Graham McIntire
fb5803c866
- bootstrap.yml: support pkg for FreeBSD sudo/python3 install - base role: FreeBSD package sets, sudoers paths, host key regen, admin group, usermod process-in-use tolerance - freebsd role: pkg update/upgrade tasks - general role: standalone hostname tasks (ungated from network.skip), hostname_override support - inspircd role: deploy configs for ca/us manero.org irc servers with vault-backed secrets - uisp role: download and run installer on fresh hosts, skip if already running - netbox role: stop services before usermod to avoid process-in-use failures - hosts: add irc_servers group, ca/us.manero.org (Tailscale), drop staging.towerops.net - all.yml: graham user gets static ed25519 key alongside github keys
159 lines
5.4 KiB
Text
159 lines
5.4 KiB
Text
<module name="alias">
|
|
<module name="allowinvite">
|
|
<module name="chancreate">
|
|
<module name="check">
|
|
<module name="chghost">
|
|
<module name="chgident">
|
|
<module name="chgname">
|
|
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
|
|
# Cloak module: Adds user mode x (cloak) which allows user hostnames to
|
|
# be hidden. This module does not provide any cloak methods by itself.
|
|
# You should also load another module like cloak_account or cloak_sha256.
|
|
#
|
|
# In order to have users automatically cloaked on connect you should
|
|
# load the conn_umodes module and add "x" to <connect:modes>.
|
|
<module name="cloak">
|
|
<module name="cloak_user">
|
|
#<include file="&dir;/codepages/ascii.conf">
|
|
#<include file="&dir;/codepages/iso-8859-1.conf">
|
|
#<include file="&dir;/codepages/iso-8859-2.conf">
|
|
#<include file="&dir;/codepages/rfc1459.conf">
|
|
#<include file="&dir;/codepages/strict-rfc1459.conf">
|
|
<module name="customprefix">
|
|
<module name="hidechans">
|
|
|
|
<module name="cap">
|
|
|
|
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
|
|
# IRCv3 module: Provides the IRCv3 account-notify, away-notify,
|
|
# extended-join, and standard-replies extensions. These are optional
|
|
# enhancements to the client-to-server protocol. An extension is only
|
|
# active for a client when the client specifically requests it, so this
|
|
# module needs the cap module to work.
|
|
#
|
|
# Further information on these extensions can be found at the IRCv3
|
|
# working group website:
|
|
# https://ircv3.net/irc/
|
|
#
|
|
<module name="ircv3">
|
|
# The following block can be used to control which extensions are
|
|
# enabled. Note that extended-join can be incompatible with delayjoin
|
|
# and host cycling.
|
|
#<ircv3 accountnotify="yes"
|
|
# awaynotify="yes"
|
|
# extendedjoin="yes"
|
|
<module name="ircv3_accounttag">
|
|
<module name="ircv3_batch">
|
|
<module name="ircv3_capnotify">
|
|
<module name="ircv3_chghost">
|
|
<module name="ircv3_ctctags">
|
|
<module name="ircv3_echomessage">
|
|
<module name="ircv3_invitenotify">
|
|
<module name="ircv3_labeledresponse">
|
|
<module name="ircv3_msgid">
|
|
<module name="ircv3_servertime">
|
|
|
|
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
|
|
# IRCv3 Strict Transport Security module: Provides the sts IRCv3
|
|
# extension which allows clients connecting insecurely to upgrade their
|
|
# connections to TLS.
|
|
<module name="ircv3_sts">
|
|
<sts host="ca.manero.org" port="6697" duration="1d">
|
|
#
|
|
# If using the ircv3_sts module you MUST define a STS policy to send
|
|
# to clients using the <sts> tag. This tag takes the following
|
|
# attributes:
|
|
#
|
|
# host - A glob match for the SNI hostname to apply this policy to.
|
|
# duration - The amount of time that the policy lasts for. Defaults to
|
|
# five minutes by default. You should raise this to a month
|
|
# or two once you know that your config is valid.
|
|
# port - The port on which TLS connections to the server are being
|
|
# accepted. You MUST have a CA-verified certificate on this
|
|
# port. Self signed certificates are not acceptable.
|
|
# preload - Whether client developers can include your certificate in
|
|
# preload lists.
|
|
#
|
|
# <sts host="*.com" duration="5m" port="6697" preload="yes">
|
|
|
|
<module name="messageflood">
|
|
#
|
|
# The weight to give each message type. TAGMSGs are considered to be
|
|
# 1/5 of a NOTICE or PRIVMSG to avoid users being accidentally flooded
|
|
# out of a channel by automatic client features such as typing
|
|
# notifications.
|
|
#<messageflood message="Message flood detected (trigger is %messages% messages in %duration%)"
|
|
# extended="yes"
|
|
# notice="1.0"
|
|
# privmsg="1.0"
|
|
# tagmsg="0.2">
|
|
|
|
<module name="monitor">
|
|
<monitor maxentries="30">
|
|
<module name="multiprefix">
|
|
<module name="nokicks">
|
|
<passforward
|
|
|
|
# nick: The nick of the service to forward passwords to.
|
|
nick="NickServ"
|
|
|
|
# forwardmsg: Message to send to users when forwarding their
|
|
# password. You can use the following variables in this message:
|
|
#
|
|
# %nick% The nickname of the authenticating user.
|
|
# %nickrequired% The nickname of the service to forward to (see above).
|
|
# %pass% The password to forward to services.
|
|
# %user% The username of the authenticating user.
|
|
forwardmsg="NOTICE %nick% :*** Forwarding password to %nickrequired%"
|
|
|
|
# cmd: The message to send to forward passwords to services.
|
|
cmd="SQUERY %nickrequired% :IDENTIFY %nick% %pass%">
|
|
|
|
<module name="sajoin">
|
|
<module name="samode">
|
|
<module name="sanick">
|
|
<module name="satopic">
|
|
<module name="services">
|
|
<servicesintegration accountoverrideshold="yes"
|
|
disablemodes="no">
|
|
<module name="sethost">
|
|
<module name="setident">
|
|
<module name="setidle">
|
|
<module name="setname">
|
|
<setname notifyopers="yes">
|
|
<module name="sha1">
|
|
<module name="sha2">
|
|
<module name="showfile">
|
|
<module name="showwhois">
|
|
<showwhois opersonly="yes">
|
|
<module name="shun">
|
|
<module name="spanningtree">
|
|
<include file="&dir;/links.conf">
|
|
#<module name="ssl_openssl">
|
|
<module name="stripcolor">
|
|
<module name="vhost">
|
|
<module name="services_account">
|
|
<module name="ssl_gnutls">
|
|
|
|
|
|
<module name="bcrypt">
|
|
<bcrypt rounds="10">
|
|
|
|
<module name="password_hash">
|
|
<mkpasswd operonly="no">
|
|
|
|
<module name="knock">
|
|
<knock notify="notice">
|
|
<module name="swhois">
|
|
<module name="sakick">
|
|
<module name="autoop">
|
|
<module name="sslmodes">
|
|
<module name="sslinfo">
|
|
<module name="override">
|
|
<module name="sasl">
|
|
<sasl requiressl="no"
|
|
target="services.manero.org">
|
|
<module name="customprefix">
|
|
<module name="hideoper">
|
|
<hideoper mode="yes">
|
|
|