You will want to get a ddos-filtered IPv4 and an IPv6 subnet from your internet provider.

Create the user znc:

<code>
$ doas adduser
</code>

<code>
Name:        znc
Password:    ****
Fullname:    znc
Uid:         10
Gid:         1017 (znc)
Groups:      znc 
Login Class: default
HOME:        /home/znc
Shell:       /sbin/nologin
OK? (y/n) [y]: y
</code>

I am not sure if this is necessary, but in /etc/login.conf, I add the following:

<code>
znc:\
  :openfiles-cur=4096:\
  :openfiles-max=8182:\
  :openfiles=4096:\
  :stacksize-cur=48M:\
  :stacksize-max=48M:\
  :maxproc-max=infinity:\
  :maxproc-cur=4096:\
  :tc=daemon:
</code>

I check to make sure znc is set to the right login class.

<code>
$ doas vipw
</code>

There should be a line with znc that looks like this (I check to make sure znc has the right login class; the '1001' is the uid, which you may find to be different from this example, but it should not be changed):

<code>
znc:*:1001:1001:znc:0:0:znc:/home/znc:/sbin/nologin
</code>

You will want to run cap_mkdb:

<code>
$ doas cap_mkdb /etc/login.conf
</code>

Now change znc shell to /bin/ksh , then continue with the steps below.

<code>
$ doas su -c znc znc
$ ulimit -a
time(cpu-seconds)    unlimited
file(blocks)         unlimited
coredump(blocks)     unlimited
data(kbytes)         33554432
stack(kbytes)        32768
lockedmem(kbytes)    329478
memory(kbytes)       985092
nofiles(descriptors) 4096
processes            1310
</code>


I then set the default shell to /sbin/nologin (note: the '1001' is the uid, which you may find to be different from this example, but it should not be changed.):

<code>
$ doas vipw

...

znc:*:1001:1001:znc:0:0:znc:/home/znc:/sbin/nologin
</code>

Run this install script (tested for OpenBSD 6.7 and znc-1.7.5) as root to put znc inside the chroot at /home/znc:

<code>
mkdir -p /home/znc/usr/lib/
mkdir -p /home/znc/usr/libexec/
mkdir -p /home/znc/etc/ssl
mkdir -p /home/znc/dev/
mkdir -p /home/znc/var/run/
mkdir -p /home/znc/home/znc/
mknod -m 644 /home/znc/dev/random c 45 0
mknod -m 644 /home/znc/dev/urandom c 45 2
mknod -m 666 /home/znc/dev/null c 2 2
cp /usr/lib/libc++.so.4.0      /home/znc/usr/lib/libc++.so.4.0
cp /usr/lib/libc++abi.so.2.1   /home/znc/usr/lib/libc++abi.so.2.1
cp /usr/lib/libc.so.96.0       /home/znc/usr/lib/libc.so.96.0
cp /usr/lib/libcrypto.so.46.1  /home/znc/usr/lib/libcrypto.so.46.1
cp /usr/lib/libm.so.10.1       /home/znc/usr/lib/libm.so.10.1
cp /usr/lib/libpthread.so.26.1 /home/znc/usr/lib/libpthread.so.26.1
cp /usr/lib/libssl.so.48.1     /home/znc/usr/lib/libssl.so.48.1
cp /usr/lib/libz.so.5.0        /home/znc/usr/lib/libz.so.5.0
cp /usr/libexec/ld.so          /home/znc/usr/libexec/ld.so
cp /etc/resolv.conf            /home/znc/etc/resolv.conf
cp /etc/ssl/cert.pem           /home/znc/etc/ssl/cert.pem
cp /var/run/ld.so.hints        /home/znc/var/run/ld.so.hints
pkg_add -B /home/znc znc
chown -R root:wheel /home/znc/dev /home/znc/etc /home/znc/usr /home/znc/var
chown -R znc:znc /home/znc/home/znc/
</code>

At first, you will need to create a conf file:

<code>
# export HOME=/home/znc/
# chroot -u znc -g znc /home/znc znc --makeconf
</code>

<code>
[ .. ] Checking for list of available modules...
[ ** ] 
[ ** ] -- Global settings --
[ ** ] 
[ ?? ] Listen on port (1025 to 65534): 31337
[ ?? ] Listen using SSL (yes/no) [no]: yes
[ ?? ] Listen using both IPv4 and IPv6 (yes/no) [yes]: no
[ .. ] Verifying the listener...
[ ** ] Unable to locate pem file: [/home/znc/.znc/znc.pem], creating it
[ .. ] Writing Pem file [/home/znc/.znc/znc.pem]...
[ ** ] Enabled global modules [webadmin]
[ ** ] 
[ ** ] -- Admin user settings --
[ ** ] 
[ ?? ] Username (alphanumeric): 
</code>

<code>
# cp /etc/ssl/my.example.com.fullchain.pem /home/znc/home/znc/.znc/
# cp /etc/ssl/private/my.example.com.key /home/znc/home/znc/.znc/
# chown znc:znc /home/znc/home/znc/.znc/my.example.com.*
</code>

Inside ~:

<code>
$ openssl dhparam -out dhparam.pem 2048
$ doas chown znc:znc dhparam.pem
$ doas mv dhparam.pem /home/znc/home/znc/.znc/
</code>

Afterwards, to run znc:

<code>
# export HOME=/home/znc
# /usr/sbin/chroot -u znc -g znc /home/znc znc >>/var/log/znc.log 2>&1 &
</code>

Creating a start script:
<code>
doas touch /etc/rc.d/znc
doas chmod +x /etc/rc.d/znc
</code>

File contents:
<code>
#!/bin/ksh
#
# $OpenBSD: znc,v 1.2 2018/01/11 19:27:07 rpe Exp $

daemon_pidfile="/home/znc/home/znc/.znc/znc.pid"
daemon="env HOME=/home/znc /usr/sbin/chroot -u znc -g znc /home/znc znc"


service_stop() {
  if [ -f $daemon_pidfile ]; then
    pid=$(sed 's/[^0-9]*//g' $daemon_pidfile)
    kill $pid
  fi
}

case "$1" in
  stop)
    service_stop
    ;;
esac


. /etc/rc.d/rc.subr

rc_reload=NO

rc_cmd $1
</code>

<code>
doas rcctl start znc
doas rcctl stop znc
</code>

Now you must add this rule in /etc/pf.conf:

<code>
pass in log quick proto tcp to port {http https} keep state (max-src-conn 30, max-src-conn-rate 20/60)
pass in log quick proto tcp to port { 1337 31337 } keep state (max 3000, max-src-conn 200) #bnc
</code>

<code>
$ doas pfctl -f /etc/pf.conf
</code>

(Here the steps are a bit out of chronology)

To start the bouncer, I run this command:

<code>
# HOME=/home/znc && /usr/sbin/chroot -u znc -g znc /home/znc znc >>/var/log/znc.log 2>&1 &
</code>

If your bouncer is already online, make sure to save the config by logging into your irc client, connected to the bouncer:

<code>
/msg *status saveconfig
</code>

Then, go add this at the top of /home/znc/home/znc/.znc/configs/znc.conf (yes I deliberately ignore the warnings):

<code>
AnonIPLimit = 10000
AuthOnlyViaModule = false
ConfigWriteDelay = 0
ConnectDelay = 5
HideVersion = false
LoadModule = chansaver
LoadModule = lastseen
LoadModule = adminlog
LoadModule = identfile
LoadModule = webadmin
LoadModule = certauth
MaxBufferSize = 10000
ProtectWebSessions = true
SSLCertFile = /home/znc/.znc/my.example.com.fullchain.pem
SSLDHParamFile = /home/znc/.znc/dhparam.pem
SSLKeyFile = /home/znc/.znc/my.example.com.key
PidFile = /home/znc/.znc/znc.pid
ServerThrottle = 30
Version = 1.7.5

<Listener listener0>
        AllowIRC = true
        AllowWeb = false
        Host = 192.168.1.1
        IPv4 = true
        IPv6 = false
        Port = 1337
        SSL = false
        URIPrefix = /
</Listener>

<Listener listener1>
        AllowIRC = true
        AllowWeb = false
        Host = 192.168.1.1
        IPv4 = true
        IPv6 = false
        Port = 31337
        SSL = true
        URIPrefix = /
</Listener>

<Listener listener2>
        AllowIRC = true
        AllowWeb = false
        Host = 2001:db8::
        IPv4 = false
        IPv6 = true
        Port = 1337
        SSL = false
        URIPrefix = /
</Listener>

<Listener listener3>
        AllowIRC = true
        AllowWeb = false
        Host = 2001:db8::
        IPv4 = false
        IPv6 = true
        Port = 31337
        SSL = true
        URIPrefix = /
</Listener>

<Listener listener4>
        AllowIRC = true
        AllowWeb = false
        Host = 127.0.0.1
        IPv4 = true
        IPv6 = false
        Port = 1337
        SSL = false
        URIPrefix = /
</Listener>

<Listener listener5>
        AllowIRC = false
        AllowWeb = true
        Host = 127.0.0.1
        IPv4 = true
        IPv6 = false
        Port = 1338
        SSL = false
        URIPrefix = /
</Listener>
</code>

We will load the identfile module by default. This is necessary to provide proper ident using [[openbsd:irc:oidentd|oidentd]]. Please follow the instructions in the link to configure ident.

I have znc bind to port 1338 without SSL for the web server. I will later use [[openbsd:net:relayd|relayd]] to provide TLS acceleration on port 443.

Replace with your own IP addresses. Then, on your irc client logged into the bouncer:

<code>
/msg *status rehash
</code>

<code>
$ doas crontab -e
</code>

Add a few lines to have ZNC reconnect every 5 minutes. ZNC will only connect if no other ZNC instance is running:

<code>
HOME=/home/znc
*/5     *       *       *       *       /usr/sbin/chroot -u znc -g znc /home/znc znc >>/var/log/znc.log 2>&1 &
</code>

To test the connection (and SSL certificate), run:

<code>
$ openssl s_client -connect my.example.com:31337
</code>

Make sure you have the proper SSL cert configured.

While you are at it, you will want to redirect any plaintext requests to the webpanel on port 80 to use SSL on port 443. Add this to /etc/httpd.conf:

<code>
server "bnc.example.com" {
        listen on * port 80
        location "/.well-known/acme-challenge/*" {
                root "/acme"
                request strip 2
        }
        location * {
                block return 302 "https://$HTTP_HOST$REQUEST_URI"
        }
}
</code>

Go ahead and reboot the web server:

<code>
$ doas rcctl restart httpd
</code>

Note: If you are using IPv6 and IPv4 for the same listener, perl IO::Socket::INET is unable to connect. Use two separate listeners.