This is a quick guide to setup Inspircd with SSL on Debian. I've had some troubles doing this, I don't understnad why, maybe it was because I did it at 4AM?
The reason I use inspircd for this is mainly because Inspircd is a pretty popular irc server daemon.
Step 1: Installing dependencies
We're going to use inspircd from source, so we have to install some inspircd building dependencies (including the ones for SSL)
sudo apt install wget make build-essential letsencrypt gnutls-bin
Step 2: Downloading inspircd
Now let's download the source code:
wget https://github.com/inspircd/inspircd/archive/refs/tags/v3.11.0.tar.gz tar xvf v3.11.0.tar.gz cd inspircd-3.11.0/
Step 3: Building the source code
Now that you are in the source code, let's configure and build. It will also enable the
ssl_gnutls that is necessary for configuring SSL.
./configure --enable-extra ssl_gnutls ./configure make install
Step 4: Edit the configuration
Let's copy the config file and edit it:
cd run/conf/ cp examples/inspircd.conf.example inspircd nano inspircd.conf
Here I let you go through the file and edit values to your wishes. I'm only going to tell you which ones you MUST change to have a working server.
First, you need to add the following part that will import the SSL certificates and files:
<sslprofile name="Clients" provider="gnutls" cafile="" certfile="cert.pem" crlfile="" dhfile="dhparams.pem" hash="sha256" keyfile="key.pem" mindhbits="1024" outrecsize="2048" priority="SECURE192" requestclientcert="yes" strictpriority="no">
Then, uncomment the following line:
Then save, exist and edit the modules file
Here, you can enable the modules you want, but you must uncomment this line:
Finally, save and exit and go to the next step.
Step 5: Generate the certificate and move it
Let's generate the certificate using certbot. To do so you have to disable nginx (or apache, or httpd depending on what you use):
sudo systemctl stop nginx sudo certbot certonly --standalone -d YOUR.DOMAIN.HERE sudo systemctl start nginx
Then move those files to the inspircd conf directory:
sudo cp /etc/letsencrypt/live/YOUR.DOMAIN.HERE/fullchain.pem cert.pem sudo cp /etc/letsencrypt/live/YOUR.DOMAIN.HERE/privkey.pem key.pem certtool --generate-dh-params --sec-param normal --outfile dhparams.pem
Then you have to set the permissions to the current user, otherwise the ownership of the files will be to
root and the current user won't be able to read it.
sudo chown -R $USER:$USER .
Step 6: Run inspircd
Now you should be good. Just run inspircd using the following commands:
cd .. ./inspircd start
If you have to debug things, run those commands:
./inspircd stop ./inspircd start --nofork --debug
If you can connect in plaintext connection (6667 port), but not SSL connection (6697 port), then run the SSL test script (inspircd must be already running)
./bin/inspircd-testssl 127.0.0.1 6697
The reasons this took me so much time may be because gnutls was outdated and I think I didn't use the right files. I don't exactly remember, I done a lot of troubleshooting at 4AM lol.
If you have any problem with this, please tell me so I can improve the guide. Be free to ask questions on #SnowCodeBlog on Libera or via the official inspircd support in #inspircd on irc.inspircd.org.
I am also planning on making 2 other posts about IRC in general, one about Weechat and another one about what I think of IRC.
PS: If you want to configure this with TOR as well and know how to connect it via Weechat, checkout the end of my post about ngircd.