docs: full reference for the daemon and echo services (modes, extbans, snomasks, commands, config reference, privileges, CLI, metrics/rpc, per-service pages)
This commit is contained in:
parent
c4836c7dd1
commit
d81c07ef01
23 changed files with 1685 additions and 84 deletions
|
|
@ -1,55 +1,90 @@
|
|||
# Operators
|
||||
|
||||
Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is
|
||||
the sum of three allow-lists: the **commands** they may run, the named **privileges** they hold,
|
||||
and the user/channel **modes** they may set.
|
||||
|
||||
## Oper types
|
||||
|
||||
An `opertype` groups a set of powers so many opers can share one role.
|
||||
|
||||
```ini
|
||||
opertype {
|
||||
name "netadmin";
|
||||
commands "*"; # every oper command
|
||||
privs "*"; # every named privilege
|
||||
usermodes "*";
|
||||
chanmodes "*";
|
||||
}
|
||||
|
||||
opertype {
|
||||
name "helper";
|
||||
commands "KILL SANICK";
|
||||
privs "users/auspex channels/auspex";
|
||||
usermodes "-*"; # no privileged usermodes
|
||||
chanmodes "b";
|
||||
}
|
||||
```
|
||||
|
||||
Lists are space-separated tokens. `*` grants everything; a `-` prefix denies a specific token —
|
||||
for example `* -KILL` means "everything except `KILL`".
|
||||
Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is the
|
||||
sum of three allow-lists: the **commands** they may run, the named **privileges** they hold, and the
|
||||
user/channel **modes** they may set. `class` blocks bundle those into reusable roles that opertypes
|
||||
compose.
|
||||
|
||||
## Oper accounts
|
||||
|
||||
An `oper` block ties a login to an `opertype`. Hash the password with the `mkpasswd` helper.
|
||||
An `oper` block ties a login to an `opertype`. Hash the password with `echoircd mkpasswd`. A block
|
||||
with neither a password nor a fingerprint is refused.
|
||||
|
||||
```ini
|
||||
oper {
|
||||
name "alice";
|
||||
password "$argon2id$..."; # from: echoircd mkpasswd
|
||||
type "netadmin";
|
||||
host "*@192.0.2.0/24";
|
||||
name "alice";
|
||||
password "$2b$11$..."; # from: echoircd mkpasswd
|
||||
fingerprint "AA:BB:..."; # optional TLS client-cert (2FA, or alone)
|
||||
type "netadmin";
|
||||
host "*@192.0.2.0/24";
|
||||
}
|
||||
```
|
||||
|
||||
Then, as a client:
|
||||
Then, as a client: `/oper alice hunter2`.
|
||||
|
||||
```text
|
||||
/oper alice hunter2
|
||||
## Classes and types
|
||||
|
||||
A `class` is a reusable capability bundle; an `opertype` composes classes into a named WHOIS role.
|
||||
|
||||
```ini
|
||||
class {
|
||||
name "ban";
|
||||
commands "KILL KLINE GLINE ZLINE";
|
||||
privs "users/auspex channels/auspex";
|
||||
snomasks "cdkx";
|
||||
}
|
||||
|
||||
opertype {
|
||||
name "helper";
|
||||
classes "auspex";
|
||||
modes "+ih";
|
||||
title "Help Operator";
|
||||
}
|
||||
```
|
||||
|
||||
## Privileges
|
||||
Command and privilege lists are space-separated tokens: `*` grants everything, a `-` prefix removes
|
||||
one (`* -KILL` = everything except `KILL`). `usermodes` / `chanmodes` on a class limit which oper-only
|
||||
modes the type may set.
|
||||
|
||||
Named privileges gate individual abilities — for example `users/auspex` (see hidden user
|
||||
details), `channels/auspex`, `servers/rehash`, or `users/mass-message`. Assign them per
|
||||
`opertype` through `privs`, and the daemon enforces them everywhere the ability is used.
|
||||
### Built-in classes
|
||||
|
||||
`announce` · `ban` · `override` · `host` · `services` · `server` · `auspex` — covering broadcast,
|
||||
X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass
|
||||
privileges respectively.
|
||||
|
||||
### Built-in types
|
||||
|
||||
Five ship ready to use (only `netadmin` holds every privilege):
|
||||
|
||||
| Type | Title | Level |
|
||||
| --- | --- | --- |
|
||||
| `helpop` | Help Operator | 10 |
|
||||
| `globop` | GlobOp | 20 |
|
||||
| `admin` | Administrator | 50 |
|
||||
| `servadmin` | Services Administrator | 70 |
|
||||
| `netadmin` | Network Administrator | 100 |
|
||||
|
||||
## Named privileges
|
||||
|
||||
Privileges gate individual abilities. Assign them per class/type via `privs`; the daemon enforces
|
||||
them everywhere the ability is used.
|
||||
|
||||
| Privilege | Grants |
|
||||
| --- | --- |
|
||||
| `users/auspex` | See a user's real host+IP and geo, and `+i` users you share no channel with |
|
||||
| `channels/auspex` | See secret/private (`+s`/`+p`) channels in LIST / WHO / WHOIS |
|
||||
| `servers/auspex` | See U-lined/services servers otherwise hidden by `hideservices` |
|
||||
| `users/flood` | Exempt from message- and join-flood limits |
|
||||
| `users/ignore-commonchans` | Message a `+c` user without sharing a common channel |
|
||||
| `channels/override` | Join through `+k`/`+b`/`+i`/`+l`/`+z`/`+R`/`+J`, CBAN, and the channel cap |
|
||||
| `channels/restricted-create` | Create a channel while `restrictchans` is on |
|
||||
| `channels/ignore-nonicks` | Change nick while on a `+N` channel |
|
||||
| `users/ignore-callerid` | Message a `+g` user without being on their ACCEPT list |
|
||||
| `users/ignore-privdeaf` | Reach a `+D` (deaf) user with channel messages |
|
||||
| `users/secret-whois` | WHOIS a `+W` user without notifying them |
|
||||
| `users/ignore-restrictmsg` | Private-message anyone while `restrictmsg` is on |
|
||||
| `servers/use-disabled-commands` | Use a command turned off by `disabled_commands` |
|
||||
| `servers/ignore-securelist` | Bypass the `securelist` LIST hold |
|
||||
| `servers/ignore-blockamsg` | Send multi-channel messages that `blockamsg` blocks |
|
||||
|
||||
An untyped ("legacy") oper — an `oper` block with no `type` — holds every command and privilege.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue