# CLI tools

The `echoircd` binary dispatches on its first argument. Any first argument that is not one of the
subcommands below is treated as the path to a config file to boot the server with.

## Boot the server

```sh
echoircd [config]
```

Loads the config (default `echoircd.conf`), binds the plaintext / TLS / S2S / WebSocket / RPC /
metrics listeners, and runs the single-threaded core.

## rehash

```sh
echoircd rehash [config]
```

Signal a **running** server to reload its configuration in place — it finds the process via the
pidfile (or a `/proc` scan) and sends `SIGHUP`, then exits without booting a new server. Most options
re-apply live, and the TLS certificate is re-read, with no restart and no disconnects.

## checkconfig

```sh
echoircd checkconfig [config]
```

Parse a config and print a deterministic, sorted dump of every key/value it produces — validate a
config before deploying it, or diff two configs (for example the block form against the legacy flat
form). Exits non-zero on an unreadable file or an empty `servername`.

## mkpasswd

```sh
echoircd mkpasswd [cost]
```

Read a password from **stdin** (never from the command line, to keep it out of `ps` and shell
history) and print its bcrypt hash — a config-ready value for an `oper` block's `password`. Takes an
optional bcrypt cost (default 11).

```sh
printf '%s' 'my-secret' | echoircd mkpasswd
```

> The in-daemon `MKPASSWD` **command** is separate from this CLI subcommand: the command supports
> md5/sha1/sha256/sha512/pbkdf2 for oper-issued credentials, while the CLI produces a bcrypt hash.