Run OpenBSD on DigitalOcean for $4/month: A Step-by-Step Guide

OpenBSD is a byword for security and correctness, but getting it onto a mainstream cloud provider has historically been a chore. This guide walks through running OpenBSD on DigitalOcean's $4/month basic droplet, using a custom image upload and the web console to install the OS.

Why OpenBSD on DigitalOcean?

The author, a full-time software engineer, wanted to recapture the DIY spirit of the early web. After hosting on GitHub Pages and Cloudflare Pages, they craved more control. OpenBSD with its built-in httpd(8) and acme-client(1) for Let's Encrypt offers a minimal, secure stack that fits perfectly on a low-resource droplet.

Getting the Image

Start by downloading the miniroot image for OpenBSD 7.9 on arm64 (or amd64, depending on your droplet architecture). Verify the checksum with sha256sum to ensure integrity.

curl -O -O https://cdn.openbsd.org/pub/OpenBSD/7.9/arm64/{miniroot79.img,SHA256}
sha256sum -c --ignore-missing SHA256 miniroot79.img

Uploading to DigitalOcean

In the DigitalOcean control panel, navigate to Backups & Snapshots under Storage. Upload the miniroot image, select a datacenter, choose "Other" as the distribution (a nod to the lack of BSD options), and name it something like "OpenBSD miniroot79". Remember to delete the custom image after the droplet is running to avoid storage charges.

Creating the Droplet

Create a basic droplet with 512MB RAM, 1 vCPU, 10GB disk, and 500GB transfer. Select the uploaded custom image under the Custom Images tab. Add an SSH key (required, though not actually used during install) and note that IPv6 cannot be enabled at creation time. The cost: $4.00/month.

Installing OpenBSD

Launch the web console from the droplet page. You'll boot into the miniroot environment. Type i to start the installer. Follow the prompts:

• Select vio0 for the network interface, use autoconf for IPv4/IPv6.
• Set a strong root password.
• Enable sshd(8) by default, but disable root SSH login.
• Skip X Window System and keep the default console.
• Create a non-root user with a secure password.
• Choose the timezone, select disk sd0 for the root disk.
• Optionally, enable full disk encryption with a passphrase.

For disk layout, use the whole disk MBR and auto layout. When installing sets, remove unnecessary ones like X, games, and compilers to keep it lean. Use an HTTP mirror close to your datacenter.

Post-Installation

After reboot, SSH in as your non-root user. If you enabled full disk encryption, you'll need to enter the passphrase via the web console on every boot—a minor inconvenience. The author recommends copying your public SSH key and disabling password authentication for better security.

This setup gives you a rock-solid, minimal web server for the price of a coffee. It's a throwback to when hosting your own stuff was the norm, and it's still viable today.