Configuration reference

Every configuration block and field echoIRCd understands. For the format itself and a quick start, see Configuration. Most options re-apply on echoircd rehash (SIGHUP) with no restart; the TLS certificate is re-read on rehash too.

Format#

echoIRCd config files use a block format: section { field value; field value; … }.

• One field per ; terminator; a block may span multiple lines.
• Comments: # and // for line comments, /* … */ for block comments. An inline # on an active line is treated as part of the value unless the value is quoted — quote values that contain #.
• Booleans are yes / no. A bare field with no value (e.g. operprefix;) enables it.
• Quoting: quote any value containing spaces or #.
• A legacy flat key = value format is also accepted; blocks are translated to flat keys internally, so the two are exactly equivalent.

Structural blocks (server, listen, tls, cloak, brand, oper, opertype, class, link, webirc, motd, opermotd) map their fields to specific keys. Grouping blocks (limits, timeouts, flood, connections, channels, users, opers, logging, modules, dns, antiabuse, restrictions, accounts, verification, reputation, securitygroups, websocket, sts, services, dnsbl, …) are cosmetic — each field inside is simply a flat key, so you could equally place it at top level.

Password fields accept plaintext, sha256:<hex>, pbkdf2:…, or a bcrypt $2b$ hash. Generate one with printf '%s' 'pw' | ./echoircd mkpasswd.

server#

Server identity (not repeatable).

listen#

A bound socket. Repeatable. ip "*" / "[::]" binds IPv4+IPv6 dual-stack.

tls#

TLS certificate (re-read on rehash).

brand#

Per-SNI branding — one daemon presenting multiple identities. A client that connected via this TLS SNI host sees this servername/network (welcome burst, ISUPPORT NETWORK=, numeric source) instead of the globals. Needs TLS+SNI. Repeatable.

motd / opermotd#

Lines of the MOTD (shown on connect) and the oper MOTD (/OPERMOTD). Each quoted line is one entry; repeatable.

oper#

An oper account. Repeatable. A block with neither password nor fingerprint is refused.

class#

A reusable capability class that opertypes compose. Repeatable.

opertype#

A named oper role (WHOIS "is a <title>"). Repeatable. Ships five: helpop, globop, admin, servadmin, netadmin (only netadmin holds every privilege).

link#

A trusted S2S peer. Repeatable.

services#

The linked server that handles SASL (client AUTHENTICATE is relayed to it). Unset = SASL disabled.

webirc#

Trusted web gateways (kiwiirc / CGI:IRC) that send WEBIRC with the real client's host+ip. Repeatable.

cloak#

Host cloaking for user mode +x.

dns#

Reverse-DNS and ident behaviour.

dnsbl#

A DNS blocklist checked on connect. Repeatable.

limits#

Advertised in ISUPPORT and enforced.

webpush_sub, webpush_vapid_file, webpush_database tune the Web Push key/store paths.

timeouts#

flood#

connections#

classes#

Per-class connection policy. connectclass is repeatable; each is a single quoted string (first match wins).

Tokens: allow=<mask[,mask]>, deny=yes, parent=<name>, requiressl=yes|trusted, password=<pw>, hash=<algo>, port=<p[,p]>, asn=<n[,n]>, localmax=<n>, globalmax=<n>, limit=<n>, maxchans=<n>, pingfreq=<s>, timeout=<s>, modes=<+modes>, recvq=<bytes>, softsendq=<bytes>, hardsendq=<bytes>, fakelag=no, penaltythreshold=<n>, commandrate=<s>, useident=yes, requireident=yes, resolvehostnames=no, maxconnwarn=yes. connectclass_required yes refuses clients that match no allow class.

sts#

Strict Transport Security. Off unless sts_duration > 0.

opers#

hidewhois_* sub-keys tune exactly which WHOIS lines (server, idle, secure) are hidden and whether opers/self see everything.

channelvis#

Restrict who sees a mode change or list mode, by rank. Repeatable.

channels#

users#

On-connect behaviour.

accounts#

Bridges IRCv3 draft/account-registration to an HTTP backend.

verification#

Anti-bot gates (reCAPTCHA / Cloudflare challenge). Keys: recaptcha, recaptcha_secret, recaptcha_url, recaptcha_issuer, recaptcha_ttl, recaptcha_message, recaptcha_whitelistports (repeatable) — and the matching cloudflare_* set.

antiabuse#

restrictions#

reputation#

Per-address scoring plus the y: score extban.

securitygroups#

Named groups usable as an extban (+b g:<name>). securitygroup is repeatable, each a quoted string: "<name> <criteria…>" where criteria include public, tls, insecure, account, unregistered, oper, exclude-oper, bot, webirc, mask=<glob>, exclude=<glob>, scoremin=<n>, scoremax=<n>, asn=<n[,n]>.

logging#

modules#

Extra features toggled here.

websocket#

Relevant only with a ws/wss listener.