X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/4dbed1ed61d745e22017fe1b54cb6a7c81de89f6..6292d72bbffc2035d404a0b1d7659fe73b96b410:/doc/reference.conf diff --git a/doc/reference.conf b/doc/reference.conf index e13541ae..592380af 100644 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -44,6 +44,7 @@ * To use them, uncomment the lines below. * * Channel mode +-A (admin only) -- chm_adminonly + * Channel mode +-T (blocks notices) -- chm_nonotice * Channel mode +-O (oper only) -- chm_operonly * Channel mode +-S (ssl only) -- chm_sslonly * Emulates channel mode +-O (oper only) (+-iI $o) -- chm_operonly_compat @@ -80,6 +81,7 @@ * Stop services kills -- no_kill_services */ #loadmodule "extensions/chm_adminonly"; +#loadmodule "extensions/chm_nonotice"; #loadmodule "extensions/chm_operonly"; #loadmodule "extensions/chm_sslonly"; #loadmodule "extensions/chm_operonly_compat"; @@ -146,15 +148,17 @@ serverinfo { /* vhost6: the IP to bind to when we connect outward to ipv6 servers. * This should be an ipv6 IP only. */ - #vhost6 = "2001:db7:2::6"; + #vhost6 = "2001:db8:2::6"; - /* ssl_private_key: our ssl private key */ - ssl_private_key = "etc/ssl.key"; - - /* ssl_cert: certificate for our ssl server */ + /* ssl_cert: certificate (and optionally key) for our ssl server */ ssl_cert = "etc/ssl.pem"; - /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ + /* ssl_private_key: our ssl private key (if not contained in ssl_cert file) */ + #ssl_private_key = "etc/ssl.key"; + + /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 2048 */ + /* If you do not provide parameters, some TLS backends will fail on DHE- ciphers, + and some will succeed but use weak, common DH groups! */ ssl_dh_params = "etc/dh.pem"; /* ssl_cipher_list: A list of ciphers, dependent on your TLS backend */ @@ -296,7 +300,7 @@ class "server" { max_number = 1; /* sendq: servers need a higher sendq as they are sent more data */ - sendq=2 megabytes; + sendq = 2 megabytes; }; /* listen {}: contain information about the ports ircd listens on (OLD P:) */ @@ -320,8 +324,8 @@ listen { /* port: listen on all available IPs, ports 5000 and 6665 to 6669 */ port = 5000, 6665 .. 6669; - /* sslport: listen for ssl connections on all available IPs, port 9999 */ - sslport = 9999; + /* sslport: listen for ssl connections on all available IPs, port 6697 */ + sslport = 6697; /* host: set a specific IP/host the ports after the line will listen * on. This may be ipv4 or ipv6. @@ -333,6 +337,12 @@ listen { host = "2001:db8:2::6"; port = 7002; sslport = 9002; + + /* wsock: listeners defined with this option enabled will be websocket listeners, + * and will not accept normal clients. + */ + wsock = yes; + sslport = 9999; }; /* auth {}: allow users to connect to the ircd (OLD I:) */ @@ -538,9 +548,9 @@ connect "irc.uplink.com" { send_password = "password"; accept_password = "anotherpassword"; - /* fingerprint: if specified, the server's client certificate - * fingerprint will be checked against the specified fingerprint - * below. + /* fingerprint: if flags = ssl is specified, the server's + * certificate fingerprint will be checked against the fingerprint + * specified below. required if using flags = ssl. */ #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b"; @@ -566,22 +576,20 @@ connect "irc.uplink.com" { * compressed - compress traffic via ziplinks * topicburst - burst topics between servers * ssl - ssl/tls encrypted server connections + * no-export - marks the link as a no-export link (not exported to other links) */ flags = compressed, topicburst; }; connect "ipv6.lame.server" { - /* Hosts that are IPv6 addresses must be in :: shortened form - * if applicable. Addresses starting with a colon get an extra - * zero prepended, for example: 0::1 - */ + host = "192.0.2.1"; host = "2001:db8:3::8"; send_password = "password"; accept_password = "password"; port = 6666; - /* aftype: controls whether the connection uses "ipv4" or "ipv6". - * Default is ipv4. + /* aftype: controls whether the outgoing connection uses "ipv4" or "ipv6". + * Default is to try either at random. */ aftype = ipv6; class = "server"; @@ -909,13 +917,11 @@ blacklist { * notified upon connect if they are being scanned. * * WARNING: - * These settings are considered experimental, and as of this writing, the - * Charybdis scanner is not as comprehensive as the one available in HOPM. Only - * basic SOCKS4 and SOCKS5 scanning is performed on a few well-known ports. You - * may disable the open proxy scanning feature by deleting this block if you are - * uncomfortable with this. + * These settings are considered experimental. Only the most common proxy types + * are checked for (Charybdis is immune from POST and GET proxies). If you are + * not comfortable with experimental code, do not use this feature. */ -opm { +#opm { /* IPv4 address to listen on. This must be a publicly facing IP address * to be effective. * If omitted, it defaults to serverinfo::vhost. @@ -925,53 +931,53 @@ opm { /* IPv4 port to listen on. * This should not be the same as any existing listeners. */ - #port_ipv4 = 32000; + #port_v4 = 32000; /* IPv6 address to listen on. This must be a publicly facing IP address * to be effective. * If omitted, it defaults to serverinfo::vhost6. */ - #listen_ipv6 = "0::1"; + #listen_ipv6 = "::1"; /* IPv6 port to listen on. * This should not be the same as any existing listeners. */ - #port_ipv6 = 32000; + #port_v6 = 32000; /* You can also set the listen_port directive which will set both the * IPv4 and IPv6 ports at once. */ - listen_port = 32000; + #listen_port = 32000; /* This sets the timeout in seconds before ending open proxy scans. * Values less than 1 or greater than 60 are ignored. * It is advisable to keep it as short as feasible, so clients do not * get held up by excessively long scan times. */ - timeout = 5; + #timeout = 5; /* These are the ports to scan for SOCKS4 proxies on. They may overlap * with other scan types. Sensible defaults are given below. */ - socks4_ports = 80, 443, 1080, 8000, 8080, 10800; + #socks4_ports = 80, 443, 1080, 8000, 8080, 10800; /* These are the ports to scan for SOCKS5 proxies on. They may overlap * with other scan types. Sensible defaults are given below. */ - socks5_ports = 80, 443, 1080, 8000, 8080, 10800; + #socks5_ports = 80, 443, 1080, 8000, 8080, 10800; /* These are the ports to scan for HTTP CONNECT proxies on (plaintext). * They may overlap with other scan types. Sensible defaults are given * below. */ - httpconnect_ports = 80, 8080, 8000; + #httpconnect_ports = 80, 8080, 8000; /* These are the ports to scan for HTTPS CONNECT proxies on (SSL). * They may overlap with other scan types. Sensible defaults are given * below. */ - httpsconnect_ports = 443, 4443; -}; + #httpsconnect_ports = 443, 4443; +#}; /* * Alias blocks allow you to define custom commands. (Old m_sshortcut.c) @@ -1097,7 +1103,7 @@ general { /* dots in ident: the amount of '.' characters permitted in an ident * reply before the user is rejected. */ - dots_in_ident=2; + dots_in_ident = 2; /* min nonwildcard: the minimum non wildcard characters in k/d/g lines * placed via the server. klines hand placed are exempt from limits. @@ -1167,17 +1173,16 @@ general { */ dline_with_reason = yes; - /* kline delay: delay the checking of klines until a specified time. - * Useful if large kline lists are applied often to prevent the - * server eating CPU. - */ - kline_delay = 0 seconds; - /* kline reason: show the user the reason why they are k/dlined * on exit. may give away who set k/dline when set via tcm. */ kline_with_reason = yes; + /* tkline duration: when showing users their k/dline reason (see + * kline_with_reason), don't add "Temporary K-line 123 min." + */ + hide_tkdline_duration = no; + /* kline reason: make the users quit message on channels this * reason instead of the oper's reason. */ @@ -1213,36 +1218,36 @@ general { stats_e_disabled = no; /* stats c oper only: make stats c (connect {}) oper only */ - stats_c_oper_only=no; + stats_c_oper_only = no; /* stats h oper only: make stats h (hub_mask/leaf_mask) oper only */ - stats_h_oper_only=no; + stats_h_oper_only = no; /* stats y oper only: make stats y (class {}) oper only */ - stats_y_oper_only=no; + stats_y_oper_only = no; /* stats o oper only: make stats o (opers) oper only */ - stats_o_oper_only=yes; + stats_o_oper_only = yes; /* stats P oper only: make stats P (ports) oper only * NOTE: users doing stats P will never be given the ips that the * server listens on, simply the ports. */ - stats_P_oper_only=no; + stats_P_oper_only = no; /* stats i oper only: make stats i (auth {}) oper only. set to: * yes: show users no auth blocks, made oper only. * masked: show users first matching auth block * no: show users all auth blocks. */ - stats_i_oper_only=masked; + stats_i_oper_only = masked; /* stats k/K oper only: make stats k/K (klines) oper only. set to: * yes: show users no auth blocks, made oper only * masked: show users first matching auth block * no: show users all auth blocks. */ - stats_k_oper_only=masked; + stats_k_oper_only = masked; /* map oper only: make /map oper only */ map_oper_only = no; @@ -1406,10 +1411,20 @@ general { away_interval = 30; /* certfp_method: the method that should be used for computing certificate fingerprints. - * Acceptable options are sha1, sha256 and sha512. Networks running versions of charybdis - * prior to charybdis 3.5 MUST use sha1 for certfp_method. + * Acceptable options are sha1, sha256, spki_sha256, sha512 and spki_sha512. Networks + * running versions of charybdis prior to charybdis 3.5 MUST use sha1 for certfp_method. + * + * The spki_* variants operate on the SubjectPublicKeyInfo of the certificate, which does + * not change unless the private key is changed. This allows the fingerprint to stay + * constant even if the certificate is reissued. These fingerprints will be prefixed with + * "SPKI:SHA2-256:" or "SPKI:SHA2-512:" depending on the hash type. These fingerprints + * are not supported on servers running charybdis 3.5.3 or earlier. + * + * To generate a fingerprint from a certificate file, please use the mkfingerprint utility + * program located in the bin/ subdirectory of your IRCd installation. Running it with no + * arguments will give you a brief usage message; it takes method and filename arguments. */ - certfp_method = sha1; + certfp_method = spki_sha256; /* hide_opers_in_whois: if set to YES, then oper status will be hidden in /WHOIS output. */ hide_opers_in_whois = no;