sysrc jail_enable=YES
    Sysrc jail_parallel_start=YES
    

Create zfs datasets.

zfs create -o mountpoint=/jails zroot/jails
    zfs create zroot/jails/media
    zfs create zroot/jails/base
    

Fetch userland.

fetch https://download.freebsd.org/ftp/releases/$(uname -m)/$(freebsd-version -k)/base.txz -o /jails/media/$(freebsd-version -k)-base.txz
    

Extract it to base.

cd /jails
    tar -xf media/$(freebsd-version)-base.txz -C base --unlink
    ls -l base
    

Copy DNS and time zone configurations to the template.

cp /etc/resolv.conf base/etc/
    cp /etc/localtime base/etc/
    

Patch base.

freebsd-update -b /jails/base fetch install
    

Bootstrap pkg (execute pkg(8) inside a chroot(8)).

pkg -c /jails/base install -y pkg
    

Install git as an example.

pkg -c /jails/base install -y git
    

Create snapshot, this will become a template.

zfs snapshot zroot/jails/base@$(freebsd-version)-$(date +%d-%b-%y)
    

Clone template for new jail.

zfs clone zroot/jails/base@<snapshot from above> zroot/jails/alcatraz
    

Set default configuration in /etc/jail.conf.

exec.start = "/bin/sh /etc/rc";
    exec.stop = "/bin/sh /etc/rc.shutdown jail";

    allow.raw_sockets;
    exec.clean;
    mount.devfs;

    devfs_ruleset=4;
    enforce_statfs=1;
    securelevel=2;

    .include "/etc/jail.conf.d/*.conf";
    

Jail specific configurations should go inside /etc/jail.conf.d/.

alcatraz {
    exec.consolelog = "/var/log/jail_console_${name}.log";

    host.hostname = "${name}.jail";
    path = "/jails/${name}";

    ip4.addr = 192.168.0.63;
    interface = re0;
    }
    

Add new jail to the rc.

sysrc jail_list+="alcatraz"
    

Jail is ready to go.

jls
    service jail start alcatraz
    jls
    jexec -u root alcatraz
    

kldload vmm
    

Create tap interface for the network device.

ifconfig tap0 create
    sysctl net.link.tap.up_on_open=1
    

Create bridge interface, add tap and physical interface to it.

ifconfig bridge0 create
    ifconfig bridge0 addm tap0
    ifconfig bridge0 addm re0
    ifconfig bridge0 up
    

Create ZFS datasets.

zfs create -o mountpoint=/bhyve zroot/bhyve
    zfs create zroot/bhyve/media
    zfs create zroot/bhyve/freebsd
    

Download FreeBSD image.

cd /bhyve/media
    fetch https://download.freebsd.org/releases/amd64/amd64/ISO-IMAGES/15.0/FreeBSD-15.0-RELEASE-amd64-bootonly.iso
    

Create virtual disk for the guest machine. It's a block device (ZFS volume), not directory.

zfs create -V 16G -o volmode=dev zroot/bhyve/freebsd/guest
    

Create and boot VM.

bhyve -AHP \
    -c 4 \
    -m 8G \
    -s 0:0,hostbridge \
    -s 1:0,lpc \
    -s 2:0,virtio-net,tap0 \
    -s 3:0,virtio-blk,/dev/zvol/zroot/bhyve/freebsd/guest \
    -s 4:0,ahci-cd,/bhyve/media/FreeBSD-15.0-RELEASE-amd64-bootonly.iso \
    -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
    -l com1,stdio \
    freebsd
    

It's possible to use null modem device.

kldload nmdm
    

Replace stdio with /dev/nmdm0A.

You can connect with cu(1) (drop connection by pressing RET ~. RET).

cu -l /dev/nmdm0B
    

You can also connect with screen(4).

screen /dev/nmdm0B 115200
    

See currently running VMs.

ls -l /dev/vmm/
    

Use bhyvectl(8) to control instances.

Start previously created VM.

bhyve -AHP \
    -c 4 \
    -m 8G \
    -s 0:0,hostbridge \
    -s 1:0,lpc \
    -s 2:0,virtio-net,tap0 \
    -s 3:0,virtio-blk,/dev/zvol/zroot/bhyve/freebsd/guest \
    -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
    -l com1,/dev/nmdm0A \
    freebsd &
    

There is an example script for running VM in FreeBSD.

sh /usr/share/examples/bhyve/vmrun.sh -h
    

Use VNC for GUI.

bhyve -AHP \
    -c 4 \
    -m 8G \
    -s 0:0,hostbridge \
    -s 1:0,lpc \
    -s 2:0,virtio-net,tap0 \
    -s 3:0,virtio-blk,/dev/zvol/zroot/bhyve/freebsd/guest \
    -s 4:0,fbuf,tcp=127.0.0.1:5900,w=800,h=600 \
    -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
    -l com1,/dev/nmdm0A \
    freebsd &
    

Connect to 127.0.0.1:5900 with your VNC client.

I used another machine to download pkg(8) and the missing kmod. To find the correct package names I checked "packages" section on freshports website. In my case I was looking for FreeBSD:15:quarterly, amd64. I needed pkg-2.4.2.pkg and realtek-re-kmod-1100.00.1500068_1.pkg.

I used pkg.freebsd with the following URL schema to download the files: https://pkg.freebsd.org/FreeBSD:15:aarch64/quarterly/All/<pkg_name>.pkg

I used a USB thumb-drive formatted with FAT32 and moved downloaded files there. Then I was ready to go back to the machine that was offline.

dmesg | tail
    mkdir -p /mnt/usb
    mount -t msdosfs /dev/da0s1 /mnt/usb
    cp -R /mnt/usb/ tmp/
    

tar xf pkg-2.4.2.pkg
    usr/local/sbin/pkg-static add pkg-2.4.2.pkg
    

This is a chicken-and-egg situation. We need to pkg to install pkg. ¯\_(ツ)_/¯

pkg add realtek-re-kmod-1100.00.1500068_1.pkg
    

# /boot/loader.conf
    if_re_load="YES"
    if_re_name="/boot/modules/if_re.ko"
    

# /init/rc.conf
    ifconfig_re0="DHCP"
    

sysrc linux_enable="YES"
    service linux start
    

Double check if service is running.

service -e | grep linux
    

Kernel modules and filesystems should be visible under /compat/linux.

There are some binaries already available in packages, names start with "linux-".

pkg search ^linux
    

I decided to check "Discord" which is not available on FreeBSD 14.3-RELEASE.

pkg install linux-discord
    

In my case there are over 550MB to be downloaded. This is because GNU/Linux binaries require userland which is downloaded and installed automatically alongside the package.

touch foo.txt
    zfs snapshot zroot/home/user@create_foo
    touch bar.txt
    zfs snapshot zroot/home/user@create_bar
    

zfs list -t snapshot
    

NAME                         USED  AVAIL  REFER  MOUNTPOINT
    zroot/home/user@create_foo    64K      -   132K  -
    zroot/home/user@create_bar     0B      -   140K  -
    

Let's say I've removed foo.txt by a mistake.

rm foo.txt
    

I can now rollback to my latest snapshot to get it back.

zfs rollback zroot/home/user@create_bar
    

I can't rollback to the user@create_foo, it has to be the latest one.

bastille setup
    

There should be now bastille0 interface visible when running ifconfig.

Next I will bootstrap FreeBSD release that I will use for my jail.

bastille bootstrap 14.3-RELEASE
    

Bastille can create few different type of jails. I will start with the "thin" one since this is the default one. I would pick "thick" if I wanted my jail to act like a full, independent FreeBSD install.

bastille create alcatraz 14.3-RELEASE 192.168.19.63
    

Then I double check if jail was created and if it's running.

bastille list all
    

If already running I'm free to launch a login shell inside that jail.

bastille console alcatraz
    

pkg install gnupg
    gpg --full-generate-key
    gpg --list-keys
    

Sign and encrypt single file.

gpg -r gpg.5kky7@passmail.net -e -s foo.txt
    # gpg --recipient gpg.5kky7@passmail.net --encrypt --sign foo.txt
    

Decrypt file (will also verify as long as there is a signature).

gpg -o foo.txt -d foo.txt.gpg
    # gpg --output foo.txt --decrypt foo.txt.gpg
    

The following won't work because gpg first signs then encodes the data. Because of that the signature is hidden.

gpg --verify foo.txt.gpg
    

I use gpgtar(1) for encoding directories.

It's also possible to encode (and sign) with symmetric key (password).

gpg --symmetric -s --cipher-algo AES256 foo.txt
    gpg -o foo.txt -d foo.txt.gpg
    

Config file can be pretty minimal.

# /usr/local/etc/doas.conf
    permit nopass cdrmack as root
    

After installing doas there should be an example config "doas.conf.sample" available under /usr/local/etc/.

Then I check current partition information with gpart show /dev/da0.

I use dd(1) to fill the device with a bunch of zeroes.

dd if=/dev/zero of=/dev/da0 bs=1M status=progress
    

gpart create -s gpt /dev/da0
    gpart add -t freebsd-ufs /dev/da0
    newfs /dev/da0p1
    

mount /dev/da0p1 /media/usb
    # do stuff
    umount /media/usb
    

geli init /dev/da0
    

geli clear /dev/da0
    

pkg install vm-bhyve
    pkg install bhyve-firmware
    

First of all I need dataset for virtual machines (if ZFS is being used).

zfs create zroot/bhyve
    

Then update my system configuration (rc.conf(5)).

sysrc vm_enable="YES"
    sysrc vm_dir="zfs:zroot/bhyve"
    

I run vm init to finish initialisation. This will create subdirectories inside the dataset.

vm init
    

To enable network for the VMs I create virtual switch and attach my network interface to it.

iconfig
    vm switch create public
    vm switch add public re0
    ifconfig
    

Now I'm ready to create Debian's VM. There should be a sample config for this already.

cp /usr/local/share/examples/vm-bhyve/debian.conf /zroot/bhyve/.templates/
    

In my case I want to use debian template (-t) and specify disk image size (-s) to be 40G. The following command will create directory with config, disk image and log. This is also a good moment to edit VM's config file and set things like RAM.

vm create -t debian -s 40G debian_vm
    

VM is now created but nothing is yet installed on it. I need installation image, it can be downloaded with vm iso (it will be placed inside /zroot/bhyve/.iso/).

vm iso https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/debian-12.9.0-amd64-DVD-1.iso
    

Now I can install Debian on my new VM.

vm install -f debian_vm debian-12.9.0-amd64-DVD-1.iso
    

I don't use -f if I plan to connect via VNC. Otherwise guest will be started in in the foreground on stdio.

After the installation VM is ready to be used.

vm start debian_vm
    vm console debian_vm
    

vm(8) uses cu(1), to exit console back to the host use ~^D or ~.~.

GUI is available via VNC (works only with uefi). There should be sample configs available.

egrep "^graphics" -R /usr/local/share/examples/vm-bhyve/
    

Make sure sshd(8) is running on the guest.

service sshd status
    

If it's not you might need to add that daemon to the rc.conf(5).

sysrc sshd_enable="YES"
    

It should run automatically after reboot but for now you probably have to start it manually.

service sshd start
    

With sshd enabled on guest make sure you try to connect to the correct system (VM) from the host.

Run the following command on the guest to display fingerprint of its public key file.

ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
    

Try to ssh to the guest from host and compare fingerprints.

ssh <guest_IP>
    

Transfer host's public key to the guest with scp(1).

scp ~/.ssh/<host_public_key>.pub <guest_user>@<guest_IP>:
    

Authorize host's public key on guest.

cat <host_public_key>.pub >> ~/.ssh/authorized_keys
    

It should be now possible to ssh to guest without credentials.

ssh <guest_user>@<guest_IP>
    

Consider adding entry to the ~/.ssh/config to make it even easier.

Host <name>
    User <guest_user>
    HostName <guest_IP>
    IdentityFile ~/.ssh/<host_private_key>
    

Now it's even better.

ssh <name>
    

Comparing to the root's /etc/crontab I don't have to specify as a "who" the command should be run.

crontab -e
    

    #minute	hour	mday	month	wday	command
    0	*	*	*	*	echo "do stuff every hour"
    

eval `ssh-agent -c`
    

With ssh-agent running I use ssh-add(1) to add private key to it.

ssh-add ~/.ssh/<private_key>
    

That's it, ssh-agent will now hold that private key and use it for the public key authentication. If I want to list all identities currently represented by the agent I use ssh-agent -l command.

pkg install amfora
    

When I run amfora I can press ? to see list of shortcuts.

My most used shortcuts: 1-0 go to links 0-10 SPC enter address or link ID b go back in history f go forward in history C-b open bookmarks C-d add, change or remove bookmark

If I want to go to the link "11" I press SPC and then provide link ID (11).

I've decided to move all of them to /usr/local/share/fonts/ after reading /usr/local/etc/fonts/fonts.conf file.

<!-- Font directory list -->

    <dir>/usr/local/share/fonts</dir>

    <dir prefix="xdg">fonts</dir>
    <!-- the following element will be removed in the future -->
    <dir>~/.fonts</dir>
    

Based on the comment "the following element will be removed in the future" I think it's safe to assume that ~/.fonts might stop working at some point.

Remember to run fc-cache(1) to scan the font directories and build cache files. I usually run it with -f flag to force re-generation.

Rather than use wg(8) directly, I've decided to play around with wg-quick(8) (wireguard-tools package).

pkg install wireguard-tools
    

WireGuard supports INI-like config files, see the example below (taken from the wg(8)).

    [Interface]
    PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
    ListenPort = 51820

    [Peer]
    PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
    Endpoint = 192.95.5.67:1234
    AllowedIPs = 10.192.122.3/32, 10.192.124.1/24
    

I've put few config files from my provider inside /usr/local/etc/wireguard/. These files can be used to add and set up interfaces.

wg-quick up /etc/wireguard/sample.conf
    

I can skip the full path and just use the config name.

wg-quick up sample
    

This works because wg-quick looks for configs inside /usr/local/etc/wireguard/ directory.

When I'm done with the given interface I use wg-quick down to tear it down.

wg-quick down sample
    

To show current WireGuard configuration and runtime information I simply call wg.

It can be easily set by editing ~/.xinitrc file. This file is being used by xinit(1) to start the X Window System server and a first client program.

# .xinitrc
    # ...
    emacs --daemon
    # ...
    

According to emacs(1) the emacs --daemon command starts Emacs as daemon (o rly?), enables Emacs server and disconnects from the terminal.

With server running in the background, I can connect to it with the emacsclient(1) command.

% emacsclient -c -a ""
    

To create a new frame, the flag -c is used. This is particularly useful when Emacs is already open but I don't want to reuse the existing frame. The second flag, -a, initiates an alternate editor if the Emacs server is not running. If it is left empty, as in this case, it runs emacs --daemon and attempts to connect to it.

To make my life easier, I've placed that line in a file named ec, made it executable, and saved it in a directory within my PATH (/usr/local/bin/, to be specific). Now, I can launch Emacs client just like any other program.