# Tencent Cloud Mirror & Firewall Quick Reference

## Mirror URLs

### apt (system default on Tencent Cloud Ubuntu)
```
deb http://mirrors.tencentyun.com/ubuntu noble main restricted universe multiverse
deb http://mirrors.tencentyun.com/ubuntu noble-updates main restricted universe multiverse
deb http://mirrors.tencentyun.com/ubuntu noble-security main restricted universe multiverse
```

### Docker
```bash
# Docker CE repo
echo "deb [arch=amd64] https://mirrors.cloud.tencent.com/docker-ce/linux/ubuntu noble stable" | sudo tee /etc/apt/sources.list.d/docker.list

# Docker Hub mirror
sudo tee /etc/docker/daemon.json << 'EOF'
{"registry-mirrors": ["https://mirror.ccs.tencentyun.com"]}
EOF
sudo systemctl restart docker
```

### pip
```bash
pip install -i https://mirrors.cloud.tencent.com/pypi/simple <package>
```

## Firewall Configuration

### Light Server (轻量应用服务器)
Path: 控制台 → 轻量应用服务器 → 实例详情 → 防火墙

Required rules:
```
应用类型    协议    端口    来源        策略
HTTP       TCP    80     所有IP地址    允许
HTTPS      TCP    443    所有IP地址    允许
自定义     TCP    <app>  所有IP地址    允许  ← your app port if needed
```

### CVM
Path: 控制台 → 云服务器 → 安全组 → 入站规则

Same rules as above but under "安全组" instead of "防火墙".

## Domain Pricing (Tencent Cloud, 2025-2026)

| TLD | First Year | Renewal | Notes |
|-----|-----------|---------|-------|
| `.top` | ¥9 | ~¥26 | Cheapest long-term |
| `.cn` | ¥29 | ~¥39 | Requires real-name auth |
| `.com` | ¥55 | ~¥75 | Standard choice |
| `.chat` | varies | varies | Niche but distinctive |
| `.xyz` | ¥6 | ~¥60-80 | ⚠️ Cheap first year, expensive renewal |
| `.io` | ~¥270 | ~¥300 | Overpriced for most projects |
| `.ai` | ~¥500 | ~¥550 | Very expensive |

## SSL Certificate Types (Tencent Cloud Free)

| Type | Duration | Validation | Notes |
|------|----------|-----------|-------|
| TrustAsia DV | 3 months | DNS auto-verify | Free, renewable |
| TrustAsia DV | 1 year | DNS auto-verify | Sometimes available |

Download format: Nginx → produces `domain_bundle.crt` and `domain.key`

## Common Diagnostic Commands

```bash
# Check if app is running
curl -s http://127.0.0.1:5000/health

# Check Nginx listening interfaces (must show 0.0.0.0, NOT 127.0.0.1)
sudo ss -tlnp | grep -E "80|443"

# Test local HTTPS
curl -sk https://127.0.0.1/health

# Check DNS resolution
dig +short your-domain.com
nslookup your-domain.com

# Check iptables (local firewall — usually empty on Tencent Cloud)
sudo iptables -L INPUT -n
sudo ufw status

# Check public IP
curl -s http://httpbin.org/ip
```