Mainly intended for myself to document my config but this may be useful to others as well. Wherever possible this configuration uses [[/LibreSSL]] as the [[/OpenSSL]] library.

====== System overview ======

LAN:     192.2.0.0/24
Gateway: 192.2.0.254
Server:  192.2.0.1

===== Hardware =====
  * Old laptop
  * Pentium i5 520M 2.4GHz
  * 4GB DDR3 SO-DIMM (8GB upgrade ordered)
  * Storage (ZFS)
    - zroot:  120GB SSD Transcend %%JetDrive%% 420 (internal 2.5" SATA slot)
    - zbay:     1TB   HGST Travelstar 7K1000 2.5" HDD (Drivebay caddy)
    - <del>zesata: 500GB Seagate Momentus 5400.6 2.5" HDD (not yet, eSATA-p external)</del>

===== Intended use =====
**Links will go to more detailed wiki articles**
  - [[BernardSpil/DHCP_DNS|DHCP/DNS]] server
  - File-server
  - Backup target for Desktop and laptops
  - Cloud storage server
  - Web-server
    * Personal website
    * Family website
    * Freelance website 
  - [[BernardSpil/MailServer|Mail-server]] (AKA %%OpenSMTPd%%) (incl spam classification and virus scanning)

===== Software =====
  - [[http://freshports.org/dns/dnsmasq|dnsmasq]] for DHCP and dynamic DNS
  - [[http://freshports.org/dns/unbound|Unbound]] as validating, caching and recursive DNS resolver
  - [[http://freshports.org/security/openldap-server|OpenLDAP]] as user and authentication backend
  - [[http://freshports.org/net/samba42|Samba 4.2]] as file-server and for backup-target
  - [[http://freshports.org/net/rsync|rsync]] for backups
  - [[http://freshports.org/net/openvpn|OpenVPN]] for secure internet access for my mobile devices
  - [[http://freshports.org/www/apache24|Apache 2.4]] as web-server
    - [[http://freshports.org/www/owncloud|ownCloud]] as cloud storage/calendar/contacts server
    - [[http://freshports.org/lang/php56|PHP 5.6]], etc. as required
    - [[http://freshports.org/databases/mariadb100-server|MariaDB]] for apps requiring database backend
  - [[http://freshports.org/mail/opensmtpd|OpenSMTPd]] as mail server
    - [[http://freshports.org/mail/dovecot2|Dovecot]] as LDA and IMAP server
    - [[http://freshports.org/security/amavisd-new|AMaVisD]] as networked scanner daemon
    - [[http://freshports.org/security/clamav|ClamAV]] as virus scanner
    - [[http://freshports.org/mail/spamassassin|SpamAssassin]] as rule-based spam classifier
    - [[http://freshports.org/mail/dspam|dspam]] as Bayesian spam classifier
  - System management
    * [[http://freshports.org/ports-mgmt/poudriere|Poudriere]] for keeping ports up-to-date
    * [[Ports/sysutils/ezjail|ezjail]] to manage the jails
    * [[http://freshports.org/smartmontools|smartmontools]] to monitor disks

===== Jails =====
Anything that can be connected from the internet is jailed. Mail scanner was separated provide additional isolation.
  * db:   Home of %%MariaDB%% server
  * http: Home of Apache and the web applications and content
  * mail: Home of MTA and IMAP-server
  * scan: Home of Amavisd, clamav, spamassassin, dspam
  * tor:  Home of my TOR router
Every jail is firewalled using ipfw.
  - tor gets access to the internet only (not LAN) and is denied anything else
  - Allow all jails to access DNS
  - jails get specific access, anything else is denied