fix: compat with latest @tangled.sh/core

changelog.md

···
+# changelog
+
+## 2025-06-23
+
+this update fixes usage with newer `@tangled.sh/core` revisions.
+
+- replaced wrapped packages with just a wrapped keyfetch binary
+- added `cfg.openFirewall` option to automatically open firewall ports (currently ssh only).
+- reject module usage with old `@tangled.sh/core` revisions.
+- (**tests**) also test-run the wrapped `keyfetch` binary

flake.lock

···
         "url": "https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js"
       }
     },
-    "ia-fonts-src": {
+    "htmx-ws-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1686932517,
-        "narHash": "sha256-2T165nFfCzO65/PIHauJA//S+zug5nUwPcg8NUEydfc=",
-        "owner": "iaolo",
-        "repo": "iA-Fonts",
-        "rev": "f32c04c3058a75d7ce28919ce70fe8800817491b",
-        "type": "github"
+        "narHash": "sha256-XbUFiv94ZPB6VVULoTWOsje5Gq1I+IT72lMc4CpUYrY=",
+        "type": "file",
+        "url": "https://unpkg.com/htmx.org@2.0.4/dist/ext/ws.js"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://unpkg.com/htmx.org@2.0.4/dist/ext/ws.js"
+      }
+    },
+    "ibm-plex-mono-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731402384,
+        "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
+        "type": "tarball",
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       },
       "original": {
-        "owner": "iaolo",
-        "repo": "iA-Fonts",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       }
     },
     "indigo": {
       "flake": false,
       "locked": {
-        "lastModified": 1738491661,
-        "narHash": "sha256-+njDigkvjH4XmXZMog5Mp0K4x9mamHX6gSGJCZB9mE4=",
+        "lastModified": 1745333930,
+        "narHash": "sha256-83fIHqDE+dfnZ88HaNuwfKFO+R0RKAM1WxMfNh/Matk=",
         "owner": "oppiliappan",
         "repo": "indigo",
-        "rev": "feb802f02a462ac0a6392ffc3e40b0529f0cdf71",
+        "rev": "e4e59280737b8676611fc077a228d47b3e8e9491",
         "type": "github"
       },
       "original": {
···
         "type": "github"
       }
     },
+    "inter-fonts-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731687360,
+        "narHash": "sha256-5vdKKvHAeZi6igrfpbOdhZlDX2/5+UvzlnCQV6DdqoQ=",
+        "type": "tarball",
+        "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip"
+      }
+    },
     "lucide-src": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-5ipNSxTlQ7627lGgsyZxk7vS1sr9RkrlR8/QMj2Zg6s=",
-        "type": "file",
-        "url": "https://unpkg.com/lucide@0.482.0"
+        "lastModified": 1742302029,
+        "narHash": "sha256-OyPVtpnC4/AAmPq84Wt1r1Gcs48d9KG+UBCtZK87e9k=",
+        "type": "tarball",
+        "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"
       },
       "original": {
-        "type": "file",
-        "url": "https://unpkg.com/lucide@0.482.0"
+        "type": "tarball",
+        "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742069588,
-        "narHash": "sha256-C7jVfohcGzdZRF6DO+ybyG/sqpo1h6bZi9T56sxLy+k=",
+        "lastModified": 1750506804,
+        "narHash": "sha256-VLFNc4egNjovYVxDGyBYTrvVCgDYgENp5bVi9fPTDYc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c80f6a7e10b39afcc1894e02ef785b1ad0b0d7e5",
+        "rev": "4206c4cb56751df534751b058295ea61357bbbaa",
         "type": "github"
       },
       "original": {
···
         "tangledCore": "tangledCore"
       }
     },
+    "sqlite-lib-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1706631843,
+        "narHash": "sha256-bJoMjirsBjm2Qk9KPiy3yV3+8b/POlYe76/FQbciHro=",
+        "type": "tarball",
+        "url": "https://sqlite.org/2024/sqlite-amalgamation-3450100.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://sqlite.org/2024/sqlite-amalgamation-3450100.zip"
+      }
+    },
     "tangledCore": {
       "inputs": {
         "gitignore": "gitignore",
         "htmx-src": "htmx-src",
-        "ia-fonts-src": "ia-fonts-src",
+        "htmx-ws-src": "htmx-ws-src",
+        "ibm-plex-mono-src": "ibm-plex-mono-src",
         "indigo": "indigo",
+        "inter-fonts-src": "inter-fonts-src",
         "lucide-src": "lucide-src",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1742252247,
-        "narHash": "sha256-4P2cyFbmfi4vO+cH5Rs8T0HjyIM9my7DDehMavPQ4ms=",
+        "lastModified": 1750580269,
+        "narHash": "sha256-Y8WCUQYknbPPBN2nKCnL2B7rqFpIJxZ9dGB8ahmPPnA=",
         "ref": "refs/heads/master",
-        "rev": "d27004cb9772260c5a2005fe1f53f1e44884f79e",
-        "revCount": 336,
+        "rev": "fa3beeb9d299bbcf86440e77899773506e654e29",
+        "revCount": 861,
         "type": "git",
         "url": "https://tangled.sh/@tangled.sh/core"
       },

module.nix

···
 let
   inherit (lib)
     mkOption
+    mkEnableOption
     types
     mkIf
     optional
···
   cfg = config.services.tangled-knotserver;
   tangledPkgs = tangledFlake.packages.${pkgs.system};
 
-  wrapped-packages =
+  keyfetch-wrapped =
     pkgs.runCommandCC "tangled-packages-wrapped" { nativeBuildInputs = [ pkgs.makeBinaryWrapper ]; }
       ''
         mkdir -p $out/bin
 
-        makeBinaryWrapper ${lib.getExe' tangledPkgs.repoguard "repoguard"} $out/bin/repoguard \
-          --add-flags -internal-api=http://${cfg.server.internalListenAddr}
-        # other flags are set by keyfetch
-
-        makeBinaryWrapper ${lib.getExe' tangledPkgs.keyfetch "keyfetch"} $out/bin/keyfetch \
-          --add-flags "-repoguard-path=$out/bin/repoguard" \
-          --add-flags "-internal-api=http://${cfg.server.internalListenAddr}" \
-          --add-flags "-git-dir=${cfg.repo.scanPath}" \
-          --add-flags "-log-path=/var/log/knotserver/repoguard.log"
+        makeBinaryWrapper ${lib.getExe' tangledPkgs.knot "knot"} $out/bin/keyfetch \
+          --add-flags "keys" \
+          --append-flags "-output authorized-keys" \
+          --append-flags "-internal-api=http://${cfg.server.internalListenAddr}" \
+          --append-flags "-git-dir=${cfg.repo.scanPath}" \
+          --append-flags "-log-path=/var/log/knotserver/repoguard.log"
       '';
 
 in
···
 
   options = {
     services.tangled-knotserver = {
-      enable = mkOption {
+      enable = mkEnableOption "a tangled knot server";
+
+      openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable a tangled knotserver";
+        description = "Whether to automatically configure the firewall to open necessary ports.";
       };
 
       appviewEndpoint = mkOption {
···
           description = "Git email address for git operations that requires one.";
         };
       };
+
+      # TODO: should a `stateDirectory` option be added?
 
       repo = {
         scanPath = mkOption {
···
       tangled-knotserver: development mode is enabled. This is not recommended in production as signature checks are disabled.
     '';
 
+    assertions = [ 
+      {
+        assertion = tangledPkgs ? knot;
+        message = "tangled-knotserver: your version of tangled flake is not compatible with this version of the knotserver module. please consider updating the pinned @tangled.sh/core version.";
+      }
+    ];
+
     environment.systemPackages = with pkgs; [ git ];
 
     users.users.${cfg.user} = {
+      createHome = true;
       home = cfg.repo.scanPath;
       group = cfg.user;
       isSystemUser = true;
···
       serviceConfig = {
         User = cfg.user;
         WorkingDirectory = cfg.repo.scanPath;
-        ExecStart = lib.getExe' tangledPkgs.knotserver "knotserver";
+        ExecStart = if (tangledPkgs ? knotserver) # compat
+          then lib.getExe' tangledPkgs.knotserver "knotserver"
+          else "${lib.getExe' tangledPkgs.knot "knot"} server";
         Restart = "always";
 
         StateDirectory = mkIf (lib.hasPrefix "/var/lib/tangled-knot" cfg.repo.scanPath) "tangled-knot";
···
     };
 
     services.openssh = {
-      enable = true;
+      enable = true; # required for the module to actually function
       extraConfig = ''
         Match User ${cfg.user}
           AuthorizedKeysCommand ${config.security.wrapperDir}/keyfetch
···
       owner = "root";
       group = config.users.groups.${cfg.user}.name;
       permissions = "u+rx,go+x";
-      source = lib.getExe' wrapped-packages "keyfetch";
+      source = lib.getExe' keyfetch-wrapped "keyfetch";
     };
+
+    # open firewall ports if configured
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22];
   };
 }

readme.md

···
   - logging to `/var/log/knotserver` prevents other users from messing around with repoguard, possibly a dos by just creating `/tmp/repoguard.log`.
   - these changes should not affect usage at all, just implementation details.
 
+## usage
+
+add this flake to your inputs, then import the module to your nixos config.
+
+whilst not required, it is recommended to add the core flake and let the module flake follow that input, since i don't have all day updating this repo.
+
+```nix
+{
+  inputs = {
+    # ...other stuff like nixpkgs
+    tangled.url = "git+https://tangled.sh/@tangled.sh/core";
+    knotserver-module = {
+      url = "git+https://tangled.sh/@soopy.moe/knotserver-module";
+      inputs.tangledCore.follows = "tangled";
+    };
+  };
+
+  outputs = {nixpkgs, knotserver-module, ...}: {
+    nixosConfigurations.saturday = nixpkgs.lib.nixosSystem {
+      modules = [
+        knotserver-module.nixosModules.default
+        ./configuration.nix
+      ];
+    };
+  };
+}
+```
+
+
 ## stability
 
 this module is stable to use.

test.nix

···
     machine.wait_for_unit("knotserver.service")
     machine.wait_for_open_port(5555)
     machine.succeed('curl -f http://127.0.0.1:5555 | grep "This is a knot server"')
+    machine.succeed('/run/wrappers/bin/keyfetch')
   '';
 }