Run it on your own OpenBSD box

It provisions a per-host TLS certificate with the machine's real addresses in the subjectAltName (so https://<ip>/ loads), mints the first administrator, populates the httpd/slowcgi chroot, writes /etc/httpd.conf, sets up audit-log rotation, loads a fail-closed firewall, and starts the web front end last.

Order matters once: ogmaprotect_netd configures the interfaces and exposes the control socket the auth plane requires, so it starts first and ogmaprotect_authd last. You do not type that order out — bootstrap reads it from the inventory the package installs, so it cannot drift from the daemons on the box, and it refuses to record a boot order at all unless every rc.d script is present.

Prefer to do it by hand? The package MESSAGE records the full enable block, in order, along with the manual admin-creation step. Follow it there rather than a list copied into a second document — that is what goes stale between releases.

1 — Check the box is in a clean state. Both must come back clean; a pending restore or a schema complaint is a reason to stop, not to push on:

doas ogmaprotectctl status
doas ogmaprotectctl schema

Confirm — or let revert — any pending change first. An apply still inside its auto-revert window is reverted when the daemons restart.

2 — Verify the new release exactly as you did the first one. An upgrade is where a substituted artifact would do the most damage; the procedure is on the download page.

3 — Stop the daemons, in reverse boot order — everything else first, ogmaprotect_netd last. The list is read from what is actually running rather than typed out:

for s in $(rcctl ls started | grep '^ogmaprotect_' | grep -v '^ogmaprotect_netd$'); do
  doas rcctl stop "$s"
done
doas rcctl stop ogmaprotect_netd

4 — Snapshot your state. This is the rollback:

doas tar czf /root/ogma-snap-$(date +%F).tgz -C /var/db/ogmaprotect .

The -C matters: on an appliance image /var/db/ogmaprotect is a symlink, so archiving the path itself captures the link and none of your state. Copy the snapshot off the box.

5 — Install in place. From the downloaded file, or by name with the repository command above:

doas pkg_add -r ./ogmaprotect-0.5.5.tgz

6 — Start back up, boot order this time: ogmaprotect_netd first, ogmaprotect_authd last.

doas rcctl start ogmaprotect_netd
for s in $(rcctl ls on | grep '^ogmaprotect_' | grep -vE '^(ogmaprotect_netd|ogmaprotect_authd)$'); do
  doas rcctl start "$s"
done
doas rcctl start ogmaprotect_authd

Then confirm every daemon came back:

doas ogmaprotectctl status

Canonical configuration carries a per-fragment schema version and upgrades are forward-only: a newer build reads an older box's configuration and re-stamps it; an older build refuses a fragment newer than it can read. Downgrading is not supported, so the pre-upgrade snapshot is the rollback — an exported backup bundle is not a downgrade path.

Restore it and you also restore credentials and secrets to their snapshot values. Restore the rendered /etc files alongside it if you ever roll back — nothing re-renders them from configuration at boot.

If a daemon does not come back, ogmaprotectctl status gives per-daemon liveness and ogmaprotectctl schema names any fragment newer than the build can read, along with the remedy.