update config env example

fix whitespace

.gitignore

@@ -0,0 +1 @@
+config.env

Dockerfile

@@ -1,10 +1,8 @@
-ARG BUILD_SERVER_NAME="irc.lame-network.local"
-
 ARG UBUNTU_VERSION="noble"
 
 FROM ubuntu:${UBUNTU_VERSION}
 
-ENV ADMIN_EMAIL="no-reply@lame-netwoork.local"
+ENV ADMIN_EMAIL="no-reply@lame-network.local"
 
 ENV SID="01A"
 
@@ -14,29 +12,31 @@ ENV NETWORK_NAME="LameNet"
 
 ENV STS_HOST="irc.lame-network.local"
 
+ENV SASL_REQUIRE_SSL="yes"
+
 ENV SASL_TARGET="service.lame-network.local"
 
 ENV ADMIN_PASSWORD="changeme"
 
-ENV COMMAND_RATE="128000"
+ENV COMMAND_RATE="1000"
 
-ENV FAKE_LAG="on"
+ENV FAKE_LAG="off"
 
-ENV HARD_SENDQ="1M"
+ENV HARD_SENDQ="1048576"
 
 ENV MAX_CHANS="256"
 
 ENV PING_FREQ="64"
 
-ENV RECVQ="8K"
+ENV RECVQ="4096"
 
-ENV SOFT_SENDQ="8192"
+ENV SOFT_SENDQ="4096"
 
-ENV COMMAND_RATE_THRESHOLD="128"
+ENV COMMAND_RATE_THRESHOLD="10"
 
-ENV COMMAND_RATE_THRESHOLD_TIMEOUT="16"
+ENV PARTIAL_CONNECT_TIMEOUT="16s"
 
-ENV USE_CONN_FLOOD="yes"
+ENV USE_CONN_FLOOD="no"
 
 ENV USE_DNSBL="yes"
 
@@ -48,19 +48,19 @@ ENV LOCAL_MAX="16"
 
 ENV MAX_CONN_WARN="yes"
 
-ENV DEFAULT_USER_MODES="+xWz"
+ENV DEFAULT_USER_MODES="+x"
 
 ENV PORT="6667"
 
 ENV RESOLVE_HOST_NAMES="yes"
 
-ENV USE_CONNECT_BAN="yes"
+ENV USE_CONNECT_BAN="no"
 
-ENV SSL_USER_MODES="+xWz"
+ENV SSL_USER_MODES="+xz"
 
 ENV SSL_PORT="6697"
 
-ENV AUTHENTICATED_USER_MODES="+xwWz"
+ENV AUTHENTICATED_USER_MODES="+xz"
 
 ENV SERVER_SSL_PORT="7000"
 
@@ -168,8 +168,6 @@ ENV NET_ADMIN_VHOST="oper/admin.lame-network.local"
 
 ENV GLOBAL_OP_VHOST="oper/op.lame-network.local"
 
-ENV HOPM_VHOST="oper/hopm.lame-network.local"
-
 ENV HELPER_VHOST="oper/helper.lame-network.local"
 
 ENV SERVICES_ULINE="services.lame-network.local"
@@ -184,13 +182,7 @@ ENV LINK_TIMEOUT=3600
 
 ENV CLOAK_KEY="changemechangemechangemechangeme"
 
-ENV CLOAK_IGNORE_CASE="no"
+ENV CLOAK_SUFFIX="hidden"
-
-ENV CLOAK_MODE="full"
-
-ENV CLOAK_PREFIX="cloak/"
-
-ENV CLOAK_SUFFIX=".hidden"
 
 ENV BLOCK_AMSG_ACTION="killopers"
 
@@ -208,7 +200,7 @@ ENV BOT_MODE_FORCE_NOTICE="no"
 
 ENV CHAN_FILTER_HIDE_MASK="yes"
 
-ENV CHAN_FILTER_MAX_LEN="512"
+ENV CHAN_FILTER_MAX_LEN="250"
 
 ENV CHAN_FILTER_NOTIFY_USER="yes"
 
@@ -238,8 +230,6 @@ ENV CHANNELS_OPERS="4294967295"
 
 ENV CHANNELS_USERS="4294967295"
 
-ENV CODE_PAGE="ascii"
-
 ENV CONNECT_BAN_BOOT_WAIT="128"
 
 ENV CONNECT_BAN_DURATION="64"
@@ -300,13 +290,13 @@ ENV IRCV3_EXTENDED_JOIN="yes"
 
 ENV JOIN_FLOOD_BOOT_WAIT="32s"
 
-ENV JOIN_FLOOD_DURATION="2m"
+ENV JOIN_FLOOD_DURATION="32s"
 
 ENV JOIN_FLOOD_SPLIT_WAIT="32s"
 
 ENV KNOCK_NOTIFY="both"
 
-ENV LIST_MAX_SIZE="100"
+ENV LIST_MAX_SIZE="256"
 
 ENV MESSAGE_FLOOD_NOTICE="1.0"
 
@@ -422,6 +412,24 @@ ENV AUDITORIUM_OPER_CAN_SEE="yes"
 
 ENV AUDITORIUM_OP_VISIBLE="no"
 
+ENV IPV4_CLONE="32"
+
+ENV IPV6_CLONE="64"
+
+ENV ROTATE_LOG_PERIOD="86400"
+
+ENV REGEX_TYPE="ecmascript"
+
+ENV ALLOW_CORE_UNLOAD="no"
+
+ENV ANNOUNCE_INVITES="dynamic"
+
+ENV XLINEDB_SAVE_PERIOD="128s"
+
+ENV PERMCHAN_LIST_MODES="yes"
+
+ENV PERMCHANDB_SAVE_PERIOD="128s"
+
 RUN apt -y update
 
 RUN apt -y install coreutils perl git automake autoconf build-essential libpcre2-dev rapidjson-dev libcurl4-gnutls-dev libargon2-dev libmaxminddb-dev libldap2-dev rapidjson-dev libmysqlclient-dev libmysqlclient-dev default-libmysqlclient-dev libpq-dev libre2-dev gnutls-dev libsqlite3-dev libmbedtls-dev libqrencode-dev libpcre3-dev libtre-dev pkg-config libwww-perl
@@ -444,7 +452,19 @@ RUN ./modulemanager list | awk '{print $1}' | xargs -i ./modulemanager install {
 
 RUN make -j$(nproc) install
 
-RUN mkdir -p /etc/inspircd /var/lib/inspircd /etc/ssl/inspircd /var/log/inspircd
+RUN mkdir -p /etc/inspircd/custom /var/lib/inspircd /etc/ssl/inspircd /var/log/inspircd /etc/inspircd/codepages
+
+WORKDIR docs/conf/codepages
+
+RUN cp ascii.example.conf /etc/inspircd/codepages/ascii.conf
+
+RUN cat iso-8859-1.example.conf | grep -v "include" > /etc/inspircd/codepages/iso-8859-1.conf
+
+RUN cat iso-8859-2.example.conf | grep -v "include" > /etc/inspircd/codepages/iso-8859-2.conf
+
+RUN cat rfc1459.example.conf | grep -v "include" > /etc/inspircd/codepages/rfc1459.conf
+
+RUN cat strict-rfc1459.example.conf | grep -v "include" > /etc/inspircd/codepages/strict-rfc1459.conf
 
 ADD inspircd.conf /etc/inspircd
 
@@ -452,20 +472,17 @@ ADD modules.conf /etc/inspircd
 
 ADD help.conf /etc/inspircd
 
-ADD custom/ /etc/inspircd/custom
+ADD include.conf.example /etc/inspircd/custom/include.conf
+
+RUN touch /etc/inspircd/motd.txt
+
+RUN touch /etc/inspircd/oper.motd.txt
 
 ADD GeoLite2-Country.mmdb /etc/inspircd
 
-RUN openssl genrsa -out /etc/ssl/inspircd/server.key
+RUN chown -R inspircd:inspircd /etc/inspircd /var/lib/inspircd /var/log/inspircd
 
-RUN openssl req -new -key /etc/ssl/inspircd/server.key -out /etc/ssl/inspircd/server.csr \
+VOLUME /etc/inspircd/custom
-    -subj "/C=US/ST=Washington/L=Seattle/O=LameNetwork/OU=IT Department/CN=$BUILD_SERVER_NAME"
-
-RUN openssl x509 -req -days 365 -in /etc/ssl/inspircd/server.csr -signkey /etc/ssl/inspircd/server.key -out /etc/ssl/inspircd/server.crt
-
-RUN chown -R inspircd:inspircd /etc/inspircd /etc/ssl/inspircd /var/lib/inspircd /var/log/inspircd
-
-VOLUME /etc/ssl/inspircd
 
 VOLUME /var/lib/inspircd
 
@@ -475,4 +492,4 @@ USER inspircd
 
 WORKDIR /
 
-CMD /usr/local/bin/inspircd -c /etc/inspircd/inspircd.conf -F
+ENTRYPOINT ["/usr/local/bin/inspircd", "-c", "/etc/inspircd/inspircd.conf", "-F"]

README.md

@@ -1,72 +1,24 @@
 # Instructions 
 
 ## docker-compose 
-- if you are not starting from scratch. delete stale containers and: `docker rmi inspi4` and `docker volume rm inspi4_ssl` 
+1. copy `config.env.exmaple` to `config.env` and edit 
-- copy `config.env.exmaple` to `config.env` and edit 
+2. copy `include.conf.example` to `custom/include.conf`
-- optional: if you intend to link, copy `include.default.conf` to `include.conf` and edit (see linking section below.)
+3. follow steps from [#easyrsa] section
-- start: `docker-compose -f docker-compose.standalone.yml up -d` also use the linked variant if you intend to link.
+4. `docker-compose build`
+5. `docker-compose up -d`
 
-- ~~`docker build -t inspi4 -t inspi4:latest .`~~
+# easyrsa
-- ~~`docker run -it --rm -e 'DEFAULT_BLOCK_HOST_MASK="nothing"' -net host inspi4`~~
+On the hub:
+- cd to `easyrsa3` directory
+- `./easyrsa init-pki` 
+- `./easyrsa build-ca`
+- `./easyrsa build-server-full hub.stuff.ts.net`
+- `./easyrsa gen-crl`
+- `./easyrsa gen-dh`
 
-# Optional 
+The `.gitignore` takes care of keeping secrets out of the git repo:
-- ~~create a custom `links.conf`~~
-- ~~`docker run -it --rm -e 'DEFAULT_BLOCK_HOST_MASK="nothing"' -net host -v $(pwd)/links.conf:/etc/inspircd/links.conf:ro inspi4`~~
 
-# Linking 
+- copy `ca.crt`, `crl.pem`, and `dh.pem` to `custom/`
-- Run `docker exec -it ircd_ircd_linked_1 openssl x509 -sha256 -fingerprint -in /etc/ssl/inspircd/server.crt  | tr -d ":" | tr '[:upper:]' '[:lower:]'` 
+- `chown -R 999 custom/`
-to get the SSL fingerprints, the `fingerprint` refers to the remote SSL certificate fingerprint for each linking section.
+- copy hub cert and key to `custom/server.crt` and `custom/server.key`
-
+- manually copy certs and keys as well as `dh.pem` to each leaf. 
-- On `hub.netcrave.network` add something like this to the `include.conf`:
-
-```
-<autoconnect period="8s"
-             server="leaf.netcrave.network">
-
-<link allowmask="*"
-      bind="1.2.3.4"
-      hidden="no"
-      sslprofile="defaultssl"
-      fingerprint="c543d8a4a6c825d917d20520e4962e4bcdc3c3c5d856815f7fd626b708842baf"
-      ipaddr="4.2.3.1"
-      name="leaf.netcrave.network"
-      port="&env.SERVER_SSL_PORT;"
-      recvpass="&env.LINK_RECV_PASSWORD;"
-      sendpass="&env.LINK_SEND_PASSWORD;"
-      statshidden="no"
-      timeout="&env.LINK_TIMEOUT;">
-```
-- On `leaf.netcrave.network` add something like this to the `include.conf`:
-
-```
-<autoconnect period="8s"
-             server="hub.netcrave.network">
-
-<link allowmask="*"
-      bind="4.2.3.1"
-      hidden="no"
-      sslprofile="defaultssl"
-      fingerprint="09afef0d8561b8d13e3e7a480ed006caed11d3f5b36c5f4569c60060baa936cd"
-      ipaddr="1.2.3.4"
-      name="hub.netcrave.network"
-      port="&env.SERVER_SSL_PORT;"
-      recvpass="&env.LINK_RECV_PASSWORD;"
-      sendpass="&env.LINK_SEND_PASSWORD;"
-      statshidden="no"
-      timeout="&env.LINK_TIMEOUT;">
-```
-
-# Linking with services
-- Doesn't work yet: https://github.com/atheme/atheme/issues/904
-```
-<link allowmask="*"
-      bind="127.0.0.1"
-      hidden="no"
-      ipaddr="127.0.0.1"
-      name="services.netcrave.network"
-      port="7001"
-      recvpass="&env.LINK_RECV_PASSWORD;"
-      sendpass="&env.LINK_SEND_PASSWORD;"
-      statshidden="no"
-      timeout="&env.LINK_TIMEOUT;">
-```

config.env.example

@@ -1,29 +1,37 @@
-ADMIN_EMAIL="no-reply@lame-network.local"
+ADMIN_EMAIL="no-reply@supernets.org"
-SID="01A"
+SID="01B"
-SERVER_NAME="irc.lame-network.local"
+SERVER_NAME="lux.supernets.org"
-NETWORK_NAME="NetcraveIRC"
+NETWORK_NAME="SuperNETs"
-STS_HOST="irc.lame-network.local"
+STS_HOST="irc.supernets.org"
-SASL_TARGET="services.lame-network.local"
+STS_DURATION="32d"
+SASL_TARGET="services.supernets.org"
 ADMIN_PASSWORD="changeme"
 PORT="6667"
 SSL_PORT="6697"
 SERVER_SSL_PORT="7000"
 HTTP_ACL_PASSWORD="changeme"
-HTTP_ACL_USERNAME="netcrave"
+HTTP_ACL_USERNAME="supernets"
-ROLE_PLAY_VHOST="roleplay/lame-network.local"
+ROLE_PLAY_VHOST="roleplay/SuperNETs"
-CUSTOM_VERSION="NetcraveIRC"
+CUSTOM_VERSION="c l a n d e s t i n  e"
-NET_ADMIN_VHOST="admin/lame-network.local"
+NET_ADMIN_VHOST="admin/SuperNETs"
-GLOBAL_OP_VHOST="oper/lame-network.local"
+GLOBAL_OP_VHOST="oper/SuperNETs"
-HOPM_VHOST="hopm/lame-network.local"
+HELPER_VHOST="helper/SuperNETs"
-HELPER_VHOST="helper/lame-network.local"
+SERVICES_ULINE="services.supernets.org"
-SERVICES_ULINE="services.lame-network.local"
+WS_ORIGIN_ALLOW="lux.supernets.org"
-WS_ORIGIN_ALLOW="irc.lame-network.local"
 LINK_RECV_PASSWORD="changeme"
 LINK_SEND_PASSWORD="changeme"
-LINK_TIMEOUT="32"
 CLOAK_KEY="changeme"
-CLOAK_PREFIX="cloak/"
+CLOAK_SUFFIX="hidden"
-CLOAK_SUFFIX=".hidden"
+DEFAULT_USER_MODES="x"
-DEFAULT_USER_MODES="xW"
+SSL_USER_MODES="x"
-SSL_USER_MODES="xW"
+LINK_TIMEOUT="512s"
-USE_DNSBL="no"
+COMMAND_RATE="1000"
+FAKE_LAG="off"
+HARD_SENDQ="1M"
+RECVQ="512K"
+COMMAND_RATE_THRESHOLD="4096"
+PING_FREQ="256"
+DISABLE_USERMODES="dDz"
+DISABLE_CHMODES="z"
+DISABLE_COMMANDS="help info restart reloadmodule loadmodule gloadmodule unloadmodule gunloadmodule greloadmodule monitor watch dccallow map mkpasswd filter"
+OPER_CHANNEL_SNOMASK="aAcCkKoOqQtxXdDfFgGjJlLnNrRvVwW"

custom/.gitignore

@@ -0,0 +1,10 @@
+motd.txt
+oper.motd.txt
+include.conf
+*.crt
+*.key
+*.pem
+!ca.crt
+!crl.pem
+links.conf
+oper.conf

custom/ca.crt

@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIG+TCCBOGgAwIBAgIUTnY+1MZsN286sT+G2i8UWe3VjZwwDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH
+DA1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKDAlTdXBlck5FVHMxDDAKBgNVBAsMA0lS
+QzEdMBsGA1UEAwwUY2EudGFpbDkxMjJjOC50cy5uZXQxJTAjBgkqhkiG9w0BCQEW
+Fm5vLXJlcGx5QHN1cGVybmV0cy5vcmcwHhcNMjQxMTA2MTkzMDM3WhcNMzQxMTA0
+MTkzMDM3WjCBojELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAU
+BgNVBAcMDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoMCVN1cGVyTkVUczEMMAoGA1UE
+CwwDSVJDMR0wGwYDVQQDDBRjYS50YWlsOTEyMmM4LnRzLm5ldDElMCMGCSqGSIb3
+DQEJARYWbm8tcmVwbHlAc3VwZXJuZXRzLm9yZzCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAKSUdSIh1QLRB+rP0CrLd9T3zMSnA6o0ToIiSwJFjDqZ6F3v
+ZtYnZMD0OiNCJe89KNngaLbTY9CY5Yds2b9g3PemdAM1Kle9hMom+W6Q17T4oA2q
+0hrJkvf4sFQo1P0P6KEQSWRPqSwQ7h10DQYNEvZ7Q9LCAsgHoCmVXZIdAm6fRZmM
+ihTkXm0K24aTS8k/Tjgq+NsMulw0Z5SA19INvq+jk4AnYcqwuFPbPHdcKdfXryLh
+M8dXbUQbv0z8tLGptLqr56ESnf3QuP9ad86hx22WxesJxnR7JwHBjWdlwO1hAdOa
+QZjlcJxejIyYwHAU1FSpYdbH++HuQ6kd+DvREEF6FOVMlIyYqwHzo4fm9mzrne7s
+NLTQWp2wnzv3RB2/Q2sMwd3ccG7SWfo7iCOXIYaEwGbjduk2/4y388uBAfbofT+T
+8hAWgPVVEJiCpQ2cMzscQxA1mAk3WDB1fz9lHwMrlgBRa/Tftj3jVogdVPl5fDsD
+/2sCQgVQ68ABT6hlzMp56iayhZu1jjnBc/fTKK40NHCh7WNvZgJ9pR4Lpqzmt6JA
+Z4iY5WtHehg+xwhFoAfjjZdCiWvLNmfzet+PmW+D9c8V17faMMNfLsHTxHjzABoc
+2jFSdGNOyoI1DPKDEw6f/ZlNY67YOesiozbvH+XBurFhzh04hkyPkKWSZnqhAgMB
+AAGjggEjMIIBHzAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRI9BMsv2VBGfUEfJjN
+s1Fb2B68zDCB4gYDVR0jBIHaMIHXgBRI9BMsv2VBGfUEfJjNs1Fb2B68zKGBqKSB
+pTCBojELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
+DVNhbiBGcmFuY2lzY28xEjAQBgNVBAoMCVN1cGVyTkVUczEMMAoGA1UECwwDSVJD
+MR0wGwYDVQQDDBRjYS50YWlsOTEyMmM4LnRzLm5ldDElMCMGCSqGSIb3DQEJARYW
+bm8tcmVwbHlAc3VwZXJuZXRzLm9yZ4IUTnY+1MZsN286sT+G2i8UWe3VjZwwCwYD
+VR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAUfhnquPlKvCB/l47JZaC0V+wR
+aAJlbCjqwCsfOJqE381i1yKBc7Dbk0rYmS68fjDDyeGs6Av/9wj6RZ4+WoY47WYL
+fYCGF/HAFqyKllAfzKF+nvvBP8mKVOZX/QTlZKBD7biTjHTJSUou6y9LkRAwm7yw
+cRHkJkPwPCHihLcn0MLdlf8vRrTCZqZ1wEiRd0jIPkrBdpYoc3ENg+3zQGkPnCsD
+L1LwbiL7d1WASZ5cAxKKMl7rqA8oHCH8Ffou4DyK+igeEhcOxTu1A2jSpIAHjLZv
+aoWy/aEl4QO1QmY4CTftb2qgX5rr7EDLRK4paqFMsPfv8nCK3w8KmwZ/s1rlYt10
+oVoO3SJF+PRl78bMiuv55k+4UHh1S17fHuYKz31eGVkj9AfIec4FPewq4hHnLYO6
+F5tX96OlTubweeNioZauKv4pynwleIhjnzW0af50beaGulJmY83gCenyQcxxdTxu
+B7bmdj11/knCdFy0CKjZmvFNc99ujkH8Bac/qViHwjctWJ87mNLxHvlHQSMe9e7f
+Z2FmtlL0tlFl4KSX3RLXBt5MzRq2zbGY6eAjm2Ld3F+/bPYoyi4t1dUZh9BglTUb
+fW0A6bn325JCOPAMvyyBs4M4yeaUm5wep+KB1VyLhbm39OFotNz5oXZ/2WhQQK1E
+WOpWX6M4m8GQTXG1IA==
+-----END CERTIFICATE-----

custom/crl.pem

@@ -0,0 +1,23 @@
+-----BEGIN X509 CRL-----
+MIID2DCCAcACAQEwDQYJKoZIhvcNAQELBQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYD
+VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRIwEAYDVQQK
+DAlTdXBlck5FVHMxDDAKBgNVBAsMA0lSQzEdMBsGA1UEAwwUY2EudGFpbDkxMjJj
+OC50cy5uZXQxJTAjBgkqhkiG9w0BCQEWFm5vLXJlcGx5QHN1cGVybmV0cy5vcmcX
+DTI0MTEwNjE5MzUwN1oXDTI1MDUwNTE5MzUwN1qggegwgeUwgeIGA1UdIwSB2jCB
+14AUSPQTLL9lQRn1BHyYzbNRW9gevMyhgaikgaUwgaIxCzAJBgNVBAYTAlVTMRMw
+EQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRIwEAYD
+VQQKDAlTdXBlck5FVHMxDDAKBgNVBAsMA0lSQzEdMBsGA1UEAwwUY2EudGFpbDkx
+MjJjOC50cy5uZXQxJTAjBgkqhkiG9w0BCQEWFm5vLXJlcGx5QHN1cGVybmV0cy5v
+cmeCFE52PtTGbDdvOrE/htovFFnt1Y2cMA0GCSqGSIb3DQEBCwUAA4ICAQBp7z2s
+2N2/cHnJaWEaQibnp89J8Co8w9+9c+VgMDtneoA5pqejV8a5gWF1U9O3txjceR1T
+HcymU5KyWxx3FTehOS0vxMib7CWWhVrciBe5R628gaZzPAnlPLVXBLwzUwloJ4Rn
+xR4+8SkKXE0aOW52Gbv3SyJId9BRkEFlxDuQeWOPgh3fIe9VqlA4T6DV5MslxH6Q
+ul/Cg8DvBI6CsXnIvxz7MU/mPjuL/mvAi1SzjL1OrQAVNSVGaIE8EasQ9dC+Y1YF
+/JsQJfDROQA8Cej2ku+R8oDp+gRuQCvEX/gu0vt72rdr8oTLjnBrHz6LjFdq9Kdw
+0M0Dnj6x2KTDdhGZMLm7HEbsFcZVlUQMUcIlcqXDpi+Irdlz8QjKp0Zca8TsUN6s
+8LGpzT5CxDlXmwli+cINZ/cMDhGNjIXSvZZOk0kfXN5pUbGFqGjPOqlyyL3NK9iG
+/AQqJxl71PFUHWYKkOo3P/+WffpQfL200xkAUgf4lcYvC9Y7/0zmkL9MWaXqSbdL
+dGdx8yCUR/TbgHSPYgoyIT65eYSb0X4vlWZnYprU1yz9SNyypO6ceg/pYKVG5ew+
+IKzXi9pkRn0jhGHKN0V3uRY1IqJStAC09m7MMkuYrhBjWkFJXivcSuDndWNoYW0V
+tRaYZVLFhkQ+CTDtovPMFoLnQyZp7dV3jiELBw==
+-----END X509 CRL-----

custom/oper.motd.txt

@@ -1 +1,57 @@
--
+   0,0     0╗  0,0  0╗  0,0  0╗ 0,0      0╗  0,0       0╗ 0,0      0╗
+  0,0  0╔══0,0  0╗ 0,0  0║  0,0  0║ 0,0  0╔══0,0  0╗ 0,0  0╔════╝ 0,0  0╔══0,0  0╗
+  0,0  0║  ╚═╝ 0,0  0║  0,0  0║ 0,0  0║  0,0  0║ 0,0  0║      0,0  0║  0,0  0║
+  0╚0,0     0╗  0,0  0║  0,0  0║ 0,0      0╔╝ 0,0       0╗ 0,0      0╔╝
+   0╚═══0,0  0╗ 0,0  0║  0,0  0║ 0,0  0╔═══╝  0,0  0╔════╝ 0,0  0╔══0,0  0╗
+  0,0  0╗  0,0  0║ 0,0  0║  0,0  0║ 0,0  0║      0,0  0║      0,0  0║  0,0  0║
+  0,0  0║  0,0  0║ 0,0  0║  0,0  0║ 0,0  0║      0,0  0║      0,0  0║  0,0  0║
+  0,0  0║  0,0  0║ 0,0  0║  0,0  0║ 0,0  0║      0,0  0║      0,0  0║  0,0  0║
+  0,0  0║  0,0  0║ 0,0  0║  0,0  0║ 0,0  0║      0,0  0║      0,0  0║  0,0  0║
+  0╚0,0     0╔╝ ╚0,0     0╔╝ 0,0  0║      0,0       0╗ 0,0  0║  0,0  0║
+0   ╚════╝   ╚════╝  ╚═╝      ╚══════╝ ╚═╝  ╚═╝
+
+      0,12                                          
+    0,12    0,4                              0,12          
+  0,12    0,4      0,8  0,4    0,8        0,4    0,8  0,4        0,12        
+0,12    0,4      0,8  0,4    0,8            0,4      0,8  0,4      0,12      
+0,12    0,4    0,8    0,4    0,8                      0,4    0,12      
+  0,12    0,4    0,8  0,4                      0,8    0,4  0,12        
+    0,12    0,4                              0,12          
+      0,12    0,4    0,8              0,4        0,12            
+        0,12    0,4      0,8  0,4  0,8      0,4      0,12              
+          0,12    0,4                  0,12                
+            0,12    0,4    0,8      0,4    0,12                  
+              0,12    0,4    0,8  0,4    0,12                    
+                0,12    0,4      0,12                      
+                  0,12    0,4  0,12                        
+                    0,12                            
+                      0,12  
+
+     0,0     0╗  0,0  0╗ 0,0       0╗ 0,0      0╗  0,0     0╗
+     0,0  0╔═0,0  0╗ 0,0  0║ 0,0  0╔════╝   0,0  0╔═╝ 0,0  0╔══0,0  0╗
+     0,0  0║ 0,0  0║ 0,0  0║ 0,0  0║        0,0  0║   0,0  0║  ╚═╝
+     0,0  0║ 0,0  0║ 0,0  0║ 0,0       0╗   0,0  0║   ╚0,0     0╗
+     0,0  0║ 0,0  0║ 0,0  0║ 0,0  0╔════╝   0,0  0║    ╚═══0,0  0╗
+     0,0  0║ 0,0  0║ 0,0  0║ 0,0  0║        0,0  0║   0,0     0,0  0║
+     0,0  0║ ╚0,0     0║ 0,0       0╗   0,0  0║   ╚0,0     0╔╝
+     0╚═╝  ╚════╝ ╚══════╝   ╚═╝    ╚════╝
+
+4─────────┤ 0THE WILD WILD WEST OF IRC 4├─────────
+
+14• 7  Round-robin   irc.supernets.org 14(IPv4/IPv6)
+14• 7        Onion   14removed until further notice
+
+14• 7        Ports   6660-6669 & 7000
+14• 7SSL/TLS Ports   6697      & 9000
+
+14• 7         Mail   12admin@supernets.org
+14• 7          Git   12https://git.supernets.org
+14• 7      Twitter   12https://twitter.com/super_nets
+14• 7      Website   12https://supernets.org/
+
+4─────────┤ 0MOST DANGEROUS IRC NETWORK 4├────────
+
+14• 7This is a hostile chat environment
+14• 7Do not disrupt the orderly operation of the network
+14• 7No distribution of child pornography
+14• 7See /RULES for a list of network rules

docker-compose.yml

@@ -1,22 +1,17 @@
 services:
-  leaf:
+  ircd:
+    restart: on-failure:3
     build:
       context: .
-      args:
-        BUILD_SERVER_NAME: ${SERVER_NAME}
     image: inspi4
     network_mode: "host"
     env_file: "config.env"
-    command: /usr/local/bin/inspircd -c /etc/inspircd/inspircd.conf -F
     volumes:
       - ./custom:/etc/inspircd/custom:ro
-      - ssl:/etc/ssl/inspircd
       - data:/var/lib/inspircd
       - log:/var/log/inspircd
 volumes:
   data:
     name: inspi4_data
-  ssl:
-    name: inspi4_ssl
   log:
     name: inspi4_log

easyrsa3/.gitignore

@@ -0,0 +1 @@
+pki/

easyrsa3/openssl-easyrsa.cnf

@@ -0,0 +1,149 @@
+# For use with Easy-RSA 3.0+ and OpenSSL or LibreSSL
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= $ENV::EASYRSA_PKI	# Where everything is kept
+certs		= $dir			# Where the issued certs are kept
+crl_dir		= $dir			# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+new_certs_dir	= $dir/certs_by_serial	# default place for new certs.
+
+certificate	= $dir/ca.crt		# The CA certificate
+serial		= $dir/serial		# The current serial number
+crl		= $dir/crl.pem		# The current CRL
+private_key	= $dir/private/ca.key	# The private key
+RANDFILE	= $dir/.rand		# private random number file
+
+x509_extensions	= basic_exts		# The extensions to add to the cert
+
+# A placeholder to handle the --copy-ext feature:
+#%COPY_EXTS%	# Do NOT remove or change this line as --copy-ext support requires it
+
+# This allows a V2 CRL. Ancient browsers don't like it, but anything Easy-RSA
+# is designed for will. In return, we get the Issuer attached to CRLs.
+crl_extensions	= crl_ext
+
+default_days	= $ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
+default_crl_days	= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
+default_md	= $ENV::EASYRSA_DIGEST		# use public key default MD
+
+# Note: preserve=no|yes, does nothing for EasyRSA.
+# Use sign-req command option 'preserve' instead.
+preserve	= no			# keep passed DN ordering
+
+# This allows to renew certificates which have not been revoked
+unique_subject	= no
+
+# A few different ways of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_anything
+
+# For the 'anything' policy, which defines allowed DN fields
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+serialNumber	= optional
+
+####################################################################
+# Easy-RSA request handling
+# We key off $DN_MODE to determine how to format the DN
+[ req ]
+default_bits		= $ENV::EASYRSA_KEY_SIZE
+default_keyfile	= privkey.pem
+default_md		= $ENV::EASYRSA_DIGEST
+distinguished_name	= $ENV::EASYRSA_DN
+x509_extensions		= easyrsa_ca	# The extensions to add to the self signed cert
+
+# A placeholder to handle the $EXTRA_EXTS feature:
+#%EXTRA_EXTS%	# Do NOT remove or change this line as $EXTRA_EXTS support requires it
+
+####################################################################
+# Easy-RSA DN (Subject) handling
+
+# Easy-RSA DN for cn_only support:
+[ cn_only ]
+commonName		= Common Name (eg: your user, host, or server name)
+commonName_max		= 64
+commonName_default	= $ENV::EASYRSA_REQ_CN
+
+# Easy-RSA DN for org support:
+[ org ]
+countryName			= Country Name (2 letter code)
+countryName_default		= $ENV::EASYRSA_REQ_COUNTRY
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= $ENV::EASYRSA_REQ_PROVINCE
+
+localityName			= Locality Name (eg, city)
+localityName_default		= $ENV::EASYRSA_REQ_CITY
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= $ENV::EASYRSA_REQ_ORG
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+organizationalUnitName_default	= $ENV::EASYRSA_REQ_OU
+
+commonName			= Common Name (eg: your user, host, or server name)
+commonName_max			= 64
+commonName_default		= $ENV::EASYRSA_REQ_CN
+
+emailAddress			= Email Address
+emailAddress_default		= $ENV::EASYRSA_REQ_EMAIL
+emailAddress_max		= 64
+
+serialNumber		= Serial-number (eg, device serial-number)
+serialNumber_default	= $ENV::EASYRSA_REQ_SERIAL
+
+####################################################################
+# Easy-RSA cert extension handling
+
+# This section is effectively unused as the main script sets extensions
+# dynamically. This core section is left to support the odd usecase where
+# a user calls openssl directly.
+[ basic_exts ]
+basicConstraints	= CA:FALSE
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid,issuer:always
+
+# The Easy-RSA CA extensions
+[ easyrsa_ca ]
+
+# PKIX recommendations:
+
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This could be marked critical, but it's nice to support reading by any
+# broken clients who attempt to do so.
+basicConstraints = CA:true
+
+# Limit key usage to CA tasks. If you really want to use the generated pair as
+# a self-signed cert, comment this out.
+keyUsage = cRLSign, keyCertSign
+
+# nsCertType omitted by default. Let's try to let the deprecated stuff die.
+# nsCertType = sslCA
+
+# A placeholder to handle the $X509_TYPES and CA extra extensions $EXTRA_EXTS:
+#%CA_X509_TYPES_EXTRA_EXTS%	# Do NOT remove or change this line as $X509_TYPES and EXTRA_EXTS demands it
+
+# CRL extensions.
+[ crl_ext ]
+
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always

easyrsa3/vars

@@ -0,0 +1,15 @@
+set_var EASYRSA_DN	"org"
+set_var EASYRSA_REQ_COUNTRY	"US"
+set_var EASYRSA_REQ_PROVINCE	"California"
+set_var EASYRSA_REQ_CITY	"San Francisco"
+set_var EASYRSA_REQ_ORG	"SuperNETs"
+set_var EASYRSA_REQ_EMAIL	"no-reply@supernets.org"
+set_var EASYRSA_REQ_OU		"IRC"
+set_var EASYRSA_PRESERVE_DN	1
+set_var EASYRSA_NO_PASS	1
+set_var EASYRSA_KEY_SIZE	4096
+set_var EASYRSA_ALGO		rsa
+set_var EASYRSA_CA_EXPIRE	3650
+set_var EASYRSA_CERT_EXPIRE	3650
+set_var EASYRSA_CRL_DAYS	180
+set_var EASYRSA_RAND_SN	"yes"

easyrsa3/x509-types/COMMON

@@ -0,0 +1,12 @@
+# X509 extensions added to every signed cert
+
+# This file is included for every cert signed, and by default does nothing.
+# It could be used to add values every cert should have, such as a CDP as
+# demonstrated in the following example:
+
+#crlDistributionPoints = URI:http://example.net/pki/my_ca.crl
+
+# The authority information access extension gives details about how to access
+# certain information relating to the CA.
+
+#authorityInfoAccess = caIssuers;URI:http://example.net/pki/my_ca.crt

easyrsa3/x509-types/ca

@@ -0,0 +1,12 @@
+# X509 extensions for a ca
+
+# Note that basicConstraints will be overridden by Easy-RSA when defining a
+# CA_PATH_LEN for CA path length limits. You could also do this here
+# manually as in the following example in place of the existing line:
+#
+# basicConstraints = CA:TRUE, pathlen:1
+
+basicConstraints = CA:TRUE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = cRLSign, keyCertSign

easyrsa3/x509-types/client

@@ -0,0 +1,7 @@
+# X509 extensions for a client
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = clientAuth
+keyUsage = digitalSignature

easyrsa3/x509-types/code-signing

@@ -0,0 +1,7 @@
+# X509 extensions for a client
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = codeSigning
+keyUsage = digitalSignature

easyrsa3/x509-types/email

@@ -0,0 +1,7 @@
+# X509 extensions for email
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = emailProtection
+keyUsage = digitalSignature,keyEncipherment,nonRepudiation

easyrsa3/x509-types/kdc

@@ -0,0 +1,21 @@
+# X509 extensions for a KDC server certificate
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = 1.3.6.1.5.2.3.5
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+issuerAltName = issuer:copy
+subjectAltName = otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
+
+[kdc_princ_name]
+realm = EXP:0,GeneralString:${ENV::EASYRSA_KDC_REALM}
+principal_name = EXP:1,SEQUENCE:kdc_principal_seq
+
+[kdc_principal_seq]
+name_type = EXP:0,INTEGER:1
+name_string = EXP:1,SEQUENCE:kdc_principals
+
+[kdc_principals]
+princ1 = GeneralString:krbtgt
+princ2 = GeneralString:${ENV::EASYRSA_KDC_REALM}

easyrsa3/x509-types/server

@@ -0,0 +1,7 @@
+# X509 extensions for a server
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = serverAuth
+keyUsage = digitalSignature,keyEncipherment

easyrsa3/x509-types/serverClient

@@ -0,0 +1,7 @@
+# X509 extensions for a client/server
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = serverAuth,clientAuth
+keyUsage = digitalSignature,keyEncipherment

haproxy/Dockerfile

@@ -0,0 +1,23 @@
+ARG UBUNTU_VERSION="noble"
+
+FROM ubuntu:${UBUNTU_VERSION}
+
+RUN apt -y update
+
+RUN apt -y install haproxy
+
+RUN groupadd docker-haproxy
+
+RUN useradd --system --shell /bin/bash docker-haproxy -g docker-haproxy
+
+RUN mkdir -p /var/lib/haproxy/ -p /etc/haproxy
+
+ADD haproxy.cfg /etc/haproxy
+
+RUN chown -R docker-haproxy:docker-haproxy /etc/haproxy /var/lib/haproxy
+
+VOLUME /var/lib/haproxy
+
+USER docker-haproxy
+
+CMD haproxy -f /etc/haproxy/haproxy.cfg

haproxy/docker-compose.yml

@@ -0,0 +1,7 @@
+services:
+  haproxy:
+    restart: on-failure:3
+    build:
+      context: .
+    image: haproxy
+    network_mode: "host"

haproxy/haproxy.cfg

@@ -0,0 +1,26 @@
+global
+log stdout format raw local0 debug
+
+defaults
+log     global
+retries 0
+#timeout connect         604800s
+#timeout client          604800s
+#timeout server          604800s
+#timeout tunnel          604800s
+#timeout queue           604800s
+#timeout http-request    604800s
+#timeout http-keep-alive 604800s
+#timeout client-fin      604800s
+#timeout server-fin      604800s
+#timeout check           604800s
+option  tcplog 
+
+frontend tor-north
+  bind                 127.0.0.1:19818 accept-proxy
+  mode                 tcp
+  default_backend      inspircd-south
+
+backend inspircd-south
+  mode   tcp
+  server inspircd 127.0.0.1:7001 send-proxy-v2

include.conf.example

@@ -1,28 +1,41 @@
-<sslprofile certfile="/etc/ssl/inspircd/server.crt"
+<include file="/etc/inspircd/codepages/rfc1459.conf">
-            compression="no"
+
-            keyfile="/etc/ssl/inspircd/server.key"
+<sslprofile certfile="/etc/inspircd/custom/server.crt"
+            keyfile="/etc/inspircd/custom/server.key"
+            cafile="/etc/inspircd/custom/ca.crt"
+            crlfile="/etc/inspircd/custom/crl.pem"
+            dhfile="/etc/inspircd/custom/dh.pem"
             name="defaultssl"
             tlsv11="no"
             tlsv12="yes"
             tlsv13="yes"
-            renegotiation="no"
+            renegotiation="yes"
-            requestclientcert="no"
+            requestclientcert="yes"
             provider="gnutls">
 
-<badhost host="*@*"
+<sslprofile certfile="/etc/inspircd/custom/irc.crt"
-         reason="default hostmask block">
+            keyfile="/etc/inspircd/custom/irc.key"
+            cafile="/etc/inspircd/custom/irc.ca.crt"
+            name="supernets_ssl"
+            tlsv11="no"
+            tlsv12="yes"
+            tlsv13="yes"
+            renegotiation="yes"
+            requestclientcert="yes"
+            provider="gnutls">
+
+<exception host="*@100.64.0.0/10"
+           reason="tailscale network">
 
 <exception host="*@127.0.0.1/32"
-           reason="Local IRC client">
+           reason="localhost">
+
+<exception host="*@fc00:dead:beef:4dad::/64"
+           reason="Tor ULA addresses (represents circuit ID)">
 
 <eventexec command="/bin/true"
            event="rehash">
 
-<oper host="*@*"
-      name="admin"
-      password="&env.ADMIN_PASSWORD;"
-      type="NetAdmin">
-
 <showfile endtext="End of uptime"
           file="/proc/uptime"
           introtext="server uptime:"
@@ -33,23 +46,70 @@
           introtext="server loadavg:"
           name="LOADAVG">
 
-<bind address="*"
+<bind address="127.0.0.1"
+      port="7001"
+      hook="haproxy">
+
+<connect commandrate="&env.COMMAND_RATE;"
+         fakelag="&env.FAKE_LAG;"
+         allow="127.0.0.1/32"
+         hardsendq="&env.HARD_SENDQ;"
+         maxchans="&env.MAX_CHANS;"
+         pingfreq="&env.PING_FREQ;"
+         recvq="&env.RECVQ;"
+         softsendq="&env.SOFT_SENDQ;"
+         threshold="&env.COMMAND_RATE_THRESHOLD;"
+         timeout="&env.PARTIAL_CONNECT_TIMEOUT;"
+         usecloak="yes"
+         useconnflood="&env.USE_CONN_FLOOD;"
+         usednsbl="no"
+         useident="no"
+         resolvehostnames="no"
+         useconnectban="no"
+         globalmax="&env.GLOBAL_MAX;"
+         localmax="&env.LOCAL_MAX;"
+         maxconnwarn="&env.MAX_CONN_WARN;"
+         modes="&env.DEFAULT_USER_MODES;"
+         name="tor_haproxy_shim"
+         port="7001">
+
+<connect commandrate="&env.COMMAND_RATE;"
+         fakelag="&env.FAKE_LAG;"
+         allow="fc00:dead:beef:4dad::/64"
+         hardsendq="&env.HARD_SENDQ;"
+         maxchans="&env.MAX_CHANS;"
+         pingfreq="&env.PING_FREQ;"
+         recvq="&env.RECVQ;"
+         softsendq="&env.SOFT_SENDQ;"
+         threshold="&env.COMMAND_RATE_THRESHOLD;"
+         timeout="&env.PARTIAL_CONNECT_TIMEOUT;"
+         usecloak="yes"
+         useconnflood="&env.USE_CONN_FLOOD;"
+         usednsbl="no"
+         useident="no"
+         resolvehostnames="no"
+         useconnectban="no"
+         autojoin="#tor"
+         globalmax="&env.GLOBAL_MAX;"
+         localmax="&env.LOCAL_MAX;"
+         maxconnwarn="&env.MAX_CONN_WARN;"
+         modes="&env.DEFAULT_USER_MODES;"
+         name="tor"
+         port="6668">
+
+<bind address="127.0.0.1"
       port="8000"
       type="httpd">
 
-<bind address="*"
+ <bind address="*"
       port="&env.SSL_PORT;"
-      sslprofile="defaultssl"
+      sslprofile="supernets_ssl"
       type="clients">
 
 <bind address="*"
       port="&env.PORT;"
       type="clients">
 
-<bind address="*"
-      port="7001"
-      type="servers">
-
 <bind address="*"
       port="&env.SERVER_SSL_PORT;"
       sslprofile="defaultssl"
@@ -68,13 +128,12 @@
          fakelag="&env.FAKE_LAG;"
          hardsendq="&env.HARD_SENDQ;"
          maxchans="&env.MAX_CHANS;"
-         motd="defaultmotd"
          name="all"
          pingfreq="&env.PING_FREQ;"
          recvq="&env.RECVQ;"
          softsendq="&env.SOFT_SENDQ;"
          threshold="&env.COMMAND_RATE_THRESHOLD;"
-         timeout="&env.COMMAND_RATE_THRESHOLD_TIMEOUT;"
+         timeout="&env.PARTIAL_CONNECT_TIMEOUT;"
          useconnflood="&env.USE_CONN_FLOOD;"
          usednsbl="&env.USE_DNSBL;"
          useident="&env.USE_IDENT;"
@@ -119,21 +178,6 @@
           types="password"
           username="&env.HTTP_ACL_USERNAME;">
 
-<autoconnect period="8s"
-             server="vps-1.lame-network.local">
-
-<link allowmask="*"
-      bind="1.2.3.4"
-      hidden="no"
-      sslprofile="defaultssl"
-      ipaddr="4.2.3.1"
-      name="vps-1.lame-network.local"
-      port="&env.SERVER_SSL_PORT;"
-      recvpass="&env.LINK_RECV_PASSWORD;"
-      sendpass="&env.LINK_SEND_PASSWORD;"
-      statshidden="no"
-      timeout="&env.LINK_TIMEOUT;">
-
 <ident prefixunqueried="&env.IDENT_PREFIX_UNQUERIED;"
        timeout="&env.IDENT_TIMEOUT;">
 

inspircd.conf

@@ -1,4 +1,5 @@
 <include file="/etc/inspircd/modules.conf">
+<include file="/etc/inspircd/help.conf">
 <include directory="/etc/inspircd/custom">
 
 <badip ipmask="169.254.0.0/16"  reason="APIPA">
@@ -51,7 +52,7 @@
 <badnick nick="SASLSERV"  reason="Reserved For Services">
 <badnick nick="STATSERV"  reason="Reserved For Services">
 
-<cidr ipv4clone="32" ipv6clone="64">
+<cidr ipv4clone="&env.IPV4_CLONE;" ipv6clone="&env.IPV6_CLONE;">
 
 <class chanmodes="*"
        commands="DIE RESTART REHASH LOADMODULE UNLOADMODULE RELOADMODULE GLOADMODULE GUNLOADMODULE GRELOADMODULE"
@@ -93,8 +94,6 @@
 <class name="RolePlay"
        priv="channels/roleplay channels/roleplay-override">
        
-<define name="VOID" value="8,4   E N T E R   T H E   V O I D   ">
-
 <files motd="/etc/inspircd/custom/motd.txt" opermotd="/etc/inspircd/custom/oper.motd.txt">
 
 <insane hostmasks="&env.INSANE_HOSTMASKS;" ipmasks="&env.INSANE_IPMASKS;" nickmasks="&env.INSANE_NICKMASKS;" trigger="&env.INSANE_TRIGGER;">
@@ -110,19 +109,15 @@
         maxquit="&env.MAX_QUIT;"
         maxtopic="&env.MAX_TOPIC;">
 
-<log method="ring" type="DEFAULT" level="normal" maxsize="1048576">
-<log method="file" type="ERROR" level="warning critical" target="errors.log" flush="20">
-<log method="file" type="m_dnsbl" level="debug" target="dnsbl.log" flush="20" maxsize="104857600">
-
 <maxlist chan="*" limit="&env.LIST_MAX_SIZE;">
 
 <options allowmismatch="&env.ALLOW_MISMATCH;"
          allowzerolimit="&env.ALLOW_ZERO_LIMIT;"
          announcets="&env.ANNOUNCE_TS;"
-         casemapping="ascii"
          cyclehosts="&env.CYCLE_HOST_TS;"
          cyclehostsfromuser="&env.CYCLE_HOST_FROM_USER;"
          defaultbind="auto"
+         defaultmodes="npst"
          exemptchanops="censor:o filter:o nickflood:o nonick:v regmoderated:o"
          fixedpart=""
          fixedquit=""
@@ -155,8 +150,8 @@
 
 <pid file="/tmp/inspircd.pid">
 
-<security allowcoreunload="no"
+<security allowcoreunload="&env.ALLOW_CORE_UNLOAD;"
-          announceinvites="dynamic"
+          announceinvites="&env.ANNOUNCE_INVITES;"
           customversion="&env.CUSTOM_VERSION;"
           flatlinks="&env.FLAT_LINKS;"
           genericoper="&env.GENERIC_OPER;"
@@ -177,17 +172,12 @@
       name="GlobalOp"
       vhost="&env.GLOBAL_OP_VHOST;">
 
-<type classes="SACommands OperChat BanControl HostCloak ServerLink"
-      name="HOPM"
-      vhost="&env.HOPM_VHOST;">
-
 <type classes="HostCloak"
       name="Helper"
       vhost="&env.HELPER_VHOST;">
 
 <whowas groupsize="&env.WHOWAS_GROUP_SIZE;" maxgroups="&env.WHOWAS_MAX_GROUPS;" maxkeep="&env.WHOWAS_MAX_KEEP;">
 
-
 <maxmind file="/etc/inspircd/GeoLite2-Country.mmdb">
 
 <sts duration="5m"
@@ -195,7 +185,7 @@
      port="&env.SSL_PORT;"
      preload="yes">
 
-<sasl requiressl="yes"
+<sasl requiressl="&env.SASL_REQUIRE_SSL;"
       target="&env.SASL_TARGET;">
 
 <alias format="*"
@@ -313,42 +303,12 @@
        text="GLOBAL"
        uline="yes">
 
-<allowchannel name="*">
-
-<anticaps lowercase="abcdefghijklmnopqrstuvwxyz"
-          uppercase="ABCDEFGHIJKLMNOPQRSTUVWXYZ">
-
-<argon2 iterations="3"
-        length="32"
-        memory="131074"
-        saltlength="16">
-
-<argon2d memory="131074">
-
-<argon2i iterations="4">
-
-<argon2id iterations="5"
-          length="64"
-          memory="262144"
-          saltlength="32">
-
 <auditorium opcansee="&env.AUDITORIUM_OP_CAN_SEE;"
             opercansee="&env.AUDITORIUM_OPER_CAN_SEE;"
             opvisible="&env.AUDITORIUM_OP_VISIBLE;">
 
 <autodrop commands="CONNECT DELETE GET HEAD OPTIONS PATCH POST PUT TRACE">
 
-<autojoinident chan="#blackhole"
-               ident="*">
-
-
-
-
-
-
-
-<bcrypt rounds="16">
-
 <blockamsg action="&env.BLOCK_AMSG_ACTION;"
            delay="&env.BLOCK_AMSG_DELAY;">
 
@@ -384,16 +344,10 @@
 <channels opers="&env.CHANNELS_OPERS;"
           users="&env.CHANNELS_USERS;">
 
-
+<cloak method="hmac-sha256-addr"
-
-<cloak ignorecase="&env.CLOAK_IGNORE_CASE;"
        key="&env.CLOAK_KEY;"
-       mode="&env.CLOAK_MODE;"
-       prefix="&env.CLOAK_PREFIX;"
        suffix="&env.CLOAK_SUFFIX;">
 
-<codepage name="&env.CODE_PAGE;">
-
 <connectban banmessage="filtered for connection hammering; wait 64 seconds to retry"
             bootwait="&env.CONNECT_BAN_BOOT_WAIT;"
             duration="&env.CONNECT_BAN_DURATION;"
@@ -402,108 +356,6 @@
             splitwait="&env.CONNECT_BAN_SPLIT_WAIT;"
             threshold="&env.CONNECT_BAN_THRESHOLD;">
 
-<cpcase lower="97"
-        upper="65">
-
-<cpcase lower="98"
-        upper="66">
-
-<cpcase lower="99"
-        upper="67">
-
-<cpcase lower="100"
-        upper="68">
-
-<cpcase lower="101"
-        upper="69">
-
-<cpcase lower="102"
-        upper="70">
-
-<cpcase lower="103"
-        upper="71">
-
-<cpcase lower="104"
-        upper="72">
-
-<cpcase lower="105"
-        upper="73">
-
-<cpcase lower="106"
-        upper="74">
-
-<cpcase lower="107"
-        upper="75">
-
-<cpcase lower="108"
-        upper="76">
-
-<cpcase lower="109"
-        upper="77">
-
-<cpcase lower="110"
-        upper="78">
-
-<cpcase lower="111"
-        upper="79">
-
-<cpcase lower="112"
-        upper="80">
-
-<cpcase lower="113"
-        upper="81">
-
-<cpcase lower="114"
-        upper="82">
-
-<cpcase lower="115"
-        upper="83">
-
-<cpcase lower="116"
-        upper="84">
-
-<cpcase lower="117"
-        upper="85">
-
-<cpcase lower="118"
-        upper="86">
-
-<cpcase lower="119"
-        upper="87">
-
-<cpcase lower="120"
-        upper="88">
-
-<cpcase lower="121"
-        upper="89">
-
-<cpcase lower="122"
-        upper="90">
-
-<cpchars index="45">
-
-<cpchars begin="48"
-         end="57">
-
-<cpchars begin="65"
-         end="90"
-         front="yes">
-
-<cpchars begin="91"
-         end="96"
-         front="yes">
-
-<cpchars begin="97"
-         end="122"
-         front="yes">
-
-<cpchars begin="123"
-         end="125"
-         front="yes">
-
-<cpchars front="no"
-         index="47">
-
 <ctctags allowclientonlytags="&env.CTC_TAGS_ALLOW_CLIENT_ONLY_TAGS;">
 
 <customprefix letter="q"
@@ -574,8 +426,6 @@
        timeout="5s"
        type="record">
 
-
-
 <exemptfromfilter target="ALIS">
 
 <exemptfromfilter target="BOTSERV">
@@ -625,7 +475,6 @@
 
 <httpd timeout="&env.HTTPD_TIMEOUT;">
 
-
 <inviteexception bypasskey="&env.INVITE_EXCEPTION_BYPASS_KEY;">
 
 <ircv3 accountnotify="&env.IRCV3_ACCOUNT_NOTIFY;"
@@ -638,15 +487,10 @@
 
 <knock notify="&env.KNOCK_NOTIFY;">
 
-
-<maxmind file="/etc/inspircd/geolite2.mmdb">
-
 <messageflood notice="&env.MESSAGE_FLOOD_NOTICE;"
               privmsg="&env.MESSAGE_FLOOD_PRIVMSG;"
               tagmsg="&env.MESSAGE_FLOOD_TAG_MSG;">
 
-
-
 <monitor maxentries="&env.MONITOR_MAX_ENTRIES;">
 
 <muteban notifyuser="&env.MUTE_BAN_NOTIFY_USER;">
@@ -669,32 +513,16 @@
 
 <operprefix prefix="&env.OPER_PREFIX;">
 
-
-
 <override enableumode="&env.OVERRIDE_ENABLE_UMODE;"
           noisy="&env.OVERRIDE_NOISY;"
           requirekey="&env.OVERRIDE_REQUIRE_KEY;">
 
-
-<pbkdf2 iterations="12288"
-        length="32">
-
-<pbkdf2prov hash="sha256"
-            iterations="24576">
-
 <penalty name="HELPOP"
          value="60">
 
-
 <permchanneldb filename="/var/lib/inspircd/permchannels.db"
-               listmodes="yes"
+               listmodes="&env.PERMCHAN_LIST_MODES;"
-               saveperiod="1d">
+               saveperiod="&env.PERMCHANDB_SAVE_PERIOD;">
-
-
-
-<qrcode blockchar=" "
-        darkcolour="black"
-        lightcolour="white">
 
 <remove protectedrank="50000"
         supportnokicks="&env.REMOVE_SUPPORT_NO_KICKS;">
@@ -705,20 +533,16 @@
         maxtime="&env.REPEAT_MAX_TIME;"
         size="&env.REPEAT_MAX_SIZE;">
 
-<restrictchans allowregistered="&env.RESTRICT_CHANS_ALLOW_REGISTERED;">
-
 <rline engine="&env.RLINE_ENGINE;"
        matchonnickchange="&env.RLINE_MATCH_ON_NICK_CHANGE;"
        zlineonmatch="&env.RLINE_ZLINE_ON_MATCH;">
 
-<rotatelog period="86400">
+<rotatelog period="&env.ROTATE_LOG_PERIOD;">
 
 <securelist exemptregistered="&env.SECURE_LIST_EXEMPT_REGISTERED;"
             showmsg="&env.SECURE_LIST_SHOW_MSG;"
             waittime="&env.SECURE_LIST_WAIT_TIME;">
 
-
-
 <showwhois opersonly="&env.SHOW_WHOIS_OPER_ONLY;"
            showfromopers="&env.SHOW_WHOIS_FROM_OPERS;">
 
@@ -736,15 +560,12 @@
 
 <sslmodes enableumode="&env.SSL_ENABLE_UMODE;">
 
-<stdregex type="ecmascript">
+<stdregex type="&env.REGEX_TYPE;">
-
-<strictsasl reason="Fix your SASL authentication settings and try again">
 
 <svshold silent="&env.SVS_HOLD_SILENT;">
 
 <timedbans sendnotice="&env.TIMED_BANS_SEND_NOTICE;">
 
-
 <uline server="&env.SERVICES_ULINE;"
        silent="no">
 
@@ -753,12 +574,10 @@
 
 <watch maxwatch="&env.WATCH_MAX;">
 
-
-
 <wsorigin allow="&env.WS_ORIGIN_ALLOW;">
 
 <xlinedb filename="/var/lib/inspircd/xline.db"
-         saveperiod="128s">
+         saveperiod="&env.XLINEDB_SAVE_PERIOD;">
 
 <zombie cleansplit="&env.ZOMBIE_CLEAN_SPLIT;"
         dirtysplit="&env.ZOMBIE_DIRTY_SPLIT;"

modules.conf

@@ -3,7 +3,6 @@
 <module name="allowinvite">
 <module name="alltime">
 <module name="anticaps">
-<module name="antiknocker">
 <module name="antisnoop">
 <module name="argon2">
 <module name="asn">
@@ -36,7 +35,11 @@
 <module name="chgname">
 <module name="classban">
 <module name="clearchan">
-<module name="cloaking">
+<module name="cloak">
+<module name="cloak_sha256">
+<module name="cloak_static">
+<module name="cloak_unreal">
+<module name="cloak_user">
 <module name="clones">
 <module name="codepage">
 <module name="commonchans">
@@ -109,7 +112,6 @@
 <module name="modenotice">
 <module name="monitor">
 <module name="muteban">
-<module name="mysql">
 <module name="namedmodes">
 <module name="namesx">
 <module name="nickflood">
@@ -134,9 +136,7 @@
 <module name="password_hash">
 <module name="pbkdf2">
 <module name="permchannels">
-<module name="pgsql">
 <module name="protoctl">
-<module name="qrcode">
 <module name="redirect">
 <module name="regex_glob">
 <module name="regex_pcre2">
@@ -146,8 +146,6 @@
 <module name="regex_tre">
 <module name="remove">
 <module name="repeat">
-<module name="restrictchans">
-<module name="restrictmsg">
 <module name="rline">
 <module name="rmode">
 <module name="sajoin">
@@ -174,12 +172,9 @@
 <module name="shun">
 <module name="silence">
 <module name="spanningtree">
-<module name="sqlite3">
-<module name="ssl_gnutls">
 <module name="sslinfo">
 <module name="sslmodes">
 <module name="sslrehashsignal">
-<module name="starttls">
 <module name="stats_unlinked">
 <module name="stripcolor">
 <module name="svshold">
@@ -196,3 +191,12 @@
 <module name="watch">
 <module name="websocket">
 <module name="xline_db">
+<module name="regex_pcre">
+<module name="pgsql">
+<module name="mysql">
+<module name="sqlite3">
+<module name="ssl_mbedtls">
+<module name="ssl_openssl">
+<module name="ssl_gnutls">
+<module name="log_sql">
+<module name="log_syslog">

tor/Dockerfile

@@ -0,0 +1,23 @@
+ARG UBUNTU_VERSION="noble"
+
+FROM ubuntu:${UBUNTU_VERSION}
+
+RUN apt -y update
+
+RUN apt -y install tor
+
+RUN groupadd docker-tor
+
+RUN useradd --system --shell /bin/bash docker-tor -g docker-tor
+
+RUN mkdir -p /var/lib/tor/ -p /etc/tor
+
+ADD torrc /etc/tor
+
+RUN chown -R docker-tor:docker-tor /etc/tor /var/lib/tor
+
+VOLUME /var/lib/tor
+
+USER docker-tor
+
+CMD tor -f /etc/tor/torrc

tor/docker-compose.yml

@@ -0,0 +1,20 @@
+services:
+  tor:
+    restart: on-failure:3
+    build:
+      context: .
+    image: tor
+    network_mode: "host"
+    volumes:
+      - data:/var/lib/inspircd
+    ulimits:
+      nofile:
+        soft: "102400"
+        hard: "102400"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "64k"
+volumes:
+  data:
+    name: tor_data

tor/torrc

@@ -0,0 +1,16 @@
+DNSPort                             0
+SocksPort                           0
+TransPort                           0
+NATDPort                            0
+RunAsDaemon                         0
+DataDirectory                       /var/lib/tor
+HiddenServiceDir                    /var/lib/tor/ircd
+HiddenServicePort                   6668 127.0.0.1:19818
+HiddenServiceMaxStreams             65535
+HiddenServiceExportCircuitID        haproxy
+CookieAuthentication                0
+ControlPort                         127.0.0.1:9051
+HardwareAccel                       1
+Log                                 info stderr
+HiddenServiceSingleHopMode          1
+HiddenServiceNonAnonymousMode       1