diff --git a/bird-conf.j2 b/bird-conf.j2
new file mode 100644
index 0000000..6cd6eee
--- /dev/null
+++ b/bird-conf.j2
@@ -0,0 +1,164 @@
+################################################
+#               Variable header                #
+################################################
+
+define OWNAS =  4242422002;
+{% if unicastv4 is defined %}
+define OWNIP =  {{ unicastv4 }};
+{% endif %}
+define OWNIPv6 = {{ unicastv6 }};
+{% if unicastv4 is defined %}
+define OWNNET = 172.22.161.0/27;
+{% endif %}
+define OWNNETv6 = fd32:6b0:70a6::/48;
+{% if unicastv4 is defined %}
+define OWNNETSET = [172.22.161.0/27+];
+{% endif %}
+define OWNNETSETv6 = [fd32:6b0:70a6::/48+];
+
+################################################
+#                 Header end                   #
+################################################
+
+router id OWNIP;
+
+protocol device {
+    scan time 10;
+}
+
+/*
+ *  Utility functions
+ */
+{% if unicastv4 is defined %}
+function is_self_net() {
+  return net ~ OWNNETSET;
+}
+{% endif %}
+
+function is_self_net_v6() {
+  return net ~ OWNNETSETv6;
+}
+
+{% if unicastv4 is defined %}
+function is_valid_network() {
+  return net ~ [
+    172.20.0.0/14{21,29}, # dn42
+    172.20.0.0/24{28,32}, # dn42 Anycast
+    172.21.0.0/24{28,32}, # dn42 Anycast
+    172.22.0.0/24{28,32}, # dn42 Anycast
+    172.23.0.0/24{28,32}, # dn42 Anycast
+    172.31.0.0/16+,       # ChaosVPN
+    10.100.0.0/14+,       # ChaosVPN
+    10.127.0.0/16+,       # neonetwork
+    10.0.0.0/8{15,24}     # Freifunk.net
+  ];
+}
+{% endif %}
+
+{% if unicastv4 is defined %}
+roa4 table dn42_roa;
+{% endif %}
+roa6 table dn42_roa_v6;
+
+{% if unicastv4 is defined %}
+protocol static {
+    roa4 { table dn42_roa; };
+    include "/etc/bird/roa_dn42.conf";
+};
+{% endif %}
+
+protocol static {
+    roa6 { table dn42_roa_v6; };
+    include "/etc/bird/roa_dn42_v6.conf";
+};
+
+function is_valid_network_v6() {
+  return net ~ [
+    fd00::/8{44,64} # ULA address space as per RFC 4193
+  ];
+}
+
+protocol kernel {
+    scan time 20;
+
+    ipv6 {
+        import none;
+        export filter {
+            if source = RTS_STATIC then reject;
+            krt_prefsrc = OWNIPv6;
+            accept;
+        };
+    };
+};
+
+{% if unicastv4 is defined %}
+protocol kernel {
+    scan time 20;
+
+    ipv4 {
+        import none;
+        export filter {
+            if source = RTS_STATIC then reject;
+            krt_prefsrc = OWNIP;
+            accept;
+        };
+    };
+}
+
+protocol static {
+    route OWNNET reject;
+
+    ipv4 {
+        import all;
+        export none;
+    };
+}
+{% endif %}
+
+protocol static {
+    route OWNNETv6 reject;
+
+    ipv6 {
+        import all;
+        export none;
+    };
+}
+
+template bgp dnpeers {
+    local as OWNAS;
+    path metric 1;
+
+{% if unicastv4 is defined %}
+    ipv4 {
+        import filter {
+          if is_valid_network() && !is_self_net() then {
+            if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
+              # Reject when unknown or invalid according to ROA
+              print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
+              reject;
+            } else accept;
+          } else reject;
+        };
+
+        export filter { if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
+        import limit 9000 action block;
+    };
+{% endif %}
+
+    ipv6 {   
+        import filter {
+          if is_valid_network_v6() && !is_self_net_v6() then {
+            if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
+              # Reject when unknown or invalid according to ROA
+              print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
+              reject;
+            } else accept;
+          } else reject;
+        };
+        export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
+        import limit 9000 action block; 
+    };
+}
+
+include "/etc/bird/babel.conf";
+include "/etc/bird/peers/*";
diff --git a/inventory.yml b/inventory.yml
index 9f8abd1..07d5cd7 100644
--- a/inventory.yml
+++ b/inventory.yml
@@ -6,24 +6,32 @@ routers:
   hosts:
     us1.routers.9pfs.dn42:
       ansible_python_interpreter: "/usr/bin/python3"
+      unicastv4: 172.22.161.1
       unicastv6: fd32:6b0:70a6:179::1
       machine_type: vm
       pop_loc: us01
+      solanum_sid: '9R1'
     us2.routers.9pfs.dn42:
       ansible_python_interpreter: "/usr/bin/python3"
       machine_type: container
+      unicastv4: 172.22.161.2
       unicastv6: fd32:6b0:70a6:179::2
       pop_loc: us02
+      solanum_sid: '9R2'
     us3.routers.9pfs.dn42:
       ansible_python_interpreter: "/usr/bin/python3"
       machine_type: container
+      unicastv4: 172.22.161.4
       unicastv6: fd32:6b0:70a6:179::4
       pop_loc: us03
+      solanum_sid: '9R4'
     uk1.routers.9pfs.dn42:
       ansible_python_interpreter: "/usr/bin/python3"
       machine_type: container
+      unicastv4: 172.22.161.3
       unicastv6: fd32:6b0:70a6:179::3
       pop_loc: uk01
+      solanum_sid: '9R3'
 services:
   hosts:
     mail.9pfs.dn42:
diff --git a/setup.yml b/setup.yml
new file mode 100644
index 0000000..9ce70bf
--- /dev/null
+++ b/setup.yml
@@ -0,0 +1,32 @@
+- name: Configure bird on routers
+  hosts: routers
+  remote_user: root
+  tasks:
+    - name: Add internal bgp peers
+      ansible.builtin.template:
+        src: int-bgp.j2
+        dest: /etc/bird/peers/internal.conf
+        mode: '0644'
+    - name: Add route collector peering
+      ansible.builtin.copy:
+        src: collector.conf
+        dest: /etc/bird/peers/collector.conf
+        mode: '0644'
+    - name: Add bird.conf in arch location
+      ansible.builtin.template:
+        src: bird-conf.j2
+        dest: /etc/bird.conf
+        mode: '0644'
+      when: ansible_distribution == 'Archlinux'
+    - name: Add bird.conf in debian location
+      ansible.builtin.template:
+        src: bird-conf.j2
+        dest: /etc/bird/bird.conf
+        mode: '0644'
+      when: ansible_distribution == 'Debian'
+    - name: Reload bird
+      ansible.builtin.systemd_service:
+        name: bird.service
+        enabled: true
+        state: reloaded
+      when: ansible_service_mgr == 'systemd'
diff --git a/solanum.yml b/solanum.yml
new file mode 100644
index 0000000..54036f1
--- /dev/null
+++ b/solanum.yml
@@ -0,0 +1,109 @@
+- name: Configure solanum on routers
+  hosts: routers
+  remote_user: root
+  tasks:
+    - name: See if solanum has been built already
+      ansible.builtin.stat:
+        path: /home/solanum/ircd
+      register: solanum_already_built
+    - name: Add Debian build dependencies
+      ansible.builtin.package:
+        name: automake,autotools-dev,bsdextrautils,build-essential,byacc,curl,flex,git,libsqlite3-dev,libssl-dev,libtool,make,pkg-config,sqlite3
+        state: present
+      when: ansible_distribution == 'Debian' and solanum_already_built.stat.exists == False
+    - name: Add Arch build dependencies
+      ansible.builtin.pacman:
+        name: base-devel,autoconf,automake,libtool
+        state: present
+      when: ansible_distribution == 'Archlinux' and solanum_already_built.stat.exists == False
+    - name: Create solanum user
+      ansible.builtin.user:
+        name: solanum
+        system: true
+        comment: Solanum service user
+      when: solanum_already_built.stat.exists == False
+    - name: Download solanum
+      ansible.builtin.git:
+        repo: 'https://github.com/solanum-ircd/solanum.git'
+        dest: /home/solanum/solanum
+      become: yes
+      become_user: solanum
+      when: solanum_already_built.stat.exists == False
+    - name: Decide whether we should run autogen.sh
+      ansible.builtin.stat:
+        path: /home/solanum/solanum/configure
+      register: configure_exists
+      when: solanum_already_built.stat.exists == False
+    - name: Run autogen.sh
+      ansible.builtin.command: ./autogen.sh
+      args:
+        chdir: /home/solanum/solanum
+      become: yes
+      become_user: solanum
+      when: solanum_already_built.stat.exists == False # or configure_exists.stat.exists == False
+    - name: See if Makefile exists
+      ansible.builtin.stat:
+        path: /home/solanum/solanum/Makefile
+      when: solanum_already_built.stat.exists == False
+      register: makefile_exists
+    - name: Run configure
+      ansible.builtin.command: ./configure --enable-oper-chghost --with-nicklen=50
+      args:
+        chdir: /home/solanum/solanum
+      become: yes
+      become_user: solanum
+      when: solanum_already_built.stat.exists == False # or makefile_exists.stat.exists == False
+    - name: Build solanum
+      ansible.builtin.make:
+        chdir: /home/solanum/solanum
+      become: yes
+      become_user: solanum
+      when: solanum_already_built.stat.exists == False
+    - name: Install solanum
+      ansible.builtin.make:
+        chdir: /home/solanum/solanum
+        target: install
+      become: yes
+      become_user: solanum
+      when: solanum_already_built.stat.exists == False
+    - name: See if there is currently a TLS certificate
+      ansible.builtin.stat:
+        path: /home/solanum/ircd/etc/cert.pem
+      register: tls_cert_exists
+    - name: Generate TLS certificate
+      ansible.builtin.command: 'openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /home/solanum/ircd/etc/key.pem -out /home/solanum/ircd/etc/cert.pem -subj "/C=US/O=AS4242422002/OU=IRC servers/CN={{ inventory_hostname }}"'
+      become: yes
+      become_user: solanum
+      when: tls_cert_exists.stat.exists == False
+    - name: Get certificate fingerprint
+      command: /home/solanum/ircd/bin/solanum-mkfingerprint spki_sha256 /home/solanum/ircd/etc/cert.pem
+      become: yes
+      become_user: solanum
+      register: tls_fingerprint
+    - name: Generate configuration file
+      ansible.builtin.template:
+        src: solanum/conf.j2
+        dest: /home/solanum/ircd/etc/ircd.conf
+        mode: '0600'
+      become: yes
+      become_user: solanum
+    - name: Generate motd
+      ansible.builtin.template:
+        src: solanum/motd.j2
+        dest: /home/solanum/ircd/etc/ircd.motd
+        mode: '0600'
+      become: yes
+      become_user: solanum
+    - name: Create systemd service
+      ansible.builtin.copy:
+        src: solanum/solanum.service
+        dest: /etc/systemd/system/solanum.service
+        mode: '0644'
+      when: ansible_service_mgr == 'systemd'
+    - name: Enable and start/reload solanum
+      ansible.builtin.systemd_service:
+        name: solanum.service
+        enabled: true
+        state: reloaded
+        daemon_reload: true
+      when: ansible_service_mgr == 'systemd'
diff --git a/solanum/channel.j2 b/solanum/channel.j2
new file mode 100644
index 0000000..55bc5a1
--- /dev/null
+++ b/solanum/channel.j2
@@ -0,0 +1,27 @@
+channel {
+	use_invex = yes;
+	use_except = yes;
+	use_forward = yes;
+	use_knock = yes;
+	knock_delay = 5 minutes;
+	knock_delay_channel = 1 minute;
+	max_chans_per_user = 150;
+	max_chans_per_user_large = 600;
+	max_bans = 100;
+	max_bans_large = 500;
+	default_split_user_count = 0;
+	default_split_server_count = 0;
+	no_create_on_split = no;
+	no_join_on_split = no;
+	burst_topicwho = yes;
+	kick_on_split_riding = no;
+	only_ascii_channels = no;
+	resv_forcepart = yes;
+	channel_target_change = yes;
+	disable_local_channels = no;
+	autochanmodes = "+nt";
+	displayed_usercount = 3;
+	strip_topic_colors = no;
+	opmod_send_statusmsg = no;
+	invite_notify_notice = yes;
+};
diff --git a/solanum/conf.j2 b/solanum/conf.j2
new file mode 100644
index 0000000..0a3ad39
--- /dev/null
+++ b/solanum/conf.j2
@@ -0,0 +1,192 @@
+loadmodule "extensions/chm_nonotice";
+loadmodule "extensions/chm_operpeace";
+#loadmodule "extensions/createauthonly";
+loadmodule "extensions/extb_account";
+loadmodule "extensions/extb_canjoin";
+loadmodule "extensions/extb_channel";
+loadmodule "extensions/extb_combi";
+loadmodule "extensions/extb_extgecos";
+loadmodule "extensions/extb_hostmask";
+loadmodule "extensions/extb_oper";
+loadmodule "extensions/extb_realname";
+loadmodule "extensions/extb_server";
+loadmodule "extensions/extb_ssl";
+loadmodule "extensions/extb_usermode";
+#loadmodule "extensions/hurt";
+loadmodule "extensions/m_extendchans";
+loadmodule "extensions/m_findforwards";
+loadmodule "extensions/m_identify";
+loadmodule "extensions/m_locops";
+#loadmodule "extensions/no_oper_invis";
+loadmodule "extensions/sno_farconnect";
+loadmodule "extensions/sno_globalnickchange";
+loadmodule "extensions/sno_globaloper";
+loadmodule "extensions/override";
+#loadmodule "extensions/no_kill_services";
+
+loadmodule "extensions/ip_cloaking_4.0";
+
+serverinfo {
+	name = "{{ inventory_hostname }}";
+    sid = "{{ solanum_sid }}";
+    description = "an IRC server run by AS4242422002";
+    network_name = "ReplIRC";
+    ssl_cert = "etc/cert.pem";
+    ssl_private_key = "etc/key.pem";
+    # ssl_dh_params = "etc/dh.pem";
+    ssld_count = 1;
+    default_max_clients = 1024;
+    nicklen = 30;
+};
+
+admin {
+	name = "9pfs (h)";
+	description = "AS4242422002";
+	email = "h+irc@9pfs.dn42";
+};
+
+class "users" {
+	ping_time = 2 minutes;
+	number_per_ident = 10;
+	number_per_ip = 10;
+	number_per_ip_global = 50;
+	cidr_ipv4_bitlen = 24;
+	cidr_ipv6_bitlen = 64;
+	number_per_cidr = 200;
+	max_number = 3000;
+	sendq = 400 kbytes;
+};
+
+class "opers" {
+	ping_time = 5 minutes;
+	max_number = 1000;
+	sendq = 1 megabyte;
+};
+
+class "server" {
+	ping_time = 5 minutes;
+	connectfreq = 30 seconds;
+	max_number = 10;
+	max_autoconn = 1;
+	sendq = 4 megabytes;
+};
+
+listen {
+	defer_accept = yes;
+	port = 6667;
+	sslport = 6697;
+};
+
+# My own dn42 network should be exempt from klines
+auth {
+	user = "*@172.22.161.0/27";
+	flags = kline_exempt;
+	class = "users";
+};
+
+auth {
+	user = "*@fd32:6b0:70a6::/48";
+	flags = kline_exempt;
+	class = "users";
+};
+
+auth {
+	user = "*@*";
+	class = "users";
+};
+
+privset "local_op" {
+	privs = oper:general, oper:privs, oper:testline, oper:kill, oper:operwall, oper:message,
+		usermode:servnotice, auspex:oper, auspex:hostname, auspex:umodes, auspex:cmodes;
+};
+
+privset "server_bot" {
+	extends = "local_op";
+	privs = oper:kline, oper:remoteban, snomask:nick_changes;
+};
+
+privset "global_op" {
+	extends = "local_op";
+	privs = oper:routing, oper:kline, oper:unkline,oper:xline,
+		oper:resv, oper:cmodes, oper:mass_notice, oper:wallops,
+		oper:remoteban;
+};
+
+privset "admin" {
+	extends = "global_op";
+	privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:grant;
+};
+
+{% include 'connect.j2' %}
+
+service {
+	name = "services.solanum.repl";
+};
+
+cluster {
+	name = "*";
+	flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv;
+};
+
+secure {
+	ip = "127.0.0.1";
+};
+
+exempt {
+	ip = "127.0.0.1";
+};
+
+{% include 'channel.j2' %}
+
+
+serverhide {
+	flatten_links = no;
+	links_delay = 5 minutes;
+	hidden = no;
+	disable_hidden = no;
+};
+
+dnsbl {
+	host = "rbl.efnetrbl.org";
+	type = ipv4;
+	reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
+};
+
+alias "NickServ" {
+	target = "NickServ";
+};
+
+alias "ChanServ" {
+	target = "ChanServ";
+};
+
+alias "OperServ" {
+	target = "OperServ";
+};
+
+alias "MemoServ" {
+	target = "MemoServ";
+};
+
+alias "NS" {
+	target = "NickServ";
+};
+
+alias "CS" {
+	target = "ChanServ";
+};
+
+alias "OS" {
+	target = "OperServ";
+};
+
+alias "MS" {
+	target = "MemoServ";
+};
+
+{% include 'general.j2' %}
+
+modules {
+	path = "modules";
+	path = "modules/autoload";
+};
diff --git a/solanum/connect.j2 b/solanum/connect.j2
new file mode 100644
index 0000000..dca7cbe
--- /dev/null
+++ b/solanum/connect.j2
@@ -0,0 +1,24 @@
+{% for host in ansible_play_hosts %}
+{% if host != inventory_hostname %}
+connect "{{ host }}" {
+	host = "{{ hostvars[host]['unicastv6'] }}";
+	send_password = "certfp";
+	accept_password = "certfp";
+	port = 6697;
+	class = "server";
+	flags = topicburst, ssl, autoconn;
+	fingerprint = "{{ hostvars[host]['tls_fingerprint']['stdout'] }}";
+};
+{% endif %}
+{% endfor %}
+{% if inventory_hostname == 'us1.routers.9pfs.dn42' %}
+connect "irc.firepi.amcforum.wiki" {
+	host = "fd13:af89:f9::1";
+	send_password = "certfp";
+	accept_password = "certfp";
+	port = 6697;
+	class = "server";
+	flags = topicburst, ssl, autoconn;
+	fingerprint = "SPKI:SHA2-256:0f9bab78b6e6eda24e2c8ff590b826b560fc88ed722233084616c050c8c32c5c";
+};
+{% endif %}
diff --git a/solanum/general.j2 b/solanum/general.j2
new file mode 100644
index 0000000..6971bf5
--- /dev/null
+++ b/solanum/general.j2
@@ -0,0 +1,86 @@
+general {
+	hide_error_messages = opers;
+	hide_spoof_ips = yes;
+	default_umodes = "+iw";
+
+	default_operstring = "is an IRC Operator";
+	default_adminstring = "is a Server Administrator";
+	servicestring = "is a Network Service";
+	sasl_service = "SaslServ";
+	disable_fake_channels = no;
+	tkline_expire_notices = yes;
+	default_floodcount = 10;
+	failed_oper_notice = yes;
+	dots_in_ident = 2;
+	min_nonwildcard = 4;
+	min_nonwildcard_simple = 3;
+	max_accept = 100;
+	max_monitor = 100;
+	anti_nick_flood = yes;
+	max_nick_time = 20 seconds;
+	max_nick_changes = 5;
+	anti_spam_exit_message_time = 5 minutes;
+	# Desyncs are BAD.
+	ts_warn_delta = 5 seconds;
+	tx_max_delta = 5 minutes;
+	client_exit = yes;
+	collision_fnc = yes;
+	resv_fnc = yes;
+	global_snotices = yes;
+	dline_with_reason = yes;
+	kline_with_reason = yes;
+	hide_tkdline_duration = no;
+	kline_reason = "K-Lined";
+	sasl_only_client_message = "You need to identify via SASL to use this server.";
+	identd_only_client_message = "You need to install identd to use this server.";
+	sctp_forbidden_client_message = "You are not allowed to use SCTP on this server.";
+	ssltls_only_client_message = "You need to use SSL/TLS to use this server.";
+	not_authorised_client_message = "You are not authorised to access this server.";
+	illegal_hostname_client_message = "You have an illegal character in your hostname.";
+	server_full_client_message = "Sorry, server is full - try later";
+	illegal_name_long_client_message = "Your username is invalid. Please make sure that your username contains only alphanumeric characters.";
+	illegal_name_short_client_message = "Invalid username";
+	identify_service = "NickServ@services.solanum.repl";
+	identify_command = "IDENTIFY";
+	non_redundant_klines = yes;
+	warn_no_nline = yes;
+	use_propagated_bans = yes;
+	stats_e_disabled = no;
+	stats_c_oper_only = no;
+	stats_y_oper_only = no;
+	stats_o_oper_only = yes;
+	stats_P_oper_only = no;
+	stats_i_oper_only = masked;
+	stats_k_oper_only = masked;
+	map_oper_only = no;
+	operspy_admin_only = no;
+	operspy_dont_care_user_info = no;
+	caller_id_wait = 1 minute;
+	pace_wait_simple = 1 second;
+	pace_wait = 10 seconds;
+	short_motd = no;
+	ping_cookie = yes;
+	connect_timeout = 30 seconds;
+	default_ident_timeout = 5;
+	disable_auth = no;
+	no_oper_flood = yes;
+	max_targets = 4;
+	client_flood_max_lines = 20;
+	post_registration_delay = 0 seconds;
+	use_whois_actually = no;
+	oper_only_umodes = operwall, locops, servnotice;
+	oper_umodes = locops, servnotice, operwall, wallop;
+	oper_snomask = "+s";
+	burst_away = yes;
+	nick_delay = 0 seconds;
+	reject_ban_time = 1 minute;
+	reject_after_count = 3;
+	reject_duration = 5 minutes;
+	throttle_duration = 60;
+	throttle_count = 4;
+	max_ratelimit_tokens = 30;
+	away_interval = 30;
+	certfp_method = spki_sha256;
+	hide_opers_in_whois = no;
+	tls_ciphers_oper_only = no;
+};
diff --git a/solanum/ircd.conf.example b/solanum/ircd.conf.example
new file mode 100644
index 0000000..57dc845
--- /dev/null
+++ b/solanum/ircd.conf.example
@@ -0,0 +1,634 @@
+/* doc/ircd.conf.example - brief example configuration file
+ *
+ * Copyright (C) 2000-2002 Hybrid Development Team
+ * Copyright (C) 2002-2005 ircd-ratbox development team
+ * Copyright (C) 2005-2006 charybdis development team
+ *
+ * See reference.conf for more information.
+ */
+
+/* Extensions */
+#loadmodule "extensions/chm_nonotice";
+#loadmodule "extensions/chm_operpeace";
+#loadmodule "extensions/createauthonly";
+#loadmodule "extensions/extb_account";
+#loadmodule "extensions/extb_canjoin";
+#loadmodule "extensions/extb_channel";
+#loadmodule "extensions/extb_combi";
+#loadmodule "extensions/extb_extgecos";
+#loadmodule "extensions/extb_hostmask";
+#loadmodule "extensions/extb_oper";
+#loadmodule "extensions/extb_realname";
+#loadmodule "extensions/extb_server";
+#loadmodule "extensions/extb_ssl";
+#loadmodule "extensions/extb_usermode";
+#loadmodule "extensions/hurt";
+#loadmodule "extensions/m_extendchans";
+#loadmodule "extensions/m_findforwards";
+#loadmodule "extensions/m_identify";
+#loadmodule "extensions/m_locops";
+#loadmodule "extensions/no_oper_invis";
+#loadmodule "extensions/sno_farconnect";
+#loadmodule "extensions/sno_globalnickchange";
+#loadmodule "extensions/sno_globaloper";
+#loadmodule "extensions/override";
+#loadmodule "extensions/no_kill_services";
+
+/*
+ * IP cloaking extensions: use ip_cloaking_4.0
+ * if you're linking 3.2 and later, otherwise use
+ * ip_cloaking, for compatibility with older 3.x
+ * releases.
+ */
+
+#loadmodule "extensions/ip_cloaking_4.0";
+#loadmodule "extensions/ip_cloaking";
+
+serverinfo {
+	name = "hades.arpa";
+	sid = "42X";
+	description = "solanum test server";
+	network_name = "StaticBox";
+
+	/* On multi-homed hosts you may need the following. These define
+	 * the addresses we connect from to other servers. */
+	/* for IPv4 */
+	#vhost = "192.0.2.6";
+	/* for IPv6 */
+	#vhost6 = "2001:db8:2::6";
+
+	/* ssl_cert: certificate (and optionally key) for our ssl server */
+	ssl_cert = "etc/ssl.pem";
+
+	/* ssl_private_key: our ssl private key (if not contained in ssl_cert file) */
+	#ssl_private_key = "etc/ssl.key";
+
+	/* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 2048
+	 * In general, the DH parameters size should be the same as your key's size.
+	 * However it has been reported that some clients have broken TLS implementations which may
+	 * choke on keysizes larger than 2048-bit, so we would recommend using 2048-bit DH parameters
+	 * for now if your keys are larger than 2048-bit.
+	 *
+	 * If you do not provide parameters, some TLS backends will fail on DHE- ciphers,
+	 * and some will succeed but use weak, common DH groups! */
+	ssl_dh_params = "etc/dh.pem";
+
+	/* ssld_count: number of ssld processes you want to start, if you
+	 * have a really busy server, using N-1 where N is the number of
+	 * cpu/cpu cores you have might be useful. A number greater than one
+	 * can also be useful in case of bugs in ssld and because ssld needs
+	 * two file descriptors per SSL connection.
+	 */
+	ssld_count = 1;
+
+	/* default max clients: the default maximum number of clients
+	 * allowed to connect.  This can be changed once ircd has started by
+	 * issuing:
+	 *   /quote set maxclients <limit>
+	 */
+	default_max_clients = 1024;
+
+	/* nicklen: enforced nickname length (for this server only; must not
+	 * be longer than the maximum length set while building).
+	 */
+	nicklen = 30;
+};
+
+admin {
+	name = "Lazy admin (lazya)";
+	description = "StaticBox client server";
+	email = "nobody@127.0.0.1";
+};
+
+log {
+	fname_userlog = "logs/userlog";
+	#fname_fuserlog = "logs/fuserlog";
+	fname_operlog = "logs/operlog";
+	#fname_foperlog = "logs/foperlog";
+	fname_serverlog = "logs/serverlog";
+	#fname_klinelog = "logs/klinelog";
+	fname_killlog = "logs/killlog";
+	fname_operspylog = "logs/operspylog";
+	#fname_ioerrorlog = "logs/ioerror";
+};
+
+/* class {} blocks MUST be specified before anything that uses them.  That
+ * means they must be defined before auth {} and before connect {}.
+ */
+class "users" {
+	ping_time = 2 minutes;
+	number_per_ident = 10;
+	number_per_ip = 10;
+	number_per_ip_global = 50;
+	cidr_ipv4_bitlen = 24;
+	cidr_ipv6_bitlen = 64;
+	number_per_cidr = 200;
+	max_number = 3000;
+	sendq = 400 kbytes;
+};
+
+class "opers" {
+	ping_time = 5 minutes;
+	number_per_ip = 10;
+	max_number = 1000;
+	sendq = 1 megabyte;
+};
+
+class "server" {
+	ping_time = 5 minutes;
+	connectfreq = 5 minutes;
+	max_number = 1;
+	sendq = 4 megabytes;
+};
+
+listen {
+	/* defer_accept: wait for clients to send IRC handshake data before
+	 * accepting them.  if you intend to use software which depends on the
+	 * server replying first, such as BOPM, you should disable this feature.
+	 * otherwise, you probably want to leave it on.
+	 */
+	defer_accept = yes;
+
+	/* If you want to listen on a specific IP only, specify host.
+	 * host definitions apply only to the following port line.
+	 */
+	#host = "192.0.2.6";
+	port = 5000, 6665 .. 6669;
+	sslport = 6697;
+
+	/* Listen on IPv6 (if you used host= above). */
+	#host = "2001:db8:2::6";
+	#port = 5000, 6665 .. 6669;
+	#sslport = 6697;
+};
+
+/* auth {}: allow users to connect to the ircd (OLD I:)
+ * auth {} blocks MUST be specified in order of precedence.  The first one
+ * that matches a user will be used.  So place spoofs first, then specials,
+ * then general access, then restricted.
+ */
+auth {
+	/* user: the user@host allowed to connect.  Multiple IPv4/IPv6 user
+	 * lines are permitted per auth block.  This is matched against the
+	 * hostname and IP address (using :: shortening for IPv6 and
+	 * prepending a 0 if it starts with a colon) and can also use CIDR
+	 * masks.
+	 */
+	user = "*@198.51.100.0/24";
+	user = "*test@2001:db8:1:*";
+
+	/* password: an optional password that is required to use this block.
+	 * By default this is not encrypted, specify the flag "encrypted" in
+	 * flags = ...; below if it is.
+	 */
+	password = "letmein";
+
+	/* spoof: fake the users user@host to be be this.  You may either
+	 * specify a host or a user@host to spoof to.  This is free-form,
+	 * just do everyone a favour and dont abuse it. (OLD I: = flag)
+	 */
+	spoof = "I.still.hate.packets";
+
+	/* Possible flags in auth:
+	 *
+	 * encrypted                  | password is encrypted with mkpasswd
+	 * spoof_notice               | give a notice when spoofing hosts
+	 * exceed_limit (old > flag)  | allow user to exceed class user limits
+	 * kline_exempt (old ^ flag)  | exempt this user from k/g/xlines,
+	 *                            | dnsbls, and proxies
+	 * proxy_exempt               | exempt this user from proxies
+	 * dnsbl_exempt               | exempt this user from dnsbls
+	 * spambot_exempt             | exempt this user from spambot checks
+	 * shide_exempt               | exempt this user from serverhiding
+	 * jupe_exempt                | exempt this user from generating
+	 *                              warnings joining juped channels
+	 * resv_exempt                | exempt this user from resvs
+	 * flood_exempt               | exempt this user from flood limits
+	 *                              USE WITH CAUTION.
+	 * no_tilde     (old - flag)  | don't prefix ~ to username if no ident
+	 * need_ident   (old + flag)  | require ident for user in this class
+	 * need_ssl                   | require SSL/TLS for user in this class
+	 * need_sasl                  | require SASL id for user in this class
+	 */
+	flags = kline_exempt, exceed_limit;
+
+	/* class: the class the user is placed in */
+	class = "opers";
+};
+
+auth {
+	user = "*@*";
+	class = "users";
+};
+
+/* privset {} blocks MUST be specified before anything that uses them.  That
+ * means they must be defined before operator {}.
+ */
+privset "local_op" {
+	privs = oper:general, oper:privs, oper:testline, oper:kill, oper:operwall, oper:message,
+		usermode:servnotice, auspex:oper, auspex:hostname, auspex:umodes, auspex:cmodes;
+};
+
+privset "server_bot" {
+	extends = "local_op";
+	privs = oper:kline, oper:remoteban, snomask:nick_changes;
+};
+
+privset "global_op" {
+	extends = "local_op";
+	privs = oper:routing, oper:kline, oper:unkline, oper:xline,
+		oper:resv, oper:cmodes, oper:mass_notice, oper:wallops,
+		oper:remoteban;
+};
+
+privset "admin" {
+	extends = "global_op";
+	privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:grant;
+};
+
+operator "god" {
+	/* name: the name of the oper must go above */
+
+	/* user: the user@host required for this operator.  CIDR *is*
+	 * supported now. auth{} spoofs work here, other spoofs do not.
+ 	 * multiple user="" lines are supported.
+	 */
+	user = "*god@127.0.0.1";
+
+	/* password: the password required to oper.  Unless ~encrypted is
+	 * contained in flags = ...; this will need to be encrypted using
+	 * mkpasswd, MD5 is supported
+	 */
+	password = "etcnjl8juSU1E";
+
+	/* rsa key: the public key for this oper when using Challenge.
+	 * A password should not be defined when this is used, see
+	 * doc/challenge.txt for more information.
+	 */
+	#rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";
+
+	/* umodes: the specific umodes this oper gets when they oper.
+	 * If this is specified an oper will not be given oper_umodes
+	 * These are described above oper_only_umodes in general {};
+	 */
+	#umodes = locops, servnotice, operwall, wallop;
+
+	/* fingerprint: if specified, the oper's client certificate
+	 * fingerprint will be checked against the specified fingerprint
+	 * below.
+	 */
+	#fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
+
+	/* snomask: specific server notice mask on oper up.
+	 * If this is specified an oper will not be given oper_snomask.
+	 */
+	snomask = "+Zbfkrsuy";
+
+	/* flags: misc options for the operator.  You may prefix an option
+	 * with ~ to disable it, e.g. ~encrypted.
+	 *
+	 * Default flags are encrypted.
+	 *
+	 * Available options:
+	 *
+	 * encrypted:    the password above is encrypted [DEFAULT]
+	 * need_ssl:     must be using SSL/TLS to oper up
+	 */
+	flags = encrypted;
+
+	/* privset: privileges set to grant */
+	privset = "admin";
+};
+
+/* See connecting-servers.rst for an introduction to using these files. */
+
+connect "irc.uplink.com" {
+	host = "203.0.113.3";
+	send_password = "password";
+	accept_password = "anotherpassword";
+	port = 6666;
+	class = "server";
+	flags = topicburst;
+
+	#fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
+};
+
+connect "ssl.uplink.com" {
+	host = "203.0.113.129";
+	send_password = "password";
+	accept_password = "anotherpassword";
+	port = 9999;
+	class = "server";
+	flags = ssl, topicburst;
+};
+
+service {
+	name = "services.int";
+};
+
+cluster {
+	name = "*";
+	flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv;
+};
+
+secure {
+	ip = "127.0.0.1";
+};
+
+/* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */
+exempt {
+	ip = "127.0.0.1";
+};
+
+channel {
+	use_invex = yes;
+	use_except = yes;
+	use_forward = yes;
+	use_knock = yes;
+	knock_delay = 5 minutes;
+	knock_delay_channel = 1 minute;
+	max_chans_per_user = 15;
+	max_chans_per_user_large = 60;
+	max_bans = 100;
+	max_bans_large = 500;
+	default_split_user_count = 0;
+	default_split_server_count = 0;
+	no_create_on_split = no;
+	no_join_on_split = no;
+	burst_topicwho = yes;
+	kick_on_split_riding = no;
+	only_ascii_channels = no;
+	resv_forcepart = yes;
+	channel_target_change = yes;
+	disable_local_channels = no;
+	autochanmodes = "+nt";
+	displayed_usercount = 3;
+	strip_topic_colors = no;
+	opmod_send_statusmsg = no;
+	invite_notify_notice = yes;
+};
+
+serverhide {
+	flatten_links = yes;
+	links_delay = 5 minutes;
+	hidden = no;
+	disable_hidden = no;
+};
+
+/* These are the DNSBL settings.
+ * You can have multiple combinations of host and rejection reasons.
+ * They are used in pairs of one host/rejection reason.
+ *
+ * The default settings should be adequate for most networks.
+ *
+ * It is not recommended to use DNSBL services designed for e-mail spam
+ * prevention, such as SPEWS for blocking IRC connections.
+ *
+ * As of charybdis 2.2, you can do some keyword substitution on the rejection
+ * reason. The available keyword substitutions are:
+ *
+ *   ${ip}           - the user's IP
+ *   ${host}         - the user's canonical hostname
+ *   ${dnsbl-host}   - the dnsbl hostname the lookup was done against
+ *   ${nick}         - the user's nickname
+ *   ${network-name} - the name of the network
+ *
+ * As of charybdis 3.4, a type parameter is supported, which specifies the
+ * address families the blacklist supports. IPv4 and IPv6 are supported.
+ * IPv4 is currently the default as few blacklists support IPv6 operation
+ * as of this writing.
+ *
+ * As of charybdis 3.5, a matches parameter is allowed; if omitted, any result
+ * is considered a match. If included, a comma-separated list of *quoted*
+ * strings is allowed to match queries. They may be of the format "0" to "255"
+ * to match the final octet (e.g. 127.0.0.1) or "127.x.y.z" to explicitly match
+ * an A record. The DNSBL match is only applied if it matches anything in the
+ * list. You may freely mix full IP's and final octets.
+ *
+ * Consult your DNSBL provider for the meaning of these parameters; they
+ * are usually used to denote different block reasons.
+ */
+dnsbl {
+	host = "rbl.efnetrbl.org";
+	type = ipv4;
+	reject_reason = "${nick}, your IP (${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=${ip}";
+
+	/* Example of a blacklist that supports both IPv4 and IPv6 and using matches */
+#	host = "foobl.blacklist.invalid";
+#	type = ipv4, ipv6;
+#	matches = "4", "6", "127.0.0.10";
+#	reject_reason = "${nick}, your IP (${ip}) is listed in ${dnsbl-host} for some reason. In order to protect ${network-name} from abuse, we are not allowing connections listed in ${dnsbl-host} to connect";
+};
+
+/* These are the OPM settings.
+ * This is similar to the functionality provided by BOPM. It will scan incoming
+ * connections for open proxies by connecting to clients and attempting several
+ * different open proxy handshakes. If they connect back to us (via a dedicated
+ * listening port), and send back the data we send them, they are considered
+ * an open proxy. For politeness reasons (users may be confused by the incoming
+ * connection attempts if they are logging incoming connections), the user is
+ * notified upon connect if they are being scanned.
+ *
+ * WARNING:
+ * These settings are considered experimental. Only the most common proxy types
+ * are checked for (Charybdis is immune from POST and GET proxies). If you are
+ * not comfortable with experimental code, do not use this feature.
+ */
+#opm {
+	/* IPv4 address to listen on. This must be a publicly facing IP address
+	 * to be effective.
+	 * If omitted, it defaults to serverinfo::vhost.
+	 */
+	#listen_ipv4 = "127.0.0.1";
+
+	/* IPv4 port to listen on.
+	 * This should not be the same as any existing listeners.
+	 */
+	#port_v4 = 32000;
+
+	/* IPv6 address to listen on. This must be a publicly facing IP address
+	 * to be effective.
+	 * If omitted, it defaults to serverinfo::vhost6.
+	 */
+	#listen_ipv6 = "::1";
+
+	/* IPv6 port to listen on.
+	 * This should not be the same as any existing listeners.
+	 */
+	#port_v6 = 32000;
+
+	/* You can also set the listen_port directive which will set both the
+	 * IPv4 and IPv6 ports at once.
+	 */
+	#listen_port = 32000;
+
+	/* This sets the timeout in seconds before ending open proxy scans.
+	 * Values less than 1 or greater than 60 are ignored.
+	 * It is advisable to keep it as short as feasible, so clients do not
+	 * get held up by excessively long scan times.
+	 */
+	#timeout = 5;
+
+	/* These are the ports to scan for SOCKS4 proxies on. They may overlap
+	 * with other scan types. Sensible defaults are given below.
+	 */
+	#socks4_ports = 1080, 10800, 443, 80, 8080, 8000;
+
+	/* These are the ports to scan for SOCKS5 proxies on. They may overlap
+	 * with other scan types. Sensible defaults are given below.
+	 */
+	#socks5_ports = 1080, 10800, 443, 80, 8080, 8000;
+
+	/* These are the ports to scan for HTTP connect proxies on (plaintext).
+	 * They may overlap with other scan types. Sensible defaults are given
+	 * below.
+	 */
+	#httpconnect_ports = 80, 8080, 8000;
+
+	/* These are the ports to scan for HTTPS CONNECT proxies on (SSL).
+	 * They may overlap with other scan types. Sensible defaults are given
+	 * below.
+	 */
+	#httpsconnect_ports = 443, 4443;
+#};
+
+alias "NickServ" {
+	target = "NickServ";
+};
+
+alias "ChanServ" {
+	target = "ChanServ";
+};
+
+alias "OperServ" {
+	target = "OperServ";
+};
+
+alias "MemoServ" {
+	target = "MemoServ";
+};
+
+alias "NS" {
+	target = "NickServ";
+};
+
+alias "CS" {
+	target = "ChanServ";
+};
+
+alias "OS" {
+	target = "OperServ";
+};
+
+alias "MS" {
+	target = "MemoServ";
+};
+
+general {
+	hide_error_messages = opers;
+	hide_spoof_ips = yes;
+
+	/*
+	 * default_umodes: umodes to enable on connect.
+	 * If you have enabled the new ip_cloaking_4.0 module, and you want
+	 * to make use of it, add +x to this option, i.e.:
+	 *      default_umodes = "+ix";
+	 *
+	 * If you have enabled the old ip_cloaking module, and you want
+	 * to make use of it, add +h to this option, i.e.:
+	 *	default_umodes = "+ih";
+	 */
+	default_umodes = "+i";
+
+	default_operstring = "is an IRC Operator";
+	default_adminstring = "is a Server Administrator";
+	servicestring = "is a Network Service";
+
+	/*
+	 * Nick of the network's SASL agent. Used to check whether services are here,
+	 * SASL credentials are only sent to its server. Needs to be a service.
+	 *
+	 * Defaults to SaslServ if unspecified.
+	 */
+	sasl_service = "SaslServ";
+	disable_fake_channels = no;
+	tkline_expire_notices = no;
+	default_floodcount = 10;
+	failed_oper_notice = yes;
+	dots_in_ident = 2;
+	min_nonwildcard = 4;
+	min_nonwildcard_simple = 3;
+	max_accept = 100;
+	max_monitor = 100;
+	anti_nick_flood = yes;
+	max_nick_time = 20 seconds;
+	max_nick_changes = 5;
+	anti_spam_exit_message_time = 5 minutes;
+	ts_warn_delta = 30 seconds;
+	ts_max_delta = 5 minutes;
+	client_exit = yes;
+	collision_fnc = yes;
+	resv_fnc = yes;
+	global_snotices = yes;
+	dline_with_reason = yes;
+	kline_with_reason = yes;
+	hide_tkdline_duration = no;
+	kline_reason = "K-Lined";
+	sasl_only_client_message = "You need to identify via SASL to use this server.";
+	identd_only_client_message = "You need to install identd to use this server.";
+	sctp_forbidden_client_message = "You are not allowed to use SCTP on this server.";
+	ssltls_only_client_message = "You need to use SSL/TLS to use this server.";
+	not_authorised_client_message = "You are not authorised to access this server.";
+	illegal_hostname_client_message = "You have an illegal character in your hostname.";
+	server_full_client_message = "Sorry, server is full - try later";
+	illegal_name_long_client_message = "Your username is invalid. Please make sure that your username contains only alphanumeric characters.";
+	illegal_name_short_client_message = "Invalid username";
+	identify_service = "NickServ@services.int";
+	identify_command = "IDENTIFY";
+	non_redundant_klines = yes;
+	warn_no_nline = yes;
+	use_propagated_bans = yes;
+	stats_e_disabled = no;
+	stats_c_oper_only = no;
+	stats_y_oper_only = no;
+	stats_o_oper_only = yes;
+	stats_P_oper_only = no;
+	stats_i_oper_only = masked;
+	stats_k_oper_only = masked;
+	map_oper_only = no;
+	operspy_admin_only = no;
+	operspy_dont_care_user_info = no;
+	caller_id_wait = 1 minute;
+	pace_wait_simple = 1 second;
+	pace_wait = 10 seconds;
+	short_motd = no;
+	ping_cookie = no;
+	connect_timeout = 30 seconds;
+	default_ident_timeout = 5;
+	disable_auth = no;
+	no_oper_flood = yes;
+	max_targets = 4;
+	client_flood_max_lines = 20;
+	post_registration_delay = 0 seconds;
+	use_whois_actually = no;
+	oper_only_umodes = operwall, locops, servnotice;
+	oper_umodes = locops, servnotice, operwall, wallop;
+	oper_snomask = "+s";
+	burst_away = yes;
+	nick_delay = 0 seconds; # 15 minutes if you want to enable this
+	reject_ban_time = 1 minute;
+	reject_after_count = 3;
+	reject_duration = 5 minutes;
+	throttle_duration = 60;
+	throttle_count = 4;
+	max_ratelimit_tokens = 30;
+	away_interval = 30;
+	certfp_method = spki_sha256;
+	hide_opers_in_whois = no;
+	tls_ciphers_oper_only = no;
+};
+
+modules {
+	path = "modules";
+	path = "modules/autoload";
+};
diff --git a/solanum/motd.j2 b/solanum/motd.j2
new file mode 100644
index 0000000..fd606bf
--- /dev/null
+++ b/solanum/motd.j2
@@ -0,0 +1,8 @@
+Welcome to {{ inventory_hostname }}
+
+Server information:
+- IPv4 address: {{ unicastv4 }}
+- IPv6 address: {{ unicastv6 }}
+- TLS certificate fingerprint: {{ tls_fingerprint['stdout'] }}
+- PoP location: {{ pop_loc }}
+- Distro: {{ ansible_distribution }}
diff --git a/solanum/solanum.service b/solanum/solanum.service
new file mode 100644
index 0000000..e8b3413
--- /dev/null
+++ b/solanum/solanum.service
@@ -0,0 +1,42 @@
+[Unit]
+Description=Solanum IRCd
+
+[Service]
+Type=forking
+User=solanum
+ExecStart=/home/solanum/ircd/bin/solanum -pidfile /run/solanum/solanum.pid
+ExecReload=/usr/bin/kill -HUP $MAINPID
+NoNewPrivileges=true
+ProtectSystem=strict
+RuntimeDirectory=solanum
+ReadWritePaths=/home/solanum/ircd/logs
+PrivateDevices=true
+Restart=always
+RestartSec=5
+RemoveIPC=true
+CapabilityBoundingSet=
+ProtectClock=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+ProtectHostname=true
+LockPersonality=true
+ProtectKernelTunables=true
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictRealtime=true
+ProtectProc=ptraceable
+ProcSubset=pid
+ProtectHome=tmpfs
+BindPaths=/home/solanum/ircd
+PrivateUsers=true
+PrivateTmp=true
+SystemCallFilter=@system-service
+SystemCallFilter=~@resources @privileged
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
diff --git a/update-bgp.yml b/update-bgp.yml
deleted file mode 100644
index 666aa02..0000000
--- a/update-bgp.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-- hosts: routers
-  remote_user: root
-  tasks:
-    - name: add internal bgp peers
-      template:
-        src: int-bgp.j2
-        dest: /etc/bird/peers/internal.conf
-    - name: add route collector peering
-      copy:
-        src: collector.conf
-        dest: /etc/bird/peers/collector.conf
-    - name: reload bird
-      ansible.builtin.systemd_service:
-        name: bird.service
-        enabled: true
-        state: reloaded
-      when: ansible_service_mgr == 'systemd'