$OpenBSD: README,v 1.2 2019/07/25 02:18:25 lteo Exp $

+-------------------------------------------------------------------------------
| Running honk on OpenBSD
+-------------------------------------------------------------------------------

Initial configuration
=====================

honk expects to be fronted by a TLS terminating reverse proxy.

acme-client(1)
--------------

# acme-client.conf(5)
domain honk.example.com {
  domain key "/etc/ssl/private/honk.example.com.key"
  domain full chain certificate "/etc/ssl/honk.example.com.fullchain.pem"
  sign with letsencrypt
}

Icon and favicon
----------------

honk# mkdir /var/www/htdocs/honk
honk# ftp -o /var/www/htdocs/honk/icon.png https://honk.tedunangst.com/icon.png
honk# ftp -o /var/www/htdocs/honk/favicon.ico \
  https://honk.tedunangst.com/favicon.ico

httpd(8)
--------

# httpd.conf(5)
server "honk.example.com" {
  listen on * port http
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
  location "/*icon.*" {
    root "/htdocs/honk"
  }
  location "*" {
    block return 302 "https://$HTTP_HOST$REQUEST_URI"
  }
}

honk# rcctl enable httpd
honk# rcctl start httpd
honk# acme-client -v honk.example.com

relayd(8)
---------

# relayd.conf(5)
ext_addr="203.0.113.1"
ext_addr6="2001:0db8::1"
honk_port="31337"
table <honk> { 127.0.0.1 }
table <honk6> { ::1 }

http protocol https {
  match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
  match request header append "X-Forwarded-By" \
    value "$SERVER_ADDR:$SERVER_PORT"
  match request header set "Connection" value "close"

  match request path "/*icon.*" forward to <honk>

  tcp { sack, backlog 128 }
}

relay wwwtls {
  listen on $ext_addr port https tls
  protocol https

  forward to <honk> port $honk_port check tcp
  forward to <honk> port http check http "/icon.png" code 200
}

relay wwwtls6 {
  listen on $ext_addr6 port https tls
  protocol https

  forward to <honk6> port $honk_port check tcp
  forward to <honk> port http check http "/icon.png" code 200
}

honk# cd /etc/ssl
honk# ln -s honk.example.com.fullchain.pem 203.0.113.1.crt
honk# ln -s honk.example.com.fullchain.pem 2001:0db8::1.crt
honk# cd /etc/ssl/private
honk# ln -s honk.example.com.key 203.0.113.1.key
honk# ln -s honk.example.com.key 2001:0db8::1.key

honk# rcctl enable relayd
honk# rcctl start relayd

pf(4)
-----

# pf.conf(5)
anchor "relayd/*"

honk# pfctl -f /etc/pf.conf

Usage
=====

Please see /usr/local/share/doc/honk

honk# doas -su _honk
honk$ umask 077; cd /var/honk && honk init
listenaddr: localhost:31337
servername: honk.example.com
honk$ touch /var/honk/savedinbox.json
honk$ exit

honk# rcctl enable honk
honk# rcctl start honk

Honk at https://honk.example.com
