Deploying OpenBSD on DigitalOcean for ~$4/Month

By Nil

My personal website is now powered by OpenBSD, utilizing httpd(8) and managing SSL certificates via acme-client(1) for Let's Encrypt.

In the past, I relied on GitHub Pages and later Cloudflare Pages. While those platforms are free and effortless, I found myself longing for the "do-it-yourself" spirit of the early web. For those of us who code professionally, the temptation to avoid computers after work is strong, but I missed the tactile experience of configuring UNIX systems and uncovering the inner workings of a machine.

In fact, a FreeBSD UNIX shell account forum is where I met one of my best friends over two decades ago. To recapture that feeling, I've put together this guide on running OpenBSD on DigitalOcean.

The Cost

The base price is 4/month, though the actual total is slightly higher: $$\text{Total} = \4.00 + \text{tax} \approx $4.24$$

---

🛠️ Deployment Workflow

Step 1: Acquiring OpenBSD

The most efficient path is to use the miniroot image. You can fetch it and its checksum using the following commands:

# Download the image and the SHA256 checksum
curl -O -O https://cdn.openbsd.org/pub/OpenBSD/7.9/arm64/{miniroot79.img,SHA256}

# Verify the integrity of the download
sha256sum -c --ignore-missing SHA256 miniroot79.img

Expected output: miniroot79.img: OK

Step 2: DigitalOcean Image Upload

Once you have an account, navigate to the STORAGE section in the left sidebar and select Backups Snapshots.

1. Distribution: Choose Other (it's a shame DigitalOcean doesn't have a native BSD option!).
2. Name: Give it a descriptive label, such as OpenBSD miniroot79.

[!WARNING] Cost Alert: DigitalOcean charges for storing custom images. To avoid unnecessary fees, delete the image once your server is successfully deployed.

Step 3: Provisioning the Droplet

Head to the COMPUTE section and click Droplets. I recommend the following specifications:

Important Configuration Notes:

• Image: Select the miniroot79.img you uploaded.
• SSH Keys: You must select a key to proceed, even though DigitalOcean doesn't actually inject it into the image.
• Networking: Note that creating the droplet with IPv6 enabled currently does not work.

Step 4: The Installation Process

Launch the Web Console from the top right of your droplet page. After the modal pop-up, you'll be dropped into the miniroot79.img shell.

Configuration Guide:

• General: Most prompts can be accepted with the default values.
• Network: Select [done] for now; additional interfaces can be tweaked later.
• SSH: Ensure you enable sshd(8) so you can access the machine remotely.
• Encryption: If you want full disk encryption, choose p.

Note on Encryption: Choosing this means you must manually enter the passphrase via the DigitalOcean web console every time the server reboots. OpenBSD lacks an fdesetup authrestart equivalent, making kernel updates slightly more tedious. There are also potential security concerns regarding typing passwords into a web-based console.

Software Sets:

Choose the mirror closest to your datacenter. To keep the server lean, I recommend removing the following:

• game (-gam*)
• compiler (-com*)

This leaves you with the essentials: bsd, bsd.rd, base79.tgz, and man79.tgz.

Once the signatures are verified and the sets are downloaded (and the passphrase entered, if applicable), the system will reboot.

Step 5: Finalizing Access

After the system boots, you can transition from the Web Console to a standard SSH session.

Remember: Log in using the non-root user created during setup, as root SSH login is disabled by default.

Post-Installation Checklist

• Read the OpenBSD Handbook regarding Post-Installation Configuration.
• Copy your public SSH key to the server.
• Disable PasswordAuthentication in sshd_config.

If you have any questions or just want to say hi, feel free to reach out! You can find my contact info on my homepage, which is proudly hosted on this very setup.