OPENHAPD(8) System Manager's Manual OPENHAPD(8)

openhapd — HomeKit Accessory Protocol daemon

openhapd [-fnv] [-c file]

The openhapd daemon implements the HomeKit Accessory Protocol (HAP), enabling Apple HomeKit integration with MQTT-connected Tasmota devices on OpenBSD.

openhapd acts as a bridge between HomeKit controllers (such as the iOS Home app) and devices controlled via MQTT, translating HAP requests into MQTT commands and publishing device state changes back to HomeKit.

The daemon implements the complete HAP specification including:

  • Secure pairing using SRP-6a (Secure Remote Password)
  • Session encryption with ChaCha20-Poly1305 AEAD
  • Curve25519 (X25519) key exchange for session establishment
  • Ed25519 digital signatures for authentication
  • HKDF-SHA-512 for key derivation
  • mDNS service advertisement

The options are as follows:

file
Specify the configuration file. The default is /etc/openhapd.conf.
Run in the foreground. By default, openhapd will daemonize and log to syslog(3). With this option, openhapd stays in the foreground and logs to stderr.
Check the configuration file for syntax errors and exit. No daemon is started.
Increase verbosity. Can be specified multiple times for more detailed logging. Each use increases the log level: -v enables debug logging, -vv adds trace information.

/etc/openhapd.conf
Default configuration file.
/var/db/openhapd/
State directory containing pairing database and cryptographic keys.
/var/db/openhapd/pairings
Database of paired HomeKit controllers.
/var/db/openhapd/ltsk
Long-term secret key (Ed25519 private key).
/var/db/openhapd/ltpk
Long-term public key (Ed25519 public key).
/var/run/openhapd.pid
Process ID file.

Check the configuration file:

# openhapd -n

Run in the foreground with verbose logging:

# openhapd -f -v

Typical daemon startup via rc(8):

# rcctl enable openhapd
# rcctl start openhapd

openhapd logs to syslog(3) using the “daemon” facility. When run in the foreground with -f, messages are written to stderr.

Log messages include:

“Starting OpenHAP server”
Daemon started successfully and listening for connections.
“Not paired - use Home app with PIN: XXX-XX-XXX”
The accessory is not paired with any HomeKit controller. Use the displayed PIN to pair via the iOS Home app.
“Connected to MQTT broker at host:port”
Successfully connected to the MQTT broker.
“MQTT broker not available, will retry in background”
Could not connect to MQTT broker on startup. openhapd will continue attempting to connect.
“Paired with controller: identifier”
A new HomeKit controller successfully completed pairing.
“Secure session established”
An encrypted session was successfully negotiated with a paired controller.

syslog(3), openhapd.conf(5), hapctl(8), rc(8), rc.conf(8)

HomeKit Accessory Protocol Specification (Non-Commercial Version): https://developer.apple.com/homekit/

openhapd implements the HomeKit Accessory Protocol Specification R2, including:

  • RFC 5054: Using the Secure Remote Password (SRP) Protocol for TLS Authentication
  • RFC 7539: ChaCha20 and Poly1305 for IETF Protocols
  • RFC 5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
  • RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)
  • RFC 7748: Elliptic Curves for Security (Curve25519)

openhapd was written from scratch in 2025 for OpenBSD as a native implementation of the HomeKit Accessory Protocol.

Dick Olsson <hi@senzilla.io>

openhapd requires a working MQTT broker (such as mosquitto(8)) and an mDNS daemon (such as mdnsd(8)) to function properly.

The HAP PIN code is logged on first startup when the accessory is unpaired. Protect access to system logs accordingly.

Pairing data stored in /var/db/openhapd/ contains cryptographic keys. The directory should be owned by “_openhap” with mode 0700.

openhapd currently only supports Tasmota devices. Additional device types and protocols may be added in future versions.

December 26, 2025 OpenBSD