bozohttpd.rocks

---

Setup a simple web server with bozohttpd on NetBSD.

If you’d prefer to use OpenBSD, check out httpd.rocks.

If you’d prefer to use something like Caddy instead, check out caddy.ninja.

---

• Before You Begin…

• Prep Your Domain(s)

• Website Files

• Configuring inetd.conf

• Start bozohttpd

• Setup HTTPS

  • Configuring acme-client.conf

  • Tweaking Permissions

  • Running a Daily cronjob

• Updating inetd.conf to Support HTTPS

• What About Multiple Websites?

  • Updating acme-client.conf

  • Symlink to the Rescue!

  • Updating inetd.conf

  • Editing rc.conf

Before You Begin…

This guide assumes you have already setup NetBSD on your desired server of choice. If you need help setting up NetBSD on a VPS, check out the official guide here.

Most commands will need to run via doas, since you should be logged in as a created user and never root directly. You might need to install doas from packages FYI.

All the examples in this guide use bozo.httpd.rocks for the domains (how meta…). Please remember to change this to your desired URL.

Prep Your Domain(s)

Make sure your DNS records are setup and working as intended with your desired domain. You can check their status with:

dig bozo.httpd.rocks

Website Files

Place your website files in the proper directory. For this guide we will be placing all files into /var/www/bozo.httpd.rocks.

Configuring inetd.conf

inetd executes a fresh httpd per connection, so it reads the cert files at the start of every request. (Not the best for performance, but for our simple requirements it’s fine!)

Place the following in your /etc/inetd.conf file:

http    stream  tcp nowait:600  _httpd  /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks

Start bozohttpd

Start bozohttpd on port 80 only. We don’t need to worry about TLS right now.

We start the web server by reloading inetd, since that is where we call it:

/etc/rc.d/inetd restart

Setup HTTPS

First, we need to install acme-client from packages:

pkgin install acme-client

Next we create all the directories / sub-directories that will be required in the following steps:

mkdir -p /etc/acme
mkdir -p /var/www/bozo.httpd.rocks/.well-known/acme-challenge
mkdir -p /etc/openssl/private
chmod 700 /etc/openssl/private

Configuring acme-client.conf

Write to /usr/pkg/etc/acme-client.conf. Make sure to change the domain and directory path to match your own!

authority letsencrypt {
    api url "https://acme-v02.api.letsencrypt.org/directory"
    account key "/etc/acme/letsencrypt-privkey.pem"
}

domain bozo.httpd.rocks {
    domain key "/etc/openssl/private/bozo.httpd.rocks.key"
    domain full chain certificate "/etc/openssl/certs/bozo.httpd.rocks.fullchain.pem"
    sign with letsencrypt
    challengedir "/var/www/bozo.httpd.rocks/.well-known/acme-challenge"
}

Now we can get the certs:

acme-client -vAD bozo.httpd.rocks

If everything worked correctly, those new key and pem files should exist. Feel free to double check:

ls -l /etc/openssl/private/bozo.httpd.rocks.key /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem

Important: Before moving on, we need to:

1. Tweak the permissions of our cert files to avoid unwanted errors

2. Setup a simple cronjob to check our cert expiry dates daily

Tweaking Permissions

doas chown root:wheel /etc/openssl/private/bozo.httpd.rocks.key
doas chmod 600 /etc/openssl/private/bozo.httpd.rocks.key
doas chgrp wheel /etc/openssl/private
doas chmod 700 /etc/openssl/private

Running a Daily cronjob

You’ll want to setup this cron entry under root:

doas crontab -e

Then setup something simple:

0 3 * * * acme-client bozo.httpd.rocks

Updating inetd.conf to Support HTTPS

Return to the original inetd.conf file and include support for https:

http    stream  tcp nowait:600  _httpd  /usr/libexec/httpd httpd /var/www/bozo.httpd.rocks
https   stream  tcp nowait:600   root   /usr/libexec/httpd httpd -U _httpd -Z /etc/openssl/certs/bozo.httpd.rocks.fullchain.pem /etc/openssl/private/bozo.httpd.rocks.key /var/www/bozo.httpd.rocks

You might have noticed that we use root user for the https instance. This is required to avoid issues with running our acme-client job above.

Now restart inetd one last time:

/etc/rc.d/inetd restart

That’s it! Enjoy your web server!

---

What About Multiple Websites?

Don’t worry! I’ve got you covered. The following assumes you completed everything above this section.

Updating acme-client.conf

We will make a new key/pem pair (calling it websites) that will be shared across all of our hosted domains. The first step is to include these “alternate” domains inside our acme-client.conf file:

authority letsencrypt {
    api url "https://acme-v02.api.letsencrypt.org/directory"
    account key "/etc/acme/letsencrypt-privkey.pem"
}

domain bozo.httpd.rocks {
    domain key "/etc/openssl/private/websites.key"
    domain full chain certificate "/etc/openssl/certs/websites.fullchain.pem"

    alternative names {
        example.com
        example.org
        example.net
    }

    sign with letsencrypt
    challengedir "/var/www/acme"
}

Symlink to the Rescue!

You’ll need to “trick” acme-client (in the next steps) into targeting the shared .well-known directory. This will need to be done for each domain:

doas mkdir -p /var/www/example.com/.well-known
doas ln -sf /var/www/acme /var/www/example.com/.well-known/acme-challenge

Updating inetd.conf

We need to slightly tweak our existing inetd.conf file and utilize bozohttpd’s -v & -V parameters:

http    stream  tcp nowait:600  _httpd  /usr/libexec/httpd httpd -v /var/www -V default /var/www/default

Also be sure to remove the specific https line entirely. After making those changes you can restart inetd:

doas /etc/rc.d/inetd restart

And now run through acme-client to grab the new certs:

doas acme-client -v bozo.httpd.rocks

Editing rc.conf

Now we make some simple adjustments to our /etc/rc.conf file:

httpd=YES
httpd_flags="-v /var/www -V -U _httpd -Z /etc/openssl/certs/websites.fullchain.pem /etc/openssl/private/websites.key"
httpd_wwwdir="/var/www/default"

and reload that as well:

doas /etc/rc.d/httpd restart

Congrats! You are now hosting multiple websites through bozohttpd!

---