BoxyBSD

Web server access with Cloudflare

BoxyBSD provided an IPv6-only server. To make services accessible to users on IPv4-only networks, you could use Cloudflare’s reverse proxy. Cloudflare would provide IPv4 access to your server.

I set up Caddy with a Cloudflare Origin CA certificate to encrypt the traffic between my server and Cloudflare. To do this, I generated a certificate and a private key in the Cloudflare dashboard and install them on the server.

Here is an example of how to configure Caddy to use an origin certificate:

dbohdan.com {
	tls /usr/local/share/certs/cloudflare/dbohdan.com/certificate.pem /usr/local/share/certs/cloudflare/dbohdan.com/key.pem

	# ...
}

The path /usr/local/share/certs/cloudflare/ is not standard; I chose it.

Accessing remote hosts with NAT64

To access IPv4-only services like GitHub from an IPv6-only VPS, you need a so-called “IPv6 transition mechanism”. A public NAT64 service could be used by configuring its DNS64 servers in /etc/resolv.conf. DNS64 synthesizes AAAA (IPv6) records from A (IPv4) records, allowing IPv6-only clients to connect to IPv4-only servers through the NAT64 gateway.

I used the public NAT64 service from NAT64.net. To use it, edit /etc/resolv.conf to contain their nameservers:

nameserver 2a00:1098:2c::1
nameserver 2a00:1098:2b::1
nameserver 2a01:4f9:c010:3f02::1

After this change, I was able to clone repositories from GitHub.

SSH access

My ISP was IPv4-only, so I couldn’t connect to an IPv6-only server directly. I used another server that has both IPv4 and IPv6 connectivity as an SSH jump host. The ProxyJump directive in my ~/.ssh/config made this seamless.

My configuration looked like this:

Host ipv6-box.example.com
    ProxyJump ipv4-jumphost.example.com

When I ran the command ssh ipv6-box.example.com, OpenSSH first connected to ipv4-jumphost.example.com and from there established a connection to ipv6-box.example.com. The ProxyJump directive handled setting up TCP forwarding automatically.

Serving the web with Caddy

I used Caddy to reverse-proxy my web services and serve static files and templates. See the Caddy page and “about” for more information about this setup, such as the template for the error pages. I found that Caddy on FreeBSD required a mime.types file; this was not specific to BoxyBSD.

Building a Crystal application

CatchUp is an application written in Crystal, a programming-language compiler with a FreeBSD port. The application worked on FreeBSD without changes.

My VPS from BoxyBSD had 10 GB of ZFS storage: 2 GB of swap and an 8 GB root partition. Building a Crystal application required installing the Crystal compiler and LLVM, which consumed 2 GB of disk space. I decided to build the application on my local FreeBSD machine (a VM in Proxmox) and copy the compiled binary to the server.