# Operators

Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is
the sum of three allow-lists: the **commands** they may run, the named **privileges** they hold,
and the user/channel **modes** they may set.

## Oper types

An `opertype` groups a set of powers so many opers can share one role.

```ini
opertype {
    name      "netadmin";
    commands  "*";                 # every oper command
    privs     "*";                 # every named privilege
    usermodes "*";
    chanmodes "*";
}

opertype {
    name      "helper";
    commands  "KILL SANICK";
    privs     "users/auspex channels/auspex";
    usermodes "-*";                # no privileged usermodes
    chanmodes "b";
}
```

Lists are space-separated tokens. `*` grants everything; a `-` prefix denies a specific token —
for example `* -KILL` means "everything except `KILL`".

## Oper accounts

An `oper` block ties a login to an `opertype`. Hash the password with the `mkpasswd` helper.

```ini
oper {
    name     "alice";
    password "$argon2id$...";       # from: echoircd mkpasswd
    type     "netadmin";
    host     "*@192.0.2.0/24";
}
```

Then, as a client:

```text
/oper alice hunter2
```

## Privileges

Named privileges gate individual abilities — for example `users/auspex` (see hidden user
details), `channels/auspex`, `servers/rehash`, or `users/mass-message`. Assign them per
`opertype` through `privs`, and the daemon enforces them everywhere the ability is used.