{% extends "base.html" %}
{% block title %}#features — echoIRCd{% endblock %}
{% block topic %}#features — what's inside the daemon & services{% endblock %}
{% block chan %}#features{% endblock %}
{% block cmd %}/msg echoircd help{% endblock %}
{% block buffer %}
  <div class="ln"><span class="t">19:31</span><span class="g n-cyan">&lt;you&gt;</span><span class="m">/msg echoircd what can you do</span></div>
  <div class="ln"><span class="t">19:31</span><span class="g n-amber">&lt;echoircd&gt;</span><span class="m">plenty — here's the short tour. all of it is original, native Rust.</span></div>

  <div class="grp">
    <div class="grp-h">the daemon</div>
    <ul class="bul">
      <li><b>safe by construction</b> — <span class="kw">#![forbid(unsafe_code)]</span> across the tree, enforced in CI</li>
      <li><b>reactor core</b> — single core thread + mio/epoll pool, zero-copy broadcast, parallel channel fan-out</li>
      <li><b>full mode set</b> — every standard channel/user mode, host cloaking, custom prefixes</li>
      <li><b>operators</b> — a privilege model: command grants, named privs, per-type mode allow-list</li>
      <li><b>the edge</b> — connection classes, per-class flood/fakelag, RFC1413 ident, PROXY v1/v2</li>
      <li><b>observability</b> — a metrics endpoint, JSON logging, native syslog</li>
    </ul>
  </div>

  <div class="grp">
    <div class="grp-h">transport &amp; tls</div>
    <ul class="bul">
      <li><b>6697</b> direct TLS · <b>7799</b> WebSocket (wss) · <b>6667</b> plaintext</li>
      <li>two backends — <b>OpenSSL</b> and <b>rustls</b> — both serving TLS 1.3</li>
      <li>with OpenSSL 3.5 the handshake negotiates post-quantum <span class="kw">X25519MLKEM768</span></li>
      <li>per-host <b>SNI</b> certificates, reloaded live on rehash</li>
    </ul>
  </div>

  <div class="grp">
    <div class="grp-h">ircv3</div>
    <div class="srvline"><span class="g n-amber">&lt;echoircd&gt;</span><span class="capline">CAP * LS :server-time message-tags account-tag account-notify extended-join chghost multi-prefix away-notify invite-notify setname echo-message userhost-in-names batch labeled-response standard-replies extended-monitor draft/chathistory draft/event-playback draft/message-redaction draft/multiline draft/metadata-2 draft/read-marker draft/webpush draft/account-registration sts</span></div>
  </div>

  <div class="grp">
    <div class="grp-h">sasl</div>
    <div class="srvline"><span class="g n-amber">&lt;echoircd&gt;</span><span class="capline">sasl=PLAIN,EXTERNAL,SCRAM-SHA-256,ECDSA-NIST256P-CHALLENGE</span></div>
    <ul class="bul">
      <li><b>EXTERNAL</b> — authenticate by your TLS client-certificate fingerprint</li>
      <li><b>SCRAM-SHA-256</b> &amp; <b>ECDSA-NIST256P-CHALLENGE</b> — challenge/response, no secret on the wire</li>
    </ul>
  </div>

  <div class="grp">
    <div class="grp-h">services</div>
    <ul class="bul">
      <li><b>NickServ</b> — registration, grouped nicks, certs, public keys, vhosts, profiles</li>
      <li><b>ChanServ</b> — founder/access, auto-op, akick, topic &amp; mode locks</li>
      <li><b>OperServ · MemoServ · more</b> — network admin, offline messages, games</li>
      <li><b>event-sourced</b> store; SASL relayed to services mechanism-agnostically</li>
    </ul>
  </div>

  <div class="grp">
    <div class="grp-h">security</div>
    <ul class="bul">
      <li>a native anti-abuse engine in the core — connection/nick-flood and mass-join screening</li>
      <li>behavioral and content heuristics with computed-pattern mining</li>
      <li>a DEFCON state machine plus DNSBL / MX screening via a native async resolver</li>
    </ul>
  </div>

  <div class="ln"><span class="t">19:32</span><span class="g">*</span><span class="m i">echoircd nods toward <a href="/connect">#connect</a></span></div>
{% endblock %}