Self-Hosting Your Website with OpenBSD: A Developer's Weekend Project

Why Self-Host? (And Why OpenBSD?)

Look, I get it. AWS, DigitalOcean, and Vercel are all fine choices. But there's something deeply satisfying about running your website on hardware you can hold in your hand — literally. When I first moved this blog to an HP T630 thin client running OpenBSD, I felt like I'd unlocked some secret developer achievement.

And here's the thing nobody talks about: OpenBSD's httpd is refreshingly simple. No systemd drama. No container overhead. No surprise dependencies. Just a clean, auditable web server that does exactly what you need and nothing more.

In this guide, I'll show you how to set up a complete self-hosted web server using OpenBSD and WireGuard. The setup involves two machines: a budget VPS (used as a relay point to hide your home IP) and your local server. Yes, you could just host everything on the VPS. But where's the joy in that?

What You'll Need

Before we dive in, grab these essentials:

• A cheap VPS (seriously, the $5/month tier works fine) — this acts as your public-facing tunnel endpoint
• Local hardware capable of running OpenBSD — old thin clients, mini PCs, or that server gathering dust in your closet
• A domain name pointed at your VPS IP (allow some time for DNS propagation)
• Basic comfort with the command line

Setting Up WireGuard: Your Encrypted Tunnel

WireGuard is our secret sauce here. It creates a secure tunnel between your home server and VPS, allowing web traffic to flow through while keeping your home IP completely hidden from the internet.

Installing WireGuard

On both machines, install the tools:

pkg_add wireguard-tools

Generating Keys

Generate your keypairs on each machine:

umask 077
wg genkey > private.key
wg pubkey < private.key > public.key

Important: After copying these keys into your config files, delete the key files from disk. You don't want those sitting around.

Configuring the VPS (Your Tunnel Endpoint)

Create /etc/hostname.wg0 on your VPS:

wgkey <VPS_PRIVATE_KEY>
wgport 51820
wgpeer <HOME_PUBLIC_KEY> wgaip 10.10.0.2/32
inet 10.10.0.1/24

Bring it online immediately:

sh /etc/netstart wg0

OpenBSD's netstart scripts handle persistence automatically — no service management needed. Refreshing.

Enable IP Forwarding

Your VPS needs to pass traffic between its public interface and the WireGuard tunnel:

echo 'net.inet.ip.forwarding=1' | doas tee -a /etc/sysctl.conf
doas sysctl net.inet.ip.forwarding=1

The pf.conf Magic

This is where things get elegant. Your VPS needs to redirect incoming web traffic to your home server and NAT it properly:

home      = "10.10.0.2"
tunnel_ip = "10.10.0.1"

set skip on lo
block return
pass out

# Allow SSH and WireGuard
pass in on egress inet proto tcp to port 22
pass in on egress inet proto udp to port 51820

# Redirect web traffic to home server
pass in on egress inet proto tcp to port { 80 443 } rdr-to $home
pass out quick on wg0 inet proto tcp to $home port { 80 443 } nat-to $tunnel_ip

pass on wg0

Load the ruleset:

pfctl -f /etc/pf.conf

Configuring Your Home Server

Create the matching /etc/hostname.wg0 on your local machine:

wgkey <HOME_PRIVATE_KEY>
wgpeer <VPS_PUBLIC_KEY> wgendpoint <VPS-IP> 51820 wgaip 10.10.0.1/32 wgpka 25
inet 10.10.0.2/24

Bring up the interface:

sh /etc/netstart wg0

Home Server Firewall

Your local firewall needs to be tighter since this is directly exposed to the internet through the tunnel:

set skip on lo
set limit states 100000
set timeout interval 10
set optimization "normal"

table <block_table> persist
table <bruteforce> persist

block all
block in quick from <block_table>
block in quick from <bruteforce>
pass out quick

# SSH only from your local network
pass in proto tcp from 192.168.1.0/24 to port 22 keep state

# Web traffic from the tunnel
pass in on wg0 proto tcp to port { 80 443 } keep state

# Base defaults
block return in on ! lo0 proto tcp to port 6000:6010

Adjust 192.168.1.0/24 to match your actual LAN subnet. This is crucial — you don't want SSH wide open to the tunnel.

Finally: The Web Server

With your tunnel established, it's time to serve some content. OpenBSD's httpd configuration lives in /etc/httpd.conf and it's refreshingly straightforward:

server "reallycoolsite.com" {
    listen on * port 80
    root "/htdocs/reallycoolsite.com"
}

server "www.reallycoolsite.com" {
    listen on * port 80
    root "/htdocs/reallycoolsite.com"
    block return 301 "http://reallycoolsite.com$REQUEST_URI"
}

Set up your web directory:

doas mkdir -p /var/www/htdocs/reallycoolsite.com
doas chmod -R 755 /var/www/htdocs/reallycoolsite.com
doas chown -R www:www /var/www/htdocs/reallycoolsite.com

Drop your HTML, CSS, and assets into that directory, then verify and start:

doas httpd -n    # Test config for errors
doas rcctl start httpd

If everything worked, your site should now be live at your domain. Congratulations — you're officially self-hosting.

HTTPS? Keep It Simple for Now

This guide keeps things HTTP-only to avoid complexity. HTTPS with Let's Encrypt on OpenBSD is absolutely doable, but it adds layers (relayd, ACME client configuration) that deserve their own dedicated guide. For development, staging, or personal projects, plain HTTP is often sufficient.

The Developer Perspective

Here's what makes this approach compelling for developers and startups:

Transparency: You know exactly what's running. No hidden container orchestration, no managed services with surprise billing.

Learning: Setting up tunnels, firewalls, and web servers by hand teaches you how the internet actually works.

Privacy: Your home IP stays private. The VPS is just a relay — it can't see your traffic content, just encrypted packets flowing through.

Cost: That $5/month VPS plus old hardware you already own beats $50/month for a comparable DigitalOcean droplet.

The OpenBSD philosophy of "fewer things, done properly" extends to everything here. The installer is solid, the documentation is excellent, and the system just... works.

Wrapping Up

Self-hosting isn't for everyone, and that's fine. But if you're the type who wants to understand every piece of your infrastructure — or just enjoy the satisfaction of running your own box — OpenBSD provides an elegant platform to start.

If this guide was useful to you, consider supporting the projects that make it possible:

• Donate to OpenBSD
• Donate to WireGuard

Happy hosting!