OgmaProtect is installed. To bring it up for the first time, run:

    doas ogmaprotect-setup bootstrap

That is the whole first install. It enables and starts the 16 daemons in the
order they require, creates the first administrator and prints a one-time
password to the console, generates the per-host TLS certificate, populates the
httpd/slowcgi chroot, writes /etc/httpd.conf and the slowcgi deadline backstop
(10.C5), configures audit-log rotation, loads a fail-closed firewall, and starts
the web front end LAST -- so the management plane never binds *:443 before the
firewall is loaded.

Then sign in at https://<this-host>/ogmaprotect/ as "admin", with the one-time
password it wrote to the console. You must change it at first login.

Installed over SSH and not watching the console? Then you did not see that
password, and it is in no file or log (by design). As root, set one instead:

    ogmaprotectctl user set-password admin

It prompts for the new password; then sign in with it.

`pkg_add` deliberately enabled and started nothing. OpenBSD packages must not,
and this one does not -- running the command above is the consent the installer
withholds. It is safe to re-run: the daemon enable is recorded as the boot
order, and the provisioner re-runs on every boot, so it also re-applies the
managed /etc files and re-syncs the chroot after an OS upgrade (sysmerge or
syspatch) that reverts them.

It reads its templates, and the daemon boot order, from
/etc/examples/ogmaprotect/ (httpd.conf, the fail-closed bootstrap pf.boot.conf,
daemon_inventory, and rc.firsttime.sample for the hardened appliance image --
the Lite pkg_add SKU uses the rc.d one-shot instead).

--------------------------------------------------------------------------
Bringing it up by hand
--------------------------------------------------------------------------

`bootstrap` exists so nobody has to do the following, but the order it applies
is not arbitrary and is recorded here as the canonical one. netd configures the
interfaces and exposes the control socket that authd (the web/auth plane)
hard-requires, so netd must come first and authd last. It also brings rtd up
before gwmond and netd before arpd, as those daemons expect. rcctl enable
records this as the boot order, so a wrong order here leaves the management
plane dead after every reboot.

  1. Enable, in this exact order, then start the same way (swap `enable` for
     `start`):

       rcctl enable ogmaprotect_netd ogmaprotect_rtd ogmaprotect_pfd \
           ogmaprotect_dnsd ogmaprotect_dhcpd ogmaprotect_routed \
           ogmaprotect_diagd ogmaprotect_healthd ogmaprotect_arpd \
           ogmaprotect_logd ogmaprotect_timed ogmaprotect_ipsecd \
           ogmaprotect_sysd ogmaprotect_alertd ogmaprotect_gwmond \
           ogmaprotect_authd

  2. Create the first administrator over authd's control socket. Run this as
     root on the console (or over SSH) -- a fresh box has no other way in yet,
     and the web UI stays down until an administrator exists:

       ogmaprotectctl user add admin
       ogmaprotectctl role grant admin net-admin

  3. Enable and start the firstboot provisioner LAST -- after the daemons above.
     It is the single tool that turns the installed binaries into a working
     HTTPS login, and it is the SOLE, LAST starter of httpd -- do NOT
     `rcctl enable httpd` yourself, or the management plane would bind *:443 at
     boot before the firewall is loaded.

       rcctl enable ogmaprotect_setup
       rcctl start  ogmaprotect_setup

     The web UI comes up only once an administrator exists (step 2), so the
     login is never exposed without an account. If you create the admin after
     starting the provisioner, just re-run `rcctl start ogmaprotect_setup`.

--------------------------------------------------------------------------
Boot resilience: unattended fsck repair (apply once, per box)
--------------------------------------------------------------------------

Stock OpenBSD halts on the console when the automatic file system check
fails after an unclean shutdown -- a headless router stays down until
someone plugs in. This package ships a patch to /etc/rc (INERT until you
apply it; /etc/rc is base-OS territory and pkg_add never edits it) that runs
`fsck -y` unattended instead, with a 3-reboot loop breaker and a fail-closed
firewall guard. Apply it on every box you cannot walk to:

    doas ogma-fsck-rc-apply enable       # refuses on a context mismatch
    doas ogma-fsck-rc-apply status

Until it is applied, `ogmaprotectctl status`, the System > Control page and
the health card report `rc patch NOT applied` as a WARNING. Re-run `enable`
after every sysupgrade (the OS replaces /etc/rc); the same WARNING tells you
when. Turn auto-repair OFF only from System > Control or
`ogmaprotectctl fsck-autorepair disable` -- never by editing the patch.

Configuration lives in /etc/ogmaprotect/ and mutable state in
/var/db/ogmaprotect/ (canonical config, revisions, users.db). That directory is
preserved across upgrades and pkg_delete. Upgrades are forward-only, so a
pre-upgrade snapshot of that directory is your rollback -- take it with
"tar czf <dest> -C /var/db/ogmaprotect ." (archiving the path itself captures
only a symlink on an appliance image) and keep it off the box. An exported
backup bundle is not a downgrade path.

License: OgmaProtect is licensed under the PolyForm Small Business License 1.0.0
(source-available; free for companies under 100 people and under USD 1M revenue).
You may pass copies on with the terms attached, but you may not sublicense --
anyone you give a copy to needs their own license. The full terms and the
Required Notice are installed at /etc/ogmaprotect/LICENSE and
/etc/ogmaprotect/NOTICE. If you use it beyond the Small Business terms, or want
to deploy it for clients, contact Wireless Connect Ltd. for a license.
