OpenBSD firewall

Installed 4.6 on my EPIA 5000 fanless & the HD I have in it is too noisy so I want to run it read only.
I've already posted about /etc/pf.conf

I've enabled syslogd on momo to accept udp syslog posts (syslogd -u) which uses UDP 514

Then in the firewall (goo) I've changed /etc/syslog.conf to send all syslog messages to @momo

Easy peasy.

Next is to mount the filesystems read only which I found here.

change fstab to something like this :
/dev/wd0a / ffs ro,noatime 1 1
swap /tmp mfs rw,noatime,nodev,nosuid,-s=20000 0 0
swap /var mfs rw,noatime,nodev,nosuid,-s=40000 0 0
swap /dev mfs rw,noatime,nosuid,noexec,-s=20000 0 0

do this patch
cp /etc/rc /etc/rc.orig && echo '/fastboot.*XXX
a
mtree -qdef /etc/mtree/4.4BSD.dist -p / -u
cp /root/MAKEDEV /dev; cd /dev; sh MAKEDEV all
.
w
q' | ed /etc/rc



to make changes later
mount -u -o rw / unless, like me, your CF card reader has a RO jumper !! lucky me
mount -u -o ro / to make it ro again.
I got rid of /usr/ports and ended up with about 500Mb of disk used, so I'm well under the 1Gb target. And I've got stuff on there from where I was putting Mercurial on.

Filesystem Size Used Avail Capacity Mounted on
/dev/wd0a 158M 32.9M 117M 22% /
/dev/wd0g 3.5G 3.4M 3.3G 0% /home
/dev/wd0f 3.5G 490M 2.9G 14% /usr
mfs:30180 9.3M 37.0K 8.8M 0% /dev
mfs:17306 9.3M 21.0K 8.8M 0% /tmp
mfs:28721 18.8M 1.2M 16.7M 7% /var