# Running & config

echo services reads a single `config.toml`. Only `[uplink]` and `[server]` are required; every other
section is optional and off when omitted. A few keys reload on OperServ `REHASH` (noted); the rest
need a service restart.

```sh
echo config.toml
```

## [uplink] — the ircd to link to (required)

| Key | Description |
| --- | --- |
| `host` / `port` | Uplink ircd address and S2S port |
| `password` | S2S link password |
| `tls` | Use TLS for the link; `true` pins the SPKI below |
| `spki_fingerprint` | Base64 SHA-256 of the uplink's SubjectPublicKeyInfo (when `tls=true`) |

## [server] — this node's identity (required)

| Key | Description |
| --- | --- |
| `name` / `sid` | Services server name and 3-char SID (unique) |
| `description` | Server description |
| `protocol` | InspIRCd link protocol (1206 = insp4, 1205 = insp3) |
| `scram_iterations` | PBKDF2 cost for new SCRAM verifiers (≥ 1000) |
| `guest_nick` | Nick prefix after `LOGOUT` |
| `service_host` | Host the pseudo-clients wear (empty = server name) |
| `service_modes` | User modes the service clients set (e.g. `iHkoB`) |
| `service_oper_type` | WHOIS "is a …" string |
| `services_channel` | Channel every pseudo-client joins |
| `standard_replies` | Use IRCv3 FAIL/WARN/NOTE instead of notices |

## [modules] — which services to start

`services` is a list of module names to bring up; omit the section for the full standard suite:
`nickserv`, `chanserv`, `botserv`, `hostserv`, `memoserv`, `operserv`, `statserv`, `groupserv`,
`infoserv`, `reportserv`, `helpserv`, `chanfix`, `diceserv`, `gameserv`, `debugserv`.

## [[oper]] — services operators (repeatable)

| Key | Description |
| --- | --- |
| `account` | Account granted operator access |
| `type` | Tier shortcut: `operator` < `administrator` < `root` |
| `privs` | Fine-grained privilege list (`auspex`, `oper`, `suspend`, `admin`, `root`) |

## Policy & lifecycle

| Section | Keys |
| --- | --- |
| `[register]` | `confusable_check`, `vouch` (REHASH-reloadable) |
| `[extban]` | `enabled` — which InspIRCd matching-extbans AKICK may use |
| `[auth]` | `external` — hand identity to an outside authority |
| `[expire]` | `accounts_days`, `channels_days`, `warn_days` (0 = never) |
| `[session]` | `default_limit` — per-IP connection limit |
| `[language]` | `default`, `dir`, `available` (ships en, fr, de, es, es-ar, pt, pt-br) |
| `[log]` | `channel`, `notify_exclude` |

## Email & web integration

| Section | Keys |
| --- | --- |
| `[email]` | `from`, `command` (mailer piped on stdin), `brand`, `accent`, `logo`, `confirm_url` |
| `[health]` | `bind` — `/health` + Prometheus `/metrics` (loopback, unauthenticated) |
| `[panel]` | `bind`, `brand` — self-contained web admin site (put behind a TLS proxy) |
| `[grpc]` | `bind`, `token`, `[grpc.tls]` — account/channel directory + Accounts API for a website |
| `[jsonrpc]` | `bind`, `token`, `origins`, `[jsonrpc.tls]` — HTTP JSON-RPC for the staff panel / stats |
| `[keycard]` | `url`, `api_key` — passwordless web login tokens |
| `[dictserv]` | `server` — DICT server for DictServ (opt-in) |

## Federation

`[gossip]` + `[[peer]]` provide node-to-node replication: `gossip.bind`, `gossip.secret`,
`[gossip.tls]` (mTLS), `[gossip.signing]` (Ed25519 per-origin signing + trusted-signer map), and one
`[[peer]]` per federated node.

See [Security & anti-abuse](/docs/services-security) for the `[security.*]` engine.