diff --git a/security/i2pd/Makefile b/security/i2pd/Makefile
index 40d79bd3543e..7887b969fca6 100644
--- a/security/i2pd/Makefile
+++ b/security/i2pd/Makefile
@@ -1,59 +1,74 @@
 PORTNAME=	i2pd
-PORTVERSION=	2.38.0
+DISTVERSION=	2.40.0
 CATEGORIES=	security net-p2p
 
-MAINTAINER=	ports@FreeBSD.org
+MAINTAINER=	driesm@FreeBSD.org
 COMMENT=	C++ implementation of I2P client
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	boost-libs>=1.72.0_5:devel/boost-libs
 LIB_DEPENDS=	libboost_thread.so:devel/boost-libs
 
+USES=		cmake:insource compiler:c++11-lib ssl
 USE_GITHUB=	yes
 GH_ACCOUNT=	PurpleI2P
+USE_RC_SUBR=	${PORTNAME}
 
-USES=		cmake:insource compiler:c++11-lib ssl
-CMAKE_ARGS=	-DWITH_GUI=OFF
 CMAKE_SOURCE_PATH=	${WRKSRC}/build
-USE_RC_SUBR=	${PORTNAME}
 
-PORTDOCS=	*
+SUB_FILES=	i2pd.newsyslog.conf pkg-message
+SUB_LIST=	CERTSDIR=${_CERTSDIR} \
+		GROUP="${GROUPS}" \
+		USER="${USERS}" \
+		WRITEDATADIR=${_WRITEDATADIR}
 
 USERS=		_i2pd
 GROUPS=		_i2pd
 
-PLIST_SUB=	USER="${USERS}" GROUP="${GROUPS}"
-SUB_LIST=	USER="${USERS}" GROUP="${GROUPS}"
-SUB_FILES=	i2pd.newsyslog.conf pkg-message
+PLIST_SUB=	GROUP="${GROUPS}" \
+		USER="${USERS}"
+
+PORTDOCS=	README.md
+
+OPTIONS_DEFINE=		AESNI DOCS HARDENING UPNP
+OPTIONS_DEFAULT=	AESNI
 
-OPTIONS_DEFINE=	AESNI UPNP DOCS HARDENING
+AESNI_DESC=	Use AES-NI instructions set
+HARDENING_DESC=	Use hardening compiler flags
+UPNP_DESC=	Include support for UPnP client
 
-AESNI_DESC=		Use AES-NI instructions set
 AESNI_CMAKE_BOOL=	WITH_AESNI
-UPNP_DESC=		Include support for UPnP client
-UPNP_CMAKE_BOOL=	WITH_UPNP
-UPNP_LIB_DEPENDS=	libminiupnpc.so:net/miniupnpc
+
 HARDENING_CMAKE_BOOL=	WITH_HARDENING
-HARDENING_DESC=		Use hardening compiler flags
 
-post-patch:
-	@${REINPLACE_CMD} -e 's|%%DATADIR%%|${DATADIR}|' ${WRKSRC}/libi2pd/Reseed.cpp
+UPNP_LIB_DEPENDS=	libminiupnpc.so:net/miniupnpc
+UPNP_CMAKE_BOOL=	WITH_UPNP
+
+_CERTSDIR=	${DATADIR}/certificates
+_WRITEDATADIR=	/var/db/${PORTNAME}
+
+post-patch: # fix config file
+	@${REINPLACE_CMD} -e 's|%%ETCDIR%%|${ETCDIR}|g' ${WRKSRC}/contrib/i2pd.conf
+	@${REINPLACE_CMD} -e 's|%%CERTSDIR%%|${_CERTSDIR}|g' ${WRKSRC}/contrib/i2pd.conf
+	@${REINPLACE_CMD} -e 's|/var/lib/${PORTNAME}|${_WRITEDATADIR}|g' ${WRKSRC}/contrib/i2pd.conf
 
 post-install:
 	${INSTALL_MAN} ${WRKSRC}/debian/${PORTNAME}.1 ${STAGEDIR}${MAN1PREFIX}/man/man1
 	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d
-	${INSTALL_DATA} ${WRKDIR}/i2pd.newsyslog.conf ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/i2pd.conf
+	${INSTALL_DATA} ${WRKDIR}/i2pd.newsyslog.conf ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/i2pd.conf.sample
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKSRC}/contrib/i2pd.conf ${STAGEDIR}${ETCDIR}/i2pd.conf.sample
-	@(cd ${WRKSRC}/contrib && ${COPYTREE_SHARE} "certificates" ${STAGEDIR}${DATADIR})
+	${INSTALL_DATA} ${WRKSRC}/contrib/tunnels.conf ${STAGEDIR}${ETCDIR}/tunnels.conf.sample
+	@(cd ${WRKSRC}/contrib/certificates && ${COPYTREE_SHARE} . ${STAGEDIR}${_CERTSDIR})
 	@${MKDIR} ${STAGEDIR}/var/run/i2pd
 	@${MKDIR} ${STAGEDIR}/var/log/i2pd
 	@${MKDIR} ${STAGEDIR}/var/db/i2pd
+	@${MKDIR} ${STAGEDIR}${ETCDIR}/tunnels.d
 
 post-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}
 
 .include <bsd.port.mk>
diff --git a/security/i2pd/distinfo b/security/i2pd/distinfo
index e0ee520c15f1..7a49f86a8310 100644
--- a/security/i2pd/distinfo
+++ b/security/i2pd/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1621346486
-SHA256 (PurpleI2P-i2pd-2.38.0_GH0.tar.gz) = 8452f5323795a1846d554096c08fffe5ac35897867b93a5079605df8f80a3089
-SIZE (PurpleI2P-i2pd-2.38.0_GH0.tar.gz) = 555543
+TIMESTAMP = 1638819224
+SHA256 (PurpleI2P-i2pd-2.40.0_GH0.tar.gz) = 4443f484ad40753e892170a26c8ee8126e8338bf416d04eab0c55c1c94a4e193
+SIZE (PurpleI2P-i2pd-2.40.0_GH0.tar.gz) = 587626
diff --git a/security/i2pd/files/i2pd.in b/security/i2pd/files/i2pd.in
index 9e77c195564f..af6867cdecc1 100644
--- a/security/i2pd/files/i2pd.in
+++ b/security/i2pd/files/i2pd.in
@@ -1,33 +1,49 @@
 #!/bin/sh
 #
 # PROVIDE: i2pd
 # REQUIRE: DAEMON NETWORKING FILESYSTEMS
 # BEFORE: LOGIN
 # KEYWORD: shutdown
 #
 # Add the following line to /etc/rc.conf to enable i2pd:
 #
-# i2pd_enable="YES"
+# i2pd_enable:		Set to NO by default.
+#			Set it to YES to enable i2pd.
+# i2pd_certsdir:	The directory where the default certificaties are stores.
+# 			Default: %%CERTSDIR%%
+# i2pd_config:		The config file used to run the daemon.
+#			Default: %%ETCDIR%%/i2pd.conf
+# i2pd_datadir:		The datadir used to run the daemon.
+#			Default: %%WRITEDATADIR%%
+# i2pd_group:		The group account used to run the daemon.
+#			Default: %%GROUP%%
+# i2pd_user:		The user account used to run the daemon.
+#			Default: %%USER%%
 #
 
 . /etc/rc.subr
 
+desc="i2pd startup script"
 name="i2pd"
-rcvar=i2pd_enable
+rcvar="i2pd_enable"
 
 load_rc_config ${name}
 
 : ${i2pd_enable="NO"}
-: ${i2pd_user="%%USER%%"}
-: ${i2pd_group="%%GROUP%%"}
-: ${i2pd_datadir="/var/db/${name}"}
+: ${i2pd_certsdir="%%CERTSDIR%%"}
 : ${i2pd_config="%%ETCDIR%%/i2pd.conf"}
+: ${i2pd_datadir="%%WRITEDATADIR%%"}
+: ${i2pd_group="%%GROUP%%"}
+: ${i2pd_user="%%USER%%"}
+
+required_dirs="${i2pd_datadir}"
 
-required_dirs=${i2pd_datadir}
-pidfile=/var/run/i2pd/i2pd.pid
 command="%%PREFIX%%/bin/${name}"
-command_args="--conf ${i2pd_config} --service --datadir ${i2pd_datadir} --daemon"
+pidfile=/var/run/i2pd/i2pd.pid
+
+command_args="--certsdir ${i2pd_certsdir} --conf ${i2pd_config} --daemon --datadir ${i2pd_datadir} --service"
+
 extra_commands="reload"
 reload_cmd="pkill -2 -F ${pidfile} -x i2pd"
 
 run_rc_command "$1"
diff --git a/security/i2pd/files/patch-contrib_i2pd.conf b/security/i2pd/files/patch-contrib_i2pd.conf
index 6e17bef32855..cefaa44290d0 100644
--- a/security/i2pd/files/patch-contrib_i2pd.conf
+++ b/security/i2pd/files/patch-contrib_i2pd.conf
@@ -1,23 +1,39 @@
---- contrib/i2pd.conf.orig	2020-08-24 16:48:09 UTC
+--- contrib/i2pd.conf.orig	2021-11-28 01:26:44 UTC
 +++ contrib/i2pd.conf
-@@ -16,7 +16,7 @@
- # tunnelsdir = /var/lib/i2pd/tunnels.d
+@@ -8,19 +8,19 @@
+ 
+ ## Tunnels config file
+ ## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf
+-# tunconf = /var/lib/i2pd/tunnels.conf
++tunconf = %%ETCDIR%%/tunnels.conf
+ 
+ ## Tunnels config files path
+ ## Use that path to store separated tunnels in different config files.
+ ## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d
+-# tunnelsdir = /var/lib/i2pd/tunnels.d
++tunnelsdir = %%ETCDIR%%/tunnels.d
+ 
+ ## Path to certificates used for verifying .su3, families
+-## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates
+-# certsdir = /var/lib/i2pd/certificates
++## Default: ~/.i2pd/certificates or %%CERTSDIR%%
++# certsdir = %%CERTSDIR%%
  
  ## Where to write pidfile (default: i2pd.pid, not used in Windows)
 -# pidfile = /run/i2pd.pid
 +pidfile = /var/run/i2pd/i2pd.pid
  
  ## Logging configuration section
  ## By default logs go to stdout with level 'info' and higher
-@@ -25,9 +25,9 @@
+@@ -30,9 +30,9 @@
  ##  * stdout - print log entries to stdout
  ##  * file - log entries to a file
  ##  * syslog - use syslog, see man 3 syslog
 -# log = file
 +log = file
  ## Path to logfile (default - autodetect)
 -# logfile = /var/log/i2pd/i2pd.log
 +logfile = /var/log/i2pd/i2pd.log
  ## Log messages above this level (debug, info, *warn, error, none)
  ## If you set it to none, logging will be disabled
  # loglevel = warn
diff --git a/security/i2pd/files/patch-libi2pd_Reseed.cpp b/security/i2pd/files/patch-libi2pd_Reseed.cpp
deleted file mode 100644
index 6fb98b810ae9..000000000000
--- a/security/i2pd/files/patch-libi2pd_Reseed.cpp
+++ /dev/null
@@ -1,13 +0,0 @@
-Static files belong to datadir, not vardir.
-
---- libi2pd/Reseed.cpp.orig	2021-02-15 13:21:30 UTC
-+++ libi2pd/Reseed.cpp
-@@ -497,7 +497,7 @@ namespace data
- 
- 	void Reseeder::LoadCertificates ()
- 	{
--		std::string certDir = i2p::fs::DataDirPath("certificates", "reseed");
-+		std::string certDir = "%%DATADIR%%/certificates/reseed";
- 		std::vector<std::string> files;
- 		int numCertificates = 0;
- 
diff --git a/security/i2pd/files/pkg-message.in b/security/i2pd/files/pkg-message.in
index de7f8b9deb3e..65fa86425363 100644
--- a/security/i2pd/files/pkg-message.in
+++ b/security/i2pd/files/pkg-message.in
@@ -1,8 +1,16 @@
 [
 { type: install
   message: <<EOM
 You may want to increase default i2pd bandwidth limit by adding
 setting "bandwidth" parameter to "X" in %%ETCDIR%%/i2pd.conf
 EOM
 }
+{ type: upgrade
+  message: <<EOM
+Some defaults in the sample config file have been changed to respect hier(7).
+It is advised to take a look at i2pd.conf.sample and reflect the better defaults
+in your i2pd.conf manually. Dont forget to move the config files from the old
+to the new location after changing the location in i2pd.conf.
+EOM
+}
 ]
diff --git a/security/i2pd/pkg-plist b/security/i2pd/pkg-plist
index b2ece4727bf7..d59f40b28f7f 100644
--- a/security/i2pd/pkg-plist
+++ b/security/i2pd/pkg-plist
@@ -1,24 +1,28 @@
 bin/i2pd
-etc/newsyslog.conf.d/i2pd.conf
+@sample %%ETCDIR%%/i2pd.conf.sample
+@sample %%ETCDIR%%/tunnels.conf.sample
+@sample etc/newsyslog.conf.d/i2pd.conf.sample
 lib/libi2pd.a
 lib/libi2pdclient.a
+lib/libi2pdlang.a
 man/man1/i2pd.1.gz
 %%DATADIR%%/certificates/family/gostcoin.crt
 %%DATADIR%%/certificates/family/i2p-dev.crt
 %%DATADIR%%/certificates/family/i2pd-dev.crt
 %%DATADIR%%/certificates/family/mca2-i2p.crt
 %%DATADIR%%/certificates/family/volatile.crt
 %%DATADIR%%/certificates/reseed/acetone_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/creativecowpat_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/echelon_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/hankhill19580_at_gmail.com.crt
 %%DATADIR%%/certificates/reseed/hottuna_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/igor_at_novg.net.crt
 %%DATADIR%%/certificates/reseed/lazygravy_at_mail.i2p.crt
+%%DATADIR%%/certificates/reseed/orignal_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
+%%DATADIR%%/certificates/reseed/rambler_at_mail.i2p.crt
 %%DATADIR%%/certificates/reseed/reseed_at_diva.exchange.crt
-%%DATADIR%%/certificates/router/orignal_at_mail.i2p.crt
-@sample %%ETCDIR%%/i2pd.conf.sample
-@dir(%%USER%%,%%GROUP%%,755) /var/run/i2pd
-@dir(%%USER%%,%%GROUP%%,755) /var/log/i2pd
+@dir %%ETCDIR%%/tunnels.d
 @dir(%%USER%%,%%GROUP%%,755) /var/db/i2pd
+@dir(%%USER%%,%%GROUP%%,755) /var/log/i2pd
+@dir(%%USER%%,%%GROUP%%,755) /var/run/i2pd