# 1. 安装CANN toolkit
wget https://www.hiascend.com/software/cann/archive
tar -xvf CANN-toolkit-*.tar.gz
./install.sh

# 2. 配置环境变量
source /usr/local/ascend/ascend_toolkit/profile.sh

# 3. 部署MindSpore
pip install mindspore==2.3.0

# 4. 配置MPI
mpirun -n 64 --map-by ppr:8:node ./ai4s_app --config config.yaml

# Prometheus 监控配置
scrape_configs:
  - job_name: 'kunpeng-npu'
    static_configs:
      - targets: ['npu-exporter:9090']
    metrics_path: /metrics
    
  - job_name: 'ai4s-application'
    static_configs:
      - targets: ['app-monitor:9091']

# 安装 Docker
curl -fsSL https://get.docker.com | sh

# 安装 Kind
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.22.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind

# 安装 kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# 安装 Helm
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# 创建开发集群
kind create cluster --name dev --config kind-config.yaml

# 创建测试集群（隔离环境）
kind create cluster --name test --config kind-config.yaml

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
    extraPortMappings:
      - containerPort: 80
        hostPort: 80
        protocol: TCP
      - containerPort: 443
        hostPort: 443
        protocol: TCP
  - role: worker
  - role: worker

# 部署 NGINX Ingress
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml

# 验证
kubectl wait --namespace ingress-nginx \
  --for=condition=ready pod \
  --selector=app.kubernetes.io/component=controller \
  --timeout=90s

# 安装 CoreDNS 优化配置
kubectl apply -f https://raw.githubusercontent.com/coredns/coredns/master/coredns.yaml

# local-path-storage.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-path
provisioner: rancher.io/local-path
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Delete

kubectl apply -f local-path-storage.yaml

# 使用 Kind 内置的 Docker  Registry
kind build node-image --image myapp:dev ./

# 或直接加载到集群
kind load docker-image myapp:dev --name dev

# 安装 Telepresence
brew install telepresence  # macOS
# 或
curl -fL https://app.gettelepresence.io/download/linux/binary > telepresence && chmod +x telepresence && sudo mv telepresence /usr/local/bin/

# 拦截服务流量
telepresence intercept myapp --port 3000:3000

# 临时端口转发
kubectl port-forward svc/myapp 3000:3000 -n dev

# 或使用 kubectl-aliases 简化
alias kpf='kubectl port-forward'
kpf svc/myapp 3000:3000

# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: dev
data:
  NODE_ENV: "development"
  LOG_LEVEL: "debug"
  API_ENDPOINT: "http://api.dev.local"

kubectl apply -f configmap.yaml

# 创建 Secret
kubectl create secret generic db-credentials \
  --from-literal=username=app \
  --from-literal=password=secret \
  -n dev

# 或使用 Helm Secrets 插件
helm secrets install my-release ./charts/myapp \
  --set db.password=$(cat .secrets/db-password)

# 查看 Pod 日志
kubectl logs -f deployment/myapp -n dev

# 查看上一个实例的日志（重启后）
kubectl logs -f deployment/myapp -n dev --previous

# 查看特定容器
kubectl logs -f deployment/myapp -c sidecar -n dev

# 进入容器
kubectl exec -it deployment/myapp -n dev -- /bin/sh

# 或使用 debug 模式启动临时容器
kubectl debug -it deployment/myapp -n dev --image=busybox --target=myapp

# 查看资源使用
kubectl top pods -n dev
kubectl top nodes

# 查看事件
kubectl get events -n dev --sort-by='.lastTimestamp'

# .github/workflows/test.yml
name: Test

on: [push]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Kind
        uses: helm/kind-action@v1
        with:
          config: kind-config.yaml
      
      - name: Deploy
        run: |
          kubectl apply -f k8s/
          kubectl wait --for=condition=ready pod -l app=myapp --timeout=120s
      
      - name: Run Tests
        run: npm test

version: "3.8"

services:
  app:
    image: ${APP_IMAGE:-myapp:latest}
    restart: unless-stopped
    environment:
      - NODE_ENV=${NODE_ENV:-development}
      - LOG_LEVEL=${LOG_LEVEL:-info}
    depends_on:
      - db
      - redis

  db:
    image: postgres:${POSTGRES_VERSION:-16}
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-app}
      - POSTGRES_USER=${POSTGRES_USER:-app}
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password

  redis:
    image: redis:${REDIS_VERSION:-7-alpine}
    command: redis-server --maxmemory 256mb

volumes:
  db_data:

version: "3.8"

services:
  app:
    image: myapp:${APP_VERSION:-1.0.0}
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 2G
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    secrets:
      - db_password
    networks:
      - frontend
      - backend

  db:
    deploy:
      resources:
        limits:
          memory: 4G
    volumes:
      - db_data:/var/lib/postgresql/data
      - ./backups:/backups

secrets:
  db_password:
    external: true

networks:
  frontend:
    driver: bridge
  backend:
    internal: true

# .env.prod
# 应用配置
APP_VERSION=1.0.0
NODE_ENV=production
LOG_LEVEL=warn

# 数据库
POSTGRES_VERSION=16
POSTGRES_DB=app_prod
POSTGRES_USER=app

# Redis
REDIS_VERSION=7-alpine

# 镜像仓库
REGISTRY_URL=registry.example.com

# 使用 Docker secrets
echo "your-secure-password" | docker secret create db_password -

# 或在 Kubernetes 中使用 Secret
kubectl create secret generic db-credentials --from-literal=password=your-secure-password

#!/bin/bash
set -euo pipefail

ENV=${1:-dev}
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

echo "🚀 部署到环境: ${ENV}"

# 1. 加载环境变量
set -a
source "${PROJECT_DIR}/environments/${ENV}/.env.${ENV}"
set +a

# 2. 拉取最新镜像
docker compose -f docker-compose.yml \
               -f environments/${ENV}/docker-compose.${ENV}.yml \
               pull

# 3. 执行数据库迁移
docker compose -f docker-compose.yml \
               -f environments/${ENV}/docker-compose.${ENV}.yml \
               run --rm app npm run migrate

# 4. 启动服务
docker compose -f docker-compose.yml \
               -f environments/${ENV}/docker-compose.${ENV}.yml \
               up -d --remove-orphans

# 5. 健康检查
sleep 10
docker compose -f docker-compose.yml \
               -f environments/${ENV}/docker-compose.${ENV}.yml \
               ps

echo "✅ 部署完成"

#!/bin/bash
set -euo pipefail

ENV=${1:-dev}
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

echo "⏪ 回滚环境: ${ENV}"

# 获取上一个版本
PREV_VERSION=$(docker images --format "{{.Tag}}" myapp | head -2 | tail -1)

# 更新环境变量
sed -i "s/APP_VERSION=.*/APP_VERSION=${PREV_VERSION}/" \
    "${PROJECT_DIR}/environments/${ENV}/.env.${ENV}"

# 重新部署
"${PROJECT_DIR}/scripts/deploy.sh" "${ENV}"

echo "✅ 回滚完成至版本: ${PREV_VERSION}"

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Staging
        run: ./scripts/deploy.sh staging
        env:
          DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_TOKEN }}

  deploy-prod:
    needs: deploy-staging
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Production
        run: ./scripts/deploy.sh prod
        env:
          DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_TOKEN }}

# 宿主机执行（192.168.0.200）
ssh-keygen -t ed25519 -C "hermes-agent" -f /home/ksboy/.ssh/hermes_key
# 设置权限
chmod 600 /home/ksboy/.ssh/hermes_key
chmod 644 /home/ksboy/.ssh/hermes_key.pub

# 宿主机执行
cat /home/ksboy/.ssh/hermes_key.pub >> /home/ksboy/.ssh/authorized_keys
chmod 600 /home/ksboy/.ssh/authorized_keys

services:
  hermes-agent:
    image: hermes-agent:latest
    volumes:
      # 密钥挂载（只读模式）
      - /home/ksboy/.ssh/hermes_key:/root/.ssh/id_ed25519:ro
      - /home/ksboy/.ssh/hermes_key.pub:/root/.ssh/id_ed25519.pub:ro
      # SSH配置
      - /home/ksboy/.ssh/config:/root/.ssh/config:ro
    environment:
      - SSH_HOST=192.168.0.200
      - SSH_USER=ksboy

# /etc/ssh/sshd_config
# 允许Docker网段访问
ListenAddress 0.0.0.0

# 重启SSH服务
systemctl restart sshd

# 容器内测试
ssh -i /root/.ssh/id_ed25519 ksboy@192.168.0.200 "echo '连接成功'"

# 重启容器后再次测试
docker-compose restart hermes-agent
ssh -i /root/.ssh/id_ed25519 ksboy@192.168.0.200 "echo '重启后连接成功'"

# ❌ 错误做法
docker exec -it hermes-agent ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519
# 容器重启后密钥丢失

# ❌ 错误做法
chmod 644 /home/ksboy/.ssh/hermes_key  # SSH拒绝使用
# ✅ 正确做法
chmod 600 /home/ksboy/.ssh/hermes_key

# ❌ 错误做法
ListenAddress 127.0.0.1  # Docker容器无法连接
# ✅ 正确做法
ListenAddress 0.0.0.0

# 银狐病毒检测脚本 - Windows版本
# 来源: zseagate/SilverFox-Scanner

Write-Host "=== 银狐病毒检测 (Windows) ===" -ForegroundColor Cyan

# 1. 检查恶意进程
Write-Host "`n[1/6] 检查可疑进程..." -ForegroundColor Yellow
$maliciousProcesses = @("foxservice.exe", "xfolder32*", "svchost.exe", "*silverfox*", "pXDc9LSz.exe", "pQpfOm.exe", "svchost64.exe")
$foundProcesses = Get-Process | Where-Object { $processName = $_.Name; $maliciousProcesses | Where-Object { $processName -like $_ } }
if ($foundProcesses) {
    Write-Host "发现可疑进程:" -ForegroundColor Red
    $foundProcesses | Format-Table Id, Name, Path, StartTime -AutoSize
} else {
    Write-Host "未发现已知恶意进程" -ForegroundColor Green
}

# 2. 检查注册表持久化项
Write-Host "`n[2/6] 检查注册表持久化项..." -ForegroundColor Yellow
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
)
foreach ($key in $runKeys) {
    Write-Host "检查 $key..."
    try {
        Get-ItemProperty -Path $key -ErrorAction Stop | Select-Object * | Format-List
    } catch {
        Write-Host "无法读取该注册表项" -ForegroundColor Gray
    }
}

# 3. 检查WMI事件订阅（银狐常用持久化方式）
Write-Host "`n[3/6] 检查WMI事件订阅..." -ForegroundColor Yellow
Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "发现WMI事件过滤器: $($_.Name)" -ForegroundColor Red
    Write-Host "查询语句: $($_.Query)"
}

# 4. 检查计划任务
Write-Host "`n[4/6] 检查计划任务..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.TaskName -like "*Task1*" -or $_.Description -like "*SilverFox*" } | Format-Table TaskName, State, Description -AutoSize

# 5. 检查常见恶意文件路径
Write-Host "`n[5/6] 扫描恶意文件路径..." -ForegroundColor Yellow
$scanPaths = @(
    "C:\ProgramData\xfolder32",
    "C:\Users\Public\Documents\",
    $env:TEMP,
    "C:\Users\$env:USERNAME\AppData\Local\Temp"
)
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        Write-Host "扫描 $path..."
        Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "svchost64\.exe|.*\.silverfox|!!!文件恢复指南.*" } | ForEach-Object {
            Write-Host "发现可疑文件: $($_.FullName)" -ForegroundColor Red
        }
    }
}

# 6. 检查Windows Defender排除项（银狐常篡改此配置）
Write-Host "`n[6/6] 检查Windows Defender排除路径..." -ForegroundColor Yellow
$exclusions = Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
if ($exclusions) {
    Write-Host "发现排除路径:" -ForegroundColor Red
    $exclusions | ForEach-Object { Write-Host $_ }
} else {
    Write-Host "未发现异常排除路径" -ForegroundColor Green
}

Write-Host "`n排查完成，若发现上述可疑项目，请立即断网并使用专杀工具清理" -ForegroundColor Cyan

#!/bin/bash
# 银狐病毒检测脚本 - Linux版本
# 来源: zseagate/SilverFox-Scanner

echo -e "\033[36m=== 银狐病毒检测 (Linux) ===\033[0m"

# 1. 检查可疑进程
echo -e "\n\033[33m[1/5] 检查可疑进程...\033[0m"
ps aux | grep -iE "silverfox|foxservice|svchost|minerd|xmrig" | grep -v grep
if [ $? -eq 0 ]; then
    echo -e "\033[31m发现可疑进程，请重点检查上述进程\033[0m"
fi

# 2. 检查开机启动项
echo -e "\n\033[33m[2/5] 检查开机启动项...\033[0m"
systemctl list-unit-files --type=service | grep -iE "silverfox|malware|unknown"
crontab -l 2>/dev/null | grep -iE "curl|wget|bash|python.*http"
cat /etc/crontab | grep -iE "curl|wget|bash|python.*http"

# 3. 检查恶意文件
echo -e "\n\033[33m[3/5] 扫描常见恶意路径...\033[0m"
scan_dirs=("/tmp" "/var/tmp" "/dev/shm" "/root" "/home")
for dir in "${scan_dirs[@]}"; do
    echo "扫描 $dir..."
    find "$dir" -type f \( -name "*.silverfox" -o -name "*silverfox*" -o -name "foxservice" \) 2>/dev/null
done

# 4. 检查网络连接
echo -e "\n\033[33m[4/5] 检查可疑网络连接...\033[0m"
netstat -antp 2>/dev/null | grep -iE "estab|listen" | grep -v ":22\|:80\|:443" | grep -v "127.0.0.1"

# 5. 检查最近修改的文件
echo -e "\n\033[33m[5/5] 检查最近24小时修改的可执行文件...\033[0m"
find / -type f -mtime -1 -perm /u+x 2>/dev/null | grep -vE "/bin|/sbin|/usr/bin|/usr/sbin" | head -20

echo -e "\n\033[36m排查完成，若发现可疑项请及时隔离并清理\033[0m"

#!/bin/bash
# 银狐病毒检测脚本 - macOS版本
# 来源: zseagate/SilverFox-Scanner

echo -e "\033[36m=== 银狐病毒检测 (macOS) ===\033[0m"

# 1. 检查可疑进程
echo -e "\n\033[33m[1/5] 检查可疑进程...\033[0m"
ps aux | grep -iE "silverfox|foxservice|svchost" | grep -v grep
if [ $? -eq 0 ]; then
    echo -e "\033[31m发现可疑进程，请重点检查上述进程\033[0m"
fi

# 2. 检查启动项与LoginHook
echo -e "\n\033[33m[2/5] 检查开机启动项...\033[0m"
launchctl list | grep -iE "silverfox|unknown|malware"
defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

# 3. 检查LaunchAgents/LaunchDaemons
echo -e "\n\033[33m[3/5] 检查Launch配置...\033[0m"
launch_dirs=(
    "/Library/LaunchAgents"
    "/Library/LaunchDaemons"
    "$HOME/Library/LaunchAgents"
)
for dir in "${launch_dirs[@]}"; do
    echo "检查 $dir..."
    ls -la "$dir" | grep -iE "silverfox|foxservice|unknown"
done

# 4. 扫描恶意文件
echo -e "\n\033[33m[4/5] 扫描恶意文件...\033[0m"
scan_dirs=("/tmp" "/var/tmp" "$HOME/Downloads" "$HOME/Documents" "/Applications")
for dir in "${scan_dirs[@]}"; do
    find "$dir" -type f \( -name "*.silverfox" -o -name "*silverfox*" -o -name "SilverFox.app" \) 2>/dev/null
done

# 5. 检查网络连接
echo -e "\n\033[33m[5/5] 检查可疑网络连接...\033[0m"
lsof -i -P | grep -iE "listen|established" | grep -v ":22\|:80\|:443" | grep -v "127.0.0.1"

echo -e "\n\033[36m排查完成，若发现可疑项建议使用专业安全工具进一步扫描\033[0m"

# 扫描整个系统
yara -r silverfox.yar /

# 扫描特定目录
yara silverfox.yar /tmp

# 扫描进程内存（需要libyara）
yara -m silverfox.yar /proc/<pid>/mem