Index: /trunk/.gitignore
===================================================================
--- /trunk/.gitignore	(revision 822)
+++ /trunk/.gitignore	(revision 823)
@@ -1,4 +1,4 @@
 /suika
-/suikactl
+/suikadb
 /suika-znc-import
 /suika.db
Index: /trunk/Makefile
===================================================================
--- /trunk/Makefile	(revision 822)
+++ /trunk/Makefile	(revision 823)
@@ -17,17 +17,22 @@
 GOOS ?= linux
 
-all: suika suikactl suika-znc-import
+all: suika suikadb suika-znc-import
 
 suika:
 	$(GO) build $(GOFLAGS) ./cmd/suika
-	strip -s suika
-suikactl:
-	$(GO) build $(GOFLAGS) ./cmd/suikactl
-	strip -s suikactl
+	@strip -s suika
+suikadb:
+	$(GO) build $(GOFLAGS) ./cmd/suikadb
+	@strip -s suikadb 
 suika-znc-import:
 	$(GO) build $(GOFLAGS) ./cmd/suika-znc-import
-	strip -s suika-znc-import
+	@strip -s suika-znc-import
 clean:
-	$(RM) -f suika suikactl suika-znc-import
+	$(RM) -f suika suikadb suikactl suika-znc-import
+docs:
+	asciidoctor -b manpage doc/suika.adoc -o doc/suika.1
+	asciidoctor -b manpage doc/suikadb.adoc -o doc/suikadb.1
+	asciidoctor -b manpage doc/suika-config.adoc -o doc/suika-config.5
+	asciidoctor -b manpage doc/suika-bouncerserv.adoc -o doc/suika-bouncerserv.7
 install:
 	$(MKDIR) -p $(DESTDIR)$(PREFIX)/$(BINDIR)
@@ -37,6 +42,8 @@
 	$(MKDIR) -p $(DESTDIR)${SYSCONFDIR}/suika
 	$(MKDIR) -p $(DESTDIR)/var/lib/suika
-	$(CP) -f suika suikactl suika-znc-import $(DESTDIR)$(PREFIX)/$(BINDIR)
+	$(CP) -f suika suikadb suika-znc-import $(DESTDIR)$(PREFIX)/$(BINDIR)
 	$(CP) -f doc/suika.1 $(DESTDIR)$(PREFIX)/$(MANDIR)/man1
+	$(CP) -f doc/suikadb.1 $(DESTDIR)$(PREFIX)/$(MANDIR)/man1
+	$(CP) -f doc/suika-znc-import.1 $(DESTDIR)/$(MANDIR)/man1
 	$(CP) -f doc/suika-config.5 $(DESTDIR)$(PREFIX)/$(MANDIR)/man5
 	$(CP) -f doc/suika-bouncerserv.7 $(DESTDIR)$(PREFIX)/$(MANDIR)/man7
@@ -44,3 +51,5 @@
 test:
 	go test
-.PHONY: suika suikactl suika-znc-import clean install
+vendor:
+	go mod vendor
+.PHONY: suika suikadb suika-znc-import clean install
Index: unk/cmd/suikactl/main.go
===================================================================
--- /trunk/cmd/suikactl/main.go	(revision 822)
+++ 	(revision )
@@ -1,150 +1,0 @@
-package main
-
-import (
-	"bufio"
-	"context"
-	"flag"
-	"fmt"
-	"io"
-	"log"
-	"os"
-
-	"marisa.chaotic.ninja/suika"
-	"marisa.chaotic.ninja/suika/config"
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/crypto/ssh/terminal"
-)
-
-const usage = `usage: suikactl [-config path] <action> [options...]
-
-  create-user <username> [-admin]  Create a new user
-  change-password <username>       Change password for a user
-  help                             Show this help message
-`
-
-func init() {
-	flag.Usage = func() {
-		fmt.Fprintf(flag.CommandLine.Output(), usage)
-	}
-}
-
-func main() {
-	var configPath string
-	flag.StringVar(&configPath, "config", "", "path to configuration file")
-	flag.Parse()
-
-	var cfg *config.Server
-	if configPath != "" {
-		var err error
-		cfg, err = config.Load(configPath)
-		if err != nil {
-			log.Fatalf("failed to load config file: %v", err)
-		}
-	} else {
-		cfg = config.Defaults()
-	}
-
-	db, err := suika.OpenDB(cfg.SQLDriver, cfg.SQLSource)
-	if err != nil {
-		log.Fatalf("failed to open database: %v", err)
-	}
-
-	ctx := context.Background()
-
-	switch cmd := flag.Arg(0); cmd {
-	case "create-user":
-		username := flag.Arg(1)
-		if username == "" {
-			flag.Usage()
-			os.Exit(1)
-		}
-
-		fs := flag.NewFlagSet("", flag.ExitOnError)
-		admin := fs.Bool("admin", false, "make the new user admin")
-		fs.Parse(flag.Args()[2:])
-
-		password, err := readPassword()
-		if err != nil {
-			log.Fatalf("failed to read password: %v", err)
-		}
-
-		hashed, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
-		if err != nil {
-			log.Fatalf("failed to hash password: %v", err)
-		}
-
-		user := suika.User{
-			Username: username,
-			Password: string(hashed),
-			Admin:    *admin,
-		}
-		if err := db.StoreUser(ctx, &user); err != nil {
-			log.Fatalf("failed to create user: %v", err)
-		}
-	case "change-password":
-		username := flag.Arg(1)
-		if username == "" {
-			flag.Usage()
-			os.Exit(1)
-		}
-
-		user, err := db.GetUser(ctx, username)
-		if err != nil {
-			log.Fatalf("failed to get user: %v", err)
-		}
-
-		password, err := readPassword()
-		if err != nil {
-			log.Fatalf("failed to read password: %v", err)
-		}
-
-		hashed, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
-		if err != nil {
-			log.Fatalf("failed to hash password: %v", err)
-		}
-
-		user.Password = string(hashed)
-		if err := db.StoreUser(ctx, user); err != nil {
-			log.Fatalf("failed to update password: %v", err)
-		}
-	case "version":
-		fmt.Printf("%v\n", suika.FullVersion())
-	default:
-		flag.Usage()
-		if cmd != "help" {
-			os.Exit(1)
-		}
-	}
-}
-
-func readPassword() ([]byte, error) {
-	var password []byte
-	var err error
-	fd := int(os.Stdin.Fd())
-
-	if terminal.IsTerminal(fd) {
-		fmt.Printf("Password: ")
-		password, err = terminal.ReadPassword(int(os.Stdin.Fd()))
-		if err != nil {
-			return nil, err
-		}
-		fmt.Printf("\n")
-	} else {
-		fmt.Fprintf(os.Stderr, "Warning: Reading password from stdin.\n")
-		// TODO: the buffering messes up repeated calls to readPassword
-		scanner := bufio.NewScanner(os.Stdin)
-		if !scanner.Scan() {
-			if err := scanner.Err(); err != nil {
-				return nil, err
-			}
-			return nil, io.ErrUnexpectedEOF
-		}
-		password = scanner.Bytes()
-
-		if len(password) == 0 {
-			return nil, fmt.Errorf("zero length password")
-		}
-	}
-
-	return password, nil
-}
Index: /trunk/cmd/suikadb/main.go
===================================================================
--- /trunk/cmd/suikadb/main.go	(revision 823)
+++ /trunk/cmd/suikadb/main.go	(revision 823)
@@ -0,0 +1,150 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"os"
+
+	"marisa.chaotic.ninja/suika"
+	"marisa.chaotic.ninja/suika/config"
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/crypto/ssh/terminal"
+)
+
+const usage = `usage: suikadb [-config path] <action> [options...]
+
+  create-user <username> [-admin]  Create a new user
+  change-password <username>       Change password for a user
+  help                             Show this help message
+`
+
+func init() {
+	flag.Usage = func() {
+		fmt.Fprintf(flag.CommandLine.Output(), usage)
+	}
+}
+
+func main() {
+	var configPath string
+	flag.StringVar(&configPath, "config", "", "path to configuration file")
+	flag.Parse()
+
+	var cfg *config.Server
+	if configPath != "" {
+		var err error
+		cfg, err = config.Load(configPath)
+		if err != nil {
+			log.Fatalf("failed to load config file: %v", err)
+		}
+	} else {
+		cfg = config.Defaults()
+	}
+
+	db, err := suika.OpenDB(cfg.SQLDriver, cfg.SQLSource)
+	if err != nil {
+		log.Fatalf("failed to open database: %v", err)
+	}
+
+	ctx := context.Background()
+
+	switch cmd := flag.Arg(0); cmd {
+	case "create-user":
+		username := flag.Arg(1)
+		if username == "" {
+			flag.Usage()
+			os.Exit(1)
+		}
+
+		fs := flag.NewFlagSet("", flag.ExitOnError)
+		admin := fs.Bool("admin", false, "make the new user admin")
+		fs.Parse(flag.Args()[2:])
+
+		password, err := readPassword()
+		if err != nil {
+			log.Fatalf("failed to read password: %v", err)
+		}
+
+		hashed, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
+		if err != nil {
+			log.Fatalf("failed to hash password: %v", err)
+		}
+
+		user := suika.User{
+			Username: username,
+			Password: string(hashed),
+			Admin:    *admin,
+		}
+		if err := db.StoreUser(ctx, &user); err != nil {
+			log.Fatalf("failed to create user: %v", err)
+		}
+	case "change-password":
+		username := flag.Arg(1)
+		if username == "" {
+			flag.Usage()
+			os.Exit(1)
+		}
+
+		user, err := db.GetUser(ctx, username)
+		if err != nil {
+			log.Fatalf("failed to get user: %v", err)
+		}
+
+		password, err := readPassword()
+		if err != nil {
+			log.Fatalf("failed to read password: %v", err)
+		}
+
+		hashed, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
+		if err != nil {
+			log.Fatalf("failed to hash password: %v", err)
+		}
+
+		user.Password = string(hashed)
+		if err := db.StoreUser(ctx, user); err != nil {
+			log.Fatalf("failed to update password: %v", err)
+		}
+	case "version":
+		fmt.Printf("%v\n", suika.FullVersion())
+	default:
+		flag.Usage()
+		if cmd != "help" {
+			os.Exit(1)
+		}
+	}
+}
+
+func readPassword() ([]byte, error) {
+	var password []byte
+	var err error
+	fd := int(os.Stdin.Fd())
+
+	if terminal.IsTerminal(fd) {
+		fmt.Printf("Password: ")
+		password, err = terminal.ReadPassword(int(os.Stdin.Fd()))
+		if err != nil {
+			return nil, err
+		}
+		fmt.Printf("\n")
+	} else {
+		fmt.Fprintf(os.Stderr, "Warning: Reading password from stdin.\n")
+		// TODO: the buffering messes up repeated calls to readPassword
+		scanner := bufio.NewScanner(os.Stdin)
+		if !scanner.Scan() {
+			if err := scanner.Err(); err != nil {
+				return nil, err
+			}
+			return nil, io.ErrUnexpectedEOF
+		}
+		password = scanner.Bytes()
+
+		if len(password) == 0 {
+			return nil, fmt.Errorf("zero length password")
+		}
+	}
+
+	return password, nil
+}
Index: /trunk/doc.go
===================================================================
--- /trunk/doc.go	(revision 822)
+++ /trunk/doc.go	(revision 823)
@@ -2,5 +2,5 @@
 //
 // # Copyright (C) 2020 The soju Contributors
-// # Copyright (C) 2023-present Aoi Koizumi et al.
+// # Copyright (C) 2023-present Izuru Yakumo et al.
 //
 // suika is covered by the AGPLv3 license:
Index: /trunk/doc/suika-bouncerserv.7
===================================================================
--- /trunk/doc/suika-bouncerserv.7	(revision 822)
+++ /trunk/doc/suika-bouncerserv.7	(revision 823)
@@ -1,258 +1,525 @@
-.Dd $Mdocdate$
-.Dt SUIKA-BOUNCERSERV 7
-.Os
-.Sh NAME
-.Nm suika-bouncerserv
-.Nd Service bot exposed by suika to control the bouncer
-.Sh DESCRIPTION
-suika exposes an IRC service called BouncerServ to manage the bouncer.
-Commands can be sent via regular private messages
-(/msg BouncerServ <command> [args...]). Commands may be written in full or
-abbreviated form, for instance network can be abbreviated as net or just
-n.
-.Ss COMMANDS
-.Bl -tag -width 11n
-.It help [command]
-Show a list of commands. If command is specified, show a help message for
-the command.
-.It network create -addr <addr> [options...]
-Connect to a new network at addr. -addr is mandatory.
-
+'\" t
+.\"     Title: suika-bouncerserv
+.\"    Author: Simon Ser and contributors / Izuru Yakumo
+.\" Generator: Asciidoctor 2.0.20
+.\"      Date: 2023-09-15
+.\"    Manual: Suika IRC Bouncer
+.\"    Source: SUIKA-BOUNCERSERV
+.\"  Language: English
+.\"
+.TH "SUIKA\-BOUNCERSERV" "7" "2023-09-15" "SUIKA\-BOUNCERSERV" "Suika IRC Bouncer"
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.ss \n[.ss] 0
+.nh
+.ad l
+.de URL
+\fI\\$2\fP <\\$1>\\$3
+..
+.als MTO URL
+.if \n[.g] \{\
+.  mso www.tmac
+.  am URL
+.    ad l
+.  .
+.  am MTO
+.    ad l
+.  .
+.  LINKSTYLE blue R < >
+.\}
+.SH "NAME"
+suika-bouncerserv \- Service bot exposed by suika(1) to control the bouncer
+.SH "DESCRIPTION"
+.sp
+suika(1) exposes an IRC service called BouncerServ to manage the bouncer.
+Commands can be sent via regular private messages.
+Commands may be written in full or abbreviated form, for instance network
+can be abbreviated as net or just n.
+.SH "COMMANDS"
+.SS "help [command]"
+.sp
+Show a list of commands.
+If command is specified, show a help message for the command.
+.SS "network\-create \-addr <addr> [options...]"
+.sp
+Connect to a new network at addr.
+The option \-addr is mandatory.
+.sp
 addr supports several connection types:
-
-.Bl -tag -width 5n
-.It [ircs://]<host>[:port] 
-connects with TLS over TCP
-.It irc+insecure://<host>[:port] 
-connects with plain-text TCP
-.It irc+unix:///<path> 
-connects to a Unix socket
-.El
-
+* ircs://<host>:port \- connects with TLS over TCP
+* irc+insecure://<host>:port \- connects with plain\-text over TCP
+* irc+unix://<path> \- connects to a Unix domain socket
+.sp
 Other options are:
-
--name <name>
-Short network name. This will be used instead of addr to refer to the
-network.
-
--username <username>
-Connect with the specified username. By default, the nickname is used.
-
--pass <pass>
-Connect with the specified server password.
-
--realname <realname>
-Connect with the specified real name. By default, the account's realname
-is used if set, otherwise the network's nickname is used.
-
--nick <nickname>
-Connect with the specified nickname. By default, the account's username
-is used.
-
--enabled true|false
-Enable or disable the network. If the network is disabled, the bouncer
-won't connect to it. By default, the network is enabled.
-
--connect-command <command>
-Send the specified command as a raw IRC message right after connecting
-to the server. This can be used to identify to an account when the
-server doesn't support SASL.
-
-.It network update [name] [options...]
-Update an existing network. The options are the same as the
-network create command.
-
-When this command is executed, suika will disconnect and re-connect to the
-network.
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-name <name>
+Short network name, this will be used instead of addr to refer to the network
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-username <username>
+Connect with the specified username, by default, the nickname is used
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-pass <pass>
+Connect with the specified server password
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-realname <realname>
+Connect with the specified real name, by default, the account\(cqs realname is used if set, otherwise the network\(cqs nickname is used
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-nick <nick>
+Connect with the specified nickname, by default, the account\(cqs username is used
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-enabled [bool]
+Enable or disable the network, if the network is disabled, the bouncer won\(cqt connect to it, by default, the network is enabled
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-connect\-command <command>
+Send the specified command as a raw IRC message right after connecting to the server, this can be used to identify to an account if a server does not support SASL
+.RE
+.SS "network update [options...]"
+.sp
+Update an existing network. The options are the same as the network create command.
+When this command is executed, suika(1) will disconnect and re\-connect to the network.
 If name is not specified, the current network is updated.
-
-.It network delete [name]
+.SS "network delete [name]"
+.sp
 Disconnect and delete a network.
-
 If name is not specified, the current network is deleted.
-
-.It network quote [name] <command>
-Send a raw IRC line as-is to a network.
-
+.SS "network quote [name] <command>"
+.sp
+Send a raw IRC line as\-is to a network.
 If name is not specified, the command is sent to the current network.
-.It network status
+.SS "network status"
+.sp
 Show a list of saved networks and their current status.
-.It channel status [options...]
+.SS "channel status [options...]"
+.sp
 Show a list of saved channels and their current status.
 Options:
-
--network <name>
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Only show channels for the specified network. By default, only the channels in the current network are displayed.
-channel update <name> [options...]
-
+.RE
+.SS "channel update <name> [options...]"
+.sp
 Update the options of an existing channel.
 Options are:
-
--detached true|false
-
+.sp
+\-detached [bool]
 Attach or detach this channel.
-A detached channel is joined but is hidden by the bouncer. This is useful to e.g. collect logs and highlights in low-interest or high-traffic channels.
-
--relay-detached <mode>
-
-Set when to relay messages from detached channels to the user with a BouncerServ NOTICE.
-Modes are:
-
-message
-
-Relay any message from this channel when detached.
-highlight
-
-Relay only messages mentioning you when detached.
-none
-
-Don't relay any messages from this channel when detached.
-default
-
-Currently same as highlight. This is the default behaviour.
--reattach-on <mode>
-
-Set when to automatically reattach to detached channels.
-Modes are:
-
-message
-
-Reattach to this channel when any message is received.
-highlight
-
-Reattach to this channel when any message mentioning you is received.
-none
-
-Never automatically reattach to this channel.
-default
-
-Currently same as none. This is the default behaviour.
--detach-after <duration>
-
-Automatically detach this channel after the specified duration has elapsed without receving any message corresponding to -detach-on.
-Example duration values: 1h30m, 30s, 2.5h.
-
-Setting this value to 0 will disable this behaviour, i.e. this channel will never be automatically detached. This is the default behaviour.
-
--detach-on <mode>
-
-Set when to reset the auto-detach timer used by -detach-after, causing it to wait again for the auto-detach duration timer before detaching. Joining, reattaching, sending a message, or changing any channel option will reset the timer, in addition to the messages specified by the mode.
-Modes are:
-
-message
-
-Receiving any message from this channel will reset the auto-detach timer.
-highlight
-
-Receiving any message mentioning you from this channel will reset the auto-detach timer.
-none
-
-Receiving messages from this channel will not reset the auto-detach timer. Sending messages or joining the channel will still reset the timer.
-default
-
-Currently same as message. This is the default behaviour.
-.It channel delete <name>
-Leave and forget a channel.
-.It certfp generate [options...]
-Generate self-signed certificate and use it for authentication (via SASL EXTERNAL).
-Generates a 3072-bit RSA private key by default.
-
-Options are:
-
--network <name>
-
+A detached channel is joined but is hidden by the bouncer.
+This is useful to e.g. collect logs and highlights in low\-interest or high\-traffic channels.
+.sp
+\-relay\-detached [mode] \- Set when to relay messages from detached channels to the user with a BouncerServ NOTICE
+* message \- Relay any message from this channel when detached.
+* highlight \- Relay only messages mentioning you when detached.
+* none \- Do not relay any messages from this channel when detached.
+* default \- Currently same as highlight. This is the default behaviour.
+.sp
+\-reattach\-on [mode] \- Set when to automatically reattach to detached channels.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+message \- Reattach to this channel when any message is received.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+highlight \- Reattach to this channel when any message mentioning you is received.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+none \- Never automatically reattach to this channel.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+default \- Currently same as none. This is the default behaviour.
+.RE
+.sp
+\-detach\-after [duration]
+.sp
+Automatically detach this channel after the specified duration has elapsed without receving any message corresponding to \-detach\-on. Example duration values: 1h30m, 30s, 2.5h. Setting this value to 0 will disable this behaviour, i.e. this channel will never be automatically detached. This is the default behaviour.
+.sp
+\-detach\-on [mode]
+Set when to reset the auto\-detach timer used by \-detach\-after, causing it to wait again for the auto\-detach duration timer before detaching. Joining, reattaching, sending a message, or changing any channel option will reset the timer, in addition to the messages specified by the mode.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+message \- Receiving any message from this channel will reset the auto\-detach timer.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+highlight \- Receiving any message mentioning you from this channel will reset the auto\-detach timer.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+none \- Receiving messages from this channel will not reset the auto\-detach timer. Sending messages or joining the channel will still reset the timer.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+default \- Currently same as message. This is the default behaviour.
+.RE
+.SS "certfp generate [options...]"
+.sp
+Generate self\-signed certificate and use it for authentication (via SASL EXTERNAL). Generates a 3072\-bit RSA private key by default.
+Options are:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Select a network. By default, the current network is selected, if any.
--key-type <type>
-
-Private key algorithm to use. Valid values are: rsa, ecdsa and ed25519. ecdsa uses the NIST P-521 curve.
--bits <bits>
-
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-key\-type <type>
+Private key algorithm to use. Valid values are: rsa, ecdsa and ed25519. ecdsa uses the NIST P\-521 curve.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-bits <bits>
 Size of RSA key to generate. Ignored for other key types.
-certfp fingerprint [options...]
-
-Show SHA-1 and SHA-256 fingerprints for the certificate currently used with the network.
-Options are:
-
--network <name>
-
+.RE
+.SS "certfp fingerprint [options...]"
+.sp
+Show SHA\-1 and SHA\-256 fingerprints for the certificate currently used with the network.
+Options are:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Select a network. By default, the current network is selected, if any.
-sasl status [options...]
-
+.RE
+.SS "sasl status [options...]"
+.sp
 Show current SASL status.
 Options are:
-
--network <name>
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Select a network. By default, the current network is selected, if any.
-.It sasl set-plain [options...] <username> <password>
+.RE
+.SS "sasl set\-plain [options...] <username> <password>"
+.sp
 Set SASL PLAIN credentials.
 Options are:
-
--network <name>
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Select a network. By default, the current network is selected, if any.
-.It sasl reset [options...]
+.RE
+.SS "sasl reset [options...]"
+.sp
 Disable SASL authentication and remove stored credentials.
 Options are:
-
--network <name>
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-network <network>
 Select a network. By default, the current network is selected, if any.
-.It user status
+.RE
+.SS "user status"
+.sp
 Show a list of users on this server. Only admins can query this information.
-user create -username <username> -password <password> [options...]
-
-Create a new suika user. Only admin users can create new accounts. The -username and -password flags are mandatory.
-Options are:
-
--username <username>
-
-The bouncer username. This cannot be changed after the user has been created.
--password <password>
-
-The bouncer password.
--disable-password
-
-Disable password authentication. The user will be unable to login.
--admin true|false
-
-Make the new user an administrator.
--nick <nick>
-
-Set the user's nickname. This is used as a fallback if there is no nickname set for a network.
--realname <realname>
-
-Set the user's realname. This is used as a fallback if there is no realname set for a network.
--enabled true|false
-
-Enable or disable the user. If the user is disabled, the bouncer will not connect to any of their networks, and downstream connections will be immediately closed. By default, users are enabled.
-.It user update [username] [options...]
-Update a user. The options are the same as the user create command.
-If username is omitted, the current user is updated. Only admins can update other users.
-
+.SS "user create \-username <username> \-password <password> [options...]"
+.sp
+Create a new suika user. Only admin users can create new accounts. The \-username and \-password flags are mandatory.
+Options are:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-username <username> \- The bouncer username. This cannot be changed after the user has been created.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-password <password> \- The bouncer password.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-disable\-password \- Disable password authentication. The user will be unable to login.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-admin [bool] \- Make the new user an administrator.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-nick <nick> \- Set the user\(cqs nickname. This is used as a fallback if there is no nickname set for a network.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-realname <realname> \- Set the user\(cqs realname. This is used as a fallback if there is no realname set for a network.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-enabled [bool] \- Enable or disable the user. If the user is disabled, the bouncer will not connect to any of their networks, and downstream connections will be immediately closed. By default, users are enabled.
+.RE
+.SS "user update [username] [options...]"
+.sp
+Update a user. The options are the same as the user create command. If username is omitted, the current user is updated. Only admins can update other users.
+.sp
 Not all flags are valid in all contexts:
-
-•The -username flag is never valid, usernames are immutable.
-•The -nick and -realname flag are only valid when updating the current user.
-•The -admin and -enabled flags are only valid when updating another user.
-.It user delete <username> [confirmation token]
-Delete a suika user.
-Only admins can delete other users.
-.It user run <username> <command...>
-Execute a command as another user.
-Only admins can use this command.
-.It server status
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+The \-username flag is never valid, usernames are immutable.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+The \-nick and \-realname flag are only valid when updating the current user.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+The \-admin and \-enabled flags are only valid when updating another user.
+.RE
+.SS "user delete <username> [confirmation token]"
+.sp
+Delete a suika user. Only admins can delete other users.
+=== user run <username> <command...>
+Execute a command as another user. Only admins can use this command.
+=== server status
 Show some bouncer statistics. Only admins can query this information.
-.It server notice <message>
+=== server notice <message>
 Broadcast a notice. All currently connected bouncer users will receive the message from the special BouncerServ service. Only admins can broadcast a notice.
-.El
-.Sh SEE ALSO
-.Xr suika 1
-.Xr suika-config 5
-.Sh AUTHORS
-.An Simon Ser and contributors
-.Lk https://emersion.fr
-.Pp
-.An Izuru Yakumo Aq Mt yakumo.izuru@chaotic.ninja
+.SH "SEE ALSO"
+.sp
+suika(1)
+suikadb(1)
+suika\-znc\-import(1)
+suika\-config(5)
+.SH "AUTHOR"
+.sp
+Simon Ser and contributors / Izuru Yakumo
Index: /trunk/doc/suika-bouncerserv.adoc
===================================================================
--- /trunk/doc/suika-bouncerserv.adoc	(revision 823)
+++ /trunk/doc/suika-bouncerserv.adoc	(revision 823)
@@ -0,0 +1,193 @@
+= suika-bouncerserv(7)
+Simon Ser and contributors / Izuru Yakumo
+v0.4.3
+:doctype: manpage
+:manmanual: Suika IRC Bouncer
+:mansource: SUIKA-BOUNCERSERV
+
+== Name
+suika-bouncerserv - Service bot exposed by suika(1) to control the bouncer
+
+== Description
+suika(1) exposes an IRC service called BouncerServ to manage the bouncer.
+Commands can be sent via regular private messages.
+Commands may be written in full or abbreviated form, for instance network
+can be abbreviated as net or just n.
+
+== Commands
+
+=== help [command]
+Show a list of commands.
+If command is specified, show a help message for the command.
+
+=== network-create -addr <addr> [options...]
+Connect to a new network at addr.
+The option -addr is mandatory.
+
+addr supports several connection types:
+* ircs://<host>:port - connects with TLS over TCP
+* irc+insecure://<host>:port - connects with plain-text over TCP
+* irc+unix://<path> - connects to a Unix domain socket
+
+Other options are:
+
+* -name <name>
+Short network name, this will be used instead of addr to refer to the network
+
+* -username <username>
+Connect with the specified username, by default, the nickname is used
+
+* -pass <pass>
+Connect with the specified server password
+
+* -realname <realname>
+Connect with the specified real name, by default, the account's realname is used if set, otherwise the network's nickname is used
+
+* -nick <nick>
+Connect with the specified nickname, by default, the account's username is used
+
+* -enabled [bool]
+Enable or disable the network, if the network is disabled, the bouncer won't connect to it, by default, the network is enabled
+
+* -connect-command <command>
+Send the specified command as a raw IRC message right after connecting to the server, this can be used to identify to an account if a server does not support SASL
+
+=== network update [options...]
+Update an existing network. The options are the same as the network create command.
+When this command is executed, suika(1) will disconnect and re-connect to the network.
+If name is not specified, the current network is updated.
+
+=== network delete [name]
+Disconnect and delete a network.
+If name is not specified, the current network is deleted.
+
+=== network quote [name] <command>
+Send a raw IRC line as-is to a network.
+If name is not specified, the command is sent to the current network.
+
+=== network status
+Show a list of saved networks and their current status.
+
+=== channel status [options...]
+Show a list of saved channels and their current status.
+Options:
+
+* -network <network>
+Only show channels for the specified network. By default, only the channels in the current network are displayed.
+
+=== channel update <name> [options...]
+Update the options of an existing channel.
+Options are:
+
+-detached [bool]
+Attach or detach this channel.
+A detached channel is joined but is hidden by the bouncer.
+This is useful to e.g. collect logs and highlights in low-interest or high-traffic channels.
+
+-relay-detached [mode] - Set when to relay messages from detached channels to the user with a BouncerServ NOTICE
+* message - Relay any message from this channel when detached.
+* highlight - Relay only messages mentioning you when detached.
+* none - Do not relay any messages from this channel when detached.
+* default - Currently same as highlight. This is the default behaviour.
+
+
+-reattach-on [mode] - Set when to automatically reattach to detached channels.
+
+* message - Reattach to this channel when any message is received.
+* highlight - Reattach to this channel when any message mentioning you is received.
+* none - Never automatically reattach to this channel.
+* default - Currently same as none. This is the default behaviour.
+
+-detach-after [duration]
+
+Automatically detach this channel after the specified duration has elapsed without receving any message corresponding to -detach-on. Example duration values: 1h30m, 30s, 2.5h. Setting this value to 0 will disable this behaviour, i.e. this channel will never be automatically detached. This is the default behaviour.
+
+-detach-on [mode]
+Set when to reset the auto-detach timer used by -detach-after, causing it to wait again for the auto-detach duration timer before detaching. Joining, reattaching, sending a message, or changing any channel option will reset the timer, in addition to the messages specified by the mode.
+
+* message - Receiving any message from this channel will reset the auto-detach timer.
+* highlight - Receiving any message mentioning you from this channel will reset the auto-detach timer.
+* none - Receiving messages from this channel will not reset the auto-detach timer. Sending messages or joining the channel will still reset the timer.
+* default - Currently same as message. This is the default behaviour.
+
+=== certfp generate [options...]
+Generate self-signed certificate and use it for authentication (via SASL EXTERNAL). Generates a 3072-bit RSA private key by default.
+Options are:
+
+* -network <network>
+Select a network. By default, the current network is selected, if any.
+
+* -key-type <type>
+Private key algorithm to use. Valid values are: rsa, ecdsa and ed25519. ecdsa uses the NIST P-521 curve.
+
+* -bits <bits>
+Size of RSA key to generate. Ignored for other key types.
+
+=== certfp fingerprint [options...]
+Show SHA-1 and SHA-256 fingerprints for the certificate currently used with the network.
+Options are:
+
+* -network <network>
+Select a network. By default, the current network is selected, if any.
+
+=== sasl status [options...]
+
+Show current SASL status.
+Options are:
+
+* -network <network>
+Select a network. By default, the current network is selected, if any.
+
+=== sasl set-plain [options...] <username> <password>
+Set SASL PLAIN credentials.
+Options are:
+
+* -network <network>
+Select a network. By default, the current network is selected, if any.
+
+=== sasl reset [options...]
+Disable SASL authentication and remove stored credentials.
+Options are:
+
+* -network <network>
+Select a network. By default, the current network is selected, if any.
+
+=== user status
+Show a list of users on this server. Only admins can query this information.
+
+=== user create -username <username> -password <password> [options...]
+
+Create a new suika user. Only admin users can create new accounts. The -username and -password flags are mandatory.
+Options are:
+
+* -username <username> - The bouncer username. This cannot be changed after the user has been created.
+* -password <password> - The bouncer password.
+* -disable-password - Disable password authentication. The user will be unable to login.
+* -admin [bool] - Make the new user an administrator.
+* -nick <nick> - Set the user's nickname. This is used as a fallback if there is no nickname set for a network.
+* -realname <realname> - Set the user's realname. This is used as a fallback if there is no realname set for a network.
+* -enabled [bool] - Enable or disable the user. If the user is disabled, the bouncer will not connect to any of their networks, and downstream connections will be immediately closed. By default, users are enabled.
+
+=== user update [username] [options...]
+Update a user. The options are the same as the user create command. If username is omitted, the current user is updated. Only admins can update other users.
+
+Not all flags are valid in all contexts:
+
+* The -username flag is never valid, usernames are immutable.
+* The -nick and -realname flag are only valid when updating the current user.
+* The -admin and -enabled flags are only valid when updating another user.
+
+=== user delete <username> [confirmation token]
+Delete a suika user. Only admins can delete other users.
+=== user run <username> <command...>
+Execute a command as another user. Only admins can use this command.
+=== server status
+Show some bouncer statistics. Only admins can query this information.
+=== server notice <message>
+Broadcast a notice. All currently connected bouncer users will receive the message from the special BouncerServ service. Only admins can broadcast a notice.
+
+== See Also
+suika(1)
+suikadb(1)
+suika-znc-import(1)
+suika-config(5)
Index: /trunk/doc/suika-config.5
===================================================================
--- /trunk/doc/suika-config.5	(revision 822)
+++ /trunk/doc/suika-config.5	(revision 823)
@@ -1,142 +1,326 @@
-.Dd $Mdocdate$
-.Dt SUIKA-CONFIG 5
-.Os
-.Sh NAME
-.Nm suika-config
-.Nd Configuration file for suika IRC bouncer
-.Sh DESCRIPTION
+'\" t
+.\"     Title: suika-config
+.\"    Author: Simon Ser and contributors / Izuru Yakumo
+.\" Generator: Asciidoctor 2.0.20
+.\"      Date: 2023-09-15
+.\"    Manual: Suika IRC Bouncer
+.\"    Source: SUIKA-CONFIG
+.\"  Language: English
+.\"
+.TH "SUIKA\-CONFIG" "5" "2023-09-15" "SUIKA\-CONFIG" "Suika IRC Bouncer"
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.ss \n[.ss] 0
+.nh
+.ad l
+.de URL
+\fI\\$2\fP <\\$1>\\$3
+..
+.als MTO URL
+.if \n[.g] \{\
+.  mso www.tmac
+.  am URL
+.    ad l
+.  .
+.  am MTO
+.    ad l
+.  .
+.  LINKSTYLE blue R < >
+.\}
+.SH "NAME"
+suika-config \- Configuration file for suika(1)
+.SH "DESCRIPTION"
+.sp
 The config file has one directive per line
-
+.sp
 Example:
-
+.sp
 listen ircs://
-.Pp
 tls cert.pem key.pem
-.Pp
 hostname example.org
-
+.sp
 The following directives are supported:
-
-.Bl -tag -width 7n -compact
-.It listen <uri>
-Listening URI (default: ":6697")
-
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+listen <uri>
+Listening URI (default ":6697")
+.RE
+.sp
 The following URIs are supported:
-.Bl -tag -width 11n -compact
-.It ircs://[host]:[port]
-listens with TLS over TCP
-.It irc+insecure://[host]:[port]
-listens with plain-text over TCP
-.It unix:///<path>
-listens on a Unix domain socket
-.It wss://[host]:[port]
-listens for WebSocket connections over
-TLS
-.It ws+insecure://[host]:[port]
-listens for plain-text WebSocket
-connections
-.It ident://[host]:[port]
-listens for plain-text ident
-connections
-.It http+prometheus://[host]:[port]
-listens for plain-text HTTP
-connections and serves Prometheus 
-metrics (host must be "localhost")
-.It http+pprof://[host]:[port]
-listens for plain-text HTTP 
-connections and serves pprof 
-runtime profiling data 
-(host must be "localhost"). 
-For more information, see: 
-<https://pkg.go.dev/net/http/pprof>.
-.El
-
-If the scheme is omitted, "ircs" is assumed.
-If multiple "listen" directives are specified,
-suika will listen on each of them.
-
-.It hostname <name>
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+ircs://host:port
+Listens with TLS over TCP
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+irc+insecure://host:port
+Listens with plain\-text over TCP
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+unix:///<path>
+Listens on a Unix domain socket
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+unix+admin:///<path>
+Listens on a Unix domain socket for use with suikactl(1)
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+wss://host:port
+Listens for WebSocket connections over TLS
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+ws+insecure://host:port
+Listens for plain\-text WebSocket connections
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+ident://host:port
+Listens for plain\-text ident connections
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+http+prometheus://host:port
+Listens for plain\-text HTTP connections and serves Prometheus metrics (host must be "localhost")
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+http+pprof://host:port
+Listens for plain\-text HTTP connections and serves pprof runtime profiling data (host must be "localhost")
+For more information, see: \c
+.URL "https://pkg.go.dev/net/http/pprof" "" "."
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+hostname <name>
 Server hostname
-
-.It title <title>
-Server title. This will be sent as
-the ISUPPORT NETWORK value when
-clients don't select a specific
-network.
-
-.It tls <cert> <key>
-Enable TLS support. The certificate
-and key files must be PEM-encoded.
-
-.It db <driver> <source>
-Set the database location for user,
-network and channel storage. By
-default, a sqlite3 database is
-opened in ./suika.db.
-
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+title <title>
+Server title. This will be sent as the ISUPPORT NETWORK value when clients don\(cqt select a specific network.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+tls <cert> <key>
+Enable TLS support. The certificate and key files must be PEM\-encoded.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+db <driver> <source>
+Set the database location for user, network and channel storage.
+By default, a sqlite3 database is opened in ./suika.db.
+.RE
+.sp
 Supported drivers:
-
-.Bl tag -width 7n -compact
-.It sqlite3
-expects source to be a path to
-the SQLite file
-.It postgres
-expects source to be a space-
-separated list of key=value
-parameters, e.g. db postgres
-host=/run/postgresql
-dbname=suika. Note that
-sslmode defaults to require.
-For more information on
-connection strings, see:
-<https://pkg.go.dev/github.com/lib/pq#hdr-Connection_String_Parameters>
-.El
-
-.It log fs <path>
-Path to the bouncer logs directory, or empty to
-disable logging. By default, logging is disabled.
-
-.It http-origin <patterns>
-List of allowed HTTP origins for WebSocket listeners. 
-The parameters are interpreted as shell patterns, see *glob*(7).
-
-By default, only the request host is authorized. 
-Use this directive to enable cross-origin WebSockets.
-
-.It accept-proxy-ip <cidr..>
-Allow the specified IPs to act as a proxy. Proxys have the ability to
-overwrite the remote and local connection addresses (via the PROXY protocol,
-the Forwarded HTTP header field defined in RFC 7239 or the X-Forwarded-\*
-HTTP header fields). The special name "localhost" accepts the loopback
-addresses 127.0.0.0/8 and ::1/128.
-
+* sqlite3: expects source to be a path to the SQLite file
+* postgres: expects source to be a space\- separated list of key=value parameters, e.g. db postgres host=/run/postgresql dbname=suika.
+Note that sslmode defaults to require.
+For more information on connection strings, see: \c
+.URL "https://pkg.go.dev/github.com/lib/pq#hdr\-Connection_String_Parameters" "" ""
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+log fs <path>
+Path to the bouncer logs directory, or empty to disable logging.
+By default, logging is disabled.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+http\-origin <patterns>
+List of allowed HTTP origins for WebSocket listeners. The parameters are interpreted as shell patterns, see glob(3)
+By default, only the request host is authorized. Use this directive to enable cross\-origin WebSockets.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+accept\-proxy\-ip <cidr..>
+Allow the specified IPs to act as a proxy.
+Proxies have the ability to overwrite the remote and local connection addresses (via the PROXY protocol, the Forwarded HTTP header field defined in RFC 7239 or the X\-Forwarded\- HTTP header fields).
+The special name "localhost" accepts the loopback addresses 127.0.0.0/8 and ::1/128.
 By default, all IPs are rejected.
-
-.It max-user-networks <limit>
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+max\-user\-networks <limit>
 Maximum number of networks per user. By default, there is no limit.
-
-.It motd <path>
-Path to the MOTD file. The bouncer MOTD is sent to clients which aren't
-bound to a specific network. By default, no MOTD is sent.
-
-.It multi-upstream-mode <true|false>
-Globally enable or disable multi-upstream mode. 
-By default, multi-upstream mode is enabled.
-
-.It upstream-user-ip <cidr...>
-Enable per-user IP addresses. 
-One IPv4 range and/or one IPv6 range can be
-specified in CIDR notation. 
-One IP address per range will be assigned to
-each user and will be used as the source address when connecting to an
-upstream network.
-
-This can be useful to avoid having the whole bouncer banned from an upstream
-network because of one malicious user.
-.El
-.Sh SEE ALSO
-.Xr suika 1
-.Xr suika-bouncerserv 7
-.Sh AUTHORS
-.An Simon Ser and contributors Aq https://emersion.fr
-.An Izuru Yakumo Aq Mt yakumo.izuru@chaotic.ninja
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+motd <path>
+Path to the MOTD file.
+The bouncer MOTD is sent to clients which aren\(cqt bound to a specific network.
+By default, no MOTD is sent.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+multi\-upstream\-mode <true|false>
+Globally enable or disable multi\-upstream mode.
+By default, multi\-upstream mode is enabled.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+upstream\-user\-ip <cidr...>
+Enable per\-user IP addresses.
+One IPv4 range and/or one IPv6 range can be specified in CIDR notation.
+One IP address per range will be assigned to each user and will be used as the source address when connecting to an upstream network.
+This can be useful to avoid having the whole bouncer banned from an upstream network because of one malicious user.
+.RE
+.SH "SEE ALSO"
+.sp
+suika(1)
+suikadb(1)
+suika\-znc\-import(1)
+suika\-bouncerserv(7)
+.SH "AUTHOR"
+.sp
+Simon Ser and contributors / Izuru Yakumo
Index: /trunk/doc/suika-config.adoc
===================================================================
--- /trunk/doc/suika-config.adoc	(revision 823)
+++ /trunk/doc/suika-config.adoc	(revision 823)
@@ -0,0 +1,104 @@
+= suika-config(5)
+Simon Ser and contributors / Izuru Yakumo
+v0.4.3
+
+:doctype: manpage
+:manmanual: Suika IRC Bouncer
+:mansource: SUIKA-CONFIG
+
+== Name
+suika-config - Configuration file for suika(1)
+
+== Description
+The config file has one directive per line
+
+Example:
+
+listen ircs://
+tls cert.pem key.pem
+hostname example.org
+
+The following directives are supported:
+
+* listen <uri>
+Listening URI (default ":6697")
+
+The following URIs are supported:
+
+* ircs://host:port
+Listens with TLS over TCP
+* irc+insecure://host:port
+Listens with plain-text over TCP
+* unix:///<path>
+Listens on a Unix domain socket
+* unix+admin:///<path>
+Listens on a Unix domain socket for use with suikactl(1)
+* wss://host:port
+Listens for WebSocket connections over TLS
+* ws+insecure://host:port
+Listens for plain-text WebSocket connections
+* ident://host:port
+Listens for plain-text ident connections
+* http+prometheus://host:port
+Listens for plain-text HTTP connections and serves Prometheus metrics (host must be "localhost")
+* http+pprof://host:port
+Listens for plain-text HTTP connections and serves pprof runtime profiling data (host must be "localhost")
+For more information, see: https://pkg.go.dev/net/http/pprof.
+
+--
+
+* hostname <name>
+Server hostname
+* title <title>
+Server title. This will be sent as the ISUPPORT NETWORK value when clients don't select a specific network.
+* tls <cert> <key>
+Enable TLS support. The certificate and key files must be PEM-encoded.
+* db <driver> <source>
+Set the database location for user, network and channel storage.
+By default, a sqlite3 database is opened in ./suika.db.
+
+Supported drivers:
+* sqlite3: expects source to be a path to the SQLite file
+* postgres: expects source to be a space- separated list of key=value parameters, e.g. db postgres host=/run/postgresql dbname=suika.
+Note that sslmode defaults to require.
+For more information on connection strings, see: https://pkg.go.dev/github.com/lib/pq#hdr-Connection_String_Parameters
+
+--
+
+* log fs <path>
+Path to the bouncer logs directory, or empty to disable logging.
+By default, logging is disabled.
+
+* http-origin <patterns>
+List of allowed HTTP origins for WebSocket listeners. The parameters are interpreted as shell patterns, see glob(3)
+By default, only the request host is authorized. Use this directive to enable cross-origin WebSockets.
+
+* accept-proxy-ip <cidr..>
+Allow the specified IPs to act as a proxy.
+Proxies have the ability to overwrite the remote and local connection addresses (via the PROXY protocol, the Forwarded HTTP header field defined in RFC 7239 or the X-Forwarded- HTTP header fields).
+The special name "localhost" accepts the loopback addresses 127.0.0.0/8 and ::1/128.
+By default, all IPs are rejected.
+
+* max-user-networks <limit>
+Maximum number of networks per user. By default, there is no limit.
+
+* motd <path>
+Path to the MOTD file.
+The bouncer MOTD is sent to clients which aren't bound to a specific network.
+By default, no MOTD is sent.
+
+* multi-upstream-mode <true|false>
+Globally enable or disable multi-upstream mode.
+By default, multi-upstream mode is enabled.
+
+* upstream-user-ip <cidr...>
+Enable per-user IP addresses.
+One IPv4 range and/or one IPv6 range can be specified in CIDR notation.
+One IP address per range will be assigned to each user and will be used as the source address when connecting to an upstream network.
+This can be useful to avoid having the whole bouncer banned from an upstream network because of one malicious user.
+
+== See Also
+suika(1)
+suikadb(1)
+suika-znc-import(1)
+suika-bouncerserv(7)
Index: /trunk/doc/suika-znc-import.adoc
===================================================================
--- /trunk/doc/suika-znc-import.adoc	(revision 823)
+++ /trunk/doc/suika-znc-import.adoc	(revision 823)
@@ -0,0 +1,19 @@
+= suika-znc-import(1)
+Simon Ser and contributors / Izuru Yakumo
+v0.4.3
+
+:doctype: manpage
+:manmanual: Suika IRC Bouncer
+:mansource: SUIKA-ZNC-IMPORT
+
+== Name
+suika-znc-import - Command for migrating from ZNC
+
+== Synopsis
+suika-znc-import <command> [options] <znc config file>
+
+== See Also
+suika(1)
+suikadb(1)
+suika-config(5)
+suika-bouncerserv(7)
Index: /trunk/doc/suika.1
===================================================================
--- /trunk/doc/suika.1	(revision 822)
+++ /trunk/doc/suika.1	(revision 823)
@@ -1,102 +1,154 @@
-.Dd $Mdocdate$
-.Dt SUIKA 1
-.Os
-.Sh NAME
-.Nm suika
-.Nd Drunk as hell IRC bouncer oni.
-.Sh SYNOPSIS
-.Nm
-.Op Fl options
-.Ar ...
-.Sh DESCRIPTION
-suika is an user-friendly IRC bouncer.
-It connects to upstream IRC servers on
-behalf of the user to provide extra
-features.
-
-.Bl -tag -width 10n -compact
-.It *
-Multiple separate users sharing the same
-bouncer, each with their own upstream
-servers
-.It *
-Clients connecting to multiple upstream
-servers via a single connection to the
-bouncer
-.It *
-Sending the backlog (messages received
-while the user was disconnected from
-the bouncer), with per-client buffers
-.El
-
-When joining a channel, the channel will
-be saved and automatically joined on
-the next connection. When registering
-or authenticating with NickServ, the
-credentials will be saved and
-automatically used on the next
-connection if the server supports
-SASL. When parting a channel with
-the reason "detach", the channel
-will be detached instead of being
-left.
-
-When all clients are disconnected
-from the bouncer, the user is
-automatically marked as away.
-
+'\" t
+.\"     Title: suika
+.\"    Author: Simon Ser and contributors / Izuru Yakumo
+.\" Generator: Asciidoctor 2.0.20
+.\"      Date: 2023-09-15
+.\"    Manual: Suika IRC Bouncer
+.\"    Source: SUIKA
+.\"  Language: English
+.\"
+.TH "SUIKA" "1" "2023-09-15" "SUIKA" "Suika IRC Bouncer"
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.ss \n[.ss] 0
+.nh
+.ad l
+.de URL
+\fI\\$2\fP <\\$1>\\$3
+..
+.als MTO URL
+.if \n[.g] \{\
+.  mso www.tmac
+.  am URL
+.    ad l
+.  .
+.  am MTO
+.    ad l
+.  .
+.  LINKSTYLE blue R < >
+.\}
+.SH "NAME"
+suika \- Drunk as hell IRC bouncer, named after Suika Ibuki from Touhou Project
+.SH "SYNOPSIS"
+.sp
+suika [\-options] ...
+.SH "DESCRIPTION"
+.sp
+suika is an user\-friendly IRC bouncer.
+It connects to upstream IRC servers on behalf of the user to provide extra features.
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+Multiple separate users sharing the same bouncer, each with their own upstream servers
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+Clients connecting to multiple upstream servers via a single connection to the bouncer
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+Sending the backlog (messages received while the user was disconnected from the bouncer), with per\-client buffers
+.RE
+.sp
+When joining a channel, the channel will be saved and automatically joined on the next connection.
+When registering or authenticating with NickServ, the credentials will be saved and automatically used on the next connection if the server supports SASL.
+When parting a channel with the reason "detach", the channel will be detached instead of being left.
+When all clients are disconnected from the bouncer, the user is automatically marked as away.
+.sp
 suika supports two connection modes:
-
-.Bl -tag -width 10n -compact
-.It Single upstream mode
-one downstream connection maps to one upstream
-connection. To enable this mode, 
-connect to the bouncer with the username
-"<username>/<network>". 
-If the bouncer isn't connected to the upstream
-server, it will get automatically added. 
-Then channels can be joined and
-parted as if you were directly 
-connected to the upstream server.
-.It Multiple upstream mode 
-one downstream connection maps to multiple upstream
-connections. 
-Channels and nicks are suffixed 
-with the network name. To join
-a channel, you need to use 
-the suffix too: 
-/join #channel/network. 
-Same applies to messages 
-sent to users.
-.El
-
-For per-client history to work, clients need to indicate their name. This can
-be done by adding a "@<client>" suffix to the username.
-
-suika will reload the configuration file, the TLS certificate/key and the MOTD
-file when it receives the HUP signal. The configuration options listen, db
-and log cannot be reloaded.
-
-Administrators can broadcast a message to all bouncer users via /notice
-$<hostname> <text>, or via /notice $\* <text> in multi-upstream mode. All
-currently connected bouncer users will receive the message from the special
-BouncerServ service.
-
-.Sh OPTIONS
-.Bl -tag -width 11n -compact
-.It -h, -help
+.sp
+Single upstream mode: one downstream connection maps to one upstream connection. To enable this mode, connect to the bouncer with the username "<username>/<network>".
+If the bouncer isn\(cqt connected to the upstream server, it will get automatically added.
+Then channels can be joined and parted as if you were directly connected to the upstream server.
+.sp
+Multiple upstream mode: one downstream connection maps to multiple upstream connections.
+Channels and nicks are suffixed with the network name.
+To join a channel, you need to use the suffix too: /join #channel/network.
+Same applies to messages sent to users.
+.sp
+For per\-client history to work, clients need to indicate their name.
+This can be done by adding a "@<client>" suffix to the username.
+.sp
+suika will reload the configuration file, the TLS certificate/key and the MOTD file when it receives the HUP signal.
+The configuration options listen, db and log cannot be reloaded.
+.sp
+Administrators can broadcast a message to all bouncer users via /notice $<hostname> <text>, or via /notice $<text> in multi\-upstream mode.
+All currently connected bouncer users will receive the message from the special BouncerServ service.
+.SH "OPTIONS"
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-h, \-help
 Show help message and quit
-.It -config <path>
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-config <path>
 Path to the config file. If unset, a default config file is used.
-.It -debug 
-Enable debug logging (this will leak sensitive information
-such as passwords)
-.It -listen <uri>
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-debug
+Enable debug logging (this will leak sensitive information such as passwords)
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\-listen <uri>
 Listening URI (default ":6697"). Can be specified multiple times.
-.El
-.Sh SEE ALSO
-.Xr suika-config 5
-.Xr suika-bouncerserv 7
-.Sh AUTHORS
-.An Simon Ser and contributors https://emersion.fr
-.An Izuru Yakumo Aq Mt yakumo.izuru@chaotic.ninja
+.RE
+.SH "SEE ALSO"
+.sp
+suikadb(1)
+suika\-znc\-import(1)
+suika\-config(5)
+suika\-bouncerserv(7)
+.SH "AUTHOR"
+.sp
+Simon Ser and contributors / Izuru Yakumo
Index: /trunk/doc/suika.adoc
===================================================================
--- /trunk/doc/suika.adoc	(revision 823)
+++ /trunk/doc/suika.adoc	(revision 823)
@@ -0,0 +1,61 @@
+= suika(1)
+Simon Ser and contributors / Izuru Yakumo
+v0.4.3
+:doctype: manpage
+:manmanual: Suika IRC Bouncer
+:mansource: SUIKA
+
+== Name
+suika - Drunk as hell IRC bouncer, named after Suika Ibuki from Touhou Project
+
+== Synopsis
+suika [-options] ...
+
+== Description
+suika is an user-friendly IRC bouncer.
+It connects to upstream IRC servers on behalf of the user to provide extra features.
+
+* Multiple separate users sharing the same bouncer, each with their own upstream servers
+* Clients connecting to multiple upstream servers via a single connection to the bouncer
+* Sending the backlog (messages received while the user was disconnected from the bouncer), with per-client buffers
+
+When joining a channel, the channel will be saved and automatically joined on the next connection.
+When registering or authenticating with NickServ, the credentials will be saved and automatically used on the next connection if the server supports SASL.
+When parting a channel with the reason "detach", the channel will be detached instead of being left.
+When all clients are disconnected from the bouncer, the user is automatically marked as away.
+
+suika supports two connection modes:
+
+Single upstream mode: one downstream connection maps to one upstream connection. To enable this mode, connect to the bouncer with the username "<username>/<network>".
+If the bouncer isn't connected to the upstream server, it will get automatically added.
+Then channels can be joined and parted as if you were directly connected to the upstream server.
+
+Multiple upstream mode: one downstream connection maps to multiple upstream connections.
+Channels and nicks are suffixed with the network name.
+To join a channel, you need to use the suffix too: /join #channel/network.
+Same applies to messages sent to users.
+
+For per-client history to work, clients need to indicate their name.
+This can be done by adding a "@<client>" suffix to the username.
+
+suika will reload the configuration file, the TLS certificate/key and the MOTD file when it receives the HUP signal.
+The configuration options listen, db and log cannot be reloaded.
+
+Administrators can broadcast a message to all bouncer users via /notice $<hostname> <text>, or via /notice $<text> in multi-upstream mode.
+All currently connected bouncer users will receive the message from the special BouncerServ service.
+
+== Options
+* -h, -help
+    Show help message and quit
+* -config <path>
+    Path to the config file. If unset, a default config file is used.
+* -debug
+    Enable debug logging (this will leak sensitive information such as passwords)
+* -listen <uri>
+    Listening URI (default ":6697"). Can be specified multiple times.
+
+== See Also
+suikadb(1)
+suika-znc-import(1)
+suika-config(5)
+suika-bouncerserv(7)
Index: /trunk/doc/suikadb.1
===================================================================
--- /trunk/doc/suikadb.1	(revision 823)
+++ /trunk/doc/suikadb.1	(revision 823)
@@ -0,0 +1,45 @@
+'\" t
+.\"     Title: suikadb
+.\"    Author: Simon Ser and contributors / Izuru Yakumo
+.\" Generator: Asciidoctor 2.0.20
+.\"      Date: 2023-09-15
+.\"    Manual: Suika IRC Bouncer
+.\"    Source: SUIKADB
+.\"  Language: English
+.\"
+.TH "SUIKADB" "1" "2023-09-15" "SUIKADB" "Suika IRC Bouncer"
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.ss \n[.ss] 0
+.nh
+.ad l
+.de URL
+\fI\\$2\fP <\\$1>\\$3
+..
+.als MTO URL
+.if \n[.g] \{\
+.  mso www.tmac
+.  am URL
+.    ad l
+.  .
+.  am MTO
+.    ad l
+.  .
+.  LINKSTYLE blue R < >
+.\}
+.SH "NAME"
+suikadb \- Basic user manipulation command for suika(1)
+.SH "SYNOPSIS"
+.sp
+suikadb create\-user
+suikadb change\-password
+.SH "SEE ALSO"
+.sp
+suika(1)
+suikactl(1)
+suika\-znc\-import(1)
+suika\-config(5)
+suika\-bouncerserv(7)
+.SH "AUTHOR"
+.sp
+Simon Ser and contributors / Izuru Yakumo
Index: /trunk/doc/suikadb.adoc
===================================================================
--- /trunk/doc/suikadb.adoc	(revision 823)
+++ /trunk/doc/suikadb.adoc	(revision 823)
@@ -0,0 +1,21 @@
+= suikadb(1)
+Simon Ser and contributors / Izuru Yakumo
+v0.4.3
+
+:doctype: manpage
+:manmanual: Suika IRC Bouncer
+:mansource: SUIKADB
+
+== Name
+suikadb - Basic user manipulation command for suika(1)
+
+== Synopsis
+suikadb create-user
+suikadb change-password
+
+== See Also
+suika(1)
+suikactl(1)
+suika-znc-import(1)
+suika-config(5)
+suika-bouncerserv(7)
Index: /trunk/service.go
===================================================================
--- /trunk/service.go	(revision 822)
+++ /trunk/service.go	(revision 823)
@@ -1108,5 +1108,4 @@
 	return nil
 }
-
 func handleServiceServerStatus(ctx context.Context, dc *downstreamConn, params []string) error {
 	dbStats, err := dc.user.srv.db.Stats(ctx)
