docs: markdown documentation section (sidebar nav, per-page toc, search, hljs)

content/docs/operators.md

@@ -0,0 +1,55 @@
+# Operators
+
+Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is
+the sum of three allow-lists: the **commands** they may run, the named **privileges** they hold,
+and the user/channel **modes** they may set.
+
+## Oper types
+
+An `opertype` groups a set of powers so many opers can share one role.
+
+```ini
+opertype {
+    name      "netadmin";
+    commands  "*";                 # every oper command
+    privs     "*";                 # every named privilege
+    usermodes "*";
+    chanmodes "*";
+}
+
+opertype {
+    name      "helper";
+    commands  "KILL SANICK";
+    privs     "users/auspex channels/auspex";
+    usermodes "-*";                # no privileged usermodes
+    chanmodes "b";
+}
+```
+
+Lists are space-separated tokens. `*` grants everything; a `-` prefix denies a specific token —
+for example `* -KILL` means "everything except `KILL`".
+
+## Oper accounts
+
+An `oper` block ties a login to an `opertype`. Hash the password with the `mkpasswd` helper.
+
+```ini
+oper {
+    name     "alice";
+    password "$argon2id$...";       # from: echoircd mkpasswd
+    type     "netadmin";
+    host     "*@192.0.2.0/24";
+}
+```
+
+Then, as a client:
+
+```text
+/oper alice hunter2
+```
+
+## Privileges
+
+Named privileges gate individual abilities — for example `users/auspex` (see hidden user
+details), `channels/auspex`, `servers/rehash`, or `users/mass-message`. Assign them per
+`opertype` through `privs`, and the daemon enforces them everywhere the ability is used.