Setup recipe for blog.mwild.co.uk

2026-06-28

The following recipe details how the blog at www.mwild.co.uk is set up on a FreeBSD 15 server.

Install and configure nginx

Install nginx:
```
# pkg install nginx
```

Create the conf.d directory:

# mkdir /usr/local/etc/nginx/conf.d

/usr/local/etc/nginx/conf.d/www.mwild.co.uk.conf:

server {
  listen 80;
  listen [::]:80;
  server_name mwild.co.uk;
  return 301 https://www.mwild.co.uk$request_uri;
}

server {
  listen 80;
  listen [::]:80;
  server_name www.mwild.co.uk;

  root /usr/local/www/www.mwild.co.uk;
  index index.html;

  location / {
    try_files $uri $uri/ =404;
  }

  location = /feed.xml {
    types { } default_type application/rss+xml;
    charset utf-8;
    charset_types application/rss+xml;
  }
}

Delete the default nginx server block and add the following to the end of the http block in /usr/local/etc/nginx/nginx.conf. Also enable gzip compression:
```
gzip on;
gzip_types application/rss+xml text/css application/javascript;
include /usr/local/etc/nginx/conf.d/*.conf;
```

Create the webroot

# mkdir -p /usr/local/www/www.mwild.co.uk
# chown -R www:www /usr/local/www/www.mwild.co.uk

Enable and start nginx

# sysrc nginx_enable="YES"
# service nginx start

Enable TLS with Let’s Encrypt

Install certbot:
```
# pkg install security/py-certbot-nginx
```

Obtain a certificate:

# certbot --nginx -d www.mwild.co.uk -d mwild.co.uk

Configure weekly renewal of the certificate by creating /etc/periodic.conf:
```
weekly_certbot_enable="YES"
```

Configure firewall

Edit /etc/pf.conf:

ext_if = "vtnet0"
tcp_services = "{ ssh, http, https }"

block in all
set skip on lo

pass inet proto icmp all
pass inet6 proto icmp6 all
pass in on $ext_if proto tcp to port $tcp_services
pass out on $ext_if from any to any keep state

Verify the configuration:
```
# pfctl -vnf /etc/pf.conf
```

Enable the firewall:

# sysrc pf_enable="YES"
# service pf start