OpenBSD 8.0

OpenBSD runs on the machines at the edge of the networks we build: gateways, firewalls, VPN endpoints and relays. Application hosts on the inside run NixOS. Together they make up what we call the Chenborg OS.

Why we still choose it

We want the machine that faces the internet to have as little going on as possible. OpenBSD ships a complete base system (kernel, pf, OpenSSH, wg(4), httpd, relayd, unbound) developed in one tree by one project and audited as a whole. Its defaults are already locked down: services are off until you enable them, and the base daemons restrict themselves with pledge(2) and unveil(2), so a compromised process can do very little.

The project’s record backs up its reputation, with two remote holes in the default install in roughly thirty years.

How we run it

We run the current release, which is 8.0 (October 2026). OpenBSD releases every six months and supports the two most recent releases, so each edge machine is upgraded with sysupgrade at least once a year and patched with syspatch in between. The configuration files (pf.conf, hostname.wg0, relayd.conf) sit in the same repository as the NixOS fleet and go through the same review.

Where it falls short

It is a second operating system for your team to learn, and that has a cost. Nothing in it matches NixOS’s declarative rebuild or rollback: the configuration files are versioned, but the machine as a whole is not described the way a NixOS host is. Hardware support and the range of packages are narrower than on Linux. You also have to keep up with the six-month release cycle, because after skipping two releases you no longer receive errata. For a network with one firewall and no appetite for BSD, nftables on NixOS is a defensible choice.