IRC Setup: ZNC Bouncer & HexChat Configuration

1. Install ZNC on Debian VPS

On your Debian VPS, install ZNC via apt:

Bash

TXT
sudo apt update
sudo apt install znc

2. Initialize ZNC Configuration

Run the interactive wizard to set up your admin user and network:

Bash

TXT
znc --makeconf

  • Follow the prompts to set a username and a strong password.

  • Choose a port (e.g., 6697 for SSL/TLS).

  • Confirm "Would you like to load a global module?" -> cert.

  • After creation, start the ZNC process.

3. Configure SSL/TLS

Ensure secure connection:

Bash

TXT
znc --makepem

4. HexChat Configuration

To connect HexChat to your ZNC instance, configure the network settings:

  1. Open HexChat and go to Network List (Ctrl+S).

  2. Add a new network named ZNC.

  3. Click Edit.

  4. In the "Servers" list, add your VPS address and the ZNC port (e.g., irc.yourdomain.tld/6697).

  5. In the Password field, use the format: user/network:password.

    • Example: myuser/freenode:mysecretpassword

  6. Check "Enable SSL for all the servers on this network".

  7. Accept the certificate if prompted.

5. Useful ZNC Modules

Load modules via the IRC query window with your user (*status):

Bash

TXT
/msg *status loadmod controlpanel
/msg *status loadmod log
/msg *status loadmod admin

Notes for Arch Linux

  • Make sure your system time is synced.

  • Use micro to edit ~/.znc/configs/znc.conf if manual adjustments are required.

  • If you use ufw on your VPS, ensure the ZNC port is open: sudo ufw allow 6697/tcp

ZNC Configuration: Tailscale Only

To restrict ZNC access exclusively to your Tailscale network, modify the listener configuration in znc.conf.

1. Identify your Tailscale IP

Find your Tailscale IP address on the VPS:

Bash

TXT
tailscale ip -4

(Let's assume your Tailscale IP is 100.x.y.z)

2. Edit the ZNC Configuration

  1. Stop the ZNC service:

    Bash

    TXT
    systemctl stop znc

  2. Open the configuration file (using micro):

    Bash

    TXT
    micro ~/.znc/configs/znc.conf

  3. Locate the <Listener> section and change the Host or ListenHost directive:

    Plaintext

    TXT
    <Listener listener0>
    Port = 6697
    Host = 100.x.y.z  # Set this to your Tailscale IP
    SSL = true
</Listener>

3. Verify Firewall (ufw/nftables)

Since you are using a VPS, ensure your firewall does not expose port 6697 to the public internet:

Bash

TXT
# If using UFW:
sudo ufw delete allow 6697/tcp
# Only allow connections from within the Tailscale subnet if necessary:
sudo ufw allow in on tailscale0 to any port 6697 proto tcp

4. Connect via Tailscale

In HexChat or HexDroid, use your Tailscale MagicDNS name or the Tailscale IP as the server address.

Pro-Tip for your setup:

Wenn du ZNC ausschließlich über Tailscale betreibst, kannst du innerhalb von ZNC auch SSL = false in Erwägung ziehen, sofern du das interne Tailscale-Netzwerk als sicher betrachtest (da der Traffic zwischen deinen Geräten ohnehin via WireGuard verschlüsselt ist). Ich würde jedoch bei SSL = true bleiben, um die Verschlüsselung durchgängig auf App-Ebene zu halten.

Soll ich dir noch zeigen, wie du ZNC als systemd-Service einrichtest, damit es bei einem Reboot deines VPS automatisch mit den richtigen Netzwerkkonfigurationen startet?