levitating: nope

devel/glib20@bootstrap devel/gobject-introspection@bootstrap breaks portmaster

stop promoting Poudriere

Oclair: ??

Oclair: Is there some breakage on ports-current or something?

Poudriere zelots breaking portmaster

again...

I just upgraded a fileserver from 13.5 to 14.2 and got through the pkg bootstrap unproblematically.

Ah, hm.

upgrade notes are taken from /usr/ports/UPDATING 2025-04-02

not working as described, it takes the system down in a loop

Ah, that sucks. :/ Did you open a bug about it?

I've been using binary packages from FreeBSD directly for aeons.

now attempting to run make in /usr/ports/devel/glib20/

Oclair: Is it just builds with portmaster that break? Are you able to run make and friends by hand?

I had something like 5000 builds running simultaneously using portmaster, they intentionally made it to nuke any system running portmaster

Poudriere zealots...

at least we dont deal with gplv2

... gplv3

Oclair: My experiences with Poudriere have been relatively pleasant in the past. Has it misbehaved on you? Or is it just that you don't want to be forced to use particular tooling when other stuff is still viable and comfortable?

I'm certainly that way with enough tools.

I am talking about people who justify forcing people to use Poudriere not Poudriere per say

pkg-static: glib-2.82.4_1,2 conflicts with gobject-introspection-1.78.1_2,1 (installs files into the same place). Problematic file: /usr/local/lib/girepository-1.0/GLib-2.0.typelib

not only does it break portmaster, it breaks ports

this has to stop

How's that a bug with Poudriere?

Isn't that a bug with those two packages?

Or rather, one of them?

Poudriere is used to justify bad coding

Not sure how Poudriere relates to those two packages, is what I'm saying and what I'm curious about.

nor am I, I didnt say that

Why is arm64 a second class citizen?

freebsd on a actually spinning hard drive is ruff.. I had It before and im thinking of doing it again. What do you guys think ?

any specific reason not to use a SSD?

oxbar: ANYTHING modern on a spinning hard drive is ruff. we've all been spoiled far too long ;)

It gets less bad if you can use ZFS and an SSD for L2ARC

deepy: Hard to open this laptop up.. can I install FreeBSD and make the spinning hard drive easier some how or am I just screwed ?

oxbar: what laptop is that? I've yet to see a laptop where accessing the harddrive isn't easy

(That's a lie actually, the EeePC 901 is incredibly compact in a bad way)

Is it possible to use moonlight on freebsd?

without hardware acceleration

Oclair: poudriere is mostly used to workaround bad coding in upstream projects, as those don't build properly in unclean environments (like that cyclic dependency between glib and gobject-introspection), try forcing portmaster to update gobject-introspection first, as that file moved from gobject-introspection to glib

wait, why does portmaster even try to update glib first? glib needs gobject-introspection, so that should be updated first

hi all. how can i fix "ld-elf.so.1: Shared object "libheimntlm.so.11" not found, required by "libcurl.so.4""

(git pull --ff-only)

on -current

do you have /usr/lib/libheimntlm.so.11 ? if not anything matching /usr/lib/libheimntlm.so.* ?

nimaje: no

start at the beginning. OS? Platform? how did you install git?

freebsd -current amd64

git installed with pkg

curl seems to be looking for that lib

the lib is part of base

judging by hier

i domn't know what libheimntlm.so is made from though

ohh htink ive found it

seems to be part of /usr/src/kerberos5/lib/libheimntlm

just out of curiosity when was the last time you updated the system

f451

sstochi: about 30 mins ago. ive found the answer though:- my src.conf has wihtout-kerebos and git was installed from the pkg cluster

whats why its not there

sorry for the nouse

I see

noise even

basically if src is customised then ports need to take account of those customisations - rules out using hte pkg cluster

fzf, syncthing, tailscale, and restic all show as orphaned for me on amd64 in the quarterly repository.

maybe orphaned is the wrong term. not existing in the repo.

go failed to build and resulted in lots of skipped packages, not sure about fzf, but I think the others are written in go

nimaje: thanks for the insight

hello

I'm considering installing a bsd, had some concerns about freebsd's security practices

I read somewhere that freebsd doesn't have a thorough review process for the code that gets submitted to the pkg collection?

Guest68: please don't rush, take a look at workflows on FreeBSD Bugzilla and project Phabricator, draw conclusions and decide

Guest68: the process is open and it is clear which patches are applied beyond what is released by upstreams

FWIW: pkg collection is not part of FreeBSD operating system

do you happen to recall the source of your article?

I must admit it was a comment (long ago), not an article

however I did come across another article today, which raises separate concerns

this one: vez.mrsk.me/freebsd-defaults.html

I don't really care that much about most of the stuff in that article (since, most of it can be solved) but the section about packages being downloaded as root was concerning

Guest68: if you are concerned, then please refrain from fully switching to FreeBSD, try to do some experimentation, begin in the sandbox like a VM

Guest68: and who do you think the packages build as?

or install as?

or what the attack surface is on a https call

i would like to know

I don't know the answer to the last question, but for the other two, root

Guest68: are you sure the download isn't sandboxed?

so don't you think it's more likely someone would put in bad code to a public package than ... stack overflow the fetch call that downloads the tarball?

Guest68: I think it is fine to ask this question, but I don't think you should be more or less concerned that you are by anything else you use

it's like you're upset about the lock, forgetting that it's currently securing a plastic chain

chains are solid, all the packages signed, moreover one can deploy own poudriere and build packages locally - of course not always source files can be poisoned during download process if they are hosted on unsafe servers

Guest68: so if you prefer 0-trust approach, install own pouriere, build packages locally, download sources, build OS locally and install it to the target servers, some significant fraction of FreeBSD users prefer this type of workflow

Guest68: are you up to implementing Zero Trust FreeBSD builders for your organisation ?

rtprio: I suppose, which brings me back to my first question, sort of. What is the protocol for submitting a package to freebsd? I get that phabricator exists (I'm not a software dev so I don't really know that much about this stuff), but what does the hierarchy for committing code look like?

oh nevermind I think i found it

here: people.freebsd.org/~jcamou/en_US.IS…ooks/dev-model/model-orgstruct.html

mzar: no, I just want to install a bsd system : )

OK, but we implemented it

Kind of an bizarre sshd log event: Apr 7 11:18:45 vincent sshd[41666]: error: Fssh_kex_exchange_identification: cl

ient sent invalid protocol identifier "MGLNDD_aaa.bbb.ccc.ddd_22"

Apr 7 11:18:45 vincent sshd[41666]: error: Fssh_kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_aaa.bbb.ccc.ddd_22"

just telnet host 22

paste in MGLNDD_aaa.bbb.ccc.ddd_22 and mash enter

The aaa.bbb.ccc.ddd it would be the public IP of the box.

then check logs

I'm plenty used to bizare shit trying to connect to sshd, but that's a strange one.

those scans have been around at least for 2-3 years: isc.sans.edu/diary/28458

Apr 7 12:40:56 vincent sshd[41909]: error: Fssh_kex_exchange_identification: Connection closed by remote host

Apr 7 12:52:58 vincent sshd[41960]: error: Fssh_kex_exchange_identification: read: Connection reset by peer

Those are vastly more common.

might be some idiot that doesnt know how to code severing a connection and, instead, decided sending a string was the fastest way to clean up

:)

102 instances in my available, non-rotated off logs.

/var/log/messages.4.bz2:Jan 30 20:54:17 vincent sshd[26778]: error: Fssh_kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1"

These are the real geniuses.

scanning for HTTP on random ports doesn't seem unreasonable to me, i bet there are people who try to hide http by putting it on port 22, or port 53 or something

Way what you will about Google, but Google Fiber doesn't block shit.

I could run SMTP on port 25 and they'd let it right in.

/22/22

Hey, that's my usual move.

on my freebsd laptop w00t :P anyway trying to get sound working.. /dev/sndstat shows pcm0: <Realtek (0x0287) (Analog)> (play/rec) default and when i do cat /dev/dsp0 > /dev/urandom nothing comes out.. i've loaded snd_driver_load="YES" in /boot/loader.conf any other ideas ?

oxbar: assuming that's a valid test, you have it backwards

it'd be /dev/urandom > /dev/dsp0

oh.. dam did it wrong.. i don't think it would work anyway cause i have firefox open with youtube and there is no sound.. dsbmixer or that app i just installed everything looks lik its at 100%

dd if=sound.au of=/dev/dspY seems like a valid test. grab a .au file and give it a go. also check mixer(8) output

actually everyting looks lik its at 1.00 vol = 1.00:1.00 pbk

maybe you just need really good hearing

lol

Nothing has changed I changed vol speaker and pcm to about 75 each

oxbar: do you have multiple pcm devices? that's fairly common for Intel hda devices, you may need to adjust the pcm default_unit

Hi, I am wondering what BSD's answer is to docker and kubernetes? I read about jails, but what about automatic scaling up/down and other stuff kubernetes offers?

Guest22: freebsd has a port of podman, and a freebsd-specific system called pot, either of which at least in theory could be used to run kubernetes (podman at least i believe is OCI container compliant, pot i'm not sure). i'm not aware of anyone actually attempting to port kubernetes to freebsd

Interesting. What would a typical tech stack look like for a BSD website that has many users? How would you handle the traffic, scaling, etc?

load balancers, additional front ends or backends

just think how you would do it 10 years ago without kubernetes and do it that way

how about erlang (⁠◍⁠•⁠ᴗ⁠•⁠◍⁠)

does kubernetes even help if you aren't at google scale?

erlang is pretty good at scaling and is very easy to distribute across multiple machines

(⁠◕⁠ᴗ⁠◕ )

Sorry, got disconnected from before. What would a typical tech stack look like for a BSD website that has many users? How would you handle the traffic, scaling, etc?

how would you do it in linux without kubernetes? probably like that

Yea that is what I am thinking. But what was the old school method? I haven't been around that long if anyone knows.

Guest76 is the website using any framework? php? python? static?

python

and those users are visitors or authenticated users?

Guest76: there are many books about

it. you have web frontends, backends and some sort of software or hardware load balancer

correct yaakal

yaazkal*

Guest76: There are no enough details. But as you are asking for a more general thing. Usually you put a reverse proxy (like nginx) in front of the app. You can also use run the app using any WSGI in order to gain peformance. Python is usually slow, so you can also try PyPi and check if it runs on it (thinking again in performance). Now, if you have more visitors than auth users, you can also consider varnish for web cache

Not to mention that you will need to check you database manager for optimizations too

and the storage layer too for optimizations

app running in the same server as the DB manager? You need High Availability? Really there is a lot to consider. There is no "a formula"

makes sense. I am most likely going to use django, postgres, nginx but would love it there is a way to do this all on BSD without having to learn kubernetes lol. I am not sure if I will have the app run on the same server as the db. Probably not. Yes, that is why I want to get an idea first before I execute. Just weighing my options.

sounds like you've got some reading to do

Yup I sure do. I don't even know BSD at all, I am a linux user. But I want to see what all the BSD fuss is about.

I like the OpenBSD security stuff, and maybe if I can get away not learning kubernetes that will be a win in my books

Guest76: simplest sceario is: one jail for nginx, one jail for the app, one jail for postgres. But you need to have some concepts clear that actually are not OS dependant. It dosen't matter if linux, *BSD or Windows. Like, if you know you need RAID10, then you check how a similar thing is done with ZFS and so on.

With the fall of CentOS and Ubuntu all that is left is Debian and BSD from what I can see. Maybe OpenSUS too.

Right, that's true

almost any web server, python library, database manager that you can run in other OS you can also do it in FreeBSD. Just make clear what design you need.

Thanks. You think I should read the docs or would these books suffice if I am starting out: Absolute FreeBSD, Absolute OpenBSD, Mastering FreeBSD and OpenBSD Security, Book of PF?

those books aren't really covering highly available web systems

Ah, so which ones should I read would you suggest?

i'm not a library man. letmegooglethat.com/?q=designing+highly+available+web+systems

XD no results returned

perhaps you should just stick to a single stack until you can figure out how to find the resources you need

also it's exceedingly pointless to build out a huge complex system when you only have 2 test users

maybe. But sometimes I feel like I want to get it right the first time, so I want to explore everything as much as possible.

True, but I don't plan on having 2 users.

hmm the linux community seems to say that virtual machines are the method to use on freebsd if you don't have kubernetes

that is one approach

my guess is that most users of kubernetes haven't reached a scale that needs it or are hiding badly designed software with it (or both of course)

Guest76: I realize I'm interjecting here -- I run highly-available services across $BIG_TECH and $RETAIL services. What rtprio said is right -- single-stack is exceedingly capable. Running kubernetes on a single host isn't really useful - run it across VMs or multiple physical hosts if you really need it

I personally run a "naked" server -- no jails, no vms, no containers - and if I ever need to scale it, it's an opportunity to redesign for more users than a single-box can handle.

kubernetes/kubernetes #91897 - hyperkube used to provide a single-host interface, but has been removed since 1.19

wow very interesting wavefunction

Guest76: gluecode.net/blog/posts/2025/freebsd.html - That's me.

You can also check out git.gluecode.net

Very cool, thanks

lol

So if you ever had to scale up wavefunction, how would you do it? What would your approach be?

...

X-P

Guest76: "By how much?" A dual-xeon single-box host with a 2Gbit internet link (and a few TB of disk) is pretty chonky

For your site or one of those other sites you support?

So, I've got freshrss (php), plain file serving, git... If my site got enough traffic, I'd set up a redirect and serve out of s3/github. If my git got enough traffic, again, redirect to Sourcehut as a mirror. FreshRSS is closed to signups, but I'd look at moving the whole thing up to a hosted DigitalOcean droplet or something that supports libre software.

If I *had* to serve locally, I'd probably split the workload out to two hosts (purchase a SFF PC and move the singular function over to it).

Ah very interesting approach

Kubernetes is really nice, when you need *incredibly elastic scale* and if you need dynamism in your environment. Xe Iaso runs a whole homelab with k8s, but they started off with fly.io and more limited hosting designs.

It required that they be *pushed* to run k8s, because up until the point they needed it, it wasn't worth it.

and xeiaso.net/talks/2025/surreal-joy-homelab

(Sorry all for linkspam) -- Guest76: if a single machine can handle at least 10x your workload on any axis, you don't need more than what you have.

Good point, I will keep that in mind. Nice site by the way lol

hi wavefunction!

I'm here if you have questions

didn't expect to see k8s in #freebsd though lol

I am seeing what you all used instead of kubernetes on freebsd.

I am talking like a huge website though with millions of users daily.

Xe: o/ Don't mind me, just a huge fan.

^^

I also just put k3s on my tower when I installed Fedora workstation

gets me a good development environment

Guest76: So, uh, can you give us some hard numbers to do actual maths on? :) Like, storage, bandwidth, etc

what are we hating on today?

jbo: Not hating, just trying to help Guest76 sort out what to do instead of k8s on freebsd.

oh yeah that's gonna be """fun"""

(y)

i don't think the BSD land has a substitute for k8s

maybe nomad would work?

does nomad ship BSD binaries?

Xe: +1 - no equivalent and would need VMs or something.

unless you do enterprise level stuff I'd argue that a proper small cluster with jails does just fine

at least that worked for some SME level stuff I was doing a few years ago

depends on the actual requirements ofc.

jbo: That was the original advice. Same with "single host vs more hosts"

jbo: does that survive power being removed from a server and causing the workloads to be moved to servers that are still up?

Xe, worked for me

okay, go cut power to a random server and tell me if the workloads move :)

again, worked for me.

I have seen too many times how people thing they need 14 racks full of equipment and they end up serving stuff you can do with a single beefy machine that is well designed (or a small cluster of three)

I'm probably mandela-effect-ing this, but I swear someone wrote a post on "the fantastic reliability of a single physical server."

over the past +10 years I got to learn that one single server is more reliable in many cases

if not, maybe I should write that post x-D

please do lol

if "what if power is cut" is a problem on a level that if your whole city looses power then you're dealing in infrastructure realms where you'd better not be asking these kinds of questions anyway (because you should already know)

if you need hardware failure tolerance (which you rarely do unless enterprise scale), CARP + jails gets you very, very far.

<raises hand> I have power go out periodically at my house, but I'm looking to solve that at house scale, not for just my server.

exactly.

what good is it if your server keeps running but your ISP distribution box on the road is dead anyway?

all the bloat these days it's insane.

Guest76: Is your current infra physical? Or is it hosted somewhere?

physically colocated (bah, can't type today)

I don't have anything now. I am planning this all out in my head.

not saying it's never necessary - absolutely not. but people that have to ask for advice on these things are usually not the ones with the requirements where anything matters that a single host + proper UPS wouldn't be able to handle.

I am fine doing either physical or virtual

Guest76: virtual has lower initial costs, higher scale costs, but *infinitely* better capacity options.

your wallet better has infinite capacity too

true

What nearly every startup I've worked at does is, spin up on virutal, then transition to purchased hardware for when you've identified your "normal" patterns

good approach

As jbo said, you end up cutting your costs to 20-30% of what you were spending in cloud, but... cloud offers really good flexibility if you don't already have hardware to use

funnily enough I am actually shutting down a node from a physical cluster right now so that's finally also a single-host setup :)

Guest76: And if you're doing "millions of users" with high bandwidth, it's probably a good idea to limit your initial investment until stuff comes in.

Yea I have always debated whether to do physical or virtual. This would be for an e-learning video website.

nah, there's no good answer to the question.

other than "it depends"

So, e-learning video delivery... might let you leverage youtube (or equivalent, like vimeo, peertube, etc) to offload the heavy bits for your server.

if your product is software, then keep it simple in the beginning. make it so you can extend it _LATER_ for more performance/bandwidth/connections/whatever. don't think about massive scales that 99.9% of the startups never end up reaching anyway.

aah, sorry. I misread the e-learning video website :)

Yes, I was going to do that at first. But eventually, do what udemy does with user uploads.

Guest76, to me, that sounds like a business model that can grow slowly/organically

+1

and availability is non critical

Yea, I would release stuff in parts, not all at once

so I'd probably go physical

as storage is expensive in the cloud.

That's a great counterpoint.

some reasonable xeon based box with a 10G NIC running ZFS will do just fine.

and you don't need to purchase all the drives at onces. just start with one raid-z vdev

then add more vdevs later

I'm running a small 80TB box for video delivery and it does just fine.

jbo: gluecode.net/blog/posts/2023/newhardware.html

I really just want a NAS for additional storage :)

wavefunction, for home use I run an HPE ProLiant MicroServer gen9+

Linked device (Dell 7810) is now $550 USD, but...

jbo: fancy

it runs extremely well (FreeBSD, ofc)

err, gen10 actually

Guest76, for your use-case. just buy a reasonable barebone server that you can extend later. don't go crazy on disks and RAM on initial purchase.

people overestimate RAM requirements all the time

my 80TB video delivery server runs on 64GB and it's doing absolutely fine.

Thanks jbo I am liking your advice you are giving.

also don't listen to advice given by random people on the internet ;)

^ this

haha

I would rather ask real people than AI I suppose

Guest76, depending on how serious you are about it you might also just start off with a 2nd hand server/barebone. as long as you buy the disks new there is little risk. just test the hardware properly when you get it (and replace thermal paste, clean it etc).

(I didn't even do most of that -- just got a new drive)

Yea for sure, I setup a data center rack one time at an old startup I was at

I would certainly not even attempt to build a video delivery platform in the cloud unless neither money nor manpower is of any concern.

I know what you mean, I have debated that in my head multiple times like I am crazy for trying. That is why I think I will release stuff in parts. First do vimeo/youtube on my own then move up slowly to AWS S3 or something to host video, or my own servers, idk yet.

But yea, it would cost a pretty penny to do everything in the cloud all at once

also it's pain to develop and work with, honestly.

I have all the code pretty much developed, just need to figure out this server stuff

True

just setup a jail, nullfs mount the ZFS dataset and you're good to go.

jail gives you the isolation, control over resource usage etc and you can easily scale up

and if a single box doesn't do it anymore just CARP + HAST/Cepth or whatever is cool nowdays.

Cool, I certainly have a lot to think about and look over, I want to thank you all for the help.

i think you would be surprised what a single system can do

Guest76: o/ Best of luck

But how big is this starting system?

however big you want it to be :)

Guest76: <points at the linked Dell 7810 workstation>

good point lol

balance your growth expectations and wallet

128GB ram, dual 12-core xeon, and full of attachable drives.

I raccoon that a system like the one I mentioned will get you very, very far.

and scale when you need to

Those machines are beasts

128GB RAM might even be overkill. I'd start with 64.

(System is pre-bought, refurbished)

(It's absolutely overkill)

Guest76, the 80TB video delivery system I mentioned runs on an ancient E5-2620v3 and it's bored to death all day long

Wow. Do you mind sharing? Curious what type of traffic you get with that?

also I missspoke, it's not 80TB of usable space, that's just raw disk space.

Guest76, why are you so worried? If you managed to get 1'000 concurrent (!) users on your platform, upgrading to a beefier CPU will not be your problem.

You're right, I worry about everything. I try to plan ahead.

choosing your delivery format wisely has a much bigger impact in my opinion. Look what kind of quality youtube is able to push over a 3 Mbps rope

Go start your project. Decide when you need to :)

The coding is mostly done, it has been years in the making. It is the server part I gotta figure out next lol.

look at what netflix is running. I can only speak of data from <10 years ago but their entire library was 100TB and they had just like a 4U sever or whatever in a random coloc rack wherever they though they'd like one.

good example for sure

might have been 5U, but that's not the point :p

assuming you don't have a potato as a workstation/desktop, just fire up a jail there with your software, give it a ZFS dataset with your video material and fire up 20 clients on the LAN and see what happens

Lol. Good idea, thanks all.

its all the same.. what matters is generating income

OS'es, languages, doesnt matter if it doesnt generate money =p

don't forget to rewrite everything in rust

Guest76, depending on how your "thing" works, the stuff I'd spend more time figuring out is which type of 3rd-party software you're running and whether it leverages the hardware you have properly.

for example, ports from the official package binary repos are built without CPU type information, so they wouldn't use AVX, AVX2, AVX512 and all the other goodies that may or may not be relevant to you. rebuilding those for your target arch can make quite some difference (again, depending on what you do such as transcoding)

extreme example but: whatcookie.github.io/posts/why-is-avx-512-useful-for-rpcs3

+18% performance for free :)

How would you(me) go about tracing down the cause of a system lockup? I have been looking at various /var/log files and haven't seen anything helpful yet.

thedaemon: Full system lockup? Does it happen with certain programs?

jbo: I had such a hard time with pkgsrc on netbsd, I gave up and went back to binary packages. Suggestions for building/rebuilding local packages on freebsd?

wavefunction: I was at work, wife called and said plex wasn't working. ssh session got kicked out and I couldn't ping the machine anymore

she had to press the power button for me

I mean, ports work good for building programs

thedaemon: yikes. Have you been able to reproduce it at all?

I *think* it's my gpu drm-616-kmod drivers, I had horrid issues with drm-515-kmod before

But I haven't verified that

If you can reliably make it crash, that's good.

<thinking face> how would one set up truss against a kernel module...?

Well, it's been when I'm away I think

beats me

what's truss

lol

I sopke too soon -- ktrace maybe

truss is the strace-equivalent for freebsd

But this pointed me to ktrace

brb, ahh okay

wavefunction, poudriere

thedaemon: Anything show up in dmesg ?

naa

It's my fault for getting a GPU noone else has XD