Operators

Server operators are defined by oper blocks and typed by opertype blocks. An oper's power is the sum of three allow-lists: the commands they may run, the named privileges they hold, and the user/channel modes they may set. class blocks bundle those into reusable roles that opertypes compose.

Oper accounts#

An oper block ties a login to an opertype. Hash the password with echoircd mkpasswd. A block with neither a password nor a fingerprint is refused.

oper {
    name        "alice";
    password    "$2b$11$...";        # from: echoircd mkpasswd
    fingerprint "AA:BB:...";          # optional TLS client-cert (2FA, or alone)
    type        "netadmin";
    host        "*@192.0.2.0/24";
}

Then, as a client: /oper alice hunter2.

Classes and types#

A class is a reusable capability bundle; an opertype composes classes into a named WHOIS role.

class {
    name      "ban";
    commands  "KILL KLINE GLINE ZLINE";
    privs     "users/auspex channels/auspex";
    snomasks  "cdkx";
}

opertype {
    name    "helper";
    classes "auspex";
    modes   "+ih";
    title   "Help Operator";
}

Command and privilege lists are space-separated tokens: * grants everything, a - prefix removes one (* -KILL = everything except KILL). usermodes / chanmodes on a class limit which oper-only modes the type may set.

Built-in classes#

announce · ban · override · host · services · server · auspex — covering broadcast, X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass privileges respectively.

Built-in types#

Five ship ready to use (only netadmin holds every privilege):

Named privileges#

Privileges gate individual abilities. Assign them per class/type via privs; the daemon enforces them everywhere the ability is used.

An untyped ("legacy") oper — an oper block with no type — holds every command and privilege.