| 1 | .Dd $Mdocdate$
|
|---|
| 2 | .Dt SUIKA-CONFIG 5
|
|---|
| 3 | .Os
|
|---|
| 4 | .Sh NAME
|
|---|
| 5 | .Nm suika-config
|
|---|
| 6 | .Nd Configuration file for suika IRC bouncer
|
|---|
| 7 | .Sh DESCRIPTION
|
|---|
| 8 | The config file has one directive per line
|
|---|
| 9 |
|
|---|
| 10 | Example:
|
|---|
| 11 |
|
|---|
| 12 | listen ircs://
|
|---|
| 13 | .Pp
|
|---|
| 14 | tls cert.pem key.pem
|
|---|
| 15 | .Pp
|
|---|
| 16 | hostname example.org
|
|---|
| 17 |
|
|---|
| 18 | The following directives are supported:
|
|---|
| 19 |
|
|---|
| 20 | .Bl -tag -width 7n -compact
|
|---|
| 21 | .It listen <uri>
|
|---|
| 22 | Listening URI (default: ":6697")
|
|---|
| 23 |
|
|---|
| 24 | The following URIs are supported:
|
|---|
| 25 | .Bl -tag -width 11n -compact
|
|---|
| 26 | .It ircs://[host]:[port]
|
|---|
| 27 | listens with TLS over TCP
|
|---|
| 28 | .It irc+insecure://[host]:[port]
|
|---|
| 29 | listens with plain-text over TCP
|
|---|
| 30 | .It unix:///<path>
|
|---|
| 31 | listens on a Unix domain socket
|
|---|
| 32 | .It wss://[host]:[port]
|
|---|
| 33 | listens for WebSocket connections over
|
|---|
| 34 | TLS
|
|---|
| 35 | .It ws+insecure://[host]:[port]
|
|---|
| 36 | listens for plain-text WebSocket
|
|---|
| 37 | connections
|
|---|
| 38 | .It ident://[host]:[port]
|
|---|
| 39 | listens for plain-text ident
|
|---|
| 40 | connections
|
|---|
| 41 | .It http+prometheus://[host]:[port]
|
|---|
| 42 | listens for plain-text HTTP
|
|---|
| 43 | connections and serves Prometheus
|
|---|
| 44 | metrics (host must be "localhost")
|
|---|
| 45 | .It http+pprof://[host]:[port]
|
|---|
| 46 | listens for plain-text HTTP
|
|---|
| 47 | connections and serves pprof
|
|---|
| 48 | runtime profiling data
|
|---|
| 49 | (host must be "localhost").
|
|---|
| 50 | For more information, see:
|
|---|
| 51 | <https://pkg.go.dev/net/http/pprof>.
|
|---|
| 52 | .El
|
|---|
| 53 |
|
|---|
| 54 | If the scheme is omitted, "ircs" is assumed.
|
|---|
| 55 | If multiple "listen" directives are specified,
|
|---|
| 56 | suika will listen on each of them.
|
|---|
| 57 |
|
|---|
| 58 | .It hostname <name>
|
|---|
| 59 | Server hostname
|
|---|
| 60 |
|
|---|
| 61 | .It title <title>
|
|---|
| 62 | Server title. This will be sent as
|
|---|
| 63 | the ISUPPORT NETWORK value when
|
|---|
| 64 | clients don't select a specific
|
|---|
| 65 | network.
|
|---|
| 66 |
|
|---|
| 67 | .It tls <cert> <key>
|
|---|
| 68 | Enable TLS support. The certificate
|
|---|
| 69 | and key files must be PEM-encoded.
|
|---|
| 70 |
|
|---|
| 71 | .It db <driver> <source>
|
|---|
| 72 | Set the database location for user,
|
|---|
| 73 | network and channel storage. By
|
|---|
| 74 | default, a sqlite3 database is
|
|---|
| 75 | opened in ./suika.db.
|
|---|
| 76 |
|
|---|
| 77 | Supported drivers:
|
|---|
| 78 |
|
|---|
| 79 | .Bl tag -width 7n -compact
|
|---|
| 80 | .It sqlite3
|
|---|
| 81 | expects source to be a path to
|
|---|
| 82 | the SQLite file
|
|---|
| 83 | .It postgres
|
|---|
| 84 | expects source to be a space-
|
|---|
| 85 | separated list of key=value
|
|---|
| 86 | parameters, e.g. db postgres
|
|---|
| 87 | host=/run/postgresql
|
|---|
| 88 | dbname=suika. Note that
|
|---|
| 89 | sslmode defaults to require.
|
|---|
| 90 | For more information on
|
|---|
| 91 | connection strings, see:
|
|---|
| 92 | <https://pkg.go.dev/github.com/lib/pq#hdr-Connection_String_Parameters>
|
|---|
| 93 | .El
|
|---|
| 94 |
|
|---|
| 95 | .It log fs <path>
|
|---|
| 96 | Path to the bouncer logs directory, or empty to
|
|---|
| 97 | disable logging. By default, logging is disabled.
|
|---|
| 98 |
|
|---|
| 99 | .It http-origin <patterns>
|
|---|
| 100 | List of allowed HTTP origins for WebSocket listeners.
|
|---|
| 101 | The parameters are interpreted as shell patterns, see *glob*(7).
|
|---|
| 102 |
|
|---|
| 103 | By default, only the request host is authorized.
|
|---|
| 104 | Use this directive to enable cross-origin WebSockets.
|
|---|
| 105 |
|
|---|
| 106 | .It accept-proxy-ip <cidr..>
|
|---|
| 107 | Allow the specified IPs to act as a proxy. Proxys have the ability to
|
|---|
| 108 | overwrite the remote and local connection addresses (via the PROXY protocol,
|
|---|
| 109 | the Forwarded HTTP header field defined in RFC 7239 or the X-Forwarded-\*
|
|---|
| 110 | HTTP header fields). The special name "localhost" accepts the loopback
|
|---|
| 111 | addresses 127.0.0.0/8 and ::1/128.
|
|---|
| 112 |
|
|---|
| 113 | By default, all IPs are rejected.
|
|---|
| 114 |
|
|---|
| 115 | .It max-user-networks <limit>
|
|---|
| 116 | Maximum number of networks per user. By default, there is no limit.
|
|---|
| 117 |
|
|---|
| 118 | .It motd <path>
|
|---|
| 119 | Path to the MOTD file. The bouncer MOTD is sent to clients which aren't
|
|---|
| 120 | bound to a specific network. By default, no MOTD is sent.
|
|---|
| 121 |
|
|---|
| 122 | .It multi-upstream-mode <true|false>
|
|---|
| 123 | Globally enable or disable multi-upstream mode.
|
|---|
| 124 | By default, multi-upstream mode is enabled.
|
|---|
| 125 |
|
|---|
| 126 | .It upstream-user-ip <cidr...>
|
|---|
| 127 | Enable per-user IP addresses.
|
|---|
| 128 | One IPv4 range and/or one IPv6 range can be
|
|---|
| 129 | specified in CIDR notation.
|
|---|
| 130 | One IP address per range will be assigned to
|
|---|
| 131 | each user and will be used as the source address when connecting to an
|
|---|
| 132 | upstream network.
|
|---|
| 133 |
|
|---|
| 134 | This can be useful to avoid having the whole bouncer banned from an upstream
|
|---|
| 135 | network because of one malicious user.
|
|---|
| 136 | .El
|
|---|
| 137 | .Sh SEE ALSO
|
|---|
| 138 | .Xr suika 1
|
|---|
| 139 | .Xr suika-bouncerserv 7
|
|---|
| 140 | .Sh AUTHORS
|
|---|
| 141 | .An Simon Ser and contributors Aq https://emersion.fr
|
|---|
| 142 | .An Izuru Yakumo Aq Mt yakumo.izuru@chaotic.ninja
|
|---|
