X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/d4214e9445d9f9d0f0ede3e09a9f81deee95d69c..6292d72bbffc2035d404a0b1d7659fe73b96b410:/doc/reference.conf diff --git a/doc/reference.conf b/doc/reference.conf index 731eadf8..592380af 100644 --- a/doc/reference.conf +++ b/doc/reference.conf @@ -44,6 +44,7 @@ * To use them, uncomment the lines below. * * Channel mode +-A (admin only) -- chm_adminonly + * Channel mode +-T (blocks notices) -- chm_nonotice * Channel mode +-O (oper only) -- chm_operonly * Channel mode +-S (ssl only) -- chm_sslonly * Emulates channel mode +-O (oper only) (+-iI $o) -- chm_operonly_compat @@ -80,6 +81,7 @@ * Stop services kills -- no_kill_services */ #loadmodule "extensions/chm_adminonly"; +#loadmodule "extensions/chm_nonotice"; #loadmodule "extensions/chm_operonly"; #loadmodule "extensions/chm_sslonly"; #loadmodule "extensions/chm_operonly_compat"; @@ -146,15 +148,17 @@ serverinfo { /* vhost6: the IP to bind to when we connect outward to ipv6 servers. * This should be an ipv6 IP only. */ - #vhost6 = "2001:db7:2::6"; + #vhost6 = "2001:db8:2::6"; - /* ssl_private_key: our ssl private key */ - ssl_private_key = "etc/ssl.key"; - - /* ssl_cert: certificate for our ssl server */ + /* ssl_cert: certificate (and optionally key) for our ssl server */ ssl_cert = "etc/ssl.pem"; - /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ + /* ssl_private_key: our ssl private key (if not contained in ssl_cert file) */ + #ssl_private_key = "etc/ssl.key"; + + /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 2048 */ + /* If you do not provide parameters, some TLS backends will fail on DHE- ciphers, + and some will succeed but use weak, common DH groups! */ ssl_dh_params = "etc/dh.pem"; /* ssl_cipher_list: A list of ciphers, dependent on your TLS backend */ @@ -320,8 +324,8 @@ listen { /* port: listen on all available IPs, ports 5000 and 6665 to 6669 */ port = 5000, 6665 .. 6669; - /* sslport: listen for ssl connections on all available IPs, port 9999 */ - sslport = 9999; + /* sslport: listen for ssl connections on all available IPs, port 6697 */ + sslport = 6697; /* host: set a specific IP/host the ports after the line will listen * on. This may be ipv4 or ipv6. @@ -333,6 +337,12 @@ listen { host = "2001:db8:2::6"; port = 7002; sslport = 9002; + + /* wsock: listeners defined with this option enabled will be websocket listeners, + * and will not accept normal clients. + */ + wsock = yes; + sslport = 9999; }; /* auth {}: allow users to connect to the ircd (OLD I:) */ @@ -538,9 +548,9 @@ connect "irc.uplink.com" { send_password = "password"; accept_password = "anotherpassword"; - /* fingerprint: if specified, the server's client certificate - * fingerprint will be checked against the specified fingerprint - * below. + /* fingerprint: if flags = ssl is specified, the server's + * certificate fingerprint will be checked against the fingerprint + * specified below. required if using flags = ssl. */ #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b"; @@ -566,6 +576,7 @@ connect "irc.uplink.com" { * compressed - compress traffic via ziplinks * topicburst - burst topics between servers * ssl - ssl/tls encrypted server connections + * no-export - marks the link as a no-export link (not exported to other links) */ flags = compressed, topicburst; }; @@ -908,10 +919,9 @@ blacklist { * WARNING: * These settings are considered experimental. Only the most common proxy types * are checked for (Charybdis is immune from POST and GET proxies). If you are - * not comfortable with experimental code, remove or comment out the *entire* - * block below to disable the proxy scanner. + * not comfortable with experimental code, do not use this feature. */ -opm { +#opm { /* IPv4 address to listen on. This must be a publicly facing IP address * to be effective. * If omitted, it defaults to serverinfo::vhost. @@ -921,7 +931,7 @@ opm { /* IPv4 port to listen on. * This should not be the same as any existing listeners. */ - #port_ipv4 = 32000; + #port_v4 = 32000; /* IPv6 address to listen on. This must be a publicly facing IP address * to be effective. @@ -932,42 +942,42 @@ opm { /* IPv6 port to listen on. * This should not be the same as any existing listeners. */ - #port_ipv6 = 32000; + #port_v6 = 32000; /* You can also set the listen_port directive which will set both the * IPv4 and IPv6 ports at once. */ - listen_port = 32000; + #listen_port = 32000; /* This sets the timeout in seconds before ending open proxy scans. * Values less than 1 or greater than 60 are ignored. * It is advisable to keep it as short as feasible, so clients do not * get held up by excessively long scan times. */ - timeout = 5; + #timeout = 5; /* These are the ports to scan for SOCKS4 proxies on. They may overlap * with other scan types. Sensible defaults are given below. */ - socks4_ports = 80, 443, 1080, 8000, 8080, 10800; + #socks4_ports = 80, 443, 1080, 8000, 8080, 10800; /* These are the ports to scan for SOCKS5 proxies on. They may overlap * with other scan types. Sensible defaults are given below. */ - socks5_ports = 80, 443, 1080, 8000, 8080, 10800; + #socks5_ports = 80, 443, 1080, 8000, 8080, 10800; /* These are the ports to scan for HTTP CONNECT proxies on (plaintext). * They may overlap with other scan types. Sensible defaults are given * below. */ - httpconnect_ports = 80, 8080, 8000; + #httpconnect_ports = 80, 8080, 8000; /* These are the ports to scan for HTTPS CONNECT proxies on (SSL). * They may overlap with other scan types. Sensible defaults are given * below. */ - httpsconnect_ports = 443, 4443; -}; + #httpsconnect_ports = 443, 4443; +#}; /* * Alias blocks allow you to define custom commands. (Old m_sshortcut.c) @@ -1163,17 +1173,16 @@ general { */ dline_with_reason = yes; - /* kline delay: delay the checking of klines until a specified time. - * Useful if large kline lists are applied often to prevent the - * server eating CPU. - */ - kline_delay = 0 seconds; - /* kline reason: show the user the reason why they are k/dlined * on exit. may give away who set k/dline when set via tcm. */ kline_with_reason = yes; + /* tkline duration: when showing users their k/dline reason (see + * kline_with_reason), don't add "Temporary K-line 123 min." + */ + hide_tkdline_duration = no; + /* kline reason: make the users quit message on channels this * reason instead of the oper's reason. */ @@ -1407,9 +1416,15 @@ general { * * The spki_* variants operate on the SubjectPublicKeyInfo of the certificate, which does * not change unless the private key is changed. This allows the fingerprint to stay - * constant even if the certificate is reissued. + * constant even if the certificate is reissued. These fingerprints will be prefixed with + * "SPKI:SHA2-256:" or "SPKI:SHA2-512:" depending on the hash type. These fingerprints + * are not supported on servers running charybdis 3.5.3 or earlier. + * + * To generate a fingerprint from a certificate file, please use the mkfingerprint utility + * program located in the bin/ subdirectory of your IRCd installation. Running it with no + * arguments will give you a brief usage message; it takes method and filename arguments. */ - certfp_method = sha1; + certfp_method = spki_sha256; /* hide_opers_in_whois: if set to YES, then oper status will be hidden in /WHOIS output. */ hide_opers_in_whois = no;