+-----------------------------------------------------------------------
| Running galene on OpenBSD
+-----------------------------------------------------------------------

Layout
======

The server runs as _galene from /var/galene, where it keeps
its state under the default relative paths:

    data/        configuration (config.json), TLS certificate, tokens
    groups/      one JSON file per group
    recordings/  what the "record" button produces

The web client is served from /usr/local/share/galene/static, passed
by the rc script as -static; keep that flag when changing the flags with
rcctl(8).

Initial setup
=============

Create the server configuration with its administrator, and the client
configuration of galenectl, as the _galene user (the password is asked):

    # su -s /bin/sh _galene -c "galenectl -admin-username admin \
          initial-setup -config /var/galene/data/config.json"

Then enable and start the service:

    # rcctl enable galene
    # rcctl start galene

Groups are managed with galenectl (create-group, set-password, ...), or
written by hand as JSON files under /var/galene/groups; see
"galenectl -help" and https://galene.org/galene.html.

TLS
===

Without /var/galene/data/cert.pem and key.pem, the server
generates a self-signed certificate. Copy a real one there, readable by
_galene only, and restart the service after each renewal.

Network
=======

The server listens on port 8443 (-http), runs a built-in TURN server
(-turn auto, port 1194 by default) and carries the media over UDP;
restrict those ports with -udp-range. Change them with rcctl(8), keeping
-static:

    # rcctl set galene flags -static /usr/local/share/galene/static \
          -http :8443 -udp-range 40000-40100

File descriptors
================

A busy server holds several descriptors per participant. Raise the limit
of the _galene user through a login.conf(5) class when serving large
groups; upstream suggests 65536.
