Ergo IRC Guide

• Part 1: Setting the Scene
• Part 2: Establishing the Server
• Part 3: Testing the Server
• Part 4: Getting Your Server Online
• Pi-Roject: Ergo IRC (Hello World)
• IRC Privacy Guide

Introduction

This is a guide to IRC, known in full as the Internet Relay Chat. IRC predates the World Wide Web and has been around since 1988, making it one of the oldest chat protocols still in use today. For this guide I am exploring the Ergo IRC server (also called an IRC daemon or IRCd), for the Dell-shaped prison I call Windows 11.

This page serves as my personal guide for all things IRC, as well as for any of you who want to join me.

Step 1: Downloading your Daemon

1. Go to: https://github.com/ergochat/ergo/releases/latest
   Under "Assets", download the Windows build. It will be named something like: ergo-2.17.0-windows-x86_64.zip

2. Extract the ZIP into your folder of choice.

3. Ergo ships with a default config called default.yaml. A YAML file is an easy-to-read configuration format used in various programs. You need to copy this file and name it ircd.yaml. Leave default.yaml alone, it is there as a guide in case you get stuck with the formatting. YAML files can be quite picky; even one mis-spacing is enough to throw things off.

4. Enter Windows PowerShell to generate your TLS certificates. Your server needs valid certificates to run, but especially if you want to make it go online. Ergo lets you generate self-signed certificates (from here we will call them certs), which you will need to do in the terminal.

5. Type this exact command into the terminal: ./ergo.exe mkcerts
   You should now see privkey and fullchain pop up in your Ergo folder. These are PEM files, and your main two certs. You cannot have one without the other, they must be together.

You have now created the bare bones of an IRC server. The certs you just generated will be used by the TLS listeners on ports 6667 and 6697. Port 6667 serves plaintext, which is usable but not recommended for private communications. For an encrypted chat, use port 6697. If you try to connect anything to anything right now, you will not get a peep.

Step 5: Installing HexChat

1. Download HexChat from https://hexchat.github.io and run the installer. The defaults are fine.

2. On every launch, HexChat will show a Network List. Fill in a nickname at the top, then click Add to create a new network entry. Name it whatever you like, e.g. My IRC Server.

3. Click Edit on your new network.

4. Under the Servers tab, remove the placeholder entry and add your server address. Since you are only connecting locally for now, use your machine's local IP followed by port 6697. If you do not know your IP address, run ipconfig in PowerShell and look for the IPv4 Address in the Wi-Fi section.

5. Tick "Use SSL for all the servers on this network" if you are using port 6697. Since you are using a self-signed cert for now, also tick "Accept invalid SSL certificates". You can untick this once you have a real cert from WinACME later.

6. Click Close to exit the Edit window.

Step 7: Connecting with HexChat

1. With Ergo running, go back to HexChat and click Connect. You will be met with Ergo's default Message-Of-The-Day and the chat interface itself.

2. Type /join #general (or any channel name you like) in the text box and press Enter. If the channel does not exist yet, Ergo will create it on the spot.

3. You can join multiple channels at once, just repeat the /join command. Each channel will open as a new tab in HexChat, just like a web browser.

Your server is now working on a basic LAN connection. Anyone on your local network can connect the same way you just did. If you are only using IRC for immediate friends, family or roommates, you can theoretically stop here. However, you will not be able to connect your server to any web-based clients, which we will be going over in the next steps.

Conclusion

Congratulations, you have just set up an IRC server. Invite your friends, or drag them kicking and screaming.

If your company is hesitant to make the switch, try Kiwi or The Lounge for a modernised IRC experience. IRC is a protocol, there is no one way to run or use it, so it is more about finding what works best for your needs.

If you want to move your server to a Raspberry Pi for permanent self-hosted use, continue to the next section. Running Ergo on a Pi has several benefits; the most apparent is that your server stays online no matter what happens to your main machine. The Pi's small size, low power draw, low cost, and basis in Linux make it ideal for running servers long-term.

Step 1: SSH into the Pi

From your Windows terminal (VPN off):

ssh ircuser@192.168.1.XXX

Step 2: No-IP DUC on the Pi

This keeps your domain pointing at your home IP automatically. If you have previously been running the No-IP client on Windows, this replaces it.

cd /tmp
wget https://www.noip.com/client/linux/noip-duc-linux.tar.gz
tar xzf noip-duc-linux.tar.gz
cd noip-2.1.9-1
sudo make install

Follow the prompts: enter your email and password, select your hostname group, set the update interval to 30 minutes, and say no to running a script on update.

Create the systemd service file:

sudo nano /etc/systemd/system/noip2.service

Paste in:

[Unit]
Description=No-IP Dynamic DNS Update Client
After=network.target

[Service]
Type=forking
ExecStart=/usr/local/bin/noip2
Restart=on-failure

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable noip2
sudo systemctl start noip2
sudo systemctl status noip2

You should see active (running) and enabled.

Setting Up Passwordless SSH (Windows to Pi)

This is needed so the cert copy script can run without a password prompt. Run on Windows as Administrator:

ssh-keygen -t rsa -b 4096
(hit Enter through all prompts, no passphrase)

type C:\Users\black\.ssh\id_rsa.pub | ssh ircuser@192.168.1.XXX "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Enter the Pi password when prompted. Test it by running ssh ircuser@192.168.1.XXX, it should connect with no password.

Step 4: Create the Ergo systemd Service File

On the Pi:

sudo nano /etc/systemd/system/ergo.service

Paste in:

[Unit]
Description=Ergo IRC Server
After=network.target

[Service]
Type=simple
User=ircuser
WorkingDirectory=/home/ircuser/ergo/ergo-2.14.0-linux-arm64
ExecStart=/home/ircuser/ergo/ergo-2.14.0-linux-arm64/ergo run --conf /home/ircuser/ergo/ergo-2.14.0-linux-arm64/ircd.yaml
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

Note the --conf flag on the ExecStart line. Easy to miss, and Ergo will fail silently without it. Save with Ctrl+O, Enter, Ctrl+X. The asterisk (*) in nano's title bar means you have unsaved changes, make sure it is gone before you exit.

Step 6: Disable Plaintext (TLS Only)

When Ergo first starts, it warns that port 6667 (plaintext IRC) is active. Since we want TLS-only connections, this needs to be commented out.

nano /home/ircuser/ergo/ergo-2.14.0-linux-arm64/ircd.yaml

Find the listeners section and add a # at the very start of the ":6667": line, before the quote mark. Nano may highlight it differently, only an actual # at the start of the line counts:

Wrong:  ":6667":
Right: #":6667":

Save, then restart Ergo:

sudo systemctl restart ergo

Verify port 6667 is no longer listening (this should return nothing):

ss -tlnp | grep 6667

Check the cert expiry while you are at it:

openssl x509 -in /home/ircuser/ergo/certs/fullchain.pem -noout -dates

Step 8: Connect with HexChat

1. HexChat menu, Network List (or Ctrl+S)
2. Click Add, name it "Hello World"
3. Add server: helloworld.ddns.net/6697 (or 192.168.1.XXX/6697 for LAN only)
4. Tick Use SSL for all the servers on this network
5. Tick Accept invalid SSL certificates
6. Click Connect

If you get "Disconnected (Remote host closed socket)", SSL was almost certainly not ticked. The server only accepts TLS, an unencrypted connection gets immediately rejected.

Quick Reference

Check if Ergo is running
sudo systemctl status ergo

Start / Stop / Restart Ergo
sudo systemctl start ergo
sudo systemctl stop ergo
sudo systemctl restart ergo

View live Ergo logs
journalctl -u ergo -f

Check which ports are listening
ss -tlnp | grep ergo

Edit Ergo config
nano /home/ircuser/ergo/ergo-2.14.0-linux-arm64/ircd.yaml

After editing the service file, always run
sudo systemctl daemon-reload

Check cert expiry on Pi
openssl x509 -in /home/ircuser/ergo/certs/fullchain.pem -noout -dates

Check if No-IP is running
sudo systemctl status noip2

Manually copy certs from Windows
C:\Users\black\Documents\copy-certs-to-pi.bat

Introduction

In stark contrast to other means of online chat, IRC (Internet Relay Chat) is a protocol, not a product. Control starts and ends with the individual operators, who have sole responsibility over their data. Meanwhile, their chatters are responsible for their own interests, and there is no third party that can intervene in this process.

On mainstream chat platforms, a third party dictates the entire process. The corporate entities that own these programs put themselves between the operator and chatter relationship and demand both parties work by its inefficiencies. They track users with data-retention policies, game-ify their chatting experience with monetisation, and if prompted, will drop these users into the awaiting hands of the law. This is not free communication, this is a system that glorifies convenience and enforces learned helplessness.

IRC has no central authority, no single server that handles everyone's traffic. It is an open-standard protocol, freer than e-mail, which itself strains under legal pressure no matter how many privacy features are implemented.

First comes the matter of encryption. IRC is not encrypted by default, nor does it use E2E encryption, instead using TLS. IP addresses are easy to obtain and backtrace to their origin. Servers are also not password-protected by default, which can leave them open to anyone if left untreated. These problems need to be solved if you are to have private communications.

Even on a properly TLS-configured server, IRC exposes your IP as part of your "hostmask", the identifier other users see when you connect. One risk remains regardless: Direct Client-to-Client (DCC) file transfers establish a direct connection between two clients, bypassing the server entirely and exposing both parties' real IPs.

What self-hosted IRC protects against: ISP reading your messages (through TLS); government requesting historical logs (partially, more effective against retrospective disclosure than real-time surveillance); IP leaking to other users (partially, via cloaks); third-party traffic correlation.

What it does not protect against: Compromised client devices; live interception; server compromise; social engineering; your ISP observing connection metadata.

Minimum requirements: Access restricted to known users; DCC disabled; logging policy defined; self-hosted on hardware under your physical control; TLS enforced, plaintext disabled; TLS certificate pinned in all clients.

For Operators

1. Disable server-side message history. Ergo stores message history in ircd.db by default. Disable it in ircd.yaml:

history:
  enabled: false

If you keep history enabled, set aggressive limits: short retention windows (hours, not days), low message counts. If you have been running Ergo without configuring this, wipe the database.

2. Disable always-on clients. Ergo's always-on feature keeps a user's nick present after they disconnect, causing messages to accumulate in server-side history. For high-privacy setups, disable this by policy.

3. Require SASL and disable self-registration together. Enabling require-sasl without disabling registration means anyone can still self-register and connect. Set both:

accounts:
  require-sasl:
    enabled: true
  registration:
    enabled: false

Create user accounts manually with /msg NickServ SAREGISTER <username> <password> from an oper session.

4. Enable IP cloaking with full privacy settings. Setting num-bits: 0 produces a cloak entirely unrelated to the user's IP, making the original address impossible to recover:

server:
  ip-cloaking:
    enabled: true
    enabled-for-always-on: true
    netname: "irc"
    cidr-len-ipv4: 32
    cidr-len-ipv6: 64
    num-bits: 0

5. Run Ergo as a non-root user with systemd hardening. A hardened service unit prevents a compromised Ergo process from reading your home directory, escalating privileges, or writing outside its data directory:

NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes

For Users

1. Ask the operator about their setup before connecting. Is logging enabled? Is server-side message history stored? Who else has physical access to the hardware? A trustworthy operator will answer these questions without hesitation and show you proof. If you feel uncomfortable, trust your instincts and leave.

2. Understand what the operator can access. An IRC Operator can read every message that passes through their server, see any traffic related to the server even if TLS prevents ISPs from seeing it, and sees your real IP address even with an IP cloak enabled. Cloaking only hides it from other users.

3. Verify the server certificate fingerprint. Ask the operator for the TLS certificate fingerprint before your first connection and pin it in your client. If the fingerprint does not match on connection, do not proceed.

4. Your trust in the server is only as strong as your trust in the Operator. A correctly configured server is meaningless if you do not trust the person running it.

For Operators

1. Use SASL EXTERNAL (certificate authentication). Generate a combined .pem file containing both the private key and the certificate:

openssl req -x509 -noenc -days 3650 \
  -newkey ed25519 \
  -keyout ~/.config/hexchat/certs/Network.pem \
  -out ~/.config/hexchat/certs/Network.pem

Then: chmod 600 ~/.config/hexchat/certs/Network.pem

Use -noenc (not the deprecated -nodes) and ed25519 (preferred over rsa:4096, ~128 bits of security, NIST FIPS 186-5 approved). Name the file exactly as your network appears in the Network List. Set the Login method to "SASL EXTERNAL (cert)", then register with: /msg NickServ cert add

2. Pin the server certificate fingerprint. In HexChat's Network List editor, enter your server's TLS certificate fingerprint. HexChat will refuse the connection if the fingerprint does not match, protecting against unannounced renewals, misconfigurations, and interception attempts.

3. Handle the HexChat server password conflict. If your server has a connection password set, it can conflict with SASL. Use the combined format: set your HexChat server password to username:password. This does not apply if you are using SASL EXTERNAL.

4. Disable local logging. HexChat logs all conversations to disk by default. Disable it at: Settings, Preferences, Logging, uncheck "Enable logging". A local log is a plaintext transcript regardless of how well the server is configured.

For Users

1. Disable local logging. This is the single most important client-side step. Settings, Preferences, Logging, uncheck "Enable logging".

2. Use SASL EXTERNAL if the operator supports it. Generate your own client certificate and ask the operator to register its fingerprint against your account. No password travels over the wire and your authentication cannot be replayed if intercepted.

3. Disable DCC. You have no reason to accept direct client connections in a private trusted-circle context. At minimum: /set dcc_auto_recv 0

4. Suppress your version string. Settings, CTCP Replies, delete or blank the VERSION entry.

5. Connect only from a device you control. Shared computers, work machines, and devices with unknown software installed are not appropriate for private IRC use.

6. Disconnect when you are not present. Do not leave an authenticated IRC session open and unattended. If the operator has always-on clients enabled, your nick may persist on the server after you disconnect.

Step 4: Configuring ircd.yaml

Message History. Message history is a log by another name. Ergo stores message history server-side in ircd.db by default. Disable it explicitly:

history:
  enabled: false

If you keep history enabled, set aggressive limits. If you have been running Ergo without configuring this, the database already contains history and should be wiped and reinitialised.

Authentication. Require SASL and disable self-registration together. Ergo's own documentation warns that enabling require-sasl without disabling registration means anyone can still self-register and connect:

accounts:
  require-sasl:
    enabled: true
  registration:
    enabled: false

Create accounts with /msg NickServ SAREGISTER <username> <password> from an oper session. This is Ergo-specific operator syntax and will not work on a standard IRC network.

IP Cloaking. Setting num-bits: 0 produces a cloak entirely unrelated to the user's IP. The enabled-for-always-on: true key ensures always-on clients also receive unique cloaked hostnames:

server:
  ip-cloaking:
    enabled: true
    enabled-for-always-on: true
    netname: "irc"
    cidr-len-ipv4: 32
    cidr-len-ipv6: 64
    num-bits: 0

Service Hardening. Run a hardened systemd service that prevents privilege escalation and limits filesystem access:

[Service]
User=irc
Group=irc
ExecStart=/usr/local/bin/ergo run \
  --conf /etc/ergo/ircd.yaml
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/ergo

Step 5: Managing a Multi-User Trusted-Circle Server

The moment a second person connects to your server, the threat model changes. Every device connecting is a potential disclosure vector, regardless of your configuration. The security of the channel is bounded by the least-secure device connecting to it.

1. Create accounts manually; never allow self-registration. With accounts > registration > enabled: false in place, create each user's account yourself via operator commands. No one joins without you explicitly adding them.

2. Configure channel modes for private circles. For a private circle, +si is the minimum. Secret means the channel does not appear in /LIST. Invite-only means users can only join if an existing member invites them with /INVITE. Additional modes: +m for moderated channels; +k <key> for a channel key that acts as a shared password.

3. Use SASL EXTERNAL where possible. Walk each person through generating their own client certificate and registering its fingerprint with NickServ. A user authenticating by password is a weaker link.

Step 6: Minimum Requirements Checklist

Single-User Ergo Server (Raspberry Pi)

Enabled: Non-root execution (systemd hardening); restricted network access (LAN/VPN/tunnel); SASL requirement; TLS on port 6697, no plaintext.

Disabled: Always-on clients; client-side logging (HexChat); DCC; self-registration; server-side message history.

Configurations: SASL authentication method (EXTERNAL preferred); TLS certificate secured; microSD and TLS private key secured; latest version of Ergo.

Conclusion

Congratulations. You now know how privacy measures work within the IRC protocol. While this guide was made for Ergo users, much of its information is relevant to all sorts of daemons. Enjoy your new technical knowledge and stay safe out there.

Sources

1. Threat Modeling / Digital Security Risk Assessment — privacyguides.org / freedom.press
2. Communicating With Others / Communication Network Types — ssd.eff.org / privacyguides.org
3. Why Metadata Matters / VPN Overview — ssd.eff.org / privacyguides.org
4. HexChat releases — github.com / libera.chat
5. WireGuard documentation — wireguard.com / freedom.press
6. NIST FIPS 186-5 — csrc.nist.gov
7. Ergo MANUAL.md — github.com/ergochat
8. ProtonMail / climate activist arrest — proton.me
9. Mullvad search warrant — mullvad.net
10. Google transparency report — transparencyreport.google.com