This blog now served by OpenBSD!

Install OpenBSD

I decided to follow Tubsta's article to install OpenBSD on a DigitalOcean droplet.

Configure httpd

Configuring httpd to serve my blog (a bunch of static files, generated by Pelican) was a piece of cake. Here's the complete configuration file:

# /etc/httpd.conf
# "egress" means "use the interface of the default route"
ext_if="egress"
# A simple macro defining my domain name. DRY
domain="tribaal.io"
# Run 6 child processes. The default is 3, and since I have plenty
# of RAM, I'm not sacrificing much here.
prefork 6
# Set mime type according to the file name.
types { include "/usr/share/misc/mime.types" }
server $domain {
    listen on $ext_if tls port 443
    # Enable HTTP Strict Transport Security (defaults to 1 year).
    hsts
    # The webroot folder (where the static content will be served from).
    # This is in a chroot under /var/www/
    root "/htdocs/tribaal.io"
}
server $domain {
    listen on $ext_if port 80
    # Redirect non-SSL connections to the SSL endpoint.
    block return 301 "https://$SERVER_NAME$REQUEST_URI"
}

Adding SSL certificates

My freshly renewed certificate in hand (thanks, Gandi!), I simply put the files in the default httpd locations (since that's the only SSL service running on the machine):

# Make a combined cert with gandhi's intermediate and my own certificate
cat server.crt > combined.crt
cat GandiStandardSSLCA2.pem >> combined.crt
mv combined.crt /etc/ssl/server.crt
mv server.key /etc/ssl/private/server.key

The default configuration, plus adding the hsts stanza in the configuration file will get you an A+ grade on SSLlabs.

Add the actual blog files

Of course, I needed to scp my blog files to the correct place in the /var/www/htdocs/tribaal.io/ folder.

Enable httpd

By default, nothing runs on your OpenBSD install - so simply run the following as root to get httpd running:

# Enable running the service
echo 'httpd_flags=""' >> /etc/rc.conf.local
# Actually run the service
/etc/rc.d/httpd start

Edit: As Mischa Peters pointed out on twitter, the more canonical way to achieve this in OpenBSD would be to use:

rcctl enable httpd # Enable the service to run
rcctl start httpd # Actually start the service

And that's it!

That's all. Piece of cake :)