OpenBSD 7.0 Released

Enjoy!

puffy$ uname -a
OpenBSD puffy.darkstar.home 7.0 GENERIC.MP#232 amd64

https://www.openbsd.org/

Thanks for the 'heads up'.

Upgraded from 6.9 to 7.0 on my Raspberry Pi 4 using sysmerge, flawlessly and fairly quickly.

Still using UEFI firmware from https://github.com/pftf/RPi4, v1.31, not U-boot. I've heard some people are having trouble with U-boot, so sticking with what I've have until I make the time to figure out how to get this booting with U-boot from eMMC.

The desktop box that I had 6.9 on went kaput. It might be awhile before I get some x86_64 gear to install 7.0 on.

TKS

I migrated my last own FreeBSD server - I'm still root on one which belongs to a local community - to OpenBSD (7.0) just a few days ago so I could circumvent a few annoyances with FreeBSD's recent reliability. While the installation went smoothly as always (I have been running OpenBSD on a few machines for a few years now), I had the dubious pleasure to learn two new things.

The FreeBSD server was the one which hosts both my IRC bouncer (a ZNC - I have been using one for more than 10 years now) and quite a lot of mixed services behind various domains, some involving PHP, others involving a Perl script running on a port, some even only being one HTML file.

First lesson learned: ZNC does not play well with OpenBSD, even if your configuration worked just fine on FreeBSD. As far as I could find out, using the same listener for IPv4 and IPv6 will fail because Perl's IO::Socket(::SSL) package is incompatible with OpenBSD, so using ZNC with both IPv4 and IPv6 on OpenBSD will require you to install the p5-IO-Socket-SSL package instead and to create a second listener, one for IPv4, one for IPv6. (The other parameters, including the port, can be copy&pasted just well. Try to find this problem yourself!)

Second lesson learned: If you used the Caddy web server on FreeBSD because you are lazy (I am!), prepare for the impact. Caddy is not packaged for OpenBSD (or is it?), and while OpenBSD's own httpd with the accompanying relayd is a pretty solid piece of software, migrating your configuration will try to break your neck once you have a more complicated setting than "just serve these HTML files" and "pass all .php files to php-fpm.sock". If you ever want to run more than one web application (running on different ports/sockets) behind HTTPS, you are strongly advised to just use httpd.conf for the very basics (i.e. a "default" server which serves Let's Encrypt requests), put everything else on separate ports on your loopback device and let relayd take care of everything else. Beware: httpd.conf must not refer to the SSL certificates anymore then (because if it does, relayd will reliably fail to call the particular site; or at least it did for me). It's all HTTP + relayd now.

Ugh.

At least relayd plays well with acme-client, so it can easily pick up my SSL certificates - no automatisms here, I liked them a lot with Caddy - by their name.

(Long story short: OpenBSD can easily be configured to be a very fine mail server and an adequate web server - but using it as a web application server for more than just your random PHP blog will cost you most of your precious sanity if you want to stick with what's already installed; until you understand what's going on where and why, that is. Not sure if it was worth it, but at least I'm confident that it will run rather reliably now. OpenBSD does have its merits.)

Originally Posted by YesItsMe Caddy is not packaged for OpenBSD (or is it?)

It hasn't been ported, nor has a WIP version been discussed on the ports@ mailing list.

I have deployed httpd(8) with Wordpress in the past, so I have some bits of familiarity with using it with PHP and acme-client. Wordpress is designed for Apache, and it would have been easier for me if I'd deployed that webserver instead. But I wanted to make it work with httpd, as a personal exercise, and I had some success. But it was a single website, and was not deployed with relayd(8).

httpd with php-fpm is rather easy.
httpd with php-fpm, a few random applications listening on different ports, all accessible over HTTPS on port 443, not so much.

At least I know that now.

Syspatches 1-3 are available for OpenBSD 7.0 for all architectures.

https://www.openbsd.org/errata70.html

Just installed OpenBSD 7.0 with X. Installed enlightenment Looking for a dark theme. The bright screen is too much. How to start E?

Hi! Disclaimer: I've never used enlightenment.

Window managers are started from your ~/.xsession script. Looking at the output of `$ pkg_info -L enlightenment` I can see there's a "starte16` script in /usr/local/bin. So, edit (or create) your .xsession file, and have the last line be `exec starte16`.

Your solution worked! Thank you jggimi. From your reply I just learned about the .xsession script, and "pkg_info -L" is very useful.

Syspatches 4-6:
https://www.openbsd.org/errata70.html

Syspatches 7 and 8 for all architectures.

Originally Posted by YesItsMe Syspatches 7 and 8 for all architectures.

Thanks. Applied.

i just installed 7.0, looks nice, i decided to install gnome-shell, works nicely.

Patch 9 (all architectures) and 10 (amd64) are out, fixing some security problems with libexpat (9) as well as the reliability of virtualized processes (10).