diff --git a/nixos/viridian/configuration.nix b/nixos/viridian/configuration.nix index 078d937..a6e4b7e 100644 --- a/nixos/viridian/configuration.nix +++ b/nixos/viridian/configuration.nix @@ -24,9 +24,10 @@ enable = true; allowPing = true; allowedTCPPorts = [ - 80 - 443 - 6600 + 80 # http + 443 # https + 6600 # mpd + 6667 # inspircd ]; }; }; diff --git a/nixos/viridian/services/default.nix b/nixos/viridian/services/default.nix index 1135b94..085e7f7 100644 --- a/nixos/viridian/services/default.nix +++ b/nixos/viridian/services/default.nix @@ -3,6 +3,7 @@ ./borgbackup ./crowdsec ./forgejo + ./inspircd ./jupyterhub ./lighttpd ./minecraft diff --git a/nixos/viridian/services/inspircd/default.nix b/nixos/viridian/services/inspircd/default.nix new file mode 100644 index 0000000..4fdaaa4 --- /dev/null +++ b/nixos/viridian/services/inspircd/default.nix @@ -0,0 +1,10 @@ +{...}: { + services.inspircd = { + enable = true; + config = builtins.readFile ./inspircd.conf; + }; + + environment.etc = { + "inspircd/inspircd.motd".source = ./inspircd.motd; + }; +} diff --git a/nixos/viridian/services/inspircd/inspircd.conf b/nixos/viridian/services/inspircd/inspircd.conf new file mode 100644 index 0000000..fa9fc8c --- /dev/null +++ b/nixos/viridian/services/inspircd/inspircd.conf @@ -0,0 +1,643 @@ +#-#-#-#-#-#-#-#-#-#-#-#- SERVER DESCRIPTION -#-#-#-#-#-#-#-#-#-#-#-#- +# # +# Here is where you enter the information about your server. # +# # + + + + +#-#-#-#-#-#-#-#-#-#-#-#- ADMIN INFORMATION -#-#-#-#-#-#-#-#-#-#-#-# +# # +# Describes the Server Administrator's real name (optionally), # +# nick, and email address. # +# # + + + + +#-#-#-#-#-#-#-#-#-#-#-#- PORT CONFIGURATION -#-#-#-#-#-#-#-#-#-#-#- +# # +# Configure the port and address bindings here. # +# # + + + + +#-#-#-#-#-#-#-#-#-#- CONNECTIONS CONFIGURATION -#-#-#-#-#-#-#-#-#-#-# +# # +# This is where you can configure which connections are allowed # +# and denied access onto your server. The password is optional. # +# You may have as many of these as you require. To allow/deny all # +# connections, use a '*' or 0.0.0.0/0. # +# # +# -- It is important to note that connect tags are read from the -- # +# TOP DOWN. This means that you should have more specific deny # +# and allow tags at the top, progressively more general, followed # +# by a (should you wish to have one). # +# # +# Connect blocks are searched twice for each user - once when the TCP # +# connection is accepted, and once when the user completes their # +# registration. Most of the information (hostname, ident response, # +# password, TLS (SSL) when using STARTTLS, etc) is only available # +# during the second search. If you are trying to make a closed server # +# you will probably need a connect block just for user registration. # +# This can be done by using # + + + + + +#-#-#-#-#-#-#-#-#-#-#-#- CIDR CONFIGURATION -#-#-#-#-#-#-#-#-#-#-#- +# # +# CIDR configuration allows detection of clones and applying of # +# throttle limits across a CIDR range. (A CIDR range is a group of # +# IPs, for example, the CIDR range 192.168.1.0-192.168.1.255 may be # +# represented as 192.168.1.0/24). This means that abuse across an ISP # +# is detected and curtailed much easier. Here is a good chart that # +# shows how many IPs the different CIDRs correspond to: # +# https://en.wikipedia.org/wiki/IPv4_subnetting_reference # +# https://en.wikipedia.org/wiki/IPv6_subnetting_reference # +# # + + + + +#-#-#-#-#-#-#-#-#-#- MISCELLANEOUS CONFIGURATION -#-#-#-#-#-#-#-#-#-# +# # + +# Files block - contains files whose contents are used by the ircd +# +# motd - displayed on connect and when a user executes /MOTD +# Modules can also define their own files + + +#-#-#-#-#-#-#-#-#-#-#-#-#-#-# DNS SERVER -#-#-#-#-#-#-#-#-#-#-#-#-#-#-# +# If these values are not defined, InspIRCd uses the default DNS resolver +# of your system. + + + +#-#-#-#-#-#-#-#-#-#-#-#-#- LIST MODE LIMITS #-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# The tag is used customise the maximum number of each list # +# mode that can be set on a channel. # +# The tags are read from top to bottom and the list mode limit from # +# the first tag found which matches the channel name and mode type is # +# applied to that channel. # +# It is advisable to put an entry with the channel as '*' at the # +# bottom of the list. If none are specified or no maxlist tag is # +# matched, the banlist size defaults to 100 entries. # +# # + +# Allows all channels and list modes not previously matched to have +# up to 100 entries. + + +#-#-#-#-#-#-#-#-#-#-#-#-#- SERVER OPTIONS -#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Settings to define which features are usable on your server. # +# # + + tags without an address. Choices are + # ipv4 or ipv6; if not specified, IPv6 will be used if your system has support, + # falling back to IPv4 otherwise. + defaultbind="auto" + + # hostintopic: If enabled, channels will show the host of the topic setter + # in the topic. If set to no, it will only show the nick of the topic setter. + hostintopic="yes" + + # pingwarning: If a server does not respond to a ping within this period, + # it will send a notice to opers with snomask +l informing that the server + # is about to ping timeout. + pingwarning="15" + + # serverpingfreq: How often pings are sent between servers. + serverpingfreq="1m" + + # splitwhois: Whether to split private/secret channels from normal channels + # in WHOIS responses. Possible values for this are: + # 'no' - list all channels together in the WHOIS response regardless of type. + # 'split' - split private/secret channels to a separate WHOIS response numeric. + # 'splitmsg' - the same as split but also send a message explaining the split. + splitwhois="no" + + # defaultmodes: The modes to set on a channel when it is created. See + # https://docs.inspircd.org/3/channel-modes/ for a list of channel + # modes. If a prefix mode is included in this option it will be set on + # the user that created the channel. The example below sets channel + # modes n (noextmsg) and t (topiclock) and grants channel prefix mode + # o (op) to the channel creator. + defaultmodes="not" + + # xlinemessage: This is the text that is sent to a user when they are + # banned from the server. + xlinemessage="You're banned! Email irc@example.com with the ERROR line below for help." + + # allowzerolimit: If enabled then allow a limit of 0 to be set on channels. + # This is non-standard behaviour and should only be enabled if you need to + # link with servers running 2.0. Defaults to yes. + allowzerolimit="no" + + # modesinlist: If enabled then the current channel modes will be shown + # in the /LIST response. Defaults to yes. + modesinlist="no" + + # exemptchanops: Allows users with with a status mode to be exempt + # from various channel restrictions. Possible restrictions are: + # - anticaps Channel mode +B - blocks messages with too many capital + # letters (requires the anticaps module). + # - auditorium-see Permission required to see the full user list of + # a +u channel (requires the auditorium module). + # - auditorium-vis Permission required to be visible in a +u channel + # (requires the auditorium module). + # - blockcaps Channel mode +B - blocks messages with too many capital + # letters (requires the blockcaps module). + # - blockcolor Channel mode +c - blocks messages with formatting codes + # (requires the blockcolor module). + # - censor Channel mode +G - censors messages based on the network + # configuration (requires the censor module). + # - delaymsg Channel mode +d - blocks sending messages until specified + # seconds have passed since user join + # - filter Channel mode +g - blocks messages containing the given + # glob mask (requires the chanfilter module). + # - flood Channel mode +f - kicks (and bans) on text flood of a + # specified rate (requires the messageflood module). + # - nickflood Channel mode +F - blocks nick changes after a specified + # rate (requires the nickflood module). + # - noctcp Channel mode +C - blocks any CTCPs to the channel + # (requires the noctcp module). + # - nonick Channel mode +N - prevents users on the channel from + # changing nicks (requires the nonicks module). + # - nonotice Channel mode +T - blocks /NOTICEs to the channel + # (requires the nonotice module). + # - regmoderated Channel mode +M - blocks unregistered users from + # speaking (requires the services account module). + # - stripcolor Channel mode +S - strips formatting codes from + # messages (requires the stripcolor module). + # - topiclock Channel mode +t - limits changing the topic to (half)ops + # You can also configure this on a per-channel basis with a channel mode and + # even negate the configured exemptions below. + # See exemptchanops in modules.conf.example for more details. + exemptchanops="censor:o filter:o nickflood:o nonick:v regmoderated:o" + + # invitebypassmodes: This allows /INVITE to bypass other channel modes. + # (Such as +k, +j, +l, etc.) + invitebypassmodes="yes" + + # nosnoticestack: This prevents snotices from 'stacking' and giving you + # the message saying '(last message repeated X times)'. Defaults to no. + nosnoticestack="no"> + + +#-#-#-#-#-#-#-#-#-#-#-# PERFORMANCE CONFIGURATION #-#-#-#-#-#-#-#-#-#-# +# # + + + +#-#-#-#-#-#-#-#-#-#-#-# SECURITY CONFIGURATION #-#-#-#-#-#-#-#-#-#-#-# +# # + +