website/content/docs/operators.md

Operators

Server operators are defined by oper blocks and typed by opertype blocks. An oper's power is the sum of three allow-lists: the commands they may run, the named privileges they hold, and the user/channel modes they may set.

Oper types

An opertype groups a set of powers so many opers can share one role.

opertype {
    name      "netadmin";
    commands  "*";                 # every oper command
    privs     "*";                 # every named privilege
    usermodes "*";
    chanmodes "*";
}

opertype {
    name      "helper";
    commands  "KILL SANICK";
    privs     "users/auspex channels/auspex";
    usermodes "-*";                # no privileged usermodes
    chanmodes "b";
}

Lists are space-separated tokens. * grants everything; a - prefix denies a specific token — for example * -KILL means "everything except KILL".

Oper accounts

An oper block ties a login to an opertype. Hash the password with the mkpasswd helper.

oper {
    name     "alice";
    password "$argon2id$...";       # from: echoircd mkpasswd
    type     "netadmin";
    host     "*@192.0.2.0/24";
}

Then, as a client:

/oper alice hunter2

Privileges

Named privileges gate individual abilities — for example users/auspex (see hidden user details), channels/auspex, servers/rehash, or users/mass-message. Assign them per opertype through privs, and the daemon enforces them everywhere the ability is used.