docs: markdown documentation section (sidebar nav, per-page toc, search, hljs)

content/docs/configuration.md

@@ -0,0 +1,62 @@
+# Configuration
+
+echoIRCd is configured from a single file (`echoircd.conf` by default). The format is a set of
+**blocks** made of `key value;` fields.
+
+> Inline `#` comments are **not** stripped from a value — keep active lines to bare values and put
+> comments on their own line.
+
+## Format
+
+```ini
+network "echoiRCd";
+sid     "0AA";
+
+listen { ip "[::]"; port 6697; tls yes; }   # dual-stack v4 + v6
+```
+
+## Listeners
+
+Each `listen` block opens one port. `tls yes` makes it a direct-TLS port, `wss yes` a
+WebSocket-over-TLS port, and `type server` a server-to-server port.
+
+```ini
+listen { ip "[::]"; port 6667; }              # plaintext clients
+listen { ip "[::]"; port 6697; tls yes; }     # direct-TLS clients
+listen { ip "[::]"; port 7799; wss yes; }     # WebSocket (wss)
+listen { ip "[::]"; port 7700; type server; } # server links
+```
+
+## TLS
+
+Point the `tls` block at a certificate and private key. Both the OpenSSL and rustls backends are
+available, and certificates are re-read on rehash. Per-host certificates can be supplied with
+repeatable `sni` entries.
+
+```ini
+tls {
+    cert    "/etc/echoircd/tls/cert.pem";
+    key     "/etc/echoircd/tls/key.pem";
+    backend openssl;                          # or: rustls
+    sni     "irc.example.net ./tls/example.crt ./tls/example.key";
+}
+```
+
+## Cloaking
+
+Set a secret `cloak` key to enable host masking:
+
+```ini
+cloak { key "a-long-random-secret"; }
+```
+
+## Applying changes
+
+Validate, then rehash the running server — no restart required:
+
+```sh
+echoircd checkconfig echoircd.conf
+echoircd rehash echoircd.conf         # sends SIGHUP
+```
+
+See the shipped `echoircd.conf.example` for every available option.