Nostr notes by Stefano Marinelli

**This is the text I wrote for my part of the talk “[Liberating ...

2026-03-31T07:30:00Z

**This is the text I wrote for my part of the talk “[Liberating the Social Web Using *BSD](https://events.eurobsdcon.org/2025/talk/PJJLFV/ )“, presented together with the great Jeroen (h3artbl33d :openbsd: :antifa: (npub1y90…900y)) at [EuroBSDCon 2025 in Zagreb](https://2025.eurobsdcon.org ). ****It’s not a transcript – it’s the base I worked from, the thoughts I organized before stepping on stage. What I actually said may have been slightly different in places, as it always is when you speak from the heart rather than read from a page. But these are the words, and the spirit is exactly the same.**

Today, I’m not just here to talk about technology, but about how the principles of BSD systems can help us build healthier and more resilient online communities. And I’ll do this by telling you the story of the bar I founded, the [BSD Cafe](https://bsd.cafe ).

The idea for the BSD Cafe was born long before its launch but, as I often do, I thought carefully about whether to proceed. On 27 December 2022, I decided to register the domain. The name came from careful reflection with my wife. The idea was to create a virtual space that resembled not so much the cafes scattered around the world, but the Italian “Cafe” (which are called “Bar”).

For many years (and in many contexts, still today), Italian bars have been at the center of people’s recreational social lives. The Barista, the manager of the establishment, is not just a keeper but a point of reference: they don’t just serve coffee, but they listen and, if asked, offer advice with the wisdom of someone who sees many people and many things, even just out of the corner of their eye, and hears many stories. It used to be said that the best advisors were priests and bartenders, but that the latter certainly gave more entertaining advice.

And the bar is precisely the place where people go to relax. There are often televisions, tables for playing cards, and recreational rooms. The bartender ensures that everything runs smoothly, but also that everyone feels comfortable: that the person passing through gets directions to their destination, that the person who just walked in gets their coffee at their preferred temperature, and that the person who entered a little earlier, who needs some rest today, has a table in a more private area.

The spirit of the BSD Cafe is the same: to try to create a serene, open, friendly, positive, and welcoming environment for all who want to be a part of it. Those who just want to read can do so. Those who post a lot are welcome. Everyone should have the experience that makes them most comfortable and at ease. No one should ever feel forced to do something they don’t want to do; no one should ever feel uncomfortable. Therefore, everyone can choose a noisy and active table, or a more reserved and quiet one.

We can therefore assume that the BSD Cafe has an infinite number of available tables. We can thus call it a *Turing cafe*. 🙂

In Italian bars, people used to go (and in some areas, still do) to find their “bar friends”. These are people you meet at the bar without an appointment. You go to the bar freely, when you have the time and inclination, and you find the people who regularly frequent that place. And the choice of the bar often aligns with the theme of the bar itself. For example, in Italy, there are many “Bar Sports” where people meet to catch up, watch games together, and read and comment on sports news. The idea of the BSD Cafe is the same – a bar where enthusiasts of BSD systems, Open Source, and technology can be found. And for me, although I might occasionally talk about users (out of technical habit), at the BSD Cafe, there are only “bar friends”.

**The BSD Cafe is a place where we are “for”, not “against”**. **Supporters, not haters**. Bar friends, not opponents. This doesn’t mean that opinions on other software can’t be expressed, even extremely negative ones (I do it myself from time to time), but the general spirit is that of open source: to build, to discuss, to understand. Wars against other solutions, especially if they are open source, are not part of the atmosphere of the BSD Cafe. We have our preferences – we support our ideas and solutions, but we are not here to “destroy” others. Among our users, there are people who develop Linux distributions – and for me, that is extremely positive!

When people are at ease and in a serene environment, they are often encouraged to be serene themselves. Some are negative and aggressive because they absorb it from their environment. Some users of the BSD Cafe have told me exactly this: the civil, friendly, relaxed, positive, and constructive level of the BSD Cafe is good for their mental health. Conversely, there are unfortunately people who find pleasure in causing trouble, in muddying the atmosphere. For these people, unfortunately, there is no solution, but the Cafe is not the place for them.

Political discussions can be part of our lives and daily routines, but the BSD Cafe is not a political group. In recent years, politics has become a topic not of discussion but of conflict. It has always been so to some extent, but commercial social media platforms have understood that hatred and conflict generate engagement, and engagement means selling advertising – a lot of advertising. Therefore, at the BSD Cafe, you might occasionally hear talk of politics or the political repercussions of technical decisions and choices. And that is perfectly okay. But it is not a place from which political conflicts should arise. We are for – supporters, not haters. We are here to build, not to destroy.

The BSD Cafe is therefore a place centered on the BSDs, and all services are, therefore, based on BSD operating systems.

All technologies used must be able to run “from my garage”. I am a professional – so this is not a hobby project – but it must not depend on any proprietary solution or “Cloud” solution. Today, there is a tendency to standardize (too much?) everything related to technical choices. If it’s pro, it’s Kubernetes/cloud/serverless/etc. – if it’s not, it’s “old” or “not pro”. I am, and have always been, a proponent of OwnYourData. And this is a mantra at the BSD Cafe. All services are based on Open Source solutions, outside the dynamics and centralized management of the usual companies. We must be free and maintain our technological autonomy; we cannot create a system where our communications and our data depend exclusively on third-party companies. I have enough experience to understand that, sooner or later, even the most solid companies can fail or change their business model. The BSD Cafe is therefore always in favor of self-hosting. Sometimes this means losing users, but not bar friends. It happens, in fact, that at a certain point, friends decide to try the BSDs and start self-hosting their own services. For me, that is a success: one less number in the statistics, but one more success on a technical and ideological level. And for all intents and purposes, they remain bar friends, even if their “handle” is different from “[bsd.cafe](http://bsd.cafe/ )” – it is the spirit, not an extension, that unites us.

From time to time, I have migrated the main VM of the BSD Cafe. Sometimes I have given notice, other times not (the downtime is minimal). In some cases, the system has run from my home desk, from the Mini PC I used as a home server and now use daily as a workstation. At the core of the technical choices, in fact, is the decision not to depend (strictly) on any specific technology or hardware. For this reason, the structure of the BSD Cafe is replicable and malleable, as well as described in its Wiki: it is a community of technology enthusiasts, and I want them to judge the choices transparently and autonomously, without hiding anything.

The BSD Cafe was not created to be just a Fediverse instance but, from the beginning, to provide a series of services powered by the BSDs for enthusiasts and friends of the BSDs. To date, the main services are:<li>A Mastodon instance – the beating heart of the BSD Cafe in the Fediverse, which currently has about 500 total users (now 600 – of which about half have been active in the last 30 days). This is where we chat, get informed, joke, critique, build, discuss, and get to know each other.</li><li>A snac instance – also for access to the Fediverse. Snac is an example of lightweight software, with no dependencies, that is stable and easy to self-host. It does not use a database but the file system and is the basis of another project of mine, FediMeteo. The snac/ZFS combination is fantastic. The developer is a caring, helpful, and fantastic person. It is my first choice for personal projects and more – it currently has more or less 30 users.</li><li>A Lemmy instance – blendit – which, however, is giving me problems and headaches. I’ve been thinking about it for a while; it might be the first of the BSD Cafe services that I will be forced to retire. More about this later.</li><li>A Matrix server – based on Synapse, it has become the hub for many interesting topics both in the thematic channels (BSD-themed) and in the Lounge, the general channel, where we talk about a bit of everything. The server is federated, so it is also an access point for channels and groups on other servers. We chat, we discuss, we ask – a bit like with the Fediverse, but on Matrix.</li><li>miniflux and freshrss – RSS is not dead – it is alive and well and still a fundamental tool for updates and consultation. Two jails, two services to give our friends a way to read the news. This is our reading corner, the newspapers, the newsletters. Here, you remain autonomous and in silence, you choose what you want to read, and you savor the content. Without advertising, without interruptions.</li><li>wallabag – called “press” – to save your bookmarks, sites, articles. Save the web. Freely. Our post-it notes, but private.</li><li>myip – by connecting to myip, you will get your IP back – both v4 and v6 – via telnet, http, https, ssh, etc. – ideally, it is an echo chamber, to “hear” the reflection of your own voice – that is, your own IP.</li><li><a href="http://wiki.bsd.cafe/">wiki.bsd.cafe</a>; – the project’s homepage and a series of articles and content about the BSDs. It is not very rich in content at the moment, but some friends contribute regularly and keep the information in it updated. It contains articles on how the BSD Cafe is structured (for each service, an explanation of the division into jails, etc.). Our recipe book – for the coffee machine, but also for the BSDs!</li><li><a href="http://brew.bsd.cafe/">brew.bsd.cafe</a>; – powered by Forgejo, it has become the home for many projects by friends of the BSD Cafe. I use it daily for my own needs, and it is a way to avoid using centralized tools controlled by the “usual suspects”. And, unlike the main and most famous similar service in the world, it also supports IPv6! It is our creative workshop, the development den. The garage where we have our tools and build, collaborating.</li><li><a href="https://journal.bsd.cafe/">journal.bsd.cafe</a>; – the latest, in chronological order, added to the BSD Cafe. Our journal, what we want to tell the world and leave a trace of. It is a WordPress blog, federated in the Fediverse thanks to the ActivityPub plugin, where authors can create and publish articles, even those not strictly related to the BSDs. So far, various articles have been published, and some of them have had some success on sites like Hacker News or <a href="http://lobste.rs/">Lobste.rs</a>; – because quality is still appreciated, especially in the world of standardized and imprecise content from LLMs (or “AI”, as is fashionable today).</li><li>There are other active services but not publicly usable, such as “tube” – our TV – Peertube. They are currently experimental.</li>

Let’s get into the technical details:

The BSD Cafe is not “cloud ready”. The BSD Cafe was not created to be serverless. We love our servers, and we don’t need the “cloud” to run our services.

The BSD Cafe started with a FreeBSD VM on Hetzner in Finland for €3.29 per month. It is still active and is the primary for the entire infrastructure and is named “bsdcafevm”. It hosts the reverse proxy, in a jail, which routes all incoming connections, and is the “router” for the larger VM. This VM also hosts a “ns2” jail, which is the secondary DNS, and the “backup” instance of Mastodon, which helps with queue management and becomes primary when I shut down the other one during updates. For IPv6, Hetzner assigns a routed /64 block. I have divided it into /72 subnets so that I can route to other VPSs, services, etc., and provide an IPv6 address to any jail.

The main VPS, which hosts the services, called “bc01”, connects to this VM via Wireguard. bc01 has some particular characteristics, including:<li>It was originally a VM on Proxmox, as I was using hardware I already owned. It is now on bhyve, on a FreeBSD host under my control (in Germany).</li><li>It does not have a public IP assigned, but connects to the Internet only via NAT on the host. This is a clear choice: this VM should only connect to bsdcafevm. BSDCafeVM will forward connections from the reverse proxy and will handle “NATing” outgoing IPv4 connections from bc01. The Wireguard rules on BSDCafeVM will also ensure that IPv6 connections reach the jails of this VM. The purpose is simple: this VM must be able to be moved anywhere, and the services must be able to resume functioning immediately. And this happens because all it needs is a Wireguard connection to BSDCafeVM, so there are no services exposed directly. This is the reason why this VM has been moved many times without any changes to IPs, addresses, etc. More information on this VM later.</li>

A small VM (for one euro per month) based on FreeBSD that, within a jail, has the ns1 nameserver, which is the primary authoritative one. This VM also serves other purposes from time to time, such as monitoring the rest, etc.

A jail within one of my FreeBSD hosts in Poland, on OVH, contains the media files for the Mastodon instance. This is the most voluminous part of the entire hosting setup because Mastodon downloads and reprocesses all the multimedia content it encounters. This is for two main purposes: to clean it, in order to possibly remove malicious content, and to ensure that users of one’s own instance only have contact with their own media repository, not with that of the original instance – both for performance and privacy reasons. This server has spinning disks. Initially, I used Minio, but over time, performance plummeted. A few months ago, I migrated to SeaweedFS, and I am very satisfied with it. The outgoing bandwidth of this machine is not very wide, and I have other services on it. For this reason, I applied a solution that I described in an article on my blog.

I have used some VMs or physical hosts (spread across Europe and the USA) to act as a CDN. The BSD Cafe’s DNS will return the IP (both v4 and v6) closest to the caller, among those available, and this host will connect directly to the media server, then caching the content. The problem, in fact, does not arise when a user scrolls through their timeline, but as soon as they publish multimedia content: all known instances will connect to download and reprocess that file, generating a spike. This has little impact if it is a normal post, but it is extremely voluminous if it is content of a considerable size, like an image or a video. In this way, the various CDN nodes will download the content only once and serve it to all instances in their area of competence. These CDN nodes also do other things, can be activated or deactivated based on my needs, and are based on FreeBSD, NetBSD, and OpenBSD (one of them is on OpenBSD Amsterdam).

Another FreeBSD VPS (which I use for other things) contains “[status.bsd.cafe](http://status.bsd.cafe/ )“, which is the jail with Uptime Kuma that shows the status of the services or any of my communications about them. I do not receive notifications from this host, but from another monitoring system, so it is only to show the status of the situation.

In practice, the BSD Cafe mainly needs the “endpoint” VPS, the VPS with the services, and the jail with the media, which could be condensed into a single system if desired. Everything else is optional and I keep it active as I have resources available on external hardware.

Many of the technical choices have been documented in articles [on my blog](https://it-notes.dragas.net ) or in the [BSD Cafe Wiki](https://wiki.bsd.cafe ).

But all of this requires backups. And the BSD Cafe has a clear and defined backup procedure.

The main VPSs – namely bsdcafevm and bc01 – are based on FreeBSD and, therefore, ZFS. Both have the same type of backup, defined as follows:<li>A local snapshot every 5 minutes, kept for two hours. In this way, in case of problems, it is possible to “clean up the coffee drop” before the tablecloth is indelibly stained—as well as one per hour, kept for 24 hours.</li><li>An external backup, performed at regular intervals, to an external backup host. The frequency varies from 15 minutes to an hour, depending on the available space and the load, which I modify according to my needs. All datasets of the VMs are copied, including system ones, for a possible quick recovery in case of a disaster.</li><li>An external backup to a backup server of mine, one meter away from me. This happens every 24 hours, and I consider it the “extreme disaster recovery” because, in my opinion, the safest data is the data that is physically reachable. The disks of this server (which also contains other backups) are all encrypted with GELI, so in case of theft, they are unusable.</li>

Last but not least, the physical FreeBSD host on which bc01 currently rests is also backed up every 15 minutes to another external backup server, so the entire disk image. An additional layer of redundancy, to help me sleep better at night.

From a technical standpoint, therefore, I have tried to create a simple but secure infrastructure, with the most granular separation possible (for example: the main Mastodon instance has a jail for Mastodon, one for the Redis for the queues, etc., one for the Redis for the timeline caches (only in RAM, does not write to disk), and one for the database (PostgreSQL).

Then there are the common service jails (unbound for DNS resolutions, smtp for sending and receiving emails, etc.).

*Being the Barista of the BSD Cafe is a privilege and an honor*. The success of the project has exceeded my expectations, and this has filled me with joy. The BSD community is fantastic, mature, intelligent, and positive. The friends who approach the BSDs absorb all of this and transmit it to others, creating a virtuous circle. But it’s not always roses. There are problems, from time to time, that need to be solved. And, [to quote my previous talk](https://it-notes.dragas.net/2024/10/03/i-solve-problems-eurobsdcon/ ): “*The main challenge is often ideological, not technical*“.

Apart from the problems with blendit – Lemmy – which accumulates all the media it sees in a frenzied way and never deletes it, as well as having created serious update problems – all the software is on average stable and reliable.

The most complex part of my role as a barista, in fact, is not technical, but human: *moderation*. The techniques of scams and disturbances are constantly improving, and it is increasingly difficult to distinguish a new friend of the bar from a troublemaker. But the biggest challenge is maintaining balance.

Our philosophy is clear: *to be for, not against. Supporters, not haters*. This principle is a conscious choice, in stark contrast to the dominant model of commercial social media. These platforms are often designed around an engagement economy, where algorithms optimized to generate conflict and outrage maximize the time spent on the site and, consequently, advertising profits. The BSD Cafe rejects this model. We are not here to capitalize on anger, but to build a refuge from the toxicity of the internet.

This approach manifests itself in the way we handle controversial topics. Recently, a technical theme with strong political implications has begun to appear in discussions. My line is not to censor the topic itself. I firmly believe in open discussion. I only intervene when the discussion ceases to be a critical analysis and becomes a personal attack. For some, this is not enough: they would like a total ban on certain topics and the immediate exclusion of those who introduce them. My experience, however, has shown me that a more patient approach is often more constructive. I have seen people support controversial software solutions simply because they did not know their background. Thanks to civil and informative discussions, they have understood the context, thanked the community, and made more informed choices. Banning them instantly would have been unfair and would have denied everyone an opportunity for growth.

However, this philosophy of constructive positivity has attracted a specific criticism: that of promoting “Toxic Positivity”. The accusation is that, in our desire to maintain a serene environment, we end up excluding those who are suffering, invalidating their negative experiences because they “clash” with the atmosphere of the bar.

This is a criticism that I take very seriously, because it touches the heart of the project. And my answer is that it is a fundamental misunderstanding of our purpose. The goal is not to deny that pain, injustice, and suffering exist in the world. On the contrary: the BSD Cafe exists precisely because the world is often a difficult place.

Our purpose is not to pretend that those who suffer should stop suffering, but to offer them a place where, for a while, they may not be defined solely by their suffering. A place where they can be, first and foremost, a technology enthusiast, a FreeBSD expert, a curious OpenBSD user. A friend of the bar. We are always ready to support, console, and help those who need it, but we want to protect that mental space where shared passions unite us and give us relief.

Fortunately, this vision is confirmed by the very people we are trying to help. The number of private messages of appreciation I receive from people going through terrible times far exceeds the criticism. They write to me that “the civil, friendly, and constructive level of the BSD Cafe is good for their mental health”, because it allows them to disconnect from daily dramas that would otherwise be unbearable.

*I am just the Barista*. I can’t solve the world’s problems, but I can try to keep the counter clean, keep the machines running, serve a good (BSD) coffee, distribute (many) stickers, and ensure that, at least here, friends can find a moment of peace and constructive sharing. But a bar is nothing without its regulars. And the success of the BSD Cafe is not mine, but that of the BSD Community and the friends who are part of it. The richness of this place is not only the quality of the Coffee (which, being BSD, is very high), but mainly the human richness of the friends who are part of it. And to them, to all of you, I say thank you. From the bottom of my heart.

We need more bars and fewer shopping malls, and that is why I recently also founded the illumos Cafe. We want people who sit down, who socialize, or who simply enjoy the atmosphere of an environment that is familiar, friendly, and positive to them. Like this conference and all the BSD Conferences, because the environment is the same. Enough of shiny shop windows; a good hot drink, in the company of friends, can help you live better. “*From the people, for the people*“.

WordPress is one of the most widely used platforms for publishing ...

2025-07-21T07:30:00Z

WordPress is one of the most widely used platforms for publishing content online. It’s often criticized as an insecure platform, but in reality WordPress itself is secure – [it’s the many plugins, unmaintained or poorly developed, that generate significant vulnerabilities](https://journal.bsd.cafe/2025/07/14/its-not-wordpress-its-the-plugins/ ).

Many people host WordPress on Linux, often using Docker. While this is a valid approach, there are excellent alternatives – sometimes even better ones – for getting your WordPress site online in a secure, reliable, and updatable manner. The goal is to make the web a safer place and avoid the computing monoculture that increasingly pushes toward uniformity of solutions and setups – an attitude that [I believe is harmful even when the solutions are open source](https://it-notes.dragas.net/2025/03/23/osday-2025-why-choose-bsd-in-2025/ ).

For this type of setup, therefore, I’ll describe how to accomplish everything using FreeBSD. The jail separation, performance, and ZFS versatility – all reasons that support this choice. This guide will serve as a foundation – everything will work at the end, but it won’t cover all possible combinations or configurations.

We’ll be using **[BastilleBSD](https://bastillebsd.org/ )**, which supports both ZFS and UFS. While FreeBSD’s base system has everything needed to create and run jails, BastilleBSD is incredibly useful for managing them. Since it’s written in shell script and has no database dependencies, management and [backups are straightforward](https://it-notes.dragas.net/2022/05/30/how-we-are-migrating-many-of-our-servers-from-linux-to-freebsd-part-2/ ). Furthermore, moving jails becomes extremely simple – either by using the *bastille* command directly or by copying the files (or datasets, if you’re using ZFS).

BastilleBSD also supports templates, but for this tutorial, we’ll perform the operations manually to understand each step.

First, install Bastille:<code>pkg install bastille</code>

Next, run the setup process:<code>bastille setup</code>

Now, bootstrap the desired FreeBSD release:<code>bastille bootstrap 14.3-RELEASE update</code>

With that, BastilleBSD is ready to go.##

Creating the JailsNow, let’s create the jail that will contain Apache, PHP, and WordPress:<code>bastille create apache 14.3-RELEASE 10.0.0.254 bastille0</code>

**Note:** This command will only create and assign an IPv4 loopback address. For IPv6, the simplest solution is to assign an address for the jail directly to the host’s interface. To do this, note an available IPv6 address and assign it to the jail. For example, if the host’s network interface is vtnet0:<code>bastille edit apache</code>

Add the following lines to the configuration file:<code>ip6 = new;ip6.addr = "vtnet0|2001:0DB8:1::443/64";</code>

Restart the jail:<code>bastille restart apache</code>

Next, let’s ensure that connections to the host’s ports 80 and 443 are redirected to the apache jail:<code>bastille rdr apache tcp 80 80bastille rdr apache tcp 443 443</code>

Now, if using ZFS, let’s create a dedicated dataset for WordPress and mount it in the jail. The reason is simple: decoupling the Apache jail from the WordPress directory will allow for updates, rollbacks, etc. of the Apache jail without touching the WordPress files. I assure you that, in the long run, this approach will save many headaches.<code>zfs create zroot/wordpressbastille mount apache /zroot/wordpress/ /usr/local/www/wordpress nullfs rw 0 0</code>

Now, let’s create the jail that will contain MariaDB:<code>bastille create mariadb 14.3-RELEASE 10.0.0.253 bastille0</code>##

Configuring the MariaDB JailAccess the MariaDB jail’s console:<code>bastille console mariadb</code>

Once inside, install the MariaDB server:<code>pkg install mariadb118-server</code>

Enable and start the mysql-server service:<code>service mysql-server enableservice mysql-server start</code>

Now, access the MySQL command line to set up the WordPress database:<code>mysql</code>

Execute the following SQL commands (you should use more secure user, password, etc.):<code>CREATE USER wp@10.0.0.254 IDENTIFIED BY 'password';CREATE DATABASE wordpress;GRANT ALL PRIVILEGES ON wordpress.* TO wp@10.0.0.254;FLUSH PRIVILEGES;</code>

Exit the MariaDB jail console to return to the host.##

Configuring the Apache & PHP JailNow, let’s configure the apache jail. First, access its console:<code>bastille console apache</code>

Inside the jail, install PHP and all the necessary extensions. We won’t install WordPress from the FreeBSD package – while it’s updated and maintained, I prefer to manage dependencies manually. It will be easier to manage updates in the long term, such as changing PHP versions, etc. At the time of writing this article, for example, the WordPress package depends on PHP 8.3 while I prefer to use 8.4.<code>pkg install php84 php84-bcmath php84-bz2 php84-calendar php84-ctype php84-curl php84-dom php84-exif php84-fileinfo php84-filter php84-ftp php84-gd php84-gettext php84-iconv php84-intl php84-mbstring php84-mysqli php84-opcache php84-pcntl php84-pdo php84-pdo_mysql php84-pecl-imagick php84-phar php84-posix php84-readline php84-session php84-shmop php84-simplexml php84-soap php84-sockets php84-sodium php84-tokenizer php84-xml php84-xmlreader php84-xmlwriter php84-xsl php84-zip php84-zlib</code>

Next, install Apache:<code>pkg install apache24</code>

Modify /usr/local/etc/apache24/httpd.conf to enable the required modules. Uncomment or add the following lines:<code>LoadModule mpm_event_module libexec/apache24/mod_mpm_event.so#LoadModule mpm_prefork_module libexec/apache24/mod_mpm_prefork.so#LoadModule mpm_worker_module libexec/apache24/mod_mpm_worker.so...LoadModule proxy_module libexec/apache24/mod_proxy.so...LoadModule proxy_fcgi_module libexec/apache24/mod_proxy_fcgi.so...LoadModule ssl_module libexec/apache24/mod_ssl.so...LoadModule rewrite_module libexec/apache24/mod_rewrite.so</code>

Enable and start the Apache service:<code>service apache24 enableservice apache24 start</code>

To optimize performance, enable PHP-FPM to listen on a socket. Modify the /usr/local/etc/php-fpm.d/www.conf file.

Comment out this line:<code>;listen = 127.0.0.1:9000</code>

And add these lines:<code>listen = /tmp/php-fpm.socklisten.owner = wwwlisten.group = www</code>

Now, we need to configure Apache to use PHP-FPM correctly. Create the file /usr/local/etc/apache24/Includes/php-fpm.conf and add the following:<code><FilesMatch \.php$> SetHandler proxy:unix:/tmp/php-fpm.sock</FilesMatch></code>

Restart Apache for the changes to take effect:<code>service apache24 graceful</code>

It’s good practice to copy the production PHP template to the final, modifiable php.ini file, which can be customized with the required options and limits:<code>cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini</code>

Make any desired changes now (or later), then enable and start PHP-FPM:<code>service php_fpm enableservice php_fpm start</code>##

Installing WordPressNavigate to the web server’s root directory:<code>cd /usr/local/www</code>

Download and extract the latest version of WordPress:<code>fetch https://wordpress.org/latest.zipunzip latest.zip</code>

Set the correct permissions:<code>chown -R www:www wordpress/</code>

Now, create an Apache virtual host configuration file at /usr/local/etc/apache24/Includes/wordpress.conf – be sure to modify the “example.com” with your own real domain name:<code><VirtualHost *:80> ServerAdmin webmaster@example.com ServerName example.com ServerAlias www.example.com DocumentRoot /usr/local/www/wordpress <Directory /usr/local/www/wordpress> DirectoryIndex index.php index.html index.htm Options FollowSymLinks MultiViews AllowOverride All Require all granted </Directory> ErrorLog "/var/log/httpd-example.com-error.log" CustomLog "/var/log/httpd-example.com-access.log" combined</VirtualHost></code>

Finally, restart Apache one more time:<code>service apache24 graceful</code>

The server will now respond on port 80 with the specified hostname, but this is absolutely not optimal or recommended. It’s therefore appropriate to generate a certificate to enable HTTPS.

For a simple solution, I recommend installing certbot with the Apache plugin to manage everything through Apache:<code>pkg install py311-certbot py311-certbot-apache</code>

In order to automatically renew the certificates, add this line to /etc/periodic.conf:<code>weekly_certbot_enable="YES"</code>

And, once installed, generate the certificate:<code>certbot --apache -d example.com -d www.example.com</code>

You can now proceed to connect to the specified URL and begin with the WordPress guided installation, remembering the authentication and database details (the host, in this example, is 10.0.0.253 – not localhost, since we installed it in a dedicated jail).

Congratulations, your site is installed and operational. Ready to receive content for publishing. It’s exposed on IPv4 and IPv6, with HTTPS (and automatic certificate renewal, managed directly by FreeBSD) and separated from the database.

Generally, I prefer to add an additional jail with a reverse proxy. This way it will be possible to install different software in different jails, ensuring that the reverse proxy “routes” requests correctly. I’ll explain this procedure in a future article.

While this is my inaugural FreeBSD post for the BSD Cafe Journal, I’ve actually written extensively on the topic for my own blog, https://it-notes.dragas.net

Yesterday, [the schedule for the next ...

2025-07-16T07:30:00Z

Yesterday, [the schedule for the next EuroBSDCon](https://events.eurobsdcon.org/2025/schedule/ ), which will be held in Zagreb, Croatia, from 25 to 28 September 2025, was published.

Last year I attended EuroBSDCon and it was a fantastic experience. I enjoyed every single moment, and connecting with the people who conceive, develop, disseminate, and are passionate about *BSD and the open-source world was an unforgettable experience. I flooded the Venue with BSD Cafe stickers and attended some incredibly interesting presentations. I wrote about it [in an article for the FreeBSD Journal](https://freebsdfoundation.org/our-work/journal/browser-based-edition/virtualization-2/conference-report-my-eurobsdcon-experience-in-dublin/ ), where I tried, as much as possible, to convey the positivity I felt at the event.

Such a positive experience pushed me, a few months later, [to propose a talk for BSDCan as well](https://indico.bsdcan.org/event/5/contributions/123/ ) – an incredible experience itself, which I will write about in more detail later.

Reading this year’s program, I see a problem that I also had to face last year and last month at BSDCan: there are so many interesting presentations that they will overlap. Fortunately, the video team will provide live streams and recordings of the individual talks, allowing us to watch the presentations even if delayed.

In Zagreb, Jeroen ( h3artbl33d :openbsd: :antifa: (npub1y90…900y) – admin of Exquisite.social) and I will present “[Liberating the social web using *BSD](https://events.eurobsdcon.org/2025/talk/PJJLFV/ )” – a 90 minutes presentation where we will talk about our experiences with Exquisite and BSD Cafe – delving into both technical and human details – an incredible experience from both points of view.

I suggest taking a look at the program and, if possible, participating. I can assure you it’s definitely worth it.

One of the reasons I’m always so happy to attend conferences ...

2025-07-14T14:10:00Z

One of the reasons I’m always so happy to attend conferences and technical events (the *real* ones – not the flashy, sponsor-driven ones designed just to sell products or services) is because I get to meet amazing people and always come away having learned something new.

I’ve been using WordPress since 2006 and have been managing hundreds of installations from a sysadmin perspective. Over time, I’ve noticed a clear pattern: most hacks and compromises happen through plugins or outdated installations. And often, these installations (and plugins) become outdated because they’ve been patched together so messily that updating them becomes nearly impossible – especially when the PHP version changes.

In March 2025, I attended a fantastic conference: [OSDay 2025](https://osday.dev/ ). I gave a talk on [why I believe it makes perfect sense to consider the BSDs in 2025](https://it-notes.dragas.net/2025/03/23/osday-2025-why-choose-bsd-in-2025/ ), but many of the other talks were truly eye-opening.

To [mark the launch of the BSD Cafe Journal](https://journal.bsd.cafe/2025/07/14/announcing-the-bsd-cafe-journal/ ), I’d like to share the link to a particularly interesting talk by Maciek Palmowski: *“How we closed almost 1k plugins in a month — the biggest WordPress bug bounty hunt.”*

What struck me right away was how much his analysis of WordPress security aligned with what I’ve seen over the years: WordPress, out of the box, is reasonably secure. It’s the plugins – often old, unmaintained, or poorly written – that make it vulnerable.

I highly recommend watching his talk. It’s definitely worth your time.

https://www.youtube.com/watch?v=Y3HsjvRAofk

Dear friends of the BSD Cafe, This idea has been in my mind since ...

2025-07-14T07:38:10Z

Dear friends of the BSD Cafe,

This idea has been in my mind since the very beginning of this adventure, almost two years ago. Over time, several people have suggested it. But until recently, I felt the timing just wasn’t right — for many reasons. Today, I believe it finally is.

So I’m happy to announce a new service: **The BSD Cafe Journal**.###

What is The BSD Cafe Journal?At first, I thought I’d use BSSG for it (I even added multi-author support with this in mind), but in the end, it didn’t feel like the right tool for the job.

The idea is to create a **multi-author space**, with content published on a fairly regular basis. A reference point for news, updates, tutorials, technical articles — a place to inform and connect.

Just like people in Italy used to stop by cafés to read the newspaper and chat about the day’s news, the BSD Cafe Journal aims to be a space for reading, sharing, and staying informed — all in the spirit of the BSD Cafe.###

What it’s Not<li>It’s not here to replace personal blogs, or excellent newsletters like Vermaden’s.</li><li>It’s not an aggregator.</li>###

What it *Is*<li>A place where authors can write original content.</li><li>A space to share links to posts on their own blogs or elsewhere.</li><li>A platform to publish guides, offer insights, or dive into technical explanations.</li>###

Our Guiding PrinciplesThe guiding principles are the same as always: **positivity, constructive discussion, promoting BSDs and open source in general.**<li>No hype: Sharing a cool new service is fine, posting non-stop about the latest trend is not.</li><li>No drama, no politics: The goal is to bring people together, not divide them. To inform, not inflame.</li><li>Respect, tolerance, and inclusivity are key. Everyone should feel welcome reading the BSD Cafe Journal — never judged, offended, or excluded.</li>###

Why WordPress?The platform I’ve chosen is WordPress, for several reasons:<li>It’s portable (runs well on all BSDs).</li><li>It has great built-in role management (contributors, authors, etc.).</li><li>And — last but not least — it supports ActivityPub.</li>

This means every author will have their own identity in the Fediverse and can be followed directly, and it’ll also be possible to follow the whole Journal.

Original and educational content is encouraged, but it’s also perfectly fine to link to existing articles elsewhere. Personally, I’ll link my technical posts from ITNotes whenever I publish them there.

The goal is simple: a **news-oriented site, rich in content, ad-free, respectful of privacy** — all under the BSD Cafe umbrella.###

Getting InvolvedContent coordination will happen in a dedicated Matrix room for authors. [There’s also a public room](https://matrix.to/#/#bsdcafejournal:bsd.cafe ) for discussing ideas, giving feedback, and sharing suggestions.

Of course, I can’t do this alone. A journal with no content is just an empty shell.

So here’s my **call to action**:

Who’s ready to lend a hand? If you enjoy writing, explaining, sharing your knowledge — **the Journal is waiting for you!**

Welcome to The BSD Cafe Journal! This platform is an ...

2025-07-14T06:22:37Z

Welcome to **The BSD Cafe Journal**! This platform is an extension of the [BSD Cafe](https://bsd.cafe ), born from a long-held vision to create a central, multi-author space for the BSD and open-source communities. Just like the traditional Italian cafés (called “*bar*“) where people gathered to read the news and chat, our Journal aims to be a vibrant hub for reading, sharing, and staying informed.###

What You’ll Find HereThe BSD Cafe Journal is dedicated to providing **original, educational, and insightful content** on a regular basis. You can expect:<li>News and Updates: Stay current with the latest happenings in the BSD and Open Source worlds.</li><li>Tutorials and Guides: Learn new skills and deepen your understanding.</li><li>Technical Articles: Dive into detailed explanations and analyses.</li><li>Author Contributions: Our writers will share original articles, link to their own blog posts (but not only), and offer unique perspectives.</li>

This isn’t an aggregator, nor is it here to replace your favorite personal blogs or newsletters. Instead, it’s a complementary space where authors can contribute high-quality content that informs and connects our community.###

Our Guiding PrinciplesThe BSD Cafe Journal operates on [the same core values that define the BSD Cafe](https://mastodon.bsd.cafe/about ):<li>Positivity and Constructive Discussion: We aim to build up, not tear down. Supporters, not haters.</li><li>Promoting BSDs and Open Source: Our focus is on the advancement and sharing of knowledge within these communities.</li><li>No Hype, No Drama, No Politics: We steer clear of trends, conflicts, and divisive topics. Our goal is to unite, not inflame.</li><li>Respect, Tolerance, and Inclusivity: Everyone is welcome here. We strive to create an environment where readers and contributors alike feel respected, never judged, offended, or excluded.</li>###

Our Platform: WordPress and the FediverseWe’ve chosen **WordPress** for its robust features, including excellent role management for contributors and authors, its portability across BSDs, and crucially, its **ActivityPub support**. This means:<li>Individual Author Identities: Each author can have their own identity within the Fediverse and be followed directly.</li><li>Follow the Journal: You can also follow the entire Journal to get all our updates.</li>

We encourage original content, but also welcome links to relevant articles published elsewhere. For example, the founder will link technical posts from [ITNotes](https://it-notes.dragas.net ) when they’re published. Our aim is a **content-rich, ad-free, privacy-respecting news site** under the BSD Café umbrella.###

Join the Conversation!Content coordination for authors happens in a dedicated, private **Matrix room**. We also have a **public Matrix room** (https://matrix.to/#/#bsdcafejournal:bsd.cafe) where you can discuss ideas, provide feedback, and share suggestions with the community.

The success of the Journal depends on its contributors. If you enjoy writing, explaining, and sharing your knowledge, we invite you to **join us!** The Journal is waiting for your unique voice.