This commit is contained in:
xfnw 2021-07-14 22:54:14 -04:00
commit fa8fb63e79
11 changed files with 529 additions and 0 deletions

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
hosts

56
auth.j2 Normal file
View file

@ -0,0 +1,56 @@
/* auth {}: allow users to connect to the ircd (OLD I:)
* auth {} blocks MUST be specified in order of precedence. The first one
* that matches a user will be used. So place spoofs first, then specials,
* then general access, then restricted.
*/
auth {
/* user: the user@host allowed to connect. Multiple IPv4/IPv6 user
* lines are permitted per auth block. This is matched against the
* hostname and IP address (using :: shortening for IPv6 and
* prepending a 0 if it starts with a colon) and can also use CIDR
* masks.
*/
user = "*@198.51.100.0/24";
user = "*test@2001:db8:1:*";
/* password: an optional password that is required to use this block.
* By default this is not encrypted, specify the flag "encrypted" in
* flags = ...; below if it is.
*/
password = "letmein";
/* spoof: fake the users user@host to be be this. You may either
* specify a host or a user@host to spoof to. This is free-form,
* just do everyone a favour and dont abuse it. (OLD I: = flag)
*/
spoof = "I.still.hate.packets";
/* Possible flags in auth:
*
* encrypted | password is encrypted with mkpasswd
* spoof_notice | give a notice when spoofing hosts
* exceed_limit (old > flag) | allow user to exceed class user limits
* kline_exempt (old ^ flag) | exempt this user from k/g/xlines,
* | dnsbls, and proxies
* proxy_exempt | exempt this user from proxies
* dnsbl_exempt | exempt this user from dnsbls
* spambot_exempt | exempt this user from spambot checks
* shide_exempt | exempt this user from serverhiding
* jupe_exempt | exempt this user from generating
* warnings joining juped channels
* resv_exempt | exempt this user from resvs
* flood_exempt | exempt this user from flood limits
* USE WITH CAUTION.
* no_tilde (old - flag) | don't prefix ~ to username if no ident
* need_ident (old + flag) | require ident for user in this class
* need_ssl | require SSL/TLS for user in this class
* need_sasl | require SASL id for user in this class
*/
flags = kline_exempt, exceed_limit;
class = "opers";
};
auth {
user = "*@*";
class = "users";
};

30
class.j2 Normal file
View file

@ -0,0 +1,30 @@
/* class {} blocks MUST be specified before anything that uses them. That
* means they must be defined before auth {} and before connect {}.
*/
class "users" {
ping_time = 2 minutes;
number_per_ident = 10;
number_per_ip = 10;
number_per_ip_global = 50;
cidr_ipv4_bitlen = 24;
cidr_ipv6_bitlen = 64;
number_per_cidr = 200;
max_number = 3000;
sendq = 400 kbytes;
};
class "opers" {
ping_time = 5 minutes;
number_per_ip = 100;
max_number = 1000;
sendq = 1 megabyte;
};
class "server" {
ping_time = 5 minutes;
connectfreq = 5 minutes;
max_autoconn = 10;
max_number = 100;
sendq = 4 megabytes;
};

27
connect.j2 Normal file
View file

@ -0,0 +1,27 @@
{% for host in ansible_play_hosts %}
{% if host != inventory_hostname %}
connect "{{ host }}" {
host = "{% if hostvars[host]['pahost'] is defined %}{{ hostvars[host]['pahost'] }}{% else %}{{ host }}{% endif %}";
send_password = "{{ hostvars[host]['linkpass'] }}";
accept_password = "{{ linkpass }}";
port = {% if hostvars[host]['paport'] is defined %}{{ hostvars[host]['paport'] }}{% else %}6697{% endif %};
class = "server";
{% if hostvars[host]['ssl_exists']['stat']['exists'] %}
fingerprint = "{{ hostvars[host]['ssl_fingerprint']['stdout'] }}";
{% endif %}
flags = {% if hostvars[host]['paport'] is not defined or hostvars[host]['paport'] != 6667 %}ssl, {% endif %}topicburst{% if autoconn is defined and autoconn == host %}, autoconn{% endif %};
};
{% endif %}
{% endfor %}
{% if services is defined %}
connect "services." {
host = "127.0.0.1";
send_password = "{{ services }}";
accept_password = "{{ services }}";
port = 6667;
class = "server";
flags = topicburst;
};
{% endif %}

0
dnsbl.j2 Normal file
View file

281
ircd.j2 Normal file
View file

@ -0,0 +1,281 @@
/* Extensions */
loadmodule "extensions/chm_nonotice";
loadmodule "extensions/chm_operpeace";
loadmodule "extensions/chm_operonly";
loadmodule "extensions/extb_account";
loadmodule "extensions/extb_canjoin";
loadmodule "extensions/extb_channel";
loadmodule "extensions/extb_combi";
loadmodule "extensions/extb_extgecos";
loadmodule "extensions/extb_hostmask";
loadmodule "extensions/extb_oper";
loadmodule "extensions/extb_realname";
loadmodule "extensions/extb_server";
loadmodule "extensions/extb_ssl";
loadmodule "extensions/extb_usermode";
loadmodule "extensions/helpops";
loadmodule "extensions/hurt";
loadmodule "extensions/m_extendchans";
loadmodule "extensions/m_findforwards";
loadmodule "extensions/m_identify";
loadmodule "extensions/m_locops";
loadmodule "extensions/sno_farconnect";
loadmodule "extensions/sno_globalkline";
loadmodule "extensions/sno_globalnickchange";
loadmodule "extensions/sno_globaloper";
loadmodule "extensions/override";
loadmodule "extensions/override_kick_immunity";
serverinfo {
name = "{{ inventory_hostname }}";
sid = "{{ sid }}";
description = "{% if description is defined %}{{ description }}{% else %}solanum fox server{% endif %}";
network_name = "vulpineawoo";
{% if ssl_exists.stat.exists %}
ssl_cert = "etc/ssl.pem";
ssl_private_key = "etc/ssl.key";
ssl_dh_params = "etc/dh.pem";
ssld_count = 1;
{% endif %}
default_max_clients = 1024;
nicklen = 30;
};
admin {
name = "xfnw";
description = "friendly vulpine, requires payment in hugs.";
email = "xfnw@riseup.net";
};
{% include 'class.j2' %}
listen {
defer_accept = yes;
port = 6667;
{% if ssl_exists.stat.exists %}
sslport = 6697;
wsock = yes;
sslport = 7001;
{% endif %}
};
{% include 'auth.j2' %}
privset "wombat" {
privs = oper:general, oper:kline, oper:unkline, oper:xline, oper:kill, oper:testline, oper:privs,
oper:resv, oper:cmodes, oper:mass_notice, oper:remoteban, usermode:helpops, oper:message,
auspex:oper, auspex:hostname, auspex:umodes, auspex:cmodes, oper:receive_immunity, oper:wallops;
};
privset "dingo" {
extends = "wombat";
privs = oper:override, oper:ojoin, oper:operwall,
oper:dehelper, oper:massnotice, usermode:servnotice;
};
privset "shark" {
extends = "dingo";
privs = oper:kline, oper:remoteban, snomask:nick_changes;
};
privset "bandicoot" {
extends = "dingo";
privs = oper:routing;
};
privset "jellyfish" {
extends = "bandicoot";
privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:grant;
};
{% include 'operator.j2' %}
{% include 'connect.j2' %}
service {
name = "services.";
};
cluster {
name = "*";
flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv, all;
};
channel {
use_invex = yes;
use_except = yes;
use_forward = yes;
use_knock = yes;
knock_delay = 5 minutes;
knock_delay_channel = 1 minute;
max_chans_per_user = 150;
max_chans_per_user_large = 300;
max_bans = 100;
max_bans_large = 500;
default_split_user_count = 0;
default_split_server_count = 0;
no_create_on_split = no;
no_join_on_split = no;
burst_topicwho = yes;
kick_on_split_riding = no;
only_ascii_channels = no;
resv_forcepart = yes;
channel_target_change = yes;
disable_local_channels = no;
autochanmodes = "+nt";
displayed_usercount = 3;
strip_topic_colors = no;
opmod_send_statusmsg = no;
};
serverhide {
flatten_links = yes;
links_delay = 5 minutes;
hidden = no;
disable_hidden = no;
};
{% include 'dnsbl.j2' %}
alias "NickServ" {
target = "NickServ";
};
alias "ChanServ" {
target = "ChanServ";
};
alias "OperServ" {
target = "OperServ";
};
alias "HostServ" {
target = "HostServ";
};
alias "MemoServ" {
target = "MemoServ";
};
alias "BotServ" {
target = "BotServ";
};
alias "CatServ" {
target = "CatServ";
};
alias "ALIS" {
target = "ALIS";
};
alias "NS" {
target = "NickServ";
};
alias "CS" {
target = "ChanServ";
};
alias "OS" {
target = "OperServ";
};
alias "HS" {
target = "HostServ";
};
alias "MS" {
target = "MemoServ";
};
alias "BS" {
target = "BotServ";
};
general {
hide_error_messages = opers;
hide_spoof_ips = yes;
default_umodes = "+";
default_operstring = "is an IRC Operator";
default_adminstring = "is a Server Administrator";
servicestring = "is a Network Service";
sasl_service = "SaslServ";
disable_fake_channels = no;
tkline_expire_notices = no;
default_floodcount = 10;
failed_oper_notice = yes;
dots_in_ident = 2;
min_nonwildcard = 4;
min_nonwildcard_simple = 3;
max_accept = 100;
max_monitor = 100;
anti_nick_flood = yes;
max_nick_time = 20 seconds;
max_nick_changes = 5;
anti_spam_exit_message_time = 5 minutes;
ts_warn_delta = 30 seconds;
ts_max_delta = 5 minutes;
client_exit = yes;
collision_fnc = yes;
resv_fnc = yes;
global_snotices = yes;
dline_with_reason = yes;
kline_with_reason = yes;
hide_tkdline_duration = no;
kline_reason = "K-Lined";
identify_service = "NickServ@services.";
identify_command = "IDENTIFY";
non_redundant_klines = yes;
warn_no_nline = yes;
use_propagated_bans = yes;
stats_e_disabled = no;
stats_c_oper_only = no;
stats_y_oper_only = no;
stats_o_oper_only = yes;
stats_P_oper_only = no;
stats_i_oper_only = masked;
stats_k_oper_only = masked;
map_oper_only = no;
operspy_admin_only = no;
operspy_dont_care_user_info = no;
caller_id_wait = 1 minute;
pace_wait_simple = 1 second;
pace_wait = 10 seconds;
short_motd = no;
ping_cookie = no;
connect_timeout = 30 seconds;
default_ident_timeout = 5;
disable_auth = no;
no_oper_flood = yes;
max_targets = 4;
client_flood_max_lines = 20;
post_registration_delay = 0 seconds;
use_whois_actually = no;
oper_only_umodes = operwall, locops, servnotice;
oper_umodes = locops, servnotice, operwall, wallop;
oper_snomask = "+s";
burst_away = yes;
nick_delay = 0 seconds; # 15 minutes if you want to enable this
reject_ban_time = 1 minute;
reject_after_count = 3;
reject_duration = 5 minutes;
throttle_duration = 60;
throttle_count = 4;
max_ratelimit_tokens = 30;
away_interval = 30;
certfp_method = sha512;
hide_opers_in_whois = no;
tls_ciphers_oper_only = no;
};
modules {
path = "modules";
path = "modules/autoload";
};

19
motd.j2 Normal file
View file

@ -0,0 +1,19 @@
Welcome to
▌ ▌▞▀▖
▚▗▘▙▄▌ vulpineawoo
▝▞ ▌ ▌ running sandcat-approved software since 2019
▘ ▘ ▘
You are connected to {{ inventory_hostname }}{% if sponsor is defined %}, donated by {{ sponsor }}{% endif %}
Other servers on the network:
{% for host in ansible_play_hosts %}
{% if host != inventory_hostname %}
- {{ host }}
{% endif %}
{% endfor %}
Pop in #vulpineawoo for help, or do /list for a list of channels.

6
openrc.j2 Normal file
View file

@ -0,0 +1,6 @@
#!/sbin/openrc-run
name="solanum ircd"
command="/home/ircd/ircd/bin/solanum -pidfile /var/run/solanum-ircd"
command_user="ircd"
pidfile="/var/run/solanum-ircd"

0
operator.j2 Normal file
View file

99
solanum.yml Normal file
View file

@ -0,0 +1,99 @@
- hosts: testnet
tasks:
- name: install dependencies for alpine
package:
name: sudo,musl-dev,libressl-dev,make,automake,gcc,curl,git,byacc,flex,libtool,sqlite-dev,autoconf,util-linux
state: present
when: ansible_distribution == 'Alpine'
- name: install dependencies for debian
package:
name: sudo,buildessential,autotools-dev,automake,cmake,make,libtool,byacc,flex,openssl-dev,sqlite3
state: present
when: ansible_distribution == 'Debian'
- name: create ircd user
user:
name: ircd
- name: download solanum
git:
repo: 'https://github.com/vulpineawoo/solanum'
dest: /home/ircd/solanum
become: yes
become_user: ircd
- name: check if autogen needed
stat:
path: /home/ircd/solanum/configure
register: alreadyautogen
- name: autogen
command: ./autogen.sh
args:
chdir: /home/ircd/solanum
become: yes
become_user: ircd
when: not alreadyautogen.stat.exists
- name: configure
command: ./configure
args:
chdir: /home/ircd/solanum
become: yes
become_user: ircd
when: not alreadyautogen.stat.exists
- name: make
make:
chdir: /home/ircd/solanum
become: yes
become_user: ircd
- name: make install
make:
chdir: /home/ircd/solanum
target: install
become: yes
become_user: ircd
- name: check for ssl cert
stat:
path: /home/ircd/ircd/etc/ssl.pem
register: ssl_exists
- name: get ssl fingerprint
command: /home/ircd/ircd/bin/solanum-mkfingerprint sha512 /home/ircd/ircd/etc/ssl.pem
register: ssl_fingerprint
when: ssl_exists.stat.exists
- name: create ircd.conf
template:
src: ircd.j2
dest: /home/ircd/ircd/etc/ircd.conf
- name: create ircd.motd
template:
src: motd.j2
dest: /home/ircd/ircd/etc/ircd.motd
- name: create openrc service
template:
src: openrc.j2
dest: /etc/init.d/solanum
mode: 0755
when: ansible_distribution == 'Alpine'
- name: create systemd service
template:
src: systemd.j2
dest: /etc/systemd/system/solnum.service
mode: 0755
when: ansible_distribution == 'Debian'
- name: enable service
service:
name: solanum
state: reloaded
enabled: yes

10
systemd.j2 Normal file
View file

@ -0,0 +1,10 @@
[Unit]
Description=solanum ircd
[Service]
Type=forking
User=ircd
ExecStart=/home/ircd/ircd/bin/solanum
[Install]
WantedBy=default.target