xeiaso.net
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
docs(site): add operating page and section template
author
Xe Iaso
date
(Jun 27, 2026, 8:42 PM -0400)
commit
b91c8a22
b91c8a222e3e8953e0459dbe9c86946e4c0b7ccf
parent
6d29413b
6d29413b19d2643f6763f17dba8fb98063f972a1
+94
+81
docs/site/content/operating.md
+81
docs/site/content/operating.md
···
1
+
+++
2
+
title = "Operating leveva"
3
+
template = "page.html"
4
+
weight = 5
5
+
+++
6
+
7
+
Day-to-day operation of a running leveva server.
8
+
9
+
## Reloading config with `REHASH`
10
+
11
+
leveva remembers the path it was started with, so an operator can reload the
12
+
config without restarting:
13
+
14
+
```
15
+
/REHASH
16
+
```
17
+
18
+
Most of the config hot-reloads: operators, connection classes, `allow` blocks,
19
+
the MOTD, the admin block, `connect` blocks, listeners, default user/channel
20
+
modes, bans, auto-connect, flood and knock tunables, and connection-accept
21
+
thresholds. Validate a config edit before reloading with `leveva --config
22
+
ircd.kdl --check`.
23
+
24
+
## TLS certificate reload
25
+
26
+
TLS certificate and key files are watched on disk. When they change — for example
27
+
after a Let's Encrypt renewal — leveva reloads them live, with no restart and no
28
+
dropped connections. Sending `SIGHUP` also triggers a reload. This pairs well
29
+
with an ACME client that rewrites the cert in place.
30
+
31
+
## Operators
32
+
33
+
An operator authenticates with:
34
+
35
+
```
36
+
/OPER <name> <password>
37
+
```
38
+
39
+
`<name>` is the `operator "<name>"` block in the config. Generate a SHA-512
40
+
password hash for that block with the `MKPASSWD` command (the `$6$…` output is
41
+
stored as the block's `password (hash)"…"`). Each operator is granted exactly the
42
+
`privileges` listed in their block — `kill`, `squit`, `connect`, `rehash`,
43
+
`kline`, `trace`, and so on. Operators with `+s` receive server notices about
44
+
network events (kills, rehashes, link changes).
45
+
46
+
## Bans
47
+
48
+
Config `ban` blocks are enforced at registration and reload with `REHASH`.
49
+
Operators with the right privileges can also set runtime bans:
50
+
51
+
- `KLINE` / `UNKLINE` — ban by `user@host`.
52
+
- `DLINE` / `UNDLINE` — ban by IP address or CIDR range.
53
+
- `RESV` — reserve nicknames and channels.
54
+
55
+
`STATS` reports the active ban lists (for example `STATS k` and `STATS d`).
56
+
57
+
## Logging
58
+
59
+
leveva logs through `tracing`. Pick a verbosity at startup with `--log-level`
60
+
(`error`/`warn`/`info`/`debug`/`trace`) or with a full `RUST_LOG`-style filter
61
+
string. The `RUST_LOG` environment variable, when set, takes precedence over the
62
+
flag:
63
+
64
+
```sh
65
+
RUST_LOG=leveva=debug,leveva_iauth=info ./target/release/leveva --config ircd.kdl
66
+
```
67
+
68
+
## Metrics
69
+
70
+
When a metrics listener is configured, leveva exposes Prometheus-format counters
71
+
(client and server counts, link traffic, and more) over HTTP. The same counters
72
+
back the `STATS m` and `STATS z` reports, so you can read them either from a
73
+
Prometheus scrape or interactively as an operator.
74
+
75
+
## Server links
76
+
77
+
Operators bring links up and down by hand with `CONNECT` and `SQUIT`, and leveva
78
+
will dial configured `connect` blocks automatically when `autoconnect #true` and
79
+
`auto-connect` is enabled in `options`. See the
80
+
[`connect` block](@/configuration.md) for how link passwords and roles are
81
+
configured.
+13
docs/site/templates/section.html
+13
docs/site/templates/section.html
···
1
+
{% extends "base.html" %}
2
+
{% block title %}{{ section.title }} — {{ config.title }}{% endblock title %}
3
+
{% block content %}
4
+
<article class="prose">
5
+
<h1>{{ section.title }}</h1>
6
+
{{ section.content | safe }}
7
+
<ul>
8
+
{% for page in section.pages %}
9
+
<li><a href="{{ page.permalink | safe }}">{{ page.title }}</a></li>
10
+
{% endfor %}
11
+
</ul>
12
+
</article>
13
+
{% endblock content %}