Features

The daemon

• Safe by construction — #![forbid(unsafe_code)] across the tree, enforced in CI.
• Reactor core — a single core thread with a mio/epoll pool; zero-copy broadcast and parallel channel fan-out.
• Full mode set — every standard channel and user mode, host cloaking, custom prefixes.
• Operators — a privilege model: command grants, named privileges, and a per-type mode allow-list.
• The edge — connection classes, per-class flood/fakelag, RFC 1413 ident, PROXY protocol v1/v2.
• Observability — a metrics endpoint, structured JSON logging, and native syslog.

Transport & TLS

• 6697 direct TLS · 7799 WebSocket (wss) · 6667 plaintext.
• Two interchangeable backends — OpenSSL and rustls — both serving TLS 1.3.
• With OpenSSL 3.5 the handshake negotiates post-quantum X25519MLKEM768.
• Per-host SNI certificates, reloaded live on rehash.

IRCv3

Capabilities advertised to clients:

SASL

• PLAIN — classic username / password.
• EXTERNAL — authenticate by your TLS client-certificate fingerprint.
• SCRAM-SHA-256 — challenge / response, no password on the wire.
• ECDSA-NIST256P-CHALLENGE — sign a challenge with a NIST P-256 key; the private key never leaves your client.

Services

• NickServ — registration, grouped nicks, certificates, public keys, vhosts, profiles.
• ChanServ — founder/access, auto-op, akick, topic and mode locks.
• OperServ · MemoServ · more — network administration, offline messaging, and games.
• Event-sourced store; SASL relayed to services mechanism-agnostically.

Security

• A native anti-abuse engine in the core — connection/nick-flood and mass-join screening.
• Behavioral and content heuristics with computed-pattern mining.
• A DEFCON state machine plus DNSBL / MX screening via a native async resolver.