Ergo

Search for Ergo in the Marketplace, select the SecureAnyCloud publisher, and click Create.

Configure the Network Security Group to allow TCP 6697 (TLS IRC) and TCP 6667 (plaintext IRC) from your client networks, and TCP 22 for administration. Prefer 6697 for real users. Where you can, limit 6667 to loopback or VNet traffic.

RG="chat-prod"; LOCATION="eastus"; VM_NAME="ircd1" IMAGE_URN="sac1647283583153:ergo-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ergo-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the IRC and admin ports on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 6697 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 6667 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1003

On first boot, the image resolves the VM public IP and generates a per-VM operator password and a per-VM self-signed TLS certificate. It then initializes the account and channel datastore, renders the configuration, and starts Ergo. This completes within a minute.

SSH in as azureuser and read the per-VM details, including the operator password:

sudo cat /root/ergo-credentials.txt

Confirm that ergo.service is active and listening on 6667 (plaintext) and 6697 (TLS).

systemctl is-active ergo.service ss -tln | grep -E ':6667|:6697'

The image ships a self-test. It connects two IRC clients to the server and has both join a channel. It sends a message from one client and confirms that the other receives it. It then logs in as an operator with the per-VM password and completes a TLS handshake on 6697.

Run it to prove the server is healthy end to end:

sudo python3 /usr/local/lib/sac/ergo-roundtrip.py

The encrypted listener on 6697 presents the per-VM self-signed certificate. Inspect the handshake and certificate with openssl:

echo | openssl s_client -connect 127.0.0.1:6697 -servername localhost 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Point any IRC client at the server. Use port 6697 with TLS, and either accept the self-signed certificate or install a CA-issued one as described in Step 9. Use port 6667 for plaintext on trusted networks only. Read <IRC_HOST> and the operator password from /root/ergo-credentials.txt.

In your client, register your nick, then become an operator with the per-VM password (the operator name is admin):

/msg NickServ REGISTER <your-account-password> /OPER admin <OPER_PASSWORD>

A successful OPER returns RPL_YOUREOPER and grants you the server administrator class defined in the configuration.

Ergo's built-in ChanServ lets an account own and manage a channel with no separate services package. Register your account and identify to it. Then join a channel and register it:

/join #welcome /msg ChanServ REGISTER #welcome

Message history is retained, so clients that support the CHATHISTORY capability can play back recent messages when they reconnect.

The image ships a per-VM self-signed certificate so TLS works out of the box. For production, install a certificate issued by a recognized authority.

Place your full chain and private key on the VM, point the 6697 listener at them in /etc/ergo/ircd.yaml, and reload:

server: listeners: ":6697": tls: cert: /etc/ergo/tls.crt key: /etc/ergo/tls.key

Replace /etc/ergo/tls.crt and /etc/ergo/tls.key with your issued certificate and key, and keep the key readable by the ergo group. Then restart the service with sudo systemctl restart ergo.

• Restrict the NSG. Allow 6697 (and 6667 where you must) only from the client networks that need to connect, and allow TCP 22 for administration only.
• Prefer TLS. Use port 6697 for real users and install a CA-issued certificate (Step 9). Where you can, limit plaintext 6667 to loopback or VNet traffic.
• Require SASL for stricter deployments. For a private network, require SASL authentication and disable open account registration in /etc/ergo/ircd.yaml, so only invited accounts can connect.
• Keep the operator password secret. It lives only in /root/ergo-credentials.txt (root-only) and is unique to this VM. Rotate it by generating a new hash with ergo genpasswd and updating the opers block.
• Keep the OS and Ergo patched. Unattended security upgrades remain enabled on the running VM.
• Back up the datastore. Account and channel registrations live in /var/lib/ergo/ircd.db. Include it in your backups.

Ergo is developed by the ergochat project and distributed under the MIT license. This SecureAnyCloud image bundles the unmodified official Ergo binary.

SecureAnyCloud provides the packaging, the secure-by-default first boot (per-VM operator password, per-VM TLS certificate, fresh datastore), the systemd integration, and 24/7 support with a guaranteed 24-hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the Ergo project. Ergo is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find Ergo on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch Ergo IRC Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Ergo. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network and inbound port 6697 (and optionally 6667) from the clients that will connect. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation, which generates the per instance operator password and TLS certificate, takes under a minute after the instance state becomes Running and the status checks pass.

The following block launches an instance from the SecureAnyCloud Ergo Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 6697 and optionally 6667 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ergo-01}]'

The command prints a JSON document on success. Note the instance ID, then retrieve its public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address of the instance. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Ergo 2.18.0 on Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

The unique operator password generated for this instance on first boot is stored in a root-only file. Print it with the following command. Keep it secret; it grants operator privileges on your IRC network:

sudo cat /root/ergo-credentials.txt

The file records the instance address, the generated server name, the plaintext and TLS endpoints, the operator name (admin) and the operator password. No default or shared operator password ships in the image.

Confirm the Ergo service is active, check its version, and confirm it is listening on the plaintext and TLS ports:

systemctl is-active ergo /usr/local/bin/ergo --version ss -tln | grep -E ':6667|:6697'

You should see active, the Ergo version, and listeners on *:6667 and *:6697.

The image ships a self-test that connects two real IRC clients to the running server, registers them, delivers a message from one to the other, logs in as an operator, and completes a TLS handshake on port 6697. Run it to prove the server accepts real IRC connections end to end:

sudo python3 /usr/local/lib/sac/ergo-roundtrip.py

A healthy server prints a single ROUNDTRIP OK line summarising the plaintext registration, the message round-trip, the operator login (numeric 381) and the TLS handshake.

Point your IRC client at the instance public IP. Use port 6697 for an encrypted (TLS) connection or port 6667 for a plaintext connection. The TLS certificate generated on first boot is self-signed, so your client will prompt you to accept it, or you can replace it with a CA-issued certificate as described in the hardening section below.

A typical client configuration is:

Server: <public-ip> Port: 6697 (TLS) or 6667 (plaintext) TLS: on for port 6697 (accept the self-signed certificate) Nickname: your-chosen-nick

From the irssi command-line client, for example, you would connect with:

/connect -tls -tls_verify off <public-ip> 6697

Once connected you can register your nickname and a channel using Ergo's built-in services:

/msg NickServ REGISTER your-account-password your@email.example /join #your-channel /msg ChanServ REGISTER #your-channel

To gain server operator privileges, log in with the operator name admin and the per instance operator password from /root/ergo-credentials.txt. Run this in your connected IRC client, replacing the password with the value you retrieved in step 3:

/oper admin your-operator-password

Ergo confirms operator status with numeric reply 381 (RPL_YOUREOPER). Operators can manage users, channels and server state; keep the operator password secret.

The image is secure by default, but for a production network consider the following. Each of these edits Ergo's configuration at /etc/ergo/ircd.yaml and then restarts the service; make the changes with an editor and apply them with sudo systemctl restart ergo.

Replace the self-signed TLS certificate. For a public network, replace /etc/ergo/tls.crt and /etc/ergo/tls.key with a certificate issued by a trusted certificate authority (for example one obtained with Let's Encrypt for your server's domain name), so clients no longer have to accept a self-signed certificate.

Require SASL and disable public plaintext. To require authenticated connections, enable the account registration and SASL requirements in the configuration, and remove port 6667 from your security group so only the encrypted 6697 listener is reachable from untrusted networks.

Tune connection limits. Ergo's per-IP connection limits and account-registration throttling ship at safe defaults; review the limits and accounts sections of the configuration for your expected load.

After any configuration change, apply it and confirm the service is healthy:

sudo systemctl restart ergo systemctl status ergo

The account and channel database lives at /var/lib/ergo/ircd.db. To back it up, stop the service briefly, copy the database file to a safe location, and start the service again. The operating system applies security updates automatically through unattended upgrades.

To upgrade Ergo itself, replace the /usr/local/bin/ergo binary with a newer official release and restart the service; review the Ergo release notes for any configuration migration steps before upgrading.