{% extends "base.html" %}
{% block title %}Features — echoIRCd{% endblock %}
{% block content %}
<section class="pagehead">
  <div class="wrap">
    <h1>Features</h1>
    <p>Everything below is original, native Rust. The InspIRCd protocol is a reference for wire
       compatibility — never a source of code.</p>
  </div>
</section>

<section class="wrap doc">
  <div class="doc-block">
    <h2>The daemon</h2>
    <ul>
      <li><b>Safe by construction</b> — <code>#![forbid(unsafe_code)]</code> across the tree, enforced in CI.</li>
      <li><b>Reactor core</b> — a single core thread with a mio/epoll pool; zero-copy broadcast and parallel channel fan-out.</li>
      <li><b>Full mode set</b> — every standard channel and user mode, host cloaking, custom prefixes.</li>
      <li><b>Operators</b> — a privilege model: command grants, named privileges, and a per-type mode allow-list.</li>
      <li><b>The edge</b> — connection classes, per-class flood/fakelag, RFC&nbsp;1413 ident, PROXY protocol v1/v2.</li>
      <li><b>Observability</b> — a metrics endpoint, structured JSON logging, and native syslog.</li>
    </ul>
  </div>

  <div class="doc-block">
    <h2>Transport &amp; TLS</h2>
    <ul>
      <li><b>6697</b> direct TLS · <b>7799</b> WebSocket (wss) · <b>6667</b> plaintext.</li>
      <li>Two interchangeable backends — <b>OpenSSL</b> and <b>rustls</b> — both serving TLS&nbsp;1.3.</li>
      <li>With OpenSSL&nbsp;3.5 the handshake negotiates post-quantum <code>X25519MLKEM768</code>.</li>
      <li>Per-host <b>SNI</b> certificates, reloaded live on rehash.</li>
    </ul>
  </div>

  <div class="doc-block">
    <h2>IRCv3</h2>
    <p>Capabilities advertised to clients:</p>
    <div class="chips">
      <span>server-time</span><span>message-tags</span><span>account-tag</span><span>account-notify</span>
      <span>extended-join</span><span>chghost</span><span>multi-prefix</span><span>away-notify</span>
      <span>invite-notify</span><span>setname</span><span>echo-message</span><span>userhost-in-names</span>
      <span>batch</span><span>labeled-response</span><span>standard-replies</span><span>extended-monitor</span>
      <span>draft/chathistory</span><span>draft/event-playback</span><span>draft/message-redaction</span>
      <span>draft/multiline</span><span>draft/metadata-2</span><span>draft/read-marker</span>
      <span>draft/webpush</span><span>draft/account-registration</span><span>sts</span>
    </div>
  </div>

  <div class="doc-block">
    <h2>SASL</h2>
    <ul>
      <li><b>PLAIN</b> — classic username / password.</li>
      <li><b>EXTERNAL</b> — authenticate by your TLS client-certificate fingerprint.</li>
      <li><b>SCRAM-SHA-256</b> — challenge / response, no password on the wire.</li>
      <li><b>ECDSA-NIST256P-CHALLENGE</b> — sign a challenge with a NIST&nbsp;P-256 key; the private key never leaves your client.</li>
    </ul>
  </div>

  <div class="doc-block">
    <h2>Accounts &amp; services</h2>
    <p>echoIRCd itself is only a daemon — it provides the account and SASL <em>interface</em> (the
       SASL relay, the account extension, and U-lined service commands). Nickname registration,
       channels and the rest are handled by <a href="/services">echo&nbsp;services</a>, a separate
       package linked over S2S — not built into the daemon.</p>
  </div>

  <div class="doc-block">
    <h2>Security</h2>
    <ul>
      <li>A native anti-abuse engine in the core — connection/nick-flood and mass-join screening.</li>
      <li>Behavioral and content heuristics with computed-pattern mining.</li>
      <li>A DEFCON state machine plus DNSBL / MX screening via a native async resolver.</li>
    </ul>
  </div>
</section>

<section class="ctaband">
  <div class="wrap ctaband-in">
    <div><h2>Try it</h2><p class="mono-line">irc.echoircd.org · +6697 · TLS 1.3</p></div>
    <a class="btn btn-primary" href="/connect">Connect &amp; register</a>
  </div>
</section>
{% endblock %}