From 594eecd07dd6c852a4d88ef714b3615a0a78695b Mon Sep 17 00:00:00 2001 From: reverse Date: Sun, 30 Aug 2026 21:10:31 +0000 Subject: [PATCH] docs: add changelog page for 5.0.1; show version 5.0.1 on the status card --- content/docs/changelog.md | 74 +++++++++++++++++++++++++++++++++++++++ src/docs.rs | 3 ++ src/main.rs | 2 +- 3 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 content/docs/changelog.md diff --git a/content/docs/changelog.md b/content/docs/changelog.md new file mode 100644 index 0000000..cd774e4 --- /dev/null +++ b/content/docs/changelog.md @@ -0,0 +1,74 @@ +# Changelog + +Release history for the echoIRCd daemon. The full commit log lives on +[git.devtronic.pro/echo/echoIRCd](https://git.devtronic.pro/echo/echoIRCd/commits/branch/main). + +## 5.0.1 — 2026-08-30 + +Rolls up the changes since 5.0.0. + +### Highlights + +- **SASL** — added the **SCRAM-SHA-256** and **ECDSA-NIST256P-CHALLENGE** mechanisms; both are + challenge/response, so they're advertised even on the plaintext port. +- **Operator privileges** — a full privilege model: oper types and reusable capability classes, named + privileges enforced at the flood / join / visibility gates, a per-type usermode/chanmode + allow-list, and `-deny` token exclusion. See [Operators](/docs/operators). +- **Connect notices** — the connecting-client snote now shows the IP (tagged ipv4/ipv6), the `+x` + cloaked host, the transport (WebSocket) and TLS version/cipher, and the port / SNI / account — + with IP and geo/ASN redacted from non-netadmin opers. Plus a post-connect "now logged in" notice. +- **GeoIP & ASN** — a native MaxMind ASN-lookup module, an `A:` extban, connect-class and + security-group matching on origin AS, and city + ASN added to geo in the connect snote, WHOIS, and + `GEOIP`. +- **IRCv3** — **draft/event-playback** (JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK replayed into + CHATHISTORY) and **draft/webpush** (RFC 8291/8292 Web Push with VAPID). +- **Localization** — server-wide locale via `lang/.conf` catalogs (fr, es): the welcome burst, + numerics, and the snotice / oper-command / xline / WHOIS paths are all translated at a single + chokepoint, with English staying zero-cost. +- **Per-SNI branding** — a `brand` block lets one daemon present multiple server/network identities + keyed by the TLS SNI host. +- **Operations** — an `echoircd rehash` CLI and `SIGHUP` in-place config reload, `RPL_VERSION` + enriched with build and toolchain provenance, and the watchdog now names the slow event. + +### Commits in this release + +- release: bump version to 5.0.1 ([`0be6daa`](https://git.devtronic.pro/echo/echoIRCd/commit/0be6daa1c285867aaceedcadf7fcf51fcfd6e650)) +- sasl: advertise and relay ECDSA-NIST256P-CHALLENGE ([`ed58813`](https://git.devtronic.pro/echo/echoIRCd/commit/ed58813ea525cfec9458983e626729fca29880b4)) +- sasl: offer and relay SCRAM-SHA-256 (advertised on plaintext too) ([`dfbe8e8`](https://git.devtronic.pro/echo/echoIRCd/commit/dfbe8e8c4aa207b9e297c1d31e33709c3bfc245c)) +- opers: use the priv-name constants at the auspex checks; remove unused fns ([`a922a30`](https://git.devtronic.pro/echo/echoIRCd/commit/a922a30bf135bed1480f1680fc6ee7900d095af8)) +- io: bound the blocking TLS handshake write side + the wss TLS handshake ([`369e06e`](https://git.devtronic.pro/echo/echoIRCd/commit/369e06ec2beadfd520f193ba5881c5b264f26429)) +- opers: add users/ignore-privdeaf — reach +D deaf users ([`2d42fbd`](https://git.devtronic.pro/echo/echoIRCd/commit/2d42fbd2ca23b293b4a43b47b6ea183175b10eab)) +- opers: wire eight more privileges over their raw is_oper gates ([`5dfedb5`](https://git.devtronic.pro/echo/echoIRCd/commit/5dfedb5091714892709cee45521c468fdd381110)) +- docs: document the oper privilege model (types/classes, privileges, mode allowlist) ([`bbe2682`](https://git.devtronic.pro/echo/echoIRCd/commit/bbe26824781abd035d49c4386681fcc9b49ab9c9)) +- opers: apply the usermode allowlist to +s (snomask) too ([`57c4cb0`](https://git.devtronic.pro/echo/echoIRCd/commit/57c4cb0c2695d339a01760dfe325f18516644699)) +- opers: gate NAMES secret-channel visibility on channels/auspex too ([`4e72ef7`](https://git.devtronic.pro/echo/echoIRCd/commit/4e72ef790c1276b52ab1f8b28a4f92baf062e6ce)) +- opers: TokenList -deny exclusion for commands/privs + auspex-gate hidden chans ([`55863e9`](https://git.devtronic.pro/echo/echoIRCd/commit/55863e9cfe00bbd018ff018062b9c4aa94b01fb7)) +- opers: enforce the per-type usermode/chanmode allowlist ([`e2a64b7`](https://git.devtronic.pro/echo/echoIRCd/commit/e2a64b780684b99b094f61c0152e6479926d75c2)) +- opers: organize privileges and enforce them at flood/join/visibility gates ([`bc412c2`](https://git.devtronic.pro/echo/echoIRCd/commit/bc412c218e708aa909bc958edc5ac6c3213ef264)) +- opertypes: enforced oper privilege system (users/auspex, channels/auspex) ([`ff380d6`](https://git.devtronic.pro/echo/echoIRCd/commit/ff380d601d8be3c825103461c6e4274a5a4d6e5f)) +- snoop: redact connect-notice IP + geo/ASN to non-netadmin opers ([`d73f68f`](https://git.devtronic.pro/echo/echoIRCd/commit/d73f68f278eb426627fe7353c709daf38542a614)) +- snoop: show the +x cloaked host in the connect notice, not the raw host ([`0af2ab7`](https://git.devtronic.pro/echo/echoIRCd/commit/0af2ab7d211c613ed600b0962f5d60073487785f)) +- snoop: show connecting IP in the connect snote, tagged ipv4/ipv6 ([`6a8999a`](https://git.devtronic.pro/echo/echoIRCd/commit/6a8999a1bbbf52cdc94b9acb0a59208bee223872)) +- asn: A: matching extban (ban/exempt by origin AS); advertise A in EXTBAN ([`bf1446a`](https://git.devtronic.pro/echo/echoIRCd/commit/bf1446a51b550de59b75cd3a7bcd30f363cdf89d)) +- asn: core ASN lookup module (native MMDB); match connect classes + security groups on origin AS ([`068924d`](https://git.devtronic.pro/echo/echoIRCd/commit/068924de86e2089820b2ade3ff6c35156a3150f9)) +- geoip: read city + ASN from MaxMind dbs; add geo (country/city + ASN) to connect snote, WHOIS and GEOIP ([`cc13ce0`](https://git.devtronic.pro/echo/echoIRCd/commit/cc13ce02c76b651f6ab08e31e895275dab42d834)) +- snoop: show transport (websocket) + TLS version/cipher in the client-connecting snote ([`f0c4a1c`](https://git.devtronic.pro/echo/echoIRCd/commit/f0c4a1cc879f96c12d266a9a06040e9947a543cd)) +- watchdog: name the slow event/command in the slow-event snote and [watchdog] warning ([`106bda2`](https://git.devtronic.pro/echo/echoIRCd/commit/106bda2e8b39091fcdacca343f6037e40a23d658)) +- link: announce a member's IJOIN status modes to local channel members so a rejoining services bot shows opped ([`533666d`](https://git.devtronic.pro/echo/echoIRCd/commit/533666dba0eeadd1671e4552c53c9c40fa31ed02)) +- docs/ircv3: document draft/event-playback, draft/webpush (WEBPUSH + VAPID ISUPPORT) ([`8df756b`](https://git.devtronic.pro/echo/echoIRCd/commit/8df756b038f354631fbfd49418058ccd45335072)) +- readme: list draft/event-playback + draft/webpush under IRCv3 features ([`f7ff5c3`](https://git.devtronic.pro/echo/echoIRCd/commit/f7ff5c3f862a534ebd4ac3d4b0ac0bf22862ba5a)) +- modules: draft/webpush — RFC 8291 (aes128gcm) + RFC 8292 (VAPID ES256) Web Push; WEBPUSH REGISTER/UNREGISTER, VAPID ISUPPORT, off-core delivery, HKDF/round-trip tested ([`6ecb6f3`](https://git.devtronic.pro/echo/echoIRCd/commit/6ecb6f3d84aa44d2720025c007e41bcc95cd5df7)) +- modules: draft/event-playback — record JOIN/PART/QUIT/NICK/MODE/TOPIC/KICK into CHATHISTORY, replayed only for cap clients (event_playback config, default on) ([`6bb8ccd`](https://git.devtronic.pro/echo/echoIRCd/commit/6bb8ccd8eea04ea8f86ca75f9da10d6aad0a4018)) +- readme: document server-wide message localization (locale/lang catalogs, fr+es) ([`9dcc269`](https://git.devtronic.pro/echo/echoIRCd/commit/9dcc269f4564d3fbee91d61b43f583b593620639)) +- i18n: localize the client-facing Closing-link ERROR wrapper via trf (fr, es); QUIT-broadcast reasons stay canonical for S2S ([`0467173`](https://git.devtronic.pro/echo/echoIRCd/commit/04671733d247a0d3241aec988cb37adad04e1aee)) +- i18n: sweep all remaining dynamic prose (oper commands, XLINE/FILTER/DNSBL notices, whois/vhost/knock/dcc/title/reputation/tline/rmode, hash, rename) through trf; +\xNN catalog escape; fr+es now 236 entries each ([`9b51db0`](https://git.devtronic.pro/echo/echoIRCd/commit/9b51db07f5cb91c1cc12eae1eb93f7500fa3d6ab)) +- i18n: localize the snotice/announce path — translate at deliver_server_notice chokepoint; rehash, connect/exit, oper-up, login, channel & ojoin notices via trf (fr, es) ([`ef96bcb`](https://git.devtronic.pro/echo/echoIRCd/commit/ef96bcbd0631655e09e6b7924aeb6f44fe81dc04)) +- i18n: localize the welcome burst (001-003/251) via trf() dynamic templates (fr, es) ([`6f8ff39`](https://git.devtronic.pro/echo/echoIRCd/commit/6f8ff39f99af601c62d2d153774f366107a7f05c)) +- i18n: server-wide locale via lang/.conf catalogs (fr, es); numeric prose auto-translated at the chokepoint, en = zero-cost passthrough ([`560c860`](https://git.devtronic.pro/echo/echoIRCd/commit/560c860f1da6008985ce7344e17a191fcc2b5a82)) +- websocket: collapse v4-mapped proxy peer so ws_proxyranges matches and X-Real-IP is honored ([`5914a6d`](https://git.devtronic.pro/echo/echoIRCd/commit/5914a6d993947500c168d2a488093ce9c0074af1)) +- accounts: oper snotice on post-connect login ('Client X is now logged in as Y') ([`935f22f`](https://git.devtronic.pro/echo/echoIRCd/commit/935f22f2f2edcac214144af34216fae090d2ed8f)) +- snoop: drop needless clones in the connect notice (hold the &User borrow) ([`37436d0`](https://git.devtronic.pro/echo/echoIRCd/commit/37436d0306b3edcaeff05fffa9c50210fb9d1dd0)) +- snoop: connect notice includes port, sni and account (present fields only) ([`6e8d6c3`](https://git.devtronic.pro/echo/echoIRCd/commit/6e8d6c31fb1391963e1166306410fe8589f7d810)) +- docs: document the brand block (per-SNI server/network identity) in the example config ([`a587d25`](https://git.devtronic.pro/echo/echoIRCd/commit/a587d25873bd4c8d2e39cd36ecf37a26c8334708)) +- brand: per-SNI server/network identity (welcome, ISUPPORT NETWORK, numeric source prefix) ([`b6ada85`](https://git.devtronic.pro/echo/echoIRCd/commit/b6ada854cc9c815a2dd4cc1c2fc5edb251856809)) +- whois: show client-cert fingerprint (276) to everyone, not just opers/self ([`f36f803`](https://git.devtronic.pro/echo/echoIRCd/commit/f36f803d42f934c6d5ba087606b3181ddeba8b93)) diff --git a/src/docs.rs b/src/docs.rs index e7460e0..4b2a2d5 100644 --- a/src/docs.rs +++ b/src/docs.rs @@ -60,6 +60,9 @@ pub static NAV: &[NavSection] = &[ p!("other-services", "Other services"), p!("services-security", "Security (services)"), ]}, + NavSection { title: "Project", pages: &[ + p!("changelog", "Changelog"), + ]}, ]; pub struct Heading { diff --git a/src/main.rs b/src/main.rs index 561a957..bf7fd0d 100644 --- a/src/main.rs +++ b/src/main.rs @@ -31,7 +31,7 @@ fn view(shared: &stats::Shared) -> Status { online: s.online, users: fmt(s.users), channels: fmt(s.channels), - version: "5.0.0".into(), + version: "5.0.1".into(), } }