OpenBSD on DigitalOcean: Your Own Droplet for $4.24 a Month

⏱️ Lectura: 10 min

A droplet with 512 MB of RAM, 1 vCPU and 10 GB of disk costs $4.24 a month on DigitalOcean, taxes included. That’s the real cost of running OpenBSD on DigitalOcean, according to developer Wally Jones, who documented the process while moving his personal blog from a managed service to his own server.

📑 En este artículo

1. TL;DR
2. What happened
3. Context and history
4. Technical details and performance
5. How to install OpenBSD on DigitalOcean step by step
6. Impact and analysis
7. What’s next
8. Frequently Asked Questions
   1. How much does it really cost to run OpenBSD on DigitalOcean?
   2. Why isn’t OpenBSD listed among DigitalOcean’s official distributions?
   3. Can I use full disk encryption on this droplet?
   4. What happens to the custom image after creating the droplet?
   5. Is this setup good for production or just for a personal blog?
   6. What’s the difference from installing Ubuntu or Debian directly from DigitalOcean’s catalog?
9. References

Jones published a step-by-step guide on August 23, 2026 for installing OpenBSD on DigitalOcean using the project’s miniroot image, something the platform doesn’t offer as an official distribution. The result is a minimal server running httpd(8), with TLS certificates automatically renewed via acme-client(1) against Let’s Encrypt.

TL;DR

• Developer Wally Jones published a guide on August 23, 2026 for installing OpenBSD on DigitalOcean.
• The Basic droplet costs $4.00 a month, $4.24 with taxes included.
• Droplet specs: 512 MB of RAM, 1 vCPU, 10 GB of disk and 500 GB of transfer.
• The installation starts from OpenBSD 7.9’s miniroot79.img image, uploaded as a custom image.
• DigitalOcean doesn’t offer OpenBSD or any BSD as an official distribution in its catalog.
• The final server runs httpd(8) with certificates automatically renewed by acme-client(1).
• DigitalOcean charges to host custom images: you need to delete them after creating the droplet.
• Full disk encryption requires typing the passphrase from the web console on every reboot.

What happened

Jones had been hosting his personal site first on GitHub Pages and then on Cloudflare Pages, two free, no-maintenance options. Neither gave him real control over the server: no shell, no configuration files of his own, no boot process to understand. According to his post, he wanted to return to a do-it-yourself hosting model, one where installing and configuring a UNIX system is part of the learning experience rather than an obstacle to avoid.

The practical result is a DigitalOcean Basic droplet, the platform’s cheapest plan, running OpenBSD 7.9 with httpd(8) as the web server and acme-client(1) to renew Let’s Encrypt TLS certificates without manual intervention. The total cost, custom image aside, is $4 a month before taxes.

Context and history

The motivation isn’t purely financial. Jones recounts that he met one of his closest friends more than 20 years ago on a FreeBSD shell account forum, the kind of community that formed around UNIX servers shared among strangers with common technical interests. That culture of running your own system, with its failures and its learning curve, is what drives the return to a manual hosting model in 2026, when most personal sites run on managed platforms that abstract away the operating system entirely.

DigitalOcean doesn’t offer OpenBSD or any BSD as an official distribution in its image catalog: only Linux (Ubuntu, Debian, Fedora, among others) and a handful of preconfigured container images. To run OpenBSD on DigitalOcean you need to upload a custom image, something the platform does allow through the Backups & Snapshots section.

Technical details and performance

The starting point is the miniroot image from OpenBSD, a minimal installer designed to boot on hypervisors without access to physical media. The project publishes a different image per architecture; for a standard DigitalOcean droplet, which runs on x86-64 processors, that means the amd64 image from the mirror, not an image for another architecture that the platform doesn’t offer in its Basic plans.

Once the image is uploaded, DigitalOcean lets you select it as the source when creating the droplet, under the Custom Images tab. The cheapest Basic plan includes 512 MB of RAM, 1 vCPU, 10 GB of disk and 500 GB of monthly transfer: enough for an httpd serving static pages or a lightweight blog, not for heavy workloads. One important detail: the platform doesn’t let you enable IPv6 when creating a droplet from a custom image, you have to add it afterward.

Option	Monthly cost	Control	Learning curve
GitHub Pages	Free	None (static sites only)	Low
Cloudflare Pages	Free	Low (managed build)	Low
OpenBSD droplet on DigitalOcean	~$4.24	Total (shell, configuration, firewall)	High
Generic Linux VPS	From ~$4-6	High	Medium

flowchart TD
 A["Download miniroot79.img"] --> B["Verify SHA256 checksum"]
 B --> C["Upload custom image to DigitalOcean"]
 C --> D["Create Basic droplet"]
 D --> E["Install OpenBSD via recovery console"]
 E --> F["Configure httpd and acme-client"]
 F --> G(("Site in production"))

How to install OpenBSD on DigitalOcean step by step

The first step is downloading the image and verifying its integrity before uploading it anywhere:

# Linux / macOS
curl -O -O https://cdn.openbsd.org/pub/OpenBSD/7.9/amd64/{miniroot79.img,SHA256}
sha256sum -c --ignore-missing SHA256 miniroot79.img

# macOS (if you prefer shasum over sha256sum)
shasum -a 256 -c SHA256 2>/dev/null | grep miniroot79.img

# Windows (PowerShell)
Invoke-WebRequest -Uri "https://cdn.openbsd.org/pub/OpenBSD/7.9/amd64/miniroot79.img" -OutFile miniroot79.img
Invoke-WebRequest -Uri "https://cdn.openbsd.org/pub/OpenBSD/7.9/amd64/SHA256" -OutFile SHA256
Get-FileHash miniroot79.img -Algorithm SHA256

On Linux and macOS, curl fetches the image and the checksum file in a single command; after that it’s just a matter of validating the hash. On Windows, PowerShell handles the same task with Invoke-WebRequest and Get-FileHash, which computes the SHA256 so you can compare it by hand against the value published in the SHA256 file.

With the image verified, the next step is uploading it to DigitalOcean from Backups & Snapshots, the Upload an Image button, selecting miniroot79.img, a datacenter, the Other distribution, and a descriptive name. Then, when creating the droplet, you need to choose the Basic plan, select the uploaded image from the Custom Images tab, and add an SSH key, a mandatory requirement to create the droplet even though DigitalOcean doesn’t install it automatically on a custom image.

💡 Tip: DigitalOcean charges to host custom images under Backups & Snapshots. Delete the miniroot79.img image as soon as the droplet is up and running so you stop paying for the snapshot.

With the droplet created, OpenBSD is installed from the web console: click Web Console, then Launch Recovery Console. There you type i to install and follow the interactive installer: select the vio0 interface, autoconf for IPv4 and IPv6, a strong root password, start sshd(8) by default, skip the X Window System, keep the console on com0, create a non-root user, disable SSH root login, choose a timezone, and select the sd0 disk as the target. The installer offers full disk encryption with a passphrase at this point, with a full-disk MBR layout and automatic partitioning.

⚠️ Heads up: If you enable full disk encryption, you’ll need to open DigitalOcean’s web console and type the passphrase every time the droplet reboots: OpenBSD has no equivalent to macOS’s fdesetup authrestart.

To install the system sets, use the http method, choosing a mirror close to the datacenter and the pub/OpenBSD/7.9/amd64 directory. Since this is a server with no graphical interface, it’s best to exclude the X sets (-x*), games (-gam*) and compilers (-com*), keeping only bsd, bsd.rd, base79.tgz and man79.tgz.

With the system installed and accessible over SSH, all that’s left is configuring httpd and acme-client:

# /etc/httpd.conf
server "blog.example.com" {
 listen on * port 80
 location "/.well-known/acme-challenge/*" {
 root "/acme"
 request strip 2
 }
 location * {
 block return 302 "https://$HTTP_HOST$REQUEST_URI"
 }
}

server "blog.example.com" {
 listen on * tls port 443
 root "/htdocs/blog.example.com"
 tls {
 certificate "/etc/ssl/blog.example.com.crt"
 key "/etc/ssl/private/blog.example.com.key"
 }
}

# /etc/acme-client.conf
authority letsencrypt {
 api url "https://acme-v02.api.letsencrypt.org/directory"
 account key "/etc/acme/letsencrypt-privkey.pem"
}

domain blog.example.com {
 domain key "/etc/ssl/private/blog.example.com.key"
 domain certificate "/etc/ssl/blog.example.com.crt"
 domain full chain certificate "/etc/ssl/blog.example.com.fullchain.pem"
 sign with letsencrypt
}

With those two files in place, doas rcctl enable httpd and doas rcctl start httpd bring up the server, and doas acme-client blog.example.com issues the first certificate before reloading httpd with doas rcctl reload httpd. To confirm everything is active, rcctl check httpd should return httpd(ok), and openssl x509 -in /etc/ssl/blog.example.com.crt -noout -dates shows the validity dates of the issued certificate.

Impact and analysis

For someone who only needs to publish blog posts occasionally, jumping from free managed hosting to a $4 droplet of your own has a clear opportunity cost: you have to apply security patches, watch disk space, and understand what every line of /etc/httpd.conf does. In exchange, you get full control over the stack: you can run any additional process (a feed generator, a webhook, a SQLite database), something Cloudflare Pages or GitHub Pages don’t allow by design.

Jones’s case also illustrates a broader pattern among developers: a return to small, auditable infrastructure over managed platforms that increasingly abstract away the underlying operating system. It’s not a mass movement, but it’s a steady one among those who value understanding, end to end, what runs their code.

What’s next

Jones doesn’t say in his post whether he’ll document ongoing maintenance of the droplet, such as OpenBSD updates, log rotation or backups, but the guide leaves the groundwork ready: a server with httpd(8) serving static content and acme-client(1) renewing certificates without manual intervention. The logical next step for anyone replicating the guide is automating the deployment of new content, for example with a git hook that syncs files via rsync over SSH.

📖 Summary on Telegram: View summary

Try it yourself: download the miniroot image from openbsd.org and spin up your own OpenBSD droplet on DigitalOcean for $4.24 a month today.

Frequently Asked Questions

How much does it really cost to run OpenBSD on DigitalOcean?

The Basic plan with 512 MB of RAM, 1 vCPU, 10 GB of disk and 500 GB of transfer costs $4 a month, $4.24 with taxes included according to the guide author’s own calculation.

Why isn’t OpenBSD listed among DigitalOcean’s official distributions?

DigitalOcean only offers prebuilt images of Linux distributions. To run a BSD you need to upload a custom image, like the miniroot the OpenBSD project publishes for each architecture.

Can I use full disk encryption on this droplet?

Yes, the OpenBSD installer allows it by choosing the passphrase encryption option during partitioning. The tradeoff is having to enter that passphrase manually from DigitalOcean’s web console on every reboot.

What happens to the custom image after creating the droplet?

It continues to exist as a snapshot and DigitalOcean keeps billing for it separately, so it’s best to delete it from Backups & Snapshots once the droplet has booted successfully.

Is this setup good for production or just for a personal blog?

The 512 MB of RAM on the Basic plan is comfortably enough for httpd serving static content or a lightweight blog. For high traffic or database-backed applications, a higher plan with more memory is recommended.

What’s the difference from installing Ubuntu or Debian directly from DigitalOcean’s catalog?

The main difference is the source: Ubuntu and Debian deploy in minutes from an official image, while OpenBSD requires downloading the miniroot image, uploading it as a custom image, and running the installer manually from the recovery console.

References

• Run OpenBSD on DigitalOcean for $4/month: Wally Jones’s original guide with the complete installation steps.
• OpenBSD Project: the project’s official site, with installation images by architecture.
• httpd(8): official manual page for the web server included with OpenBSD.
• acme-client(1): manual page for OpenBSD’s native ACME client used for Let’s Encrypt.
• DigitalOcean: the cloud hosting platform where the droplet was deployed.

📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day. @programacion

Imagen destacada: Foto de Hack Capital en Unsplash