diff --git a/.env.example b/.env.example new file mode 100644 index 00000000..aa3d3b29 --- /dev/null +++ b/.env.example @@ -0,0 +1,332 @@ +# ============================================================================ +# X3 IRC Services — Docker environment defaults (.env.example) +# ============================================================================ +# +# HOW TO USE +# 1. Copy this file to .env.local: cp .env.example .env.local +# 2. Edit .env.local and change ONLY the values you care about — every value +# shown here is already the built-in default the container entrypoint +# (docker/dockerentrypoint.sh) would use anyway. You never need to set a +# var just to keep its default; only OVERRIDE what you want to change. +# 3. At minimum, review the lines marked "CHANGE THIS — secret" below. +# +# HOW IT WORKS (regeneration policy) +# On container start, dockerentrypoint.sh reads docker/x3.conf-dist, replaces +# each %X3_*% placeholder with the matching environment variable (falling +# back to the defaults documented here), and writes /x3/data/x3.conf. +# It only (re)generates that file when the file is absent OR its first line +# carries the generator marker ("// GENERATED BY dockerentrypoint.sh ..."). +# A user-supplied x3.conf that LACKS that marker (e.g. a volume-mounted, +# hand-managed config) is left untouched and these variables are ignored. +# +# FORWARD-COMPATIBILITY +# This file is intended to eventually become X3's single canonical, documented +# source of default values — a future change may have X3 read .env* directly +# instead of templating through the entrypoint. It is therefore written to be +# complete (all 70 X3_* vars), accurate (exact entrypoint defaults), and +# self-contained (each var is understandable without reading source). +# +# Value syntax: shell-style KEY=value, one per line. Do not add quotes unless +# the value itself must contain them (see X3_SUPPORT_CHANNEL). +# ============================================================================ + + +# ---------------------------------------------------------------------------- +# Server identity (conf: "server" { } — how this X3 presents on the network) +# ---------------------------------------------------------------------------- + +# Server name X3 announces on link. This MUST be the name used in the ircd's +# Connect/C:line for X3. Shows in /links and /whois. +X3_GENERAL_NAME=x3.network + +# Free-text server description, shown in /links. +X3_GENERAL_DESCRIPTION=Network Services + +# Network domain. Used as the "network" name and woven into the hidden-host +# suffix (Users.), admin block, and all mail from/body templates. +X3_GENERAL_DOMAIN=example.com + +# Server numeric. Each server on a P10 network needs a unique numeric — +# if you get collisions on link, CHANGE THIS. +X3_GENERAL_NUMERIC=199 + +# Protocol/compat type — MUST match your ircd version: +# 8 = Nefarious 1.3.x and higher (legacy) +# 9 = Nefarious 2.0.x / nefarious2 (current) +# (Lower values 4-7 exist for old/obsolete ircds.) Default is 8; set 9 for +# a modern nefarious2 uplink. +X3_SERVER_TYPE=8 + +# LOCAL source IP X3 binds when connecting out to the uplink (uplink +# "bind_address"). Also becomes the default connect-from address. +X3_GENERAL_BIND_ADDRESS=127.0.0.1 + + +# ---------------------------------------------------------------------------- +# Uplink (conf: "uplinks"."Hub" — the IRC server X3 links to) +# ---------------------------------------------------------------------------- + +# IP/address of the ircd X3 connects to. +X3_UPLINK_ADDRESS=127.0.0.1 + +# TCP port of the uplink's server (C:line) listener. +X3_UPLINK_PORT=8888 + +# CHANGE THIS — secret. Link password; fills BOTH "password" and +# "uplink_password" and must match the pass in the ircd's Connect/C:line for X3. +X3_UPLINK_PASSWORD=changeme + + +# ---------------------------------------------------------------------------- +# Service bot nicks (conf: "services".."nick") +# ---------------------------------------------------------------------------- + +# Authentication service (NickServ/AuthServ) — register and auth here. +X3_NICKSERV_NICK=AuthServ + +# Operator service (OpServ) nick. Afternet uses "O3" (easier to type). +X3_OPSERV_NICK=O3 + +# OpServ /whois hostname (only used because OpServ also sets a description). +X3_OPSERV_HOSTNAME=X3.Services + +# Channel service (ChanServ) nick. +X3_CHANSERV_NICK=X3 + +# Global announcement bot nick. +X3_GLOBAL_NICK=Global + +# MemoServ bot nick (user-to-user memos module). +X3_MEMOSERV_BOT=MemoServ + + +# ---------------------------------------------------------------------------- +# Channels (service/report/autojoin channels) +# ---------------------------------------------------------------------------- + +# OpServ debug channel — bot joins it; also the target for override/error/fatal +# log events. +X3_DEBUG_CHANNEL=#TheOps + +# OpServ general-alert channel (e.g. flood alerts). Bot joins it. +X3_ALERT_CHANNEL=#TheOps + +# Channel where staff-auth notices are announced. Bot joins it. +X3_STAFF_AUTH_CHANNEL=#OperServ + +# Snoop module channel (connect/quit/join/part feed). Keep it secure — it +# exposes user activity. Also used as the log target for "staff" severity. +X3_SNOOP_CHANNEL=#MrSnoopy + +# Track module channel (per-user event tracking). NOTE: the track module is +# known-unstable and normally not compiled in; this only matters if it is. +X3_TRACK_CHANNEL=#MrPeanuts + +# ChanServ support_channel list — helpers must be in one of these to be "on +# duty". This is a conf LIST body: keep each channel individually quoted. +X3_SUPPORT_CHANNEL="#Operations", "#Help" + + +# ---------------------------------------------------------------------------- +# Hidden-host / cloaking (conf: "server" — must mirror the ircd's F:lines) +# ---------------------------------------------------------------------------- + +# Host-hiding style: 1 = simple (Users.), 2 = Nefarious style-2 keyed +# cloaking. If you use +x style-2 on the ircd, set 2 and the keys/prefix below. +X3_HIDDEN_HOST_TYPE=1 + +# CHANGE THIS — secret (style-2 only). These three keys MUST exactly match the +# ircd's HOST_HIDING_KEY1/2/3 F:lines. The shipped stock values make style-2 +# cloaks predictable — change them in production. +X3_HIDDEN_HOST_KEY1=45432 +X3_HIDDEN_HOST_KEY2=76934 +X3_HIDDEN_HOST_KEY3=98336 + +# Style-2 host prefix — the name prefixed onto cloaked hosts. +X3_HIDDEN_HOST_PREFIX=NETWORK + + +# ---------------------------------------------------------------------------- +# OpServ / G-line durations (clone control + module G-lines) +# ---------------------------------------------------------------------------- + +# OpServ clone threshold (untrusted_max): auto-G-line a host that exceeds this +# many connections. Default 6 (stock). 0 DISABLES it — testbeds set 0 in +# .env.local so a harness opening many connections from one host isn't +# auto-G-lined (which would make the network look dead). +X3_UNTRUSTED_MAX=6 + +# How long the clone/untrusted-max G-line lasts (duration units: s m h d m y). +X3_CLONE_GLINE_DURATION=2h + +# SockCheck (open-proxy scanner) max concurrent sockets. 0 = effectively off. +# Only enable proxy scanning with ISP permission — probes look like attacks. +X3_SOCKCHECK_MAX_SOCKETS=0 + +# G-line duration SockCheck issues when it flags an open proxy. +X3_SOCKCHECK_GLINE_DURATION=1d + +# G-line duration for blacklist (DNSBL/file) hits in the blacklist module. +X3_BLACKLIST_GLINE_DURATION=1h + + +# ---------------------------------------------------------------------------- +# ChanServ limits (conf: "services"."chanserv") +# ---------------------------------------------------------------------------- + +# off_channel mode: no/0 = ChanServ idles in registered channels; 1 = use the +# registered-channel mode and self-op; 2 = as 1 but ChanServ does NOT idle in +# the channel. Needs ircd +z support; do not run another +z service alongside. +X3_OFF_CHANNEL=no + +# Max channels one account may own (FORCE can override). +X3_MAX_OWNED=2 + +# Max users tracked in a channel userlist. +X3_MAX_CHAN_USERS=512 + + +# ---------------------------------------------------------------------------- +# MemoServ (conf: "modules"."memoserv") +# ---------------------------------------------------------------------------- + +# Age at which memos are auto-deleted; 0 disables memo expiry. +X3_MEMO_EXPIRY=30d + +# Max number of memos one account may hold. +X3_MEMO_LIMIT=30 + + +# ---------------------------------------------------------------------------- +# Mail / email (conf: "mail" + AuthServ email-cookie settings) +# ---------------------------------------------------------------------------- + +# Master mail switch. Disabled by default: the image ships NO MTA at +# /usr/sbin/sendmail, so "enabled" without a working mailer/SMTP just makes +# every cookie mail fail at exec time. Set 1 AND provide a mailer/SMTP to use it. +X3_MAIL_ENABLE=0 + +# Path to the sendmail-compatible binary (used when mail is enabled and you are +# not using the SMTP back-end). +X3_MAIL_MAILER=/usr/sbin/sendmail + +# SMTP server host (SMTP mail back-end). +X3_MAIL_SMTP_SERVER=localhost + +# SMTP service/port name (from /etc/services, e.g. "smtp" = 25). +X3_MAIL_SMTP_SERVICE=smtp + +# AuthServ: allow account verification and password reset by email. +# Requires mail (above) to be enabled and configured. +X3_EMAIL_ENABLED=0 + +# AuthServ: if email is enabled, require verification before an account may +# authenticate. +X3_EMAIL_REQUIRED=0 + +# How long an email verification/reset cookie stays valid. +X3_COOKIE_TIMEOUT=2d + +# How many accounts may share one email address. +X3_ACCOUNTS_PER_EMAIL=1 + + +# ---------------------------------------------------------------------------- +# Password / login policy (conf: "services"."nickserv") +# ---------------------------------------------------------------------------- + +# Minimum characters AuthServ enforces in a password. +X3_PASSWD_MIN_LENGTH=4 + +# Minimum digit characters required in a password (0 = no requirement). +X3_PASSWD_MIN_DIGITS=0 + +# Minimum uppercase characters required in a password (0 = no requirement). +X3_PASSWD_MIN_UPPER=0 + +# Minimum lowercase characters required in a password (0 = no requirement). +X3_PASSWD_MIN_LOWER=0 + +# Default max simultaneous logins on a NEW account (users can change their own). +X3_DEFAULT_MAXLOGINS=3 + +# Hard ceiling on simultaneous logins that a user cannot raise past. +X3_HARD_MAXLOGINS=10 + +# User modes auto-set when an oper auths. If it contains 'o' they are +# auto-remote-opered on auth. +X3_AUTO_OPER=+oxwgs + +# Oper privileges granted alongside X3_AUTO_OPER when an oper auths +# (space-separated privilege tokens). +X3_AUTO_OPER_PRIVS=CHAN_LIMIT SHOW_INVIS SHOW_ALL_INVIS KILL LOCAL_KILL REHASH RESTART DIE JUPE LOCAL_JUPE OPMODE WHOX SEE_CHAN PROPAGATE DISPLAY SEE_OPERS WIDE_GLINE FORCE_OPMODE REMOTEREHASH CHECK SEE_SECRET_CHAN WIDE_SHUN WIDE_ZLINE LIST_CHAN + + +# ---------------------------------------------------------------------------- +# LDAP (conf: "services"."nickserv" ldap_* — disabled by default) +# ---------------------------------------------------------------------------- + +# Master LDAP switch. 0 = off (accounts live only in saxdb). Set 1 to +# authenticate/store accounts against an LDAP directory. +X3_LDAP_ENABLE=0 + +# Write new registrations (including credentials) back to LDAP. REQUIRED for +# SASL when LDAP is authoritative — without it nickserv gates out ldap_do_add +# and new accounts land credential-less in saxdb only. +X3_LDAP_WRITEBACK=0 + +# LDAP server URI. +X3_LDAP_URI=ldap://localhost:389 + +# Base DN under which user entries live. +X3_LDAP_BASE=ou=users,dc=example,dc=net + +# DN format used to bind as a user; %s is replaced with the account name. +X3_LDAP_DN_FMT=uid=%s,ou=users,dc=example,dc=net + +# Admin/manager bind DN used for writes and searches. +X3_LDAP_ADMIN_DN=cn=admin,dc=example,dc=net + +# CHANGE THIS — secret. Password for the admin bind DN above. +X3_LDAP_ADMIN_PASS=changeme + +# Attribute holding the account name. +X3_LDAP_FIELD_ACCOUNT=uid + +# Attribute holding the (hashed) password. +X3_LDAP_FIELD_PASSWORD=userPassword + +# Attribute holding the email address. +X3_LDAP_FIELD_EMAIL=mail + +# Attribute holding the X3 OpServ level. +X3_LDAP_FIELD_OSLEVEL=X3AccountLevel + +# Search filter used to locate user entries. +X3_LDAP_FILTER=(objectClass=inetOrgPerson) + +# Auto-create an LDAP entry on first registration (1 = yes). +X3_LDAP_AUTOCREATE=1 + +# LDAP operation timeout, in seconds. +X3_LDAP_TIMEOUT=10 + + +# ---------------------------------------------------------------------------- +# Misc +# ---------------------------------------------------------------------------- + +# How often the mondo database (/x3/data/x3.db) is flushed to disk. +# Set 0 to disable automatic saves. +X3_DB_SAVE_FREQUENCY=30m + +# CHANGE THIS — secret. qserver (remote query interface) password. +# The entrypoint default is NOT a literal: if this var is left UNSET the +# entrypoint auto-generates a random 16-char password per boot. Set an explicit +# value here only if you need a stable, known qserver password. +X3_QSERVER_PASSWORD=changeme + +# AuthServ 'USET title' fakehost suffix (name.title.). The entrypoint +# default is DERIVED from X3_GENERAL_DOMAIN (i.e. equals your domain) unless you +# set an explicit value here. +X3_TITLEHOST_SUFFIX=example.com diff --git a/docker/dockerentrypoint.sh b/docker/dockerentrypoint.sh index c91fc35f..3826321a 100755 --- a/docker/dockerentrypoint.sh +++ b/docker/dockerentrypoint.sh @@ -7,11 +7,21 @@ BASECONFDIST=/x3/x3src/docker/x3.conf-dist BASECONF=/x3/data/x3.conf -# Only generate config if it doesn't already exist -if [ -f "$BASECONF" ]; then - echo "Found existing config at $BASECONF, skipping generation" +# Marker stamped as the first line of every conf THIS script generates. +# Regeneration policy: +# - no x3.conf -> generate (and stamp the marker) +# - x3.conf with the marker -> regenerate: env + template are the source +# of truth, so config changes actually land +# on restart instead of freezing at first +# container start +# - x3.conf without the marker -> user-managed (e.g. volume-mounted); +# never touched +GENMARKER='// GENERATED BY dockerentrypoint.sh from x3.conf-dist. Do not hand-edit: this file is REGENERATED ON EVERY CONTAINER START while this marker is the first line. To manage x3.conf yourself, replace it with a file that lacks this marker.' + +if [ -f "$BASECONF" ] && ! head -n 1 "$BASECONF" | grep -qF 'GENERATED BY dockerentrypoint.sh'; then + echo "Found user-managed config at $BASECONF (no generation marker), leaving it alone" else - echo "No existing config found, generating from template..." + echo "Generating $BASECONF from template..." # Set defaults for required variables (can be overridden by environment) : "${X3_GENERAL_NAME:=x3.network}" @@ -23,8 +33,83 @@ else : "${X3_UPLINK_PORT:=8888}" : "${X3_UPLINK_PASSWORD:=changeme}" + # Server block + # 8 = Nefarious 1.3.x; 9 = Nefarious 2.0.x (nefarious2) — must match your ircd. + : "${X3_SERVER_TYPE:=8}" + : "${X3_HIDDEN_HOST_TYPE:=1}" + # MUST match the ircd's HOST_HIDING_KEY* F:lines; change in production — + # stock keys make style-2 cloaks predictable. + : "${X3_HIDDEN_HOST_KEY1:=45432}" + : "${X3_HIDDEN_HOST_KEY2:=76934}" + : "${X3_HIDDEN_HOST_KEY3:=98336}" + : "${X3_HIDDEN_HOST_PREFIX:=NETWORK}" + + # OpServ clone-G-line threshold (untrusted_max). Default 6 (stock). + # 0 disables it — testbeds set X3_UNTRUSTED_MAX=0 in .env.local so harness + # connection volume from a single host isn't auto-G-lined. + : "${X3_UNTRUSTED_MAX:=6}" + + # OpServ / ChanServ / Global identity + limits + : "${X3_OPSERV_NICK:=O3}" + : "${X3_OPSERV_HOSTNAME:=X3.Services}" + : "${X3_DEBUG_CHANNEL:=#TheOps}" + : "${X3_ALERT_CHANNEL:=#TheOps}" + : "${X3_STAFF_AUTH_CHANNEL:=#OperServ}" + : "${X3_CLONE_GLINE_DURATION:=2h}" + : "${X3_CHANSERV_NICK:=X3}" + : "${X3_OFF_CHANNEL:=no}" + : "${X3_MAX_OWNED:=2}" + : "${X3_MAX_CHAN_USERS:=512}" + # Value is a conf list body: each channel stays individually quoted. + : "${X3_SUPPORT_CHANNEL:=\"#Operations\", \"#Help\"}" + : "${X3_GLOBAL_NICK:=Global}" + # Also used by the snoop module (templatized with the other modules). + : "${X3_SNOOP_CHANNEL:=#MrSnoopy}" + + # Modules + : "${X3_SOCKCHECK_MAX_SOCKETS:=0}" + : "${X3_SOCKCHECK_GLINE_DURATION:=1d}" + : "${X3_TRACK_CHANNEL:=#MrPeanuts}" + : "${X3_MEMOSERV_BOT:=MemoServ}" + : "${X3_MEMO_EXPIRY:=30d}" + : "${X3_MEMO_LIMIT:=30}" + # qserver: no shipped literal credential — generate a random password + # when the deployment doesn't provide one. + : "${X3_QSERVER_PASSWORD:=$(tr -dc 'A-Za-z0-9' "$BASECONF" + rm -f "$GENTMP" + echo "Generated $BASECONF from template" fi diff --git a/docker/x3.conf-dist b/docker/x3.conf-dist index 29cccda2..808f888b 100644 --- a/docker/x3.conf-dist +++ b/docker/x3.conf-dist @@ -36,11 +36,13 @@ /* hidden_host should match the F:HIDDEN_HOST: line in your ircu's ircd.conf; * x3 does not set the host suffix for users, but must know it when making * things like bans, where it should not show the user's real hostname. */ - "hidden_host_type" "1"; // change this to 2 if you use Nefarious's style 2 host hiding. - "key1" "45432"; // Set these key values to the network KEY values you use - "key2" "76934"; // for host hiding style 2. - "key3" "98336"; // - "prefix" "NETWORK"; // If you use style 2 then this is the name that is prefixed to hosts. + "hidden_host_type" "%X3_HIDDEN_HOST_TYPE%"; // change this to 2 if you use Nefarious's style 2 host hiding. + // MUST match the ircd's HOST_HIDING_KEY* F:lines; change in production — + // stock keys make style-2 cloaks predictable. + "key1" "%X3_HIDDEN_HOST_KEY1%"; // Set these key values to the network KEY values you use + "key2" "%X3_HIDDEN_HOST_KEY2%"; // for host hiding style 2. + "key3" "%X3_HIDDEN_HOST_KEY3%"; // + "prefix" "%X3_HIDDEN_HOST_PREFIX%"; // If you use style 2 then this is the name that is prefixed to hosts. "numeric" "%X3_GENERAL_NUMERIC%"; // hint: If you get collisions on link, CHANGE THIS. /* Type handles some changes in Nefarious from version to version. * 4 - nefarious 0.4.x and other ircds @@ -50,7 +52,7 @@ * 8 - nefarious 1.3.0 and higher (Legacy Version) * 9 - nefarious 2.0.x and higher (Current Version) */ - "type" "8"; + "type" "%X3_SERVER_TYPE%"; // 8 = Nefarious 1.3.x; 9 = Nefarious 2.0.x (nefarious2) — must match your ircd. "host_in_topic" "1"; //Set to 1 if your Nefarious server have the HOST_IN_TOPIC F:line set to TRUE. "max_users" "256"; // You can save a little memory by setting this to a lower value. "force_n2k" "1"; // Use extended (5-digit) numnick for self, even if 3 are possible. @@ -96,7 +98,7 @@ * reserve nicks. */ "nickserv" { - "nick" "AuthServ"; // The bots nick on IRC + "nick" "%X3_NICKSERV_NICK%"; // The bots nick on IRC // If you want to have *@* as the default hostmask, set // default_hostmask. I highly reccomend this, and its required @@ -108,15 +110,15 @@ // default max number of logins allowed on new accounts. Users can set it // to something different using authserv commands. - "default_maxlogins" "3"; + "default_maxlogins" "%X3_DEFAULT_MAXLOGINS%"; // hard_maxlogins is the ammount the user cant override. - "hard_maxlogins" "10"; + "hard_maxlogins" "%X3_HARD_MAXLOGINS%"; //automatically set the following modes when opers auth: // - if it includes o, then are auto remote-opered. - "auto_oper" "+oxwgs"; - "auto_oper_privs" "CHAN_LIMIT SHOW_INVIS SHOW_ALL_INVIS KILL LOCAL_KILL REHASH RESTART DIE JUPE LOCAL_JUPE OPMODE WHOX SEE_CHAN PROPAGATE DISPLAY SEE_OPERS WIDE_GLINE FORCE_OPMODE REMOTEREHASH CHECK SEE_SECRET_CHAN WIDE_SHUN WIDE_ZLINE LIST_CHAN"; + "auto_oper" "%X3_AUTO_OPER%"; + "auto_oper_privs" "%X3_AUTO_OPER_PRIVS%"; // This names a file that contains easily guessed passwords. // It always contains "password", "" and the user's @@ -126,10 +128,10 @@ // Minimum number of various types of characters permitted in // a password. Authserv will enforce these. - "password_min_length" "4"; - "password_min_digits" "0"; - "password_min_upper" "0"; - "password_min_lower" "0"; + "password_min_length" "%X3_PASSWD_MIN_LENGTH%"; + "password_min_digits" "%X3_PASSWD_MIN_DIGITS%"; + "password_min_upper" "%X3_PASSWD_MIN_UPPER%"; + "password_min_lower" "%X3_PASSWD_MIN_LOWER%"; // What should valid account and nicks look like? // If valid_nick_regex is omitted, valid_account_regex is used @@ -222,14 +224,14 @@ // How to integrate with email cookies? // In order to use mail, mail must be enabled and configured // down below in the mail section of this config file. - "email_enabled" "0"; // Allow account verification and password reset by email. - "email_required" "0"; // if above is 1, require verification to authenticate. - "cookie_timeout" "2d"; // how long before we expire cookies? - "accounts_per_email" "1"; // How many people can use the same email account. + "email_enabled" "%X3_EMAIL_ENABLED%"; // Allow account verification and password reset by email. + "email_required" "%X3_EMAIL_REQUIRED%"; // if above is 1, require verification to authenticate. + "cookie_timeout" "%X3_COOKIE_TIMEOUT%"; // how long before we expire cookies? + "accounts_per_email" "%X3_ACCOUNTS_PER_EMAIL%"; // How many people can use the same email account. "email_search_level" "600"; // minimum OpServ level to search based on email address (search print email *foo*) "email_visible_level" "800"; // minimum OpServ level to see somebody's email address - "titlehost_suffix" "AfterNET.Org"; // 'USET title' sets a fake hostname of name.title.titlehost on a user. + "titlehost_suffix" "%X3_TITLEHOST_SUFFIX%"; // 'USET title' sets a fake hostname of name.title.titlehost on a user. "set_title_level" "900"; // Access to use 'uset title'. "set_fakehost_level" "1000"; //Access to set a freeform fakehost. (uset fakehost) @@ -250,17 +252,24 @@ // LDAP configuration // Uses inetOrgAnonAccount schema (x3/tools/ldap/inetorganon.schema) "ldap_enable" "%X3_LDAP_ENABLE%"; + // ldap_writeback: write new account registrations (incl. credentials) to LDAP. + // Required for SASL when LDAP is authoritative — without it nickserv.c gates out + // ldap_do_add and accounts land in saxdb only (credential-less). Was missing from + // the LDAP-docker templatization. + "ldap_writeback" "%X3_LDAP_WRITEBACK%"; "ldap_uri" "%X3_LDAP_URI%"; "ldap_base" "%X3_LDAP_BASE%"; "ldap_dn_fmt" "%X3_LDAP_DN_FMT%"; - "ldap_autocreate" "1"; + "ldap_autocreate" "%X3_LDAP_AUTOCREATE%"; "ldap_admin_dn" "%X3_LDAP_ADMIN_DN%"; "ldap_admin_pass" "%X3_LDAP_ADMIN_PASS%"; "ldap_object_classes" ( "top", "inetOrgAnonAccount" ); "ldap_field_account" "%X3_LDAP_FIELD_ACCOUNT%"; "ldap_field_password" "%X3_LDAP_FIELD_PASSWORD%"; "ldap_field_email" "%X3_LDAP_FIELD_EMAIL%"; - "ldap_timeout" "10"; + "ldap_field_oslevel" "%X3_LDAP_FIELD_OSLEVEL%"; + "ldap_filter" "%X3_LDAP_FILTER%"; + "ldap_timeout" "%X3_LDAP_TIMEOUT%"; }; @@ -269,7 +278,7 @@ * Afternet uses the nickname "O3" for this as its easier to type. */ "opserv" { - "nick" "O3"; + "nick" "%X3_OPSERV_NICK%"; // should use of this service be limited to global opers? "privileged" "1"; @@ -277,21 +286,21 @@ "description" "Oper Service Bot"; // (for /whois) // hostname for service; only used if "description" is also set - "hostname" "X3.Services"; // (for /whois) + "hostname" "%X3_OPSERV_HOSTNAME%"; // (for /whois) // What channel should opserv send debug output to? // I don't have any idea what debug info goes here. You can configure // debugging logs in the log section to go to any channel. // Probably safest to set to your oper channel. - "debug_channel" "#TheOps"; // Bot will join this channel, also. + "debug_channel" "%X3_DEBUG_CHANNEL%"; // Bot will join this channel, also. "debug_channel_modes" "+tnOS"; // Modes get set every time X3 starts up // where to send general alerts (e.g. flood alerts)? - "alert_channel" "#TheOps"; // Bot will join this channel, also. + "alert_channel" "%X3_ALERT_CHANNEL%"; // Bot will join this channel, also. "alert_channel_modes" "+"; // Modes get set every time X3 starts up // who to tell about staff auths? - "staff_auth_channel" "#OperServ"; // Bot will join this channel, also. + "staff_auth_channel" "%X3_STAFF_AUTH_CHANNEL%"; // Bot will join this channel, also. "staff_auth_channel_modes" "+tnOs"; // modes get set every time X3 starts up // which channels should all services autojoin? @@ -302,10 +311,10 @@ // when a server pings out and they reconnect before the old connection is noticed // to be dead by the server.. so set it at about twice the # you want to allow to // avoid false positives. - "untrusted_max" "6"; // 3 connections and 3 ghosts, 7th connection causes a gline. + "untrusted_max" "%X3_UNTRUSTED_MAX%"; // env-templated (default 6). 0 DISABLES the clone-G-line — set 0 on testbeds where a harness opens many connections from one host (else O3 auto-G-lines that host for clone_gline_duration and the bed appears dead). 3 connections and 3 ghosts, (N+1)th connection causes a gline. // how long of a g-line should be issued if the max hosts is exceeded? - "clone_gline_duration" "2h"; // durations are smhdmy + "clone_gline_duration" "%X3_CLONE_GLINE_DURATION%"; // durations are smhdmy // how long to g-line for ?block (or, by default, for trace gline)? "block_gline_duration" "12h"; @@ -408,7 +417,7 @@ }; "chanserv" { - "nick" "X3"; + "nick" "%X3_CHANSERV_NICK%"; // The umodes - add +d if you use nefarious 1.0 and you added 'b:lines' // to pass cmdchar through to chanserv anyway. @@ -422,7 +431,7 @@ // NOTE: +z mode, needed for this to work. X3 contains modifications to // try and prevent desynchs. If you use this mode do not use any other service // that uses this mode. - "off_channel" "no"; + "off_channel" "%X3_OFF_CHANNEL%"; // Infolines are sent when channel users join the channel. Users set them with USET INFO in X3. // how long should a person be unseen before resending infoline? @@ -434,7 +443,7 @@ "max_greetlen" "120"; // maximum users in a channel userlist - "max_chan_users" "512"; + "max_chan_users" "%X3_MAX_CHAN_USERS%"; // maximum bans on a channel banlist "max_chan_bans" "512"; // maximum length of a user's infoline @@ -501,10 +510,10 @@ // channel(s) that support helpers must be in to be helping // if this is a list, any one by itself will do - "support_channel" ("#Operations", "#Help"); + "support_channel" (%X3_SUPPORT_CHANNEL%); // maximum number of channels a user may have. ( FORCE can override ) - "max_owned" "2"; + "max_owned" "%X3_MAX_OWNED%"; // how long between automatic topic and userlist refreshes with TopicRefresh/Resync "refresh_period" "10h"; @@ -533,7 +542,7 @@ * like to set ours' nick to 'AfterNET', but some people use 'Global' */ "global" { - "nick" "Global"; + "nick" "%X3_GLOBAL_NICK%"; // should users get community announcements by default or not? // community announcements are a type of global that users may // opt into (or out of, depending on this setting) @@ -631,11 +640,12 @@ */ "sockcheck" { // disabling this hopefully - "max_sockets" "0"; // 64 is a good # of concurrent clients to be checked + "max_sockets" "%X3_SOCKCHECK_MAX_SOCKETS%"; // 64 is a good # of concurrent clients to be checked "max_read" "1024"; // don't read more than 1024 bytes from any client - "gline_duration" "1d"; // issue G-lines lasting one hour + "gline_duration" "%X3_SOCKCHECK_GLINE_DURATION%"; // issue G-lines lasting one hour "max_cache_age" "60"; // only cache results for 60 seconds - "bind_address" "192.168.0.10"; // do proxy tests from this address + // set only if you need a specific source IP — bogus default removed + //"bind_address" "192.168.0.10"; // do proxy tests from this address }; /* Snoop sends connect, quit, join, and part messages for every user * on the network, and helps in finding drones. Put it somewhere secure @@ -643,10 +653,10 @@ */ "snoop" { // Where to send snoop messages? - "channel" "#MrSnoopy"; + "channel" "%X3_SNOOP_CHANNEL%"; "channel_modes" "+sntim"; // Which bot? - "bot" "O3"; + "bot" "%X3_OPSERV_NICK%"; // Show new users and joins from net joins? (off by default) "show_bursts" "0"; }; @@ -659,7 +669,7 @@ // What to track by default? "snomask" "nick,join,part,kick,new,del,auth,chanmode,umode"; // Where to send snoop messages? - "channel" "#MrPeanuts"; + "channel" "%X3_TRACK_CHANNEL%"; "channel_modes" "+sntOm"; // Which bot? "bot" "O3"; @@ -669,16 +679,16 @@ /* Memoserv lets users send messages to other users accounts. */ "memoserv" { - "bot" "MemoServ"; + "bot" "%X3_MEMOSERV_BOT%"; "modes" "+k"; - "message_expiry" "30d"; // age when messages are deleted; set + "message_expiry" "%X3_MEMO_EXPIRY%"; // age when messages are deleted; set // to 0 to disable message expiration - "limit" "30"; // Max amount of messages a person can get. + "limit" "%X3_MEMO_LIMIT%"; // Max amount of messages a person can get. }; "qserver" { "bind_address" "127.0.0.1"; "port" "7702"; - "password" "hello"; + "password" "%X3_QSERVER_PASSWORD%"; }; "blacklist" { // File containing blacklisted client addresses. @@ -688,7 +698,7 @@ // message will override this one: "file_reason" "client is blacklisted"; // How long should a blacklist G-line last? - "gline_duration" "1h"; + "gline_duration" "%X3_BLACKLIST_GLINE_DURATION%"; // If you want to use DNS blacklists, add them here: "dnsbl" { // This DNSBL zone does not exist - you'll have to pick your own. @@ -797,19 +807,19 @@ * section for additional mail settings also. */ "mail" { - "enable" "1"; - "mailer" "/usr/sbin/sendmail"; + "enable" "%X3_MAIL_ENABLE%"; + "mailer" "%X3_MAIL_MAILER%"; // OR Afternet uses a custom script to keep the services IP hidden: // "mailer" "/home/x3user/x3/sendmail.sh"; "from_address" "supportrobot@%X3_GENERAL_DOMAIN%"; - "extra_headers" ("Network-Services: x3"); + "extra_headers" ("X-Mailer: X3-Services"); "body_prefix_first" ("Welcome to the network, looks like this is your first email from us."); - "body_prefix" ("NET Support - User and Channel registration system"); + "body_prefix" ("%X3_GENERAL_DOMAIN% Support - User and Channel registration system"); "body_suffix_first" ("", "%X3_GENERAL_DOMAIN% IRC Network", "http://%X3_GENERAL_DOMAIN%"); - "body_suffix" ("", "NET IRC Network", "http://www.%X3_GENERAL_DOMAIN%", "support@%X3_GENERAL_DOMAIN%","irc://irc.%X3_GENERAL_DOMAIN%/help"); + "body_suffix" ("", "%X3_GENERAL_DOMAIN% IRC Network", "http://www.%X3_GENERAL_DOMAIN%", "support@%X3_GENERAL_DOMAIN%","irc://irc.%X3_GENERAL_DOMAIN%/help"); // If you are using the smtp mail back-end, you may need to set these: - "smtp_server" "localhost"; - "smtp_service" "smtp"; + "smtp_server" "%X3_MAIL_SMTP_SERVER%"; + "smtp_service" "%X3_MAIL_SMTP_SERVICE%"; // "smtp_myname" "localhost.domain"; }; @@ -840,7 +850,7 @@ "filename" "/x3/data/x3.db"; // How often should it be saved? // (You can disable automatic saves by setting this to 0.) - "frequency" "30m"; + "frequency" "%X3_DB_SAVE_FREQUENCY%"; }; }; @@ -883,8 +893,8 @@ // list a target to log it -- this is because it is very rarely // useful. "*.*" ("std:out", "file:/x3/data/everything.log"); // does NOT suppress any defaults - "*.override,error,fatal" "irc:#TheOps"; // report all uses of staff commands - "*.staff" "irc:#MrSnoopy"; // report all uses of staff commands + "*.override,error,fatal" "irc:%X3_DEBUG_CHANNEL%"; // report all uses of staff commands + "*.staff" "irc:%X3_SNOOP_CHANNEL%"; // report all uses of staff commands "ChanServ.*" "file:/x3/data/chanserv.log"; // duplicates the default behavior "ProxyCheck.*" (); // stop it from logging anything };