GoWiki | openbsd

# OpenBSD httpd

Enable and start service:

```
rcctl enable httpd
rcctl start httpd
```

## pf Rules

```
cat <<EOF>> /etc/pf.conf
pass in on egress proto tcp to any port http
pass in on egress proto tcp to any port https
EOF
pfctl -f /etc/pf.conf
```

## vHosts

httpd config file: `/etc/httpd.conf`

### TLS vHost

Certificate using acme. More info at [OpenBSD Lets Encrypt](/openbsd/Lets+Encrypt)

```
domain="example.com"

server $domain {
  listen on * port 80
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
  location "/*" {
    block return 301 "https://$SERVER_NAME$DOCUMENT_URI"
  }
}

server $domain {
  listen on * tls port 443
  tls {
    certificate "/etc/ssl/example.com.fullchain.pem"
    key "/etc/ssl/private/example.com.key"
    ciphers "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256:ECDHE+AESGCM+AES256:ECDHE+CHACHA20:ECDHE+AESGCM+AES128"
    ecdhe "X25519:secp384r1:secp521r1"
  }
  hsts { max-age 31536000, subdomains }
  location "/" {
    directory auto index
  }
}
```
## robots.txt

Create the robots.txt file:

```
cat <<EOF> /var/www/htdocs/robots.txt
User-agent: *
Disallow: /
EOF
```

Add this to your httpd.conf:

Note: this needs to be the first `location` inside your `server`-section.

```
location "/robots.txt" {
  root "/htdocs"
}
```

## maintenance.html

Create the maintenance.html file:

```
cat <<EOF> /var/www/htdocs/maintenance.html
<!doctype html>
<html>
<head>
  <title>Site Maintenance</title>
  <style>
    body { text-align: center; padding: 150px; font: 20px Helvetica, sans-serif; color: #333; }
    article { display: block; text-align: left; width: 650px; margin: 0 auto; }
    h1 { font-size: 50px; }
  </style>
</head>
<body>
  <article>
    <h1>We will be back soon!</h1>
    <p>Sorry for the inconvenience but we are performing some maintenance at the moment. We will be back online shortly!</p>
    <p>The Team</p>
  </article>
</body>
</html>
EOF
```

Add this below your `robots.txt` or make it the first `location` inside your `server`-section:

```
location "/maintenance.html" {
  root "/htdocs"
  #block return 302 "https://$SERVER_NAME"
}
location "*" {
  block return 302 "https://$SERVER_NAME/maintenance.html"
}
```

To disable the maintenance mode make the locations look like this and restart the webserver `rcctl restart httpd`:

```
location "/maintenance.html" {
  root "/htdocs"
  block return 302 "https://$SERVER_NAME"
}
#location "*" {
#  block return 302 "https://$SERVER_NAME/maintenance.html"
#}
```