init

.gitignore

@@ -0,0 +1 @@
+hosts

auth.j2

@@ -0,0 +1,56 @@
+/* auth {}: allow users to connect to the ircd (OLD I:)
+ * auth {} blocks MUST be specified in order of precedence.  The first one
+ * that matches a user will be used.  So place spoofs first, then specials,
+ * then general access, then restricted.
+ */
+auth {
+        /* user: the user@host allowed to connect.  Multiple IPv4/IPv6 user
+         * lines are permitted per auth block.  This is matched against the
+         * hostname and IP address (using :: shortening for IPv6 and
+         * prepending a 0 if it starts with a colon) and can also use CIDR
+         * masks.
+         */
+        user = "*@198.51.100.0/24";
+        user = "*test@2001:db8:1:*";
+
+        /* password: an optional password that is required to use this block.
+         * By default this is not encrypted, specify the flag "encrypted" in
+         * flags = ...; below if it is.
+         */
+        password = "letmein";
+       /* spoof: fake the users user@host to be be this.  You may either
+         * specify a host or a user@host to spoof to.  This is free-form,
+         * just do everyone a favour and dont abuse it. (OLD I: = flag)
+         */
+        spoof = "I.still.hate.packets";
+
+        /* Possible flags in auth:
+         *
+         * encrypted                  | password is encrypted with mkpasswd
+         * spoof_notice               | give a notice when spoofing hosts
+         * exceed_limit (old > flag)  | allow user to exceed class user limits
+         * kline_exempt (old ^ flag)  | exempt this user from k/g/xlines,
+         *                            | dnsbls, and proxies
+         * proxy_exempt               | exempt this user from proxies
+         * dnsbl_exempt               | exempt this user from dnsbls
+         * spambot_exempt             | exempt this user from spambot checks
+         * shide_exempt               | exempt this user from serverhiding
+         * jupe_exempt                | exempt this user from generating
+         *                              warnings joining juped channels
+         * resv_exempt                | exempt this user from resvs
+         * flood_exempt               | exempt this user from flood limits
+         *                              USE WITH CAUTION.
+         * no_tilde     (old - flag)  | don't prefix ~ to username if no ident
+         * need_ident   (old + flag)  | require ident for user in this class
+         * need_ssl                   | require SSL/TLS for user in this class
+         * need_sasl                  | require SASL id for user in this class
+         */
+        flags = kline_exempt, exceed_limit;
+        class = "opers";
+};
+
+auth {
+	user = "*@*";
+	class = "users";
+};
+

class.j2

@@ -0,0 +1,30 @@
+/* class {} blocks MUST be specified before anything that uses them.  That
+ * means they must be defined before auth {} and before connect {}.
+ */
+class "users" {
+	ping_time = 2 minutes;
+	number_per_ident = 10;
+	number_per_ip = 10;
+	number_per_ip_global = 50;
+	cidr_ipv4_bitlen = 24;
+	cidr_ipv6_bitlen = 64;
+	number_per_cidr = 200;
+	max_number = 3000;
+	sendq = 400 kbytes;
+};
+
+class "opers" {
+	ping_time = 5 minutes;
+	number_per_ip = 100;
+	max_number = 1000;
+	sendq = 1 megabyte;
+};
+
+class "server" {
+	ping_time = 5 minutes;
+	connectfreq = 5 minutes;
+	max_autoconn = 10;
+	max_number = 100;
+	sendq = 4 megabytes;
+};
+

connect.j2

@@ -0,0 +1,27 @@
+{% for host in ansible_play_hosts %}
+{% if host != inventory_hostname %}
+connect "{{ host }}" {
+	host = "{% if hostvars[host]['pahost'] is defined %}{{ hostvars[host]['pahost'] }}{% else %}{{ host }}{% endif %}";
+	send_password = "{{ hostvars[host]['linkpass'] }}";
+	accept_password = "{{ linkpass }}";
+	port = {% if hostvars[host]['paport'] is defined %}{{ hostvars[host]['paport'] }}{% else %}6697{% endif %};
+	class = "server";
+{% if hostvars[host]['ssl_exists']['stat']['exists'] %}
+	fingerprint = "{{ hostvars[host]['ssl_fingerprint']['stdout'] }}";
+{% endif %}
+	flags = {% if hostvars[host]['paport'] is not defined or hostvars[host]['paport'] != 6667 %}ssl, {% endif %}topicburst{% if autoconn is defined and autoconn == host %}, autoconn{% endif %};
+};
+{% endif %}
+{% endfor %}
+
+{% if services is defined %}
+connect "services." {
+	host = "127.0.0.1";
+	send_password = "{{ services }}";
+	accept_password = "{{ services }}";
+	port = 6667;
+	class = "server";
+	flags = topicburst;
+};
+{% endif %}
+

ircd.j2

@@ -0,0 +1,281 @@
+
+/* Extensions */
+loadmodule "extensions/chm_nonotice";
+loadmodule "extensions/chm_operpeace";
+loadmodule "extensions/chm_operonly";
+loadmodule "extensions/extb_account";
+loadmodule "extensions/extb_canjoin";
+loadmodule "extensions/extb_channel";
+loadmodule "extensions/extb_combi";
+loadmodule "extensions/extb_extgecos";
+loadmodule "extensions/extb_hostmask";
+loadmodule "extensions/extb_oper";
+loadmodule "extensions/extb_realname";
+loadmodule "extensions/extb_server";
+loadmodule "extensions/extb_ssl";
+loadmodule "extensions/extb_usermode";
+loadmodule "extensions/helpops";
+loadmodule "extensions/hurt";
+loadmodule "extensions/m_extendchans";
+loadmodule "extensions/m_findforwards";
+loadmodule "extensions/m_identify";
+loadmodule "extensions/m_locops";
+loadmodule "extensions/sno_farconnect";
+loadmodule "extensions/sno_globalkline";
+loadmodule "extensions/sno_globalnickchange";
+loadmodule "extensions/sno_globaloper";
+loadmodule "extensions/override";
+loadmodule "extensions/override_kick_immunity";
+
+serverinfo {
+	name = "{{ inventory_hostname }}";
+	sid = "{{ sid }}";
+	description = "{% if description is defined %}{{ description }}{% else %}solanum fox server{% endif %}";
+	network_name = "vulpineawoo";
+
+{% if ssl_exists.stat.exists %}
+	ssl_cert = "etc/ssl.pem";
+	ssl_private_key = "etc/ssl.key";
+	ssl_dh_params = "etc/dh.pem";
+	ssld_count = 1;
+
+{% endif %}
+	default_max_clients = 1024;
+	nicklen = 30;
+};
+
+admin {
+	name = "xfnw";
+	description = "friendly vulpine, requires payment in hugs.";
+	email = "xfnw@riseup.net";
+};
+
+{% include 'class.j2' %}
+
+listen {
+	defer_accept = yes;
+	port = 6667;
+{% if ssl_exists.stat.exists %}
+	sslport = 6697;
+	wsock = yes;
+	sslport = 7001;
+{% endif %}
+};
+
+{% include 'auth.j2' %}
+
+privset "wombat" {
+	privs = oper:general, oper:kline, oper:unkline, oper:xline, oper:kill, oper:testline, oper:privs,
+		oper:resv, oper:cmodes, oper:mass_notice, oper:remoteban, usermode:helpops, oper:message,
+		auspex:oper, auspex:hostname, auspex:umodes, auspex:cmodes, oper:receive_immunity, oper:wallops;
+};
+
+privset "dingo" {
+	extends = "wombat";
+	privs = oper:override, oper:ojoin, oper:operwall,
+		oper:dehelper, oper:massnotice, usermode:servnotice;
+};
+
+privset "shark" {
+	extends = "dingo";
+	privs = oper:kline, oper:remoteban, snomask:nick_changes;
+};
+
+privset "bandicoot" {
+	extends = "dingo";
+	privs = oper:routing;
+};
+
+privset "jellyfish" {
+	extends = "bandicoot";
+	privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:grant;
+};
+
+{% include 'operator.j2' %}
+
+{% include 'connect.j2' %}
+
+service {
+	name = "services.";
+};
+
+cluster {
+	name = "*";
+	flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv, all;
+};
+
+channel {
+	use_invex = yes;
+	use_except = yes;
+	use_forward = yes;
+	use_knock = yes;
+	knock_delay = 5 minutes;
+	knock_delay_channel = 1 minute;
+	max_chans_per_user = 150;
+	max_chans_per_user_large = 300;
+	max_bans = 100;
+	max_bans_large = 500;
+	default_split_user_count = 0;
+	default_split_server_count = 0;
+	no_create_on_split = no;
+	no_join_on_split = no;
+	burst_topicwho = yes;
+	kick_on_split_riding = no;
+	only_ascii_channels = no;
+	resv_forcepart = yes;
+	channel_target_change = yes;
+	disable_local_channels = no;
+	autochanmodes = "+nt";
+	displayed_usercount = 3;
+	strip_topic_colors = no;
+	opmod_send_statusmsg = no;
+};
+
+serverhide {
+	flatten_links = yes;
+	links_delay = 5 minutes;
+	hidden = no;
+	disable_hidden = no;
+};
+
+{% include 'dnsbl.j2' %}
+
+alias "NickServ" {
+	target = "NickServ";
+};
+
+alias "ChanServ" {
+	target = "ChanServ";
+};
+
+alias "OperServ" {
+	target = "OperServ";
+};
+
+alias "HostServ" {
+	target = "HostServ";
+};
+
+alias "MemoServ" {
+	target = "MemoServ";
+};
+
+alias "BotServ" {
+	target = "BotServ";
+};
+
+alias "CatServ" {
+	target = "CatServ";
+};
+
+alias "ALIS" {
+	target = "ALIS";
+};
+
+alias "NS" {
+	target = "NickServ";
+};
+
+alias "CS" {
+	target = "ChanServ";
+};
+
+alias "OS" {
+	target = "OperServ";
+};
+
+alias "HS" {
+	target = "HostServ";
+};
+
+alias "MS" {
+	target = "MemoServ";
+};
+
+alias "BS" {
+	target = "BotServ";
+};
+
+general {
+	hide_error_messages = opers;
+	hide_spoof_ips = yes;
+	default_umodes = "+";
+
+	default_operstring = "is an IRC Operator";
+	default_adminstring = "is a Server Administrator";
+	servicestring = "is a Network Service";
+
+	sasl_service = "SaslServ";
+	disable_fake_channels = no;
+	tkline_expire_notices = no;
+	default_floodcount = 10;
+	failed_oper_notice = yes;
+	dots_in_ident = 2;
+	min_nonwildcard = 4;
+	min_nonwildcard_simple = 3;
+	max_accept = 100;
+	max_monitor = 100;
+	anti_nick_flood = yes;
+	max_nick_time = 20 seconds;
+	max_nick_changes = 5;
+	anti_spam_exit_message_time = 5 minutes;
+	ts_warn_delta = 30 seconds;
+	ts_max_delta = 5 minutes;
+	client_exit = yes;
+	collision_fnc = yes;
+	resv_fnc = yes;
+	global_snotices = yes;
+	dline_with_reason = yes;
+	kline_with_reason = yes;
+	hide_tkdline_duration = no;
+	kline_reason = "K-Lined";
+	identify_service = "NickServ@services.";
+	identify_command = "IDENTIFY";
+	non_redundant_klines = yes;
+	warn_no_nline = yes;
+	use_propagated_bans = yes;
+	stats_e_disabled = no;
+	stats_c_oper_only = no;
+	stats_y_oper_only = no;
+	stats_o_oper_only = yes;
+	stats_P_oper_only = no;
+	stats_i_oper_only = masked;
+	stats_k_oper_only = masked;
+	map_oper_only = no;
+	operspy_admin_only = no;
+	operspy_dont_care_user_info = no;
+	caller_id_wait = 1 minute;
+	pace_wait_simple = 1 second;
+	pace_wait = 10 seconds;
+	short_motd = no;
+	ping_cookie = no;
+	connect_timeout = 30 seconds;
+	default_ident_timeout = 5;
+	disable_auth = no;
+	no_oper_flood = yes;
+	max_targets = 4;
+	client_flood_max_lines = 20;
+	post_registration_delay = 0 seconds;
+	use_whois_actually = no;
+	oper_only_umodes = operwall, locops, servnotice;
+	oper_umodes = locops, servnotice, operwall, wallop;
+	oper_snomask = "+s";
+	burst_away = yes;
+	nick_delay = 0 seconds; # 15 minutes if you want to enable this
+	reject_ban_time = 1 minute;
+	reject_after_count = 3;
+	reject_duration = 5 minutes;
+	throttle_duration = 60;
+	throttle_count = 4;
+	max_ratelimit_tokens = 30;
+	away_interval = 30;
+	certfp_method = sha512;
+	hide_opers_in_whois = no;
+	tls_ciphers_oper_only = no;
+};
+
+modules {
+	path = "modules";
+	path = "modules/autoload";
+};
+

motd.j2

@@ -0,0 +1,19 @@
+Welcome to
+
+ ▌ ▌▞▀▖
+ ▚▗▘▙▄▌ vulpineawoo
+ ▝▞ ▌ ▌   running sandcat-approved software since 2019
+  ▘ ▘ ▘ 
+
+You are connected to {{ inventory_hostname }}{% if sponsor is defined %}, donated by {{ sponsor }}{% endif %}
+
+
+Other servers on the network:
+{% for host in ansible_play_hosts %}
+{% if host != inventory_hostname %}
+ - {{ host }}
+{% endif %}
+{% endfor %}
+
+Pop in #vulpineawoo for help, or do /list for a list of channels.
+

openrc.j2

@@ -0,0 +1,6 @@
+#!/sbin/openrc-run
+
+name="solanum ircd"
+command="/home/ircd/ircd/bin/solanum -pidfile /var/run/solanum-ircd"
+command_user="ircd"
+pidfile="/var/run/solanum-ircd"

solanum.yml

@@ -0,0 +1,99 @@
+- hosts: testnet
+
+  tasks:
+    - name: install dependencies for alpine
+      package:
+        name: sudo,musl-dev,libressl-dev,make,automake,gcc,curl,git,byacc,flex,libtool,sqlite-dev,autoconf,util-linux
+        state: present
+      when: ansible_distribution == 'Alpine'
+
+    - name: install dependencies for debian
+      package:
+        name: sudo,buildessential,autotools-dev,automake,cmake,make,libtool,byacc,flex,openssl-dev,sqlite3
+        state: present
+      when: ansible_distribution == 'Debian'
+
+    - name: create ircd user
+      user:
+        name: ircd
+
+    - name: download solanum
+      git:
+        repo: 'https://github.com/vulpineawoo/solanum'
+        dest: /home/ircd/solanum
+      become: yes
+      become_user: ircd
+
+    - name: check if autogen needed
+      stat:
+        path: /home/ircd/solanum/configure
+      register: alreadyautogen
+
+    - name: autogen
+      command: ./autogen.sh
+      args:
+        chdir: /home/ircd/solanum
+      become: yes
+      become_user: ircd
+      when: not alreadyautogen.stat.exists
+
+    - name: configure
+      command: ./configure
+      args:
+        chdir: /home/ircd/solanum
+      become: yes
+      become_user: ircd
+      when: not alreadyautogen.stat.exists
+
+    - name: make
+      make:
+        chdir: /home/ircd/solanum
+      become: yes
+      become_user: ircd
+
+    - name: make install
+      make:
+        chdir: /home/ircd/solanum
+        target: install
+      become: yes
+      become_user: ircd
+
+    - name: check for ssl cert
+      stat:
+        path: /home/ircd/ircd/etc/ssl.pem
+      register: ssl_exists
+
+    - name: get ssl fingerprint
+      command: /home/ircd/ircd/bin/solanum-mkfingerprint sha512 /home/ircd/ircd/etc/ssl.pem
+      register: ssl_fingerprint
+      when: ssl_exists.stat.exists
+
+    - name: create ircd.conf
+      template:
+        src: ircd.j2
+        dest: /home/ircd/ircd/etc/ircd.conf
+
+    - name: create ircd.motd
+      template:
+        src: motd.j2
+        dest: /home/ircd/ircd/etc/ircd.motd
+
+    - name: create openrc service
+      template:
+        src: openrc.j2
+        dest: /etc/init.d/solanum
+        mode: 0755
+      when: ansible_distribution == 'Alpine'
+
+    - name: create systemd service
+      template:
+        src: systemd.j2
+        dest: /etc/systemd/system/solnum.service
+        mode: 0755
+      when: ansible_distribution == 'Debian'
+
+    - name: enable service
+      service:
+        name: solanum
+        state: reloaded
+        enabled: yes

systemd.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=solanum ircd
+
+[Service]
+Type=forking
+User=ircd
+ExecStart=/home/ircd/ircd/bin/solanum
+
+[Install]
+WantedBy=default.target