Group the module crates under modules/

The service pseudo-clients and the ircd protocol link sat flat at the
repo root, mixed in with the daemon core and the SDK. Move them all
under modules/ so the tree separates concerns cleanly: the daemon in
src/, the SDK every module links against in api/, and the loadable
modules — the pseudo-clients plus the protocol link — in modules/.

Workspace members, the daemon's per-crate dependency paths, and each
module's api path are updated to match; the docs follow. No code change.

modules/hostserv/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "fedserv-hostserv"
+version = "0.0.1"
+edition = "2021"
+description = "HostServ: assign and apply virtual hosts (vhosts)."
+
+[dependencies]
+fedserv-api = { path = "../../api" }

modules/hostserv/src/approve.rs

@@ -0,0 +1,46 @@
+use fedserv_api::{NetView, Sender, ServiceCtx, Store};
+
+// ACTIVATE <account> / REJECT <account>: approve a pending vhost request (setting
+// and applying it) or turn it down. Operators only.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store, activate: bool) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(&account) = args.get(1) else {
+        let syntax = if activate { "Syntax: ACTIVATE <account>" } else { "Syntax: REJECT <account>" };
+        ctx.notice(me, from.uid, syntax);
+        return;
+    };
+    let host = match db.take_vhost_request(account) {
+        Ok(Some(h)) => h,
+        Ok(None) => {
+            ctx.notice(me, from.uid, format!("\x02{account}\x02 has no pending vhost request."));
+            return;
+        }
+        Err(_) => {
+            ctx.notice(me, from.uid, format!("\x02{account}\x02 isn't registered."));
+            return;
+        }
+    };
+    if !activate {
+        ctx.notice(me, from.uid, format!("Rejected \x02{account}\x02's vhost request."));
+        return;
+    }
+    // Re-check the requested host now (another account may have taken it since).
+    let host = match super::prepare_vhost(&host, account, db) {
+        Ok(h) => h,
+        Err(msg) => {
+            ctx.notice(me, from.uid, format!("Can't activate: {msg}"));
+            return;
+        }
+    };
+    match db.set_vhost(account, &host, from.nick, None) {
+        Ok(()) => {
+            for uid in net.uids_logged_into(account) {
+                ctx.apply_vhost(&uid, &host);
+            }
+            ctx.notice(me, from.uid, format!("Activated vhost \x02{host}\x02 for \x02{account}\x02."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/default.rs

@@ -0,0 +1,35 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// DEFAULT: give yourself the auto-vhost from the network template, with your
+// account name substituted for $account.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    let Some(template) = db.vhost_template() else {
+        ctx.notice(me, from.uid, "This network has no auto-vhost template.");
+        return;
+    };
+    // Sanitise the account into a host-safe label (lowercase, alphanumerics only).
+    let label: String = account.to_ascii_lowercase().chars().filter(|c| c.is_ascii_alphanumeric()).collect();
+    if label.is_empty() {
+        ctx.notice(me, from.uid, "Your account name has no usable characters for a vhost.");
+        return;
+    }
+    let generated = template.replace("$account", &label);
+    let host = match super::prepare_vhost(&generated, account, db) {
+        Ok(h) if !db.vhost_is_forbidden(&h) => h,
+        _ => {
+            ctx.notice(me, from.uid, "Sorry, a vhost couldn't be generated for your account.");
+            return;
+        }
+    };
+    match db.set_vhost(account, &host, "template", None) {
+        Ok(()) => {
+            ctx.apply_vhost(from.uid, &host);
+            ctx.notice(me, from.uid, format!("You now have the vhost \x02{host}\x02."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/del.rs

@@ -0,0 +1,26 @@
+use fedserv_api::{NetView, Sender, ServiceCtx, Store};
+
+// DEL <account>: remove an account's vhost, restoring the normal host on any
+// online sessions. Operators only.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(&account) = args.get(1) else {
+        ctx.notice(me, from.uid, "Syntax: DEL <account>");
+        return;
+    };
+    match db.del_vhost(account) {
+        Ok(true) => {
+            for uid in net.uids_logged_into(account) {
+                if let Some(host) = net.host_of(&uid) {
+                    let host = host.to_string();
+                    ctx.set_host(&uid, &host);
+                }
+            }
+            ctx.notice(me, from.uid, format!("Vhost for \x02{account}\x02 removed."));
+        }
+        Ok(false) => ctx.notice(me, from.uid, format!("\x02{account}\x02 has no vhost.")),
+        Err(_) => ctx.notice(me, from.uid, format!("\x02{account}\x02 isn't registered.")),
+    }
+}

modules/hostserv/src/forbid.rs

@@ -0,0 +1,51 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// FORBID <pattern>: block user-requested vhosts matching this regex (operators),
+// e.g. (?i)(oper|admin|staff|services) to stop impersonation.
+pub fn add(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    if args.len() < 2 {
+        ctx.notice(me, from.uid, "Syntax: FORBID <regex>");
+        return;
+    }
+    let pattern = args[1..].join(" ");
+    match db.vhost_forbid_add(&pattern) {
+        Ok(true) => ctx.notice(me, from.uid, format!("Forbidden vhost pattern added: {pattern}")),
+        Ok(false) => ctx.notice(me, from.uid, "That pattern is already forbidden."),
+        Err(_) => ctx.notice(me, from.uid, format!("\x02{pattern}\x02 isn't a valid regular expression.")),
+    }
+}
+
+// FORBIDLIST: the forbidden-pattern list (operators).
+pub fn list(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let forbidden = db.vhost_forbidden();
+    if forbidden.is_empty() {
+        ctx.notice(me, from.uid, "No vhost patterns are forbidden.");
+        return;
+    }
+    ctx.notice(me, from.uid, format!("Forbidden vhost patterns ({}):", forbidden.len()));
+    for (i, p) in forbidden.iter().enumerate() {
+        ctx.notice(me, from.uid, format!("  {}. {p}", i + 1));
+    }
+}
+
+// FORBIDDEL <number>: remove a forbidden pattern (operators).
+pub fn del(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(n) = args.get(1).and_then(|s| s.parse::<usize>().ok()) else {
+        ctx.notice(me, from.uid, "Syntax: FORBIDDEL <number> (see FORBIDLIST)");
+        return;
+    };
+    match db.vhost_forbid_del(n) {
+        Ok(Some(pattern)) => ctx.notice(me, from.uid, format!("Removed forbidden pattern: {pattern}")),
+        Ok(None) => ctx.notice(me, from.uid, format!("There's no forbidden pattern #\x02{n}\x02.")),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/lib.rs

@@ -0,0 +1,141 @@
+//! HostServ assigns virtual hosts (vhosts) to accounts and applies them to the
+//! displayed host. Members toggle their own with ON/OFF; operators assign them
+//! with SET/DEL and review with LIST. `lib.rs` holds the dispatcher; each
+//! command lives in its own file.
+
+use fedserv_api::{NetView, Priv, Sender, Service, ServiceCtx, Store};
+
+#[path = "on.rs"]
+mod on;
+#[path = "off.rs"]
+mod off;
+#[path = "set.rs"]
+mod set;
+#[path = "del.rs"]
+mod del;
+#[path = "list.rs"]
+mod list;
+#[path = "request.rs"]
+mod request;
+#[path = "waiting.rs"]
+mod waiting;
+#[path = "approve.rs"]
+mod approve;
+#[path = "offer.rs"]
+mod offer;
+#[path = "take.rs"]
+mod take;
+#[path = "forbid.rs"]
+mod forbid;
+#[path = "template.rs"]
+mod template;
+#[path = "default.rs"]
+mod default;
+
+pub struct HostServ {
+    pub uid: String,
+}
+
+impl Service for HostServ {
+    fn nick(&self) -> &str {
+        "HostServ"
+    }
+    fn uid(&self) -> &str {
+        &self.uid
+    }
+    fn gecos(&self) -> &str {
+        "Host Services"
+    }
+
+    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
+        let me = self.uid.as_str();
+        match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
+            Some("ON") => on::handle(me, from, ctx, db),
+            Some("OFF") => off::handle(me, from, ctx, net, db),
+            // SET(ALL)/DEL(ALL): the per-account model already covers every
+            // grouped nick, so ALL is an alias, and GROUP is a no-op reassurance.
+            Some("SET") | Some("SETALL") => set::handle(me, from, args, ctx, net, db),
+            Some("DEL") | Some("DELALL") => del::handle(me, from, args, ctx, net, db),
+            Some("GROUP") => ctx.notice(me, from.uid, "Your vhost already applies to all your grouped nicks — nothing to sync."),
+            Some("LIST") => list::handle(me, from, ctx, db),
+            Some("REQUEST") => request::handle(me, from, args, ctx, db),
+            Some("WAITING") => waiting::handle(me, from, ctx, db),
+            Some("ACTIVATE") | Some("APPROVE") => approve::handle(me, from, args, ctx, net, db, true),
+            Some("REJECT") => approve::handle(me, from, args, ctx, net, db, false),
+            Some("OFFER") => offer::add(me, from, args, ctx, db),
+            Some("OFFERLIST") => offer::list(me, from, ctx, db),
+            Some("OFFERDEL") => offer::del(me, from, args, ctx, db),
+            Some("TAKE") => take::handle(me, from, args, ctx, db),
+            Some("FORBID") => forbid::add(me, from, args, ctx, db),
+            Some("FORBIDLIST") => forbid::list(me, from, ctx, db),
+            Some("FORBIDDEL") => forbid::del(me, from, args, ctx, db),
+            Some("TEMPLATE") => template::handle(me, from, args, ctx, db),
+            Some("DEFAULT") => default::handle(me, from, ctx, db),
+            Some("HELP") | None => ctx.notice(me, from.uid, "HostServ gives you a vhost: \x02ON\x02 activates your assigned vhost, \x02OFF\x02 restores your normal host, \x02REQUEST\x02 <host> asks for one, \x02OFFERLIST\x02 + \x02TAKE\x02 <n> pick from the menu. Operators use \x02SET\x02/\x02DEL\x02 <account>, \x02LIST\x02, \x02WAITING\x02 + \x02ACTIVATE\x02/\x02REJECT\x02, and \x02OFFER\x02/\x02OFFERDEL\x02 for the menu."),
+            Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
+        }
+    }
+}
+
+// Operator gate for vhost administration.
+fn require_oper(me: &str, from: &Sender, ctx: &mut ServiceCtx) -> bool {
+    if from.privs.has(Priv::Admin) {
+        return true;
+    }
+    ctx.notice(me, from.uid, "Access denied — assigning vhosts is for services operators.");
+    false
+}
+
+// Canonicalise a vhost the way the ircd will actually display it: the host part
+// only allows letters, digits, dots and hyphens, so a disallowed character it
+// would rewrite (an underscore becomes a hyphen) is rewritten here first. This
+// keeps what we store identical to what shows on the network, so two inputs
+// that would collapse to the same host are detected as one.
+pub(crate) fn normalize_vhost(spec: &str) -> String {
+    let (ident, host) = match spec.split_once('@') {
+        Some((i, h)) => (Some(i), h),
+        None => (None, spec),
+    };
+    let norm_host: String = host.chars().map(|c| if c == '_' { '-' } else { c }).collect();
+    match ident {
+        Some(i) => format!("{i}@{norm_host}"),
+        None => norm_host,
+    }
+}
+
+// Normalise a requested vhost and check it's valid and not already another
+// account's. Returns the canonical spec to store, or a message to show.
+pub(crate) fn prepare_vhost(spec: &str, account: &str, db: &dyn Store) -> Result<String, String> {
+    let host = normalize_vhost(spec);
+    if !valid_vhost(&host) {
+        return Err(format!("\x02{host}\x02 isn't a valid host (letters, digits, hyphens and dots)."));
+    }
+    if db.vhost_owner(&host).is_some_and(|owner| !owner.eq_ignore_ascii_case(account)) {
+        return Err(format!("\x02{host}\x02 is already in use. Please choose another."));
+    }
+    Ok(host)
+}
+
+// Whether `spec` is a valid vhost: an optional `ident@` (letters, digits, a few
+// punctuation) followed by a hostname of dot-separated alphanumeric/hyphen labels.
+pub(crate) fn valid_vhost(spec: &str) -> bool {
+    let (ident, host) = match spec.split_once('@') {
+        Some((i, h)) => (Some(i), h),
+        None => (None, spec),
+    };
+    if let Some(i) = ident {
+        if i.is_empty() || i.len() > 12 || !i.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_' || b == b'.') {
+            return false;
+        }
+    }
+    if host.is_empty() || host.len() > 64 || !host.contains('.') {
+        return false;
+    }
+    host.split('.').all(|label| {
+        !label.is_empty()
+            && label.len() <= 63
+            && !label.starts_with('-')
+            && !label.ends_with('-')
+            && label.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-')
+    })
+}

modules/hostserv/src/list.rs

@@ -0,0 +1,18 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// LIST: every account with an assigned vhost. Operators only.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let vhosts = db.vhosts();
+    if vhosts.is_empty() {
+        ctx.notice(me, from.uid, "No vhosts have been assigned.");
+        return;
+    }
+    ctx.notice(me, from.uid, format!("Assigned vhosts ({}):", vhosts.len()));
+    for v in &vhosts {
+        let temp = if v.expires.is_some() { ", temporary" } else { "" };
+        ctx.notice(me, from.uid, format!("  \x02{}\x02 — {} (by {}{temp})", v.account, v.host, v.setter));
+    }
+}

modules/hostserv/src/off.rs

@@ -0,0 +1,22 @@
+use fedserv_api::{NetView, Sender, ServiceCtx, Store};
+
+// OFF: restore your normal host for this session (the vhost stays assigned and
+// re-applies next time you identify).
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    if db.vhost(account).is_none() {
+        ctx.notice(me, from.uid, "You have no vhost assigned.");
+        return;
+    }
+    match net.host_of(from.uid) {
+        Some(host) => {
+            let host = host.to_string();
+            ctx.set_host(from.uid, &host);
+            ctx.notice(me, from.uid, "Your vhost is off; your normal host is restored.");
+        }
+        None => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/offer.rs

@@ -0,0 +1,51 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// OFFER <host>: add a vhost to the self-serve menu (operators).
+pub fn add(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(&host) = args.get(1) else {
+        ctx.notice(me, from.uid, "Syntax: OFFER <host>");
+        return;
+    };
+    if !super::valid_vhost(host) {
+        ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't a valid host."));
+        return;
+    }
+    match db.vhost_offer_add(host) {
+        Ok(true) => ctx.notice(me, from.uid, format!("\x02{host}\x02 is now on the vhost menu.")),
+        Ok(false) => ctx.notice(me, from.uid, "That vhost is already on the menu."),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}
+
+// OFFERLIST: show the self-serve vhost menu (anyone).
+pub fn list(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    let offers = db.vhost_offers();
+    if offers.is_empty() {
+        ctx.notice(me, from.uid, "No vhosts are on offer.");
+        return;
+    }
+    ctx.notice(me, from.uid, format!("Vhosts on offer ({}):", offers.len()));
+    for (i, host) in offers.iter().enumerate() {
+        ctx.notice(me, from.uid, format!("  {}. {host}", i + 1));
+    }
+    ctx.notice(me, from.uid, "Take one with \x02TAKE\x02 <number>.");
+}
+
+// OFFERDEL <number>: remove an offer from the menu (operators).
+pub fn del(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(n) = args.get(1).and_then(|s| s.parse::<usize>().ok()) else {
+        ctx.notice(me, from.uid, "Syntax: OFFERDEL <number> (see OFFERLIST)");
+        return;
+    };
+    match db.vhost_offer_del(n) {
+        Ok(Some(host)) => ctx.notice(me, from.uid, format!("Removed \x02{host}\x02 from the menu.")),
+        Ok(None) => ctx.notice(me, from.uid, format!("There's no offer #\x02{n}\x02.")),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/on.rs

@@ -0,0 +1,16 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// ON: activate the vhost assigned to your account.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    match db.vhost(account) {
+        Some(v) => {
+            ctx.apply_vhost(from.uid, &v.host);
+            ctx.notice(me, from.uid, format!("Your vhost \x02{}\x02 is now active.", v.host));
+        }
+        None => ctx.notice(me, from.uid, "You have no vhost assigned."),
+    }
+}

modules/hostserv/src/request.rs

@@ -0,0 +1,33 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// REQUEST <host>: ask for a vhost, to be approved by an operator.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    let Some(&host) = args.get(1) else {
+        ctx.notice(me, from.uid, "Syntax: REQUEST <host>");
+        return;
+    };
+    let host = match super::prepare_vhost(host, account, db) {
+        Ok(h) => h,
+        Err(msg) => {
+            ctx.notice(me, from.uid, msg);
+            return;
+        }
+    };
+    if db.vhost_is_forbidden(&host) {
+        ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't allowed here. Please choose another."));
+        return;
+    }
+    let wait = db.vhost_request_wait(account);
+    if wait > 0 {
+        ctx.notice(me, from.uid, format!("Please wait \x02{wait}\x02s before requesting another vhost."));
+        return;
+    }
+    match db.request_vhost(account, &host) {
+        Ok(()) => ctx.notice(me, from.uid, format!("Requested vhost \x02{host}\x02 — an operator will review it.")),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/set.rs

@@ -0,0 +1,36 @@
+use fedserv_api::{parse_duration, NetView, Sender, ServiceCtx, Store};
+
+// SET <account> <host> [duration]: assign a vhost to an account, applying it at
+// once to online sessions. An optional duration (e.g. 30d) makes it temporary.
+// Operators only.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let (Some(&account), Some(&host)) = (args.get(1), args.get(2)) else {
+        ctx.notice(me, from.uid, "Syntax: SET <account> <host> [duration]");
+        return;
+    };
+    if db.account(account).is_none() {
+        ctx.notice(me, from.uid, format!("\x02{account}\x02 isn't registered."));
+        return;
+    }
+    let host = match super::prepare_vhost(host, account, db) {
+        Ok(h) => h,
+        Err(msg) => {
+            ctx.notice(me, from.uid, msg);
+            return;
+        }
+    };
+    let ttl = args.get(3).and_then(|s| parse_duration(s));
+    match db.set_vhost(account, &host, from.nick, ttl) {
+        Ok(()) => {
+            for uid in net.uids_logged_into(account) {
+                ctx.apply_vhost(&uid, &host);
+            }
+            let when = args.get(3).filter(|_| ttl.is_some()).map(|d| format!(" (expires in {d})")).unwrap_or_default();
+            ctx.notice(me, from.uid, format!("Vhost \x02{host}\x02 assigned to \x02{account}\x02{when}."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/take.rs

@@ -0,0 +1,31 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// TAKE <number>: assign yourself the vhost offered at that position on the menu.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    let Some(n) = args.get(1).and_then(|s| s.parse::<usize>().ok()) else {
+        ctx.notice(me, from.uid, "Syntax: TAKE <number> (see OFFERLIST)");
+        return;
+    };
+    let Some(offer) = n.checked_sub(1).and_then(|i| db.vhost_offers().into_iter().nth(i)) else {
+        ctx.notice(me, from.uid, format!("There's no offer #\x02{n}\x02. See \x02OFFERLIST\x02."));
+        return;
+    };
+    let host = match super::prepare_vhost(&offer, account, db) {
+        Ok(h) => h,
+        Err(msg) => {
+            ctx.notice(me, from.uid, msg);
+            return;
+        }
+    };
+    match db.set_vhost(account, &host, "offer", None) {
+        Ok(()) => {
+            ctx.apply_vhost(from.uid, &host);
+            ctx.notice(me, from.uid, format!("You now have the vhost \x02{host}\x02."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

modules/hostserv/src/template.rs

@@ -0,0 +1,32 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// TEMPLATE [<pattern>]: show the auto-vhost template, or (operators) set it.
+// Use $account for the requester's sanitised account name, e.g.
+// $account.users.example. Give no argument to show it, OFF to clear it.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    match args.get(1) {
+        None => match db.vhost_template() {
+            Some(t) => ctx.notice(me, from.uid, format!("Auto-vhost template: \x02{t}\x02. Users apply it with \x02DEFAULT\x02.")),
+            None => ctx.notice(me, from.uid, "No auto-vhost template is set."),
+        },
+        Some(&arg) => {
+            if !super::require_oper(me, from, ctx) {
+                return;
+            }
+            if arg.eq_ignore_ascii_case("OFF") {
+                let _ = db.set_vhost_template(None);
+                ctx.notice(me, from.uid, "Auto-vhost template cleared.");
+                return;
+            }
+            let template = args[1..].join(" ");
+            if !template.contains("$account") || !super::valid_vhost(&template.replace("$account", "x")) {
+                ctx.notice(me, from.uid, "The template must contain \x02$account\x02 and form a valid host, e.g. \x02$account.users.example\x02.");
+                return;
+            }
+            match db.set_vhost_template(Some(template.clone())) {
+                Ok(()) => ctx.notice(me, from.uid, format!("Auto-vhost template set to \x02{template}\x02.")),
+                Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+            }
+        }
+    }
+}

modules/hostserv/src/waiting.rs

@@ -0,0 +1,18 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// WAITING: pending vhost requests awaiting approval. Operators only.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let requests = db.vhost_requests();
+    if requests.is_empty() {
+        ctx.notice(me, from.uid, "No vhost requests are waiting.");
+        return;
+    }
+    ctx.notice(me, from.uid, format!("Pending vhost requests ({}):", requests.len()));
+    for (account, host) in &requests {
+        ctx.notice(me, from.uid, format!("  \x02{account}\x02 — {host}"));
+    }
+    ctx.notice(me, from.uid, "Approve with \x02ACTIVATE\x02 <account> or turn down with \x02REJECT\x02 <account>.");
+}