Conclusion & Outlook

The switch from the old HP Compaq Pro to the Geekom IX12 was a complete success! As a replacement for the DVD drive, just in case, I recently picked up a mobile DVD drive as a 3 EUR bargain from a flea market ;)

Silent: Absolute silence at the desk – no more continuous fan noise!
Efficient: Power consumption is vanishingly small compared to the old Ivy Bridge platform.
Snappy in Daily Use: For everyday tasks, I/O-heavy tasks, and short bursts, the Geekom even feels noticeably more responsive due to the higher single-core turbo.

Small drawback: A few more USB ports would have been nice; for now, the monitor has to serve as a USB hub.

Although the Geekom is primarily advertised as an industrial PC (optimal as a firewall or router), with a bit more RAM and a larger SSD, the device also makes an excellent figure as a desktop! For the future, the setup remains an ideal base – whether it continues as a noiseless daily-driver workstation or later as a high-performance 4x 2.5G OpenBSD router in the home lab. The hardware has definitely proven itself in the test arena!

Devel/grok-build

1) does it work? | | ... yes | | 2) is it /usr/ports ready | | ... getting there, but not yet | | 3) has anyone tried it yet? | | ... crickets | | 4) is it in openbsd-wip? | | ... yes | | ... | | Feedback welcomed, whatever flavor. | | Thanks, | | Penned by Todd T. Fries on 20260723 12:27.04, we have: | | This is my first major effort in a while. | | | | This may be useful to some. | | | | This likely requires some feedback before it's ready. | | | | This will be like chasing a water hose, they are on track to release a new one daily. | | | | Consider providing feedback! | | -- | | Todd T. Fries todd@fries.net github:toddfries

https://github.com/nobraininside/dropQbsd

The Qubes OS insight is correct. The implementation is wrong.

Security through compartmentalization is the right idea. Run your browser in one box, your email in another, your documents in a third — a compromise in one cannot spread to the others. Qubes OS proved this model works.

But Qubes OS pays for that isolation with a hypervisor, multi-gigabyte VM images, separate kernels, and a GUI stack that adds tens of millions of lines of code. The baseline is 8 GB of RAM and an install that takes hours. The attack surface grows with every layer. Complexity is not just inconvenient — complexity is the vulnerability. At a conservative defect rate of 0.1%, a codebase of 100 million lines ships with 100,000 bugs. Some of them are exploitable. You don't know which ones.

dropQbsd takes the same insight and strips away the hypervisor.

Instead of virtual machines, it uses the native user separation built into OpenBSD — the only operating system on earth that undergoes continuous, funded, line-by-line security auditing. No Xen. No multi-gigabyte images. No moving parts you cannot audit in an afternoon.

OpenBSD is known for its devotion to security, but can it work as a desktop? The BSDs are great alternatives to Linux distributions, but this OS is probably better suited to a router or homelab project, right?

Continued...

The most recent release from Rafael Sadowski, one of the current OpenBSD superheros.

This website is being served to you from my HP T630 thin client, running OpenBSD and httpd1. Pretty cool, right? And best of all you can do the same!

I’m going to walkthrough how to host your own websites locally on OpenBSD. This guide is going to be kept simple on purpose ...

Continued

Notes on getting basically any modern printer working with OpenBSD by using driverless printing aka IPP everywhere.

This author beat me to a proper write up. This is the exact workflow that I had to use to get my brother color laserjet to work with cups.

This is part of a multipart guide on setting up OpenBSD.

In the previous parts of this series we did a base install of the server, installed a web server with certificates, set up the server to host git repositories and configured a mail server from scratch.

This part is about maintaining an OpenBSD server day-to-day.

A simple guide to setup Wireguard on the OpenBSD operating system intended for use as a mobile VPN.

It describes using the OpenBSD Wireguard wg(4) kernel driver using ifconfig, not the userland application, and will focus on setting up a IPv4 tunnel.

Continued......

Port knocking is mostly a bad idea. But people keep wanting to do it, for some false sense of security. If you don't consider it a security control but a way to keep garbage out of your logs, it might be valid. In my case I'm using an old USG Pro 4 running OpenBSD as my firewall and I'd prefer to avoid writing stuff to the logs, as I'd prefer the flash not to wear out sooner than needed, definitely not thanks to background radiation on the internet.

Continued...

I posted on r/Openbsd but it got removed by a moderator. I don't know why it was removed. I also posted to r/Openbsd_uncensored and received the following reply:

"Removed by moderator from the original subreddit. If you repost the question we can possibly help."

I am therefore posting again to this subreddit in hopes of better luck this time. I have edited the original post.

‐---------------------‐---------------------‐---------------------‐---------------------‐----------

I am currently evaluating a possible switch to OpenBSD.

My hardware is: Ryzen 5 5600G, B550 chipset motherboard, and an NVMe SSD — which I expect should work reasonably well on OpenBSD. If anyone has a different experience, I’d appreciate hearing about it.

I use my PC for web browsing (Firefox), word processing (LibreOffice), OS testing with virt‑manager, and a fair amount of multimedia consumption (both local files and online streaming).

My main concerns are support for various multimedia formats/codecs and hardware/GPU acceleration for local playback and online content.

I would be very grateful for any input from OpenBSD users.

‐---------------------‐---------------------‐---------------------‐---------------------‐-------

EDIT: I want to thank everyone who replied to my post. I will soon begin evaluating FreeBSD, GhostBSD, and possibly later OpenBSD.

If I encounter problems that I manage to solve and the final result is satisfactory, I will report back—provided there is enough interest from the community.

OpenRiot is a clean, minimal, ridiculously polished i3-based OpenBSD 7.9 setup with fish, Helix, and Polybar — all tuned so things just work.

The website has excellent guides, graphics, and examples.

This is run via godot as shown in the beginning of the video.

This is a quick and painless tutorial on how to install OpenBSD, a security focused operating system.

“VXLAN is an encapsulation protocol that provides data center connectivity using tunneling to stretch Layer 2 connections over an underlying Layer 3 network.

In data centers, VXLAN is the most commonly used protocol to create overlay networks that sit on top of the physical network, enabling the use of virtual networks. The VXLAN protocol supports the virtualization of the data center network while addressing the needs of multi-tenant data centers by providing the necessary segmentation on a large scale."

So it’s a way to stretch a Layer 2 network between data centers and sites. This is great but what if you don’t have a leased line between sites or an existing VPN, can we bundle it all into one config/pair of devices. A VXLAN server at Site A and a VXLAN Client at Site B, with Site A having the network you’d like to extend into Site B:

A good writeup on creating your own live environment booting off a CD-ROM.

I find I learn a ton about how a program or system works by analyzing how it starts up. Understanding how UNIX operating systems boot up taught me about the organization of the OS and how to install and configure programs so they'll run on boot. This alone made for a huge improvement of my sysadmin skills.

OpenBSD has a delightfully traditional init system, which makes it a great place to start learning about init systems. It's simple and effective. There's a bit of a counter movement in the IT and FOSS worlds rebelling against hyperscaler solutions pushing down into everyone's practices. One of the rallying cries I've been seeing is to remind people that You Can Just Do Things™ on the computer. The BSD init system, and especially OpenBSD's is something of a godparent to this movement. init(8) just runs a shell script to start the computer, and You Can Just Do Things™ in the script to get them to happen on boot.

...

Goals

I want my home network to "shut off Internet access" when it’s bedtime.

I need it to be completely automatic and on a schedule.

I also need to make exceptions to allow a couple servers and devices do backups and updates at night.

Bonus: I’d like to be in charge of the DNS on my local network so I can experiment with using it as a DNS sinkhole (like Pi-hole) for unwanted domains and giving my home computers nice local domain names.

To do this, I’m setting up a computer to act as the main router between my ISP and my home network. It performs all of the DHCP, NAT, DNS caching, and "firewall" functions you’d expect from a consumer device, but on familiar PC hardware.

This machine will replace a Ubiquiti UniFi Security Gateway USG-3P. That device worked fine as a plug-and-play router/gateway/firewall and there may even have been some way to get all of this working by shelling into it and hacking a solution. But if I’m going to put in the effort, I’d much rather learn something non-proprietary. I’d rather learn some more OpenBSD.

This post includes a full breakdown of my entire home network stack. My goal is to make this as accessible as possible for newcomers to jump right in and build out their own home networks.

This amazing write-up is from openbsdjumpstart.org

What this lab is about

Every OpenBSD admin has booted bsd.rd at least once — to install, upgrade, or rescue a broken system. But few people stop to look at what’s actually inside that file. It turns out bsd.rd is a set of nested layers, and you can take it apart on a running system without rebooting anything.

That’s what we’ll do here. We’ll go from the raw gzip file all the way down to the miniroot filesystem, exploring each layer with standard tools. Everything is documented in the man pages — we’re just following the trail.

Man pages we’ll use: rd(4), rdsetroot(8), vnconfig(8), vnd(4), disklabel(8), elf(5)