diff --git a/echoircd.conf.bak-20260816-114429 b/echoircd.conf.bak-20260816-114429
new file mode 100644
index 0000000..d8f2e5d
--- /dev/null
+++ b/echoircd.conf.bak-20260816-114429
@@ -0,0 +1,121 @@
+# echoIRCd config — simple key = value (repeat `motd` for extra lines).
+# Dev-safe default port so it won't clash with the live InspIRCd on 6667/6697.
+
+servername = irc.devtronic.pro
+network    = echoiRCd
+bind       = [::]:6767
+
+# TLS listener (6697 is the live InspIRCd; 6698 is taken too, so dev TLS = 6770)
+bind_tls   = [::]:6770
+tls_cert   = /home/debian/irc/ircd/echoIRCd/tls/cert.pem
+tls_key    = /home/debian/irc/ircd/echoIRCd/tls/key.pem
+
+motd = Welcome to echoIRCd — a tiny IRC daemon in Rust.
+motd = Work in progress. Be gentle.
+
+# --- server-to-server (phase-1 link foundation) ---
+sid         = 0AA
+serverdesc  = echoIRCd dev A
+bind_server = [::]:7700
+# link = <name> <ip> <port> <password> [autoconnect]  (test link secret, host-only)
+link = peer.test 127.0.0.1 7999 s2ssecret
+link = echoB.devtronic.pro 127.0.0.1 7701 s2ssecret
+
+# IRC operators — oper = <name> <password>
+oper = reverse z0e
+
+# host-cloaking secret (+x). Keep private; changing it re-cloaks everyone.
+cloak_key  = b1ca9b0343617a9b4774ea421a39f610f4eda5b680632ba4
+
+# antimixedutf8 — block spam that mixes look-alike scripts within words.
+# action = block | kill | gline | kline | zline ; target = both | channel | private
+antimixedutf8 = on
+amu_threshold = 8
+amu_minlen    = 10
+amu_action    = block
+amu_target    = both
+
+# +G censor words: `badword = <find> [replacement]` (omit replacement to block).
+# (none configured by default — +G is inert until words are listed here)
+
+badword = puto puta
+
+use_resolved_host = off
+
+# DNS blocklist (DNSBL) checks on connect, like InspIRCd's m_dnsbl. Repeat `dnsbl`
+# for multiple zones. On a listing, `dnsbl_action` decides what happens:
+#   mark  = just show the "*** ... LISTED" notice, let them in (default, safe)
+#   kill  = disconnect them (no persistent ban)
+#   kline / gline / zline = add a 1-day ban and disconnect
+# (leave commented to disable DNSBL entirely)
+#
+dnsbl = dnsbl.dronebl.org
+dnsbl = rbl.efnetrbl.org
+dnsbl_action = mark
+dnsbl_reason = Your host is listed in a DNS blocklist
+# --- opermotd / vhost / alias (added for feature testing) ---
+opermotd = Welcome to echoIRCd staff.
+opermotd = Use your powers wisely.
+vhost = vhostuser vhostpass my.cool.vhost
+alias = NS NickServ
+alias = HELPME helperbot
+
+# --- security groups (test) ---
+securitygroup = regged account public
+securitygroup = opers oper public
+
+# --- geoip (native MaxMind reader) ---
+geoip_database = /home/debian/irc/ircd/inspircd/run/conf/geodata/GeoLite2-Country.mmdb
+
+
+# --- flood: per-IP accept-rate limit (defense-in-depth with the firewalld rule) ---
+accept_rate = 30
+accept_burst = 60
+
+# =============================================================================
+#  extra modules — enabled 2026-08-15 (full option reference: echoircd.conf.example)
+# =============================================================================
+# ENABLED (safe, non-destructive):
+blockamsg = yes
+blockamsg_action = notice        # block mass /amsg + notify the user (NOT kill)
+securelist = yes
+securelist_showmsg = yes         # delay /LIST for fresh connections (anti list-spam)
+maphide = yes                    # hide LINKS/MAP from non-opers
+chancreate = yes                 # snotice opers when a new channel is created
+
+# OFF by default — enable deliberately after reading the note:
+#  antirandom DEFAULT ACTION IS KILL — set antirandom_action=block first + test:
+# antirandom = yes
+# antirandom_action = block
+# antirandom_showfailed = yes
+#  connectban z-lines an IP opening too many connections — can ban a shared NAT;
+#  connection floods are already handled by accept_rate above, so leave off unless needed:
+# connectban = yes
+# connectban_threshold = 20
+#  policy changes (can annoy legit users):
+# restrictmsg = yes              # blocks user<->user private messages
+# restrictchans = yes            # only opers may CREATE channels
+#  registration GATES — a misconfig LOCKS OUT ALL NEW USERS; need a working backend:
+# recaptcha / cloudflare_challenge / account_registration  (see echoircd.conf.example)
+
+# --- more modules enabled 2026-08-15 (all standalone; safe actions, no external deps) ---
+antirandom = yes
+antirandom_action = block
+antirandom_threshold = 15
+antirandom_showfailed = yes
+connectban = yes
+connectban_threshold = 30
+connectban_duration = 3600
+conn_waitpong = yes
+solvemsg = yes
+dnsbl_action = mark
+seenicks = yes
+hashident = yes
+hashident_key = 38c798c2091fb4c1dbee153067f996765c0d6085b82b34fa1583707c34ec59d7
+extjwt_secret = 372fd2169e6e640f78efb99f55e100bb8f4627c2a6968545b81489637a891a56
+connbanner = Welcome to the network — be respectful; staff can help via /HELPOP.
+
+# services link (echo services package dials in on 7700)
+link = services.devtronic.pro 127.0.0.1 7700 df06ade704bcb3c8cbaae5e36787b25bd671e68a
+# relay client SASL (AUTHENTICATE) to the services server above
+sasl_server = services.devtronic.pro
diff --git a/echoircd.conf.permchannels b/echoircd.conf.permchannels
new file mode 100644
index 0000000..0ef52d5
--- /dev/null
+++ b/echoircd.conf.permchannels
@@ -0,0 +1,5 @@
+# echoircd permanent channels — auto-generated; manual edits are overwritten
+C #echoircd 1786931020
+M +rntCTP
+C #services 1786931020
+M +nstOP