79 lines
3.4 KiB
Markdown
79 lines
3.4 KiB
Markdown
# Running & config
|
|
|
|
echo services reads a single `config.toml`. Only `[uplink]` and `[server]` are required; every other
|
|
section is optional and off when omitted. A few keys reload on OperServ `REHASH` (noted); the rest
|
|
need a service restart.
|
|
|
|
```sh
|
|
echo config.toml
|
|
```
|
|
|
|
## [uplink] — the ircd to link to (required)
|
|
|
|
| Key | Description |
|
|
| --- | --- |
|
|
| `host` / `port` | Uplink ircd address and S2S port |
|
|
| `password` | S2S link password |
|
|
| `tls` | Use TLS for the link; `true` pins the SPKI below |
|
|
| `spki_fingerprint` | Base64 SHA-256 of the uplink's SubjectPublicKeyInfo (when `tls=true`) |
|
|
|
|
## [server] — this node's identity (required)
|
|
|
|
| Key | Description |
|
|
| --- | --- |
|
|
| `name` / `sid` | Services server name and 3-char SID (unique) |
|
|
| `description` | Server description |
|
|
| `protocol` | InspIRCd link protocol (1206 = insp4, 1205 = insp3) |
|
|
| `scram_iterations` | PBKDF2 cost for new SCRAM verifiers (≥ 1000) |
|
|
| `guest_nick` | Nick prefix after `LOGOUT` |
|
|
| `service_host` | Host the pseudo-clients wear (empty = server name) |
|
|
| `service_modes` | User modes the service clients set (e.g. `iHkoB`) |
|
|
| `service_oper_type` | WHOIS "is a …" string |
|
|
| `services_channel` | Channel every pseudo-client joins |
|
|
| `standard_replies` | Use IRCv3 FAIL/WARN/NOTE instead of notices |
|
|
|
|
## [modules] — which services to start
|
|
|
|
`services` is a list of module names to bring up; omit the section for the full standard suite:
|
|
`nickserv`, `chanserv`, `botserv`, `hostserv`, `memoserv`, `operserv`, `statserv`, `groupserv`,
|
|
`infoserv`, `reportserv`, `helpserv`, `chanfix`, `diceserv`, `gameserv`, `debugserv`.
|
|
|
|
## [[oper]] — services operators (repeatable)
|
|
|
|
| Key | Description |
|
|
| --- | --- |
|
|
| `account` | Account granted operator access |
|
|
| `type` | Tier shortcut: `operator` < `administrator` < `root` |
|
|
| `privs` | Fine-grained privilege list (`auspex`, `oper`, `suspend`, `admin`, `root`) |
|
|
|
|
## Policy & lifecycle
|
|
|
|
| Section | Keys |
|
|
| --- | --- |
|
|
| `[register]` | `confusable_check`, `vouch` (REHASH-reloadable) |
|
|
| `[extban]` | `enabled` — which InspIRCd matching-extbans AKICK may use |
|
|
| `[auth]` | `external` — hand identity to an outside authority |
|
|
| `[expire]` | `accounts_days`, `channels_days`, `warn_days` (0 = never) |
|
|
| `[session]` | `default_limit` — per-IP connection limit |
|
|
| `[language]` | `default`, `dir`, `available` (ships en, fr, de, es, es-ar, pt, pt-br) |
|
|
| `[log]` | `channel`, `notify_exclude` |
|
|
|
|
## Email & web integration
|
|
|
|
| Section | Keys |
|
|
| --- | --- |
|
|
| `[email]` | `from`, `command` (mailer piped on stdin), `brand`, `accent`, `logo`, `confirm_url` |
|
|
| `[health]` | `bind` — `/health` + Prometheus `/metrics` (loopback, unauthenticated) |
|
|
| `[panel]` | `bind`, `brand` — self-contained web admin site (put behind a TLS proxy) |
|
|
| `[grpc]` | `bind`, `token`, `[grpc.tls]` — account/channel directory + Accounts API for a website |
|
|
| `[jsonrpc]` | `bind`, `token`, `origins`, `[jsonrpc.tls]` — HTTP JSON-RPC for the staff panel / stats |
|
|
| `[keycard]` | `url`, `api_key` — passwordless web login tokens |
|
|
| `[dictserv]` | `server` — DICT server for DictServ (opt-in) |
|
|
|
|
## Federation
|
|
|
|
`[gossip]` + `[[peer]]` provide node-to-node replication: `gossip.bind`, `gossip.secret`,
|
|
`[gossip.tls]` (mTLS), `[gossip.signing]` (Ed25519 per-origin signing + trusted-signer map), and one
|
|
`[[peer]]` per federated node.
|
|
|
|
See [Security & anti-abuse](/docs/services-security) for the `[security.*]` engine.
|