bozohttpd rocks - Setup a simple web server with bozohttpd on NetBSD
bozohttpd.rocks
Setup a simple web server with bozohttpd on NetBSD.
If you’d prefer to use OpenBSD, check out httpd.rocks.
If you’d prefer to use something like Caddy instead, check out caddy.ninja.
Before You Begin…
Prep Your Domain(s)
Website Files
Configuring inetd.conf
Start bozohttpd
Setup HTTPS<br>Configuring acme-client.conf
Tweaking Permissions
Running a Daily cronjob
Updating inetd.conf to Support HTTPS
What About Multiple Websites?<br>Updating acme-client.conf
Symlink to the Rescue!
Updating inetd.conf
Editing rc.conf
Before You Begin…
This guide assumes you have already setup NetBSD on your desired server of choice. If you need help setting up NetBSD on a VPS, check out the official guide here.
Most commands will need to run with elevated permissions. For this we will use NetBSD’s priv. You will need to install priv from packages.
Make sure you create a file for your user entry under /usr/pkg/etc/priv/your-username:
# run as root for any command<br>0:root:01160:
All the examples in this guide will use bozo.httpd.rocks for the domains (how meta…). Please remember to change this to your desired URL.
Prep Your Domain(s)
Make sure your DNS records are setup and working as intended with your desired domain. You can check their status with:
dig bozo.httpd.rocks
Website Files
Place your website files in the proper directory. For this guide we will be placing all files into /var/www/bozo.httpd.rocks.
Configuring inetd.conf
inetd executes a fresh httpd per connection, so it reads the cert files at the start of every request. (Not the best for performance, but for our simple requirements it’s fine!)
Place the following in your /etc/inetd.conf file:
http stream tcp nowait:600 _httpd /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks
Start bozohttpd
Start bozohttpd on port 80 only. We don’t need to worry about TLS right now.
We start the web server by reloading inetd, since that is where we call it:
/etc/rc.d/inetd restart
Setup HTTPS
First, we need to install acme-client from packages:
pkgin install acme-client
Next we create all the directories / sub-directories that will be required in the following steps:
mkdir -p /etc/acme<br>mkdir -p /var/www/bozo.httpd.rocks/.well-known/acme-challenge<br>mkdir -p /etc/openssl/private<br>chmod 700 /etc/openssl/private
Configuring acme-client.conf
Write to /usr/pkg/etc/acme-client.conf. Make sure to change the domain and directory path to match your own!
authority letsencrypt {<br>api url "https://acme-v02.api.letsencrypt.org/directory"<br>account key "/etc/acme/letsencrypt-privkey.pem"
domain bozo.httpd.rocks {<br>domain key "/etc/openssl/private/bozo.httpd.rocks.key"<br>domain full chain certificate "/etc/openssl/certs/bozo.httpd.rocks.fullchain.pem"<br>sign with letsencrypt<br>challengedir "/var/www/bozo.httpd.rocks/.well-known/acme-challenge"
Now we can get the certs:
acme-client -vAD bozo.httpd.rocks
If everything worked correctly, those new key and pem files should exist. Feel free to double check:
ls -l /etc/openssl/private/bozo.httpd.rocks.key /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem
Important : Before moving on, we need to:
Tweak the permissions of our cert files to avoid unwanted errors
Setup a simple cronjob to check our cert expiry dates daily
Tweaking Permissions
priv chown root:wheel /etc/openssl/private/bozo.httpd.rocks.key<br>priv chmod 600 /etc/openssl/private/bozo.httpd.rocks.key<br>priv chgrp wheel /etc/openssl/private<br>priv chmod 700 /etc/openssl/private
Running a Daily cronjob
You’ll want to setup this cron entry under root:
priv crontab -e
Then setup something simple:
0 3 * * * acme-client bozo.httpd.rocks && /etc/rc.d/inetd restart
Updating inetd.conf to Support HTTPS
Return to the original inetd.conf file and include support for https:
http stream tcp nowait:600 _httpd /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks<br>https stream tcp nowait:600 root /usr/libexec/httpd httpd -U _httpd -Z /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem /etc/openssl/private/bozo.httpd.rocks.key /var/www/bozo.httpd.rocks
You might have noticed that we use root user for the https instance. This is required to avoid issues with running our acme-client job above.
Now restart inetd one last time:
/etc/rc.d/inetd restart
That’s it! Enjoy your web server!
What About Multiple Websites?
Don’t worry! I’ve got you covered. The following assumes you completed everything above this section.
Updating acme-client.conf
We will make a new key/pem pair (calling it websites) that will be shared across all of our hosted domains. The first step is to include these “alternate” domains inside our acme-client.conf file:
authority letsencrypt {<br>api url "https://acme-v02.api.letsencrypt.org/directory"<br>account key "/etc/acme/letsencrypt-privkey.pem"
domain bozo.httpd.rocks {<br>domain key "/etc/openssl/private/websites.key"<br>domain full chain certificate...