fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in external-account mode (delegate identity to the website)

Browse source 
By default fedserv owns accounts itself — nothing changes, no external
service required. Set [auth] external = true and an outside authority (the
website) owns identity instead: NickServ REGISTER / DROP / SET
PASSWORD|EMAIL / RESETPASS / CONFIRM / CERT / GROUP and the IRCv3
registration relay are all refused ("managed on the website"), so IRC
can't mint or change a second identity. Login is unchanged — fedserv still
authenticates locally against the accounts the authority pushes in via the
existing gRPC Accounts API, so lookups stay in-memory fast.

fedserv keeps owning all IRC-domain data (channels, access, vhosts, bans,
memos) keyed by the account name in both modes. One config bool, off by
default, so standalone deployments are unaffected.
This commit is contained in:
Jean Chevronnet 2026-07-14 03:12:59 +00:00
parent 4c899d80b0
commit fba91b4d62
No known key found for this signature in database
8 changed files with 108 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
config.example.toml
View file

@ -74,3 +74,13 @@ protocol = 1206 # InspIRCd link protocol version (1206 = insp4, 1205
# per IP-mask (an exception limit of 0 means unlimited). 0 or omitted = off.
# [session]
# default_limit = 3
# Account authority. Omit this section (the default) and fedserv owns accounts
# itself: NickServ REGISTER / IDENTIFY / SET PASSWORD all work standalone, no
# external service needed. Set external = true to hand identity to an outside
# authority (e.g. your website): IRC can then only IDENTIFY — REGISTER, DROP,
# SET PASSWORD/EMAIL, RESETPASS, CONFIRM, CERT and GROUP are refused, and the
# authority pushes accounts in via the gRPC Accounts API (see [grpc]). fedserv
# still owns all channel/vhost/ban data, keyed by the account name.
# [auth]
# external = true