$OpenBSD$

+-------------------------------------------------------------------------------
| Running PurritoBin on OpenBSD
+-------------------------------------------------------------------------------

Set proper daemon flags
=======================

You need to set at least the following option for PurritoBin
  -d <domain-name>   # e.g. https://bsd.ac/
                     # needs to include the trailing slash

To look at all the possible options and descriptions
  purrito -h

Exposing a webserver
====================

PurritoBin saves all the pastes to a single folder
so it is possible to just expose the folder via httpd(8)

sample httpd(8) configuration
-----------------------------
http_port=80
https_port=443
ext_if=egress

server "bsd.ac" {
	alias "www.bsd.ac"
	listen on $ext_if port $http_port
	location "/.well-known/acme-challenge/*" {
		root { "/acme" }
		request strip 2
	}
	location "/*" {
		block return 301 "https://$HTTP_HOST$REQUEST_URI"
	}
}

server "bsd.ac" {
	alias "www.bsd.ac"
	listen on egress port $https_port
	root "/purritobin"
	directory index "index.html"
}

PF bruteforce blocking
======================

PurritoBin exposes a port using -p <port> (by default: 42069) for
clients to post their pastes.
PurritoBin does not enforce any rate limiting for number of pastes
at a time as this can be done much better using pf(4)

sample pf.conf for rate limiting
--------------------------------
table <bruteforce> persist
purritobin_port=42069

set skip on lo

block return	# block stateless traffic
pass		# establish keep-state

block quick from <bruteforce>

# no more than one connection every 3 seconds
pass in on egress proto tcp from any to any port $purritobin_port \
		flags S/SA keep state \
		(max-src-conn-rate 1/3, \
		overload <bruteforce> flush global)

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

# Port build user does not need network
block return out log proto {tcp udp} user _pbuild


Cron job for cleaning
=====================

PurritoBin leaves the cleaning upto the webmaster.
Fortunately, due to the simple storage mechanism, you can
do the cleaning very easily in daily.local

sample daily.local for cron cleanup
-----------------------------------

find /var/www/purritobin/ -type f ! -name index.html \
				! -name paste.html \
				-delete

This clears all pastes which were done during the day.
