OKHK

The Helm chart for Envoy Gateway Homepage: https://gateway.envoyproxy.io/ Maintainers Name Email Url envoy-gateway-steering-committee https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md envoy-gateway-maintainers https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS Source Code https://github.com/envoyproxy/gateway Requirements Repository Name Version crds 0.0.0 Values Key Type Default Description certgen object {"job":{"affinity":{},"annotations":{},"args":[],"nodeSelector":{},"pod":{"annotations":{},"labels":{},"securityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}} Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify values.yaml to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. commonLabels object {} Labels to apply to all resources config.envoyGateway object {"extensionApis":{},"gateway":{"controllerName":"gateway.envoyproxy.io/gatewayclass-controller"},"logging":{"level":{"default":"info"}},"provider":{"type":"Kubernetes"}} EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options. crds.enabled bool true Install Envoy Gateway CRDs, Gateway API CRDs, and Gateway API safe upgrade policy resources. Set to false when these resources are managed separately. createNamespace bool false deployment.annotations object {} deployment.envoyGateway.extraEnv list [] Additional environment variables for the envoy-gateway container. deployment.envoyGateway.image.repository string "" deployment.envoyGateway.image.tag string "" deployment.envoyGateway.imagePullPolicy string "" deployment.envoyGateway.imagePullSecrets list [] deployment.envoyGateway.livenessProbe.httpGet.path string "/healthz" deployment.envoyGateway.livenessProbe.httpGet.port int 8081 deployment.envoyGateway.livenessProbe.periodSeconds int 20 deployment.envoyGateway.livenessProbe.successThreshold int 1 deployment.envoyGateway.livenessProbe.timeoutSeconds int 1 deployment.envoyGateway.readinessProbe.httpGet.path string "/readyz" deployment.envoyGateway.readinessProbe.httpGet.port int 8081 deployment.envoyGateway.readinessProbe.periodSeconds int 10 deployment.envoyGateway.readinessProbe.successThreshold int 1 deployment.envoyGateway.readinessProbe.timeoutSeconds int 1 deployment.envoyGateway.resources.limits.memory string "1024Mi" deployment.envoyGateway.resources.requests.cpu string "100m" deployment.envoyGateway.resources.requests.memory string "256Mi" deployment.envoyGateway.securityContext.allowPrivilegeEscalation bool false deployment.envoyGateway.securityContext.capabilities.drop[0] string "ALL" deployment.envoyGateway.securityContext.privileged bool false deployment.envoyGateway.securityContext.readOnlyRootFilesystem bool true deployment.envoyGateway.securityContext.runAsGroup int 65532 deployment.envoyGateway.securityContext.runAsNonRoot bool true deployment.envoyGateway.securityContext.runAsUser int 65532 deployment.envoyGateway.securityContext.seccompProfile.type string "RuntimeDefault" deployment.envoyGateway.startupProbe.failureThreshold int 30 deployment.envoyGateway.startupProbe.httpGet.path string "/healthz" deployment.envoyGateway.startupProbe.httpGet.port int 8081 deployment.envoyGateway.startupProbe.periodSeconds int 1 deployment.envoyGateway.startupProbe.successThreshold int 1 deployment.envoyGateway.startupProbe.timeoutSeconds int 1 deployment.envoyGateway.strategy object {} Volume source for the Wasm module cache mounted at /var/lib/eg/wasm. Defaults to an emptyDir when left empty. Example: persist the Wasm module cache across controller restarts by backing it with a PersistentVolumeClaim: wasmCacheVolume: persistentVolumeClaim: claimName: envoy-gateway-wasm-cache deployment.envoyGateway.wasmCacheVolume object {} deployment.pod.affinity object {} deployment.pod.annotations.“prometheus.io/port” string "19001" deployment.pod.annotations.“prometheus.io/scrape” string "true" deployment.pod.extraVolumeMounts list [] deployment.pod.extraVolumes list [] deployment.pod.labels object {} deployment.pod.nodeSelector object {} deployment.pod.securityContext.fsGroup int 65532 deployment.pod.securityContext.runAsGroup int 65532 deployment.pod.securityContext.runAsNonRoot bool true deployment.pod.securityContext.runAsUser int 65532 deployment.pod.securityContext.seccompProfile.type string "RuntimeDefault" deployment.pod.tolerations list [] deployment.pod.topologySpreadConstraints list [] deployment.ports[0].name string "grpc" deployment.ports[0].port int 18000 deployment.ports[0].targetPort int 18000 deployment.ports[1].name string "ratelimit" deployment.ports[1].port int 18001 deployment.ports[1].targetPort int 18001 deployment.ports[2].name string "wasm" deployment.ports[2].port int 18002 deployment.ports[2].targetPort int 18002 deployment.ports[3].name string "metrics" deployment.ports[3].port int 19001 deployment.ports[3].targetPort int 19001 deployment.priorityClassName string nil deployment.replicas int 1 global.imagePullSecrets list [] Global override for image pull secrets global.imageRegistry string "" Global override for image registry global.images.envoyGateway.image string nil Full image for the Envoy Gateway control plane Deployment installed by this chart. global.images.envoyGateway.pullPolicy string nil Image pull policy for the Envoy Gateway control plane Deployment. Default behavior: latest images will be Always else IfNotPresent. global.images.envoyGateway.pullSecrets list [] Pull secrets for the Envoy Gateway control plane Deployment. global.images.envoyProxy.image string "" Full image for the managed Envoy Proxy data plane. This updates the generated envoyProxy config and does not change the envoy-gateway control plane Deployment image. If not specified, the default image built into envoy-gateway is used. global.images.envoyProxy.pullPolicy string "" Image pull policy for the managed Envoy Proxy data plane. Default behavior: IfNotPresent. global.images.envoyProxy.pullSecrets list [] Pull secrets for the managed Envoy Proxy data plane. global.images.ratelimit.image string "docker.io/envoyproxy/ratelimit:master" global.images.ratelimit.pullPolicy string "IfNotPresent" global.images.ratelimit.pullSecrets list [] hpa.behavior object {} hpa.enabled bool false hpa.maxReplicas int 1 hpa.metrics list [] hpa.minReplicas int 1 kubernetesClusterDomain string "cluster.local" namespaceOverride string "" Override the namespace for resources deployed by the chart. Defaults to the release namespace. podDisruptionBudget.minAvailable int 0 service.annotations object {} service.trafficDistribution string "" service.type string "ClusterIP" Service type. Can be set to LoadBalancer with specific IP, e.g.: type: LoadBalancer loadBalancerIP: 10.236.90.20 topologyInjector.annotations object {} topologyInjector.enabled bool true

docker-traefik-dns - 根据容器标签 URL 自动创建 Cloudflare DNS 记录

Tue, 08 Sep 2026 16:00:00 GMT

在服务器上部署服务后，还要到 Cloudflare 上配置一条 DNS 记录，有点麻烦。

（~~虽然 AI Agent 能自动去干，但是 token 在这方面烧不起也没必要，而且有时候还有幻觉不确定性~~）

OKHK ✨ 使用 Cloudflare Tunnel 和 Traefik 访问部署的 Docker 服务

文章记录了个人自建服务的“古法运维”方案：利用 Traefik 作为本地容器的反向代理和动态服务发现，结合 Cloudflare Tunnel 实现内网穿透和安全访问。

https://note.okhk.net/self-hosted-service-with-traefik-and-cloudflare-tunnel

既然 Traefik 通过 Lable 完成了对其他服务的反向代理，而 Lable 中也有对应的服务域名，那么再来个程序依据 Lable 中的域名自动去调用 Cloudflare 的 API 添加对应的 A 记录或者 CNAME 记录不就完成上线可以访问了。

把想法和 AI 讨论一番后，直接就得到了下面这个简单项目

GitHub - hkint/docker-traefik-dns: A lightweight dynamic DNS sync service for Docker and Traefik environments.

A lightweight dynamic DNS sync service for Docker and Traefik environments. - hkint/docker-traefik-dns

https://github.com/hkint/docker-traefik-dns

compose.yaml

Podroid 简单体验 - Android 上无需 root 运行 Alpine Linux 虚拟机容器环境

Sat, 29 Aug 2026 16:00:00 GMT

Podroid 是一款在 Android 上运行真正的 Linux 系统的应用，包含 Podman、Docker、LXC 和 Linux 桌面环境，无需 root 权限，也无需自定义 Recovery。它在应用内通过 KVM 启动了一个 Alpine Linux 虚拟机，并搭载了定制的 Linux 7.1.5 内核。

GitHub - ExTV/Podroid: A rootless Android app that boots Alpine Linux: run containers (Podman/Docker/LXC) and GUI desktop apps.

A rootless Android app that boots Alpine Linux: run containers (Podman/Docker/LXC) and GUI desktop apps. - ExTV/Podroid

https://github.com/ExTV/Podroid

Overview · Podroid docs

Podroid documentation: run Linux containers and a Linux desktop on Android with no root, via a real Alpine VM on QEMU or AVF/pKVM.

https://extv.github.io/Podroid/guide/

之前也曾分享过：

Podroid - Android 免 Root 运行 Linux 容器（Podman）

Podroid - Android 免 Root 运行 Linux 容器（Podman）https://github.com/ExTV/Podroid使用 QEMU 启动了一个轻量级 Alpine Linux 虚拟机，从而实现完整的 Podman 容器运行环境。支持 OCI 镜像、存储持久化与端口转发#Android #Docker #Tool #GitHub

https://tg.okhk.net/posts/9276

刚好手头上有台旧手机，刚好安装体验下。下载 Release 中的 apk 安装运行，根据安装引导，完成配置启动。点击打开终端后在右上角启用服务器模式，可以让手机黑屏从而节省电量消耗。

此时得到 SSH 连接信息如下，默认的密码是 podroid。


  Host podroid
  HostName 192.168.31.9
  Port 9922
  User root

在其他设备上 SSH 连上 Alpine 虚拟机：

替换镜像源


sed -i 's/dl-cdn.alpinelinux.org/mirrors.ustc.edu.cn/g' /etc/apk/repositories

配置时区


apk add tzdata
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
echo "Asia/Shanghai" > /etc/timezone

~~创建具有等效 sudo 权限的普通用户~~（感觉没啥必要，反正是玩具环境）：

使用 Cloudflare Tunnel 和 Traefik 访问部署的 Docker 服务

Mon, 09 Feb 2026 16:00:00 GMT

自部署的 Docker 服务用起来很舒心，但数量多了后，端口映射管理，防火墙端口规则，DNS 配置等也很麻烦。

Cloudflare Tunnel 服务，可以在不暴露服务器端口的情况下建立一条服务器连接到 Cloudflare 的隧道，再搭配上 Traefik 来实现各容器服务的服务发现和反向代理，从而可以在公网访问自部署的 Docker 服务。核心逻辑如下：

流量入口：用户访问域名 -> Cloudflare 边缘节点 -> Cloudflare Tunnel。

穿透层：cloudflared 容器通过隧道将流量拉取到本地 Docker 网络。

分发层：流量到达 Traefik，Traefik 根据 HTTP Host 规则（Labels）识别目标容器。

应用层：流量最终到达具体的业务容器（如 whoami）。

优势：无需公网 IP，无需在防火墙开启 80/443 端口，自带 SSL 证书管理。

流量路径示意


       [ 互联网 (Internet) ]
               ||
               \/
+---------------------------------------+
|        Cloudflare 全球网络             |
|    (DNS 解析 & 安全防护 & CDN)          |
+---------------------------------------+
               ||
      <== Cloudflare Tunnel ==> (加密隧道)
               ||
+--------------||------------------------+
|          宿主机 (Host)                 |
|              ||                       |
|   +----------\/----------+            |
|   |  cloudflared 容器    |            |
|   +----------||----------+            |
|              || (Docker Network: traefik)
|   +----------\/----------+            |
|   |    Traefik 容器      |            |
|   | (反向代理/服务发现)    |            |
|   +----------||----------+            |
|              || (路由分发)             |
|   +----------\/----------+            |
|   |  业务容器 (如 whoami) |            |
|   +----------------------+            |
+---------------------------------------+

💡

这套方案用了很久了，但早前都是手动配置了就开始用了。这次服务器被迫重装顺便记录下这种“古法运维”。

现在 LLM / AI Agent 已经很强了，这些内容都能生成或者直接给你配置完成。这里就简单贴上配置，不做详细操作说明，毕竟 AI 大概干得更好。

Docker 环境配置略去不表。

Traefik 配置

traefik 容器网络配置脚本

network-setup.sh


#!/bin/bash

NETWORK_NAME=traefik

if [ -z $(docker network ls --filter name=^${NETWORK_NAME}$ --format="{{ .Name }}") ] ; then
    # 创建 Docker 网络
    output=$(docker network create ${NETWORK_NAME});
    # 检查输出是否为 64 位长度的字符串
    if [[ ${#output} -eq 64 ]]; then
        echo "create docker network for traefik ok"
    else
        echo "Network creation failed or output is not 64 characters long."
    fi
fi

执行👆脚本创建一个名为 Traefik 的容器网络。

traefik 容器配置

compose.yaml


services:
  traefik:
    container_name: traefik
    image: traefik
    restart: always
    command:
      - "--global.sendanonymoususage=false"
      - "--global.checknewversion=false"
      - "--entrypoints.web.address=:80"
      - "--api=true"
      - "--api.dashboard=true"
      - "--ping=true"
      - "--log.level=INFO"
      - "--log.format=common"
      - "--accesslog=false"
      - "--providers.docker=true"
      - "--providers.docker.watch=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.useBindPortIP=false"
      - "--providers.docker.network=traefik"
    ports:
      - "80:80" # 如本机/局域网也需要访问，则映射；仅走 Tunnel 可不映射
    environment:
      - TZ=Asia/Shanghai
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.okhk.net`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.entrypoints=web"
      # Traefik 管理面板安全认证配置
      - "traefik.http.routers.dashboard.middlewares=auth"
      # echo $(htpasswd -nb admin 你的密码) | sed -e s/\\$/\\$\\$/g
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$..."
      - "traefik.http.middlewares.gzip.compress=true"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    extra_hosts:
      - "update.traefik.io:127.0.0.1"
      - "collect.traefik.io:127.0.0.1"
      - "stats.g.doubleclick.net:127.0.0.1"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider --proxy off localhost:8080/ping || exit 1"]
      interval: 3s
      retries: 10
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
    networks:
      - traefik

networks:
  traefik:
    external: true

自部署服务配置

以 whoami 为例

whoami 容器配置

compose.yaml


services:
  whoami:
    image: traefik/whoami
    container_name: whoami
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.okhk.net`)"
      - "traefik.http.routers.whoami.entrypoints=web"
    networks:
      - traefik

networks:
  traefik:
    external: true

Traefik 可通过 lables 发现并代理 whoami 服务。

Cloudflare Tunnel 配置

cloudflared 容器配置

compose.yaml


services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: always
    command: tunnel --no-autoupdate run --token $TUNNEL_TOKEN
    environment:
      - TZ=Asia/Shanghai
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "cloudflared", "tunnel", "--metrics", "localhost:20241", "ready"]
      interval: 10s
      timeout: 10s
      retries: 5
      start_period: 20s
    networks:
      - traefik 
    
networks:
  traefik:
    external: true

.env


TUNNEL_TOKEN=

TUNNEL_TOKEN 获取

one.dash.cloudflare.com

We're streamlining our dashboard to keep all of your tools in one place. Please update your bookmarks to use dash.cloudflare.com.

https://one.dash.cloudflare.com/

可参考 Cloudflare 官网文档：

Create a tunnel (dashboard)

Follow this step-by-step guide to create your first remotely-managed tunnel using Cloudflare One.

https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/

复制命令中的 --token 后面的长字符串，将其作为环境变量填入上述文件中，启动 cloudflared 容器，建立 Cloudflare Tunnel 链接。

Cloudflare Tunnel 路由配置

公网域名 (Public Hostname)	服务协议	内部服务 URL (Service)	类型说明
`*.okhk.net`	HTTP	`http://traefik:80`	泛域名转发 (推荐)
`whoami.okhk.net`	HTTP	`http://traefik:80`	精确匹配

如果在 Cloudflare 中配置了泛域名（如 *.okhk.net）指向 http://traefik:80，那么之后新增 Docker 服务时，只需在 Docker Labels 里写好域名，无需再回 Cloudflare 页面操作。

如果使用精确域名，则后续每次新增 Docker 服务都需要手动配置域名转发到 http://traefik 。

（当然也可以借用一些工具实现根据 Traefik 服务发现情况自动调用 Cloudflare API 添加对应的 tunnel 路由规则，但出于某些原因（~~懒得整了~~）就没再弄了

香港汇丰银行红狮子提款卡电话人工客服激活 | TERR_30004 报错

Sun, 21 Dec 2025 16:00:00 GMT

🤣

更新：现在通过港澳通行证 + 人脸识别即可完成流动理财 App 的注册激活。 ——— 汇丰香港现已支持以往来港澳通行证开户的内地居民使用港澳通行证注册流动理财

长期以来，汇丰仅支持香港身份证客户和指定地区护照客户凭证件自行注册流动理财。

而非指定地区护照客户和使用港澳通行证开户的内地居民，若并非在线下分行开通账户，或遭遇线上开户申请未立即通过/立即通过但忘记注册流动理财等情况，而又无法前往线下分行请求职员协助开通，则需要使用提款卡卡号和提款卡密码才能注册流动理财。

而密码信以平邮寄出（日前汇丰已取消DHL邮寄密码信）送达率极低，经常有长期无法注册流动理财的情况。

更新汇丰香港APP版本至3.65.12后，现已支持使用拍摄/NFC读取港澳通行证照片+人脸的形式，激活流动理财，极大的缓解了上述尴尬局面。

背景

汇丰香港线上开户后，在内地收到了红狮子提款卡和密码函，需要先激活红狮子提款卡，然后才可以激活手机上汇丰流动理财 App。不然在 App 中按流程一步步操作最后输入港澳通行证号码后，页面会提示 TERR_30004 编号报错。

激活红狮子提款卡

根据激活的方式有以下两种

拨打香港汇丰客服电话： (+852) 22333000 激活。

汇丰 ATM 插卡配合密码函上的密码激活。

如有条件可先在内地 ATM 上尝试下，不行则还是拨打香港汇丰客服电话激活。

客服电话人工服务

毕竟是跨境通话，拨打电话是想要尽快接通人工客服的。而客服电话的等待不可避免，这里直接参考小红书网友分享的方法。

拨打 (+852) 22333000
根据语音提示选择语言，按 3 为普通话（1 为粤语，2 为英语）(有反馈说选粤语也行，最终转接的客服人员一般也会普通话
按 # 选择人工服务
系统语音会两次提示输入银行户口或信用卡号码，不要去按键输入，保持静默听完语音
上段语音结束后，系统语音会接着询问致电原因，还是继续保持静默等待语音结束
上段语音结束后，根据系统语音提示按两次 ## 进入按键式语音目录
根据语音提示，按 2 进入有限服务目录，继续保持静默等待
根据提示再按 1
根据提示再按 3 进入“自动柜员机，借记卡及相关服务”
此时系统就会很快会转接人工客服，接通后告诉对方要激活红狮子提款卡，按照客服的指示回答提供相关信息即可（红狮子卡卡号、卡号右下角的数字、发到预留手机号的验证码、相关信息核验等）
信息提供正确的情况下，客服在系统提交激活请求后，会告知需要 6 个工作日左右激活，到时会有短信提示。

此外，汇丰客服电话是 24 小时服务，可以尝试在晚间 10 点过后拨打，以减少等待时长，提高转接率。

附：联系香港客服的资费与白嫖技巧

使用 Tello 免费分钟：
在开启 Wi-Fi Calling 的状态下，直接使用 Tello 套餐内包含的免费分钟数拨打 +852 号码，无额外资费。

内地手机直拨 vs IP 前缀资费：
常规直拨：资费约 0.8 - 1.5 元/分钟（部分套餐高达 2.9 元）。
加拨 IP 前缀：移动前加 12593 或 17951，电信加 11808，联通加 10193。加拨后拨打香港，资费大幅降至约 0.39 - 0.4 元/分钟（需提前开通国际长途）。

🤖 中银香港 95566 免费代转秘籍
1. 用内地手机拨打国内中国银行客服 95566。
2. 接通后，直接对语音机器人说：“帮我转接境外服务电话”。
3. 根据语音提示输入 852#。
4. 系统将自动、免费代转至中银香港人工客服，免除国际长途话费。

汇丰卓越免费拨打客服全球转接尊敬的卓越阁下可以免费拨打国内客服电话400-920-0828进行全球转接！

开源 AI/LLM API 聚合项目列表

Mon, 10 Nov 2025 16:00:00 GMT

~~介绍就省略了吧…~~

GitHub - router-for-me/CLIProxyAPI: Wrap Antigravity, ChatGPT Codex, Claude Code, Grok Build as an OpenAI/Gemini/Claude/Codex compatible API service, allowing you to enjoy the free Gemini 3.1 Pro, GPT 5.6 Series, Grok 4.5, Claude model through API

Wrap Antigravity, ChatGPT Codex, Claude Code, Grok Build as an OpenAI/Gemini/Claude/Codex compatible API service, allowing you to enjoy the free Gemini 3.1 Pro, GPT 5.6 Series, Grok 4.5, Claude mod...

https://github.com/router-for-me/CLIProxyAPI

GitHub - aurorallm/aurora: The Fastest enterprise AI gateway — route LLM traffic across OpenAI, Anthropic, Gemini, Groq & 30+ providers via a single API. Self-hosted, no vendor lock-in. ( 55x faster than litellm )

The Fastest enterprise AI gateway — route LLM traffic across OpenAI, Anthropic, Gemini, Groq & 30+ providers via a single API. Self-hosted, no vendor lock-in. ( 55x faster than litellm ) - ...

https://github.com/aurorallm/aurora

GitHub - diegosouzapw/OmniRoute: Never stop coding. Free MIT AI gateway: one endpoint, 268+ providers (50+ free), 500+ models — Kimi, Claude, GPT, OpenAI, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, OpenCode, Cline & Copilot. Quota-aware auto-fallback, RTK+Caveman compression saves 15-95% tokens, MCP/A2A, Desktop/PWA. Built by 500+ contributors

Never stop coding. Free MIT AI gateway: one endpoint, 268+ providers (50+ free), 500+ models — Kimi, Claude, GPT, OpenAI, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, Open...

https://github.com/diegosouzapw/OmniRoute

GitHub - decolua/9router: Unlimited FREE AI coding. Connect Claude Code, Codex, Cursor, Cline, Copilot, Antigravity to FREE Claude/GPT/Gemini via 40+ providers. Auto-fallback, RTK -40% tokens, never hit limits.

Unlimited FREE AI coding. Connect Claude Code, Codex, Cursor, Cline, Copilot, Antigravity to FREE Claude/GPT/Gemini via 40+ providers. Auto-fallback, RTK -40% tokens, never hit limits. - decolua/9r...

https://github.com/decolua/9router

GitHub - AprilNEA/BYOKEY: Turn AI subscriptions into standard API endpoints. OpenAI & Anthropic compatible gateway — for Amp Code, Cursor, Factory CLI, and more.

Turn AI subscriptions into standard API endpoints. OpenAI & Anthropic compatible gateway — for Amp Code, Cursor, Factory CLI, and more. - AprilNEA/BYOKEY

https://github.com/AprilNEA/BYOKEY

sglang/sgl-model-gateway at main · sgl-project/sglang

SGLang is a high-performance serving framework for large language models and multimodal models. - sgl-project/sglang

https://github.com/sgl-project/sglang/tree/main/sgl-model-gateway

GitHub - nghyane/llm-mux: AI Gateway: Claude Pro, Copilot, Gemini subscriptions → OpenAI/Anthropic/Gemini APIs. No API keys needed.

AI Gateway: Claude Pro, Copilot, Gemini subscriptions → OpenAI/Anthropic/Gemini APIs. No API keys needed. - nghyane/llm-mux

https://github.com/nghyane/llm-mux

GitHub - BerriAI/litellm: Python SDK, Proxy Server (AI Gateway) to call 100+ LLM APIs in OpenAI (or native) format, with cost tracking, guardrails, loadbalancing and logging. [Bedrock, Azure, OpenAI, VertexAI, Cohere, Anthropic, Sagemaker, HuggingFace, VLLM, NVIDIA NIM]

Python SDK, Proxy Server (AI Gateway) to call 100+ LLM APIs in OpenAI (or native) format, with cost tracking, guardrails, loadbalancing and logging. [Bedrock, Azure, OpenAI, VertexAI, Cohere, Anthr...

https://github.com/BerriAI/litellm

GitHub - maximhq/bifrost: Fastest enterprise AI gateway (50x faster than LiteLLM) with adaptive load balancer, cluster mode, guardrails, 1000+ models support & <100 µs overhead at 5k RPS.

Fastest enterprise AI gateway (50x faster than LiteLLM) with adaptive load balancer, cluster mode, guardrails, 1000+ models support & <100 µs overhead at 5k RPS. - maximhq/bifrost

https://github.com/maximhq/bifrost

GitHub - QuantumNous/new-api: AI模型聚合管理中转分发系统，一个应用管理您的所有AI模型，支持将多种大模型转为统一格式调用，支持OpenAI、Claude、Gemini等格式，可供个人或者企业内部管理与分发渠道使用。🍥 A Unified AI Model Management & Distribution System. Aggregate all your LLMs into one app and access them via an OpenAI-compatible API, with native support for Claude (Messages) and Gemini formats.

AI模型聚合管理中转分发系统，一个应用管理您的所有AI模型，支持将多种大模型转为统一格式调用，支持OpenAI、Claude、Gemini等格式，可供个人或者企业内部管理与分发渠道使用。🍥 A Unified AI Model Management & Distribution System. Aggregate all your LLMs into one app and ...

https://github.com/QuantumNous/new-api

GitHub - songquanpeng/one-api: LLM API 管理 & 分发系统，支持 OpenAI、Azure、Anthropic Claude、Google Gemini、DeepSeek、字节豆包、ChatGLM、文心一言、讯飞星火、通义千问、360 智脑、腾讯混元等主流模型，统一 API 适配，可用于 key 管理与二次分发。单可执行文件，提供 Docker 镜像，一键部署，开箱即用。LLM API management & key redistribution system, unifying multiple providers under a single API. Single binary, Docker-ready, with an English UI.

LLM API 管理 & 分发系统，支持 OpenAI、Azure、Anthropic Claude、Google Gemini、DeepSeek、字节豆包、ChatGLM、文心一言、讯飞星火、通义千问、360 智脑、腾讯混元等主流模型，统一 API 适配，可用于 key 管理与二次分发。单可执行文件，提供 Docker 镜像，一键部署，开箱即用。LLM API manage...

https://github.com/songquanpeng/one-api

GitHub - odahpen/claude-code-hub: 🚀 Unify, manage, and optimize multiple AI service APIs with Claude Code Hub for seamless integration and real-time monitoring.

🚀 Unify, manage, and optimize multiple AI service APIs with Claude Code Hub for seamless integration and real-time monitoring. - odahpen/claude-code-hub

https://github.com/odahpen/claude-code-hub

GitHub - MartialBE/one-hub: OpenAI 接口管理 & 分发系统，改自songquanpeng/one-api。支持更多模型，加入统计页面，完善非openai模型的函数调用。

OpenAI 接口管理 & 分发系统，改自songquanpeng/one-api。支持更多模型，加入统计页面，完善非openai模型的函数调用。 - MartialBE/one-hub

https://github.com/MartialBE/one-hub

GitHub - deanxv/done-hub

Contribute to deanxv/done-hub development by creating an account on GitHub.

https://github.com/deanxv/done-hub

GitHub - tbphp/gpt-load: Multi-channel AI proxy with intelligent key rotation. 智能密钥轮询的多渠道 AI 代理。

Multi-channel AI proxy with intelligent key rotation. 智能密钥轮询的多渠道 AI 代理。 - tbphp/gpt-load

https://github.com/tbphp/gpt-load

GitHub - yym68686/uni-api: This is a project that unifies the management of LLM APIs. It can call multiple backend services through a unified API interface, convert them to the OpenAI format uniformly, and support load balancing. Currently supported backend services include: OpenAI, Anthropic, DeepBricks, OpenRouter, Gemini, Vertex, etc.

This is a project that unifies the management of LLM APIs. It can call multiple backend services through a unified API interface, convert them to the OpenAI format uniformly, and support load balan...

https://github.com/yym68686/uni-api

GitHub - yym68686/uni-api-web: uni-api web frontend

uni-api web frontend. Contribute to yym68686/uni-api-web development by creating an account on GitHub.

https://github.com/yym68686/uni-api-web

GitHub - looplj/axonhub: AxonHub is a modern AI gateway system that provides a unified OpenAI ( Chat Completion, Responses), Anthropic, Gemini and AI SDK compatible API

AxonHub is a modern AI gateway system that provides a unified OpenAI ( Chat Completion, Responses), Anthropic, Gemini and AI SDK compatible API - looplj/axonhub

https://github.com/looplj/axonhub

GitHub - poixeai/proxify: An open-source, lightweight, and self-hosted reverse proxy gateway for AI APIs

An open-source, lightweight, and self-hosted reverse proxy gateway for AI APIs - poixeai/proxify

https://github.com/poixeai/proxify

GitHub - bestruirui/octopus: One Hub All LLMs For You | 为个人打造的 LLM API 聚合服务

One Hub All LLMs For You | 为个人打造的 LLM API 聚合服务. Contribute to bestruirui/octopus development by creating an account on GitHub.

https://github.com/bestruirui/octopus

GitHub - Wei-Shaw/sub2api: Sub2API-CRS2 一站式开源中转服务，让 Claude、Openai 、Gemini、Antigravity订阅统一接入，支持拼车共享，更高效分摊成本，原生工具无缝使用。

Sub2API-CRS2 一站式开源中转服务，让 Claude、Openai 、Gemini、Antigravity订阅统一接入，支持拼车共享，更高效分摊成本，原生工具无缝使用。 - Wei-Shaw/sub2api

https://github.com/Wei-Shaw/sub2api

GitHub - aiclientproxy/proxycast: 让 AI 编辑器之间自然流动，不仅仅可以其他工具使用，也可以转换成 api 为本地开发提供动力。

让 AI 编辑器之间自然流动，不仅仅可以其他工具使用，也可以转换成 api 为本地开发提供动力。. Contribute to aiclientproxy/proxycast development by creating an account on GitHub.

https://github.com/aiclientproxy/proxycast/

GitHub - LeenHawk/gproxy: gproxy is a Rust-based multi-channel LLM proxy that exposes OpenAI / Claude / Gemini-style APIs through a unified gateway, with a built-in admin console, user/key management, and request/usage auditing.

gproxy is a Rust-based multi-channel LLM proxy that exposes OpenAI / Claude / Gemini-style APIs through a unified gateway, with a built-in admin console, user/key management, and request/usage audi...

https://github.com/LeenHawk/gproxy

GitHub - Kong/kong: 🦍 The Cloud-Native Gateway for APIs & AI

🦍 The Cloud-Native Gateway for APIs & AI. Contribute to Kong/kong development by creating an account on GitHub.

https://github.com/Kong/kong

GitHub - APIParkLab/APIPark: Cloud native, ultra-high performance AI&API gateway, LLM API management, distribution system, open platform, supporting all AI APIs.🦄云原生、超高性能 AI&API网关，LLM API 管理、分发系统、开放平台，支持所有AI API，不限于OpenAI、Azure、Anthropic Claude、Google Gemini、DeepSeek、字节豆包、ChatGLM、文心一言、讯飞星火、通义千问、360 智脑、腾讯混元等主流模型，统一 API 请求和返回，API申请与审批，调用统计、负载均衡、多模型灾备。一键部署，开箱即用。

Cloud native, ultra-high performance AI&API gateway, LLM API management, distribution system, open platform, supporting all AI APIs.🦄云原生、超高性能 AI&API网关，LLM API 管理、分发系统、开放平台，支持所有AI AP...

https://github.com/APIParkLab/APIPark

GitHub - alibaba/higress: 🤖 AI Gateway | AI Native API Gateway

🤖 AI Gateway | AI Native API Gateway. Contribute to alibaba/higress development by creating an account on GitHub.

https://github.com/alibaba/higress

GitHub - Portkey-AI/gateway: A blazing fast AI Gateway with integrated guardrails. Route to 200+ LLMs, 50+ AI Guardrails with 1 fast & friendly API.

A blazing fast AI Gateway with integrated guardrails. Route to 200+ LLMs, 50+ AI Guardrails with 1 fast & friendly API. - Portkey-AI/gateway

https://github.com/Portkey-AI/gateway

GitHub - fruitbars/simple-one-api: OpenAI 接口接入适配，支持千帆大模型平台、讯飞星火大模型、腾讯混元以及MiniMax、Deep-Seek，等兼容OpenAI接口，仅单可执行文件，配置超级简单，一键部署，开箱即用. Seamlessly integrate with OpenAI and compatible APIs using a single executable for quick setup and deployment.

OpenAI 接口接入适配，支持千帆大模型平台、讯飞星火大模型、腾讯混元以及MiniMax、Deep-Seek，等兼容OpenAI接口，仅单可执行文件，配置超级简单，一键部署，开箱即用. Seamlessly integrate with OpenAI and compatible APIs using a single executable for quick setup and dep...

https://github.com/fruitbars/simple-one-api

GitHub - qixing-jk/all-api-hub: 统一管理第三方 AI 聚合中转站与自建 New API：自动识别账号、查看余额、同步模型、管理密钥，全平台与云端备份 | Unified management of third-party AI aggregation transfer stations and self-built New API: automatic account identification, balance viewing, model synchronization, key management, and full-platform and cloud backup

统一管理第三方 AI 聚合中转站与自建 New API：自动识别账号、查看余额、同步模型、管理密钥，全平台与云端备份 | Unified management of third-party AI aggregation transfer stations and self-built New API: automatic account identification, balance vie...

https://github.com/qixing-jk/all-api-hub

GitHub - cita-777/metapi: 把你在各处注册的 New API / One API / OneHub / DoneHub / Veloera / AnyRouter / Sub2API 等站点，汇聚成一个 API Key、一个入口，自动发现模型、智能路由、成本最优

把你在各处注册的 New API / One API / OneHub / DoneHub / Veloera / AnyRouter / Sub2API 等站点，汇聚成一个 API Key、一个入口，自动发现模型、智能路由、成本最优 - cita-777/metapi

https://github.com/cita-777/metapi

GitHub - mcowger/plexus: Unified API gateway for multiple AI providers (OpenAI, Anthropic, Gemini, etc.). Switch models and providers without changing client code. Features OAuth authentication, quota tracking, embeddings, transcriptions, and OpenAI-compatible endpoints.

Unified API gateway for multiple AI providers (OpenAI, Anthropic, Gemini, etc.). Switch models and providers without changing client code. Features OAuth authentication, quota tracking, embeddings,...

https://github.com/mcowger/plexus

GitHub - tashfeenahmed/freellmapi: OpenAI-compatible proxy that aggregates free-tier keys from ~14 AI providers with automatic failover. For personal experimentation only.

OpenAI-compatible proxy that aggregates free-tier keys from ~14 AI providers with automatic failover. For personal experimentation only. - tashfeenahmed/freellmapi

https://github.com/tashfeenahmed/freellmapi

GitHub - sh2001sh/CodeGo-Api

Contribute to sh2001sh/CodeGo-Api development by creating an account on GitHub.

https://github.com/sh2001sh/CodeGo-Api

GitHub - oai404iao/ai_gateway

Contribute to oai404iao/ai_gateway development by creating an account on GitHub.

https://github.com/oai404iao/ai_gateway

GitHub - workweave/router: Model router for agentic systems. Routes every prompt to the right model in <50ms. Cut costs 40-70% with just an endpoint change.

Model router for agentic systems. Routes every prompt to the right model in <50ms. Cut costs 40-70% with just an endpoint change. - workweave/router

https://github.com/workweave/router

GitHub - BloretCrew/CrewRouter: Your Team with AI, AI with provider.

Your Team with AI, AI with provider. Contribute to BloretCrew/CrewRouter development by creating an account on GitHub.

https://github.com/BloretCrew/CrewRouter

GitHub - tbphp/gpt-load: Self-hosted AI gateway for multi-channel, multi-credential setups — API keys and subscription accounts, scheduling, failover, request logs and usage. 自托管 AI 网关：多渠道多凭据统一接入，含密钥与订阅账号、调度容错、日志与用量。

Self-hosted AI gateway for multi-channel, multi-credential setups — API keys and subscription accounts, scheduling, failover, request logs and usage. 自托管 AI 网关：多渠道多凭据统一接入，含密钥与订阅账号、调度容错、日志与用量。 - tbp...

https://github.com/tbphp/gpt-load

GitHub - experientiallabs/experiential: An open source model gateway that provides one control plane across closed, open-source, local, and custom models.

An open source model gateway that provides one control plane across closed, open-source, local, and custom models. - experientiallabs/experiential

https://github.com/experientiallabs/experiential

GitHub - TokenFlux/TokenRouter: tokenrouter is the next generation llm gateway

tokenrouter is the next generation llm gateway. Contribute to TokenFlux/TokenRouter development by creating an account on GitHub.

https://github.com/TokenFlux/TokenRouter

https://github.com/decolua/9router

GitHub - diegosouzapw/OmniRoute: Never stop coding. Free MIT AI gateway: one endpoint, 350 providers (90+ free), 1200+ models Kimi, Claude, GPT, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, OpenCode, Cline & Copilot. Quota-aware auto-fallback, RTK+Caveman compression saves 15-95% tokens, MCP/A2A, Desktop/PWA. Built by 450+ contributors

Never stop coding. Free MIT AI gateway: one endpoint, 350 providers (90+ free), 1200+ models Kimi, Claude, GPT, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, OpenCode, Clin...

https://github.com/diegosouzapw/OmniRoute

GitHub - experientiallabs/experiential: Experiential is the open source, zero markup gateway for BYOK, self-hosted and 1000+ marketplace models. It learns from your traffic to cut costs, recommend better models, and train a specialized model you own.

Experiential is the open source, zero markup gateway for BYOK, self-hosted and 1000+ marketplace models. It learns from your traffic to cut costs, recommend better models, and train a specialized m...

https://github.com/experientiallabs/experiential

GitHub - theagentrouter/agent-router: Manages Unified Access to Generative AI Services built on Envoy Gateway

Manages Unified Access to Generative AI Services built on Envoy Gateway - theagentrouter/agent-router

https://github.com/theagentrouter/agent-router

GitHub - fongap/ai-gateway: Resilient AI gateway that turns fragmented providers, keys and quotas into one dependable endpoint.

Resilient AI gateway that turns fragmented providers, keys and quotas into one dependable endpoint. - fongap/ai-gateway

https://github.com/fongap/ai-gateway

GitHub - api7/aisix: Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, observability.

Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, obse...

https://github.com/api7/aisix

GitHub - zyycn/codex-proxy-rs: 基于 Rust 的低风控、自托管 Codex 多账号透明代理网关

基于 Rust 的低风控、自托管 Codex 多账号透明代理网关. Contribute to zyycn/codex-proxy-rs development by creating an account on GitHub.

https://github.com/zyycn/codex-proxy-rs

Debian 12 升级 Debian 13 简单记录

Sat, 09 Aug 2025 16:00:00 GMT

Debian 项目发布了最新的稳定版本 Debian 13，代号为“trixie”。该版本历经两年多的开发，于 2025 年 8 月 9 日发布。

Debian 13 (trixie) 的发行说明 — release-notes 文档

本程序发布的目的是希望它对您有用，但没有任何担保，甚至不保证它有经济价值和适合特定用途。请查阅 GNU 通用公共许可证以获得更多细节。

https://www.debian.org/releases/trixie/release-notes/index.zh_CN.html

⚠️

Debian 作为以稳定著称的 Linux 发行版，大版本升级可以说是其“不稳定”的时刻了，升级需谨慎。稳妥起见，一定要做好备份！

官方的升级注意事项说明：Debian 12 升级 Debian 13 需要注意的 Breaking Change

准备工作

核对当前系统版本

更新系统软件包


sudo apt update
sudo apt upgrade -y
sudo apt autoclean
sudo apt autoremove -y

软件源配置

自 2025 年 2 月起，Debian 13（Trixie）和 APT 引入了 deb822 格式来管理 APT 源。这种新格式用更具结构化和可读性的 ⁠/etc/apt/sources.list.d/debian.sources 文件取代了传统的 ⁠/etc/apt/sources.list 文件。

单行格式 (.list) ：传统格式，所有 APT 版本都支持，但已被弃用，预计在 2029 年后移除。

deb822 格式 (.sources)：新版格式，可读性更佳，更易于扩展和修改，已成为推荐格式。Debian 13 正式版及后续版本均使用此格式。

🔍 点击展开查看两种配置格式

VSCode 的 Dev Container 配置 Docker 容器中运行 Claude Code

Sat, 12 Jul 2025 16:00:00 GMT

最近 AI Coding 工具使用的多，Gemini CLI 免费，Claude Code 高效，用起来体验确实不错。并且可以两者搭配起来：让 Claude Code 来负责制定编码计划，拆分计划，并调用 Gemini CLI 利用其超长的上下文来进行迭代处理，最后再由 Claude Code 来完成细节优化以及 Code Review 并修复 BUG。

安全隐患

工具用起来一时爽，但是这样直接在设备上运行一个可以控制整个操作系统、访问完整文件系统的 AI Agent 还是有风险的。

虽然这类工具会在每次执行操作前进行询问批准确认（这种每次都审核确认的方案确实有效），但人总会有误操或者想偷懒的时候，或者是图省事直接用 YOLO（You Only Look Once）模式完全交给 AI Agent，这些场景下未知命令/脚本/代码的执行就带来了一些安全隐患，难免会出问题。

比如下面这篇帖子中就提到了 Claude 模型能够绕过用户设置的命令黑名单，通过创建并运行脚本来执行被禁止的命令，例如 rm。

IMPORTANT: Claude has learned how to jailbreak Cursor!

And it’s only the beginning, the models are getting very smart and may have been trained on how to work harder/make more efforts to achieve the user goals…

https://forum.cursor.com/t/important-claude-has-learned-how-to-jailbreak-cursor/96702/2?ref=timsh.org

Sandbox

随着我们给到 AI 模型 / AI Agent 的权限越来越大，相应的所面临的像上文提及的安全风险和攻击手段也会越来越多， Sandbox 自然而然地成为 AI Agent 发展中一个重要的项目。

Gemini CLI 中就有 Sandbox 相关的配置项，其中明确提到 Sandbox 功能用于隔离潜在危险操作，提升安全性和环境一致性。

gemini-cli/docs/sandbox.md at main · google-gemini/gemini-cli

An open-source AI agent that brings the power of Gemini directly into your terminal. - google-gemini/gemini-cli

https://github.com/google-gemini/gemini-cli/blob/main/docs/sandbox.md

如何创建更高效安全的适用于 AI Agent 的 Sandbox 环境此处不做展开。

当前为了隔离限制 AI Agent，Docker 就是最直接的选择。把这些 AI Agent 全部放进容器内，使其只能访问到容器内部以及手动挂载上去的文件，而且它也无法对宿主机造成破坏，顶多就是容器异常而停止运行。

Docker & VSCode

下面是基于 VSCode 的 Dev Container 来配置 Docker 容器的记录，简短且简单。


mkdir -p ~/work-dir/claude-code/.devcontainer

touch devcontainer.json

先创建一个文件夹，之后这个文件夹会被作为 Claude Code 和项目的根目录。再在此文件夹下创建一个名为 .devcontainer 的文件夹，并在其中创建一个 devcontainer.json 文件。

devcontainer.json 文件内容如下（以 Golang 项目为例，采用了 go 的基础镜像）：


{
  "name": "Claude Code Dev Container",
  "image": "mcr.microsoft.com/devcontainers/go:1.24",
  "features": {
    "ghcr.io/devcontainers/features/node:1": {
      "version": "lts"
    }
  },
  "postCreateCommand": "npm install -g @anthropic-ai/claude-code",
  "customizations": {
    "vscode": {
      "extensions": [
        "golang.Go"
      ]
    }
  },
  "remoteUser": "vscode"
}

在 VSCode 中打开 ~/work-dir/claude-code 目录，点击左下角图标，然后在上方中央弹出的选项中选择 ”Reopen in Container“ 并等待容器启动即可。

一切启动后，可以在终端执行 claude 命令来使用 Claude Code 了。

Golang 编写简单的 AI Agent Demo

Tue, 24 Jun 2025 16:00:00 GMT

AI Agent 并不复杂，粗略来说就是 循环 + AI(LLM) + 工具(Tools) 。

这里整理记录下之前用 Golang 写的 AI Agent Demo，可以当作一个最简的 AI Agent 示例，快速学习理解 AI Agent 的基本结构。