flake.nix: tangled-knotserver module improvements

Added two additional options:
- stateDir: controls where the knotserver's state should be stored
(defaults to `/home/git` to maintain compatibility with previous configs)
- openFirewall: decides if we should open port 22 for ssh
(defaults to true to maintain compatibility with previous configs)

Made use of config options that weren't being used

Changed the `gitUser` to be a system user instead of a normal user.
This is purely cosmetic and pretty much just keeps the UID and GID
below 1000. If the user and group were already made, NixOS won't
change them so this shouldn't have the possibility of breaking any
existing setups but if the UID and GID are changing, the activation
script that creates the directories should update the owner of all the
state files.

Add short-hand for `config.services.tangled-knotserver`
Instead of typing `config.services.tangled-knotserver` we can now use
`cfg` to refer to the module's options.

flake.nix

···
       pkgs,
       lib,
       ...
-    }:
+    }: let
+      cfg = config.services.tangled-knotserver;
+    in
       with lib; {
         options = {
           services.tangled-knotserver = {
···
               description = "User that hosts git repos and performs git operations";
             };
 
+            openFirewall = mkOption {
+              type = types.bool;
+              default = true;
+              description = "Open port 22 in the firewall for ssh";
+            };
+
+            stateDir = mkOption {
+              type = types.path;
+              default = "/home/${cfg.gitUser}";
+              description = "Tangled knot data directory";
+            };
+
             repo = {
               scanPath = mkOption {
                 type = types.path;
-                default = "/home/git";
+                default = cfg.stateDir;
                 description = "Path where repositories are scanned from";
               };
 
···
 
               dbPath = mkOption {
                 type = types.path;
-                default = "knotserver.db";
+                default = "${cfg.stateDir}/knotserver.db";
                 description = "Path to the database file";
               };
 
···
           };
         };
 
-        config = mkIf config.services.tangled-knotserver.enable {
+        config = mkIf cfg.enable {
           environment.systemPackages = with pkgs; [git];
 
           system.activationScripts.gitConfig = ''
-            mkdir -p /home/git/.config/git
-            cat > /home/git/.config/git/config << EOF
+            mkdir -p "${cfg.repo.scanPath}"
+            chown -R ${cfg.gitUser}:${cfg.gitUser} \
+                "${cfg.repo.scanPath}"
+
+            mkdir -p "${cfg.stateDir}/.config/git"
+            cat > "${cfg.stateDir}/.config/git/config" << EOF
             [user]
                 name = Git User
                 email = [e-mail]
             EOF
-            chown -R git:git /home/git/.config
+            chown -R ${cfg.gitUser}:${cfg.gitUser} \
+                "${cfg.stateDir}"
           '';
 
-          users.users.git = {
-            isNormalUser = true;
-            home = "/home/git";
+          users.users.${cfg.gitUser} = {
+            isSystemUser = true;
+            useDefaultShell = true;
+            home = cfg.stateDir;
             createHome = true;
-            group = "git";
+            group = cfg.gitUser;
           };
 
-          users.groups.git = {};
+          users.groups.${cfg.gitUser} = {};
 
           services.openssh = {
             enable = true;
             extraConfig = ''
-              Match User git
+              Match User ${cfg.gitUser}
                   AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper
                   AuthorizedKeysCommandUser nobody
             '';
···
               #!${pkgs.stdenv.shell}
               ${self.packages.${pkgs.system}.keyfetch}/bin/keyfetch \
                 -repoguard-path ${self.packages.${pkgs.system}.repoguard}/bin/repoguard \
+                -internal-api "http://${cfg.server.internalListenAddr}" \
+                -git-dir "${cfg.repo.scanPath}" \
                 -log-path /tmp/repoguard.log
             '';
           };
···
             after = ["network.target" "sshd.service"];
             wantedBy = ["multi-user.target"];
             serviceConfig = {
-              User = "git";
-              WorkingDirectory = "/home/git";
+              User = cfg.gitUser;
+              WorkingDirectory = cfg.stateDir;
               Environment = [
-                "KNOT_REPO_SCAN_PATH=${config.services.tangled-knotserver.repo.scanPath}"
-                "APPVIEW_ENDPOINT=${config.services.tangled-knotserver.appviewEndpoint}"
-                "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${config.services.tangled-knotserver.server.internalListenAddr}"
-                "KNOT_SERVER_LISTEN_ADDR=${config.services.tangled-knotserver.server.listenAddr}"
-                "KNOT_SERVER_HOSTNAME=${config.services.tangled-knotserver.server.hostname}"
+                "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"
+                "KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}"
+                "APPVIEW_ENDPOINT=${cfg.appviewEndpoint}"
+                "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}"
+                "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}"
+                "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}"
+                "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}"
               ];
-              EnvironmentFile = config.services.tangled-knotserver.server.secretFile;
+              EnvironmentFile = cfg.server.secretFile;
               ExecStart = "${self.packages.${pkgs.system}.knotserver}/bin/knotserver";
               Restart = "always";
             };
           };
 
-          networking.firewall.allowedTCPPorts = [22];
+          networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22];
         };
       };