Openbsd

OpenBSD Installation and Setup Guide

At the time of this writing, OpenBSD's release version is 7.1. OpenBSD 7.1 does not have golang 1.18 packaged, so it's not possible to compile mycorrhiza on a stable OpenBSD host. OpenBSD-current has golang 1.18 and the next OpenBSD release will as well.

Cross-compiling for OpenBSD

You'll need another host with go 1.18. I used a shared machine at http://sdf.org. The current mycorrhiza makefile assumes that the building os/arch is the same as the target os/arch, so we have to run the generate and build separately:

On your go 1.18 machine:

git clone http://git.sr.ht/~bouncepaw/mycorrhiza
cd mycorrhiza
# Generate must be run with current GOOS and GOARCH intact
go generate
# Compile a static binary that will run under OpenBSD.
# Change GOARCH if your target isn't x86_64
GOOS=openbsd GOARCH=amd64 CGO_ENABLED=0 go build -o mycorrhiza.openbsd .
# Copy static binary to OpenBSD host
scp mycorrhiza.openbsd <openbsd-host>:/tmp

La_ninpre's port

La_ninpre maintains a port:

https://git.aaoth.xyz/ports.git/tree/misc/mycorrhiza

Installation for personal use

mkdir ~/bin # You can also copy the binary to another directory in your path
cp /tmp/mycorrhiza.openbsd ~/bin/mycorrhiza

Now you may continue with the quickstart.

Installation for public server use

Add a Dedicated User

On your OpenBSD machine, you'll want to create a new user to run mycorrhiza:

useradd -m wiki  # Add user
doas -u wiki -s # Switch to new user
cd # enter ~wiki directory
mkdir bin # Move in the mycorrhiza binary to a location reachable by wiki user
cp /tmp/mycorrhiza.openbsd bin/mycorrhiza
# Generate a new wiki
./bin/mycorrhiza wikidata

CTRL-C to quit mycorrhiza for now.

Running mycorrhiza at startup

To have mycorrhiza start at startup, you'll want to create an rc script. As the root user, create the file /etc/rc.d/mycorrhiza with the following contents:

#!/bin/ksh

daemon="/home/wiki/bin/mycorrhiza"
daemon_flags="/home/wiki/wikidata &"

. /etc/rc.d/rc.subr

rc_cmd $1

Then a few settings:

chmod +x /etc/rc.d/mycorrhiza # Make the script executable
# Set the mycorrhiza binary to run as the user wiki
rcctl set mycorrhiza user wiki
# Enable starting mycorrhiza automatically at startup
rcctl enable mycorrhiza
# Start mycorrhiza now
rcctl start mycorrhiza

You should be able to access mycorrhiza now. From the OpenBSD host:

ftp -o - http://localhost:1737 # HTML output on console

or from another machine, you can forward the port and access with a web browser;

ssh -L1737:localhost:1737 <openbsd.hostname>
# Leave the shell open
# Open browser on local machine and point at http://localhost:1737/

httpd and relayd setup for port 80,443

Sample /etc/httpd.conf:

server "changeme.com" {
        listen on * port 80
        # Support acme-client for Let's Encrypt certificates
        location "/.well-known/acme-challenge/*" {
                root "/acme"
                request strip 2
        }
        # Redirect other traffic to relayd for tls offload and 
        # privileged port access
        location * {
                block return 302 "https://$HTTP_HOST$REQUEST_URI"
        }
}

Sample /etc/relayd.conf:

# Change to your external ip
ip4="x.x.x.x"
domain="changeme.com"

table <wiki> { 127.0.0.1 }
log connection

http protocol https {
        match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
        match request header append "X-Forwarded-By" \
            value "$SERVER_ADDR:$SERVER_PORT"
        match request header set "Connection" value "close"
        tcp { sack, backlog 128 }
        # This sets the prefix for the tls cert and key relayd looks for
        # in the /etc/ssl directory. If you already have a cert following
        # the acme-client.conf default template, you'll need to
        # symlink /etc/ssl/changeme.com.fullchain.pem -> 
        #    /etc/ssl/changeme.com.crt
        tls { keypair $domain }
}

relay wwwtls {
        listen on $ip4 port 443 tls
        protocol https
        forward to <wiki> port 1737
}

Sample /etc/acme-client.conf:

authority letsencrypt {
	api url "https://acme-v02.api.letsencrypt.org/directory"
	account key "/etc/acme/letsencrypt-privkey.pem"
}

domain changeme.com {
	domain key "/etc/ssl/private/changeme.com.key"
	domain full chain certificate "/etc/ssl/changeme.com.crt"
	sign with letsencrypt
}

🍄:Openbsd