3 files changed, 173 insertions, 0 deletions
diff --git a/GoAccess.md b/GoAccess.md
new file mode 100644
index 0000000..b079469
--- /dev/null
+++ b/GoAccess.md
@@ -0,0 +1,32 @@
+# GoAccess – HTTP log monitoring for OpenBSD
+
+This guide sets up GoAccess to analyse httpd(8) access logs in real time via a
+simple HTML report. The report is updated from a cron job and served by the
+same web server.
+
+## Installation
+
+```bash
+doas pkg_add goaccess
+
+Collect logs for a specific domain
+
+Assume logs for your_domain are stored in /var/www/logs/access.log.
+Create a report directory and generate the first report:
+bash
+
+doas mkdir -p /var/www/htdocs/you_www/stats
+doas goaccess /var/www/logs/you_www.log -o /var/www/htdocs/you_www/stats/index.html --log-format=COMBINED
+doas chown -R www:www /var/www/htdocs/report
+
+doas chown -R www:www /var/www/htdocs/drohiczyn-poleski/stats
+doas chmod 755 /var/www/htdocs/drohiczyn-poleski/stats
+
+Automatic daily update with cron
+
+Add the following line to root's crontab (doas crontab -e):
+text
+
+0 * * * * /usr/local/bin/goaccess /var/www/logs/you_www/.log -o /var/www/htdocs/you_www//stats/index.html >/dev/null 2>&1
+
+Now visit https://your_domain/report/ to see the statistics.
diff --git a/WireGuard.md b/WireGuard.md
new file mode 100644
index 0000000..324c31b
--- /dev/null
+++ b/WireGuard.md
@@ -0,0 +1,105 @@
+The report is public. To restrict access, add basic authentication in httpd.conf
+or place the report behind your VPN (see WireGuard guide).
+text
+
+
+---
+
+### 2. WireGuard VPN – Secure administrative access
+
+```markdown
+# WireGuard VPN on OpenBSD (server + client)
+
+This guide creates a private tunnel so that SSH, Git, and other
+administrative services are accessible only through the VPN.
+
+Replace `your_server_pubkey`, `your_client_pubkey`, `your_server_ip` and
+`your_client_ip_range` accordingly.
+
+## Server side (OpenBSD)
+
+### 1. Install WireGuard
+
+```bash
+doas pkg_add wireguard-tools
+
+2. Generate keys
+bash
+
+doas mkdir -m 700 /etc/wireguard
+doas wg genkey | doas tee /etc/wireguard/server.key | doas wg pubkey > /etc/wireguard/server.pub
+doas chmod 600 /etc/wireguard/server.key
+
+3. Create /etc/wireguard/wg0.conf
+ini
+
+[Interface]
+PrivateKey = <contents of /etc/wireguard/server.key>
+ListenPort = 51820
+
+[Peer]
+PublicKey = <your_client_pubkey>
+AllowedIPs = 10.77.77.2/32
+
+4. Start the interface
+bash
+
+doas ifconfig wg0 create
+doas ifconfig wg0 10.77.77.1/24
+doas wg setconf wg0 /etc/wireguard/wg0.conf
+doas ifconfig wg0 up
+
+5. Make it permanent
+
+Add to /etc/rc.local (create if missing):
+bash
+
+doas tee -a /etc/rc.local << 'EOF'
+#!/bin/sh
+ifconfig wg0 create 2>/dev/null
+ifconfig wg0 10.77.77.1/24
+wg setconf wg0 /etc/wireguard/wg0.conf
+ifconfig wg0 up
+EOF
+doas chmod +x /etc/rc.local
+
+Client side (Linux / Gentoo)
+1. Install WireGuard
+bash
+
+doas emerge --ask net-vpn/wireguard-tools   # Gentoo
+sudo apt install wireguard-tools            # Debian/Ubuntu
+
+2. Generate client keys
+bash
+
+wg genkey > client.key
+wg pubkey < client.key > client.pub
+chmod 600 client.key
+
+3. Create /etc/wireguard/wg0.conf (client)
+ini
+
+[Interface]
+Address = 10.77.77.2/24
+PrivateKey = <contents of client.key>
+
+[Peer]
+PublicKey = <your_server_pubkey>
+Endpoint = your_server_ip:51820
+AllowedIPs = 10.77.77.0/24
+PersistentKeepalive = 25
+
+4. Start the tunnel
+bash
+
+doas wg-quick up wg0   # or sudo wg-quick up wg0
+ping 10.77.77.1
+
+Now all sensitive services can listen on 10.77.77.1 only.
+text
+
+
+---
+
+
diff --git a/pf Firewall.md b/pf Firewall.md
new file mode 100644
index 0000000..acfe783
--- /dev/null
+++ b/pf Firewall.md
@@ -0,0 +1,36 @@
+### 3. pf Firewall – Basic Hardening
+
+```markdown
+# Hardening OpenBSD with pf (packet filter)
+
+This basic rule set allows only public web traffic (80/443) and WireGuard.
+Everything else – SSH, direct Git, etc. – must go through the VPN.
+
+## Configuration file `/etc/pf.conf`
+
+```pf
+ext_if = egress
+
+# Default deny
+block in log all
+pass out all keep state
+
+# Localhost
+set skip on lo0
+
+# Public services
+pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA
+
+# WireGuard
+pass in on $ext_if proto udp to any port 51820
+
+# Allow all traffic inside the VPN
+pass in on wg0 all
+pass out on wg0 all
+
+Apply the rules:
+bash
+
+doas pfctl -f /etc/pf.conf
+
+To make them permanent, ensure the file exists (it will be loaded at boot).