From 9934dd538b0ce116e3b1600272cb46369b082246 Mon Sep 17 00:00:00 2001
From: Hsieh Chin Fan <typebrook@gmail.com>
Date: Wed, 2 Feb 2022 13:34:47 +0800
Subject: init commit

---
 demo/client.sh                 |  30 ++
 dovecot/90-sieve.conf          | 206 ++++++++++++
 dovecot/Makefile               |   2 +
 dovecot/dovecot.conf           |  34 ++
 dovecot/sieve                  | 149 +++++++++
 git/README.md                  |   9 +
 git/create.sh                  |  53 ++++
 git/daemon.sh                  |   7 +
 git/git-daemon.service         |  21 ++
 nginx/.gitignore               |   2 +
 nginx/Makefile                 |  28 ++
 nginx/layout/gal.xslt          |  67 ++++
 nginx/layout/simple-gal.xslt   |  36 +++
 nginx/layout/simple.xslt       |  51 +++
 nginx/nginx.conf               | 131 ++++++++
 nginx/passwd/2022.10.11        |   1 +
 nginx/passwd/houshou           |   1 +
 nginx/passwd/japan             |   1 +
 nginx/passwd/ntumountainclub   |   1 +
 nginx/passwd/rescue            |   1 +
 nginx/sites-available/vps      | 354 +++++++++++++++++++++
 postfix/Makefile               |   9 +
 postfix/aliases                | 268 ++++++++++++++++
 postfix/main.cf                | 701 +++++++++++++++++++++++++++++++++++++++++
 postfix/master.cf              | 141 +++++++++
 postfix/opendkim/opendkim.conf |   6 +
 postfix/virtual                | 328 +++++++++++++++++++
 rclone/Makefile                |  23 ++
 smtpd/Makefile                 |   8 +
 smtpd/mail/spam                |  11 +
 smtpd/smtpd.conf               |  47 +++
 ssh/local.conf                 |   4 +
 www/.gitignore                 |   1 +
 www/Makefile                   |  14 +
 www/assets/favicon.ico         | Bin 0 -> 549 bytes
 www/assets/gpg.asc             |  84 +++++
 www/assets/robots.txt          |   4 +
 www/assets/style.css           | 213 +++++++++++++
 www/assets/wp-admin.php        |   1 +
 www/scripts/add-graph.py       |  35 ++
 www/scripts/build.sh           | 188 +++++++++++
 www/templates/footer.html      |   4 +
 www/templates/head.html        |  10 +
 www/templates/header.html      |  17 +
 www/templates/index.md         |   1 +
 45 files changed, 3303 insertions(+)
 create mode 100644 demo/client.sh
 create mode 100644 dovecot/90-sieve.conf
 create mode 100644 dovecot/Makefile
 create mode 100644 dovecot/dovecot.conf
 create mode 100644 dovecot/sieve
 create mode 100644 git/README.md
 create mode 100755 git/create.sh
 create mode 100755 git/daemon.sh
 create mode 100644 git/git-daemon.service
 create mode 100644 nginx/.gitignore
 create mode 100644 nginx/Makefile
 create mode 100644 nginx/layout/gal.xslt
 create mode 100644 nginx/layout/simple-gal.xslt
 create mode 100644 nginx/layout/simple.xslt
 create mode 100644 nginx/nginx.conf
 create mode 100644 nginx/passwd/2022.10.11
 create mode 100644 nginx/passwd/houshou
 create mode 100644 nginx/passwd/japan
 create mode 100644 nginx/passwd/ntumountainclub
 create mode 100644 nginx/passwd/rescue
 create mode 100644 nginx/sites-available/vps
 create mode 100644 postfix/Makefile
 create mode 100644 postfix/aliases
 create mode 100644 postfix/main.cf
 create mode 100644 postfix/master.cf
 create mode 100644 postfix/opendkim/opendkim.conf
 create mode 100644 postfix/virtual
 create mode 100644 rclone/Makefile
 create mode 100644 smtpd/Makefile
 create mode 100755 smtpd/mail/spam
 create mode 100644 smtpd/smtpd.conf
 create mode 100644 ssh/local.conf
 create mode 100644 www/.gitignore
 create mode 100644 www/Makefile
 create mode 100644 www/assets/favicon.ico
 create mode 100644 www/assets/gpg.asc
 create mode 100644 www/assets/robots.txt
 create mode 100644 www/assets/style.css
 create mode 100644 www/assets/wp-admin.php
 create mode 100755 www/scripts/add-graph.py
 create mode 100755 www/scripts/build.sh
 create mode 100644 www/templates/footer.html
 create mode 100644 www/templates/head.html
 create mode 100644 www/templates/header.html
 create mode 100644 www/templates/index.md

diff --git a/demo/client.sh b/demo/client.sh
new file mode 100644
index 0000000..5d4a3c4
--- /dev/null
+++ b/demo/client.sh
@@ -0,0 +1,30 @@
+# Enter tmux session on this host
+
+# RUN the following command to quickly execute this script
+# curl demo.topo.tw | sh
+
+# Add private key as temporary file
+# Remove it when script is exited
+IDENTITY_FILE=$(mktemp -t demo.key.XXXX)
+trap "rm $IDENTITY_FILE" EXIT
+
+# This private key can only run command 'tmux -r' on remote
+<<KEY cat >$IDENTITY_FILE
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQR4XNnhI1OJe4o/yexrMJs3EECymgz4
+UjF9oHl3F+jF/CQ5EDyFaW1IH35Eh0ECHPDfqfzB0BmgZ4zqOs9lvzA2AAAAqPeejtr3no
+7aAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHhc2eEjU4l7ij/J
+7GswmzcQQLKaDPhSMX2geXcX6MX8JDkQPIVpbUgffkSHQQIc8N+p/MHQGaBnjOo6z2W/MD
+YAAAAhALHPQcjhYNBkrVVzDj6dJbRbN2gqAiJtXPx/iJogfcaqAAAACnBoYW1AdnVsdHIB
+AgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
+KEY
+
+# Launch SSH connection with private key above
+# Use tty of parent shell as STDIN, so user cannot type on the screen
+</proc/$PPID/fd/0 ssh -i $IDENTITY_FILE \
+  -o StrictHostKeyChecking=no \
+  -o UserKnownHostsFile=/dev/null \
+  -p 7579 \
+  pham@git.topo.tw
diff --git a/dovecot/90-sieve.conf b/dovecot/90-sieve.conf
new file mode 100644
index 0000000..8c0c244
--- /dev/null
+++ b/dovecot/90-sieve.conf
@@ -0,0 +1,206 @@
+##
+## Settings for the Sieve interpreter
+##
+
+# Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf
+# by adding it to the respective mail_plugins= settings.
+
+# The Sieve interpreter can retrieve Sieve scripts from several types of
+# locations. The default `file' location type is a local filesystem path
+# pointing to a Sieve script file or a directory containing multiple Sieve
+# script files. More complex setups can use other location types such as
+# `ldap' or `dict' to fetch Sieve scripts from remote databases.
+#
+# All settings that specify the location of one ore more Sieve scripts accept
+# the following syntax:
+#
+# location = [<type>:]path[;<option>[=<value>][;...]]
+#
+# If the type prefix is omitted, the script location type is 'file' and the 
+# location is interpreted as a local filesystem path pointing to a Sieve script
+# file or directory. Refer to Pigeonhole wiki or INSTALL file for more
+# information.
+
+plugin {
+  # The location of the user's main Sieve script or script storage. The LDA
+  # Sieve plugin uses this to find the active script for Sieve filtering at
+  # delivery. The "include" extension uses this location for retrieving
+  # :personal" scripts. This is also where the  ManageSieve service will store
+  # the user's scripts, if supported.
+  # 
+  # Currently only the 'file:' location type supports ManageSieve operation.
+  # Other location types like 'dict:' and 'ldap:' can currently only
+  # be used as a read-only script source ().
+  #
+  # For the 'file:' type: use the ';active=' parameter to specify where the
+  # active script symlink is located.
+  # For other types: use the ';name=' parameter to specify the name of the
+  # default/active script.
+  sieve = file:~/sieve;active=~/.dovecot.sieve
+
+  # The default Sieve script when the user has none. This is the location of a
+  # global sieve script file, which gets executed ONLY if user's personal Sieve
+  # script doesn't exist. Be sure to pre-compile this script manually using the
+  # sievec command line tool if the binary is not stored in a global location.
+  # --> See sieve_before for executing scripts before the user's personal
+  #     script.
+  #sieve_default = /var/lib/dovecot/sieve/default.sieve
+
+  # The name by which the default Sieve script (as configured by the 
+  # sieve_default setting) is visible to the user through ManageSieve. 
+  #sieve_default_name = 
+
+  # Location for ":global" include scripts as used by the "include" extension.
+  #sieve_global =
+
+  # The location of a Sieve script that is run for any message that is about to
+  # be discarded; i.e., it is not delivered anywhere by the normal Sieve
+  # execution. This only happens when the "implicit keep" is canceled, by e.g.
+  # the "discard" action, and no actions that deliver the message are executed.
+  # This "discard script" can prevent discarding the message, by executing
+  # alternative actions. If the discard script does nothing, the message is
+	# still discarded as it would be when no discard script is configured.
+  #sieve_discard =
+
+  # Location Sieve of scripts that need to be executed before the user's
+  # personal script. If a 'file' location path points to a directory, all the 
+  # Sieve scripts contained therein (with the proper `.sieve' extension) are
+  # executed. The order of execution within that directory is determined by the
+  # file names, using a normal 8bit per-character comparison.
+  #
+  # Multiple script locations can be specified by appending an increasing number
+  # to the setting name. The Sieve scripts found from these locations are added
+  # to the script execution sequence in the specified order. Reading the
+  # numbered sieve_before settings stops at the first missing setting, so no
+  # numbers may be skipped.
+  #sieve_before = /var/lib/dovecot/sieve.d/
+  #sieve_before2 = ldap:/etc/sieve-ldap.conf;name=ldap-domain
+  #sieve_before3 = (etc...)
+
+  # Identical to sieve_before, only the specified scripts are executed after the
+  # user's script (only when keep is still in effect!). Multiple script
+  # locations can be specified by appending an increasing number.
+  #sieve_after =
+  #sieve_after2 =
+  #sieve_after2 = (etc...)
+
+  # Which Sieve language extensions are available to users. By default, all
+  # supported extensions are available, except for deprecated extensions or
+  # those that are still under development. Some system administrators may want
+  # to disable certain Sieve extensions or enable those that are not available
+  # by default. This setting can use '+' and '-' to specify differences relative
+  # to the default. For example `sieve_extensions = +imapflags' will enable the
+  # deprecated imapflags extension in addition to all extensions were already
+  # enabled by default.
+  sieve_extensions = +variables +editheader
+  sieve_editheader_max_header_size = 1k
+
+  # Which Sieve language extensions are ONLY available in global scripts. This
+  # can be used to restrict the use of certain Sieve extensions to administrator
+  # control, for instance when these extensions can cause security concerns.
+  # This setting has higher precedence than the `sieve_extensions' setting
+  # (above), meaning that the extensions enabled with this setting are never
+  # available to the user's personal script no matter what is specified for the
+  # `sieve_extensions' setting. The syntax of this setting is similar to the
+  # `sieve_extensions' setting, with the difference that extensions are
+  # enabled or disabled for exclusive use in global scripts. Currently, no
+  # extensions are marked as such by default.
+  #sieve_global_extensions =
+
+  # The Pigeonhole Sieve interpreter can have plugins of its own. Using this
+  # setting, the used plugins can be specified. Check the Dovecot wiki
+  # (wiki2.dovecot.org) or the pigeonhole website
+  # (http://pigeonhole.dovecot.org) for available plugins.
+  # The sieve_extprograms plugin is included in this release.
+  #sieve_plugins =
+
+  # The maximum size of a Sieve script. The compiler will refuse to compile any
+  # script larger than this limit. If set to 0, no limit on the script size is
+  # enforced.
+  #sieve_max_script_size = 1M
+
+  # The maximum number of actions that can be performed during a single script
+  # execution. If set to 0, no limit on the total number of actions is enforced.
+  #sieve_max_actions = 32
+
+  # The maximum number of redirect actions that can be performed during a single
+  # script execution. If set to 0, no redirect actions are allowed.
+  #sieve_max_redirects = 4
+
+  # The maximum number of personal Sieve scripts a single user can have. If set
+  # to 0, no limit on the number of scripts is enforced.
+  # (Currently only relevant for ManageSieve)
+  #sieve_quota_max_scripts = 0
+
+  # The maximum amount of disk storage a single user's scripts may occupy. If
+  # set to 0, no limit on the used amount of disk storage is enforced.
+  # (Currently only relevant for ManageSieve)
+  #sieve_quota_max_storage = 0
+
+  # The primary e-mail address for the user. This is used as a default when no
+  # other appropriate address is available for sending messages. If this setting
+  # is not configured, either the postmaster or null "<>" address is used as a
+  # sender, depending on the action involved. This setting is important when
+  # there is no message envelope to extract addresses from, such as when the
+  # script is executed in IMAP.
+  #sieve_user_email =
+
+  # The path to the file where the user log is written. If not configured, a
+  # default location is used. If the main user's personal Sieve (as configured
+  # with sieve=) is a file, the logfile is set to <filename>.log by default. If
+  # it is not a file, the default user log file is ~/.dovecot.sieve.log.
+  #sieve_user_log =
+
+  # Specifies what envelope sender address is used for redirected messages.
+  # The following values are supported for this setting:
+  #
+  #   "sender"         - The sender address is used (default).
+  #   "recipient"      - The final recipient address is used.
+  #   "orig_recipient" - The original recipient is used.
+  #   "user_email"     - The user's primary address is used. This is
+  #                      configured with the "sieve_user_email" setting. If
+  #                      that setting is unconfigured, "user_mail" is equal to
+  #                      "recipient".
+  #   "postmaster"     - The postmaster_address configured for the LDA.
+  #   "<user@domain>"  - Redirected messages are always sent from user@domain.
+  #                      The angle brackets are mandatory. The null "<>" address
+  #                      is also supported.
+  #
+  # This setting is ignored when the envelope sender is "<>". In that case the
+  # sender of the redirected message is also always "<>".
+  #sieve_redirect_envelope_from = sender
+
+  ## TRACE DEBUGGING
+  # Trace debugging provides detailed insight in the operations performed by
+  # the Sieve script. These settings apply to both the LDA Sieve plugin and the
+  # IMAPSIEVE plugin. 
+  #
+  # WARNING: On a busy server, this functionality can quickly fill up the trace
+  # directory with a lot of trace files. Enable this only temporarily and as
+  # selective as possible.
+  
+  # The directory where trace files are written. Trace debugging is disabled if
+  # this setting is not configured or if the directory does not exist. If the 
+  # path is relative or it starts with "~/" it is interpreted relative to the
+  # current user's home directory.
+  #sieve_trace_dir =
+  
+  # The verbosity level of the trace messages. Trace debugging is disabled if
+  # this setting is not configured. Possible values are:
+  #
+  #   "actions"        - Only print executed action commands, like keep,
+  #                      fileinto, reject and redirect.
+  #   "commands"       - Print any executed command, excluding test commands.
+  #   "tests"          - Print all executed commands and performed tests.
+  #   "matching"       - Print all executed commands, performed tests and the
+  #                      values matched in those tests.
+  #sieve_trace_level =
+  
+  # Enables highly verbose debugging messages that are usually only useful for
+  # developers.
+  #sieve_trace_debug = no
+  
+  # Enables showing byte code addresses in the trace output, rather than only
+  # the source line numbers.
+  #sieve_trace_addresses = no 
+}
diff --git a/dovecot/Makefile b/dovecot/Makefile
new file mode 100644
index 0000000..5d80849
--- /dev/null
+++ b/dovecot/Makefile
@@ -0,0 +1,2 @@
+all:
+	ln -f `pwd`/sieve ~/sieve
diff --git a/dovecot/dovecot.conf b/dovecot/dovecot.conf
new file mode 100644
index 0000000..e98b281
--- /dev/null
+++ b/dovecot/dovecot.conf
@@ -0,0 +1,34 @@
+listen = *
+
+ssl = required
+
+ssl_cert = </etc/mail/ssl/fullchain.cer
+ssl_key = </etc/mail/ssl/mail.topo.tw.key
+ssl_dh = </etc/ssl/dh.pem
+
+mail_location = maildir:~/Maildir
+
+passdb {
+    # This is where you define your password scheme.
+    # If you have used blowfish it needs to be 'BLF-CRYPT'.
+    args = scheme=sha512-crypt /etc/mail/passwd
+    driver = passwd-file
+}
+
+userdb {
+    args = uid=pham gid=pham home=/home/pham
+    driver = static
+}
+
+protocols = imap lmtp
+
+service imap-login {
+  inet_listener imaps {
+    port = 993
+    ssl = yes
+  }
+  # Disable imap
+  inet_listener imap {
+    port = 0
+  }
+}
diff --git a/dovecot/sieve b/dovecot/sieve
new file mode 100644
index 0000000..b11f1cc
--- /dev/null
+++ b/dovecot/sieve
@@ -0,0 +1,149 @@
+# Sieve filter
+
+# Declare the extensions used by this script.
+require ["fileinto", "reject", "variables", "editheader"];
+
+# If transport is not encrypted, add warning emoji at the beginning of the subject
+if header :contains "Received" ["by topo.tw (Postfix) with ESMTP "]
+{
+  # Match the entire subject
+  if header :matches "Subject" "*" {
+    # Stored in a variable:
+    set "subject" "${1}";
+  }
+  deleteheader "Subject";
+  addheader :last "Subject" "⚠ ${subject}";
+}
+
+# Edit header for test
+if header :contains "From" ["typebrook@gmail.com"] {
+  # Match the entire subject ...
+  if header :matches "Subject" "*" {
+      # ... to get it in a match group that can then be stored in a variable:
+      set "subject" "${1}";
+  }
+  deleteheader "Subject";
+  addheader :last "Subject" "Warning: ${subject}";
+}
+
+# CAUTION!!
+# Put this block at the top so unwanted mail are discarded
+# Message which will trigger commands
+# Discard them so we only have message in Sent
+if allof (
+    address :is ["To"] "mastodon@topo.tw",
+    header :matches "X-Original-To" "mastodon@topo.tw"
+) {
+  discard;
+}
+
+elsif header :contains "From" [
+  "HANCHOR",
+  "info@members.netflix.com",
+  "Amazon Web Services",
+  "no-reply@wamazing.jp",
+  "info@join.netflix.com",
+  "noreply@steampowered.com"
+] {
+  fileinto "promotion";
+}
+
+elsif header :matches :comparator "i;ascii-casemap" "Subject" [
+  "*login*",
+  "*verify*",
+  "*sign-in*",
+  "*登入*",
+  "*密碼*",
+  "*安全性警示*",
+  "*new IP Address*"
+] {
+  fileinto "login";
+}
+
+elsif header :matches :comparator "i;ascii-casemap" "Subject" [
+  "*系統公告*"
+] {
+  fileinto "service";
+}
+
+elsif header :contains :comparator "i;ascii-casemap" "Subject" [
+  "帳單",
+  "付款",
+  "繳款",
+  "扣款",
+  "交易",
+  "費用",
+  "eGUI",
+  "Invoice",
+  "發票",
+  "Receipt",
+  "Billing",
+  "Expense"
+] {
+  fileinto "pay";
+}
+
+elsif header :matches :comparator "i;ascii-casemap" "Subject" ["*永豐*"] {
+  fileinto "STOCK";
+}
+
+elsif address :is ["From"] "no-reply@hackmd.io" {
+  fileinto "update";
+}
+
+elsif address :is ["From"] "notifications@github.com" {
+  fileinto "github";
+}
+
+elsif address :contains ["To", "Cc"] "arch-general@lists.archlinux.org" {
+  fileinto "mailing_list.arch-general";
+}
+
+elsif address :is ["From", "To", "Cc"] "mutt-users@mutt.org" {
+  fileinto "mailing_list.mutt-users";
+}
+
+elsif address :is ["From", "To", "Cc"] "help-bash@gnu.org" {
+  fileinto "mailing_list.bash";
+}
+
+elsif header :matches "Sender" "*~rjarry/aerc-discuss@lists.sr.ht*" {
+  fileinto "mailing_list.aerc";
+}
+
+elsif header :matches "Chat-Version" ["*"] {
+  fileinto "DeltaChat";
+}
+
+elsif header :matches "X-Original-To" ["cybersec@topo.tw"] {
+  fileinto "cybersec";
+}
+
+elsif address :is ["To"] "lay9412206@gmail.com" {
+  fileinto "hometeach";
+}
+
+# Spam Rule:
+# Message does not contain my address in "To", "CC" or "BCC"
+elsif anyof (
+    not header :contains ["To", "Cc", "Bcc", "X-Original-To"] "topo.tw",
+    header :contains "X-Original-To" "eocuk17"
+) {
+  fileinto "spam";
+}
+# Or fake header in "From"
+elsif allof (
+    header :matches "From" "*@topo.tw*",
+    not header :contains "Received" [
+      "from topo.tw",
+      "from PC",
+      "from [127.0.0.1]",
+      "by topo.tw"
+    ]
+) {
+  fileinto "spam";
+}
+
+else {
+  fileinto "INBOX";
+}
diff --git a/git/README.md b/git/README.md
new file mode 100644
index 0000000..5637f06
--- /dev/null
+++ b/git/README.md
@@ -0,0 +1,9 @@
+## For Git Daemon
+
+read https://git-scm.com/book/be/v2/Git-on-the-Server-Git-Daemon
+
+## For Http Files for Git
+
+refs:
+- https://mtkn.jp/computer/git_server.html
+- https://codemadness.org/stagit.html
diff --git a/git/create.sh b/git/create.sh
new file mode 100755
index 0000000..f2f4227
--- /dev/null
+++ b/git/create.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+# - Makes index for repositories in a single directory.
+# - Makes static pages for each repository directory.
+#
+# NOTE, things to do manually (once) before running this script:
+# - copy style.css, logo.png and favicon.png manually, a style.css example
+#   is included.
+#
+# - write clone URL, for example "git://git.codemadness.org/dir" to the "url"
+#   file for each repo.
+# - write owner of repo to the "owner" file.
+# - write description in "description" file.
+#
+# Usage:
+# - mkdir -p htmldir && cd htmldir
+# - sh example_create.sh
+
+ORIG_DIR=`pwd`
+
+# path must be absolute.
+reposdir="/srv/git"
+curdir="/srv/git/www"
+
+cd ${curdir}
+
+# make files per repo.
+for dir in "${reposdir}/"*/; do
+	# strip .git suffix.
+	r=$(basename "${dir}")
+	d=$(basename "${dir}" ".git")
+	printf "%s... " "${d}"
+
+	mkdir -p "${curdir}/${d}"
+	cd "${curdir}/${d}" || continue
+
+    test -f ${dir}/owner || echo `whoami` >${dir}/owner
+    test -f ${dir}/url || echo git://git.topo.tw/${d} >${dir}/url
+
+	stagit -c ".cache" -u "https://git.codemadness.nl/$d/" "${reposdir}/${r}"
+
+	# symlinks
+	ln -sf log.html index.html
+	ln -sf ../style.css style.css
+	ln -sf ../logo.png logo.png
+	ln -sf ../favicon.png favicon.png
+
+	echo "done"
+done
+
+# make index.
+stagit-index "${reposdir}/"*/ > "${curdir}/index.html"
+
+cd ${ORIG_DIR}
diff --git a/git/daemon.sh b/git/daemon.sh
new file mode 100755
index 0000000..3cfac1b
--- /dev/null
+++ b/git/daemon.sh
@@ -0,0 +1,7 @@
+#! /bin/bash
+
+git daemon \
+  --export-all \
+  --enable=upload-archive \
+  --verbose --base-path=`pwd` \
+  -- `pwd`/*
diff --git a/git/git-daemon.service b/git/git-daemon.service
new file mode 100644
index 0000000..4641aea
--- /dev/null
+++ b/git/git-daemon.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Start Git Daemon
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=/home/pham/git/vps/git/daemon.sh
+WorkingDirectory=/srv/git
+
+Restart=always
+RestartSec=500ms
+
+StandardOutput=syslog
+StandardError=syslog
+SyslogIdentifier=git-daemon
+
+User=pham
+Group=pham
+
+[Install]
+WantedBy=multi-user.target
diff --git a/nginx/.gitignore b/nginx/.gitignore
new file mode 100644
index 0000000..c5d401b
--- /dev/null
+++ b/nginx/.gitignore
@@ -0,0 +1,2 @@
+src/
+*tar.gz
diff --git a/nginx/Makefile b/nginx/Makefile
new file mode 100644
index 0000000..cb995f7
--- /dev/null
+++ b/nginx/Makefile
@@ -0,0 +1,28 @@
+.ONESHELL:
+
+VERSION=1.27.2
+
+all: src /home/pham/git/ngx_http_proxy_connect_module
+	cd $<
+	nginx -V |& \
+	sed -nE 's/^configure arguments: ([^\n]*)$$/\1/p' | \
+	sed -nE 's/([^'"'"' \t\n]+('"'"'([^'"'"'\]|\\'"'"'?)*'"'"'|"([^"\\]|\\"?)*")?) ?/\1\n/gp' | \
+	xargs ./configure \
+		--with-http_xslt_module=dynamic \
+		--with-http_dav_module \
+		--with-http_image_filter_module \
+		--add-dynamic-module=/home/pham/git/ngx_http_proxy_connect_module
+	make modules
+	make
+	sudo make install
+	#cd ../.. &&  rm -rf nginx
+
+src:
+	curl -O https://nginx.org/download/nginx-${VERSION}.tar.gz
+	tar zxvf nginx-${VERSION}.tar.gz && mv nginx-${VERSION} $@
+
+config:
+	ln -sf `pwd`/* /etc/nginx
+
+/home/pham/git/ngx_http_proxy_connect_module:
+	git clone https://github.com/chobits/ngx_http_proxy_connect_module $@
diff --git a/nginx/layout/gal.xslt b/nginx/layout/gal.xslt
new file mode 100644
index 0000000..fadcc37
--- /dev/null
+++ b/nginx/layout/gal.xslt
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:output method="html" encoding="utf-8" indent="yes" />
+<xsl:template match="/">
+<xsl:text disable-output-escaping='yes'>&lt;!DOCTYPE html&gt;</xsl:text>
+<html>
+<head>
+  <title><xsl:value-of select="$title" /></title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.css" integrity="sha256-Vzbj7sDDS/woiFS3uNKo8eIuni59rjyNGtXfstRzStA=" crossorigin="anonymous"/>
+  <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js" integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0=" crossorigin="anonymous"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.js" integrity="sha256-yt2kYMy0w8AbtF89WXb2P1rfjcP/HTHLT7097U8Y5b8=" crossorigin="anonymous"></script>
+  <script src="https://cdn.jsdelivr.net/npm/jszip@3.1.5/dist/jszip.min.js" integrity="sha256-PZ/OvdXxEW1u3nuTAUCSjd4lyaoJ3UJpv/X11x2Gi5c=" crossorigin="anonymous"></script>
+  <script src="https://cdn.jsdelivr.net/npm/file-saver@2.0.5/dist/FileSaver.min.js" integrity="sha256-xoh0y6ov0WULfXcLMoaA6nZfszdgI8w2CEJ/3k8NBIE=" crossorigin="anonymous"></script>
+  <style>img { display: block; }</style>
+</head>
+<body>
+<h1 style="text-align: center;"><xsl:value-of select="$title"/></h1>
+<div style="border-bottom: 1px solid gray; margin-bottom: 1rem;"></div>
+<div style="display: flex; flex-wrap: wrap; gap: 2px; justify-content: center;">
+<xsl:for-each select="list/file">
+  <xsl:sort order="descending"/>
+  <a href="{.}" data-fancybox="gallery">
+    <img loading="lazy" src="{.}!lg" height="200"/>
+  </a>
+</xsl:for-each>
+</div>
+<script>
+async function downloadAll() {
+  const zip = JSZip();
+  const folder = zip.folder('<xsl:value-of select="$title" />');
+  const files = [
+    <xsl:for-each select="list/file">
+     <xsl:value-of select="." />
+    </xsl:for-each>
+  ];
+  for(const i in files) {
+    const file = files[i];
+    const resp = await fetch(file);
+    folder.file(file, resp.blob());
+    $.fancybox.animate($.fancybox.getInstance().SlideShow.$progress.show(),{scaleX: i/files.length}, 0.1);
+  }
+  const zipFile = await zip.generateAsync({type: 'blob'});
+  saveAs(zipFile, '<xsl:value-of select="$title" />' + '.zip');
+  $.fancybox.animate($.fancybox.getInstance().SlideShow.$progress.show(),{scaleX: 0}, 0.1); 
+}
+
+$('[data-fancybox="gallery"]').fancybox({
+  buttons: [
+    "thumbs",
+    "slideShow",
+    "fullScreen",
+    "downloadAll",
+    "close"
+  ],
+  btnTpl: {
+    downloadAll:
+      '<a class="fancybox-button fancybox-button--download" title="Download All" href="javascript:downloadAll()">' +
+      '<svg xmlns="http://www.w3.org/2000/svg" class="h-6 w-6" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 10v6m0 0l-3-3m3 3l3-3M3 17V7a2 2 0 012-2h6l2 2h6a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z" style="fill:unset; stroke-width:2"/></svg>' +
+      '</a>',
+  }
+});
+</script>
+</body>
+</html>
+</xsl:template>
+</xsl:stylesheet>
diff --git a/nginx/layout/simple-gal.xslt b/nginx/layout/simple-gal.xslt
new file mode 100644
index 0000000..749be72
--- /dev/null
+++ b/nginx/layout/simple-gal.xslt
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:output method="html" encoding="utf-8" indent="yes" />
+<xsl:template match="/">
+<xsl:text disable-output-escaping='yes'>&lt;!DOCTYPE html&gt;</xsl:text>
+<html>
+<head>
+    <title><xsl:value-of select="$title" /></title>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <style>
+    img {
+         display: inline;
+         width: 23%;    
+         margin: 2mm;
+         vertical-align: bottom;
+    }
+    @media all and (max-width: 20.4cm) {
+        img {
+            max-width: calc(100% - 4mm);
+        }
+    }
+    body {
+        margin: 0;
+    }
+    </style>
+</head>
+<body>
+    <xsl:for-each select="list/file">
+        <a href="{.}" title="click to enlarge">
+            <img src="{.}" alt="{.}"/>
+        </a>
+   </xsl:for-each>
+</body>
+</html>
+</xsl:template>
+</xsl:stylesheet>
diff --git a/nginx/layout/simple.xslt b/nginx/layout/simple.xslt
new file mode 100644
index 0000000..9cc5ad6
--- /dev/null
+++ b/nginx/layout/simple.xslt
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/">
+    <html>
+      <body style="margin: 0 auto; max-width: 900px; width: fit-content;">
+
+        <h3><xsl:value-of select="name(//directory)"/></h3>
+
+        <table border="0">
+          <tr bgcolor="#7DAFFF">
+            <th>Name</th>
+            <th style="padding-inline: 2em;">Size</th>
+            <th>Date</th>
+          </tr>
+          <xsl:for-each select="list/*">
+            <xsl:sort select="mtime" />
+
+            <xsl:variable name="name">
+              <xsl:value-of select="."/>
+            </xsl:variable>
+
+            <xsl:variable name="size">
+              <xsl:if test="string-length(@size) &gt; 0">
+                <xsl:if test="number(@size) &gt; 0">
+                  <xsl:choose>
+                    <xsl:when test="round(@size div 1024) &lt; 1"><xsl:value-of select="@size" /></xsl:when>
+                    <xsl:when test="round(@size div 1048576) &lt; 1"><xsl:value-of select="format-number((@size div 1024), '0.0')" />K</xsl:when>
+                    <xsl:otherwise><xsl:value-of select="format-number((@size div 1048576), '0.00')" /> MB</xsl:otherwise>
+                  </xsl:choose>
+                </xsl:if>
+              </xsl:if>
+            </xsl:variable>
+
+            <xsl:variable name="date">
+              <xsl:value-of select="substring(@mtime,6,2)"/>/<xsl:value-of select="substring(@mtime,9,2)"/><xsl:text> </xsl:text>
+              <xsl:value-of select="substring(@mtime,12,2)"/>:<xsl:value-of select="substring(@mtime,15,2)"/>:<xsl:value-of select="substring(@mtime,18,2)"/><xsl:text> </xsl:text>
+              <xsl:value-of select="substring(@mtime,1,4)"/>
+            </xsl:variable>
+
+            <tr>
+              <td><a href="{$name}"><xsl:value-of select="."/></a></td>
+              <td align="right" style="padding-right: 2em;"><xsl:value-of select="$size"/></td>
+              <td><xsl:value-of select="$date"/></td>
+            </tr>
+
+          </xsl:for-each>
+        </table>
+      </body>
+    </html>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
new file mode 100644
index 0000000..d0601ec
--- /dev/null
+++ b/nginx/nginx.conf
@@ -0,0 +1,131 @@
+load_module /etc/nginx/modules/ngx_http_dav_ext_module.so;
+load_module /etc/nginx/modules/ngx_http_xslt_filter_module.so;
+load_module /etc/nginx/modules/ngx_http_proxy_connect_module.so;
+
+user pham;
+worker_processes  1;
+
+#error_log  logs/error.log;
+#error_log  logs/error.log  notice;
+#error_log  logs/error.log  info;
+
+#pid        logs/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    types_hash_max_size 4096;
+    server_names_hash_bucket_size 128;
+
+    include       mime.types;
+    default_type  application/octet-stream;
+    disable_symlinks off;
+
+    # Read manual for valid variables:
+    #   https://nginx.org/en/docs/http/ngx_http_core_module.html#variables
+
+    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    #                  '$status $body_bytes_sent "$http_referer" '
+    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+    log_format  main  '$status $request_method\t$http_host$uri\tfrom $http_referer\n'
+                      '$time_iso8601 $remote_addr\r\t\t\t\t\t   $http_user_agent';
+    access_log /var/log/nginx/access.log main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    #server {
+    #    listen       80;
+    #    server_name  localhost;
+
+    #    #charset koi8-r;
+
+    #    #access_log  logs/host.access.log  main;
+
+    #    location / {
+    #        root   /usr/share/nginx/html;
+    #        index  index.html index.htm;
+    #    }
+
+    #    #error_page  404              /404.html;
+
+    #    # redirect server error pages to the static page /50x.html
+    #    #
+    #    error_page   500 502 503 504  /50x.html;
+    #    location = /50x.html {
+    #        root   /usr/share/nginx/html;
+    #    }
+
+        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
+        #
+        #location ~ \.php$ {
+        #    proxy_pass   http://127.0.0.1;
+        #}
+
+        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+        #
+        #location ~ \.php$ {
+        #    root           html;
+        #    fastcgi_pass   127.0.0.1:9000;
+        #    fastcgi_index  index.php;
+        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+        #    include        fastcgi_params;
+        #}
+
+        # deny access to .htaccess files, if Apache's document root
+        # concurs with nginx's one
+        #
+        #location ~ /\.ht {
+        #    deny  all;
+        #}
+    #}
+
+
+    # another virtual host using mix of IP-, name-, and port-based configuration
+    #
+    #server {
+    #    listen       8000;
+    #    listen       somename:8080;
+    #    server_name  somename  alias  another.alias;
+
+    #    location / {
+    #        root   html;
+    #        index  index.html index.htm;
+    #    }
+    #}
+
+
+    # HTTPS server
+    #
+    #server {
+    #    listen       443 ssl;
+    #    server_name  localhost;
+
+    #    ssl_certificate      cert.pem;
+    #    ssl_certificate_key  cert.key;
+
+    #    ssl_session_cache    shared:SSL:1m;
+    #    ssl_session_timeout  5m;
+
+    #    ssl_ciphers  HIGH:!aNULL:!MD5;
+    #    ssl_prefer_server_ciphers  on;
+
+    #    location / {
+    #        root   html;
+    #        index  index.html index.htm;
+    #    }
+    #}
+
+    # load configs
+    #include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/vps;
+}
diff --git a/nginx/passwd/2022.10.11 b/nginx/passwd/2022.10.11
new file mode 100644
index 0000000..7037748
--- /dev/null
+++ b/nginx/passwd/2022.10.11
@@ -0,0 +1 @@
+lay911225:$apr1$yc365c.t$HrUOy9eWekr6xNkWsTZBR.
diff --git a/nginx/passwd/houshou b/nginx/passwd/houshou
new file mode 100644
index 0000000..7ec2d1d
--- /dev/null
+++ b/nginx/passwd/houshou
@@ -0,0 +1 @@
+houshou:$apr1$tSspURxF$zciiExFt0nj0n.pbJiXUh0
diff --git a/nginx/passwd/japan b/nginx/passwd/japan
new file mode 100644
index 0000000..da8a465
--- /dev/null
+++ b/nginx/passwd/japan
@@ -0,0 +1 @@
+klara:$apr1$ZCAf5ib0$ZjDi7s1djpikGXhRQaQX01
diff --git a/nginx/passwd/ntumountainclub b/nginx/passwd/ntumountainclub
new file mode 100644
index 0000000..d485239
--- /dev/null
+++ b/nginx/passwd/ntumountainclub
@@ -0,0 +1 @@
+radio:$apr1$rexQL6MJ$MRLWfUmi4FyeJ65oKYz/Q/
diff --git a/nginx/passwd/rescue b/nginx/passwd/rescue
new file mode 100644
index 0000000..d46bf6f
--- /dev/null
+++ b/nginx/passwd/rescue
@@ -0,0 +1 @@
+mountainclub:$apr1$H5RdWRmY$Clj3PkR.x4vLomKNK/ZN3.
diff --git a/nginx/sites-available/vps b/nginx/sites-available/vps
new file mode 100644
index 0000000..bad4621
--- /dev/null
+++ b/nginx/sites-available/vps
@@ -0,0 +1,354 @@
+#map $token $api_client_name {
+#    default "";
+#
+#    # CAUTION!! Change token and client name wisely
+#    "XXXX" "client";
+#}
+
+# Gets the basename of the original request
+map $request_uri $request_basename {
+  ~/(?<captured_request_basename>[^/?]*)(?:\?|$) $captured_request_basename;
+}
+
+# Gets the basename of the current uri
+map $uri $basename {
+  ~/(?<captured_basename>[^/]*)$ $captured_basename;
+}
+
+server {
+  server_name topo.tw www.topo.tw;
+
+  listen 80;
+  listen 443 ssl;
+  ssl_certificate /etc/nginx/ssl/fullchain.cert;
+  ssl_certificate_key /etc/nginx/ssl/cert.pem;
+
+  root /srv/http;
+  index index.html;
+  autoindex on;
+  autoindex_exact_size off;
+
+  # charset
+  charset utf-8;
+  charset_types *;
+  override_charset on;
+  default_type "text/plain; charset=utf-8";
+
+  # header
+  proxy_set_header Host $host;
+  add_header Cache-Control "no-cache" always;
+  #add_header Cache-Control "max-age=604800";
+  error_page 404 /404.html;
+  error_log /var/log/nginx/error.log debug;
+  #rewrite_log on;
+
+  location ~ \.html$ {
+    try_files $uri =404;
+  }
+
+  location ~ \.js$ {
+    add_header Access-Control-Allow-Origin *;
+  }
+
+  location ~ [^/]$ {
+    try_files $uri @rewrite_no_slash;
+  }
+
+  location @rewrite_no_slash {
+    add_header rewrite no_slash;
+    rewrite ^(.+)$ $1.html permanent;
+  }
+
+  location ~ /$ {
+    try_files $uri @rewrite_slash;
+  }
+
+  location @rewrite_slash {
+    rewrite ^(.+)/$ $1.html permanent;
+  }
+
+  rewrite ^/posts$ /posts/ permanent;
+  location = /posts/ {
+    autoindex_format xml;
+    xslt_string_param title "/posts/";
+    xslt_stylesheet layout/simple.xslt;
+    add_header Cache-Control "no-cache" always;
+  }
+
+  # This configuration allow you to upload/modify/delete file, for example:
+  #   curl -X PUT -F file=@foo https://topo.tw/doc/bar
+  location ^~ /doc {
+    alias /home/pham/doc/;
+
+    client_body_temp_path /tmp/client_temp;
+    dav_methods PUT DELETE MKCOL COPY MOVE;
+    create_full_put_path  on;
+    dav_access            group:rw  all:r;
+    client_max_body_size 10000m;
+  }
+
+  location ^~ /photos/ {
+    alias /home/pham/data/s3.photos/;
+    autoindex_format xml;
+    xslt_string_param title "photos";
+    xslt_stylesheet layout/gal.xslt;
+    try_files $uri $uri/ =404;
+    expires max;
+
+    if ($uri ~ ^/photos/([^!]+)!(large|lg|md)$ ) {
+      set $filename /home/pham/data/s3.photos/$1;
+      set $img_version $2;
+      rewrite ^ /thumbnail;
+    }
+  }
+
+  rewrite ^/p(ublic)?$ /public/ permanent;
+  rewrite ^/p/(.*)$ /public/$1;
+  location ^~ /public/ {
+    alias /home/pham/public/;
+    autoindex_format xml;
+    xslt_string_param title "/posts/";
+    xslt_stylesheet layout/simple.xslt;
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Cache-Control "no-cache" always;
+  }
+
+  # thumbnail CGI, requires variables 'filename' and 'img_version'
+  location = /thumbnail {
+    # Prepare the required parameters (width, height, cropping or zooming) according to the URL address!
+    set $img_type resize;
+    set $img_w    -;
+    set $img_h    -;
+    if ($img_version = 'large') {
+      set $img_type resize;
+      set $img_w    1920;
+    }
+    if ($img_version = 'lg') {
+      set $img_type crop;
+      set $img_w    256;
+      set $img_h    256;
+    }
+    if ($img_version = 'md') {
+      set $img_type crop;
+      set $img_w    128;
+      set $img_h    128;
+    }
+    rewrite ^ /_$img_type;
+  }
+
+  # Processing of Scaled Pictures
+  location = /_resize {
+    alias $filename;
+    image_filter resize $img_w $img_h;
+    image_filter_jpeg_quality 95;
+    image_filter_buffer         20M;
+    image_filter_interlace      on;
+  }
+
+  # Processing of clipped pictures
+  location = /_crop {
+    alias $filename;
+    image_filter crop $img_w $img_h;
+    image_filter_jpeg_quality 95;
+    image_filter_buffer         20M;
+    image_filter_interlace      on;
+  }
+
+  location ^~ /wallpapers {
+    alias /home/pham/public/wallpapers/;
+
+    autoindex_format xml;
+    xslt_string_param title "Wallpaper Collection!";
+    xslt_stylesheet layout/gal.xslt;
+    try_files $uri $uri/ =404;
+
+    if ($uri ~ ([^/!]+)!(large|lg|md)$ ) {
+      set $filename /home/pham/public/wallpapers/$1;
+      set $img_version $2;
+      rewrite ^ /thumbnail;
+    }
+  }
+
+  location ^~ /tmp {
+    alias /home/pham/public/tmp/;
+    autoindex on;
+    add_header "Content-Type" "text/plain; charset=utf-8";
+  }
+
+  location ^~ /osm {
+    alias /home/pham/public/osm/;
+    autoindex on;
+  }
+
+  location ^~ /tainan/ {
+    alias /home/pham/public/tainan/;
+    autoindex on;
+    index =404;
+  }
+
+  location /public/layx {
+    alias /home/pham/public/layx/;
+
+    autoindex on;
+
+    auth_basic "You need to login";
+    auth_basic_user_file /etc/nginx/passwd/2022.10.11;
+  }
+
+  location ^~ /private/ {
+    alias /home/pham/private/;
+    autoindex on;
+    auth_basic "You need to login";
+    auth_basic_user_file /etc/nginx/passwd/japan;
+  }
+
+  location = /japan.html {
+    autoindex on;
+
+    auth_basic "You need to login";
+    auth_basic_user_file /etc/nginx/passwd/japan;
+  }
+
+  location ^~ /houshou {
+    alias /home/pham/houshou/;
+
+    autoindex on;
+    autoindex_format xml;
+    xslt_string_param title "Houshou Collection!";
+    xslt_stylesheet layout/gal.xslt;
+    try_files $uri $uri/ =404;
+
+    auth_basic "You need to login";
+    auth_basic_user_file /etc/nginx/passwd/houshou;
+
+    if ($uri ~ ([^/!]+)!(large|lg|md)$ ) {
+      set $filename /home/pham/houshou/$1;
+      set $img_version $2;
+      rewrite ^ /thumbnail;
+    }
+  }
+
+  location ^~ /houshou2 {
+    alias /home/pham/houshou2/;
+
+    autoindex on;
+    autoindex_format xml;
+    xslt_string_param title "Houshou Collection!";
+    #xslt_stylesheet layout/simple-gal.xslt;
+    xslt_stylesheet layout/gal.xslt;
+    try_files $uri $uri/ =404;
+
+    if ($uri ~ ([^/!]+)!(large|lg|md)$ ) {
+      set $filename /home/pham/houshou2/$1;
+      set $img_version $2;
+      rewrite ^ /thumbnail;
+    }
+  }
+
+  location /rescue {
+    root /home/pham;
+
+    auth_basic "You need to login";
+    auth_basic_user_file /etc/nginx/passwd/rescue;
+  }
+
+#  location /upload/ {
+#    proxy_pass http://127.0.0.1:8000/;
+#  }
+
+  #rewrite ^/up$ /up/;
+  #location /up/ {
+    #    proxy_set_header X-Forwarded-Proto https;
+    #    proxy_set_header Referer $host/up/;
+    #    proxy_pass http://127.0.0.1:8080/;
+
+    #    client_max_body_size 1g;
+    #}
+
+  #location = /_validate_token {
+    #    internal;
+
+    #    if ($token = "") {
+      #        return 401; # Unauthorized
+      #    }
+
+    #    if ($api_client_name = "") {
+      #        return 403; # Forbidden
+      #    }
+
+    #    return 204; # OK (no content)
+    #}
+
+}
+
+# git server
+server {
+  server_name git.topo.tw;
+
+  listen 80;
+  listen 443 ssl;
+  ssl_certificate /etc/nginx/ssl/git.topo.tw/fullchain.cer;
+  ssl_certificate_key /etc/nginx/ssl/git.topo.tw/git.topo.tw.key;
+
+  root /srv/git/www;
+
+  location ~ (/.*) {
+    #include       fastcgi_params;
+    #fastcgi_param SCRIPT_FILENAME     /usr/lib/git-core/git-http-backend;
+    ## export all repositories under GIT_PROJECT_ROOT
+    #fastcgi_param GIT_HTTP_EXPORT_ALL "";
+    #fastcgi_param GIT_PROJECT_ROOT    /srv/git;
+    #fastcgi_param PATH_INFO           $1;
+  }
+}
+
+# Block all direct accesses via IP address
+server {
+  server_name "~[\d\.]+";
+  listen 80;
+  listen 443 ssl;
+
+  error_page 404 /404.html;
+  return 404;
+}
+
+## Redirect 80 to 443
+#server {
+#  if ($host = topo.tw) {
+#    return 301 https://$host$request_uri;
+#  } # managed by Certbot
+#
+#
+#  #listen 80;
+#  server_name topo.tw;
+#  return 301 https://$host$request_uri;
+#
+#
+#}
+
+## Forward Proxy
+#server {
+#  resolver 8.8.8.8;
+#  listen 13288;
+#
+#  proxy_connect;
+#  proxy_connect_allow            443 563;
+#  proxy_connect_connect_timeout  10s;
+#  proxy_connect_read_timeout     10s;
+#  proxy_connect_send_timeout     10s;
+#  location / {
+#    proxy_pass http://$host;
+#    proxy_set_header Host $host;
+#  }
+#}
+
+#server {
+#  server_name demo.topo.tw;
+#  root /;
+#
+#  location / {
+#    index /home/pham/git/vps/demo/client.sh;
+#    add_header Content-Type text/plain;
+#  }
+#  #listen 80;
+#}
diff --git a/postfix/Makefile b/postfix/Makefile
new file mode 100644
index 0000000..f808d21
--- /dev/null
+++ b/postfix/Makefile
@@ -0,0 +1,9 @@
+.ONESHELL:
+SHELL := bash
+
+config:
+	shopt -s extglob
+	ln -sf `pwd`/!(opendkim) /etc/postfix
+	mkdir -p /etc/opendkim/
+	cp `pwd`/opendkim/* /etc/opendkim/
+	chown opendkim:opendkim /etc/opendkim/*
diff --git a/postfix/aliases b/postfix/aliases
new file mode 100644
index 0000000..04a104f
--- /dev/null
+++ b/postfix/aliases
@@ -0,0 +1,268 @@
+#
+# Sample aliases file. Install in the location as specified by the
+# output from the command "postconf alias_maps". Typical path names
+# are /etc/aliases or /etc/mail/aliases.
+#
+#	>>>>>>>>>>      The program "newaliases" must be run after
+#	>> NOTE >>      this file is updated for any changes to
+#	>>>>>>>>>>      show through to Postfix.
+#
+pham:		pham
+
+# Person who should get root's mail. Don't receive mail as root!
+root:		pham
+
+# Basic system aliases -- these MUST be present
+MAILER-DAEMON:	postmaster
+postmaster:	pham
+
+# General redirections for pseudo accounts
+bin:		pham
+daemon:		pham
+named:		pham
+nobody:		pham
+uucp:		pham
+www:		pham
+ftp-bugs:	pham
+postfix:	pham
+
+# Put your local aliases here.
+
+# Well-known aliases
+manager:	pham
+dumper:		pham
+operator:	pham
+abuse:		postmaster
+
+# trap decode to catch security attacks
+decode:		pham
+
+# custom
+devnull:    /dev/null
+
+# ALIASES(5)                                                          ALIASES(5)
+# 
+# NAME
+#        aliases - Postfix local alias database format
+# 
+# SYNOPSIS
+#        newaliases
+# 
+# DESCRIPTION
+#        The  aliases(5)  table provides a system-wide mechanism to
+#        redirect mail for local recipients. The  redirections  are
+#        processed by the Postfix local(8) delivery agent.
+# 
+#        Normally, the aliases(5) table is specified as a text file
+#        that serves as input  to  the  postalias(1)  command.  The
+#        result,  an  indexed file in dbm or db format, is used for
+#        fast lookup  by  the  mail  system.  Execute  the  command
+#        newaliases  in  order  to  rebuild  the indexed file after
+#        changing the Postfix alias database.
+# 
+#        When the table is provided via other means  such  as  NIS,
+#        LDAP  or  SQL,  the  same lookups are done as for ordinary
+#        indexed files.
+# 
+#        Alternatively, the  table  can  be  provided  as  a  regu-
+#        lar-expression  map  where  patterns  are given as regular
+#        expressions. In this case,  the  lookups  are  done  in  a
+#        slightly  different  way as described below under "REGULAR
+#        EXPRESSION TABLES".
+# 
+#        Users can control delivery of their own mail by setting up
+#        .forward files in their home directory.  Lines in per-user
+#        .forward files have the same syntax as the right-hand side
+#        of aliases(5) entries.
+# 
+#        The format of the alias database input file is as follows:
+# 
+#        o      An alias definition has the form
+# 
+#                    name: value1, value2, ...
+# 
+#        o      Empty lines and whitespace-only lines are  ignored,
+#               as  are  lines whose first non-whitespace character
+#               is a `#'.
+# 
+#        o      A logical line starts with non-whitespace  text.  A
+#               line  that starts with whitespace continues a logi-
+#               cal line.
+# 
+#        The name is a local address (no domain part).  Use  double
+#        quotes  when the name contains any special characters such
+#        as whitespace, `#', `:', or `@'. The  name  is  folded  to
+#        lowercase, in order to make database lookups case insensi-
+#        tive.
+# 
+#        In addition, when an alias  exists  for  owner-name,  this
+#        will  override the envelope sender address, so that deliv-
+#        ery diagnostics are directed to owner-name, instead of the
+#        originator    of    the    message   (for   details,   see
+#        owner_request_special,       expand_owner_alias        and
+#        reset_owner_alias).   This  is  typically  used  to direct
+#        delivery errors to the maintainer of a mailing  list,  who
+#        is in a better position to deal with mailing list delivery
+#        problems than the originator of the undelivered mail.
+# 
+#        The value contains one or more of the following:
+# 
+#        address
+#               Mail is forwarded to address, which  is  compatible
+#               with the RFC 822 standard.
+# 
+#        /file/name
+#               Mail  is  appended  to /file/name. See local(8) for
+#               details of delivery to file.  Delivery is not  lim-
+#               ited  to regular files.  For example, to dispose of
+#               unwanted mail, deflect it to /dev/null.
+# 
+#        |command
+#               Mail is piped into command. Commands  that  contain
+#               special  characters,  such as whitespace, should be
+#               enclosed between double quotes.  See  local(8)  for
+#               details of delivery to command.
+# 
+#               When the command fails, a limited amount of command
+#               output is mailed back  to  the  sender.   The  file
+#               /usr/include/sysexits.h  defines  the expected exit
+#               status codes. For example, use "|exit 67" to  simu-
+#               late  a  "user  unknown"  error,  and  "|exit 0" to
+#               implement an expensive black hole.
+# 
+#        :include:/file/name
+#               Mail is sent to  the  destinations  listed  in  the
+#               named file.  Lines in :include: files have the same
+#               syntax as the right-hand side of alias entries.
+# 
+#               A  destination  can  be  any  destination  that  is
+#               described in this manual page. However, delivery to
+#               "|command" and /file/name is disallowed by default.
+#               To  enable,  edit  the  allow_mail_to_commands  and
+#               allow_mail_to_files configuration parameters.
+# 
+# ADDRESS EXTENSION
+#        When alias database search fails, and the recipient local-
+#        part  contains  the  optional  recipient  delimiter (e.g.,
+#        user+foo), the  search  is  repeated  for  the  unextended
+#        address (e.g., user).
+# 
+#        The   propagate_unmatched_extensions   parameter  controls
+#        whether an unmatched address extension  (+foo)  is  propa-
+#        gated to the result of table lookup.
+# 
+# CASE FOLDING
+#        The local(8) delivery agent always folds the search string
+#        to lowercase before database lookup.
+# 
+# REGULAR EXPRESSION TABLES
+#        This section describes how the table lookups  change  when
+#        the table is given in the form of regular expressions. For
+#        a description of regular expression lookup  table  syntax,
+#        see  regexp_table(5) or pcre_table(5). NOTE: these formats
+#        do not use ":" at the end of a pattern.
+# 
+#        Each regular expression is applied to  the  entire  search
+#        string.  Thus,  a  search string user+foo is not broken up
+#        into user and foo.
+# 
+#        Regular expressions are applied in the order as  specified
+#        in  the  table,  until  a regular expression is found that
+#        matches the search string.
+# 
+#        Lookup results are the same as with indexed file  lookups.
+#        For  security  reasons there is no support for $1, $2 etc.
+#        substring interpolation.
+# 
+# SECURITY
+#        The local(8) delivery agent disallows  regular  expression
+#        substitution  of $1 etc. in alias_maps, because that would
+#        open a security hole.
+# 
+#        The local(8) delivery agent will silently ignore  requests
+#        to  use  the proxymap(8) server within alias_maps. Instead
+#        it will open the table directly.  Before  Postfix  version
+#        2.2,  the  local(8)  delivery  agent will terminate with a
+#        fatal error.
+# 
+# CONFIGURATION PARAMETERS
+#        The following main.cf parameters are especially  relevant.
+#        The  text  below  provides  only  a parameter summary. See
+#        postconf(5) for more details including examples.
+# 
+#        alias_database (see 'postconf -d' output)
+#               The alias databases for local(8) delivery that  are
+#               updated with "newaliases" or with "sendmail -bi".
+# 
+#        alias_maps (see 'postconf -d' output)
+#               The  alias  databases  that  are  used for local(8)
+#               delivery.
+# 
+#        allow_mail_to_commands (alias, forward)
+#               Restrict local(8) mail delivery  to  external  com-
+#               mands.
+# 
+#        allow_mail_to_files (alias, forward)
+#               Restrict  local(8) mail delivery to external files.
+# 
+#        expand_owner_alias (no)
+#               When delivering to an alias "aliasname" that has an
+#               "owner-aliasname" companion alias, set the envelope
+#               sender   address   to   the   expansion   of    the
+#               "owner-aliasname" alias.
+# 
+#        propagate_unmatched_extensions (canonical, virtual)
+#               What  address  lookup tables copy an address exten-
+#               sion from the lookup key to the lookup result.
+# 
+#        owner_request_special (yes)
+#               Enable special treatment for owner-listname entries
+#               in the aliases(5) file, and don't split owner-list-
+#               name and listname-request address  localparts  when
+#               the recipient_delimiter is set to "-".
+# 
+#        recipient_delimiter (empty)
+#               The set of characters that can separate a user name
+#               from its extension (example: user+foo), or a  .for-
+#               ward  file  name from its extension (example: .for-
+#               ward+foo).
+# 
+#        Available in Postfix version 2.3 and later:
+# 
+#        frozen_delivered_to (yes)
+#               Update the local(8) delivery agent's  idea  of  the
+#               Delivered-To:     address    (see    prepend_deliv-
+#               ered_header) only once, at the start of a  delivery
+#               attempt;  do  not  update the Delivered-To: address
+#               while expanding aliases or .forward files.
+# 
+# STANDARDS
+#        RFC 822 (ARPA Internet Text Messages)
+# 
+# SEE ALSO
+#        local(8), local delivery agent
+#        newaliases(1), create/update alias database
+#        postalias(1), create/update alias database
+#        postconf(5), configuration parameters
+# 
+# README FILES
+#        Use "postconf readme_directory" or  "postconf  html_direc-
+#        tory" to locate this information.
+#        DATABASE_README, Postfix lookup table overview
+# 
+# LICENSE
+#        The  Secure  Mailer  license must be distributed with this
+#        software.
+# 
+# AUTHOR(S)
+#        Wietse Venema
+#        IBM T.J. Watson Research
+#        P.O. Box 704
+#        Yorktown Heights, NY 10598, USA
+# 
+#        Wietse Venema
+#        Google, Inc.
+#        111 8th Avenue
+#        New York, NY 10011, USA
+# 
+#                                                                     ALIASES(5)
diff --git a/postfix/main.cf b/postfix/main.cf
new file mode 100644
index 0000000..5ef0f1d
--- /dev/null
+++ b/postfix/main.cf
@@ -0,0 +1,701 @@
+# Global Postfix configuration file. This file lists only a subset
+# of all parameters. For the syntax, and for a complete parameter
+# list, see the postconf(5) manual page (command: "man 5 postconf").
+#
+# For common configuration examples, see BASIC_CONFIGURATION_README
+# and STANDARD_CONFIGURATION_README. To find these documents, use
+# the command "postconf html_directory readme_directory", or go to
+# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc.
+#
+# For best results, change no more than 2-3 parameters at a time,
+# and test if Postfix still works after every change.
+
+# COMPATIBILITY
+#
+# The compatibility_level determines what default settings Postfix
+# will use for main.cf and master.cf settings. These defaults will
+# change over time.
+#
+# To avoid breaking things, Postfix will use backwards-compatible
+# default settings and log where it uses those old backwards-compatible
+# default settings, until the system administrator has determined
+# if any backwards-compatible default settings need to be made
+# permanent in main.cf or master.cf.
+#
+# When this review is complete, update the compatibility_level setting
+# below as recommended in the RELEASE_NOTES file.
+#
+# The level below is what should be used with new (not upgrade) installs.
+#
+compatibility_level = 2
+
+# SOFT BOUNCE
+#
+# The soft_bounce parameter provides a limited safety net for
+# testing.  When soft_bounce is enabled, mail will remain queued that
+# would otherwise bounce. This parameter disables locally-generated
+# bounces, and prevents the SMTP server from rejecting mail permanently
+# (by changing 5xx replies into 4xx replies). However, soft_bounce
+# is no cure for address rewriting mistakes or mail routing mistakes.
+#
+soft_bounce = yes
+
+# LOCAL PATHNAME INFORMATION
+#
+# The queue_directory specifies the location of the Postfix queue.
+# This is also the root directory of Postfix daemons that run chrooted.
+# See the files in examples/chroot-setup for setting up Postfix chroot
+# environments on different UNIX systems.
+#
+queue_directory = /var/spool/postfix
+
+# The command_directory parameter specifies the location of all
+# postXXX commands.
+#
+command_directory = /usr/bin
+
+# The daemon_directory parameter specifies the location of all Postfix
+# daemon programs (i.e. programs listed in the master.cf file). This
+# directory must be owned by root.
+#
+daemon_directory = /usr/lib/postfix/bin
+
+# The data_directory parameter specifies the location of Postfix-writable
+# data files (caches, random numbers). This directory must be owned
+# by the mail_owner account (see below).
+#
+data_directory = /var/lib/postfix
+
+# QUEUE AND PROCESS OWNERSHIP
+#
+# The mail_owner parameter specifies the owner of the Postfix queue
+# and of most Postfix daemon processes.  Specify the name of a user
+# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
+# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM.  In
+# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
+# USER.
+#
+mail_owner = postfix
+
+# The default_privs parameter specifies the default rights used by
+# the local delivery agent for delivery to external file or command.
+# These rights are used in the absence of a recipient user context.
+# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
+#
+#default_privs = nobody
+
+# INTERNET HOST AND DOMAIN NAMES
+# 
+# The myhostname parameter specifies the internet hostname of this
+# mail system. The default is to use the fully-qualified domain name
+# from gethostname(). $myhostname is used as a default value for many
+# other configuration parameters.
+#
+myhostname = topo.tw
+#myhostname = virtual.domain.tld
+
+# The mydomain parameter specifies the local internet domain name.
+# The default is to use $myhostname minus the first component.
+# $mydomain is used as a default value for many other configuration
+# parameters.
+#
+#mydomain = domain.tld
+
+# SENDING MAIL
+# 
+# The myorigin parameter specifies the domain that locally-posted
+# mail appears to come from. The default is to append $myhostname,
+# which is fine for small sites.  If you run a domain with multiple
+# machines, you should (1) change this to $mydomain and (2) set up
+# a domain-wide alias database that aliases each user to
+# user@that.users.mailhost.
+#
+# For the sake of consistency between sender and recipient addresses,
+# myorigin also specifies the default domain name that is appended
+# to recipient addresses that have no @domain part.
+#
+#myorigin = $myhostname
+#myorigin = $mydomain
+
+# RECEIVING MAIL
+
+# The inet_interfaces parameter specifies the network interface
+# addresses that this mail system receives mail on.  By default,
+# the software claims all active interfaces on the machine. The
+# parameter also controls delivery of mail to user@[ip.address].
+#
+# See also the proxy_interfaces parameter, for network addresses that
+# are forwarded to us via a proxy or network address translator.
+#
+# Note: you need to stop/start Postfix when this parameter changes.
+#
+inet_interfaces = all
+#inet_interfaces = $myhostname
+#inet_interfaces = $myhostname, localhost
+
+# The proxy_interfaces parameter specifies the network interface
+# addresses that this mail system receives mail on by way of a
+# proxy or network address translation unit. This setting extends
+# the address list specified with the inet_interfaces parameter.
+#
+# You must specify your proxy/NAT addresses when your system is a
+# backup MX host for other domains, otherwise mail delivery loops
+# will happen when the primary MX host is down.
+#
+#proxy_interfaces =
+#proxy_interfaces = 1.2.3.4
+
+# The mydestination parameter specifies the list of domains that this
+# machine considers itself the final destination for.
+#
+# These domains are routed to the delivery agent specified with the
+# local_transport parameter setting. By default, that is the UNIX
+# compatible delivery agent that lookups all recipients in /etc/passwd
+# and /etc/aliases or their equivalent.
+#
+# The default is $myhostname + localhost.$mydomain + localhost.  On
+# a mail domain gateway, you should also include $mydomain.
+#
+# Do not specify the names of virtual domains - those domains are
+# specified elsewhere (see VIRTUAL_README).
+#
+# Do not specify the names of domains that this machine is backup MX
+# host for. Specify those names via the relay_domains settings for
+# the SMTP server, or use permit_mx_backup if you are lazy (see
+# STANDARD_CONFIGURATION_README).
+#
+# The local machine is always the final destination for mail addressed
+# to user@[the.net.work.address] of an interface that the mail system
+# receives mail on (see the inet_interfaces parameter).
+#
+# Specify a list of host or domain names, /file/name or type:table
+# patterns, separated by commas and/or whitespace. A /file/name
+# pattern is replaced by its contents; a type:table is matched when
+# a name matches a lookup key (the right-hand side is ignored).
+# Continue long lines by starting the next line with whitespace.
+#
+# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
+#
+mydestination = $myhostname, localhost.$mydomain, localhost
+#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
+#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
+#	mail.$mydomain, www.$mydomain, ftp.$mydomain
+
+# REJECTING MAIL FOR UNKNOWN LOCAL USERS
+#
+# The local_recipient_maps parameter specifies optional lookup tables
+# with all names or addresses of users that are local with respect
+# to $mydestination, $inet_interfaces or $proxy_interfaces.
+#
+# If this parameter is defined, then the SMTP server will reject
+# mail for unknown local users. This parameter is defined by default.
+#
+# To turn off local recipient checking in the SMTP server, specify
+# local_recipient_maps = (i.e. empty).
+#
+# The default setting assumes that you use the default Postfix local
+# delivery agent for local delivery. You need to update the
+# local_recipient_maps setting if:
+#
+# - You define $mydestination domain recipients in files other than
+#   /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
+#   For example, you define $mydestination domain recipients in    
+#   the $virtual_mailbox_maps files.
+#
+# - You redefine the local delivery agent in master.cf.
+#
+# - You redefine the "local_transport" setting in main.cf.
+#
+# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
+#   feature of the Postfix local delivery agent (see local(8)).
+#
+# Details are described in the LOCAL_RECIPIENT_README file.
+#
+# Beware: if the Postfix SMTP server runs chrooted, you probably have
+# to access the passwd file via the proxymap service, in order to
+# overcome chroot restrictions. The alternative, having a copy of
+# the system passwd file in the chroot jail is just not practical.
+#
+# The right-hand side of the lookup tables is conveniently ignored.
+# In the left-hand side, specify a bare username, an @domain.tld
+# wild-card, or specify a user@domain.tld address.
+# 
+#local_recipient_maps = unix:passwd.byname $alias_maps
+#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
+#local_recipient_maps =
+virtual_alias_maps = hash:/etc/postfix/virtual
+
+# The unknown_local_recipient_reject_code specifies the SMTP server
+# response code when a recipient domain matches $mydestination or
+# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
+# and the recipient address or address local-part is not found.
+#
+# The default setting is 550 (reject mail) but it is safer to start
+# with 450 (try again later) until you are certain that your
+# local_recipient_maps settings are OK.
+#
+unknown_local_recipient_reject_code = 550
+
+# TRUST AND RELAY CONTROL
+
+# The mynetworks parameter specifies the list of "trusted" SMTP
+# clients that have more privileges than "strangers".
+#
+# In particular, "trusted" SMTP clients are allowed to relay mail
+# through Postfix.  See the smtpd_recipient_restrictions parameter
+# in postconf(5).
+#
+# You can specify the list of "trusted" network addresses by hand
+# or you can let Postfix do it for you (which is the default).
+#
+# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
+# clients in the same IP subnetworks as the local machine.
+# On Linux, this works correctly only with interfaces specified
+# with the "ifconfig" command.
+# 
+# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
+# clients in the same IP class A/B/C networks as the local machine.
+# Don't do this with a dialup site - it would cause Postfix to "trust"
+# your entire provider's network.  Instead, specify an explicit
+# mynetworks list by hand, as described below.
+#  
+# Specify "mynetworks_style = host" when Postfix should "trust"
+# only the local machine.
+# 
+#mynetworks_style = class
+#mynetworks_style = subnet
+mynetworks_style = host
+
+# Alternatively, you can specify the mynetworks list by hand, in
+# which case Postfix ignores the mynetworks_style setting.
+#
+# Specify an explicit list of network/netmask patterns, where the
+# mask specifies the number of bits in the network part of a host
+# address.
+#
+# You can also specify the absolute pathname of a pattern file instead
+# of listing the patterns here. Specify type:table for table-based lookups
+# (the value on the table right-hand side is not used).
+#
+#mynetworks = 168.100.189.0/28, 127.0.0.0/8
+#mynetworks = $config_directory/mynetworks
+#mynetworks = hash:/etc/postfix/network_table
+
+# The relay_domains parameter restricts what destinations this system will
+# relay mail to.  See the smtpd_recipient_restrictions description in
+# postconf(5) for detailed information.
+#
+# By default, Postfix relays mail
+# - from "trusted" clients (IP address matches $mynetworks) to any destination,
+# - from "untrusted" clients to destinations that match $relay_domains or
+#   subdomains thereof, except addresses with sender-specified routing.
+# The default relay_domains value is $mydestination.
+# 
+# In addition to the above, the Postfix SMTP server by default accepts mail
+# that Postfix is final destination for:
+# - destinations that match $inet_interfaces or $proxy_interfaces,
+# - destinations that match $mydestination
+# - destinations that match $virtual_alias_domains,
+# - destinations that match $virtual_mailbox_domains.
+# These destinations do not need to be listed in $relay_domains.
+# 
+# Specify a list of hosts or domains, /file/name patterns or type:name
+# lookup tables, separated by commas and/or whitespace.  Continue
+# long lines by starting the next line with whitespace. A file name
+# is replaced by its contents; a type:name table is matched when a
+# (parent) domain appears as lookup key.
+#
+# NOTE: Postfix will not automatically forward mail for domains that
+# list this system as their primary or backup MX host. See the
+# permit_mx_backup restriction description in postconf(5).
+#
+#relay_domains = $mydestination
+
+# INTERNET OR INTRANET
+
+# The relayhost parameter specifies the default host to send mail to
+# when no entry is matched in the optional transport(5) table. When
+# no relayhost is given, mail is routed directly to the destination.
+#
+# On an intranet, specify the organizational domain name. If your
+# internal DNS uses no MX records, specify the name of the intranet
+# gateway host instead.
+#
+# In the case of SMTP, specify a domain, host, host:port, [host]:port,
+# [address] or [address]:port; the form [host] turns off MX lookups.
+#
+# If you're connected via UUCP, see also the default_transport parameter.
+#
+#relayhost = $mydomain
+#relayhost = [gateway.my.domain]
+#relayhost = [mailserver.isp.tld]
+#relayhost = uucphost
+#relayhost = [an.ip.add.ress]
+
+# REJECTING UNKNOWN RELAY USERS
+#
+# The relay_recipient_maps parameter specifies optional lookup tables
+# with all addresses in the domains that match $relay_domains.
+#
+# If this parameter is defined, then the SMTP server will reject
+# mail for unknown relay users. This feature is off by default.
+#
+# The right-hand side of the lookup tables is conveniently ignored.
+# In the left-hand side, specify an @domain.tld wild-card, or specify
+# a user@domain.tld address.
+# 
+#relay_recipient_maps = hash:/etc/postfix/relay_recipients
+
+# INPUT RATE CONTROL
+#
+# The in_flow_delay configuration parameter implements mail input
+# flow control. This feature is turned on by default, although it
+# still needs further development (it's disabled on SCO UNIX due
+# to an SCO bug).
+# 
+# A Postfix process will pause for $in_flow_delay seconds before
+# accepting a new message, when the message arrival rate exceeds the
+# message delivery rate. With the default 100 SMTP server process
+# limit, this limits the mail inflow to 100 messages a second more
+# than the number of messages delivered per second.
+# 
+# Specify 0 to disable the feature. Valid delays are 0..10.
+# 
+#in_flow_delay = 1s
+
+# ADDRESS REWRITING
+#
+# The ADDRESS_REWRITING_README document gives information about
+# address masquerading or other forms of address rewriting including
+# username->Firstname.Lastname mapping.
+
+# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
+#
+# The VIRTUAL_README document gives information about the many forms
+# of domain hosting that Postfix supports.
+
+# "USER HAS MOVED" BOUNCE MESSAGES
+#
+# See the discussion in the ADDRESS_REWRITING_README document.
+
+# TRANSPORT MAP
+#
+# See the discussion in the ADDRESS_REWRITING_README document.
+
+# ALIAS DATABASE
+#
+# The alias_maps parameter specifies the list of alias databases used
+# by the local delivery agent. The default list is system dependent.
+#
+# On systems with NIS, the default is to search the local alias
+# database, then the NIS alias database. See aliases(5) for syntax
+# details.
+# 
+# If you change the alias database, run "postalias /etc/aliases" (or
+# wherever your system stores the mail alias file), or simply run
+# "newaliases" to build the necessary DBM or DB file.
+#
+# It will take a minute or so before changes become visible.  Use
+# "postfix reload" to eliminate the delay.
+#
+#alias_maps = dbm:/etc/aliases
+#alias_maps = hash:/etc/aliases
+#alias_maps = hash:/etc/aliases, nis:mail.aliases
+#alias_maps = netinfo:/aliases
+alias_maps = hash:/etc/postfix/aliases
+
+# The alias_database parameter specifies the alias database(s) that
+# are built with "newaliases" or "sendmail -bi".  This is a separate
+# configuration parameter, because alias_maps (see above) may specify
+# tables that are not necessarily all under control by Postfix.
+#
+#alias_database = dbm:/etc/aliases
+#alias_database = dbm:/etc/mail/aliases
+#alias_database = hash:/etc/aliases
+#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
+alias_database = $alias_maps
+
+# ADDRESS EXTENSIONS (e.g., user+foo)
+#
+# The recipient_delimiter parameter specifies the separator between
+# user names and address extensions (user+foo). See canonical(5),
+# local(8), relocated(5) and virtual(5) for the effects this has on
+# aliases, canonical, virtual, relocated and .forward file lookups.
+# Basically, the software tries user+foo and .forward+foo before
+# trying user and .forward.
+#
+#recipient_delimiter = +
+
+# DELIVERY TO MAILBOX
+#
+# The home_mailbox parameter specifies the optional pathname of a
+# mailbox file relative to a user's home directory. The default
+# mailbox file is /var/spool/mail/user or /var/mail/user.  Specify
+# "Maildir/" for qmail-style delivery (the / is required).
+#
+#home_mailbox = Mailbox
+home_mailbox = Maildir/
+ 
+# The mail_spool_directory parameter specifies the directory where
+# UNIX-style mailboxes are kept. The default setting depends on the
+# system type.
+#
+#mail_spool_directory = /var/mail
+#mail_spool_directory = /var/spool/mail
+
+# The mailbox_command parameter specifies the optional external
+# command to use instead of mailbox delivery. The command is run as
+# the recipient with proper HOME, SHELL and LOGNAME environment settings.
+# Exception:  delivery for root is done as $default_user.
+#
+# Other environment variables of interest: USER (recipient username),
+# EXTENSION (address extension), DOMAIN (domain part of address),
+# and LOCAL (the address localpart).
+#
+# Unlike other Postfix configuration parameters, the mailbox_command
+# parameter is not subjected to $parameter substitutions. This is to
+# make it easier to specify shell syntax (see example below).
+#
+# Avoid shell meta characters because they will force Postfix to run
+# an expensive shell process. Procmail alone is expensive enough.
+#
+# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
+# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
+#
+mailbox_command = /usr/lib/dovecot/dovecot-lda
+#mailbox_command = /some/where/procmail -a "$EXTENSION"
+
+# The mailbox_transport specifies the optional transport in master.cf
+# to use after processing aliases and .forward files. This parameter
+# has precedence over the mailbox_command, fallback_transport and
+# luser_relay parameters.
+#
+# Specify a string of the form transport:nexthop, where transport is
+# the name of a mail delivery transport defined in master.cf.  The
+# :nexthop part is optional. For more details see the sample transport
+# configuration file.
+#
+# NOTE: if you use this feature for accounts not in the UNIX password
+# file, then you must update the "local_recipient_maps" setting in
+# the main.cf file, otherwise the SMTP server will reject mail for    
+# non-UNIX accounts with "User unknown in local recipient table".
+#
+# Cyrus IMAP over LMTP. Specify ``lmtpunix      cmd="lmtpd"
+# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
+#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
+#
+# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
+# subsequent line in master.cf.
+#mailbox_transport = cyrus
+
+# The fallback_transport specifies the optional transport in master.cf
+# to use for recipients that are not found in the UNIX passwd database.
+# This parameter has precedence over the luser_relay parameter.
+#
+# Specify a string of the form transport:nexthop, where transport is
+# the name of a mail delivery transport defined in master.cf.  The
+# :nexthop part is optional. For more details see the sample transport
+# configuration file.
+#
+# NOTE: if you use this feature for accounts not in the UNIX password
+# file, then you must update the "local_recipient_maps" setting in
+# the main.cf file, otherwise the SMTP server will reject mail for    
+# non-UNIX accounts with "User unknown in local recipient table".
+#
+#fallback_transport = lmtp:unix:/file/name
+#fallback_transport = cyrus
+#fallback_transport =
+
+# The luser_relay parameter specifies an optional destination address
+# for unknown recipients.  By default, mail for unknown@$mydestination,
+# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
+# as undeliverable.
+#
+# The following expansions are done on luser_relay: $user (recipient
+# username), $shell (recipient shell), $home (recipient home directory),
+# $recipient (full recipient address), $extension (recipient address
+# extension), $domain (recipient domain), $local (entire recipient
+# localpart), $recipient_delimiter. Specify ${name?value} or
+# ${name:value} to expand value only when $name does (does not) exist.
+#
+# luser_relay works only for the default Postfix local delivery agent.
+#
+# NOTE: if you use this feature for accounts not in the UNIX password
+# file, then you must specify "local_recipient_maps =" (i.e. empty) in
+# the main.cf file, otherwise the SMTP server will reject mail for    
+# non-UNIX accounts with "User unknown in local recipient table".
+#
+#luser_relay = $user@other.host
+#luser_relay = $local@other.host
+#luser_relay = admin+$local
+  
+# JUNK MAIL CONTROLS
+# 
+# The controls listed here are only a very small subset. The file
+# SMTPD_ACCESS_README provides an overview.
+
+# The header_checks parameter specifies an optional table with patterns
+# that each logical message header is matched against, including
+# headers that span multiple physical lines.
+#
+# By default, these patterns also apply to MIME headers and to the
+# headers of attached messages. With older Postfix versions, MIME and
+# attached message headers were treated as body text.
+#
+# For details, see "man header_checks".
+#
+#header_checks = regexp:/etc/postfix/header_checks
+
+# FAST ETRN SERVICE
+#
+# Postfix maintains per-destination logfiles with information about
+# deferred mail, so that mail can be flushed quickly with the SMTP
+# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
+# See the ETRN_README document for a detailed description.
+# 
+# The fast_flush_domains parameter controls what destinations are
+# eligible for this service. By default, they are all domains that
+# this server is willing to relay mail to.
+# 
+#fast_flush_domains = $relay_domains
+
+# SHOW SOFTWARE VERSION OR NOT
+#
+# The smtpd_banner parameter specifies the text that follows the 220
+# code in the SMTP server's greeting banner. Some people like to see
+# the mail version advertised. By default, Postfix shows no version.
+#
+# You MUST specify $myhostname at the start of the text. That is an
+# RFC requirement. Postfix itself does not care.
+#
+#smtpd_banner = $myhostname ESMTP $mail_name
+smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
+
+# PARALLEL DELIVERY TO THE SAME DESTINATION
+#
+# How many parallel deliveries to the same user or domain? With local
+# delivery, it does not make sense to do massively parallel delivery
+# to the same user, because mailbox updates must happen sequentially,
+# and expensive pipelines in .forward files can cause disasters when
+# too many are run at the same time. With SMTP deliveries, 10
+# simultaneous connections to the same domain could be sufficient to
+# raise eyebrows.
+# 
+# Each message delivery transport has its XXX_destination_concurrency_limit
+# parameter.  The default is $default_destination_concurrency_limit for
+# most delivery transports. For the local delivery agent the default is 2.
+
+#local_destination_concurrency_limit = 2
+#default_destination_concurrency_limit = 20
+
+# DEBUGGING CONTROL
+#
+# The debug_peer_level parameter specifies the increment in verbose
+# logging level when an SMTP client or server host name or address
+# matches a pattern in the debug_peer_list parameter.
+#
+debug_peer_level = 2
+
+# The debug_peer_list parameter specifies an optional list of domain
+# or network patterns, /file/name patterns or type:name tables. When
+# an SMTP client or server host name or address matches a pattern,
+# increase the verbose logging level by the amount specified in the
+# debug_peer_level parameter.
+#
+#debug_peer_list = 127.0.0.1
+#debug_peer_list = some.domain
+
+# The debugger_command specifies the external command that is executed
+# when a Postfix daemon program is run with the -D option.
+#
+# Use "command .. & sleep 5" so that the debugger can attach before
+# the process marches on. If you use an X-based debugger, be sure to
+# set up your XAUTHORITY environment variable before starting Postfix.
+#
+debugger_command =
+	 PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
+	 ddd $daemon_directory/$process_name $process_id & sleep 5
+
+# If you can't use X, use this to capture the call stack when a
+# daemon crashes. The result is in a file in the configuration
+# directory, and is named after the process name and the process ID.
+#
+# debugger_command =
+#	PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
+#	echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
+#	>$config_directory/$process_name.$process_id.log & sleep 5
+#
+# Another possibility is to run gdb under a detached screen session.
+# To attach to the screen session, su root and run "screen -r
+# <id_string>" where <id_string> uniquely matches one of the detached
+# sessions (from "screen -list").
+#
+# debugger_command =
+#	PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
+#	-dmS $process_name gdb $daemon_directory/$process_name
+#	$process_id & sleep 1
+
+# INSTALL-TIME CONFIGURATION INFORMATION
+#
+# The following parameters are used when installing a new Postfix version.
+# 
+# sendmail_path: The full pathname of the Postfix sendmail command.
+# This is the Sendmail-compatible mail posting interface.
+# 
+sendmail_path = /usr/bin/sendmail
+
+# newaliases_path: The full pathname of the Postfix newaliases command.
+# This is the Sendmail-compatible command to build alias databases.
+#
+newaliases_path = /usr/bin/newaliases
+
+# mailq_path: The full pathname of the Postfix mailq command.  This
+# is the Sendmail-compatible mail queue listing command.
+# 
+mailq_path = /usr/bin/mailq
+
+# setgid_group: The group for mail submission and queue management
+# commands.  This must be a group name with a numerical group ID that
+# is not shared with other accounts, not even with the Postfix account.
+#
+setgid_group = postdrop
+
+# html_directory: The location of the Postfix HTML documentation.
+#
+html_directory = no
+
+# manpage_directory: The location of the Postfix on-line manual pages.
+#
+manpage_directory = /usr/share/man
+
+# sample_directory: The location of the Postfix sample configuration files.
+# This parameter is obsolete as of Postfix 2.1.
+#
+sample_directory = /etc/postfix
+
+# readme_directory: The location of the Postfix README files.
+#
+readme_directory = /usr/share/doc/postfix
+inet_protocols = ipv4
+meta_directory = /etc/postfix
+shlib_directory = /usr/lib/postfix
+    
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+smtpd_sasl_auth_enable = yes
+smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination 
+
+smtp_tls_security_level = may
+smtpd_tls_security_level = may
+smtpd_use_tls = yes
+smtpd_tls_auth_only = yes
+smtpd_tls_cert_file = /etc/letsencrypt/live/mail.topo.tw/fullchain.pem
+smtpd_tls_key_file = /etc/letsencrypt/live/mail.topo.tw/privkey.pem
+smtpd_tls_loglevel = 1 
+maillog_file=/var/log/postfix.log
+message_size_limit = 40960000
+mailbox_size_limit = 10000000000
+
+smtpd_milters = inet:localhost:8891
+non_smtpd_milters = $smtpd_milters
+milter_default_action = accept
diff --git a/postfix/master.cf b/postfix/master.cf
new file mode 100644
index 0000000..883a466
--- /dev/null
+++ b/postfix/master.cf
@@ -0,0 +1,141 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (no)    (never) (100)
+# ==========================================================================
+smtp     inet  n       -       n       -       -       smtpd
+#smtp     inet  n       -       n       -       -       smtpd    -o  content_filter=myhook:dummy
+#smtp      inet  n       -       n       -       1       postscreen
+#smtpd     pass  -       -       n       -       -       smtpd
+#dnsblog   unix  -       -       n       -       0       dnsblog
+#tlsproxy  unix  -       -       n       -       0       tlsproxy
+# Choose one: enable submission for loopback clients only, or for any client.
+#127.0.0.1:submission inet n -   n       -       -       smtpd
+submission inet n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_tls_auth_only=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+# Choose one: enable smtps for loopback clients only, or for any client.
+#127.0.0.1:smtps inet n  -       n       -       -       smtpd
+#smtps     inet  n       -       n       -       -       smtpd
+#  -o syslog_name=postfix/smtps
+#  -o smtpd_tls_wrappermode=yes
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#628       inet  n       -       n       -       -       qmqpd
+pickup    unix  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+#qmgr     unix  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       n       -       -       smtp
+relay     unix  -       -       n       -       -       smtp
+        -o syslog_name=postfix/$service_name
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+retry     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache    unix  -       -       n       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+#maildrop  unix  -       n       n       -       -       pipe
+#  flags=DRXhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+#
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+#uucp      unix  -       n       n       -       -       pipe
+#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# ====================================================================
+#
+# Other external delivery methods.
+#
+#ifmail    unix  -       n       n       -       -       pipe
+#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+#
+#bsmtp     unix  -       n       n       -       -       pipe
+#  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
+#
+#scalemail-backend unix -       n       n       -       2       pipe
+#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
+#  ${nexthop} ${user} ${extension}
+#
+#mailman   unix  -       n       n       -       -       pipe
+#  flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+#  ${nexthop} ${user}
+#
+    
+myhook unix - n n - - pipe flags=F user=pham argv=/home/pham/scripts/postfix-test ${sender} ${size} ${recipient}
diff --git a/postfix/opendkim/opendkim.conf b/postfix/opendkim/opendkim.conf
new file mode 100644
index 0000000..5c8c65e
--- /dev/null
+++ b/postfix/opendkim/opendkim.conf
@@ -0,0 +1,6 @@
+Mode			s
+Domain                  topo.tw
+KeyFile                 /etc/opendkim/dkim.key
+Selector                dkim
+Socket                  inet:8891@localhost
+UserID                  opendkim
diff --git a/postfix/virtual b/postfix/virtual
new file mode 100644
index 0000000..ca8fb33
--- /dev/null
+++ b/postfix/virtual
@@ -0,0 +1,328 @@
+@topo.tw pham
+#no-reply@topo.tw devnull
+#dmarc@topo.tw devnull
+
+# VIRTUAL(5)                                                          VIRTUAL(5)
+# 
+# NAME
+#        virtual - Postfix virtual alias table format
+# 
+# SYNOPSIS
+#        postmap /etc/postfix/virtual
+# 
+#        postmap -q "string" /etc/postfix/virtual
+# 
+#        postmap -q - /etc/postfix/virtual <inputfile
+# 
+# DESCRIPTION
+#        The  optional  virtual(5)  alias  table rewrites recipient
+#        addresses for all local, all virtual, and all remote  mail
+#        destinations.   This  is unlike the aliases(5) table which
+#        is used only for local(8) delivery.  Virtual  aliasing  is
+#        recursive,  and  is  implemented by the Postfix cleanup(8)
+#        daemon before mail is queued.
+# 
+#        The main applications of virtual aliasing are:
+# 
+#        o      To redirect mail for one address  to  one  or  more
+#               addresses.
+# 
+#        o      To   implement  virtual  alias  domains  where  all
+#               addresses  are  aliased  to  addresses   in   other
+#               domains.
+# 
+#               Virtual  alias  domains are not to be confused with
+#               the virtual mailbox domains  that  are  implemented
+#               with  the  Postfix  virtual(8) mail delivery agent.
+#               With  virtual  mailbox  domains,   each   recipient
+#               address can have its own mailbox.
+# 
+#        Virtual  aliasing  is  applied  only to recipient envelope
+#        addresses, and  does  not  affect  message  headers.   Use
+#        canonical(5)   mapping  to  rewrite  header  and  envelope
+#        addresses in general.
+# 
+#        Normally, the virtual(5) alias table  is  specified  as  a
+#        text  file that serves as input to the postmap(1) command.
+#        The result, an indexed file in dbm or db format,  is  used
+#        for fast searching by the mail system. Execute the command
+#        "postmap /etc/postfix/virtual" to rebuild an indexed  file
+#        after changing the corresponding text file.
+# 
+#        When  the  table  is provided via other means such as NIS,
+#        LDAP or SQL, the same lookups are  done  as  for  ordinary
+#        indexed files.
+# 
+#        Alternatively,  the  table  can  be  provided  as  a regu-
+#        lar-expression map where patterns  are  given  as  regular
+#        expressions,  or  lookups  can  be  directed  to TCP-based
+#        server. In those case, the lookups are done in a  slightly
+#        different way as described below under "REGULAR EXPRESSION
+#        TABLES" or "TCP-BASED TABLES".
+# 
+# CASE FOLDING
+#        The search string is folded to lowercase  before  database
+#        lookup.  As  of Postfix 2.3, the search string is not case
+#        folded with database types such as regexp: or pcre:  whose
+#        lookup fields can match both upper and lower case.
+# 
+# TABLE FORMAT
+#        The input format for the postmap(1) command is as follows:
+# 
+#        pattern address, address, ...
+#               When pattern matches a mail address, replace it  by
+#               the corresponding address.
+# 
+#        blank lines and comments
+#               Empty  lines and whitespace-only lines are ignored,
+#               as are lines whose first  non-whitespace  character
+#               is a `#'.
+# 
+#        multi-line text
+#               A  logical  line starts with non-whitespace text. A
+#               line that starts with whitespace continues a  logi-
+#               cal line.
+# 
+# TABLE SEARCH ORDER
+#        With lookups from indexed files such as DB or DBM, or from
+#        networked  tables  such  as  NIS,  LDAP   or   SQL,   each
+#        user@domain query produces a sequence of query patterns as
+#        described below.
+# 
+#        Each query pattern is sent to each specified lookup  table
+#        before  trying  the  next  query pattern, until a match is
+#        found.
+# 
+#        user@domain address, address, ...
+#               Redirect mail for  user@domain  to  address.   This
+#               form has the highest precedence.
+# 
+#        user address, address, ...
+#               Redirect mail for user@site to address when site is
+#               equal to $myorigin, when site is listed in  $mydes-
+#               tination,  or when it is listed in $inet_interfaces
+#               or $proxy_interfaces.
+# 
+#               This functionality overlaps with  functionality  of
+#               the  local  aliases(5)  database. The difference is
+#               that virtual(5) mapping can be applied to non-local
+#               addresses.
+# 
+#        @domain address, address, ...
+#               Redirect mail for other users in domain to address.
+#               This form has the lowest precedence.
+# 
+#               Note: @domain is a wild-card. With this  form,  the
+#               Postfix  SMTP server accepts mail for any recipient
+#               in domain, regardless  of  whether  that  recipient
+#               exists.   This  may  turn  your  mail system into a
+#               backscatter source: Postfix first accepts mail  for
+#               non-existent  recipients  and  then tries to return
+#               that mail as "undeliverable" to  the  often  forged
+#               sender address.
+# 
+#               To  avoid  backscatter  with  mail  for a wild-card
+#               domain, replace the wild-card mapping with explicit
+#               1:1  mappings, or add a reject_unverified_recipient
+#               restriction for that domain:
+# 
+#                   smtpd_recipient_restrictions =
+#                       ...
+#                       reject_unauth_destination
+#                       check_recipient_access
+#                           inline:{example.com=reject_unverified_recipient}
+#                   unverified_recipient_reject_code = 550
+# 
+#               In the above example, Postfix may contact a  remote
+#               server  if  the  recipient  is  aliased to a remote
+#               address.
+# 
+# RESULT ADDRESS REWRITING
+#        The lookup result is subject to address rewriting:
+# 
+#        o      When the result  has  the  form  @otherdomain,  the
+#               result  becomes the same user in otherdomain.  This
+#               works only for the first address in a multi-address
+#               lookup result.
+# 
+#        o      When  "append_at_myorigin=yes", append "@$myorigin"
+#               to addresses without "@domain".
+# 
+#        o      When "append_dot_mydomain=yes", append ".$mydomain"
+#               to addresses without ".domain".
+# 
+# ADDRESS EXTENSION
+#        When a mail address localpart contains the optional recip-
+#        ient delimiter (e.g., user+foo@domain), the  lookup  order
+#        becomes: user+foo@domain, user@domain, user+foo, user, and
+#        @domain.
+# 
+#        The  propagate_unmatched_extensions   parameter   controls
+#        whether  an  unmatched  address extension (+foo) is propa-
+#        gated to the result of table lookup.
+# 
+# VIRTUAL ALIAS DOMAINS
+#        Besides virtual aliases, the virtual alias table can  also
+#        be used to implement virtual alias domains. With a virtual
+#        alias domain,  all  recipient  addresses  are  aliased  to
+#        addresses in other domains.
+# 
+#        Virtual alias domains are not to be confused with the vir-
+#        tual mailbox domains that are implemented with the Postfix
+#        virtual(8)  mail  delivery  agent.  With  virtual  mailbox
+#        domains, each recipient address can have its own  mailbox.
+# 
+#        With  a  virtual  alias domain, the virtual domain has its
+#        own user name space. Local  (i.e.  non-virtual)  usernames
+#        are  not visible in a virtual alias domain. In particular,
+#        local aliases(5) and local mailing lists are  not  visible
+#        as localname@virtual-alias.domain.
+# 
+#        Support for a virtual alias domain looks like:
+# 
+#        /etc/postfix/main.cf:
+#            virtual_alias_maps = hash:/etc/postfix/virtual
+# 
+#        Note: some systems use dbm databases instead of hash.  See
+#        the output  from  "postconf  -m"  for  available  database
+#        types.
+# 
+#        /etc/postfix/virtual:
+#            virtual-alias.domain    anything (right-hand content does not matter)
+#            postmaster@virtual-alias.domain postmaster
+#            user1@virtual-alias.domain      address1
+#            user2@virtual-alias.domain      address2, address3
+# 
+#        The  virtual-alias.domain anything entry is required for a
+#        virtual alias domain. Without this entry, mail is rejected
+#        with  "relay  access  denied", or bounces with "mail loops
+#        back to myself".
+# 
+#        Do not specify virtual alias domain names in  the  main.cf
+#        mydestination or relay_domains configuration parameters.
+# 
+#        With  a  virtual  alias  domain,  the  Postfix SMTP server
+#        accepts  mail  for  known-user@virtual-alias.domain,   and
+#        rejects   mail  for  unknown-user@virtual-alias.domain  as
+#        undeliverable.
+# 
+#        Instead of specifying the virtual alias  domain  name  via
+#        the  virtual_alias_maps table, you may also specify it via
+#        the main.cf virtual_alias_domains configuration parameter.
+#        This  latter parameter uses the same syntax as the main.cf
+#        mydestination configuration parameter.
+# 
+# REGULAR EXPRESSION TABLES
+#        This section describes how the table lookups  change  when
+#        the table is given in the form of regular expressions. For
+#        a description of regular expression lookup  table  syntax,
+#        see regexp_table(5) or pcre_table(5).
+# 
+#        Each  pattern  is  a regular expression that is applied to
+#        the entire address being looked up. Thus, user@domain mail
+#        addresses  are  not  broken up into their user and @domain
+#        constituent parts, nor is user+foo broken up into user and
+#        foo.
+# 
+#        Patterns  are applied in the order as specified in the ta-
+#        ble, until a pattern is  found  that  matches  the  search
+#        string.
+# 
+#        Results  are  the  same as with indexed file lookups, with
+#        the additional feature that parenthesized substrings  from
+#        the pattern can be interpolated as $1, $2 and so on.
+# 
+# TCP-BASED TABLES
+#        This  section  describes how the table lookups change when
+#        lookups are directed to a TCP-based server. For a descrip-
+#        tion of the TCP client/server lookup protocol, see tcp_ta-
+#        ble(5).  This feature is not available up to and including
+#        Postfix version 2.4.
+# 
+#        Each lookup operation uses the entire address once.  Thus,
+#        user@domain mail addresses are not broken  up  into  their
+#        user and @domain constituent parts, nor is user+foo broken
+#        up into user and foo.
+# 
+#        Results are the same as with indexed file lookups.
+# 
+# BUGS
+#        The table format does not understand quoting  conventions.
+# 
+# CONFIGURATION PARAMETERS
+#        The  following  main.cf parameters are especially relevant
+#        to this topic. See the Postfix  main.cf  file  for  syntax
+#        details  and  for default values. Use the "postfix reload"
+#        command after a configuration change.
+# 
+#        virtual_alias_maps ($virtual_maps)
+#               Optional lookup tables  that  alias  specific  mail
+#               addresses  or  domains  to  other  local  or remote
+#               address.
+# 
+#        virtual_alias_domains ($virtual_alias_maps)
+#               Postfix is final destination for the specified list
+#               of  virtual  alias  domains,  that  is, domains for
+#               which all addresses are  aliased  to  addresses  in
+#               other local or remote domains.
+# 
+#        propagate_unmatched_extensions (canonical, virtual)
+#               What  address  lookup tables copy an address exten-
+#               sion from the lookup key to the lookup result.
+# 
+#        Other parameters of interest:
+# 
+#        inet_interfaces (all)
+#               The network interface addresses that this mail sys-
+#               tem receives mail on.
+# 
+#        mydestination  ($myhostname,  localhost.$mydomain,  local-
+#        host)
+#               The  list  of  domains  that  are delivered via the
+#               $local_transport mail delivery transport.
+# 
+#        myorigin ($myhostname)
+#               The domain name that locally-posted mail appears to
+#               come  from,  and that locally posted mail is deliv-
+#               ered to.
+# 
+#        owner_request_special (yes)
+#               Enable special treatment for owner-listname entries
+#               in the aliases(5) file, and don't split owner-list-
+#               name and listname-request address  localparts  when
+#               the recipient_delimiter is set to "-".
+# 
+#        proxy_interfaces (empty)
+#               The network interface addresses that this mail sys-
+#               tem receives mail on by way of a proxy  or  network
+#               address translation unit.
+# 
+# SEE ALSO
+#        cleanup(8), canonicalize and enqueue mail
+#        postmap(1), Postfix lookup table manager
+#        postconf(5), configuration parameters
+#        canonical(5), canonical address mapping
+# 
+# README FILES
+#        Use  "postconf  readme_directory" or "postconf html_direc-
+#        tory" to locate this information.
+#        ADDRESS_REWRITING_README, address rewriting guide
+#        DATABASE_README, Postfix lookup table overview
+#        VIRTUAL_README, domain hosting guide
+# 
+# LICENSE
+#        The Secure Mailer license must be  distributed  with  this
+#        software.
+# 
+# AUTHOR(S)
+#        Wietse Venema
+#        IBM T.J. Watson Research
+#        P.O. Box 704
+#        Yorktown Heights, NY 10598, USA
+# 
+#        Wietse Venema
+#        Google, Inc.
+#        111 8th Avenue
+#        New York, NY 10011, USA
+# 
+#                                                                     VIRTUAL(5)
diff --git a/rclone/Makefile b/rclone/Makefile
new file mode 100644
index 0000000..02a0969
--- /dev/null
+++ b/rclone/Makefile
@@ -0,0 +1,23 @@
+# ref: https://rclone.org/googlephotos/
+
+.ONESHELL:
+
+IMAGE=rclone/rclone:1.58.0
+
+config:
+	rclone config
+
+mount.gh-photos:
+	mkdir -p ~/data/photos
+	rclone mount photos:media ~/data/photos --allow-non-empty --vfs-cache-mode writes --cache-dir /tmp/rclone
+
+mount.s3.photos:
+	mkdir -p ~/data/s3.photos
+	rclone mount s3:topo.photos ~/data/s3.photos --allow-non-empty --vfs-cache-mode writes --cache-dir /tmp/rclone
+
+mount.s3.backup:
+	mkdir -p ~/data/s3.backup
+	rclone mount s3:topo.backup /data/s3.backup --allow-non-empty --vfs-cache-mode writes --cache-dir /tmp/rclone
+
+ls:
+	rclone ls photos:media
diff --git a/smtpd/Makefile b/smtpd/Makefile
new file mode 100644
index 0000000..a29254f
--- /dev/null
+++ b/smtpd/Makefile
@@ -0,0 +1,8 @@
+all: dkim
+	sudo mkdir -p /etc/smtpd /etc/mail
+	sudo ln -sf `pwd`/smtpd.conf /etc/smtpd/smtpd.conf
+	sudo cp mail/* /etc/mail/
+dkim:
+	ls /etc/mail/{passwd,dkim.key,dkim.txt}
+passwd:
+	sudo echo $$(id -un):$$(smtpctl encrypt)
diff --git a/smtpd/mail/spam b/smtpd/mail/spam
new file mode 100755
index 0000000..3c48717
--- /dev/null
+++ b/smtpd/mail/spam
@@ -0,0 +1,11 @@
+#! /bin/bash
+
+SIZE=$(ls --size /tmp/spam | cut -d' ' -f1)
+
+if test $SIZE -gt 10000; then
+  cat >/tmp/spam
+else
+  cat >>/tmp/spam	
+fi
+
+true
diff --git a/smtpd/smtpd.conf b/smtpd/smtpd.conf
new file mode 100644
index 0000000..e8a5042
--- /dev/null
+++ b/smtpd/smtpd.conf
@@ -0,0 +1,47 @@
+# This is the smtpd server system-wide configuration file.
+# See smtpd.conf(5) for more information, refs:
+# 	https://man.openbsd.org/smtpd.conf.5
+# 	https://unixdigest.com/tutorials/arch-linux-mail-server-tutorial-part-2-opensmtpd-dovecot-dkimproxy-and-lets-encrypt.html
+
+# TIPS: Add a new/group vamil for processing dirty stuffs:
+#   useradd -m -c "Virtual Mail" -d /var/vmail -s /sbin/nologin vmail
+
+# Certificates from Let's Encrypt.
+pki mail.topo.tw cert "/etc/mail/ssl/fullchain.cer"
+pki mail.topo.tw key "/etc/mail/ssl/mail.topo.tw.key"
+
+# DKIM, command:
+# 	sudo PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install --force git+https://github.com/palant/opensmtpd-filters.git
+# refs: https://palant.info/2020/11/09/adding-dkim-support-to-opensmtpd-with-custom-filters/
+filter dkimsign proc-exec "/usr/local/bin/dkimsign topo.tw:dkim:/etc/mail/dkim.key"
+filter dkimverify proc-exec "/usr/local/bin/dkimverify topo.tw"
+filter dkim chain {"dkimsign", "dkimverify"}
+
+# refs: https://man.openbsd.org/table.5
+table passwd file:/etc/mail/passwd
+
+# To also accept external mail over IPv4 or IPv6,
+# respectively replace "listen on localhost" with:
+#
+# listen on 0.0.0.0
+# listen on ::
+listen on lo
+listen on enp1s0 inet4 hostname "mail.topo.tw" port 25 tls pki mail.topo.tw filter "dkim"
+listen on enp1s0 inet4 hostname "mail.topo.tw" port 587 tls-require mask-src pki mail.topo.tw auth-optional <passwd> filter "dkim"
+
+# Allow delivery from local or domain-owned-by-me
+action "me" maildir "/home/pham/Maildir" virtual { "@" = "pham" }
+match from any for domain "topo.tw" action "me"
+match from local for local action "me"
+
+# Allow outgoing emails: authenticated connection only
+action "relay" relay
+#match from local for any action "relay"
+match auth ! from local for any action "relay"
+match from local for any action "relay"
+
+# SPAM: deliver spam to custom mda
+action "spam" mda "/etc/mail/spam" virtual { "@" = "pham" }
+#match from any for rcpt-to "valxxx@megamail.com.br" action "relay"
+#match from any for any action "spam"
+#match for any reject
diff --git a/ssh/local.conf b/ssh/local.conf
new file mode 100644
index 0000000..2e8a19d
--- /dev/null
+++ b/ssh/local.conf
@@ -0,0 +1,4 @@
+LoginGraceTime 30
+PermitRootLogin no
+MaxAuthTries 3
+PasswordAuthentication no
diff --git a/www/.gitignore b/www/.gitignore
new file mode 100644
index 0000000..364fdec
--- /dev/null
+++ b/www/.gitignore
@@ -0,0 +1 @@
+public/
diff --git a/www/Makefile b/www/Makefile
new file mode 100644
index 0000000..80b9d47
--- /dev/null
+++ b/www/Makefile
@@ -0,0 +1,14 @@
+.ONESHELL:
+ROOT_DIR := $(dir $(realpath $(lastword $(MAKEFILE_LIST))))
+
+# build html files for public/
+build:
+	@input_dir=~/log/posts \
+	output_dir=/srv/http \
+	assets_dir=$(ROOT_DIR)assets \
+	template_dir=$(ROOT_DIR)templates \
+	$(ROOT_DIR)scripts/build.sh
+
+# Migrage frontmatter from '---' to HTML comment '<!-- -->'
+frontmatter:
+	find content -type f -name '*.md' | xargs sed -i ':frontmatter { 1s/^---/<!--/; 1!s/^---/-->/; 1!b}; /^---/ {1b frontmatter}'
diff --git a/www/assets/favicon.ico b/www/assets/favicon.ico
new file mode 100644
index 0000000..5af1857
Binary files /dev/null and b/www/assets/favicon.ico differ
diff --git a/www/assets/gpg.asc b/www/assets/gpg.asc
new file mode 100644
index 0000000..f33181e
--- /dev/null
+++ b/www/assets/gpg.asc
@@ -0,0 +1,84 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBGAzCdIBDACvt2iu+FTg+p3Q5p/J8Q7643g61n3kgIgDt9a5JU06nwAGDmX+
+hIrVy5OxsTntJzRkvV+nr0cR9Suvkci9RfJ9TixjMca+Eld3pPLhdPGmtPofjCaj
+LpKMkPdHg+VU4B7BANwsd/on7VYLq5Ko6dj1HKrp3KJappP5njK1u39DQHjLPEjK
+976nyErOdKNVjswIWdLFJgWhC46mH3zW4aOtkw8UIn32fbCmpZyuVU8ooJTbIl6+
+YvU9BsYRgEhSjQbi+RXQZAyUqsQlZnS8/81pwanKs6NFqBSTFaryHVfbC1McXHNY
+V3+Y/rGEmUIn2FXhHWWHb8b5oBroZQLbHVpjWV3DZgkTN0c8g+K3hQ1iLFAdWuQg
+wxBuzkq/5AMiqJ/0gUjkT4uW12fIEQR30wvveVDq/BMWdhC4tgy+ft5QcBjA3xj2
+xC813/r3cvgfWaJvB5/mUH4QPv1gESG9QdjAVOBMt/TTnKJFes5iuq1q0+ZdnG0S
+KZ1aFlfbGgZWcW8AEQEAAbQvdHlwZWJyb29rIDx0eXBlYnJvb2tAZ21haWwuY29t
+PiAoR21haWwgQWNjb3VudCmJAdQEEwEIAD4WIQQSgUZMDGWhjNgJ9OxmRzq+mhjP
+LQUCYEnKDgIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBmRzq+
+mhjPLe7zC/9/6O4+icJc74Y/d/VhJv4k/Zc3b2ZlMrdGq/FDQTYSISPPo2k6hgcS
+IQw2SPNb0hRkoaj7Dj3tMFzumSrGMyfGNXHThYWh3UABSTkTnYIXMNhd+on7VpfZ
+FqkBrIfgv+Im7Gops66L7x9b3BT16yxb373uG9bhe+w/Kzk8Mix6f57M9f21f/MI
+trOKbA50HG6scpmytJ5YHiu7qZVihhVewJDX32e9W9fpMu3Kos+SCDOzxIrLl8An
+/8WrSTqAMh/RGYKaxL6A+JjZyhDMXjWMZfvCPfzFrfF60D3ppcDtatqYvMk76i+c
+QW8Oiyv8CRWEK9CzSXptz/MsDwzVKn4UV4QFyoCmB4EGLB7+lbSbnNdtZeluoElG
++HKIwayJ9s09m3AItTIoyaejjLp7+NgivoUWueW8c2z4KHSY9uJYij0+3k9VASfx
+Njs7DdiWcgezi4BIHS0dC7sRLmJ2U5Bt0oHyRzoDa67trumCLKc/b8xAEaZZCO8z
+5FkhOSquTNe0HUhzaWVoIENoaW4gRmFuIDxwaGFtQHRvcG8udHc+iQHUBBMBCAA+
+FiEEEoFGTAxloYzYCfTsZkc6vpoYzy0FAmIPAUsCGwMFCQPCZwAFCwkIBwIGFQoJ
+CAsCBBYCAwECHgECF4AACgkQZkc6vpoYzy0ysQv9FlY6c8Jq5pIFn9i6Jk7a0Pm+
+qmWNwh9t+Wgqv+D7hIrThi9Ldb8VdslJZVGi9rqh1GHIC+lv17yclXQJ+0RHuOo6
+u7EoubT4+xuPWBQGLqcACX0LJO+XBbiN0mTs/7G7U4TOz77PoqRqUVc/mspK97l8
+aqRMXWlA6BKR5iFZLsmgI0i6pQ+YUiZbOEquVpTeRZNJF3aNi7TaZ2fROnlIVAmo
+dL0vuypVOLUqFmsiSoqR9V9n31m2LJXDGghh18VAT0hiZh2BCs3mUVwPT9G03naC
+nzidrNp/W1y3VU8f5jBdtpCrkQcCN5aIV8BAV6sUEhlezCcdx0YXmms1T6C2I7Ke
+fnnFs6M9X32uparkESUGT9DBG/e9whQCGrXeTtn1bEon+HeanWJ/eZZxNNAUFPaX
+jNgpl/Gk6zSaLiXi3PFn629piTcalbljn2pbIxwCZWX+Zh800+jRyfs9qCMhcJK2
+J+aVn9+HSGbgwKHB1V/RCVds+WzYIjdujKl2uUr1uQGNBGAzCdIBDADL1lLG8WzO
+8V46ic24UIF2JT2U4A1gfbjJ+vPdKxPxvqrctd54fGcsE8nLhdmiPfodxMwkD6qa
+FX0GQz7UmxPNl3k/i74NlTB9G0difp+Pc2fbhYD2nPOanFx3RMxX6df7V4lAlddX
+LQ0x0ryt1p8TMLUz38v+ge8oN7au0R4cHpB2ELHaNgpLc/m45XP5Qg02gYDBlO0K
+2ejW/vxpB91LNoRmlozsO+d67MQTX2Gv2mDYIf3L91uHNzbiI7V2V+R2zFkVW11p
+9YKbD5RrC7frD3CZE5wEeFmwAE6z7ivasv7qiNk8+uneIjq13xS8ul5sEbHCuyO1
+XUQ6+KXFMI5djqcoqR1p0C3daozqOygI/QVaV38RJ4XAbNUtL9bv2HjhiuVbbpKU
+frQ+7pScQosaF8rszXmr60GwK5SRICfzKTzug7m8Am+8WubjuF5jUC2WMLjMZgBP
+WiKtatoMXB4DBAdn4uN/I9IsyE+cZFgo0+Gwr7lCn+6nyYZGQhDR3fcAEQEAAYkB
+vAQYAQgAJhYhBBKBRkwMZaGM2An07GZHOr6aGM8tBQJgMwnSAhsMBQkDwmcAAAoJ
+EGZHOr6aGM8tWMQMAKD8a0n9MRIb34/6TECJbQ/VIfKiRDhd+vwoGDLoBHGzWcbU
+mQPmi3WPVBPpcxihqZi1gFoDLegv4ZFSQKLQOG5+czkLFtwbQCkJizyJFyvT8YtQ
+Dr+muBSYWnmPrJbe88qcr2HWNyYkwk0/Ibj8DfQughcSjSq0o2rV8FIITs3Fh8PJ
+55ueOX8hwTBQOS+7LZz9R1RV4d4mxlycv/C8Injx3AkHTcAzivdlaXwD2tO+3gVn
+2+oi9NFRL7esI+9jk1jCVHZjBISQ6KevxAYJW7+rE90AEBmgfeNXwWKA924mlkUP
+wxeBxFEOFySH06mfXYC9//wtOL6cmKV8xrhjAOnvLrXC/ILjzxBox+s/82pnUfSL
+ciR+TOTLVAWfB7Ep0qhrOueOXhD7eLf4Ald2Pd1/xSlQfRhMirjCL2dJ1tbx4nZP
+h+24fDXiw1zyumY5d5CbjB9/LKXMdwVhNW1CpP8Tw8oFgKbTuJMQgYQBNX6OnJRj
+4Cdkkud6LseLjVF9IbkCDQRh1Tq6ARAA6swAJeTtdlE4L8OygVprgTc3uvzoHfLh
+UfNlVxMwXeO75CEPXaovZs08c61vue4BgMxpDb7uxkBbnjTW1E3vtG2MLKJ0jHt3
+ZuqPFgzHqxmqDgces12jDlITcYK15RxJdrdEjeDDziwKo/v64aY2RDRLk1brJxYb
+DMB1Mjcgwr1GZd8CsoR4rA9YWBB49b1XdmEM/ra3vutBJFa/PmFTVz9v3NCf9g40
++k4eMTsb4RfG5mL2nk7DH+iJWw110Nk3IDhKLlxNIAPA1v6HQ5k3yvU/cwQtE7UA
+OyXQOnJPYMyzGFvcscD04GO9D23JAKLc7R9vk/77m4n3qI8IRZNVaQbAFax6wx7M
+LXg5jsgCmOESljfquUYricuieefZExWJueJedK6nHrMeqr1b9GV2SFJumN7XNZ2u
+fYP3lm5FkutPQFSqLhLD9wlqGNxyZMNAxy2smAsI8V7a7OwJdl9sugs+Tz+lHYSW
+o6PGhAUqFYXFknWlarEOlXrUtv18m8JnsMXrjWTajhlaxsgLFrpi8Li+aY/LN/YN
+7Jw0uWK4EQE6oebK8at4u9ChndaqLoyevUZ0LdTH7Fv7bnhSMk+4igrX3dVZv560
+I908Oz2ncI+eAvzlIGudk9bEL9lf/aQlVLs+aDG7Q3xhQX+rbNNOJgnTToW6oyzJ
+sOoWAuhEf40AEQEAAYkD8gQYAQgAJhYhBBKBRkwMZaGM2An07GZHOr6aGM8tBQJh
+1Tq6AhsCBQkB4TOAAkAJEGZHOr6aGM8twXQgBBkBCAAdFiEEcXjol+7uC8jTh2ia
+UN6fYpttz1kFAmHVOroACgkQUN6fYpttz1kZxQ//dvupgSMMzC1Un9VbvB5kIuPD
++6mYQGCs8bc7FY1ZsOKQdeZnR3sqpEvSiZI+i/sD436D/1xAf43c2uSPzK18g1N5
+qXax+eKlZPMGrdbVO2TjSfg0Fhz8y9ckH7u4Rb123VOurAfDrXJzmUtCChNu3iA/
+IcH9t7z8vDj91/yaW5MjgmQgijL7XC57dClu03YM3rjdQmaFXbxeGGq72NPdPjLz
+heCgjMEoUJ8viQqOBiM+BIMjftvfsyPQjELOOQTy+TeU/Yu9JTzVTntjVyBlz4Y7
+vCqfxnmEu3qsHayKYPVgCKatrP4OmqsW61kup3itcxlfq5C21WL0xJLUPq3NYOwl
+FX+3ufcfy7TrS7BcNYvfPbvIrNW10l2GTHIvjqla7wfP4+Zo47KuxYRvDFD6I21P
+Fx3/4JQfShXx0WiO1mgpA8CH2P8ZDPcdMl9Q8N8DZUHU6ClEfrMLEYGzupfSPcJH
++6sGuopfIVJ0GOHvsfZarcBqJsY3QG9lLMSAGslA7uFLoD3Wl/0ecMgDY3HuI11v
+aecZCJTs5JzIrzye2FZS73h/6yY7HNY4PEtfFoOrGY4jiugRnu9RLXc1/HgR/Veb
+mXPuueTwqiTMiSC81kAIEuSjTiePlmVX/d8Bm4KYQN6Ey0H4yW+TdSTeuRv1CkCe
+bpj5dum8whxqNw+GoClCcgv/fD3TPNddQFG6Agrk6dj5LlwZc5KuYSTmRlX2hNiP
+u9/wWO0oJFsqUYTe6h1wrZDinXwoiIWfeEZSQKzq3LgxkkzAy9LebGjXlX51eN8X
+3rgWtWGeaq1VlYHeDXSDhCAXzVAo3bRAp37H7GDIscitL35umPudfP/FTOvYJmNL
+rx1cbd0yTrxgAhAm1+Tx9BWyDb3dnfZPBkHxyrND1RmJQN0kMEnnjvhdRefZXcWf
+53RRiHXjpZ2mXwW6eNAwGuadgcXjvgb3Nb0ZsLHlu1XBOx8pvxoKJtNIi0+1RoRm
+juSV8BDPIaIMPn/xlR2E0a3Hft3L8Y4xZXj0DBnYncd2prLiihJezA7CqCRFO1+l
+7y9ZFEdx9sVrlT/5oWcQ6rLMt0ImiOOaGZYntDMKywtqy4p27lplZPbzj1wBEHGQ
+ukVHh7WOTesLHslm3q0mCfYFJPpMxpB6KsSq37zY4Pni1ByC+p2V1S6VcjT0WFmw
+RWr5Ni7wyLHOaHhoDLK9i+Fz
+=DNGE
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/www/assets/robots.txt b/www/assets/robots.txt
new file mode 100644
index 0000000..41f82c4
--- /dev/null
+++ b/www/assets/robots.txt
@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://topo.tw/sitemap.xml
diff --git a/www/assets/style.css b/www/assets/style.css
new file mode 100644
index 0000000..2752323
--- /dev/null
+++ b/www/assets/style.css
@@ -0,0 +1,213 @@
+header {
+  display: flex;
+  justify-content: space-between;
+  margin-top: 1rem;
+}
+
+footer * {
+  display: inline;
+}
+
+blockquote {
+  color: gray;
+  font-size: 1.2rem;
+  font-style: italic;
+
+  text-align: center;
+}
+
+p code {
+  margin-inline: 0.2rem;
+  padding-inline: 6px;
+}
+
+/* Neat CSS: https://neat.joeldare.com */
+* {
+    box-sizing: border-box;
+}
+
+:root {
+    color-scheme: light dark;
+    --light: #fff;
+    /* --light: #f7f7f7; */
+    --lesslight: #efefef;
+    --dark: #404040;
+    --moredark: #000;
+    /*--link: royalblue; */
+    --link: #850000;
+    --link-highlight-color: #ffdcda;
+    /* border-top: 5px solid var(--dark); */
+    line-height: 1.5em;
+    font-family: system-ui, sans-serif;
+    font-size: 16px;
+    color: var(--dark);
+}
+
+h1 {
+    line-height: 1em;
+}
+
+button, input {
+    font-size: 1em; /* Override browser default font shrinking*/
+}
+
+input {
+    border: 1px solid var(--dark);
+    background-color: var(--lesslight);
+    border-radius: .25em;
+    padding: .5em;
+}
+
+pre {
+    background-color: var(--lesslight);
+    margin: 0.5em 0 0.5em 0;
+    padding: 0.5em;
+    overflow: auto;
+}
+
+code {
+    background-color: var(--lesslight);
+}
+
+body {
+    background-color: var(--light);
+    margin: 0;
+    max-width: 800px;
+    padding: 0 20px 20px 20px;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+a {
+    outline: none;
+    text-decoration: underline 2px var(--link-highlight-color);
+    color: var(--link);
+}
+
+a:hover {
+    background: var(--link-highlight-color);
+}
+
+img {
+    max-width: 100%;
+    height: auto;
+}
+
+button, .button, input[type=submit] {
+    display: inline-block;
+    background-color: var(--dark);
+    color: var(--light);
+    text-align: center;
+    padding: .5em;
+    border-radius: .25em;
+    text-decoration: none;
+    border: none;
+    cursor: pointer;
+}
+
+button:hover, .button:hover, input[type=submit]:hover {
+    color: var(--lesslight);
+    background-color: var(--moredark);
+}
+
+/* Add a margin between side-by-side buttons */
+button + button, .button + .button, input[type=submit] + input[type=submit] {
+    margin-left: 1em;
+}
+
+.center {
+    display: block;
+    margin-left: auto;
+    margin-right: auto;
+    text-align: center;
+}
+
+.bordered {
+    border: 3px solid;
+}
+
+.home {
+    display: inline-block;
+    background-color: var(--dark);
+    color: var(--light);
+    margin-top: 20px;
+    padding: 5px 10px 5px 10px;
+    text-decoration: none;
+    font-weight: bold;
+}
+
+
+/* Desktop sizes */
+@media (min-width: 600px) {
+    ol.twocol {
+        column-count: 2;
+    }
+
+    .row {
+        display: flex;
+        flex-direction: row;
+        padding: 0;
+        width: 100%;
+    }
+
+    /* Make everything in a row a column */
+    .row > * {
+        display: block;
+        flex: 1 1 auto;
+        max-width: 100%;
+        width: 100%;
+    }
+
+    .row > *:not(:last-child) {
+        margin-right: 10px;
+    }
+}
+
+/* Dark mode overrides (confusingly inverse) */
+@media (prefers-color-scheme: dark) {
+    :root {
+        --light: #222;
+        --lesslight: #333;
+        --dark: #eee;
+        --moredark: #fefefe;
+    }
+    /* This fixes an odd blue then white shadow on FF in dark mode */
+    *:focus {
+        outline: var(--light);
+        box-shadow: 0 0 0 .25em var(--link);
+    }
+}
+
+/* Printing */
+@media print {
+    .home {
+        display: none;
+    }
+}
+
+[data-tooltip]{
+  display: inline-block;
+  position: relative;
+
+  &::after {
+    display: block;
+    position: absolute;
+    content: attr(data-tooltip);
+    background: var(--dark);
+    color: var(--lesslight);
+    padding: .25em;
+    cursor: default;
+    user-select: text;
+
+    transition:
+      visibility .3s ease-out,
+      opacity .3s ease-out;
+    visibility: hidden;
+    opacity: 0;
+  }
+
+  &:hover::after {
+    opacity: 1;
+    visibility: visible;
+  }
+}
diff --git a/www/assets/wp-admin.php b/www/assets/wp-admin.php
new file mode 100644
index 0000000..b774c98
--- /dev/null
+++ b/www/assets/wp-admin.php
@@ -0,0 +1 @@
+Got you!
diff --git a/www/scripts/add-graph.py b/www/scripts/add-graph.py
new file mode 100755
index 0000000..455b45a
--- /dev/null
+++ b/www/scripts/add-graph.py
@@ -0,0 +1,35 @@
+#! /bin/python3
+
+import sys, subprocess
+from datetime import date
+from bs4 import BeautifulSoup
+
+def handle(html):
+    soup = BeautifulSoup(html, 'html.parser')
+    for graph in soup.select('pre.language-graph'):
+        print()
+        print(date.today().strftime("%H:%M:%S"))
+        print('before:')
+        print(graph.string)
+
+        process = subprocess.Popen(
+            ["/usr/bin/vendor_perl/graph-easy", "--boxart"], 
+            stdin=subprocess.PIPE, 
+            stdout=subprocess.PIPE, 
+            stderr=subprocess.PIPE
+        )
+        output, error = process.communicate(input=graph.get_text().encode())
+        graph.string = output.decode()
+
+        print('After:')
+        print(graph.string)
+        print('Error:')
+        print(error.decode())
+    return str(soup)
+
+for line in sys.stdin:
+    file = line.rstrip("\n")
+    with open(file, 'r') as html:
+        new_content = handle(html)
+    with open(file, 'w') as html:
+        html.write(new_content)
diff --git a/www/scripts/build.sh b/www/scripts/build.sh
new file mode 100755
index 0000000..9b95c99
--- /dev/null
+++ b/www/scripts/build.sh
@@ -0,0 +1,188 @@
+#! /bin/bash
+
+set -e
+
+# Executable command for markdown
+markdown_bin="markdown -f fencedcode,autolink,alphalist,autolink,footnote"
+
+# Directory for input/output
+input_dir=${input_dir:?ENV \"input_dir\" is not set}
+output_dir=${output_dir:?ENV \"output_dir\" is not set}
+assets_dir=${assets_dir:?ENV \"assets_dir\" is not set}
+template_dir=${template_dir:?ENV \"template_dir\" is not set}
+
+# functions {{{
+
+# add indent for each line except <pre>
+indent() {
+  indent="$(printf "%${1}s")"
+  sed "s/^/${indent}/; /<pre>/!b; :pre; N; /<\/pre>/!b pre"
+}
+
+# use heredoc to generate html from .md file and templates
+html() {
+  <<-END_OF_HTML sed '1d;$d'
+
+	<!DOCTYPE html>
+	<html lang="en">
+	${head}
+	<body>
+	${header}
+	  <hr><br>
+	  <main>
+	$(${markdown_bin} | indent 4)
+	  </main>
+	  <br><hr>
+	${footer}
+	</body>
+	</html>
+
+	END_OF_HTML
+}
+
+# list of latest posts in markdown format
+latest_posts() {
+  (IFS=$'\n'; echo "${index_list[*]}") | sort -r | head -20 | while read date path title; do
+    echo "- <time datetime="$date">$date</time> [$title](/$path)"
+  done
+}
+
+# print frontmatter from markdown file with format: "<key> <value>"
+get_frontmatter() {
+  sed -n '1 {/<!--/ !q; n}; /-->/q; s/"//g; s/://p'
+}
+
+# process frontmatter
+add_index() {
+  unset title public index date draft
+
+  # define local variables for frontmatter
+  while read key value; do
+    local -r $key="$value"
+  done <<<"$(get_frontmatter)"
+
+  # don't process draft after function call
+  test "$draft" != ""		&& return 1
+
+  # skip making index in some cases
+  test "$public" = false	&& return 0
+  test "$index"  = false	&& return 0
+  test "$type"   = demo		&& return 0
+  test "$title"  = ""		&& return 0
+  iso8601=$(date --iso --date "${date:-NULL}" 2>/dev/null)
+  test "$iso8601"   = ""	&& return 0
+
+  # put frontmatter info into variable "index" if title and date are valid
+  index_list+=("$iso8601 $path $title")
+}
+
+# remove SGML comments but keep the top one as frontmatter
+ignore_comment() {
+  sed '1 !{ /^<!--$/,/^-->$/ d }'
+}
+
+# Generate the feed file
+make_rss() {
+  echo -n "Making RSS "
+
+  rssfile=$blog_feed.$RANDOM
+  while [[ -f $rssfile ]]; do rssfile=$blog_feed.$RANDOM; done
+
+  {
+	pubdate=$(LC_ALL=C date +"$date_format_full")
+	cat <<-EOF
+		<?xml version="1.0" encoding="UTF-8" ?>'
+		<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">'
+		<channel><title>Dummy Website</title><link>https://topo.tw/index.xml</link>"
+		<description>$global_description</description><language>en</language>"
+		<lastBuildDate>$pubdate</lastBuildDate>"
+		<pubDate>$pubdate</pubDate>"
+		<atom:link href="$global_url/$blog_feed" rel="self" type="application/rss+xml" />"
+	EOF
+
+	n=0
+	while IFS='' read -r i; do
+	  is_boilerplate_file "$i" && continue
+	  ((n >= number_of_feed_articles)) && break # max 10 items
+	  echo -n "." 1>&3
+	  echo '<item><title>'
+	  get_post_title "$i"
+	  echo '</title><description><![CDATA['
+	  get_html_file_content 'text' 'entry' $cut_do <"$i"
+	  echo "]]></description><link>$global_url/${i#./}</link>"
+	  echo "<guid>$global_url/$i</guid>"
+	  echo "<dc:creator>$(get_post_author "$i")</dc:creator>"
+	  echo "<pubDate>$(LC_ALL=C date -r "$i" +"$date_format_full")</pubDate></item>"
+
+	  n=$(( n + 1 ))
+	done < <(ls -t ./*.html)
+
+	echo '</channel></rss>'
+  } 3>&1 >"$rssfile"
+  echo ""
+
+  mv "$rssfile" "$blog_feed"
+  chmod 644 "$blog_feed"
+}
+
+# }}}
+# prepare directory for outputs {{{
+
+mkdir -p $output_dir/
+rm -rf $output_dir/**
+ln -s $assets_dir/* $output_dir/
+
+# }}}
+# content of templates {{{
+
+head="$(cat $template_dir/head.html)"
+header="$(cat $template_dir/header.html | indent 2)"
+footer="$(cat $template_dir/footer.html | indent 2)"
+index_list=()
+index_template="$(cat $template_dir/index.md)"
+
+# }}}
+# for each markdown file {{{
+
+files="$(find "$input_dir" -type f -name '*md')"
+total=$(wc -l <<<"$files")
+declare -i counter
+for file in $files; do
+  # set variables
+  path=$(<<<"$file" sed "s#^${input_dir}/##; s/\.md$//").html; mkdir -p $(dirname $output_dir/$path)
+  content="$(cat ${file} | ignore_comment)"
+
+  # use frontmatter to decide making html file or not
+  <<<"$content" add_index || continue
+
+  # log
+  echo -e "\033[1K\r$((counter+=1))/$total \t\t processing $path"
+
+  # make html file for draft
+  h1="$(<<<"$content" get_frontmatter | sed -n 's/^title *//p')"
+  echo "$content" \
+  | tee $output_dir/${file#${input_dir}/} \
+  | { [ -n "$h1" ] && echo "# $h1"; cat; } \
+  | html >$output_dir/$path
+done
+echo
+
+# }}}
+# make index.html {{{
+
+{
+  echo "${index_template}"
+  echo -e '<br><br>\n\n'
+  latest_posts
+} \
+| tee $output_dir/index.md \
+| html >$output_dir/index.html
+
+echo -e index.html "\t" generated
+
+# }}}
+# make index.xml {{{
+
+
+
+# }}}
diff --git a/www/templates/footer.html b/www/templates/footer.html
new file mode 100644
index 0000000..9e87e02
--- /dev/null
+++ b/www/templates/footer.html
@@ -0,0 +1,4 @@
+<footer>
+  <address><a href="mailto:info@topo.tw">info@topo.tw</a></address> |
+  <a href="http://creativecommons.org/publicdomain/zero/1.0" rel="license noopener noreferrer">CC0 1.0</a>
+</footer>
diff --git a/www/templates/head.html b/www/templates/head.html
new file mode 100644
index 0000000..ede99c9
--- /dev/null
+++ b/www/templates/head.html
@@ -0,0 +1,10 @@
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="X-UA-Compatible" content="ie=edge">
+
+  <title>Dummy Site</title>
+
+  <link rel="stylesheet" href="/style.css">
+  <link rel="icon" href="/favicon.ico" type="image/x-icon">
+</head>
diff --git a/www/templates/header.html b/www/templates/header.html
new file mode 100644
index 0000000..a77079a
--- /dev/null
+++ b/www/templates/header.html
@@ -0,0 +1,17 @@
+<header>
+  <nav class="left">
+    <a href="/">Home</a> |
+    <a href="/about.html" data-tooltip="About this site">About</a> |
+    <a href="/posts/">Posts</a> |
+    <a href="/projects.html" data-tooltip="Not valid now...">Projects</a> |
+    <!--
+    <a href="/links.html" data-tooltip="Cool sites you might be interested">Links</a>
+    -->
+    <a href="/links.html" data-tooltip="Not valid now...">Links</a>
+  </nav>
+  <nav class="right">
+    <a href="/rss.xml" data-tooltip="Not valid now...">RSS</a> |
+    <a href="https://git.topo.tw" data-tooltip="Public Git Repos">Code</a> |
+    <a href="/gpg.asc">GPG</a>
+  </nav>
+</header>
diff --git a/www/templates/index.md b/www/templates/index.md
new file mode 100644
index 0000000..5743a19
--- /dev/null
+++ b/www/templates/index.md
@@ -0,0 +1 @@
+> There should be a intro for this site, but I cannot came up with any idea about this...
-- 
cgit v1.2.3-70-g09d2