mike/biboumi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update to ergo 2.15+

Browse Source
This commit is contained in:
Luca Matei Pintilie
2025-10-12 18:01:47 +02:00
committed by mathieui
parent d3b3242874
commit 979ba96cb0
19 changed files with 78 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/end_to_end/ircd.yaml
+30 -101
View File
@@ -1,4 +1,4 @@
# oragono IRCd config
# ergo IRCd config
# network configuration
network:
@@ -33,7 +33,7 @@ server:
# 'proxy' should typically be false. It's only for Kubernetes-style load
# balancing that does not terminate TLS, but sends an initial PROXY line
# in plaintext.
proxy: false
proxy: false
# Example of a Unix domain socket for proxying:
# "/tmp/oragono_sock":
@@ -87,14 +87,15 @@ server:
# casemapping controls what kinds of strings are permitted as identifiers (nicknames,
# channel names, account names, etc.), and how they are normalized for case.
# with the recommended default of 'precis', utf-8 identifiers that are "sane"
# (according to RFC 8265) are allowed, and the server additionally tries to protect
# against confusable characters ("homoglyph attacks").
# the other options are 'ascii' (traditional ASCII-only identifiers), and 'permissive',
# which allows identifiers to contain unusual characters like emoji, but makes users
# vulnerable to homoglyph attacks. unless you're really confident in your decision,
# we recommend leaving this value at its default (changing it once the network is
# already up and running is problematic).
# the recommended default is 'ascii' (traditional ASCII-only identifiers).
# the other options are 'precis', which allows UTF8 identifiers that are "sane"
# (according to UFC 8265), with additional mitigations for homoglyph attacks,
# 'permissive', which allows identifiers containing unusual characters like
# emoji, at the cost of increased vulnerability to homoglyph attacks and potential
# client compatibility problems, and the legacy mappings 'rfc1459' and
# 'rfc1459-strict'. we recommend leaving this value at its default;
# however, note that changing it once the network is already up and running is
# problematic.
casemapping: "precis"
# whether to look up user hostnames with reverse DNS
@@ -109,12 +110,12 @@ server:
check-ident: false
# password to login to the server
# generated using "oragono genpasswd"
# generated using "ergo genpasswd"
#password: ""
# motd filename
# if you change the motd, you should move it to ircd.motd
motd:
# motd:
# motd formatting codes
# if this is true, the motd is escaped using formatting codes like $c, $b, and $i
@@ -136,7 +137,7 @@ server:
# (comment this out to use passwords only)
fingerprint: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"
# password the gateway uses to connect, made with oragono genpasswd
# password the gateway uses to connect, made with ergo genpasswd
password: "$2a$04$sLEFDpIOyUp55e6gTMKbOeroT6tMXTjPFvA0eGvwvImVR9pkwv7ee"
# addresses/CIDRs that can use this webirc command
@@ -209,42 +210,13 @@ server:
# IP cloaking hides users' IP addresses from other users and from channel admins
# (but not from server admins), while still allowing channel admins to ban
# offending IP addresses or networks. In place of hostnames derived from reverse
# DNS, users see fake domain names like pwbs2ui4377257x8.oragono. These names are
# DNS, users see fake domain names like pwbs2ui4377257x8.ergo. These names are
# generated deterministically from the underlying IP address, but if the underlying
# IP is not already known, it is infeasible to recover it from the cloaked name.
ip-cloaking:
# whether to enable IP cloaking
enabled: false
# fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.oragono
netname: "oragono"
# secret key to prevent dictionary attacks against cloaked IPs
# any high-entropy secret is valid for this purpose:
# you MUST generate a new one for your installation.
# suggestion: use the output of `oragono mksecret`
# note that rotating this key will invalidate all existing ban masks.
secret: "siaELnk6Kaeo65K3RCrwJjlWaZ-Bt3WuZ2L8MXLbNb4"
# name of an environment variable to pull the secret from, for use with
# k8s secret distribution:
# secret-environment-variable: "ORAGONO_CLOAKING_SECRET"
# the cloaked hostname is derived only from the CIDR (most significant bits
# of the IP address), up to a configurable number of bits. this is the
# granularity at which bans will take effect for IPv4. Note that changing
# this value will invalidate any stored bans.
cidr-len-ipv4: 32
# analogous granularity for IPv6
cidr-len-ipv6: 64
# number of bits of hash output to include in the cloaked hostname.
# more bits means less likelihood of distinct IPs colliding,
# at the cost of a longer cloaked hostname. if this value is set to 0,
# all users will receive simply `netname` as their cloaked hostname.
num-bits: 64
# secure-nets identifies IPs and CIDRs which are secure at layer 3,
# for example, because they are on a trusted internal LAN or a VPN.
# plaintext connections from these IPs and CIDRs will be considered
@@ -272,21 +244,6 @@ accounts:
# length of time a user has to verify their account before it can be re-registered
verify-timeout: "32h"
# callbacks to allow
enabled-callbacks:
- none # no verification needed, will instantly register successfully
# example configuration for sending verification emails via a local mail relay
# callbacks:
# mailto:
# server: localhost
# port: 25
# tls:
# enabled: false
# username: ""
# password: ""
# sender: "admin@my.network"
# throttle account login attempts (to prevent either password guessing, or DoS
# attacks on the server aimed at forcing repeated expensive bcrypt computations)
login-throttling:
@@ -343,10 +300,16 @@ accounts:
# rename-timeout - this is how long users have 'til they're renamed
rename-timeout: 30s
# rename-prefix - this is the prefix to use when renaming clients (e.g. Guest-AB54U31)
rename-prefix: Guest-
# format for guest nicknames:
# 1. these nicknames cannot be registered or reserved
# 2. if a client is automatically renamed by the server,
# this is the template that will be used (e.g., Guest-nccj6rgmt97cg)
# 3. if force-guest-format (see below) is enabled, clients without
# a registered account will have this template applied to their
# nicknames (e.g., 'katie' will become 'Guest-katie')
guest-nickname-format: Guest-*
# multiclient controls whether oragono allows multiple connections to
# multiclient controls whether ergo allows multiple connections to
# attach to the same client/nickname identity; this is part of the
# functionality traditionally provided by a bouncer like ZNC
multiclient:
@@ -379,27 +342,6 @@ accounts:
# (make sure any changes you make here are RFC-compliant)
valid-regexp: '^[0-9A-Za-z.\-_/]+$'
# options controlling users requesting vhosts:
user-requests:
# can users request vhosts at all? if this is false, operators with the
# 'vhosts' capability can still assign vhosts manually
enabled: false
# if uncommented, all new vhost requests will be dumped into the given
# channel, so opers can review them as they are sent in. ensure that you
# have registered and restricted the channel appropriately before you
# uncomment this.
#channel: "#vhosts"
# after a user's vhost has been approved or rejected, they need to wait
# this long (starting from the time of their original request)
# before they can request a new one.
cooldown: 168h
# vhosts that users can take without approval, using `/HS TAKE`
offer-list:
#- "oragono.test"
# support for deferring password checking to an external LDAP server
# you should probably ignore this section! consult the grafana docs for details:
# https://grafana.com/docs/grafana/latest/auth/ldap/
@@ -466,9 +408,8 @@ oper-classes:
# capability names
capabilities:
- "oper:local_kill"
- "oper:local_ban"
- "oper:local_unban"
- "kill"
- "ban"
- "nofakelag"
# network operator
@@ -479,12 +420,6 @@ oper-classes:
# oper class this extends from
extends: "local-oper"
# capability names
capabilities:
- "oper:remote_kill"
- "oper:remote_ban"
- "oper:remote_unban"
# server admin
"server-admin":
# title shown in WHOIS
@@ -495,8 +430,7 @@ oper-classes:
# capability names
capabilities:
- "oper:rehash"
- "oper:die"
- "rehash"
- "accreg"
- "sajoin"
- "samode"
@@ -522,7 +456,7 @@ opers:
# operators can be authenticated either by password (with the /OPER command),
# or by certificate fingerprint, or both. if a password hash is set, then a
# password is required to oper up (e.g., /OPER dan mypassword). to generate
# the hash, use `oragono genpasswd`.
# the hash, use `ergo genpasswd`.
password: "$2a$04$LiytCxaY0lI.guDj2pBN4eLRD5cdM2OLDwqmGAgB6M2OPirbF5Jcu"
# if a SHA-256 certificate fingerprint is configured here, then it will be
@@ -576,7 +510,7 @@ logging:
# debug options
debug:
# when enabled, oragono will attempt to recover from certain kinds of
# when enabled, ergo will attempt to recover from certain kinds of
# client-triggered runtime errors that would normally crash the server.
# this makes the server more resilient to DoS, but could result in incorrect
# behavior. deployments that would prefer to "start from scratch", e.g., by
@@ -606,7 +540,7 @@ datastore:
host: "localhost"
# port is unnecessary for connections via unix domain socket:
#port: 3306
user: "oragono"
user: "ergo"
password: "hunter2"
history-database: "oragono_history"
timeout: 3s
@@ -720,11 +654,6 @@ history:
# (and will eventually be deleted from persistent storage, if that's enabled)
#expire-time: 1w
# if this is set, logged-in users cannot retrieve messages older than their
# account registration date, and logged-out users cannot retrieve messages
# older than their sign-on time (modulo grace-period, see below):
enforce-registration-date: false
# but if this is set, you can retrieve messages that are up to `grace-period`
# older than the above cutoff time. this is recommended to allow logged-out
# users to do session resumption / query history after disconnections.