Add /topic !#channel operspy to sgml docs.

[irc/rqf/shadowircd.git] / doc / sgml / oper-guide / config.sgml

diff --git a/doc/sgml/oper-guide/config.sgml b/doc/sgml/oper-guide/config.sgml
index 987a29ab89791d7673239fd8f3b0592dea0d59e5..4c6207ffc6c8e14d6501b4f914f0ae54a28765c1 100644 (file)
--- a/doc/sgml/oper-guide/config.sgml
+++ b/doc/sgml/oper-guide/config.sgml
@@ -359,7 +359,7 @@ auth {
          <varlistentry>
            <term>kline_exempt (^)</term>
            <listitem>
-             <para>Users in this auth{} block are exempted from DNS blacklists, k:lines, g:lines and x:lines.</para>
+             <para>Users in this auth{} block are exempted from DNS blacklists, k:lines and x:lines.</para>
            </listitem>
          </varlistentry>
          <varlistentry>
@@ -410,6 +410,12 @@ auth {
              <para>Users in this auth{} block must have identd, otherwise they will be rejected.</para>
            </listitem>
          </varlistentry>
+         <varlistentry>
+           <term>need_ssl</term>
+           <listitem>
+             <para>Users in this auth{} block must be connected via SSL/TLS, otherwise they will be rejected.</para>
+           </listitem>
+         </varlistentry>
          <varlistentry>
            <term>need_sasl</term>
            <listitem>
@@ -442,6 +448,33 @@ exempt {
          </varlistentry>
        </variablelist>
       </sect2>
+      <sect2>
+       <title>privset {} block</title>
+       <synopsis>
+privset {
+       extends = "<replaceable>name</replaceable>";
+       privs = <replaceable>list</replaceable>;
+};</synopsis>
+       <para>
+         A privset (privilege set) block specifies a set of
+         operator privileges.
+       </para>
+       <variablelist>
+         <title>privset {} variables</title>
+         <varlistentry>
+           <term>extends</term>
+           <listitem>
+             <para>An optional privset to inherit. The new privset will have all privileges that the given privset has.</para>
+           </listitem>
+         </varlistentry>
+         <varlistentry>
+           <term>privs</term>
+           <listitem>
+             <para>Privileges to grant to this privset. These are described in the operator privileges section.</para>
+           </listitem>
+         </varlistentry>
+       </variablelist>
+      </sect2>
       <sect2>
        <title>operator {} block</title>
        <synopsis>
@@ -510,19 +543,35 @@ operator "<replaceable>name</replaceable>" {
            </listitem>
          </varlistentry>
          <varlistentry>
-           <term>flags</term>
+           <term>privset</term>
            <listitem>
               <para>
-               A listing of privileges granted to operators using this block.
-               By default, the mass_notice, operwall, remoteban and resv privileges are granted;
-               use ~mass_notice, ~operwall, ~remoteban and ~resv to disable them if necessary.
-             </para>
-             <para>
-               In addition, a flag designating if the password is encrypted is here.
-               Privileges are documented elsewhere in this guide.
+               The privilege set granted to successfully opered clients.
+               This must be defined before this operator{} block.
              </para>
            </listitem>
          </varlistentry>
+         <varlistentry>
+           <term>flags</term>
+           <listitem>
+              <para>A list of flags to apply to this operator{} block. They are listed below.</para>
+           </listitem>
+         </varlistentry>
+       </variablelist>
+       <variablelist>
+         <title>operator {} flags</title>
+         <varlistentry>
+           <term>encrypted</term>
+           <listitem>
+             <para>The password used has been encrypted. This is enabled by default, use ~encrypted to disable it.</para>
+           </listitem>
+         </varlistentry>
+         <varlistentry>
+           <term>need_ssl</term>
+           <listitem>
+             <para>Restricts use of this operator{} block to SSL/TLS connections only.</para>
+           </listitem>
+         </varlistentry>
        </variablelist>
       </sect2>
       <sect2>
@@ -549,8 +598,6 @@ connect "<replaceable>name</replaceable>" {
            <listitem>
              <para>The hostname or IP to connect to.</para>
              <note><para>
-               Charybdis uses solely DNS for all hostname/address lookups
-               (no <filename>/etc/hosts</filename> or anything else).
                Furthermore, if a hostname is used, it must have an A or AAAA
                record (no CNAME) and it must be the primary
                hostname for inbound connections to work.
@@ -1018,7 +1065,7 @@ shared {
          <varlistentry>
            <term>all</term>
            <listitem>
-             <para>All of the above; this does not include locops or rehash</para>
+             <para>All of the above; this does not include locops, rehash, dline, tdline or undline.</para>
            </listitem>
          </varlistentry>
          <varlistentry>
@@ -1036,6 +1083,24 @@ shared {
              <para>REHASH commands; all options can be used</para>
            </listitem>
          </varlistentry>
+         <varlistentry>
+           <term>dline (D)</term>
+           <listitem>
+             <para>Permanent and temporary D:lines</para>
+           </listitem>
+         </varlistentry>
+         <varlistentry>
+           <term>tdline (d)</term>
+           <listitem>
+             <para>Temporary D:lines</para>
+           </listitem>
+         </varlistentry>
+         <varlistentry>
+           <term>undline (E)</term>
+           <listitem>
+             <para>D:line removals</para>
+           </listitem>
+         </varlistentry>
          <varlistentry>
            <term>none</term>
            <listitem>
@@ -1076,6 +1141,28 @@ service {
        </variablelist>
       </sect2>
     </sect1>
+    <sect1>
+      <title>Hostname resolution (DNS)</title>
+      <para>
+       Charybdis uses solely DNS for all hostname/address lookups
+       (no <filename>/etc/hosts</filename> or anything else).
+       The DNS servers are taken from <filename>/etc/resolv.conf</filename>.
+       If this file does not exist or no valid IP addresses are listed in it,
+       the local host (127.0.0.1) is used. (Note that the latter part
+       did not work in older versions of Charybdis.)
+      </para>
+      <para>
+       IPv4 as well as IPv6 DNS servers are supported, but it is not
+       possible to use both IPv4 and IPv6 in
+       <filename>/etc/resolv.conf</filename>.
+      </para>
+      <para>
+       For both security and performance reasons, it is recommended
+       that a caching nameserver such as BIND be run on the same machine
+       as Charybdis and that <filename>/etc/resolv.conf</filename> only
+       list 127.0.0.1.
+      </para>
+    </sect1>
   </chapter>
 <!-- Keep this comment at the end of the file
 Local variables: