Ansible on OpenBSD 7.6 Automation Complete Guide

By Luca Berton · Published 2024-01-01 · Category: installation

Automate OpenBSD 7.6 servers with Ansible: pkg_add, rc.conf.local, pf firewall, OpenSSH defaults, syspatch, and OpenBSD-specific modules.

OpenBSD 7.6 (October 2024) is the security-focused BSD release. It ships LibreSSL 4.0, OpenSSH 9.9 (with PQ KEX), pf firewall, syspatch for binary patches, and sysupgrade for major-version upgrades. Two releases are supported at any time (7.5 and 7.6 currently). Ansible's role on OpenBSD is mostly bootstrapping packages, dropping pf.conf, managing rc.conf.local, and orchestrating syspatch/sysupgrade.

OpenBSD 7.6 release facts

Item	Value
Release	2024-10-08
Default shell	ksh
Package tool	pkg_add / pkg_delete
Init	rc.d (BSD-style)
Firewall	pf
Patch tool	syspatch
Upgrade tool	sysupgrade

Ansible-core compatibility

Use ansible-core 2.18 LTS. Bootstrap Python:

pkg_add python-3.10

[openbsd76]
obsd76-01.example.com

[openbsd76:vars]
ansible_user=root
ansible_python_interpreter=/usr/local/bin/python3.10

Baseline playbook

- name: OpenBSD 7.6 baseline
  hosts: openbsd76
  tasks:
    - name: Install baseline packages
      community.general.openbsd_pkg:
        name:
          - vim--no_x11
          - curl
          - rsync
          - htop--
          - tmux
          - sudo--
          - py3-pip
        state: present

    - name: Apply syspatch
      ansible.builtin.command: syspatch
      register: sp
      changed_when: "'Installing patch' in sp.stdout"

rc.conf.local

- name: Manage rc.conf.local
  hosts: openbsd76
  tasks:
    - name: Enable httpd
      ansible.builtin.lineinfile:
        path: /etc/rc.conf.local
        create: true
        regexp: '^httpd_flags='
        line: 'httpd_flags=""'
        mode: "0644"

    - name: Disable apmd
      ansible.builtin.lineinfile:
        path: /etc/rc.conf.local
        regexp: '^apmd_flags='
        line: 'apmd_flags="NO"'

pf firewall

- name: Configure pf on OpenBSD
  hosts: openbsd76
  handlers:
    - name: reload pf
      ansible.builtin.command: pfctl -f /etc/pf.conf
  tasks:
    - name: Drop pf.conf
      ansible.builtin.copy:
        dest: /etc/pf.conf
        mode: "0600"
        content: |
          set skip on lo
          set block-policy drop
          match in all scrub (no-df max-mss 1440)
          block in
          pass in proto tcp to any port {22, 80, 443} keep state
          pass out keep state
      notify: reload pf

OpenSSH defaults (already strict)

- name: Reinforce SSH defaults
  hosts: openbsd76
  handlers:
    - name: restart sshd
      ansible.builtin.command: rcctl restart sshd
  tasks:
    - name: Tight sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?{{ item.k }}'
        line: '{{ item.k }} {{ item.v }}'
      loop:
        - { k: 'PermitRootLogin',        v: 'no' }
        - { k: 'PasswordAuthentication', v: 'no' }
        - { k: 'KbdInteractiveAuthentication', v: 'no' }
      notify: restart sshd

sysupgrade orchestration (major version upgrades)

- name: Run sysupgrade
  hosts: openbsd75_upgrade
  tasks:
    - name: Stage next release
      ansible.builtin.command: sysupgrade -r
      async: 1800
      poll: 0

    - name: Wait for SSH after reboot
      ansible.builtin.wait_for_connection:
        delay: 30
        timeout: 600

    - name: Run pkg_add -u
      ansible.builtin.command: pkg_add -u
      register: pa
      changed_when: "'Update' in pa.stdout"

Best practices

OpenBSD's defaults are already tight — avoid weakening them with copy/paste configs from Linux.
Schedule syspatch weekly via Ansible; OpenBSD does not auto-apply.
Keep pf.conf in Git; treat it like infrastructure code.
OpenBSD doesn't ship systemd or PAM — translate Linux idioms (e.g. service -> rcctl).

Conclusion

OpenBSD 7.6 + Ansible delivers minimal, security-first servers. Use community.general.openbsd_pkg, lineinfile for rc.conf.local, the copy module for pf.conf, and orchestrate syspatch and sysupgrade to keep the fleet current.

Installing Ansible on OpenBSD

# Install via pkg_add
pkg_add ansible

# Or via pip
pip3 install ansible

# Verify
ansible --version

OpenBSD Package Management

- name: Configure OpenBSD 7.6
  hosts: openbsd
  become: true
  vars:
    ansible_python_interpreter: /usr/local/bin/python3
  tasks:
    - name: Install packages
      community.general.openbsd_pkg:
        name:
          - vim
          - git
          - curl
          - nginx
        state: present

    - name: Enable and start services
      ansible.builtin.service:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - sshd
        - nginx

PF Firewall Configuration

    - name: Deploy PF rules
      ansible.builtin.template:
        src: pf.conf.j2
        dest: /etc/pf.conf
        owner: root
        group: wheel
        mode: '0600'
      notify: reload pf

  handlers:
    - name: reload pf
      ansible.builtin.command: pfctl -f /etc/pf.conf

FAQ

Does Ansible work on OpenBSD?

Yes. Install Python 3 and Ansible via pkg_add. Set ansible_python_interpreter: /usr/local/bin/python3 in inventory since OpenBSD doesn't include Python by default.

Which package module for OpenBSD?

Use community.general.openbsd_pkg. The generic ansible.builtin.package also detects OpenBSD's pkg_add automatically.

Category: installation

Browse all Ansible tutorials · AnsiblePilot Home

AnsiblePilot — Master Ansible Automation

Popular Topics

About Luca Berton