Introduction

Deploying install gitlab runner on a FreeBSD 15 machine differs from Linux in several important ways: packages come from the FreeBSD Ports Collection or the binary pkg repository, services are registered in /etc/rc.conf via sysrc(8), and firewall rules are written in pf.conf(5) syntax. This tutorial stays entirely within the standard base + ports approach so the result is reproducible on any official FreeBSD 15 installation.

Prerequisites

Ensure FreeBSD 15 is fully updated (freebsd-update fetch install && pkg upgrade -y), that pf is enabled in /etc/rc.conf (pf_enable=YES), and that you have a wheel-group user for sudo access. On FreeBSD 15 the default shell is sh — if you prefer bash, install it with pkg install -y bash and update your user record with chsh -s /usr/local/bin/bash username.

Step 1: Update FreeBSD 15 Packages

Always refresh the pkg repository metadata and upgrade installed packages before adding anything new to FreeBSD 15. This ensures you receive the latest binary packages and avoids dependency conflicts. FreeBSD’s rc(8) system supports a rcvar query: run service servicename rcvar to see the exact rc.conf variable name for the service before editing /etc/rc.conf manually.

pkg update
pkg upgrade -y

Step 2: Install Supporting Utilities

Install common administration utilities used on FreeBSD 15 servers. These provide SSL helpers, process inspection tools, and network diagnostics compatible with the FreeBSD base environment. On FreeBSD, the pkg-message(5) file for many packages contains post-install notes about required rc.conf entries and recommended configuration steps — always read it with pkg info -D packagename before proceeding.

pkg install -y curl wget ca_root_nss gnupg sudo bash

Step 3: Enable the Service in rc.conf

FreeBSD does not use systemd. Services are enabled by setting the appropriate variable in /etc/rc.conf. The recommended way is sysrc(8) which edits the file safely without manual text editing. After enabling, start the service with service(8). Log all session commands with script -a /root/install-$(date +%Y%m%d).log before starting so you have a full audit trail for the change-management record — especially important on FreeBSD where base OS and ports updates can change library ABIs.

sysrc servicename_enable="YES"
service servicename start
service servicename status

Step 4: Apply the Initial Configuration

Edit the service configuration file. On FreeBSD 15, most third-party package configurations live under /usr/local/etc/. The package may also install a sample configuration — check /usr/local/etc/servicename.conf.sample and copy it before editing. If you need a development version of a package not yet in the binary repository, the Ports Collection at /usr/ports provides make install clean with full compile-time options — run make config first to review the WITH/WITHOUT flags.

cp /usr/local/etc/servicename.conf.sample /usr/local/etc/servicename.conf
nano /usr/local/etc/servicename.conf
service servicename restart

Step 6: Consider FreeBSD Jail Isolation

One of FreeBSD 15’s most powerful features is Jails — lightweight OS-level virtualisation that isolates services without the overhead of a VM. Consider running this service inside a Jail using iocage or cbsd for production deployments to limit the blast radius of a compromise. Log all session commands with script -a /root/install-$(date +%Y%m%d).log before starting so you have a full audit trail for the change-management record — especially important on FreeBSD where base OS and ports updates can change library ABIs.

pkg install -y iocage
iocage fetch -r 15.0-RELEASE
iocage create -r 15.0-RELEASE -n servicejail ip4_addr="em0|192.168.1.10/24"
iocage start servicejail
iocage console servicejail

Step 7: Monitor Logs

FreeBSD 15 services log to /var/log/ via syslog(3) and newsyslog(8) handles rotation. Use tail -F to follow the log in real time and diagnose startup errors. On FreeBSD 15 with ZFS, consider placing service data directories on a dedicated ZFS dataset with compression=lz4 and recordsize tuned for the workload — databases typically benefit from recordsize=8k while file stores prefer recordsize=1M.

tail -F /var/log/messages
tail -F /var/log/servicename.log 2>/dev/null || tail -F /var/log/messages

Additional Configuration Options

Once the basic deployment is stable on FreeBSD 15, consider these production-hardening steps: enable periodic(8) maintenance scripts (periodic daily weekly monthly) so the system self-audits; tune newsyslog(8) in /etc/newsyslog.conf to rotate service logs to a remote syslog server using syslogd’s @host syntax; snapshot the service ZFS dataset before each upgrade with zfs snapshot tank/data@pre-upgrade-$(date +%Y%m%d); and review the MAC/Biba or MAC/MLS policy framework if your threat model requires label-based access control beyond standard Unix DAC permissions.

zfs list -t snapshot
periodicconf_enable="YES"  # add to /etc/rc.conf
service periodic onestart daily

Troubleshooting Common Issues

Common issues on FreeBSD 15: if a service fails to start, check /var/log/messages and the rc.conf entry (service servicename rcvar). If a shared library is missing (Shared object "libXXX.so.N" not found), run pkg check -d servicename to identify broken dependencies and reinstall. For pf rule errors, run pfctl -n -f /etc/pf.conf (dry-run parse) before loading. If a Jail cannot reach the network, verify pf_enable="YES" is set before jail_enable and that the pf ruleset passes traffic from the jail’s IP. Use sockstat -4l to confirm a service is listening on the expected port and interface.

sockstat -4l
pfctl -n -f /etc/pf.conf
pkg check -da
cat /var/log/messages | tail -50

Best Practices and Hardening

For production FreeBSD 15 deployments: enable pf with a default-deny policy (block all at the top of pf.conf, then explicit pass rules); run services inside Jails with minimal network access; use GELI disk encryption for data at rest; enable FreeBSD’s built-in security.bsd sysctl hardening knobs (security.bsd.see_other_uids=0, security.bsd.hardlink_check_uid=1); subscribe to the FreeBSD Security Advisory mailing list and apply errata patches promptly with freebsd-update fetch install.

sysctl security.bsd.see_other_uids=0
sysctl security.bsd.see_other_gids=0
sysctl security.bsd.hardlink_check_uid=1
freebsd-update fetch install

Verification

Run this checklist after every deployment on FreeBSD 15: confirm the service is running with service servicename status, verify the listening socket with sockstat -4l | grep :PORT, check the pf ruleset with pfctl -sr, and make an end-to-end client request. Review /var/log/messages for any warnings logged during startup.

service servicename status
sockstat -4l
pfctl -sr
tail /var/log/messages

Conclusion

By following this guide you now have a working install gitlab runner setup on FreeBSD 15 that starts automatically via rc.conf, logs to syslog, and is reachable only through the pf rules you added. Consider snapshotting the ZFS dataset containing the service data after each configuration change so you can roll back in seconds: zfs snapshot zpool/data@post-install.

As a next step, consider encoding this setup as an Ansible role using the community.general.pkgng and community.general.sysrc modules so it can be applied to an entire FreeBSD fleet. Add a Prometheus node_exporter jail to collect system metrics, and include the service data ZFS dataset in a daily zfs send | ssh backup-host zfs recv job so data is protected from the first moment the service is in production.