Roadmap

[kzndotsh]

Docker

• How to compile from source?
  • What dependencies do I need?
• How to Upgrades?
• How would we seperate staging and prod?
• How much storage is needed?

UnrealIRCD

• How to configure UnrealIRCD?
• How to setup Let's Encrypt?
• Do we want to use fingerprint certifs?
• Do we want to allow DCC?
  • If so, what should we consider?
  • If so, how would we set it up?
• How would we secure UnrealIRCD in a manner which is complicit with the Security wiki page?
• How would we setup the MOTD?
• How would we have a multi server setup?
  • How do we balance load?
• How do we handle telemetry?
  • How do we set this up with Grafana?
    • Should we use the JSON-RPC?
• Should we support I2P
• Should we support Tor?
• How should we manage modules?
  • How should we update them?
  • How would be profit off of them (not monetarily)?
  • How do we source them?
  • How would make the daemon independent from modules?
• What are websockets?
• How should the daemon export logs?

Any other IRCd?

• If UnrealIRCD is not good enough
  • Should we consider InspIRCd?

Services

• What are services?
• What services do we need?
  • How should we setup ChanServ?
  • How should we setup NickServ?
• Why should we use Atheme?
  • How should we setup Atheme?
• Why should we use Anope?
  • How should we setup Anope?
• Should we offer our own services?

IRC clients

• What exists?
  • Why would we use Gamja?
  • Why would we use KiwiIRC?
  • Should we offer a web frontend?

IRC in general

• How would an IRC operator administrate the server?
• How to setup moderation for Discord moderators to handle IRC situations?
• What could a moderator use?
• How to use central API?
• What are channel modes?
• What are prefixes?
• What the FUCK is a k-line?
  • What the fuck is a g-line?
• How would a user be cloaked?
• What is a snomask?
• How can users report?
  • How can a user report without Discord's ticket system?

Useful links

• https://www.unrealircd.org/docs/Distributing_user_load_and_doing_server_maintenance
• https://www.unrealircd.org/docs/Configuration
• https://www.unrealircd.org/docs/FAQ
• https://www.unrealircd.org/docs/Features
• https://www.unrealircd.org/docs/Security
• https://www.unrealircd.org/docs/Tip_of_the_day
• https://www.unrealircd.org/docs/Upgrading

[kzndotsh]

AI braindump

UnrealIRCd + Docker: Community Server Roadmap

0) Goals and Requirements

• Purpose: real-time chat for community with clear moderation, security, and reliability.
• Key requirements:
  • Environments: dev, staging, prod
  • TLS-only, modern ciphers
  • Persistent data and backup
  • Moderation tools (anti-spam, registration, services)
  • Observable operations (logs, alerts)
  • Clear docs (admin + users)

1) Architecture Overview

• Core: UnrealIRCd in Docker
• IRC Services: Anope (NickServ/ChanServ/etc.) in Docker
• Optional:
  • Web client (The Lounge/KiwiIRC) via WebSocket support
  • Bouncer (ZNC) for power users
  • Multi-server linking (scaling and regional presence)
• Storage:
  • Volumes for configs, TLS certs/keys, logs
  • Anope DB (SQLite or MariaDB/Postgres) with backups
• Networking:
  • Docker network, exposed ports: 6697 (TLS), optional 6667 (plaintext disabled in prod)
  • Reverse proxy only if needed (e.g., for WebSockets/observability)

2) Environments

• Dev:
  • Self-signed TLS, test users, minimal modules
  • Fast iteration on configs/modules
• Staging:
  • Real certs, mirror prod modules/settings
  • Pre-release testing of policy changes and upgrades
• Prod:
  • Strict security, comprehensive logging, backups & monitoring
  • Change control via PRs and scheduled maintenance

3) Containerization & IaC

• Repository layout:
  • docker/ (Dockerfiles, entrypoints)
  • compose/ (dev.yml, staging.yml, prod.yml)
  • unrealircd/conf.d/ (*.conf split by domain: security, connect-classes, modules, spamfilter)
  • services/anope/
  • docs/ (runbooks, user guides, policies)
• Build:
  • Multi-stage Dockerfile for UnrealIRCd with optional third-party modules build steps
• Runtime:
  • docker-compose or Docker Swarm/Nomad/Kubernetes (start with compose)

4) Configuration Management

• Config split:
  • unrealircd.conf includes conf.d/*.conf
  • secrets in env files or mounted files (never in repo)
• Per-environment overrides via compose profiles or separate files
• Config test in CI before deploy (unrealircd config check)

5) Security Baseline

• TLS:
  • TLS 1.2/1.3 only, modern ciphers, 4096-bit key, rotate certs routinely
  • Unique DH params if applicable
• Access control:
  • Separate oper classes/roles and least privilege
  • SASL and/or certfp for staff and bots
  • Consider opers restricted to certfp only
• Server policy:
  • Prefer TLS-only (disable plaintext listener in prod)
  • Connection classes with rate limits per-IP and per-subnet
  • DNSBL/blacklist integration for known abusers
• Secrets:
  • Store TLS keys, oper passwords, services secrets in a secrets manager or encrypted at rest
  • Rotate cloak-keys and oper credentials periodically
• Hardening:
  • Disable unneeded modules/commands
  • Anti-flood and throttle settings
  • Spamfilter rules (bad words, invite spam, mass-mentions)
• Compliance:
  • Clear ToS/Code of Conduct, privacy policy, log retention policy

6) Moderation & Community Management

• IRC Services (Anope):
  • NickServ (registration, enforce), ChanServ (ops/akicks), HostServ, MemoServ (optional)
• Channel defaults:
  • Registration required for core channels
  • Conservative modes to limit spam (e.g., moderated/unregistered-limited modes where appropriate)
• Automated protections:
  • Spamfilter and anti-flood
  • DNSBL, connection throttling
• Staff playbooks:
  • Escalation ladder: warn → mute → kick → ban → G-Line/Shun when necessary
  • Runbooks: incident response, raid handling, evidence capture
• Appeal process documented and accessible

7) Modules Strategy

• Core modules: enable recommended defaults only
• Optional modules:
  • WebSocket support (if using web clients)
  • Cloak/host masking
  • SASL mechanisms
• Third-party modules:
  • Security review, pin versions, build in dedicated stage, track licenses
• Versioning and rollback plan per module

8) Networking & Clients

• Ports: 6697 (TLS) exposed; 6667 disabled in prod
• Web client:
  • If used, enable UnrealIRCd WebSocket module and configure CORS/origins
• Linking (optional):
  • Peering configs, per-link TLS certs/keys, split detection, test netsplits/relinks

9) CI/CD & Testing

• CI:
  • Lint configs, run UnrealIRCd config test
  • Build Docker images, scan for vulnerabilities
• CD:
  • Staging deploy on merge to main, manual approval for prod
  • Zero-downtime or scheduled rolling restarts
• Tests:
  • Smoke: connect with TLS, SASL auth, join/talk
  • Moderation: spamfilter triggers, flood controls
  • Services: register nick, channel ops, password reset flows
  • Upgrade tests for UnrealIRCd and Anope

10) Observability & Operations

• Logs:
  • Structured logging to stdout; ship to ELK/Loki
  • Channel service logs retained securely
• Metrics/health:
  • Container healthchecks (port, config test)
  • Basic stats exported via scripts if needed
• Alerts:
  • High connection error rates, repeated bans/spam triggers, service restarts
• Backups:
  • TLS certs/keys, cloak-keys, UnrealIRCd configs, Anope DB
  • Nightly encrypted backups, restore drills quarterly
• Maintenance:
  • Monthly patch window; announce and pin upgrade plan
  • Disaster recovery plan tested (restore from backup, rotate secrets)

11) Documentation

• Public:
  • How to connect (TLS, ports), code of conduct, registration guide
  • Channel directory and purpose
  • Privacy & data retention
• Internal:
  • Runbooks (deploy, rollback, moderation, incident response)
  • Architecture diagrams, config references
  • On-call guide and contacts

12) Timeline (Suggested)

• Week 1: Requirements, repo setup, base Dockerfiles, dev compose, basic configs
• Week 2: Staging environment, TLS, services (Anope), basic moderation policies
• Week 3: CI config tests, logging pipeline, spamfilters, docs (public + internal)
• Week 4: Load/smoke tests, staff training, announce, production launch
• Ongoing: Monthly updates, quarterly DR drills, feedback and policy refinement

13) Open Decisions

• Allow public access or require registration for all channels?
• Single server vs. linked multi-server network?
• Web client offering?
• Database choice for Anope (SQLite vs. MariaDB/Postgres)?
• Log retention period and jurisdictional privacy requirements?

[amadaluzia]

services/anope

Are we moving to Anope or are we still using Atheme?

[kzndotsh]

services/anope

Are we moving to Anope or are we still using Atheme?

Can you provide me a bullet list of what their differences is? what boxes they check? Does atheme include anope?