---
## Bot::Cobalt auth.conf (standard auth module config)

## Arranged vaguely by priority.
## You can probably just add a superuser and roll right along.

## SuperUsers:
##
## Generally, users should be managed via the 'user' PRIVMSG commands.
## However, bot superusers should be specified here.
## A superuser's access level always trumps any other.
## Plugins may also provide superusers with Special Powers (tm)
##
## It's recommended that superusers be defined per-context.
## Specify '-ALL' to apply a superuser to all contexts.
##
## Password hashes can be created via `bmkpasswd` from App::bmkpasswd
## (Required by Bot::Cobalt; try: `bmkpasswd --help`)
## Bcrypt is strongly recommended (and also the default)
##
## Format looks something like this:
## SuperUsers:
##   <CONTEXT>:
##     <USERNAME>:
##       Mask: *!*user@*host # or a list, see below
##       Password: <HASH>
##
## Here's a couple examples:
##
#SuperUsers:
#  ## Here's a user with multiple masks.
#  ## They only have privileges in the 'Main' server context.
#  Main:
#    rakshasa:
#      ## List of masks:
#      Mask:
#        - '*avenj@*.oppresses.us'
#        - '*avenj@*.cobaltirc.org'
#      Password: '$2a$08$W19087w4dFjaET17sJsaheQ4eSzax3ORh7xryiWJkOzZiEjV/YGm2'
#
#    avenj:
#      ## A superuser with one mask entry.
#      Mask: '*avenj@*.oppresses.us'
#      Password: '$2a$08$W19087w4dFjaET17sJsaheQ4eSzax3ORh7xryiWJkOzZiEjV/YGm2'

# This one is filled by cobalt2-installer:
SuperUsers:
  Main:
    '%AUTH_USER%':
      Mask:
        - '%AUTH_MASK%'
      Password: '%AUTH_PASS%'


## Opts:
## Basic auth plugin options.
Opts:
  ## Our password crypting method.
  ## 'bcrypt' is a good choice, and the default
  ## 'md5' is fairly universal, but easy to break.
  ## 'sha256' and 'sha512' require recent libcs or Crypt::Passwd::XS
  ##
  ## Changing mid-stream is OK, but SHA passwords will fail if the 
  ## authdb is later moved to a system without SHA.
  Method: bcrypt

  ## Bcrypt_Cost: <two digit power of 2>
  ##  Bcrypt work cost factor
  ##
  ##  Only applies if using Method: bcrypt, above
  ##
  ##  Must be a two digit power of 2, padded with 0 if needed.
  ##  Lower is faster (less secure), higher is slower (more secure)
  ##  '08' seems to be a pretty good balance.
  ##  See http://codahale.com/how-to-safely-store-a-password/
  Bcrypt_Cost: '08'

  ## YAML authdb relative to our var/ dir:
  AuthDB: db/authdb.yml

## RequiredPrivs:
##
## Define required base access levels for certain operations.
RequiredPrivs:

  ## Generally users can add any user with a lower numeric access
  ## level than their own (level 3 can add level 2, etc.)
  ## You can specify a minimum base access level for adding new users:
  AddingUsers: 2

  ## ...same for deleting, or it'll default to the above value
  DeletingUsers: 2