Kapisi/roles/IRC/templates/inspircd/inspircd.conf.j2

#-#-#-#-#-#-#-#-#-#  INCLUDE CONFIGURATION  #-#-#-#-#-#-#-#-#-#-#-#-#-#
#<include file="file.conf">                                           #
#<include executable="/path/to/executable parameters">                #
#<include executable="/usr/bin/wget -q -O - http://example.com/inspircd.conf">
<include file="/etc/inspircd/opers.conf">
<include file="/etc/inspircd/links.conf">
<include file="/etc/inspircd/modules.conf">
<files motd="/etc/inspircd/motd.txt" rules="/etc/inspircd/rules.txt">


#-#-#-#-#-#-#-#-#-#-#-#  VARIABLE DEFINITIONS  -#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# You can define variables that will be substituted later in the      #
# configuration file. This can be useful to allow settings to be      #
# easily changed, or to parameterize a remote includes.               #
#                                                                     #
# Variables may be redefined and may reference other variables.       #
# Value expansion happens at the time the tag is read.                #
#                                                                     #
# Using variable definitions REQUIRES that the config format be       #
# changed to "xml" from the default "compat" that uses escape         #
# sequences such as "\"" and "\n", and does not support <define>      #
<config format="xml">
#<define name="bindip" value="1.2.2.3">
#<define name="localips" value="&bindip;/24">

#-#-#-#-#-#-#-#-#-#-#-#-  SERVER DESCRIPTION  -#-#-#-#-#-#-#-#-#-#-#-#-
#                                                                     #
#   Here is where you enter the information about your server.        #
#                                                                     #
<server
        name="{{ external_domain }}"
        description="{{ organization['displayname'] }}/IRC"
        #id="97K"
        network="{{ organization['displayname'] }}/IRC">


#-#-#-#-#-#-#-#-#-#-#-#-   ADMIN INFORMATION   -#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
#   Describes the Server Administrator's real name (optionally),      #
#   nick, and email address.                                          #
#                                                                     #
<admin
       name="{{ organization['admin'] }}"
       nick="{{ organization['admin'] }}"
       email="{{ organization['email'] }}">

#-#-#-#-#-#-#-#-#-#-#-#-   PORT CONFIGURATION   -#-#-#-#-#-#-#-#-#-#-#-
#                                                                     #
#   Enter the port and address bindings here.                         #
#                                                                     #
#                                                                     j
<define name="subnetips" value="10.0.1.0/24">
<define name="localhost" value="127.0.0.1/32">

<bind
      address=""
      port="6697"
      sslprofile="clients"
      type="clients">

<bind address="" port="6667" type="clients">

<bind address="" port="8067" type="servers">

<openssl onrehash="yes">

<sslprofile
      name="clients"
      provider="openssl"
      cafile="/etc/letsencrypt/live/{{ ssl['identity'] }}/fullchain.pem"
      certfile="/etc/letsencrypt/live/{{ ssl['identity'] }}/cert.pem"
      keyfile="/etc/letsencrypt/live/{{ ssl['identity'] }}/privkey.pem"
      ciphers="{{ ssl['ciphersuite'] }}"
      hash="sha256"
      renegotiation="no"
      requestclientcert="no"
      sslv3="no"
      tlsv1="no"
      tlsv11="no"
      tlsv12="yes"
      tlsv13="yes">



#-#-#-#-#-#-#-#-#-#-  CONNECTIONS CONFIGURATION  -#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
#   This is where you can configure which connections are allowed     #
#   and denied access onto your server. The password is optional.     #
#   You may have as many of these as you require. To allow/deny all   #
#   connections, use a '*' or 0.0.0.0/0.                              #
#                                                                     #
#  -- It is important to note that connect tags are read from the  -- #
#     TOP DOWN. This means that you should have more specific deny    #
#    and allow tags at the top, progressively more general, followed  #
#        by a <connect allow="*" (should you wish to have one).       #
#                                                                     #
# Connect blocks are searched twice for each user - once when the TCP #
# connection is accepted, and once when the user completes their      #
# registration. Most of the information (hostname, ident response,    #
# password, SSL when using STARTTLS, etc) is only available during    #
# the second search, so if you are trying to make a closed server,    #
# you will probably need a connect block just for user registration.  #
# This can be done by using <connect registered="no">                 #

#<connect deny="192.0.2.*">
#<connect deny="3ffe::0/32" reason="The 6bone address space is deprecated">
<connect
         name="local"
         parent="main"
         allow="127.0.0.1"
         localmax="20"
         globalmax="20"
         limit="20"
         requiressl="off"
         threshold="200"
         port="6667">
<connect
         name="main"
         allow="*"
         commandrate="1000"
         fakelag="on"
         globalmax="500"
         hardsendq="1M"
         limit="500"
         localmax="500"
         maxconnwarn="on"
         modes="+wx"
         pingfreq="120"
         port="6697"
         recvq="8192"
         requiressl="on"
         resolvehostnames="on"
         softsendq="8192"
         threshold="25"
         timeout="10"
         useident="no">

#-#-#-#-#-#-#-#-#-#-#-#-  CIDR CONFIGURATION   -#-#-#-#-#-#-#-#-#-#-#-
#                                                                     #
# CIDR configuration allows detection of clones and applying of       #
# throttle limits across a CIDR range. (A CIDR range is a group of    #
# IPs, for example, the CIDR range 192.168.1.0-192.168.1.255 may be   #
# represented as 192.168.1.0/24). This means that abuse across an ISP #
# is detected and curtailed much easier. Here is a good chart that    #
# shows how many IPs the different CIDRs correspond to:               #
# http://en.wikipedia.org/wiki/CIDR#Prefix_aggregation                #
#                                                                     #
<cidr
      # ipv4clone: specifies how many bits of an IP address should be
      # looked at for clones. The default only looks for clones on a
      # single IP address of a user. You do not want to set this
      # extremely low. (Values are 0-32).
      ipv4clone="32"
      # ipv6clone: specifies how many bits of an IP address should be
      # looked at for clones. The default only looks for clones on a
      # single IP address of a user. You do not want to set this
      # extremely low. (Values are 0-128).
      ipv6clone="128">

#-#-#-#-#-#-#-#-#-#-#-# MAXIMUM CHANNELS -#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
<channels users="20" opers="60">

#-#-#-#-#-#-#-#-#-#-#-#-#-#-# DNS SERVER -#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# If these values are not defined, InspIRCd uses the default DNS resolver
# of your system.
#<dns server="127.0.0.1" timeout="5">
#<dns server="::1" timeout="5">

#-#-#-#-#-#-#-#-#-#-#-#-#-#-#  PID FILE  -#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# Define the path to the PID file here. The PID file can be used to   #
# rehash the ircd from the shell or to terminate the ircd from the    #
# shell using shell scripts, perl scripts, etc... and to monitor the  #
# ircd's state via cron jobs. If this is a relative path, it will be  #
# relative to the configuration directory, and if it is not defined,  #
# the default of 'inspircd.pid' is used.                              #
#                                                                     #
<pid file="/var/lib/inspircd/inspircd.pid">

#-#-#-#-#-#-#-#-#-#-#-#-#- BANLIST LIMITS #-#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# Use these tags to customise the ban limits on a per channel basis.  #
# The tags are read from top to bottom, and any tag found which       #
# matches the channels name applies the banlimit to that channel.     #
# It is advisable to put an entry with the channel as '*' at the      #
# bottom of the list. If none are specified or no maxbans tag is      #
# matched, the banlist size defaults to 64 entries.                   #
#                                                                     #
#<banlist chan="#largechan" limit="128">
<maxlist chan="*" limit="60">

#-#-#-#-#-#-#-#-#-#-#-  DISABLED FEATURES  -#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# This tag is optional, and specifies one or more features which are  #
# not available to non-operators.                                     #
#                                                                     #
# For example you may wish to disable NICK and prevent non-opers from #
# changing their nicknames.                                           #
# Note that any disabled commands take effect only after the user has #
# 'registered' (e.g. after the initial USER/NICK/PASS on connection)  #
# so for example disabling NICK will not cripple your network.        #
#                                                                     #
# You can also define if you want to disable any channelmodes         #
# or usermodes from your users.                                       #
#                                                                     #
# `fakenonexistant' will make the ircd pretend that nonexistant       #
# commands simply don't exist to non-opers ("no such command").       #
#                                                                     #
#<disabled commands="TOPIC MODE" usermodes="" chanmodes="" fakenonexistant="yes">


#-#-#-#-#-#-#-#-#-#-#-#-#-  SERVER OPTIONS   -#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
#   Settings to define which features are usable on your server.      #
#                                                                     #

<options
         # prefixquit: What (if anything) users' quit messages
         # should be prefixed with.
         prefixquit="Quit: "

         # suffixquit: What (if anything) users' quit messages
         # should be suffixed with.
         suffixquit=""

         # prefixpart: What (if anything) users' part messages
         # should be prefixed with.
         prefixpart="&quot;"
         # NOTE: Use "\"" instead of "&quot;" if not using <config format="xml">

         # suffixpart: What (if anything) users' part message
         # should be suffixed with.
         suffixpart="&quot;"

         # fixedquit: Set all users' quit messages to this value.
         #fixedquit=""

         # fixedpart: Set all users' part messages in all channels
         # to this value.
         #fixedpart=""

         # syntaxhints: If enabled, if a user fails to send the correct parameters
         # for a command, the ircd will give back some help text of what
         # the correct parameters are.
         syntaxhints="no"

         # cyclehosts: If enabled, when a user gets a host set, it will cycle
         # them in all their channels. If not, it will simply change their host
         # without cycling them.
         cyclehosts="no"

         # cyclehostsfromuser: If enabled, the source of the mode change for
         # cyclehosts will be the user who cycled. This can look nicer, but
         # triggers anti-takeover mechanisms of some obsolete bots.
         cyclehostsfromuser="no"

         # ircumsgprefix: Use undernet-style message prefixing for NOTICE and
         # PRIVMSG. If enabled, it will add users' prefix to the line, if not,
         # it will just message the user normally.
         ircumsgprefix="no"

         # announcets: If set to yes, when the timestamp on a channel changes, all users
         # in the channel will be sent a NOTICE about it.
         announcets="yes"

         # allowmismatch: Setting this option to yes will allow servers to link even
         # if they don't have the same "optionally common" modules loaded. Setting this to
         # yes may introduce some desyncs and unwanted behaviour.
         allowmismatch="no"

         # defaultbind: Sets the default for <bind> tags without an address. Choices are
         # ipv4 or ipv6; if not specified, IPv6 will be used if your system has support,
         # falling back to IPv4 otherwise.
         defaultbind="auto"

         # hostintopic: If enabled, channels will show the host of the topic setter
         # in the topic. If set to no, it will only show the nick of the topic setter.
         hostintopic="yes"

         # pingwarning: If a server does not respond to a ping within x seconds,
         # it will send a notice to opers with snomask +l informing that the server
         # is about to ping timeout.
         pingwarning="15"

         # serverpingfreq: How often pings are sent between servers (in seconds).
         serverpingfreq="60"

         # defaultmodes: What modes are set on a empty channel when a user
         # joins it and it is unregistered.
         defaultmodes="not"

         # moronbanner: This is the text that is sent to a user when they are
         # banned from the server.
         moronbanner="You're banned! Contact {{ organization['email'] }} with the ERROR line below for help."

         # exemptchanops: exemptions for channel access restrictions based on prefix.
         exemptchanops="nonick:v flood:o"

         # invitebypassmodes: This allows /invite to bypass other channel modes.
         # (Such as +k, +j, +l, etc.)
         invitebypassmodes="yes"

         # nosnoticestack: This prevents snotices from 'stacking' and giving you
         # the message saying '(last message repeated X times)'. Defaults to no.
         nosnoticestack="no"

         # welcomenotice: When turned on, this sends a NOTICE to connecting users
         # with the text Welcome to <networkname>! after successful registration.
         # Defaults to yes.
         welcomenotice="yes">


#-#-#-#-#-#-#-#-#-#-#-# PERFORMANCE CONFIGURATION #-#-#-#-#-#-#-#-#-#-#
#                                                                     #

<performance
             # netbuffersize: Size of the buffer used to receive data from clients.
             # The ircd may only read this amount of text in 1 go at any time.
             netbuffersize="10240"

             # somaxconn: The maximum number of connections that may be waiting
             # in the accept queue. This is *NOT* the total maximum number of
             # connections per server. Some systems may only allow this to be up
             # to 5, while others (such as Linux and *BSD) default to 128.
             somaxconn="128"

             # limitsomaxconn: By default, somaxconn (see above) is limited to a
             # safe maximum value in the 2.0 branch for compatibility reasons.
             # This setting can be used to disable this limit, forcing InspIRCd
             # to use the value specified above.
             limitsomaxconn="true"

             # softlimit: This optional feature allows a defined softlimit for
             # connections. If defined, it sets a soft max connections value.
             softlimit="1024"

             # quietbursts: When syncing or splitting from a network, a server
             # can generate a lot of connect and quit messages to opers with
             # +C and +Q snomasks. Setting this to yes squelches those messages,
             # which makes it easier for opers, but degrades the functionality of
             # bots like BOPM during netsplits.
             quietbursts="yes">

#-#-#-#-#-#-#-#-#-#-#-# SECURITY CONFIGURATION  #-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #

<security

          # announceinvites: This option controls which members of the channel
          # receive an announcement when someone is INVITEd. Available values:
          # 'none' - don't send invite announcements
          # 'all' - send invite announcements to all members
          # 'ops' - send invite announcements to ops and higher ranked users
          # 'dynamic' - send invite announcements to halfops (if available) and
          #             higher ranked users. This is the recommended setting.
          announceinvites="dynamic"

          # hidemodes: If enabled, then the listmodes given will be hidden
          # from users below halfop. This is not recommended to be set on +b
          # as it may break some functionality in popular clients such as mIRC.
          hidemodes="eI"

          # hideulines: If this value is set to yes, U-lined servers will
          # be hidden from non-opers in /links and /map.
          hideulines="no"

          # flatlinks: If this value is set to yes, /map and /links will
          # be flattened when shown to non-opers.
          flatlinks="no"

          # hidewhois: When defined, the given text will be used in place
          # of the server a user is on when whoised by a non-oper. Most
          # networks will want to set this to something like "*.netname.net"
          # to conceal the actual server a user is on.
          # Note that enabling this will cause users' idle times to only be
          # shown when the format /WHOIS <nick> <nick> is used.
          hidewhois=""

          # hidebans: If this value is set to yes, when a user is banned ([gkz]lined)
          # only opers will see the ban message when the user is removed
          # from the server.
          hidebans="no"

          # hidekills: If defined, replaces who set a /kill with a custom string.
          hidekills=""

          # hidesplits: If enabled, non-opers will not be able to see which
          # servers split in a netsplit, they will only be able to see that one
          # occurred (If their client has netsplit detection).
          hidesplits="yes"

          # maxtargets: Maximum number of targets per command.
          # (Commands like /notice, /privmsg, /kick, etc)
          maxtargets="20"

          # customversion: Displays a custom string when a user /version's
          # the ircd. This may be set for security reasons or vanity reasons.
          customversion=""

          # operspywhois: show opers (users/auspex) the +s channels a user is in. Values:
          #  splitmsg  Split with an explanatory message
          #  yes       Split with no explanatory message
          #  no        Do not show
          operspywhois="yes"

          # runasuser: If this is set, InspIRCd will attempt to switch
          # to run as this user, which allows binding of ports under 1024.
          # You should NOT set this unless you are starting as root.
          # NOT SUPPORTED/NEEDED UNDER WINDOWS.
          #runasuser="ircd"

          # runasgroup: If this is set, InspIRCd will attempt to switch
          # to run as this group, which allows binding of ports under 1024.
          # You should NOT set this unless you are starting as root.
          # NOT SUPPORTED/NEEDED UNDER WINDOWS.
          #runasgroup="ircd"

          # restrictbannedusers: If this is set to yes, InspIRCd will not allow users
          # banned on a channel to change nickname or message channels they are
          # banned on.
          restrictbannedusers="yes"

          # genericoper: Setting this value to yes makes all opers on this server
          # appear as 'is an IRC operator' in their WHOIS, regardless of their
          # oper type, however oper types are still used internally. This only
          # affects the display in WHOIS.
          genericoper="no"

          # userstats: /stats commands that users can run (opers can run all).
          userstats="Pu">

#-#-#-#-#-#-#-#-#-#-#-#-# LIMITS CONFIGURATION  #-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# This configuration tag defines the maximum sizes of various types   #
# on IRC, such as the maximum length of a channel name, and the       #
# maximum length of a channel. Note that with the exception of the    #
# identmax value all values given here are the exact values you would #
# expect to see on IRC. This contrasts with the older InspIRCd        #
# releases where these values would be one character shorter than     #
# defined to account for a null terminator on the end of the text.    #
#                                                                     #
# These values should match network-wide otherwise issues will occur. #
#                                                                     #
# The highest safe value you can set any of these options to is 500,  #
# but it is recommended that you keep them somewhat                   #
# near their defaults (or lower).                                     #

<limits
        # maxnick: Maximum length of a nickname.
        maxnick="12"

        # maxchan: Maximum length of a channel name.
        maxchan="20"

        # maxmodes: Maximum number of mode changes per line.
        maxmodes="20"

        # maxident: Maximum length of a ident/username.
        maxident="64"

        # maxquit: Maximum length of a quit message.
        maxquit="255"

        # maxtopic: Maximum length of a channel topic.
        maxtopic="307"

        # maxkick: Maximum length of a kick message.
        maxkick="255"

        # maxgecos: Maximum length of a GECOS (realname).
        maxgecos="128"

        # maxaway: Maximum length of an away message.
        maxaway="200">


#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# Logging
# -------
#
# Logging is covered with the <log> tag, which you may use to change
# the behaviour of the logging of the IRCd.
#
# In InspIRCd as of 1.2, logging is pluggable and very extensible.
# Different files can log the same thing, different 'types' of log can
# go to different places, and modules can even extend the log tag
# to do what they want.
#
# An example log tag would be:
#  <log method="file" type="OPER" level="default" target="logs/opers.log">
# which would log all information on /oper (failed and successful) to
# a file called opers.log.
#
# There are many different types which may be used, and modules may
# generate their own. A list of useful types:
#  - USERS - information relating to user connection and disconnection
#  - OPER - succesful and failed oper attempts
#  - KILL - kill related messages
#  - snomask - server notices (*all* snomasks will be logged)
#  - FILTER - messages related to filter matches (m_filter)
#  - CONFIG - configuration related messages
#  - COMMAND - die and restart messages, and messages related to unknown user types
#  - SOCKET - socket engine informational/error messages
#  - MODULE - module related messages
#  - STARTUP - messages related to starting up the server
#
# You may also log *everything* by using a type of *, and subtract things out
# of that by using -TYPE - for example "* -USERINPUT -USEROUTPUT".
#
# Useful levels are:
#  - default (general messages, including errors)
#  - sparse (misc error messages)
#  - debug (debug messages)
#
# Some types only produce output in the debug level, those are:
#  - BANCACHE - ban cache debug messages
#  - CHANNELS - information relating to joining/creating channels
#  - CULLLIST - debug messages related to issues with removing users
#  - RESOLVER - DNS related debug messages
#  - CONNECTCLASS - Connection class debug messages
#  - USERINPUT
#  - USEROUTPUT
#
# The following log tag is highly default and uncustomised. It is recommended you
# sort out your own log tags. This is just here so you get some output.

<log method="file" type="* -USERINPUT -USEROUTPUT" level="default" target="/var/log/ircd.log">

#-#-#-#-#-#-#-#-#-#-#-#-#-  WHOWAS OPTIONS   -#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# This tag lets you define the behaviour of the /whowas command of    #
# your server.                                                        #
#                                                                     #

<whowas
        # groupsize: Maximum entries per nick shown when performing
        # a /whowas nick.
        groupsize="10"

        # maxgroups: Maximum number of nickgroups that can be added to
        # the list so that /whowas does not use a lot of resources on
        # large networks.
        maxgroups="100000"

        # maxkeep: Maximum time a nick is kept in the whowas list
        # before being pruned. Time may be specified in seconds,
        # or in the following format: 1y2w3d4h5m6s. Minimum is
        # 1 hour.
        maxkeep="1d">

#-#-#-#-#-#-#-#-#-#-#-#-#-#-  BAN OPTIONS  -#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# The ban tags define nick masks, host masks and ip ranges which are  #
# banned from your server. All details in these tags are local to     #
# Your server.                                                        #
#                                                                     #

#<badip ipmask="192.0.2.*" reason="Nope.">
<badnick nick="*Serv" reason="Reserved for Services">
<badhost host="*@*malware*" reason="Malware">
<badhost host="root@*" reason="Don't IRC as root!">
<exception host="{{ organization['admin'] }}@localhost" reason="localhost">
<exception host="{{ organization['admin'] }}@127.0.0.1" reason="localhost">
<exception host="{{ organization['admin'] }}@{{ external_domain }}" reason="localhost">
<exception host="{{ organization['admin'] }}@*.{{ external_domain }}" reason="localhost">

#-#-#-#-#-#-#-#-#-#-#- INSANE BAN OPTIONS  -#-#-#-#-#-#-#-#-#-#-#-#-#-#
#                                                                     #
# This optional tag allows you to specify how wide a gline, eline,    #
# kline, zline or qline can be before it is forbidden from being      #
# set. By setting hostmasks="yes", you can allow all G, K, E lines,   #
# no matter how many users the ban would cover. This is not           #
# recommended! By setting ipmasks="yes", you can allow all Z lines,   #
# no matter how many users these cover too. Needless to say we        #
# don't recommend you do this, or, set nickmasks="yes", which will    #
# allow any qline.                                                    #
#                                                                     #
<insane
        # hostmasks: Allow bans with insane hostmasks. (over-reaching bans)
        hostmasks="no"
        # ipmasks: Allow bans with insane ipmasks. (over-reaching bans)
        ipmasks="no"
        # nickmasks: Allow bans with insane nickmasks. (over-reaching bans)
        nickmasks="no"
        # trigger: What percentage of users on the network to trigger
        # specifying an insane ban as. The default is 95.5%, which means
        # if you have a 1000 user network, a ban will not be allowed if it
        # will be banning 955 or more users.
        trigger="99">

#########################################################################
#                                                                       #
#                     - InspIRCd Development Team -                     #
#                        http://www.inspircd.org                        #
#                                                                       #
#########################################################################