Index: trunk/cmd/soju/main.go
===================================================================
--- trunk/cmd/soju/main.go	(revision 322)
+++ trunk/cmd/soju/main.go	(revision 323)
@@ -6,4 +6,5 @@
 	"log"
 	"net"
+	"net/http"
 	"net/url"
 	"strings"
@@ -57,4 +58,5 @@
 	srv.Hostname = cfg.Hostname
 	srv.LogPath = cfg.LogPath
+	srv.HTTPOrigins = cfg.HTTPOrigins
 	srv.Debug = debug
 
@@ -98,4 +100,29 @@
 				log.Fatal(srv.Serve(ln))
 			}()
+		case "wss":
+			addr := u.Host
+			if _, _, err := net.SplitHostPort(addr); err != nil {
+				addr = addr + ":https"
+			}
+			httpSrv := http.Server{
+				Addr:      addr,
+				TLSConfig: tlsCfg,
+				Handler:   srv,
+			}
+			go func() {
+				log.Fatal(httpSrv.ListenAndServeTLS("", ""))
+			}()
+		case "ws+insecure":
+			addr := u.Host
+			if _, _, err := net.SplitHostPort(addr); err != nil {
+				addr = addr + ":http"
+			}
+			httpSrv := http.Server{
+				Addr:    addr,
+				Handler: srv,
+			}
+			go func() {
+				log.Fatal(httpSrv.ListenAndServe())
+			}()
 		default:
 			log.Fatalf("failed to listen on %q: unsupported scheme", listen)
Index: trunk/config/config.go
===================================================================
--- trunk/config/config.go	(revision 322)
+++ trunk/config/config.go	(revision 323)
@@ -15,10 +15,11 @@
 
 type Server struct {
-	Listen    []string
-	Hostname  string
-	TLS       *TLS
-	SQLDriver string
-	SQLSource string
-	LogPath   string
+	Listen      []string
+	Hostname    string
+	TLS         *TLS
+	SQLDriver   string
+	SQLSource   string
+	LogPath     string
+	HTTPOrigins []string
 }
 
@@ -91,4 +92,6 @@
 				return nil, err
 			}
+		case "http-origin":
+			srv.HTTPOrigins = append(srv.HTTPOrigins, d.Params...)
 		default:
 			return nil, fmt.Errorf("unknown directive %q", d.Name)
Index: trunk/conn.go
===================================================================
--- trunk/conn.go	(revision 322)
+++ trunk/conn.go	(revision 323)
@@ -2,4 +2,5 @@
 
 import (
+	"context"
 	"fmt"
 	"net"
@@ -8,4 +9,5 @@
 
 	"gopkg.in/irc.v3"
+	"nhooyr.io/websocket"
 )
 
@@ -16,9 +18,9 @@
 	WriteMessage(*irc.Message) error
 	Close() error
+	SetReadDeadline(time.Time) error
 	SetWriteDeadline(time.Time) error
-	SetReadDeadline(time.Time) error
 }
 
-func netIRCConn(c net.Conn) ircConn {
+func newNetIRCConn(c net.Conn) ircConn {
 	type netConn net.Conn
 	return struct {
@@ -26,4 +28,52 @@
 		netConn
 	}{irc.NewConn(c), c}
+}
+
+type websocketIRCConn struct {
+	conn                        *websocket.Conn
+	readDeadline, writeDeadline time.Time
+}
+
+func newWebsocketIRCConn(c *websocket.Conn) ircConn {
+	return websocketIRCConn{conn: c}
+}
+
+func (wic websocketIRCConn) ReadMessage() (*irc.Message, error) {
+	ctx := context.Background()
+	if !wic.readDeadline.IsZero() {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithDeadline(ctx, wic.readDeadline)
+		defer cancel()
+	}
+	_, b, err := wic.conn.Read(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return irc.ParseMessage(string(b))
+}
+
+func (wic websocketIRCConn) WriteMessage(msg *irc.Message) error {
+	b := []byte(msg.String())
+	ctx := context.Background()
+	if !wic.writeDeadline.IsZero() {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithDeadline(ctx, wic.writeDeadline)
+		defer cancel()
+	}
+	return wic.conn.Write(ctx, websocket.MessageText, b)
+}
+
+func (wic websocketIRCConn) Close() error {
+	return wic.conn.Close(websocket.StatusNormalClosure, "")
+}
+
+func (wic websocketIRCConn) SetReadDeadline(t time.Time) error {
+	wic.readDeadline = t
+	return nil
+}
+
+func (wic websocketIRCConn) SetWriteDeadline(t time.Time) error {
+	wic.writeDeadline = t
+	return nil
 }
 
Index: trunk/doc/soju.1.scd
===================================================================
--- trunk/doc/soju.1.scd	(revision 322)
+++ trunk/doc/soju.1.scd	(revision 323)
@@ -73,4 +73,8 @@
 	- _irc+insecure://[host][:port]_ listens with plain-text over TCP (default
 	  port if omitted: 6667)
+	- _wss://[host][:port]_ listens for WebSocket connections over TLS (default
+	  port: 443)
+	- _ws+insecure://[host][:port]_ listens for plain-text WebSocket
+	  connections (default port: 80)
 
 	If the scheme is omitted, "ircs" is assumed. If multiple *listen*
@@ -91,4 +95,8 @@
 	Path to the bouncer logs root directory, or empty to disable logging. By
 	default, logging is disabled.
+
+*http-origin* <patterns...>
+	List of allowed HTTP origins for WebSocket listeners. The parameters are
+	interpreted as shell patterns, see *glob*(7).
 
 # IRC SERVICE
Index: trunk/downstream.go
===================================================================
--- trunk/downstream.go	(revision 322)
+++ trunk/downstream.go	(revision 323)
@@ -100,13 +100,13 @@
 }
 
-func newDownstreamConn(srv *Server, netConn net.Conn, id uint64) *downstreamConn {
-	logger := &prefixLogger{srv.Logger, fmt.Sprintf("downstream %q: ", netConn.RemoteAddr())}
+func newDownstreamConn(srv *Server, ic ircConn, remoteAddr string, id uint64) *downstreamConn {
+	logger := &prefixLogger{srv.Logger, fmt.Sprintf("downstream %q: ", remoteAddr)}
 	dc := &downstreamConn{
-		conn:          *newConn(srv, netIRCConn(netConn), logger),
+		conn:          *newConn(srv, ic, logger),
 		id:            id,
 		supportedCaps: make(map[string]string),
 		caps:          make(map[string]bool),
 	}
-	dc.hostname = netConn.RemoteAddr().String()
+	dc.hostname = remoteAddr
 	if host, _, err := net.SplitHostPort(dc.hostname); err == nil {
 		dc.hostname = host
Index: trunk/go.mod
===================================================================
--- trunk/go.mod	(revision 322)
+++ trunk/go.mod	(revision 323)
@@ -10,3 +10,4 @@
 	golang.org/x/sys v0.0.0-20200317113312-5766fd39f98d // indirect
 	gopkg.in/irc.v3 v3.1.2
+	nhooyr.io/websocket v1.8.5
 )
Index: trunk/go.sum
===================================================================
--- trunk/go.sum	(revision 322)
+++ trunk/go.sum	(revision 323)
@@ -3,6 +3,20 @@
 github.com/emersion/go-sasl v0.0.0-20191210011802-430746ea8b9b h1:uhWtEWBHgop1rqEk2klKaxPAkVDCXexai6hSuRQ7Nvs=
 github.com/emersion/go-sasl v0.0.0-20191210011802-430746ea8b9b/go.mod h1:G/dpzLu16WtQpBfQ/z3LYiYJn3ZhKSGWn83fyoyQe/k=
+github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee h1:s+21KNqlpePfkah2I+gwHF8xmJWRjooY+5248k6m4A0=
+github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
+github.com/gobwas/pool v0.2.0 h1:QEmUOlnSjWtnpRGHF3SauEiOsy82Cup83Vf2LcMlnc8=
+github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.0.2 h1:CoAavW/wd/kulfZmSIBt6p24n4j7tHgNVCjsfHVNUbo=
+github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/golang/protobuf v1.3.5 h1:F768QJ1E9tib+q5Sc8MkdJi1RxLTbRcTf8LJV56aRls=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/klauspost/compress v1.10.3 h1:OP96hzwJVBIHYU52pVTI6CczrxPvrGfgqF9N5eTO0Q8=
+github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
 github.com/mattn/go-sqlite3 v2.0.3+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
@@ -22,4 +36,7 @@
 golang.org/x/sys v0.0.0-20200317113312-5766fd39f98d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -29,2 +46,4 @@
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+nhooyr.io/websocket v1.8.5 h1:DCqbsbyRh43Ky0pWkdbWXF6z6MS2W8LqJ4ym3F+fw3I=
+nhooyr.io/websocket v1.8.5/go.mod h1:szdAKb/TINbpD/bAZy4Ydj5xgVo2BOLNPIi/mcAOGrU=
Index: trunk/server.go
===================================================================
--- trunk/server.go	(revision 322)
+++ trunk/server.go	(revision 323)
@@ -5,8 +5,11 @@
 	"log"
 	"net"
+	"net/http"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"gopkg.in/irc.v3"
+	"nhooyr.io/websocket"
 )
 
@@ -45,4 +48,5 @@
 	LogPath      string
 	Debug        bool
+	HTTPOrigins  []string
 
 	db *DB
@@ -92,26 +96,40 @@
 }
 
+var lastDownstreamID uint64 = 0
+
+func (s *Server) handle(ic ircConn, remoteAddr string) {
+	id := atomic.AddUint64(&lastDownstreamID, 1)
+	dc := newDownstreamConn(s, ic, remoteAddr, id)
+	if err := dc.runUntilRegistered(); err != nil {
+		dc.logger.Print(err)
+	} else {
+		dc.user.events <- eventDownstreamConnected{dc}
+		if err := dc.readMessages(dc.user.events); err != nil {
+			dc.logger.Print(err)
+		}
+		dc.user.events <- eventDownstreamDisconnected{dc}
+	}
+	dc.Close()
+}
+
 func (s *Server) Serve(ln net.Listener) error {
-	var nextDownstreamID uint64 = 1
 	for {
-		netConn, err := ln.Accept()
+		conn, err := ln.Accept()
 		if err != nil {
 			return fmt.Errorf("failed to accept connection: %v", err)
 		}
 
-		dc := newDownstreamConn(s, netConn, nextDownstreamID)
-		nextDownstreamID++
-		go func() {
-			if err := dc.runUntilRegistered(); err != nil {
-				dc.logger.Print(err)
-			} else {
-				dc.user.events <- eventDownstreamConnected{dc}
-				if err := dc.readMessages(dc.user.events); err != nil {
-					dc.logger.Print(err)
-				}
-				dc.user.events <- eventDownstreamDisconnected{dc}
-			}
-			dc.Close()
-		}()
+		go s.handle(newNetIRCConn(conn), conn.RemoteAddr().String())
 	}
 }
+
+func (s *Server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	conn, err := websocket.Accept(w, req, &websocket.AcceptOptions{
+		OriginPatterns: s.HTTPOrigins,
+	})
+	if err != nil {
+		s.Logger.Printf("failed to serve HTTP connection: %v", err)
+		return
+	}
+	s.handle(newWebsocketIRCConn(conn), req.RemoteAddr)
+}
Index: trunk/upstream.go
===================================================================
--- trunk/upstream.go	(revision 322)
+++ trunk/upstream.go	(revision 323)
@@ -144,5 +144,5 @@
 
 	uc := &upstreamConn{
-		conn:                     *newConn(network.user.srv, netIRCConn(netConn), logger),
+		conn:                     *newConn(network.user.srv, newNetIRCConn(netConn), logger),
 		network:                  network,
 		user:                     network.user,
