads.immortalwrt.org,https://mirrors.ustc.edu.cn/immortalwrt,g' \
-e 's,https://mirrors.vsean.net/openwrt,https://mirrors.ustc.edu.cn/immortalwrt,g' \
-i.bak /etc/opkg/distfeeds.conf
```

### 安装必备软件
```shell
opkg update && opkg install luci-theme-argon luci-i18n-argon-config-zh-cn kmod-usb-net-rndis kmod-usb-net-ipheth usbmuxd

# opkg update && opkg install luci-app-homeproxy luci-i18n-homeproxy-zh-cn ip-full kmod-tun
# opkg update && opkg install luci-app-openclash
```

### 更新所有软件包
```shell
opkg update && opkg list-upgradable | cut -f 1 -d ' ' | xargs -r opkg upgrade
```

### 刷机教程 (OpenWrt & ImmortalWrt Git提交记录)

#### 128M
```
mediatek: add support for Cudy TR3000 v1
Hardware:
 - SoC: MediaTek MT7981B
 - CPU: 2x 1.3 GHz Cortex-A53
 - Flash: 128 MiB SPI NAND
 - RAM: 512 MiB
 - WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
 - Ethernet: 1x 10/100/1000/2500 Mbps RTL8221B WAN, 1x10/100/1000 Mbps MT7981 LAN
 - USB 3.0 port
 - Buttons: 1 Reset button, 1 slider button
 - LEDs: 1x Red, 1x White
 - Serial console: internal test points, 115200 8n1
 - Power: 5 VDC, 3 A

MAC addresses:
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| WAN     | 80:af:ca:xx:xx:x1 | label+1   |
| LAN     | 80:af:ca:xx:xx:x0 | label     |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label     |
| WLAN 5g | 82:af:ca:xx:xx:x0 |           |
+---------+-------------------+-----------+

Installation:
The installation must be done via TFTP by disassembling the router. On other occasions Cudy has distributed intermediate firmware to make installation easier, and so I recommend checking the Wiki for this device if there is a more convenient solution than the one below.

To install using TFTP:
1. Connect to UART.
2. With the router off, press the RESET button. While the router is turning on, the button should continue to be pressed for at least 5 seconds.
3. A u-boot shell will automatically open.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP server and an OpenWrt initramfs-kernel.bin firmware file.
5. Run these steps in u-boot using the name of your file.

setenv bootfile initramfs-kernel.bin
tftpboot
bootm

6. If you can reach LuCI or SSH now, just use the sysupgrade image with the 'Keep settings' option turned off.

---
mediatek: add ubootmod layout for cudy tr3000 v1
This allows us to use the full size of nand, which increases ubi size
from 64M to 122.25M.

If you are at factory firmware, please refer commit 63b8d98 ("mediatek: add support for Cudy TR3000 v1")
to boot into OpenWrt initramfs (stock layout version).

Flash instructions:
1. Login into the device and backup everything, especially 'Factory' part.
2. Unlock mtd partitions:
   apk update && apk add kmod-mtd-rw
   insmod mtd-rw i_want_a_brick=1
2. Write new BL2 and FIP
   mtd write openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-preloader.bin BL2
   mtd write openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC:
   IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.

```

#### 256M
```
mediatek: add support for Cudy TR3000  256MB  v1 flash version
This device is similar to the Cudy TR3000 v1 128MB version.
The difference is that the flash memory is 128mb and the other is 256mb

Hardware:
 - SoC: MediaTek MT7981B
 - CPU: 2x 1.3 GHz Cortex-A53
 - Flash: 256 MiB SPI NAND
 - RAM: 512 MiB
 - WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
 - Ethernet: 1x 10/100/1000/2500 Mbps RTL8221B WAN, 1x10/100/1000 Mbps MT7981 LAN
 - USB 3.0 port
 - Buttons: 1 Reset button, 1 slider button
 - LEDs: 1x Red, 1x White
 - Power: 5 VDC, 3 A

Installation:
Cudy has distributed intermediate firmware to make installation easier
1. Go to [Cudy CN official website](https://www.cudy.com/zh-cn/pages/download-center/tr3000-1-0) and download the intermediate firmware
2. Upgrade the intermediate firmware on the page
3. Visit the intermediate firmware 192.168.1.1 webpage and use the sysupgrade image to update

other:
If you fail to flash the device, you can use TFTP to flash back to the original firmware.
1. Ask Cudy CN official customer service for the original firmware
2. With the router off, press the RESET button. While the router is turning on, the button should continue to be pressed for at least 5 seconds.
3. A u-boot shell will automatically open.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP server and an recovery.bin firmware file.

Signed-off-by: cheng wang <typedelta@outlook.com>
Link: openwrt/openwrt#19167
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
```

ImmortalWrt 一些配置（Cudy TR3000 v1）

### 创建WSL容器
```shell
LxRunOffline i -n ImmortalWrt -f ubuntu-jammy-amd64-default-root.tar.xz -d D:\VM\WSL\ImmortalWrt
wsl --set-version ImmortalWrt 2
LxRunOffline r -n ImmortalWrt

sudo tee -a /etc/wsl.conf << EOF > /dev/null
[interop]
enabled = false
appendWindowsPath = false
EOF

exit

wsl --shutdown
LxRunOffline r -n ImmortalWrt
```

### 安装软件包
```shell
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y bash-completion build-essential clang flex bison g++ gawk \
gcc-multilib g++-multilib gettext git libncurses-dev libssl-dev \
python3-distutils python3-setuptools rsync swig unzip zlib1g-dev file wget
```

### 下载代码
```shell
git clone -b openwrt-24.10 --filter=blob:none https://github.com/immortalwrt/immortalwrt
```

### 编译
```shell
pushd immortalwrt/
# 第一次编译
./scripts/feeds update -a
./scripts/feeds install -a
# 编译配置选项
FORCE_UNSAFE_CONFIGURE=1 make menuconfig

FORCE_UNSAFE_CONFIGURE=1 make download -j8
FORCE_UNSAFE_CONFIGURE=1 make V=s -j1

# 二次以上编译
git pull
./scripts/feeds update -a
./scripts/feeds install -a
FORCE_UNSAFE_CONFIGURE=1 make defconfig
FORCE_UNSAFE_CONFIGURE=1 make download -j8
FORCE_UNSAFE_CONFIGURE=1 make V=s -j$(nproc)
popd
```

OpenWrt & ImmortalWrt 编译环境（WSL）

ROS2 学习笔记

### ROS2-Desktop-Full Gui
```shell
xhost + && sudo docker run -it --rm --net=host -v /dev:/dev -v $HOME/.Xauthority:/root/.Xauthority:ro -e DISPLAY=unix$DISPLAY osrf/ros:humble-desktop-full
```

### ROS2-Desktop Cli 
```bash
# talker
docker run -it --rm osrf/ros:humble-desktop ros2 run demo_nodes_cpp talker
# listener
docker run -it --rm osrf/ros:humble-desktop ros2 run demo_nodes_cpp listener
```

### docker-compose.yml
```yml
version: '2'

services:
  talker:
    image: osrf/ros:humble-desktop
    command: ros2 run demo_nodes_cpp talker
  listener:
    image: osrf/ros:humble-desktop
    command: ros2 run demo_nodes_cpp listener
    depends_on:
      - talker
```


### micro-ROS Agent in Docker
```bash
# UDPv4 micro-ROS Agent
sudo docker run -it --rm --net=host microros/micro-ros-agent:$ROS_DISTRO udp4 --port 8888 -v6

# Serial micro-ROS Agent
sudo docker run -it --rm -v /dev:/dev  --privileged --net=host microros/micro-ros-agent:$ROS_DISTRO serial -b 115200 --dev [YOUR BOARD PORT] -v6

# TCPv4 micro-ROS Agent
sudo docker run -it --rm --net=host microros/micro-ros-agent:$ROS_DISTRO tcp4 --port 8888 -v6

# CAN-FD micro-ROS Agent
sudo docker run -it --rm -v /dev:/dev --privileged --net=host microros/micro-ros-agent:$ROS_DISTRO canfd --dev [YOUR CAN INTERFACE] -v6
```

### 拉取 arm64 架构镜像
```shell
docker pull --platform=arm64
```

### 导出镜像
```shell
docker save osrf/ros:humble-desktop-full | pigz -9 -p 16 > humble-desktop-full.tgz
**```**

软件源的替换

创建WSL容器

一些理论

自动驾驶三层架构

感知层

ROS2-Desktop-Full Gui