docs: full reference for the daemon and echo services (modes, extbans, snomasks, commands, config reference, privileges, CLI, metrics/rpc, per-service pages)

content/docs/security.md

@@ -0,0 +1,57 @@
+# Security & anti-abuse
+
+echoIRCd's anti-abuse is a **layered defence** rather than a single engine, applied at the cheapest
+possible point in each case. (The behavioural DEFCON-style detection engine with a report-only mode
+lives in [echo services](/docs/services-security), not in the daemon.)
+
+## The layers
+
+- **Upstream / provider** — volumetric floods (SYN/UDP/amplification) are handled before they reach
+  the host.
+- **Kernel / firewall** — SYN cookies, per-IP connection-rate limits, conntrack caps.
+- **echoIRCd** — abusive *sessions* and *content*, described below.
+
+## Accept edge
+
+Rejection before any per-connection state is allocated:
+
+- **`accept_rate` / `accept_burst`** — a per-source-IP token bucket, shared across the plaintext and
+  TLS acceptors so one IP can't get a fresh budget per listener. Trusted proxies and server links are
+  exempt.
+- **`connflood`** — refuse connections from an IP opening too many too fast.
+- **`connectban`** — Z-line an IP range that opens too many connections, with a boot grace period,
+  garbage collection, and exemptions.
+
+## Per connection
+
+- **Clone caps** — connection classes cap concurrent per-IP connections (`localmax`, `globalmax`).
+- **`registration_timeout`** — drop connections that never send NICK+USER.
+- **`tls_handshake_timeout`** — reap sockets that open the TLS port but never negotiate.
+- **`conn_waitpong`** — hold registration until the client echoes an exact PING cookie.
+- **`recvq` / `softsendq` / `hardsendq`** — bound per-connection memory.
+
+## Per message
+
+- **Fakelag** — `flood_messages` per `flood_seconds` throttles a fast client (opers exempt); a class
+  may set `fakelag=no` to disconnect instead.
+- Channel modes **`+f`** (message flood), **`+j`** (join flood), **`+F`** (nick-change flood).
+
+## Screening & scoring
+
+- **DNSBL** — check DNS blocklists on connect; action `mark` / `kill` / `kline` / `gline` / `zline`.
+- **Reputation** — accrue a per-address score over time; surfaces the `y:` extban and WHOIS.
+- **Security groups** — named AND-ed user sets usable as the `g:` extban.
+
+## Content & behaviour
+
+`antirandom` (drone nick/ident/realname scoring), `antimixedutf8` (look-alike mixed-script spam),
+`filter` / `badword` (`+G` censor), `solvemsg` (arithmetic PM gate), `recaptcha` /
+`cloudflare_challenge` (registration gates), `autodrop` (HTTP-scanner connections), and `blockamsg`
+(mass `/amsg`). See [Modules](/docs/modules) and the [Configuration reference](/docs/config-reference)
+for the keys.
+
+## Network bans
+
+Persistent `K` / `G` / `Z` / `E` (exempt) / `Q` (nick) / `CBAN` (channel) / `SHUN` / `RLINE`
+(realname) bans; `TLINE <mask>` reports how many current users a would-be ban would match before you
+set it.