Digital Life — FoundersJP

The Cheapest 10G WiFi 7 Router in Japan: Why I Still Can’t Recommend the TP-Link BE550 Pro

Mon, 19 Oct 2026 14:43:30 GMT

I recently switched my home internet in Tokyo from SoftBank's 10G fiber to NTT Docomo's 10G service. After seeing multiple users complain about the instability of Docomo’s rented gateway WiFi, I decided to take matters into my own hands and buy a proper 10G WiFi 7 router: the TP-Link BE550 Pro.

At the time of purchase, this model was the cheapest 10G 6GHz WiFi 7 router available on the Japanese market. Thanks to the weak Yen and recent price adjustments across consumer electronics, I picked it up for 26,000 JPY (around $175 USD).

Here is my honest, unfiltered review after putting it through its paces.

Unboxing & Design

The packaging is minimalist. Aside from the main unit and manual, you only get a wide-voltage power adapter and a 1.5-meter shielded Cat6A Ethernet cable.

Visually, the router features hidden internal antennas with a recessed belt line running through the middle. The design language draws inspiration from the Dell XPS chassis from twenty years ago.Placed alongside other modern gaming consoles, it fits right in without looking like an alien spaceship.

The Highlights (Hardware Done Right)

Antenna Array: The upper half of the body houses 6 integrated antennas covering the 2.4GHz, 5GHz, and 6GHz bands. Each band utilizes a dual-antenna setup, delivering a theoretical wireless throughput of up to 9,679 Mbps.
Generous Ports: It comes with one 10G WAN port and four 2.5G LAN ports. Kudos to TP-Link here—many "10G" routers on the market foolishly pair a 10G WAN port with standard 1G LAN ports, bottlenecking the entire local network.

The Bottleneck: Disastrous Software

While TP-Link stacked the hardware specs to the ceiling, the software implementation is a complete letdown.

Broken MLO: Although Multi-Link Operation (MLO) is supported on paper, enabling it results in severe packet loss and unbearable latency, making it practically unusable.
Unstable Japanese IPoE (IPv4 over IPv6): For a router officially sold in Japan, its adaptation to local IPoE connections is abysmal. These connections rely heavily on IPv6, yet the stock firmware frequently drops the IPv6 connection. Worse, when it drops, the system fails to auto-restart or reconnect the IPv6 service—leaving you with no choice but to manually reboot the device.

To solve this, I flashed a separate device with OpenWrt to handle MAP-E link, converting the BE550 Pro into a glorified Access Point (AP).

My Advice to TP-Link: Spend less time on flashy, gimmick features and focus on rock-solid core software functionality.

If I could turn back time, I would not buy this router again.

Final Thoughts: Why 10G Fiber Matters in the AI Era

Japan is currently pushing symmetric 10G fiber to residential homes (10Gbps down / 10Gbps up). In the age of local AI workflows, this bandwidth isn't just a luxury—it’s a necessity.

For example, pulling a local 32B parameter AI model requires downloading around 70GB of data. On a standard 1Gbps connection, that download takes an entire night. On a full 10G connection, it wraps up in a matter of minutes.

Related Reading :

Advanced Play with Docker Compose in NAS
Do you have to lose port 443 and your address will be with a little digital tail?No! Lucky+CloudFlare makes you clean and fresh!

Follow me for more “survival” tips on Digital nomad！

AI Filmmaking for Beginners: 3 Tools That Turn Stories Into Short Films

Thu, 17 Sep 2026 14:23:16 GMT

A friend of mine enjoys writing screenplays as a hobby.

Recently, I helped her turn a few simple scripts into short videos.

They are still far from Hollywood-level productions, but that was never the point.

Even with a rough production, seeing a story come to life on screen was surprisingly rewarding. The process itself was fun, creative, and satisfying.

Experiences like this make me believe that AI is bringing us closer to a world where anyone can become the director of their own stories.

Today I’d like to share three AI tools I used in this project. Together, they can handle most of the work needed to create a video.

1. Dreamina AI — Creating Images and Videos

Dreamina AI is a generative AI platform developed by ByteDance. It supports text-to-image generation, image-to-video creation, and story-based content generation.

For this project, I didn’t use advanced techniques such as keyframes or detailed camera control.

Instead, I simply wrote a few short prompts and allowed the AI to interpret them creatively.

That simplicity is one of the reasons I think beginners can start using AI video tools without a steep learning curve.

2. ElevenLabs — Voiceovers and AI Music

ElevenLabs is best known for its high-quality text-to-speech technology.

It supports multiple languages, emotional voice styles, and precise control over pacing, pauses, and tone. The resulting audio often sounds professional enough for podcasts, videos, and commercial projects.

One feature I particularly like is its ability to generate songs.

You can write your own lyrics, choose a musical style, and let AI create the music.

For my New Year video, instead of searching for background music, I simply wrote a few lines of lyrics and asked the AI to generate a song that matched the mood.

It saved time and made the final video feel more personal.

3. DaVinci Resolve — Editing and Color Grading

DaVinci Resolve is a professional video editing and color grading application widely used in the film industry.

It offers advanced editing tools, visual effects, multi-track editing, and industry-leading color correction features.

In the past, I mainly used Premiere Pro for editing.

This time, however, I found DaVinci Resolve surprisingly approachable.

It sits somewhere between professional editing software and beginner-friendly tools.

If DaVinci Resolve still feels too complex, CapCut is another great option. It is much easier to learn and can handle most basic editing tasks without much effort.

Final Thoughts

AI has dramatically lowered the barrier to video creation.

By combining AI-generated visuals from Dreamina AI, voiceovers and music from ElevenLabs, and editing in DaVinci Resolve, ordinary people can create unique videos in a relatively short amount of time.

This is especially exciting for writers, storytellers, and creative hobbyists.

For the first time, it’s becoming realistic to transform stories from the page into something closer to film.

Tools can make creation easier.

But meaningful stories still come from people.

No need to worry, even for beginners—after SoftBank blocks IPv6, Lucky and Cloudflare Tunnel have you covered.

Sun, 23 Aug 2026 13:55:00 GMT

Today I suddenly realized that I couldn’t access my home NAS from outside the network, and the notes stored on it wouldn’t sync either. It took me a while to figure out the cause—a SoftBank router update had blocked incoming IPv6 connections. I’ve previously shared a method for “removing the ‘non-443 port’ suffix,” which can resolve many access issues, but that approach was completely ineffective against this IPv6 block.

https://www.foundersjp.com/lifestyle/digitallife/do-you-have-to-lose-port-443-and-your-address-will-be-with-a-little-digital-tailno-luckycloudflare-makes-you-clean-and-fresh/

Since the old method didn’t work, I switched to a new solution: Lucky + Cloudflare (CF) Tunnel. This solved the problem perfectly. Below, I’ll walk you through the detailed steps one by one so even beginners can follow along.

First, let me talk about the main tool I’ve been using—Lucky

Lucky is a highly integrated utility that combines a variety of practical features, including DDNS, reverse proxy, intranet access, port forwarding, WebDAV, and the CorazaWAF firewall. Whether you're using a standard router or installing it via Docker, it works seamlessly.

Even better is its “lightweight” design: common setup combinations (such as NPM+cloudflared+ddclient) can take up 600–800 MB of disk space after installation and consume a significant amount of RAM; in contrast, the Lucky package is less than 30 MB, and its daily RAM usage is just over 50 MB, making it particularly well-suited for devices with limited hardware resources.

Next, I’ll walk you through the setup step by step—just follow along 👇

Step 1: Create a tunnel in Cloudflare

Log in to your Cloudflare account, go to [Zero Trust] → [Network] → [Connectors], and click the [Create Tunnel] button.
Follow the on-screen prompts to name the tunnel (any name will do, as long as you can tell them apart). Once creation is complete, the page will display a tunnel token.
⚠️ Important reminder: This token is only displayed once! Be sure to copy it immediately, paste it into a text editor, and save it securely. If you lose it, you’ll have to recreate the tunnel. For example
, the page will display something like--token 一串字符,--tokenAll characters following that are the tunnel token we need. Even if it isn’t displayed in full, you must copy and save the entire string.

Step 2: Create a Cloudflare API token

Click the profile icon in the upper-right corner of the page, go to [Profile], locate the [API Token] option, and click [Create Token].
Select [Use Template] or configure permissions manually, and check the permissions as required below:

Permission 1: Account → Cloudflare Tunnel → Edit
Permission 2: Zone → DNS → Edit

For 【Account Resources】 and 【Region Resources】, select "All Accounts/Regions," or specify the account and region corresponding to the specific domain you want to use.
After clicking "Save," the page will generate an API token, which is also displayed only once! Copy and save it; we recommend labeling it "API-Token" to avoid confusing it with the "Tunnel-Token" from the first step.

Step 3: Add tunnel settings in Lucky

Open the Lucky management interface, navigate to [Internal Network Penetration] → [Cloudflare], and click [Add Instance].
Fill in the parameters according to the instructions below; leave any other options that aren't mentioned here at their default settings:

Note: Enter a name of your choice to help identify the purpose of this tunnel (e.g., "NAS Access Tunnel").
Instance type: Select [Tunnel]
First token input field: Paste the "Tunnel-Token" you saved in the first step
In the CF API Token input field at the bottom: Paste the "API-Token" you saved in Step 2.

After saving, you'll see the newly added item in the tunnel list. Click [Apply Route] next to it, and the page will display a unique record value. Copy this value in its entirety.

Step 4: Configure DNS resolution in Cloudflare

Return to the Cloudflare dashboard, go to [DNS] > [Records], and click [Add Record].
Select the record type [CNAME] and fill in the required information:

Name: Enter the domain prefix you want to use to access the service (for example, if you want to access it via nas.xxx.com, enter "nas")
Content: Paste the record values copied from Lucky in the previous step
Proxy status: Tap the "Little Yellow Cloud" icon (to enable CDN and proxy)

Click "Save," and the DNS record is now configured.

Step 5: Complete the final setup and start using it

Return to the tunnel configuration page in Lucky, and enter the full domain name you created in the previous step (e.g., nas.xxx.com) in the [Hostname] field.
Click [Test] next to it. Once the test result turns green, it means the tunnel is connected.
In the [Destination Service] field, enter the address and port of the device on your internal network (for example, the NAS address 192.168.1.100:5000). After saving, you will be able to access the service normally via the domain name.

Finally, let’s discuss the pros and cons of this approach.

✅ Pros: Compared to traditional "DDNS + reverse proxy" solutions, this method offers stronger encryption. Plus, since traffic is routed through Cloudflare, it’s virtually impossible for ISPs to block or intercept it, ensuring maximum stability.
❌ Cons: Currently, it only supports services using the HTTP and HTTPS protocols. If you need to use other protocols, such as Remote Desktop or FTP, this solution isn’t suitable—you’ll need to find an alternative.

Do you have to lose port 443 and your address will be with a little digital tail?No! Lucky+CloudFlare makes you clean and fresh!

Tue, 11 Aug 2026 15:41:00 GMT

Those of you who are familiar with me know that I love to toss NAS, and I run a lot of services in my NAS at home. As a family of geeks, most of my use is through the routing side of the intranet address to jump to use, and did not pay attention to the access status of the public network. Recently, however, one day, I suddenly went out and found that these services on the NAS could not be accessed through the public network.

I found out the reason is that port 443 of IPv6 is blocked, and in the past, IPv6 was not blocked for 443 in my city. I thought it was a phased blocking of ports and would be unblocked after a while, however, more than a month has passed and it still hasn't been unblocked, so I'm afraid it won't be unblocked for quite some time.

Lucky.

In the past, my service on the NAS has been realized through DDNS-Go + Ngnix Prosy Manager. I experienced Lucky Daikichi when I tossed iStoreOS on my Lab machine some time ago, and this time I plan to formally apply Lucky to the NAS as well. I'm not the only one who uses the network at home, and there's a history of being criticized by the whole family because of something going wrong with All In One. So I have all my services on the NAS now, and the routing will just be routing.

Lucky Daji is based on DDNS integrated reverse proxy solution, support for many domain name service provider platform, also through the API and key management (I believe that friends can see here, must know how to apply for API and key), but its management background design is more humanized, a variety of processes are also more intuitive. ssl certificates are also managed individually, more suitable for the use of national I've used CloudCloud myself. I myself have used CloudFlare's 15-year certificate, so long cycle, or very worrying.

Of course the biggest problem is still the port issue. Because I'm a lazy person, I only set up one external listening port when shadowing ports through Biggie, and the various services are differentiated by secondary domain names. The reverse proxy service addresses on the NAS are prefixed with nasx.

source rules

Although a port is better to remember, through the domain name plus port can also be used. But as a slightly obsessive-compulsive have bacteria, always feel very awkward, so also have been looking for ways to realize the public port jump. Before in the big mom also have seen other friends write, through the redirection rules and source rules to realize the way, but let a person more helpless is the free version only 10 redirection and 10 source rules to use the authority.

In the course of my attempts, I found that the source rule has an option to match "SSL/HTTPS" to point the default port 443 to the specified port of the service host, which is literally customized for my current situation.

CloudFlare's source rules are very user-friendly and can be used to create a variety of complex judgment combinations through "And" and "Ro" to adapt to various situations. If there is only one host in a single network segment, it can be judged by the IPv6 segment, which does not need a prefix and is easy to remember. But I have other hosts under "2408", so I chose the prefix way to do the judgment, the services on the NAS are in the second-level domain name added "nasx" as a prefix, this setup ensures that the other hosts under the main domain name will not conflict with the second-level domain name. This setting ensures that the other second-level domain names under the primary domain name will not conflict with each other.

Of course the little yellow cloud in DNS must be turned on, or it will not take effect.

utilization effect

After these settings, you can access your own private service directly with just the domain name, no problem for either browsers or clients. However, it is important to note that the actual port for accessing through the domain name is 443, not a customized port. For remote Aria downloads or remote database access, the port needs to be 443. For remote desktop access, the domain name can be used to connect directly without a port.

In practice, the DNS access through CloudFlare is a bit slower than AliDNS with port resolution, but it is more stable. In the course of my business trip, I found that some cities through the Ali DNS access will fail, but CloudFlare is not a problem. I haven't tried Tencent's DNSPod or Volcano, and I don't know if other platforms in China support this kind of source rule, so I'd like to hear from those who have used it.

Performing Brain Surgery on AI: Can We Use Ollama Modelfile to Fine-Tune a Local Large Model and Teach It the "Shadow Clone" Technique?

Tue, 11 Aug 2026 13:57:00 GMT

In the era of agent privatization, Ollama serves as an ideal platform for running AI models. Depending on specific requirements, different models can be loaded in a staggered manner to achieve the agent’s behavioral objectives. However, the models in the official Ollama library generally take up a significant amount of space and cannot be customized. In comparison, fetching models from Hugging Face is a great alternative.

As it happens, both Qwen and Gemma have recently released new models that are supposedly agent- and skill-friendly, so I decided to give them a try. However, even though I pulled in the most powerful Qwen 3.5, it ran like a madman talking to himself. This is most likely not a problem with the model’s intelligence, but rather a case where the Ollama model file needs a bit of “brain surgery.”

When pulling models from HuggingFace, we need to create a ModeFile tailored to our specific needs, but this is often where the most issues arise. We may encounter hallucinations, self-questioning and self-answering, looping outputs, or no output at all. The reason for this is that Ollama is extremely sensitive to the Template in the model’s ModeFile.In most cases, each model includes a pre-configured Chat Template provided by the publisher. The root cause of model runaway behavior is a conflict arising from inconsistencies between the ModeFile and the model’s built-in Chat Template.

Even within the same model series, there can be significant differences between the built-in chat templates. For example, if you place a Qwen3 ModeFile into Qwen3.5, it will malfunction. Therefore, the safest approach is to export the chat template from the model and use it to build a ModeFile that meets your specific needs.

Export Template

Ollama typically runs in a container, but since container environments are often minimal, the best way to extract chat templates is to run the command directly on the host machine. I run Ollama on UNRAID, which doesn’t come with a Python environment by default, but you can install it from the App Store. Similarly, you can install it on Synology and Feiniu as well.

Simply run the following command in the model directory using Python:

python3 -c "



def read_gguf_template(file_path):
    try:
        with open(file_path, 'rb') as f:
            magic = f.read(4)
            if magic != b'GGUF': return '【Invalid GGUF】'
            # 2MB Covers the vast majority of metadata scenarios
            header_data = f.read(2 * 1024 * 1024)
            key = b'tokenizer.chat_template'
            pos = header_data.find(key)
            if pos == -1: return '【Template field not found】'
            
            # Identifying Jinja template delimiters
            start_jinja = header_data.find(b'{%', pos)
            if start_jinja == -1: start_jinja = header_data.find(b'{{', pos)
            
            if start_jinja != -1:
                raw = header_data[start_jinja : start_jinja + 2000]
                end_jinja = raw.rfind(b'%}')
                # Decode and clean up any remaining binary data
                res = raw[:end_jinja + 2].decode('utf-8', 'ignore') if end_jinja != -1 else raw.decode('utf-8', 'ignore')
                return res.strip()
            return '【The keyword was found, but the starting point could not be located.】'
    except Exception as e:
        return f'【Read error: {e}】'

files = sorted([f for f in os.listdir('.') if f.endswith('.gguf')])
if not files:
    print('Error: No .gguf files were found in the current directory.')
else:
    for file in files:
        print('\n' + '★' * 40)
        print(f'Model file: {file}')
        print('--- Original template content ---')
        print(read_gguf_template(file))
        print('★' * 40)
"

You will then see an item with the same name under the model.

P.S.: I mostly use the Q4_K_M model, which offers a fairly moderate compression ratio.

The cause of the confusion

Taking Qwen 3.5 as an example:

The template includes <think>\n\n</think>structure. If Ollama's Modelfile has not defined PARAMETER stop "<|im_end|>" or if the thought chain tags are not handled properly, the model will enter a loop.

To keep pace with the current trend in agents and skills, Qwen 3.5 has added a large number <tool_call>, <function=...>, and <parameter=...> tags. If the System Prompt passed from Ollama is incomplete, the model may "mistakenly assume" that it needs to call a tool. When it realizes there are no tools available, it will start randomly generating function names and parameters based on a template format, resulting in "nonsensical content."

There is logic in the template:{% if message.role == "tool" %} This will be followed by <|im_start|>user\n<tool_response>. IIn Ollama’s default logic, the "user" and "assistant" roles alternate. However, to maintain compatibility with tool responses, Qwen 3.5 wraps tool wraps the return content of user a role. If Ollama’s Modelfile simply defines a role, it can lead to a misalignment of contextual roles. The model may suddenly perceive itself as the user, creating the illusion of a "loop."

Custom Modeflie

With the built-in templates in the structural model, building Modeflies is much simpler. Based on the Chat Template included in the model, I built two Modeflies: Think and Agent.

Features	Think Mode (Thinking Type)	Agent Pattern (Executing)
Temperature (Temp)	0.6–0.8 (to allow for creativity)	0.1–0.4 (for stability)
Context (Ctx)	32768 (Long-form text analysis)	8,192–16,384 (as long as it’s sufficient)
Core Logic	Inductive <think> Inductive Activation	Enforce Constraints on Tool Calls
Stop words	Standard Role Tags	Increase </think> Truncate

Think is used <think> for scheduling, planning, breaking down plans, and studying existing documents. It improves the quality of generated content by allowing the model to self-validate. If the base model you’ve selected does not support the Think mode, do not attempt <think> to convert it into a Think model within Modeflie, as this will result in garbled text.

FROM ./Qwen3.5-4B-Q4_K_M.gguf

TEMPLATE """<|im_start|>system
{{ .System }}<|im_end|>
{{ range .Messages }}<|im_start|>{{ .Role }}
{{ .Content }}<|im_end|>
{{ end }}<|im_start|>assistant
<think>
"""

SYSTEM """You are an expert reasoning assistant. For every problem, think carefully and thoroughly before answering. Show your reasoning process inside <think> tags, then provide a clear, well-structured final answer after </think>."""

PARAMETER stop "<|im_end|>"
PARAMETER stop "<|im_start|>"
PARAMETER stop "<|endoftext|>"

PARAMETER num_gpu 99

PARAMETER num_ctx 32768
PARAMETER temperature 0.6
PARAMETER top_p 0.95
PARAMETER top_k 40
PARAMETER repeat_penalty 1.1
PARAMETER num_predict 8192

An Agent is responsible for invoking various tools and quickly generating real-time content. The Agent’s modefile strictly enforces rules governing which tools can be invoked, how they are executed, and what their outputs should be. Allowing the model to think during execution reduces efficiency and can cause deviations in the execution process. Therefore, the thinking process is terminated using the </think> tag during execution; alternatively, thinking can be forcibly terminated using the PARAMETER stop "</think>" parameter.

FROM ./Qwen3.5-4B-Q4_K_M.gguf

TEMPLATE """<|im_start|>system
{{ .System }}<|im_end|>
{{ range .Messages }}<|im_start|>{{ .Role }}
{{ .Content }}<|im_end|>
{{ end }}<|im_start|>assistant
<think>

</think>

"""

SYSTEM """You are a precise, execution-focused AI assistant operating as an agent backend.

## Tool Usage
- Call tools proactively when external data, retrieval, or computation is needed.
- Return tool calls as valid JSON strictly following the provided schema.
- Include all required fields. Never omit or fabricate parameter values.
- If a required parameter is missing or ambiguous, ask for clarification before calling.
- After receiving tool results, synthesize and respond — do not re-expose raw tool output.

## Task Handling
- RAG / Retrieval: Query precisely. Summarize retrieved content faithfully without hallucination.
- Data processing: Apply operations step by step. Validate output structure before responding.
- Multi-step planning: Break complex tasks into subtasks. Track progress and adjust plan if a step fails.

## Output Rules
- Structured tasks → use JSON or markdown tables as appropriate.
- Free-form tasks → plain concise prose, no filler.
- Never guess. Never pad. If uncertain, say so explicitly."""

PARAMETER stop "<|im_end|>"
PARAMETER stop "<|im_start|>"
PARAMETER stop "<|endoftext|>"

PARAMETER num_gpu 99

PARAMETER num_ctx 16384
PARAMETER temperature 0.6
PARAMETER top_p 0.9
PARAMETER top_k 40
PARAMETER repeat_penalty 1.1
PARAMETER num_predict 2048

You can adjust the PARAMETER section according to your device environment and requirements.

Teamwork: 1 + 1 > 2

Through this "brain surgery" on the model file, we have essentially split a single model into two distinct "personalities." This is the "Shadow Clone Technique" of local large models:

Thinker: Responsible for digesting lengthy documents and refining logic, <think> the tag to construct complex chains of reasoning.
Executor: Handles the dirty and tedious work, strictly executes JSON output, never wastes words, and delivers only results.

Compared to mixing and matching models from different brands and of different scales, this collaborative approach based on “clones from the same source” offers a decisive advantage:

Zero communication overhead: Since they share the same vocabulary (tokenizer) and underlying logic, Clone B can instantly and accurately grasp the intent planned by Clone A, significantly reducing the protocol alignment overhead associated with cross-model calls.
Ultra-space-saving: No matter how many partitions you create, it always occupies only a single Qwen3.5-4B-Q4_K_M.gguf of disk space.
A Leap in NAS Performance: Even in resource-constrained NAS environments, a "specialized and fine-tuned" small-parameter model can deliver greater stability and responsiveness for specific tasks than even those bloated, general-purpose large models.

The Ultimate Closed-Loop Solution for Agent Privatization

Amid the trend toward agent privatization, Ollama is no longer just a model loader; it’s more like a “talent marketplace.”

With Modelfile’s precise control, you can summon countless “clones” just like in *Naruto*, tailored to the difficulty of the task: one for security reviews, one for code audits, one for data cleansing… They all share a single brain (Weights) but each performs its own specific role.

When your local AI can automatically and seamlessly switch between “thoughtful deliberation” and “swift action” based on your instructions, you no longer have just a chatbot—you have a special forces unit of AI that is at your beck and call, absolutely loyal, and deeply attuned to your needs.

The brain surgery is complete. Now, restart Ollama and experience the power of the avatar combo!

Registering a personal account with Azure is essential to resolve issues accessing Outlook email.

Sat, 08 Nov 2025 15:51:53 GMT

The world-renowned tech giant Microsoft has truly taken a firm stance, vigorously promoting modern secure connection methods for data security reasons. Since 2022, it has phased out basic authentication (username/password) for enterprise email services. In September 2024, it announced that basic authentication for personal users would also be discontinued starting May 2025, though this deadline has now been extended to the end of April 2026.

For users who frequently use Outlook's website and app, as well as major email clients like Apple Mail and Gmail, there appears to be little impact since these apps already have built-in OAuth2 support. However, those who have long relied on third-party clients or self-hosted tools and accumulated years of email data may find themselves in a bind, forced to take matters into their own hands.

Regardless of which client or app you use, if it doesn't have Microsoft's OAuth2 interface built-in, you must first obtain OAuth credentials for your personal Outlook account.

First, you need to register for a free account on Azure, Microsoft's cloud service platform. For enterprise users, the corporate ID is typically already linked to the corresponding Azure account. Individual users, however, must register anew using the email address associated with their Outlook account.

Please note that during registration, you will be required to verify your credit card. Supported credit cards include VISA, American Express, Mastercard, and JCB.

After completing registration, go to the homepage of the personal management platform and select App Registration. If you don't see the Application Registration option, you can search for it in the search bar.

On the application registration page, click New Registration, then fill in the application name, account type, and other information. If this account is solely for your personal use, select Single Tenant. Since I have separate Outlook email accounts for work and personal use, I need to choose Multi-tenant and Personal Account.

After that, determine the redirect address. Select Web as the method, and the address is

https://login.microsoftonline.com/common/oauth2/nativeclient

This address is a special address whose function is to inform the Microsoft Identity Platform that the application we are currently registering is intended for API authorization.

After clicking "Finish," you'll arrive at the application details page. Under "Manage" on the left, select "Certificates and Passwords." Here, create a new client password. You can choose the password's validity period, with a maximum of 24 months (two years). After two years, if you wish to continue using it, you'll need to reapply for the password—a security measure implemented by Microsoft. Note that this password will only be displayed once. If forgotten, you'll have to reapply for the application. Therefore, it's advisable to record this password in a secure location.

After obtaining the password, select the API permissions on the right. Then choose Microsoft Graph and select Delegated permissions within it. Check the boxes for IMAP and SMTP. After adding them, click Grant admin consent, which represents the default directory.

Then, in the third-party application or app you use, simply add the corresponding application tenant account and password.

On your Azure personal homepage, you can view your current subscription plan. Mine is the free tier. Clicking "Details" shows which services are included at no cost. If you need to set up a simple website or personal application, you can fully leverage these resources.

Advanced Play with Docker Compose in NAS

Sun, 02 Nov 2025 04:17:06 GMT

Those of you who are familiar with me know that I often toss NAS, and I also belong to the NAS deployment of many self-hosted services, which Docker is essential. Different NAS systems have different solutions for Docker, and Docker Compose is currently the most widely applicable one.

Labeling instructions

The Docker Compose configuration file is in YAML format, usually a docker-compose.yml or compose.yaml file. The top-level tags define the configuration of services, networks, storage volumes, etc. for the entire application. The following is a list of common and important top-level tag names and their functions in the Docker Compose configuration file. This list is based on the Compose Specification, which replaces the older v2 and v3 formats and is the recommended and widely used standard at this stage.


`version` (deprecated)	(no longer recommended in newer Compose specifications) Used in older Compose file formats (v2 and v3) to specify the profile version. When using the Compose specification now, this field is usually omitted or used only for backward compatibility.	old version
`services`	Defines all services in the application. Each service entry (such as `image`, `container_name`, etc. as you mentioned) acts as a subconfiguration under this key. This is the core part of the Compose file.	compulsory
`volumes`	Define Named Volumes. These volumes can be shared between different services and are independent of the container lifecycle.	selectable
`networks`	Define custom networks. Allows services to connect to a specific network in order to communicate with each other or with an external network.	selectable
`configs`	Define Config Data. Allows a service to access sensitive or non-sensitive configuration data, typically used for application configuration.	selectable
`secrets`	Define Sensitive Data (Secrets). Allows services to securely access sensitive information such as passwords or API keys.	selectable
`include`	Contains additional Compose files. Allows configuration to be split into multiple files for easy management and reuse.	selectable
`name`	Specifies the project name. Used to override the default behavior of directory names as project names.	selectable

Of these top-level tags, the services tag is essential for building containers, and there are a number of common sub-tags under it.


`image`	Specifies the image used to build the container. This can be a public image on Docker Hub, a private repository or a local image.
`build`	Defines how to build the image. Use this to specify the Dockerfile path and build context if not using an existing `image`.
`container_name`	Specify a fixed name for the container. By default Compose generates a name (e.g. `projectname-servicename-1` ).
`ports`	Publish the container's port to the host. The format is usually `Host Port:Container Port`.
`volumes`	Mount storage volumes or host paths to containers. Used for data persistence or shared host files. The format can be `host path:container path` or `volume name:container path`.
`environment`	Sets an environment variable in the container. This can be a list of key-value pairs or file references.
`env_file`	Add environment variables from the file.
`networks`	Specifies which networks the service should connect to.
`depends_on`	Define dependencies between services. Ensure that dependent services are started before the current service is started.
`restart`	Defines the restart policy when the container exits. Examples are `always`, `on-failure`, `unless-stopped`.
`command`	Overrides the default commands executed when the container starts.
`entrypoint`	Overrides the default entry point of the container.
`labels`	Add custom metadata (tags) to the container.
`healthcheck`	Define a command to check the health status of a container.
`logging`	Configure the logging driver and options for the service.
`deploy`	Specify deployment and runtime constraints (mainly used in Swarm mode).

example

To make it easier to understand, I'll use two samples to illustrate. I'll add comments (notes) using the # symbol next to each tag.

The following example shows a scenario where a standalone web server container (using an Nginx image) is configured through a single container.

# Top-level configuration keys (tags) for the Compose file

# The 'version' key is generally discouraged in favor of the latest Compose Specification.
# If needed for backward compatibility, it can be added as:
# version: '3.8'

# Core tag: Defines all services in the application
services:
  # Service Name: Can be any name you choose; it acts as a network alias
  web_server:
    # Service sub-tags:

    # Specifies the image used to build the container
    image: nginx:latest

    # Assigns a fixed name to the container
    container_name: my_single_nginx_container

    # Mounts volumes or host paths to the container
    # Format: [Host Path or Volume Name]:[Container Internal Path]
    volumes:
      # Mounts the local ./html directory to the Nginx default web directory in the container
      - ./html:/usr/share/nginx/html:ro

    # Publishes container ports to the host
    # Format: [Host Port]:[Container Port]
    ports:
      # Maps the container's 80 port to the host's 8080 port
      - "8080:80"

    # Sets environment variables inside the container
    environment:
      # This is an example environment variable
      - TIMEZONE=Asia/Shanghai

    # Defines the restart policy when the container exits
    # 'unless-stopped' means the container will restart upon exiting, unless manually stopped
    restart: unless-stopped

    # Adds custom metadata (labels) to the container
    labels:
      - "com.example.description=Single Nginx Web Server"

# Top-level tag: Defines named volumes (if needed)
# Since this example uses host mounting, the 'volumes' tag can be omitted.
# volumes:
#   my_data:

# Top-level tag: Defines custom networks (if needed)
# In this single container example, Compose will use the default bridge network.
# networks:
#   default:
#     driver: bridge

This example configures a web application (using the Node.js example) and a database (using PostgreSQL) with multiple containers and configures the dependencies and communication between them.

# Top-level configuration keys (tags) for the Compose file

# Core tag: Defines all services in the application
services:
  # Service One: Web Application
  app_service:
    # Service sub-tags:

    # Specifies how to build the image (building from a Dockerfile)
    # 'context' specifies the directory containing the Dockerfile, 'dockerfile' specifies the Dockerfile name
    build:
      context: .
      dockerfile: Dockerfile.app

    # Assigns a fixed name to the container
    container_name: web_app_container

    # Publishes container ports to the host
    # Maps the container's 3000 port to the host's 3000 port
    ports:
      - "3000:3000"

    # Sets environment variables inside the container
    environment:
      # Environment variables needed to connect to the database
      - DB_HOST=db_service  # Use the service name as the hostname for connection
      - DB_PORT=5432
      - DB_USER=user
      - DB_PASSWORD=secret

    # Defines dependencies between services
    # Ensures the db_service container is started and running before starting app_service
    depends_on:
      db_service:
        condition: service_started

    # Specifies which networks the service should connect to
    networks:
      - internal_network
      - public_network

  # Service Two: Database Service
  db_service:
    # Service sub-tags:

    # Specifies the database image to use
    image: postgres:14-alpine

    # Assigns a fixed name to the container
    container_name: postgres_db_container

    # Mounts volumes to the container
    volumes:
      # Uses a named volume for data persistence, ensuring data is not lost after container restarts
      - postgres_data:/var/lib/postgresql/data

    # Adds environment variables from a file (a safer way to manage secrets)
    # Assumes a file named .env.db exists, containing variables like POSTGRES_USER
    env_file:
      - .env.db

    # Defines the restart policy when the container exits
    restart: always

    # Specifies which networks the service should connect to
    # Note: Database services are usually not exposed directly to the public, only connecting to the internal network
    networks:
      - internal_network

# Top-level tag: Defines named volumes
volumes:
  # Defines a volume named 'postgres_data'
  postgres_data:
    # Can specify driver and options; using default driver here
    driver: local

# Top-level tag: Defines custom networks
networks:
  # Defines an internally used network for app and db communication
  internal_network:
    driver: bridge
  # Defines a network that might require external connection
  public_network:
    driver: bridge

Used in NAS

At present, all mainstream NAS systems support Docker Compose, according to their own needs to find the corresponding project Docker Compose, copy and paste into the NAS Docker Compose, and according to their own specific circumstances can be edited.

One special note is to modify the path in the Docker Compose file when using it in your own NAS. As mentioned in the previous section, the mount tag volumes and the variable file env_file tag are both involved in setting the path. Most NAS systems require a path to be set when adding Docker Compose, and this path is where the container project stores its files in the NAS.

In the Docker Compose file, the items under each tab are separated by ":", the first colon before the first is the mapped host port or address, after the first colon is the port or address within the container, and after the second colon is the setup items such as read/write permissions.

Depending on different developers' editing code habits, when mapping the mount address, some developers will write the absolute address, while others will write the relative address, using the above sample for reference:

Absolute Address：/volume1/docker/Test/html

Relative Address：./html

In the above example, the html folder is the mapped mount folder, and the " . / " means that the html folder is in the /docker/Test directory. Personally, I prefer to use relative paths so that if the container or docker directory is relocated, it doesn't invalidate the container by losing the directory.

The other is the port, in the example above, it is mapping port 80 in the container to port 8080 on the host, if there are multiple Docker containers running in the NAS, make sure to pay attention to which ports are already occupied, avoid mapping the same port in different containers, which will also lead to invalid containers.

NextCloud-AIO Use and Optimization, Online Collaboration Office All in One Click

Mon, 23 Dec 2024 12:14:29 GMT

I installed NextCloud-AIO some time ago, and some of you said that when you use it outside the network, sometimes Office still gives errors. There are also friends who ask how to migrate data. So put together a variety of situations to say.

https://www.foundersjp.com/zh/digital-life-zh/unriad-nextcloud-aio/

Installer Password

Friends who often toss may delete containers, or even delete mirrors, etc., and when reinstalling, they find that they don't remember the installer's password, which is embarrassing. If you forget the installer password, it doesn't matter, you can retrieve the password through the following command.

docker exec nextcloud-aio-mastercontainer cat /mnt/docker-aio-config/data/configuration.json | grep password

Accordingly, if the Docker is under Win, you need to manually complete the absolute path yourself.

Missing containers

Because of network reasons, it may fail when pulling images, some items are red when you start NextCloud on the installer page, and if you find multiple containers missing in UnRaid's Docker list, you can choose to stop the service first, and then select Start or and Update afterwards, and the installer will automatically fill in the missing containers.

modify a password

After logging in with the random password generated by the installer, you can change the Admin password in the "Personal Settings-Security" menu in the upper right corner of the avatar. Here you need to verify the original password, and the new password is only entered once, there is no secondary verification, so be sure to point to the back of the small eyes to close the mask to confirm, so as not to enter the wrong, do not ask me how to know.

Office

NextCloud has enabled WOPI whitelist verification by default, but NextCloud also explains that Office components may not be able to connect when used on the public network, so it is recommended to disable the WOPI whitelist verification in the case of installing via AIO. In the "Management Settings - Office" option, clear the input box under "Allow list for WOPI requests" and click the right arrow.

backing up

NextCloud-AIO uses PostgreSQL database, and the data files are not placed in "/appdata/nextcloud/", so it is not safe to backup the "appdata" data just by UnRaid regularly, but NextCloud-AIO installer provides backup function, which can support local and remote backup, and also supports regular backup. It is not safe to backup "appdata" data regularly by UnRaid, but NextCloud-AIO installer provides backup function, which can support local backup and remote backup, and also support timed backup, the NextCloud service will be stopped when backup is performed, so remember to choose the time when there is no synchronization plan.

synchronization

NextCloud itself is integrated into the network disk, notes, photo albums, contacts, mail, calendar, TodoList and other functions, in the mobile terminal also has a wealth of APP support, can completely replace iCloud, millet cloud and other manufacturers of cloud services, after all, their digital assets or in their own hands the most peace of mind.

Common files, pictures, notes, etc. can be synchronized directly to your own NAS at home through NextCloud's series of apps, safely and securely.

iOS

Contacts and calendar synchronization for iPhone and iPad is still relatively simple and convenient as you can add addresses and accounts directly in Contacts and Calendar in the system settings.

android

Android phones need to install DAVx⁵ this APP to synchronize, but compared to the iPhone, through the DAVx⁵ in addition to synchronization of contacts and calendars, but also can synchronize Tasks (ToDoList), it is an unexpected pleasure. DAVx⁵ is just a synchronization DAVx⁵ is just a synchronization tool, Tasks can be used on Android phones through jtxBoard, OpenTasks or Tasks in any of them, more recommended jtxBoard, including diary, notes and Tasks, can be synchronized to NextCloud.

Digital Life

In "Three Bodies", it is written that higher dimensional beings look at us as a painting left behind by the points formed by our life trajectories, which is indeed the case, in this digital age, we will leave countless data and countless points in our life, instead of worrying about the data in the cloud that this project is offline and that company is running away, it is better to hold these important life trajectories in our own hands. The NAS contains my preferences, my interests, and my life data.

Hands-on tutorials, online collaborative Office all in one click, UnRiad+NextCloud-AIO

Fri, 20 Dec 2024 15:12:26 GMT

Recently, I've been working on a project with a friend, so I'm planning to build a powerful self-hosted collaboration platform. We chose NextCloud for two reasons: firstly, it has a wide range of features, including task boards, Office suite, and ToDoList management; and secondly, each of the features is equipped with corresponding mobile apps, which allows us to advance the project process anytime, anywhere.

Previously also installed Docker's NextCloud in UnRaid, but it is not a good realization of the Office function, there are always a variety of problems. Recently found NextCloud official launched All In One solution, claiming to solve the office problem, but also comes with antivirus bottom and other more enhanced features, just this time to try.

mountings

Search for NextCloud in the UnRaid app market and you will find "nextcloud-aio-mastercontainer", which is not NextCloud itself, but the installer of NextCloud-AIO, which is specially labeled as the official version. This is not the NextCloud itself, but the NextCloud-AIO installer, which is specially labeled as the official version.

Before installing, you will be prompted to enable "Keep user-defined network" in UnRaid's Docker settings.

Clicking OK takes you to the configuration page for the installer container, where many of the less commonly used options are hidden. Click More Settings below to see more.

AIO webui" is the intranet access port of the installer, and "Nextcloud apache port" is the actual access port of NextCloud, which requires domain name resolution and reverse proxy in advance. This port is required for domain name resolution and reverse proxy, the default is 11000, these two ports can be modified according to your network environment. These two ports can be modified according to your own network environment:

https://www.foundersjp.com/zh/digital-life-zh/no443luckycloudflare/

"NextCloud Data Directory" is the path where NextCloud's files are stored in the host, for UnRaid, except for the location here, you don't need to change anything else. The bottom "Skip domain check" is to skip the domain check, if you are sure that the domain pointing to the reverse generation has been bound, this item can be selected ture. click on the application to start pulling the image, and then you can see the installer in the Docker page of UnRaid.

Installation Options

When you open the installer, the system automatically generates a phrase which is the password for the first login.

After logging into the NextCloud-AIO installer, the first thing you need is to verify the domain name, which is the reverse proxy domain name that was previously pointing to 11000.

After that comes the installation options, from top to bottom:

antivirus engine

Office Components

Full-text search component

Image Viewer

chat tool

Provision of recording services for chat tools

Docker Agent Manager

tabula rasa

Here according to their own needs to choose to install the components, of which "Docker Agent Manager" NextCloud official Git specifically stated that " not recommended for use in the AIO ". After selecting the components, you need to save them. Click "Download and start containers" to start the download and installation. This is a long process, go back to UnRaid's Docker page and refresh the page, you can see a few new containers appear.

Completion of the installation

At this point the NextCloud-AIO installation is complete, all containers will be randomly generated after the completion of the startup of the initial password for the admin account, through this password you can happily log in to use.