feat(irc): members-only Ergo IRC network + built-in ssh irc@ client#9
Closed
ralyodio wants to merge 2 commits into
Closed
feat(irc): members-only Ergo IRC network + built-in ssh irc@ client#9ralyodio wants to merge 2 commits into
ssh irc@ client#9ralyodio wants to merge 2 commits into
Conversation
Provision a self-hosted Ergo IRC network (irc.${DOMAIN}) in setup.sh §9b:
single Go binary on its own ports/user, reusing Caddy's Let's Encrypt cert
for 6697 TLS (refreshed by a timer; self-signed fallback on first boot),
loopback 6667 + a loopback WebSocket fronted by Caddy at wss://${DOMAIN}/irc.
Access is MEMBERS-ONLY: every client must authenticate with SASL, self-service
registration is off, and an auth-script (deploy/ergo/auth-script.sh, installed
as /usr/local/bin/ergo-auth-member) approves a login only if the account name
maps to an existing AgentBBS member home dir under <data>/users/. Passphrase is
ignored — membership (the filesystem dir) is the credential. require-sasl has
no IP exemption so WebSocket clients (which reach Ergo via Caddy from 127.0.0.1)
can't bypass the gate; accounts are auto-created on first successful auth.
Public attack surface is TLS-only (ufw opens 6697; 6667 is loopback). Toggle
with IRC=0. See docs/irc.md.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Adds an in-process IRC client (internal/irc) and an `irc@` SSH route that drops a member straight into the BBS's own Ergo network with no client to install and no SASL to configure. - internal/irc/client.go: minimal IRC client (SASL PLAIN, IRCv3 CAP, PING, PRIVMSG/JOIN/PART/NICK, event stream). Dials Ergo on the loopback 127.0.0.1:6667; presents the member's account name (the SSH key already proved membership; Ergo's auth-script ignores the passphrase by design). - internal/irc/tui.go: Bubble Tea TUI over the SSH PTY (mirrors internal/chat) with /join /part /msg /me /names /nick /help and a current-channel input. - cmd/agentbbs: handleIRC resolves the member by key (members-only, free) and runs the client; routed via auth.IsIRCName. AGENTBBS_IRC_ADDR overrides the target on dev hosts. - auth: reserve `irc` as a route name. Unlike copying tor-irc@ (a third-party client in a pod), this runs our own Go code in-process, so there is no /exec shell-escape surface, and the host process can reach Ergo's loopback listener directly. Validated live against a members-only Ergo: non-members are rejected, a member authenticates via SASL, and channel messages are received. Co-Authored-By: Claude Opus 4.8 <[email protected]>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
Contributor
Author
|
Merged into main in 52b06d8 ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stands up a co-located, lightweight IRC network on the AgentBBS box for humans and agents, plus a zero-setup built-in client.
What's here
1. Members-only Ergo IRC server (
deploy/ergo/,setup.sh§9b)wss://<domain>/irc(no extra public port).ergo-auth-member) approves a login only if the account name maps to an existing AgentBBS member home dir — your BBS account is your IRC identity.IRC=0.2. Built-in
ssh irc@client (internal/irc/)ssh -t irc@<host>drops a member straight into the network — no client install, no SASL config.internal/chat);/join /part /msg /me /names /nick /help.127.0.0.1:6667and authenticates as the member (the SSH key already proved membership). Because it's our own code (not irssi-in-a-pod), there's no/execshell-escape surface.Validation
sedpipeline →ergo run --smokebrings up all four listeners.internal/irc/client.gocompiled and driven live against a members-only Ergo (member in, non-member out, cross-member message received).gofmtclean. (Fullgo build ./...needs go 1.26, not available in this sandbox;tui.go/main.gomirror existingchat.goAPIs.)Note for the operator
Native clients connect to
irc.<domain>— add the DNS record. The cert is for<domain>; addirc.<domain>as a SAN (or wildcard) for a clean hostname match on 6697.🤖 Generated with Claude Code