Setup a Simple, Self-Hosted Web Server with OpenBSD

查看原文 / View Original 编辑 / Edit

Setup a Simple, Self-Hosted Web Server with OpenBSD

使用 OpenBSD 搭建简单的自托管 Web 服务器

2026-07-18 This website is being served to you from my HP T630 thin client, running OpenBSD and httpd. Pretty cool, right? And best of all you can do the same! I’m going to walkthrough how to host your own websites locally on OpenBSD. This guide is going to be kept simple on purpose, so feel free to expand on it as you see fit! 2026-07-18 本网站由我的 HP T630 瘦客户机提供服务，运行着 OpenBSD 和 httpd。很酷，对吧？最棒的是你也可以做到！我将带你了解如何在 OpenBSD 上本地托管自己的网站。本指南特意保持简单，因此请根据需要随意扩展！

Requirements

要求

Cheap, low spec VPS (checkout Low End Talk for deals). Why the VPS? This will allow us to hide our home IP from the nasty interwebs! Local server (thin client, mini PC box) that can run OpenBSD. Coffee and a positive attitude! 廉价、低配置的 VPS（查看 Low End Talk 获取优惠）。为什么要用 VPS？这能让我们隐藏家庭 IP，避免暴露在复杂的互联网环境中！一台可以运行 OpenBSD 的本地服务器（瘦客户机、迷你 PC）。咖啡和积极的心态！

But wait! I hear you question right away: “If you already have a VPS running OpenBSD, why not just use that to host your website?” And you would be right. But that’s not fun. That’s boring. Isn’t having fun the entire point of working with computers?! But you do whatever you like, I’m not your dad. 等等！我听到你立刻会问：“如果你已经有一台运行 OpenBSD 的 VPS，为什么不直接用它来托管网站呢？”你说得对。但这没意思，太无聊了。玩电脑的意义不就是为了找乐子吗？！当然，你想怎么做都行，我可不是你老爸。

Getting Started

入门

I won’t be covering the details of installing OpenBSD, since the core installer does an excellent job itself. I’ll assume you have base OpenBSD running on both your VPS of choice and your local server. 我不会介绍安装 OpenBSD 的细节，因为核心安装程序本身已经做得非常出色。我假设你的 VPS 和本地服务器都已经运行了基础的 OpenBSD 系统。

Wireguard

Wireguard

First thing we need to do is install Wireguard on both machines: pkg_add wireguard-tools. Then we need to generate both private and public keys (again, on both machines): 首先，我们需要在两台机器上安装 Wireguard：pkg_add wireguard-tools。然后，我们需要生成私钥和公钥（同样是在两台机器上）：

umask 077
wg genkey > private.key
wg pubkey < private.key > public.key

Take note of each machine’s private and public key sets. Make sure to delete these key files once you include them to the configuration files below. 记下每台机器的私钥和公钥。确保在将它们写入下方的配置文件后，删除这些密钥文件。

The VPS

VPS 配置

On the VPS create a new file /etc/hostname.wg0: 在 VPS 上创建一个新文件 /etc/hostname.wg0：

wgkey <VPS_PRIVATE_KEY>
wgport 51820
wgpeer <HOME_PUBLIC_KEY>
wgaip 10.10.0.2/32
inet 10.10.0.1/24

Bring this up right now with sh /etc/netstart wg0. The best part is that this will automatically be persistent. OpenBSD saves us the hassle of needing to setup or enable any kind of “service”. 现在使用 sh /etc/netstart wg0 启动它。最棒的是，它会自动持久化。OpenBSD 省去了我们需要设置或启用任何“服务”的麻烦。

Now we enable forwarding on our VPS: 现在我们在 VPS 上启用转发：

echo 'net.inet.ip.forwarding=1' | doas tee -a /etc/sysctl.conf && doas sysctl net.inet.ip.forwarding=1

And finally, a basic pf.conf to tie everything together: 最后，配置一个基础的 pf.conf 将一切串联起来：

home = "10.10.0.2"
tunnel_ip = "10.10.0.1"
set skip on lo
block return
pass out
pass in on egress inet proto tcp to port 22
pass in on egress inet proto udp to port 51820
pass in on egress inet proto tcp to port { 80 443 } rdr-to $home
pass out quick on wg0 inet proto tcp to $home port { 80 443 } nat-to $tunnel_ip
pass on wg0

Load it right away with pfctl -f /etc/pf.conf. Nothing is going to work just yet, but we’re getting there! 立即使用 pfctl -f /etc/pf.conf 加载它。现在还无法工作，但我们快成功了！

The Local Server

本地服务器配置

Now on your home (local) server, create a similar /etc/hostname.wg0: 现在在你的家庭（本地）服务器上，创建一个类似的 /etc/hostname.wg0：

wgkey <HOME_PRIVATE_KEY>
wgpeer <VPS_PUBLIC_KEY>
wgendpoint <VPS-IP> 51820
wgaip 10.10.0.1/32
wgpka 25
inet 10.10.0.2/24

And then bring it up just like the VPS: sh /etc/netstart wg0. Finally, create the local server’s pf.conf. (Feel free to tweak general rules to your liking and be sure to target the appropriate IP range found under the SSH from LAN only section to match your own network.) 然后像 VPS 一样启动它：sh /etc/netstart wg0。最后，创建本地服务器的 pf.conf。（请随意调整通用规则，并确保修改“仅限局域网 SSH”部分的 IP 范围以匹配你自己的网络。）

Basic Web Server

基础 Web 服务器

For this guide we will just make a simple, HTTP-only website. Before going any further, make sure your desired domain has its DNS A Records pointing at your VPS IP. Give it time to propagate and then continue. 在本指南中，我们将只制作一个简单的、仅支持 HTTP 的网站。在继续之前，请确保你的域名 DNS A 记录已指向你的 VPS IP。等待其生效后再继续。

Make our website directory: doas mkdir -p /var/www/htdocs/reallycoolsite.com. Place your website files into this new folder and set proper permissions: 创建网站目录：doas mkdir -p /var/www/htdocs/reallycoolsite.com。将你的网站文件放入此文件夹并设置正确的权限：

doas chmod -R 755 /var/www/htdocs/reallycoolsite.com
doas chown -R www:www /var/www/htdocs/reallycoolsite.com

Create the initial /etc/httpd.conf file: 创建初始的 /etc/httpd.conf 文件：

server "reallycoolsite.com" {
    listen on * port 80
    root "/htdocs/reallycoolsite.com"
}
server "www.reallycoolsite.com" {
    listen on * port 80
    root "/htdocs/reallycoolsite.com"
    block return 301 "http://reallycoolsite.com$REQUEST_URI"
}

Check that the configuration has no errors, then get httpd up and running: 检查配置是否有误，然后启动 httpd：

doas httpd -n
doas rcctl start httpd

And that’s it! You should see your website live (although without HTTPS support for now). Congrats! 就是这样！你应该能看到你的网站上线了（尽管目前还没有 HTTPS 支持）。恭喜！

Give Back to the Community

回馈社区

If you ended up running your own server based on this guide or even found it a little interesting, consider donating to either OpenBSD or Wireguard directly. We wouldn’t have the ability to make awesome stuff like this without the existence these incredible pieces of open software! 如果你最终根据本指南运行了自己的服务器，或者觉得它很有趣，请考虑直接向 OpenBSD 或 Wireguard 捐款。如果没有这些令人难以置信的开源软件，我们将无法做出如此棒的东西！

← 返回新闻列表 / Back to news list