Running & config

echo services reads a single config.toml. Only [uplink] and [server] are required; every other section is optional and off when omitted. A few keys reload on OperServ REHASH (noted); the rest need a service restart.

echo config.toml

[uplink] — the ircd to link to (required)#

Key	Description
`host` / `port`	Uplink ircd address and S2S port
`password`	S2S link password
`tls`	Use TLS for the link; `true` pins the SPKI below
`spki_fingerprint`	Base64 SHA-256 of the uplink's SubjectPublicKeyInfo (when `tls=true`)

[server] — this node's identity (required)#

Key	Description
`name` / `sid`	Services server name and 3-char SID (unique)
`description`	Server description
`protocol`	InspIRCd link protocol (1206 = insp4, 1205 = insp3)
`scram_iterations`	PBKDF2 cost for new SCRAM verifiers (≥ 1000)
`guest_nick`	Nick prefix after `LOGOUT`
`service_host`	Host the pseudo-clients wear (empty = server name)
`service_modes`	User modes the service clients set (e.g. `iHkoB`)
`service_oper_type`	WHOIS "is a …" string
`services_channel`	Channel every pseudo-client joins
`standard_replies`	Use IRCv3 FAIL/WARN/NOTE instead of notices

[modules] — which services to start#

services is a list of module names to bring up; omit the section for the full standard suite: nickserv, chanserv, botserv, hostserv, memoserv, operserv, statserv, groupserv, infoserv, reportserv, helpserv, chanfix, diceserv, gameserv, debugserv.

[[oper]] — services operators (repeatable)#

Key	Description
`account`	Account granted operator access
`type`	Tier shortcut: `operator` < `administrator` < `root`
`privs`	Fine-grained privilege list (`auspex`, `oper`, `suspend`, `admin`, `root`)

Policy & lifecycle#

Section	Keys
`[register]`	`confusable_check`, `vouch` (REHASH-reloadable)
`[extban]`	`enabled` — which InspIRCd matching-extbans AKICK may use
`[auth]`	`external` — hand identity to an outside authority
`[expire]`	`accounts_days`, `channels_days`, `warn_days` (0 = never)
`[session]`	`default_limit` — per-IP connection limit
`[language]`	`default`, `dir`, `available` (ships en, fr, de, es, es-ar, pt, pt-br)
`[log]`	`channel`, `notify_exclude`

Email & web integration#

Section	Keys
`[email]`	`from`, `command` (mailer piped on stdin), `brand`, `accent`, `logo`, `confirm_url`
`[health]`	`bind` — `/health` + Prometheus `/metrics` (loopback, unauthenticated)
`[panel]`	`bind`, `brand` — self-contained web admin site (put behind a TLS proxy)
`[grpc]`	`bind`, `token`, `[grpc.tls]` — account/channel directory + Accounts API for a website
`[jsonrpc]`	`bind`, `token`, `origins`, `[jsonrpc.tls]` — HTTP JSON-RPC for the staff panel / stats
`[keycard]`	`url`, `api_key` — passwordless web login tokens
`[dictserv]`	`server` — DICT server for DictServ (opt-in)

Federation#

[gossip] + [[peer]] provide node-to-node replication: gossip.bind, gossip.secret, [gossip.tls] (mTLS), [gossip.signing] (Ed25519 per-origin signing + trusted-signer map), and one [[peer]] per federated node.

See Security & anti-abuse for the [security.*] engine.