bash linux

    # General Aliases
    alias apk='apk --progress'
    alias ll="ls -ltan"

    alias hosts='cat /etc/hosts'
    alias ..="cd .."
    alias ...="cd ../.."
    alias ....="cd ../../.."
    alias untar="tar xzvkf"
    alias mv="mv -nv"
    alias cp="cp -i"
    alias ip4="ip -4 addr"
    alias ip6="ip -6 addr"

    COL_YEL="\[\e[1;33m\]"
    COL_GRA="\[\e[0;37m\]"
    COL_WHI="\[\e[1;37m\]"
    COL_GRE="\[\e[1;32m\]"
    COL_RED="\[\e[1;31m\]"

    # Bash Prompt
    if test "$UID" -eq 0 ; then
        _COL_USER=$COL_RED
        _p=" #"
    else
        _COL_USER=$COL_GRE
        _p=">"
    fi
    COLORIZED_PROMPT="${_COL_USER}\u${COL_WHI}@${COL_YEL}\h${COL_WHI}:\w${_p} \[\e[m\]"
    case $TERM in
        *term | rxvt | screen )
            PS1="${COLORIZED_PROMPT}\[\e]0;\u@\h:\w\007\]" ;;
        linux )
            PS1="${COLORIZED_PROMPT}" ;;
        * ) 
            PS1="\u@\h:\w${_p} " ;;
    esac

alpine docker Bad file descriptor

https://stackoverflow.com/questions/48736212/bad-file-descriptor-error-during-apk-update-in-docker-container-why

When you login docker container, use apk update get this error message Bad file descriptor...

Try to run follow command

rm -rf /var/cache/apk && \
mkdir /var/cache/apk && \
apk update

建議每天

https://www.mobile01.com/topicdetail.php?f=291&t=5107288&p=1156#11551

有一些版友會自行操作一些股票，在買進前，記得基本的功課要先做，買進後每天，每周，每月要查尋的東西也不要太偷懶，不要a大在休養期，你們就隨便憑感覺開始買賣了。大笑大笑

我這樣說好了，投資股票和一般職業的運動家沒有什麼兩樣，例如田徑選手，如果沒有賽事時，也許每天鍛鍊的沒有這麼勤，一周也許三次，當賽事近了，鍛鍊量當然會開始加量，每天要做的功課就很多，如練體能，練衝刺，負重訓練…等，會以最佳的狀態出賽，比賽時差一點就差很多，所以狀態要在最佳狀態，但沒有比賽時，基本的訓練還是得做，平常的鍛練是能累積的，就算不是出賽狀態，至少還是能有七、八成的功力，和一般人比起來還是強很多，如果有人問這位田徑選手平常怎麼訓練，而這個人僅照作了一天或一周，成效當然是比不上長期鍛鍊的人，股市知識也是一樣的道理，雖然下面的事很簡單，但你累積久了，融會貫通了，你就能抓住別人的習慣，也能避開一些陷阱，也能了解一般判斷公司價值的準則，有一些人會問我說判斷準則，我就和他說不同的個股就是會有不同的情況，這沒有什麼好懷疑的，如果每一間公司都能用同一套準則去判斷，股市中就不會有輸家了，就是因為每一家判斷方法都不同，很多投資人傻傻的不知變通想要用同一個方法套入，套久了後，有時輸，有時贏，久了就亂套用，當然就是輸家。

我舉一個簡單的例子，每一個人都不同，興趣不同，志向不同，智商不同…等，我們的國民十二年教育就用同一套方法套到所有的小孩身上，最終的結果就是能適應的小朋友生存下來，不是這小朋友很厲害，只是恰好這教育剛好適合這小孩，一個女生的個性很適合某一個男生，卻可能在另一個男生的眼裡就是眼中釘。

操作股票前要做的功課

買進前要先查尋七季以上的簡易財報，再看七年左右的簡易年報

https://goodinfo.tw/StockInfo/StockFinDetail.asp?RPT_CAT=IS_M_QUAR_ACC&STOCK_ID=2353

1、本業，注意營收，毛利率，營利率逐季的變化
2、業外，注意其它收入，財務成本及匯損益
3、若為轉機股要看資產負債及現金流量表，且不能放過細節，如果是穩健股，1、看完就差不多，看一下年線，三年線，五年線，十年線，及季對季的獲利變化，每一季的法人說明會要看。

每天查尋
1、查尋台灣五十成份股各報價變化
2、查尋三大人買期現貨買賣超
3、查尋個股三大法人買賣超，融資券，借券還券情況
4、注意公司消息或動態(有一些公司很低調，平常就沒啥新聞)

每周查尋
1、集保股權分佈

每月查尋
1、個股營收
2、三大法人一個買買賣超，融資券變化，借券還券情況
3、外資群累積買賣超

每季查尋
1、財報的研讀
2、觀看法說會

常用籌碼面，基本面查尋網站
常用籌碼查尋網址

1、玩股網
https://www.wantgoo.com/

可以查尋當天主力進出成本均價，比較少用，除非我想看當天主力在想啥

2、histock
https://histock.tw/stock/main.aspx?no=2353

用於查尋某一段時間內，主力外資群買賣張數及平均成本

3、集保股權分怖
https://www.tdcc.com.tw/smWeb/QryStock.jsp

用於每周追蹤超級大戶及散戶持股變化

4、goodinfo
https://goodinfo.tw/StockInfo/StockFinDetail.asp?RPT_CAT=IS_M_QUAR_ACC&STOCK_ID=2353

用於看基本面及內有財報的網結，也能查尋連長期的技術線型

用於查尋當天三大法人進出，融資融券，主力進出，也可以查尋一年內三大法人、融資、融券，主力進出資料。

5、三大法人買賣日報
http://www.twse.com.tw/zh/page/trading/fund/T86.html

用於4點10分時看三大法人當天進出的情況

6、三大法人買賣月報
http://www.twse.com.tw/zh/page/trading/fund/TWT47U.html

用於查尋較長時間三大法人的進出情況

7、股市籌碼分析_股狗網
https://www.stockdog.com.tw/stockdog/index.php?m=home

用於查尋10日借券賣出，借券回補的情況

8、股市金字塔
http://norway.twsthr.info/StockHolders.aspx?stock=2353

用於看長周期大股東持股變化

k8s nfs v4 kubernetes

https://hub.docker.com/r/itsthenetwork/nfs-server-alpine

https://sueboy.blogspot.com/2019/11/kubernetes-nodeport.html

ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: nfs
  namespace: nfs
data:
  exports: |
    {{SHARED_DIRECTORY}} {{PERMITTED}}({{READ_ONLY}},fsid=0,{{SYNC}},no_subtree_check,no_auth_nlm,insecure,no_root_squash)
  nfsd: |
    #!/bin/bash

    # Make sure we react to these signals by running stop() when we see them - for clean shutdown
    # And then exiting
    trap "stop; exit 0;" SIGTERM SIGINT

    stop()
    {
      # We're here because we've seen SIGTERM, likely via a Docker stop command or similar
      # Let's shutdown cleanly
      echo "SIGTERM caught, terminating NFS process(es)..."
      /usr/sbin/exportfs -uav
      /usr/sbin/rpc.nfsd 0
      pid1=`pidof rpc.nfsd`
      pid2=`pidof rpc.mountd`
      # For IPv6 bug:
      pid3=`pidof rpcbind`
      kill -TERM $pid1 $pid2 $pid3 > /dev/null 2>&1
      echo "Terminated."
      exit
    }
    
    # Check if the SHARED_DIRECTORY variable is empty
    if [ -z "${SHARED_DIRECTORY}" ]; then
      echo "The SHARED_DIRECTORY environment variable is unset or null, exiting..."
      exit 1
    else
      echo "Writing SHARED_DIRECTORY to /etc/exports file"
      /bin/sed -i "s@{{SHARED_DIRECTORY}}@${SHARED_DIRECTORY}@g" /etc/exports
    fi

    # This is here to demonsrate how multiple directories can be shared. You
    # would need a block like this for each extra share.
    # Any additional shares MUST be subdirectories of the root directory specified
    # by SHARED_DIRECTORY.

    # Check if the SHARED_DIRECTORY_2 variable is empty
    if [ ! -z "${SHARED_DIRECTORY_2}" ]; then
      echo "Writing SHARED_DIRECTORY_2 to /etc/exports file"
      echo "{{SHARED_DIRECTORY_2}} {{PERMITTED}}({{READ_ONLY}},{{SYNC}},no_subtree_check,no_auth_nlm,insecure,no_root_squash)" >> /etc/exports
      /bin/sed -i "s@{{SHARED_DIRECTORY_2}}@${SHARED_DIRECTORY_2}@g" /etc/exports
    fi

    # Check if the PERMITTED variable is empty
    if [ -z "${PERMITTED}" ]; then
      echo "The PERMITTED environment variable is unset or null, defaulting to '*'."
      echo "This means any client can mount."
      /bin/sed -i "s/{{PERMITTED}}/*/g" /etc/exports
    else
      echo "The PERMITTED environment variable is set."
      echo "The permitted clients are: ${PERMITTED}."
      /bin/sed -i "s/{{PERMITTED}}/"${PERMITTED}"/g" /etc/exports
    fi

    # Check if the READ_ONLY variable is set (rather than a null string) using parameter expansion
    if [ -z ${READ_ONLY+y} ]; then
      echo "The READ_ONLY environment variable is unset or null, defaulting to 'rw'."
      echo "Clients have read/write access."
      /bin/sed -i "s/{{READ_ONLY}}/rw/g" /etc/exports
    else
      echo "The READ_ONLY environment variable is set."
      echo "Clients will have read-only access."
      /bin/sed -i "s/{{READ_ONLY}}/ro/g" /etc/exports
    fi

    # Check if the SYNC variable is set (rather than a null string) using parameter expansion
    if [ -z "${SYNC+y}" ]; then
      echo "The SYNC environment variable is unset or null, defaulting to 'async' mode".
      echo "Writes will not be immediately written to disk."
      /bin/sed -i "s/{{SYNC}}/async/g" /etc/exports
    else
      echo "The SYNC environment variable is set, using 'sync' mode".
      echo "Writes will be immediately written to disk."
      /bin/sed -i "s/{{SYNC}}/sync/g" /etc/exports
    fi

    # Partially set 'unofficial Bash Strict Mode' as described here: http://redsymbol.net/articles/unofficial-bash-strict-mode/
    # We don't set -e because the pidof command returns an exit code of 1 when the specified process is not found
    # We expect this at times and don't want the script to be terminated when it occurs
    set -uo pipefail
    IFS=$'\n\t'

    # This loop runs till until we've started up successfully
    while true; do

      # Check if NFS is running by recording it's PID (if it's not running $pid will be null):
      pid=`pidof rpc.mountd`

      # If $pid is null, do this to start or restart NFS:
      while [ -z "$pid" ]; do
        echo "Displaying /etc/exports contents:"
        cat /etc/exports
        echo ""

        # Normally only required if v3 will be used
        # But currently enabled to overcome an NFS bug around opening an IPv6 socket
        echo "Starting rpcbind..."
        /sbin/rpcbind -w
        echo "Displaying rpcbind status..."
        /sbin/rpcinfo

        # Only required if v3 will be used
        # /usr/sbin/rpc.idmapd
        # /usr/sbin/rpc.gssd -v
        # /usr/sbin/rpc.statd

        echo "Starting NFS in the background..."
        /usr/sbin/rpc.nfsd --debug 8 --no-udp --no-nfs-version 2 --no-nfs-version 3
        echo "Exporting File System..."
        if /usr/sbin/exportfs -rv; then
          /usr/sbin/exportfs
        else
          echo "Export validation failed, exiting..."
          exit 1
        fi
        echo "Starting Mountd in the background..."These
        /usr/sbin/rpc.mountd --debug all --no-udp --no-nfs-version 2 --no-nfs-version 3
    # --exports-file /etc/exports

        # Check if NFS is now running by recording it's PID (if it's not running $pid will be null):
        pid=`pidof rpc.mountd`

        # If $pid is null, startup failed; log the fact and sleep for 2s
        # We'll then automatically loop through and try again
        if [ -z "$pid" ]; then
          echo "Startup of NFS failed, sleeping for 2s, then retrying..."
          sleep 2
        fi

      done

      # Break this outer loop once we've started up successfully
      # Otherwise, we'll silently restart and Docker won't know
      echo "Startup successful."
      break

    done

    while true; do

      # Check if NFS is STILL running by recording it's PID (if it's not running $pid will be null):
      pid=`pidof rpc.mountd`
      # If it is not, lets kill our PID1 process (this script) by breaking out of this while loop:
      # This ensures Docker observes the failure and handles it as necessary
      if [ -z "$pid" ]; then
        echo "NFS has failed, exiting, so Docker can restart the container..."
        break
      fi

      # If it is, give the CPU a rest
      sleep 1

    done

    sleep 1
    exit 1
  bashrc: |
    # General Aliases
    alias apk='apk --progress'
    alias ll="ls -ltan"

    alias hosts='cat /etc/hosts'
    alias ..="cd .."
    alias ...="cd ../.."
    alias ....="cd ../../.."
    alias untar="tar xzvkf"
    alias mv="mv -nv"
    alias cp="cp -i"
    alias ip4="ip -4 addr"
    alias ip6="ip -6 addr"

    COL_YEL="\[\e[1;33m\]"
    COL_GRA="\[\e[0;37m\]"
    COL_WHI="\[\e[1;37m\]"
    COL_GRE="\[\e[1;32m\]"
    COL_RED="\[\e[1;31m\]"

    # Bash Prompt
    if test "$UID" -eq 0 ; then
        _COL_USER=$COL_RED
        _p=" #"
    else
        _COL_USER=$COL_GRE
        _p=">"
    fi
    COLORIZED_PROMPT="${_COL_USER}\u${COL_WHI}@${COL_YEL}\h${COL_WHI}:\w${_p} \[\e[m\]"
    case $TERM in
        *term | rxvt | screen )
            PS1="${COLORIZED_PROMPT}\[\e]0;\u@\h:\w\007\]" ;;
        linux )
            PS1="${COLORIZED_PROMPT}" ;;
        * ) 
            PS1="\u@\h:\w${_p} " ;;
    esac

Deployment

Different is ln /exports/exports /etc/exports
ConfigMAP /etc have read-only problem

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nfs-service
  namespace: nfs
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nfs-service
  template:
    metadata:
      labels:
        app: nfs-service
    spec:
      #restartPolicy: Always
      volumes:
        - name: exports
          configMap:
            name: nfs
            items:
              - key: exports
                path: exports
                mode: 0744
        - name: nfsd
          configMap:
            name: nfs
            items:
              - key: nfsd
                path: nfsd.sh
                mode: 0744
        - name: bashrc
          configMap:
            name: nfs
            items:
              - key: bashrc
                path: .bashrc
                mode: 0744
        - name: nfsshare
          emptyDir: {}  
      containers:
        - name: nfs-server-container
          image: alpine:latest
          securityContext:
            privileged: true
          command:
            - /bin/sh
            - -c
            - |
              echo nameserver 8.8.8.8 >> /etc/resolv.conf
              apk add --no-cache --update --verbose nfs-utils bash iproute2 
              rm -rf /var/cache/apk /tmp /sbin/halt /sbin/poweroff /sbin/reboot 
              mkdir -p /var/lib/nfs/rpc_pipefs /var/lib/nfs/v4recovery 
              echo "rpc_pipefs    /var/lib/nfs/rpc_pipefs rpc_pipefs      defaults        0       0" >> /etc/fstab 
              echo "nfsd  /proc/fs/nfsd   nfsd    defaults        0       0" >> /etc/fstab 
              rm /etc/exports 
              cp /exports/exports /etc/exports 
              cp /nfsd/nfsd.sh /usr/bin/nfsd.sh
              cp /bashrc/.bashrc /root/.bashrc
              chmod +x /usr/bin/nfsd.sh
              /usr/bin/nfsd.sh
          env:
            - name: SHARED_DIRECTORY
              value: "/nfsshare"
          volumeMounts:
            - name: exports
              mountPath: /exports
              #readOnly: true
            - name: nfsd
              mountPath: /nfsd
            - name: bashrc
              mountPath: /bashrc 
            - name: nfsshare
              mountPath: /nfsshare 

k8s ConfigMap mountPath need becarful. like this example exports and nfsd are /etc & /usr/bin. This two directory already have file inside. When you director mountPath: /etc or mountPath: /usr/bin . k8s replace this two path to other direcotry. ls -al /etc or /usr/bin that only get exports file and nfsd.sh file. So better way is mountPath usually different directory. In shell: Use Copy that copy exprots file and nfsd.sh file to docker image correct directory.

Service

kind: Service
apiVersion: v1
metadata:
  name: nfs-service
  namespace: nfs
spec:
  selector:
    app: nfs-service
  type: NodePort
  ports:
    # Open the ports required by the NFS server
    # Port 2049 for TCP
    - name: tcp-2049
      port: 2049
      targetPort: 2049
      protocol: TCP
      nodePort: 32049

    # Port 111 for UDP
    - name: udp-111
      port: 111
      protocol: UDP

======nfs v4 client mount
debain
https://blog.gtwang.org/linux/nfsv4/

Centos
https://computingforgeeks.com/configure-nfsv3-and-nfsv4-on-centos-7/

$ sudo yum -y install nfs-utils
$ sudo systemctl start rpcbind 
$ sudo systemctl enable rpcbind

mount -v -o port=32049 -o vers=4 -t nfs 192.168.99.118:/ /tmp/tnfs/
nano /tmp/tnfs/tt  # save some text. Then check nfs pod /nfsshare have tt and tt context

skype 8 自動登入..... 令人無言的設計

skype 8登入後自動記住登入帳密，下次登入時，不會詢問，一般會有不記憶選項，但沒有！ 唯一只能登出時選擇

等到下次再登入就會詢問，但實際上再次登入後，登出、登入…又不用輸入……


難怪軟微推什麼產品，失敗居多！

kubernetes Deployment Failed to fetch Temporary failure resolving

IF you apt-get update in k8s Deployment yaml that containers command run it. Maybe get

Deployment Failed to fetch Temporary failure resolving


So just put this line before script

- /bin/bash
- -c
- |
  echo nameserver 8.8.8.8 >> /etc/resolv.conf
  apt-get update

Usually you get this problem because try to transfer Dockerfile / docker-compose directory to ConfigMap and Deployment YAML. Dockerfile have apt-get update that get problem.

[轉]你到底知不知道什麼是 Kubernetes?

https://www.hwchiu.com/kubernetes-concept.html


然而通常 A/B/C/D 都不是底下的工程人員，所以最後都會變成用嘴巴生架構，用嘴巴解決問題，底下實際的工程人員則是各種崩潰

goodbye microservices

https://segment.com/blog/goodbye-microservices/

核心服務 不見得要微服務化，因為共同開發上，減少一些問題

In early 2017 we reached a tipping point with a core piece of Segment’s product. It seemed as if we were falling from the microservices tree, hitting every branch on the way down. Instead of enabling us to move faster, the small team found themselves mired in exploding complexity. Essential benefits of this architecture became burdens. As our velocity plummeted, our defect rate exploded.

Eventually, the team found themselves unable to make headway, with 3 full-time engineers spending most of their time just keeping the system alive. Something had to change. This post is the story of how we took a step back and embraced an approach that aligned well with our product requirements and needs of the team.


===
Ditching Microservices and Queues

The first item on the list was to consolidate the now over 140 services into a single service. The overhead from managing all of these services was a huge tax on our team. We were literally losing sleep over it since it was common for the on-call engineer to get paged to deal with load spikes.


===

While we did have auto-scaling implemented, each service had a distinct blend of required CPU and memory resources, which made tuning the auto-scaling configuration more art than science.

===

===
跟當初想法一樣，微服務化會成幾何成長的複雜度，人力夠ok，人力不夠，搞這個找死

k8s kubernetes Lesson 6 yaml docker-registry cron part 2 No minikube

normal k8s

https://sueboy.blogspot.com/2019/11/kubernetes-nodeport.html

namespace docker-registry

{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "docker-registry",
    "labels": {
      "name": "test-dev"
    }
  }
}

secret.yml ID/PWD:username/password tls:cn=docker-registry

apiVersion: v1
kind: Secret
metadata:
  name: registry-tls
  namespace: docker-registry
type: Opaque
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzRENDQXBnQ0NRRHpteitOQUZCMGRUQU5CZ2txaGtpRzl3MEJBUXNGQURBYU1SZ3dGZ1lEVlFRRERBOWsKYjJOclpYSXRjbVZuYVhOMGNua3dIaGNOTVRrd01qSTJNVEF3TlRBMldoY05NakF3TWpJMk1UQXdOVEEyV2pBYQpNUmd3RmdZRFZRUUREQTlrYjJOclpYSXRjbVZuYVhOMGNua3dnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDCkR3QXdnZ0lLQW9JQ0FRRFBKcHhZK0RVQ05aMVh4Tkc0bUJlaFp2ZXZ4R21XMFdZandhRklzcFQ0L09ETWgwZVgKRXRmT0xpaUZibXFzMi93L01CeWlUSWlZczltMFdhdG5uVDc5bm5wZUVHdFNtQUJHeXMyU1hxdDZ3SzJubHJSLwowVllaVEpJQ2t2amE5WExtQ2w2eEgrbFFxWVFnNHlHSWxuZ2ZXUFBCTzkvVFhnS2Jmc2xBTk9uTXY0ckVTMlNFCkZLQzNuSTRqY1JWc1BQSUNkNDNJVlU1akNiRllublZJS2l2eTdqY0l0Q2JoelZsTHRuOHFIRE5YcElHSlpTTlYKUkdSdUVhN3ZFbUloei90blJZdFJRTmpSNGhQNkM5eG1QMFpBZFhjQWZYMTk0aVVKNDRFYnZUZ0NKK0I4Yi9jdwpEZ29IRWxCbGtJaUtmSm9wL0RhR3B5OUY0VjRhbHZIcnNMdFdYYTZYWmQzeGxmWWx6S2xMZ0IzTDJVQ2VCUWljCk0yUDlXMEZZZGFIR3NjUkFyNGQvbEtiZE1PYXNDV2dXaHlGekRDMUFYQkcxdU9SSXFBbi84OTJPQnk1UVE2SDQKSk9yOXNRRGhRejVEdWZReFlGNDZUZjZUNk9MOGp6TkUrUk11YmR2RmVVS1ZwYzJXazgrVWY3UE9OdW9iRC9XZgpTRFVCYjNsSCtGVTFZalVhR0Y5VzNwSE14NXZzTU8xOFJ3UTIzU2ZFT1dMZFFseU8rYXg3STZKVm5CbG1xaStFCk16QjFHMzVTbmlMMWcyVDRkbFlIWThIbllaU1A3RFdYR3JrZ2l6SloweUUveE55dkJuLy9GeWtIYTlIdjBhUk0KNE45OUhHRkthTmNzdkFDR2NSU2QvYUdHUDdqWHNEb3R2R1U5VjU4ems2S21oVGRjN3V0cE9Hb0Nud0lEQVFBQgpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUNBUUM4U1orN0V3U0liY0tDT0xoV3NvbDEzNUVIYVdiRTEzOFRRdHBVCk55aExqZXM3THVQSjg3YVdjK0NWT3VMWEdIY2FtTiszQWhKL1k3L1U5NlVCWS8yTDREUnd6b0RDYzhhQ3ZQY0oKZDhWcGxvUXJuRzRueUgxVTJUV243SXo1UDNrYjVZeE82UHlVdlNZMTJTaXBxWmVuQU1STzVQSDRlUldwbDkwbAp3cHJDVU1TNGhaL3FGVE1ORG1HSzBGS243VHZRekZrSVo1eEhUK0VncTNzcERVY1BCenV4WVdGTG9pT2ZGUFRZCnZkSDc5Vis5K1p6T3ZBVlF3ZHhHSVlOaGlpNGd1OTg4N3Jld3RKbEZUQ1pXT05DWnNMcUw0RHBtWmJhbUlxRi8KakF5ZUR4T2kwN2VKcTlUREFLUlErZzg1NzMvR2JhVU5MVHVndzM0Z1pNZUttUnNzUjBEZWc5ckFHeXRRM2pqRApqeWJLYmo1SE8vT25xNTlGSk9rRi94eklZYWtXcjVPem1kRzJDdVhNOXhSN3BYSm5IM0RKcWUwc2FQd2ZMV2xPClF3L1RRM1lpMHg4ajhwOTRpeHZWbnRPRFRIUXBmeUFDMDloaFNmVG1sMnJXT3FqTzJ4d1dzUkhEOXBUQ0FpMG0KTHlZQS9UTVVXRWdMdklmMEZjOXRZZGkrck9HQVJuRWdXdjdhRjhKL0pRUlZ2ZjBVL2hGTmo4bFRmY0RuOU95WQprVEtWdHNRVllqZXNBU1lIdzYyRmZoUkRIZmZRbUlscTN3emljU3MvbnBQMzZraExCZGt0TnZzakVNaE40a0JLCjR5NlJWekdZR20rakpVQk8zV3ZQbHF0T0pwVUFCbHVCWFZOK3hhMnZOODNGYjZtMFlJTmVWbXNFQmxnVTVGT1oKa2xFVTJ3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRd0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Mwd2dna3BBZ0VBQW9JQ0FRRFBKcHhZK0RVQ05aMVgKeE5HNG1CZWhadmV2eEdtVzBXWWp3YUZJc3BUNC9PRE1oMGVYRXRmT0xpaUZibXFzMi93L01CeWlUSWlZczltMApXYXRublQ3OW5ucGVFR3RTbUFCR3lzMlNYcXQ2d0sybmxyUi8wVllaVEpJQ2t2amE5WExtQ2w2eEgrbFFxWVFnCjR5R0lsbmdmV1BQQk85L1RYZ0tiZnNsQU5Pbk12NHJFUzJTRUZLQzNuSTRqY1JWc1BQSUNkNDNJVlU1akNiRlkKbm5WSUtpdnk3amNJdENiaHpWbEx0bjhxSEROWHBJR0paU05WUkdSdUVhN3ZFbUloei90blJZdFJRTmpSNGhQNgpDOXhtUDBaQWRYY0FmWDE5NGlVSjQ0RWJ2VGdDSitCOGIvY3dEZ29IRWxCbGtJaUtmSm9wL0RhR3B5OUY0VjRhCmx2SHJzTHRXWGE2WFpkM3hsZllsektsTGdCM0wyVUNlQlFpY00yUDlXMEZZZGFIR3NjUkFyNGQvbEtiZE1PYXMKQ1dnV2h5RnpEQzFBWEJHMXVPUklxQW4vODkyT0J5NVFRNkg0Sk9yOXNRRGhRejVEdWZReFlGNDZUZjZUNk9MOApqek5FK1JNdWJkdkZlVUtWcGMyV2s4K1VmN1BPTnVvYkQvV2ZTRFVCYjNsSCtGVTFZalVhR0Y5VzNwSE14NXZzCk1PMThSd1EyM1NmRU9XTGRRbHlPK2F4N0k2SlZuQmxtcWkrRU16QjFHMzVTbmlMMWcyVDRkbFlIWThIbllaU1AKN0RXWEdya2dpekpaMHlFL3hOeXZCbi8vRnlrSGE5SHYwYVJNNE45OUhHRkthTmNzdkFDR2NSU2QvYUdHUDdqWApzRG90dkdVOVY1OHprNkttaFRkYzd1dHBPR29DbndJREFRQUJBb0lDQVFDb0FkZXliUFNKS3pUR3Q1R2tsbTRyCjhKZ1lUVU9hRjVFd2xOMmJXWU5yZ2FWTkhMYmFkMlRpQ3h2QVJISnVhaWpta3IzV2dCNFZRMkRoWGd5Zmg3Qk0KQUZtY3F0SndkV2xjQVNYRGZkYTBRMHRVYmUxTThWcFVRSDczYVg0K0QrNDFWdG0vN0hMTmdmN3dzV1pFSWsyZwpsd056aUgwYkw5Y0xpRVB2T0RzYlhZcE5kQnc4NTRJR0NRcGJBbDl1bnV0bFJ0T09WR216OTJ1SHhWUzN4OFJIClRoOENoeUkxNXRkeWlid1BTam4xN2kxRll1cktRQ0w0Qm8yTHhxd2lZazJ6VDNzVDFuVkRuSW01Tmg5MktnRnYKVEJYTkp2bzl1OGx3Z0x6NDQzbG1mak1hbWJDd24rSlFJL0Zpdmx1UGZrbUduZEVYV3NjRGRTcGVoR2dIVVJwTwpGWURKU29jaTlGVG5NRTF4a3c4TUR5V1JjSzdvSjJrRzd0RXh4aDBML1NjK1dmY2RKVFJyRW9BR3VxNzNYdWZGCk1CdVRoK3JCVU9ITVpSTVJMTXN6aGVTekp1SXBZU1BsNUF1VUY5cHVNd21vYkFpbXBzdmpQVEprRlR3bytLdmQKYUVlNW5IMFlmTlRNS3JSU1YybjBaTmp0dHB3VU9VZ2lXVE9VdnJXOGNiMlVJZjRpRVk3VjJBc3ArKzVvK25QdQpZRkdiZWd0d1U3dURyNTN2YjNPRE9ZRVUrUlZmYTlScWxXMUswYlpmeGZBcCtzdVNQTHczclBiNk4xZ0UybWhFCnNUcy9FYmQ5dW5Vdm1XZ0tzdGtBeDBuRVM4Z1VqNW9Zc1F5Um1wM1NaaUJXUmlXYnZoSzRaQ3k0V3NaZUZWZEoKMEtuNDZCeXB1Sndtelozd2hRMDBZUUtDQVFFQS9XODlsa0c1eW9UVXlEZnI3M0hqMHNyZ0o3amlLdlNoZ29PVwpCck1ndkxxeEMzUVRaZjg2VHpObnhoVDFwSS9sUnNRN2tiYjJhclpHZ3phRHlNemV2QXpYMUJiNnRkakxnVVIvCi9ZMTR1QW9VVzhYNEhrY0Rhb2xtVkFjOXdsRmpJcHVjY25YdEZJZ3NacnVydEJSQW9mSU91aUV4bzJCQkc3aUEKMW1qN2RqZlZwSTQzWWd4UHBiZndmVjV0bC9CTENMQis0RzZkclhvaExBdTlqSWlKNWw4MEEydG1qR3Z3S3lVTApHc3RGamc1MVcxTjQyTC8rY0FSQ213a3pUUTkwMFZaS1BaOUdtZTE2NndZdjl4eXdsZjN6L09udGJsZjRLaXE4ClVVQXR3RFF3bWFwN3o1OUhpckp1TEczMDk3QWRlNTZjQ1JOMk53c0YzYTJQM09VeFVRS0NBUUVBMFQ5dHlzK24KVHdkd0JNK0lRcVBQUWt0ZjhodENSUW1Wamw0WWVZc1ptR0F2TXRqN00wYVhjcnVLT0k2VjBmc0k2T0RrbWRDSQpnZWYwUk15WXR3czdMcGtXWmIyQzlFdzk0K3VpL2tEQVlxUUJXczBVaTQwbTdNeDgwN2pKdGZONVJad3d1MGxNCm1kR1ZSa3hkbWVtM0V6MmhsR2ltZUMvcnB5REtiMkY1SU9Mdjk1cUdlWHBlOGNwUDhVMDd6dTdqdmdDNVRSeDcKV0pYYVVFSEt4bjVHVHU2UUluMXQrZmw5MnRnNXprNmNjaklUeStvUG4yNWU1ZnR3ZlNaVzg1Tno2dFQzRE04bwpMZ0h4aFBNS0RzcjZySnVRSExObHI1MnY4TDlwVlZlWlpOanlmbDNxUmhqOE5zanN4OEhCczV1Z1ZFYU9MWkJTClFrU1pCYzNkYldONDd3S0NBUUFMWVhaemkrb0s5U0lWQjZYWnI5U2FQN0FIT0o4M2JKcmdJSWFaTUd3VTdaRkwKd1YrcG9lZDliUUtJKzZINFRObnY3cG42Tml3a3FLREwvYU8zWGJQVzRBREZMbTc5d1ltSitZaUIyMXVEY0RodgowcGtNeXdXVlFDeFBNN0FMVE5wVjBJVWJBcjZ0d0Z1MkZWRmxtYzg1Tm9TQXlVTFFZbDhxSG9QeW5PNUY1Y1g3ClNNT2w3SVdiSElKNUxzZGZIbFJRUkpTK0FWbWxVNm12cjZ0SVowMUNBaDUwMU5yYkRYSFFqaTVNZXJwWjRiNVYKWm84enRKTjVka2VEYk10WDk0eTRaZGFabzlCbzB5aEU2NWMxMHB6L2IxTUlsWHlyQ3RwREVuNDRhOWhpSERYZQpnTEJrcDNOd0FBbEFoNE9McCtYN0NpbFpvdjBaQmE2eXdMdUlJT2F4QW9JQkFILytaSkppWXQwY2w1RFp3V2ZCCis4MTVmYjhDblk3TlJnWkgySURBYlcrZnBqOWNLb3c2NmZqc2JxZ1p6OXNaeTJGbjcyMkcrWGs5QVZYME1KWUcKOExTWVAvTUw4VWF1UEUxbW5kVVlscFcvN0hRMmJoTE96TGljZk42bGNmMHlhVVFEUG12UmNtSEVxYUxPbzVLNgpPNW94WU56L0JwVU4rdi9JTnd2YWU5VjUrMzlocmxBd1lsTlVoWUg4MUZESUg5YmhhbmVZckhxTGIzY1lSNGtUClJMNlRmdWNhQW1PZUVUWUVmWmVNem5XcjNDQW5sRmJabElMcFF1M0t2ZlZRaE45b1ZaWW9RVk9qTExFK1dUQ2oKU0tLOHBYSm82aEo2U2x6aE9QVlRHQ2x2NnlVUkhYU3pZOU8vSTljczFlZWZrbnI2alkyaGNpL0c5ak51c2J0dgoxVkVDZ2dFQkFJVUdEbEcxQmpPdTVhcVZ1eDZzTzUwbHB4eVpienFvMm1TRVMwZHNYNDcvclN6ZGRoblE4QnVVCjlURHF3aDBlM0pZdGlUczM4Z21RT1pVdndEM2FnNjdDU0t1T3FNUWM3aU00S01rbmdrakxOMnhIM2luYjZxUjMKc0ZLYVluWDlMdTBZeVVZU013cGwyNjM4ZHoxanY3a05wRE8xd2p0bTh5TjdxQk00d3IrU3JNV0EyWHlhSG1hZgpBZE5hNzdxdHppL0JIcXdVTFZsbDFTSitIU1dqdHU2QmRNQTlLandzMllieWxUTm1UbmZWTzdLeVMzTFAwY2xCCm1MaEVhYS93d2J1Mm5sTWRxdDJpeTQzcE5QYmhRZ0lOck95dDR6cXhNZEVXdWtSeHAwSGFieXdFcldFWXJFQ1cKdS90ZDhKZ291QmZqZ0JDQ3hnNjNvWlJVS1ZnU1FQST0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQ==
  HTPASSWD: dXNlcm5hbWU6JDJ5JDA1JGprbU5CSm1DVTYyV0pKc0tqcWx3RC5BQmpLcUswc2R0SU9lZ29kb3VrQzFpR0owc05ENjhD

configmap.yml

apiVersion: v1
kind: ConfigMap
metadata:
  name: docker-registry
  namespace: docker-registry
data:
  registry-config.yml: |
    version: 0.1
    log:
      fields:
        service: registry
    storage:
      delete:
        enabled: true
      cache:
        blobdescriptor: inmemory
      filesystem:
        rootdirectory: /var/lib/registry
    http:
      addr: :5000
      host: https://docker-registry:30500
      secret: asecretforlocaldevelopment
      headers:
        X-Content-Type-Options: [nosniff]
        Access-Control-Allow-Origin: ['*']
        Access-Control-Allow-Methods: ['HEAD', 'GET', 'OPTIONS', 'DELETE']
        Access-Control-Allow-Headers: ['Authorization']
        Access-Control-Max-Age: [1728000]
        Access-Control-Allow-Credentials: [true]
        Access-Control-Expose-Headers: ['Docker-Content-Digest']
      tls:
        certificate: /cert/x509/public
        key: /cert/x509/private
    auth:
      htpasswd:
        realm: basic-realm
        path: /auth/htpasswd
    health:
      storagedriver:
        enabled: true
        interval: 10s
        threshold: 3

deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: registry
  namespace: docker-registry
spec:
  replicas: 2
  selector:
    matchLabels:
      app: registry
  template:
    metadata:
      labels:
        app: registry
    spec:
      #restartPolicy: Always
      volumes:
        - name: config
          configMap:
            name: docker-registry
            items:
              - key: registry-config.yml
                path: config.yml
        - name: cert
          secret:
            secretName: registry-tls
            items:
              - key: tls.crt
                path: public
              - key: tls.key
                path: private  
        - name: htpasswd
          secret:
            secretName: registry-tls
            items:
              - key: HTPASSWD
                path: htpasswd
        - name: registry-data
          emptyDir: {}  
      containers:
        - name: registry
          image: registry:2.7.1
          ports:
            - name: http
              containerPort: 5000
              protocol: TCP
          volumeMounts:
            - name: config
              mountPath: /etc/docker/registry
              readOnly: true
            - name: cert
              mountPath: /cert/x509
              readOnly: true
            - name: htpasswd
              mountPath: /auth
              readOnly: true
            - name: registry-data
              mountPath: /var/lib/registry

service.yml

apiVersion: v1
kind: Service
metadata:
  name: docker-registry
  namespace: docker-registry
spec:
  type: NodePort
  ports:
  - name: registryhttp
    port: 5000
    targetPort: 5000
    nodePort: 30500
  selector:
    app: registry

===== docker-compose =====

docker-compose.yml

version: '3.3'

services:
  gethpeers:
    build:
      context: gethpeers/
    image: docker-registry:30500/username/gethpeers
    volumes:
      - cronlog:/app/cronapplog:rw
      - /etc/localtime:/etc/localtime:ro
    networks:
      - fastdev

  fakelog:
    build:
      context: fakelog/
    image: docker-registry:30500/username/fakelog
    volumes:
      - cronlog:/app/cronapplog:rw
      - filebeat:/usr/share/filebeat/data:rw
    networks:
      - fastdev

volumes:  
  cronlog: 
  filebeat:
  
networks:
  fastdev:
    driver: bridge

fakelog/Dockerfile

FROM docker.elastic.co/beats/filebeat:6.5.4
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml
USER filebeat

fakelog/filebeat.yml

filebeat.prospectors:

- type: log
  paths:
    - /app/cronapplog/*.log
  exclude_files: ['.gz$']
  fields_under_root: true
  symlinks: true

output.logstash:
  hosts: ["logstash:5044"]

cron/crontab

* * * * * /app/run-cronjob.sh /app/start.sh > /proc/1/fd/1 2>/proc/1/fd/2
#* * * * * echo hello > /proc/1/fd/1 2>/proc/1/fd/2

cron/Dockerfile

FROM debian:stretch-slim
RUN apt-get -y update && apt-get install -y cron curl jq nano iputils-ping net-tools && \
    rm -r /var/lib/apt/lists/*
ADD . /app
ADD crontab /var/spool/cron/crontabs/root
RUN chmod 0600 /var/spool/cron/crontabs/root
RUN chmod +x /app/run-cronjob.sh
RUN chmod +x /app/start.sh
CMD cron -f

cron/run-cronjob.sh

#!/bin/bash

if [ -z "$1" ] ; then
  echo "need name of cron job as first argument" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi
 
if [ ! -x "$1" ] ; then
  echo "cron job file $1 not executable, exiting" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi
 
if "$1"
then
  echo "cron job $1 Run!" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 0
else
  echo "cron job $1 failed!" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi

cron/start.sh

#!/bin/bash

# geth get admin.peers
IP_PORT=xxx.xxx.xxx.xxx.xxx
ETH_METHOD=admin_peers
PEERS=$(curl -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"'$ETH_METHOD'","params":[],"id":1}' $IP_PORT |  jq -c '.result[].network + {"run":"curl json"}')

printf "\n===== Now Geth Peers =====\n"
#printf "Peers: %s\n" $PEERS
echo $PEERS | jq .
#echo $PEERS >> /app/cronapplog/gethpeers.log
curl -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"'$ETH_METHOD'","params":[],"id":1}' $IP_PORT |  jq -c '.result[].network + {"run":"curl json"}' >> /app/cronapplog/gethpeers.log

===== push image to docker-registry =====

nano /etc/docker/daemon.json
{
  "insecure-registries" : ["docker-registry:30500"]
}
service docker restart

docker login -u username -p password docker-registry:30500
docker-compose push

nano /etc/hosts
192.168.99.118 docker-registry

check https://docker-registry:30500/v2/_catalog  
#check result
{"repositories":["username/fakelog","username/gethpeers"]}

IF get error

ERROR: blob upload unknown

when docker-compose push

Deployment replicase 2 -> 1

apiVersion: apps/v1
kind: Deployment
metadata:
  name: registry
  namespace: docker-registry
spec:
  replicas: 1

===== docker-registry ui =====
===== docker =====
docker run -d -p 80:80 -e URL=http://192.168.99.118 -e REGISTRY_URL=https://192.168.99.118:30500 -e DELETE_IMAGES=true joxit/docker-registry-ui:static

broswer http://192.168.99.118

[轉][教學] 用Drone, Kubernetes跟Helm，以及RBAC來建置你的CI/CD流程

Part 1 https://medium.com/@cloudsanchen/ci-cd-with-drone-kubernetes-and-helm-part-1-69c147046ffa

Part 2 https://medium.com/@cloudsanchen/ci-cd-with-drone-kubernetes-and-helm-part-2-65b43d790b30

part 3 https://medium.com/@cloudsanchen/%E6%95%99%E5%AD%B8-%E7%94%A8drone-kubernetes%E8%B7%9Fhelm-%E4%BB%A5%E5%8F%8Arbac%E4%BE%86%E5%BB%BA%E7%BD%AE%E4%BD%A0%E7%9A%84ci-cd%E6%B5%81%E7%A8%8B-part-3-de7273591bb

k8s kubernetes Lesson 5 command line

kubectl cluster-info

融資、融券

https://www.mobile01.com/topicdetail.php?f=291&t=5107288&p=1147#11470

上面的文章有提到融資、融券，其實這也是金融工具之一，融資說穿了就是向券商借錢，自已出40%的錢，券商出60%，所謂的融資斷頭就是股票價格跌到你自已出的錢賠光，這時券商就會強制賣出，在你持有期間你還要融資利息給券商大概4~6.x%都有可能，而且因為你槓桿放大2.5倍，你的交易手續費及交易稅也要放大2.5倍，這也是為什麼很多老手都建議不要融資玩股票，因為你很容易就會出局，而且持有的成本太高，會高過你的每年在股市中得到的現金殖利率。

融券是你付出股價九成的保證金，去放空個股，由於股價向上是沒有限制的，所以融券很容易會被軋爆，例如之前我看準放空宏碁的借券賣出兩、三年的成本介於12~14，14~16，我算準漲到26以上就會產生骨牌效應，空方軋空方，一路軋到33.x，只要軋到這價位，在這兩三年12~16元放空宏碁的人全部都得出局，這也是為啥很多版友賺到不少錢的原因，當初把空方軋到山頂上，空方不得不去回補，多不合理的價位空方都得吞，就算接下來股價跌下來，空方也沒救了，因為都已補了，錢就賠光了。

當市場上很多投資人不懂這些金融工具的弱點，所以很容易在這些金融工具的弱點下出局，但其實融資及融券也是能使用的，但前提是你的經驗夠老道，我舉個例，如果你今天可以一直在市場上賺錢，連續的賺，這時放大槓桿行不行？當然行，因為你都是常勝軍了，你投資都一直賺錢了，你當然放大槓桿也有機會能賺錢，但當你放大槓桿後，你要面對的就是較高的融資利息，及高2.5倍的交易稅及手續費，所以一般來說，融資在使用時都是短期上使用不會硬凹抱一年 ，抱兩年，抱三年的，當初我在開始賺錢後，我也是有使用過1/4金額的融資，也就是說我有150萬，我會操作200萬，當資金再變大時，就變1/10，也就是說500萬中有50萬是融資，而且這融資都是最後勝負已分時才出場的，到了資金水至1000萬以上後，我就沒有再使用過融資。

很多散戶連現股操作都贏不了錢，當面臨槓桿放大2.5倍，手續費，交易稅成本增加2.5倍，再加上持有時間愈久會產生4~6.x%的融資利息，種種不利的的因素在使用融資時一一顯現，試想一件很簡單的事，你在沒有這些不利的情況都贏不了了，更何況面對這些不利的情況下，你如何能贏，而且對持有現股的人只要基本面好，股價一時跌到哪都沒關係，但對融資戶來說，股價只要跌了3成左右，券商就會打電話來要你補錢，只要某個股價出現一兩天，不論多不合理，你就會被券商融資斷頭，斷完頭後，就算股價回升，那也不關你的事，但如果持有現股，股價一兩天的不合理低，你也不會有事，放了一年後，說不定股價就漲回來了，還賺了一年的股息(前提是基本面不變)。

融券在賺錢前我也有用過，因為使用過，所以對被軋爆及融券強制回補的規則也有所了解，我寫了這一篇的原因不是鼓勵大家使用融資或融券，而是你要了解這些金融工具，就算你不使用它，你也要了解他的優缺點，因為市場上很人會使用，你了解這些金融工具的優缺點時，你就間接的了解使用這些金融工具人的弱點，你何時該去踹它一腳讓他融資斷頭，何時該去向上拉最後一波讓他融券軋爆，當你了解他們弱點時，你就容易能抓住股價在上漲及下跌時這些人心理的變化，他們何時壓力很大，我說過，股市就是人與人之間的對戰，短線更是明顯，如果你這一些金融工具都不了解，每天就僅能幻想著股價快快漲，股價快快跌，你在對股價及局勢做判斷時就一點依據都沒有，所以準確率就會相對的低。

大家應該會發覺一件事，如果我全力在做某一檔股票時，我對股價的趨勢及判斷會相對的準確，因為那時觀察的就會很深入，會考慮融資、融券，借券，三大法人進出，權証買賣這些原因，在營收及基本面出來時，依據之前財報內容外資群會有的反應先行做預測，這些因素考慮的愈多，準確性就會愈高，最近我投入的資金水位不高，

我對於猜中美貿易戰的結果也不會有太大的興趣，我認為我的優勢在分析股個，所以猜中美貿易戰的結果這種局我就不會跟，我寧願中美貿易戰結束後，所有個股股價回到某一個水位，這時再來以基本面和別的投資者決勝負，我認為這才是我比別人有優勢的地方。

期貨,選擇權 是 股票避險

https://www.mobile01.com/topicdetail.php?f=291&t=5107288&p=1147#11469

請教 A大: 之前你提過,期貨,選擇權是給大戶,法人們避險用的,不是散戶們拿來賺零用錢. 我想很多這裡網友們跟我一樣,對'期貨,選擇權' 對應到短線上的應用應該也是很陌生.而你提供 CMoney 上的連結只是介紹 '期貨,選擇權' 的定義,其它部份並沒有作深入的探討. 可否請你,有機會,針對這個應用 '國際走勢加三大法人買貨，期貨，選擇權的進出去做判斷',給個例子,謝謝.


ans:01上還是有一些人專門是在做期貨，選擇權，期貨及選擇權如果你是婐操作(單純所有資金買期貨，沒有現貨部位)，那無疑就是找死，股票中的贏家在股市中算是約一成的少數，婐操作期貨、選擇權的贏家可能1000個人中也找不到一人，其實道理不難理解，期貨及選擇權是拿來避險用的，不是拿來賭多空的，很多人想透過期貨、選擇權放大槓桿， 以期貨來說，放大槓桿最大為20倍，也就是說一個貪心的人用期貨放大槓桿到最大時，只要波動5%他就再見了，而選擇權更誇張，大概可以放大到160倍，大部份的散戶都愛用選擇權猜點數，投資當買樂透，中了就十倍，二十倍，甚至100倍的賺，錯了就全部都沒有。

我給你的cmoney投資小學堂中的期貨及選擇權只是讓你知道什麼是期貨，什麼是選擇權，當使用一項金融工具時，最基本的就是了解它的遊戲規則，例如很多人被融資斷頭，融券被強制回補，會發生這種事都是因為對這些金融工具不熟及使用不當所造成的，對外資群或法人來說，期貨及選擇權是用來保護手上現貨，因為有時局勢不明朗時，為了要保護手上現貨的獲利，就會透過期貨去避險，我舉個例，如果你有1000萬，假設你1000萬買了各大權值股，今天中美貿易戰2000億美金課了10%，川普恐赫說要把2000億美金在2019/3/1日加到25%，這時你該怎麼該？如果你是專業的基金經理人，你很注意績效，你當然不能像一般散戶坐以待斃讓上天決定自已的輸或贏，這時你當然要有一些動作，這時如果你總資金就1000萬，你都買光了，這時你能做的事就是按情勢做減碼，但交易有費用，給政府的要千分之三，買及賣各要給券商千分之1點5(各券商能有折扣)，此時如果你一買一賣，這會造成你的操作成本上升，所以你當然要想一個操作成本比較低的避險方法。

這時期貨就出來了，因為可以放大槓桿20倍，也就是說，你操作資金1000萬，你買了950萬的現股，你拿50萬就能用期貨對你的現貨去做避險，因為槓桿為20倍，以期貨交易稅率為十萬分之2，買及賣十萬分之3，下圖有比較圖，買賣個股及期貨要付出的成本差了55倍，這是非常誇張的，之前我常說，你的弱點要是比別人少，你打敗別人的機率就愈高，交易成本當然也是需要考慮的因素之一，選擇權也是避險工具之一，用在短線上會有劇烈波動的情況。

大概了解一下期貨及選擇權後，這你你就要幻想一下，如果你是大部位的外資群，你要怎麼去使用這金融工具，使用的情境很多種，假設你打算要在1個月中買進1000億，這時你知道股市一定會因為你要買進的這一千億而讓指數上漲，此時你就會先去怖期貨多單，你也會去佈選擇權多單，當你買進這1000億時，股價上升，指數上升，你期貨的槓桿是20倍，選擇權是160倍。下一種情境，如果你要賣1000億，這時你也會知道股市會因為你接下來這一個月賣1000億而使指數下跌，在你開賣現貨前，你就先去佈期貨空單，再去佈選擇權空方，當你賣這一仟億現股，指數下跌時，你放空的期貨及選擇權可以彌補一些你股票賣的不漂亮的損失，另一種情境，當你現股已經賣了300億後，此時局勢不明，你害怕會漲上去，但買賣股票的成本太高，所以你就去佈期貨、選擇權多單，如果漲上去，雖然你沒有現股，但因為槓桿夠大，你還是能賺到和持有300億股票的獲利，如果期貨表現不如預期，你想硬凹，你還能用手上300億的現金去推升股價及指數。


當你了解這金融工具的使用方法後，你也知道法人在什麼情境下會去使用，這時你就能了解為什麼一般婐操作期貨、選擇權散戶輸的機會很大，外資群及法人手上有現金可以去操控指數的漲跌，外資群操作時僅是拿本金的5%當避險資金，而散戶是拿100%資金去賭方向，股市波動時，外資群手上有一大堆現貨，除了可以控制方向，也能拿來當擔保品，就算外資群整個看錯把拿來操作期貨的錢賠光，那也僅僅是賠了5%，手上的現貨放一年以台股殖利率4%來算，隨便也補得回去。

聽完後，你該了解，期貨及選擇權不能婐做了吧，當你了解期貨及選擇權的使用方法後，你只要去觀察外資群的期貨，選擇權，買賣現貨的變化，你會能看出一些端倪，

但你無法很準確的預測到轉折點

，我舉個例給你聽，如果我的部位夠大，大到左手丟300億，右手接300億這種水準，今天我左手丟300億出去，右手如果接到350億回來，那代表市場信心不足，如果我左手丟300億，右手接到200億，那代表市場信心充足，外資群何時去轉買為賣，或轉賣為買，這是不可測的，就像讓你猜我啥時會買，啥時會賣一樣，這是不可測的，

但外資群在操作時一定會有一個方向性，這是大部位的人都了解的事，當你買進50億時，你不可能明天馬上轉賣，一定是一步一步佈局上去，而在佈局的中期是很明確的，因為外資群部位很大，轉賣時也是很明顯的，像1/7到2/22日，外資群買了700億了，當外資群連續賣現貨或是期貨先減碼時，這就是徵兆。

短線可以看出一些端倪，這是沒有問題的，但是我個人比較偏好個股基本面，我個人覺得我的優勢是分析基本面，所以我不會去操作大盤，因為我認為還是存在不公平，畢竟外資群現貨，期貨、選擇權可以搭配使用，如果我的部位不夠大，持有的現貨和指數走勢不相同，這時我在使用現貨，期貨，選擇權就會輸外資群。

期貨資料參考網址

[OK!!]Docker, cron, mail and logs

https://forums.docker.com/t/running-cronjob-in-debian-jessie-container/17527/7

dkoval Mar '17

=====

docker-compose.yml

version: '3.3'

services:
  gethpeers:
    build:
      context: gethpeers/
    volumes:
      - cronlog:/app/cronapplog:rw
    networks:
      - fastdev

  fakelog:
    build:
      context: fakelog/
    volumes:
      - cronlog:/app/cronapplog:rw
      - filebeat:/usr/share/filebeat/data:rw
    networks:
      - fastdev

volumes:  
  cronlog: 
  filebeat:
  
networks:
  fastdev:
    driver: bridge

gethpeers Dockerfile Fixed

FROM debian:stretch-slim
RUN apt-get -y update && apt-get install -y cron curl jq nano && \
    rm -r /var/lib/apt/lists/*
ADD . /app
ADD crontab /var/spool/cron/crontabs/root
RUN chmod 0600 /var/spool/cron/crontabs/root
RUN chmod +x /app/run-cronjob.sh
RUN chmod +x /app/start.sh
CMD cron -f

gethpeers crontab Fixed

* * * * * /app/run-cronjob.sh /app/start.sh > /proc/1/fd/1 2>/proc/1/fd/2
* * * * * echo hello > /proc/1/fd/1 2>/proc/1/fd/2

gethpeers run-cronjob Fixed

#!/bin/bash

if [ -z "$1" ] ; then
  echo "need name of cron job as first argument" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi
 
if [ ! -x "$1" ] ; then
  echo "cron job file $1 not executable, exiting" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi
 
if "$1"
then
  echo "cron job $1 Run!" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 0
else
  echo "cron job $1 failed!" > /proc/1/fd/1 2>/proc/1/fd/2
  exit 1
fi

gethpeers start.sh

#!/bin/bash

IP_PORT=xxx.xxx.xxx.xxx:8545
ETH_METHOD=admin_peers
PEERS=$(curl -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"'$ETH_METHOD'","params":[],"id":1}' $IP_PORT |  jq '.result[].network + {"project":"cronapp"}')

printf "\n===== Now Geth Peers =====\n"
printf "Peers: %s\n" $PEERS
echo $PEERS >> /app/cronapplog/gethpeers.log

fakelog Dockerfile

FROM docker.elastic.co/beats/filebeat:6.5.4
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml
USER filebeat

fakelog filebeat.yml

filebeat.prospectors:

- type: log
  paths:
    - /app/cronapplog/gethpeers.log
  exclude_files: ['.gz$']
  fields:
    srcname: "geth"
    srctype: "cron"
    filebeatserverip: "xxx.xxx.xxx.xxx"
  fields_under_root: true
  symlinks: true

output.logstash:
  hosts: ["logstash:5044"]

[Faile!!]Docker, cron, mail and logs

F............................................................................................

https://www.preining.info/blog/2018/05/docker-cron-mail-and-logs/

from debian:stretch-slim
RUN apt-get -y update
RUN apt-get install -y cron #ssmtp
ADD . /app
ADD crontab /etc/cron.d/mypackage
RUN chmod 0644 /etc/cron.d/mypackage
#ADD ssmtp.conf /etc/ssmtp/ssmtp.conf
#RUN chown root.mail /etc/ssmtp/ssmtp.conf
#RUN chmod 0640 /etc/ssmtp/ssmtp.conf
CMD cron -f

=====

docker-compose.yml

version: '3.3'

services:
  gethpeers:
    build:
      context: gethpeers/
    volumes:
      - cronlog:/app/cronapplog:rw
    networks:
      - fastdev

  fakelog:
    build:
      context: fakelog/
    volumes:
      - cronlog:/app/cronapplog:rw
      - filebeat:/usr/share/filebeat/data:rw
    networks:
      - fastdev

volumes:  
  cronlog: 
  filebeat:
  
networks:
  fastdev:
    driver: bridge

gethpeers Dockerfile

from debian:stretch-slim
RUN apt-get -y update
RUN apt-get install -y cron 
#ssmtp
ADD . /app
ADD crontab /etc/cron.d/mypackage
RUN chmod 0644 /etc/cron.d/mypackage
#ADD ssmtp.conf /etc/ssmtp/ssmtp.conf
#RUN chown root.mail /etc/ssmtp/ssmtp.conf
#RUN chmod 0640 /etc/ssmtp/ssmtp.conf
CMD cron -f

gethpeers crontab

* * * * * root /app/run-cronjob /app/start.sh

gethpeers run-cronjob

#!/bin/bash

if [ -z "$1" ] ; then
  echo "need name of cron job as first argument" >&2
  exit 1
fi
 
if [ ! -x "$1" ] ; then
  echo "cron job file $1 not executable, exiting" >&2
  exit 1
fi
 
if "$1"
then
  exit 0
else
  echo "cron job $1 failed!" 2>/proc/1/fd/2 >&2
  exit 1
fi

gethpeers start.sh

#!/bin/bash

IP_PORT=xxx.xxx.xxx.xxx:8545
ETH_METHOD=admin_peers
PEERS=$(curl -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"'$ETH_METHOD'","params":[],"id":1}' $IP_PORT |  jq '.result[].network + {"project":"cronapp"}')

printf "\n===== Now Geth Peers =====\n"
printf "Peers: %s\n" $PEERS
echo $PEERS >> /app/cronapplog/gethpeers.log

fakelog Dockerfile

FROM docker.elastic.co/beats/filebeat:6.5.4
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml
USER filebeat

fakelog filebeat.yml

filebeat.prospectors:

- type: log
  paths:
    - /app/cronapplog/gethpeers.log
  exclude_files: ['.gz$']
  fields:
    srcname: "geth"
    srctype: "cron"
    filebeatserverip: "xxx.xxx.xxx.xxx"
  fields_under_root: true
  symlinks: true

output.logstash:
  hosts: ["logstash:5044"]

OpenFaas

https://github.com/openfaas/faas

k8s kubernetes Lesson 4 RKE

Use RKE only one YAML config

https://itnext.io/setup-a-basic-kubernetes-cluster-with-ease-using-rke-a5f3cc44f26f

[轉]"migrating" to Kubernetes from docker-compose in homelab

https://www.reddit.com/r/docker/comments/9j2vc7/migrating_to_kubernetes_from_dockercompose_in/


If / when you're able to spawn arbitrary VMs, you can look at kubeadm, CoreOS, RKE (my current choice), and so on for cluster creation.



Before you can use kompose, or use kubectl apply -f myawesome.yaml, you first and foremost need to set up a Kubernetes cluster. This might be the most challenging thing to do because Kubernetes is heavy-weight compared to docker-compose. I recommend using RKE to set it up. Also, run away if anyone mentions Kubespray.


=====

RKE ？？？

YAML multi-line string

https://rancher.com/docs/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/


To define an add-on directly in the YAML file, make sure to use the YAML’s block indicator

|-

as the addons directive is a multi-line string option. It’s possible to specify multiple YAML resource definitions by separating them using the

---

directive.

[轉]Headless CMS: REST vs JSON:API vs GraphQL

https://dri.es/headless-cms-rest-vs-jsonapi-vs-graphql?fbclid=IwAR3PJouIotZns9DnthDvr4cA-vtWiFq60opwL-dCuAjLElaflI-qj4Uw5KY#operational-efficiency