knot2: knot rewrite for PoC

- no internal server (use yaml config file instead)
- doesn't support most of the xrpc endpoints used by appview
those aren't necessary when appview has local sync anyways
- testing 'knot as a service' idea

Signed-off-by: Seongmin Lee <[e-mail]>

cmd/knot/main.go

···
 	"os"
 
 	"github.com/urfave/cli/v3"
-	"tangled.org/core/guard"
-	"tangled.org/core/hook"
-	"tangled.org/core/keyfetch"
-	"tangled.org/core/knotserver"
+	"tangled.org/core/knot2/guard"
+	"tangled.org/core/knot2/hook"
+	"tangled.org/core/knot2/keys"
+	"tangled.org/core/knot2/server"
 	tlog "tangled.org/core/log"
 )
 
···
 		Usage: "knot administration and operation tool",
 		Commands: []*cli.Command{
 			guard.Command(),
-			knotserver.Command(),
-			keyfetch.Command(),
+			server.Command(),
+			keys.Command(),
 			hook.Command(),
 		},
 	}

go.mod

···
 	github.com/cloudflare/cloudflare-go v0.115.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/dgraph-io/ristretto v0.2.0
+	github.com/did-method-plc/go-didplc v0.0.0-20250716171643-635da8b4e038
 	github.com/docker/docker v28.2.2+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/gliderlabs/ssh v0.3.8

go.sum

···
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/did-method-plc/go-didplc v0.0.0-20250716171643-635da8b4e038 h1:AGh+Vn9fXhf9eo8erG1CK4+LACduPo64P1OICQLDv88=
+github.com/did-method-plc/go-didplc v0.0.0-20250716171643-635da8b4e038/go.mod h1:ddIXqTTSXWtj5kMsHAPj8SvbIx2GZdAkBFgFa6e6+CM=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=

knot2/config/config.go

···
+package config
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/sethvargo/go-envconfig"
+	"gopkg.in/yaml.v3"
+)
+
+type Config struct {
+	Dev               bool       `yaml:"dev"`
+	HostName          string     `yaml:"hostname"`
+	OwnerDid          syntax.DID `yaml:"owner_did"`
+	ListenHost        string     `yaml:"listen_host"`
+	ListenPort        string     `yaml:"listen_port"`
+	DataDir           string     `yaml:"data_dir"`
+	RepoDir           string     `yaml:"repo_dir"`
+	PlcUrl            string     `yaml:"plc_url"`
+	JetstreamEndpoint string     `yaml:"jetstream_endpoint"`
+	AppviewEndpoint   string     `yaml:"appview_endpoint"`
+	GitUserName       string     `yaml:"git_user_name"`
+	GitUserEmail      string     `yaml:"git_user_email"`
+	OAuth             OAuthConfig
+}
+
+type OAuthConfig struct {
+	CookieSecret string `env:"KNOT2_COOKIE_SECRET, default=00000000000000000000000000000000"`
+	ClientSecret string `env:"KNOT2_OAUTH_CLIENT_SECRET"`
+	ClientKid    string `env:"KNOT2_OAUTH_CLIENT_KID"`
+}
+
+func (c *Config) Uri() string {
+	// TODO: make port configurable
+	if c.Dev {
+		return "http://127.0.0.1:6444"
+	}
+	return "https://" + c.HostName
+}
+
+func (c *Config) ListenAddr() string {
+	return net.JoinHostPort(c.ListenHost, c.ListenPort)
+}
+
+func (c *Config) DbPath() string {
+	return path.Join(c.DataDir, "knot.db")
+}
+
+func (c *Config) GitMotdFilePath() string {
+	return path.Join(c.DataDir, "motd")
+}
+
+func (c *Config) Validate() error {
+	if c.HostName == "" {
+		return fmt.Errorf("knot hostname cannot be empty")
+	}
+	if c.OwnerDid == "" {
+		return fmt.Errorf("knot owner did cannot be empty")
+	}
+	return nil
+}
+
+func Load(ctx context.Context, path string) (Config, error) {
+	// NOTE: yaml.v3 package doesn't support "default" struct tag
+	cfg := Config{
+		Dev:               true,
+		ListenHost:        "0.0.0.0",
+		ListenPort:        "5555",
+		DataDir:           "/home/git",
+		RepoDir:           "/home/git",
+		PlcUrl:            "https://plc.directory",
+		JetstreamEndpoint: "wss://jetstream1.us-west.bsky.network/subscribe",
+		AppviewEndpoint:   "https://tangled.org",
+		GitUserName:       "Tangled",
+		GitUserEmail:      "[e-mail]",
+	}
+	// load config from env vars
+	err := envconfig.Process(ctx, &cfg.OAuth)
+	if err != nil {
+		return cfg, err
+	}
+
+	// load config from toml config file
+	bytes, err := os.ReadFile(path)
+	if err != nil {
+		return cfg, err
+	}
+	if err := yaml.Unmarshal(bytes, &cfg); err != nil {
+		return cfg, err
+	}
+
+	// validate the config
+	if err = cfg.Validate(); err != nil {
+		return cfg, err
+	}
+	return cfg, nil
+}

knot2/db/db.go

···
+package db
+
+import (
+	"database/sql"
+	"strings"
+
+	_ "github.com/mattn/go-sqlite3"
+)
+
+func New(dbPath string) (*sql.DB, error) {
+	// https://github.com/mattn/go-sqlite3#connection-string
+	opts := []string{
+		"_foreign_keys=1",
+		"_journal_mode=WAL",
+		"_synchronous=NORMAL",
+		"_auto_vacuum=incremental",
+	}
+
+	return sql.Open("sqlite3", dbPath+"?"+strings.Join(opts, "&"))
+}
+
+func Init(d *sql.DB) error {
+	_, err := d.Exec(`
+		create table if not exists _jetstream (
+			id integer primary key autoincrement,
+			last_time_us integer not null
+		);
+
+		create table if not exists events (
+			rkey text not null,
+			nsid text not null,
+			event text not null, -- json
+			created integer not null -- unix nanos
+		);
+
+		create table if not exists users (
+			id integer primary key autoincrement,
+			did text not null unique,
+			created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+		);
+
+		create table if not exists public_keys (
+			id integer primary key autoincrement,
+			did text not null,
+			key text not null,
+			created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),
+			unique(did, key)
+		);
+	`)
+
+	return err
+}

knot2/db/pubkeys.go

···
+package db
+
+import (
+	"database/sql"
+)
+
+// GetPubkeyDidListMap returns a PubKey->[]DID map
+func GetPubkeyDidListMap(d *sql.DB) (map[string][]string, error) {
+	return nil, nil
+}

knot2/db/users.go

···
+package db
+
+import (
+	"database/sql"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+func AddUser(tx *sql.Tx, did syntax.DID) error {
+	_, err := tx.Exec(`insert into users (did) values (?)`, did)
+	return err
+}

knot2/guard/guard.go

···
+package guard
+
+import (
+	"context"
+
+	"github.com/urfave/cli/v3"
+	"tangled.org/core/log"
+)
+
+func Command() *cli.Command {
+	return &cli.Command{
+		Name:   "guard",
+		Usage:  "role-based access control for git over ssh (not for manual use)",
+		Action: Run,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "user",
+				Usage:    "allowed git user",
+				Required: true,
+			},
+		},
+	}
+}
+
+func Run(ctx context.Context, cmd *cli.Command) error {
+	l := log.FromContext(ctx)
+	l = log.SubLogger(l, cmd.Name)
+	ctx = log.IntoContext(ctx, l)
+
+	panic("unimplemented")
+}

knot2/hook/hook.go

···
+package hook
+
+import (
+	"context"
+
+	"github.com/urfave/cli/v3"
+	"tangled.org/core/log"
+)
+
+func Command() *cli.Command {
+	return &cli.Command{
+		Name:  "hook",
+		Usage: "run git hooks",
+		Action: Run,
+		Flags: []cli.Flag{
+			// TODO:
+		},
+	}
+}
+
+func Run(ctx context.Context, cmd *cli.Command) error {
+	l := log.FromContext(ctx)
+	l = log.SubLogger(l, cmd.Name)
+	ctx = log.IntoContext(ctx, l)
+
+	panic("unimplemented")
+}

knot2/keys/keys.go

···
+package keys
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/urfave/cli/v3"
+	"tangled.org/core/knot2/config"
+	"tangled.org/core/knot2/db"
+	"tangled.org/core/log"
+)
+
+func Command() *cli.Command {
+	return &cli.Command{
+		Name:   "keys",
+		Usage:  "fetch public keys from the knot server",
+		Action: Run,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "config",
+				Aliases:  []string{"c"},
+				Usage:    "config path",
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:    "output",
+				Aliases: []string{"o"},
+				Usage:   "output format (table, json, authorized-keys)",
+				Value:   "table",
+			},
+		},
+	}
+}
+
+func Run(ctx context.Context, cmd *cli.Command) error {
+	l := log.FromContext(ctx)
+	l = log.SubLogger(l, cmd.Name)
+	ctx = log.IntoContext(ctx, l)
+
+	var (
+		output     = cmd.String("output")
+		configPath = cmd.String("config")
+	)
+
+	cfg, err := config.Load(ctx, configPath)
+	if err != nil {
+		return fmt.Errorf("failed to load config: %w", err)
+	}
+
+	d, err := db.New(cfg.DbPath())
+	if err != nil {
+		return fmt.Errorf("failed to load db: %w", err)
+	}
+
+	pubkeyDidListMap, err := db.GetPubkeyDidListMap(d)
+	if err != nil {
+		return err
+	}
+
+	switch output {
+	case "json":
+		prettyJSON, err := json.MarshalIndent(pubkeyDidListMap, "", "    ")
+		if err != nil {
+			return err
+		}
+		if _, err := os.Stdout.Write(prettyJSON); err != nil {
+			return err
+		}
+	case "table":
+		fmt.Printf("%-40s %-40s\n", "KEY", "DID")
+		fmt.Println(strings.Repeat("-", 80))
+
+		for key, didList := range pubkeyDidListMap {
+			fmt.Printf("%-40s %-40s\n", key, strings.Join(didList, ","))
+		}
+	case "authorized-keys":
+		for key, didList := range pubkeyDidListMap {
+			executablePath, err := os.Executable()
+			if err != nil {
+				l.Error("error getting path of executable", "error", err)
+				return err
+			}
+			command := fmt.Sprintf("%s guard", executablePath)
+			for _, did := range didList {
+				command += fmt.Sprintf(" -user %s", did)
+			}
+			fmt.Printf(
+				`command="%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty %s`+"\n",
+				command,
+				key,
+			)
+		}
+		if err != nil {
+			l.Error("error writing to stdout", "error", err)
+			return err
+		}
+	}
+
+	return nil
+}

knot2/models/pubkeys.go

···
+package models
+
+import "tangled.org/core/api/tangled"
+
+type PublicKey struct {
+	Did string
+	tangled.PublicKey
+}

knot2/server/handler/events.go

···
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+}
+
+func Events() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		panic("unimplemented")
+	}
+}

knot2/server/handler/git_receive_pack.go

···
+package handler
+
+import "net/http"
+
+func GitReceivePack() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		panic("unimplemented")
+	}
+}

knot2/server/handler/git_upload_pack.go

···
+package handler
+
+import "net/http"
+
+func GitUploadPack() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		panic("unimplemented")
+	}
+}

knot2/server/handler/info_refs.go

···
+package handler
+
+import "net/http"
+
+func InfoRefs() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		panic("unimplemented")
+	}
+}

knot2/server/handler/register.go

···
+package handler
+
+import (
+	"context"
+	"database/sql"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"net/http"
+	"strings"
+
+	"github.com/bluesky-social/indigo/api/agnostic"
+	"github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/did-method-plc/go-didplc"
+	"github.com/gorilla/sessions"
+	"tangled.org/core/knot2/config"
+	"tangled.org/core/knot2/db"
+	"tangled.org/core/log"
+)
+
+const (
+	// atproto
+	serviceId   = "tangled_knot"
+	serviceType = "TangledKnot"
+	// cookies
+	sessionName = "oauth-demo"
+	sessionId   = "sessionId"
+	sessionDid  = "sessionDID"
+)
+
+//go:embed "templates/register.html"
+var tmplRegisgerText string
+var tmplRegister = template.Must(template.New("register.html").Parse(tmplRegisgerText))
+
+func Register(jar *sessions.CookieStore) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		l := log.FromContext(ctx).With("handler", "Register")
+
+		sess, _ := jar.Get(r, sessionName)
+		var data map[string]any
+
+		if !sess.IsNew {
+			// render Register { Handle, Web: true }
+			did := syntax.DID(sess.Values[sessionDid].(string))
+			plcop := did.Method() == "plc" && r.URL.Query().Get("method") != "web"
+			data = map[string]any{
+				"Did":   did,
+				"PlcOp": plcop,
+			}
+		}
+
+		err := tmplRegister.Execute(w, data)
+		if err != nil {
+			l.Error("failed to render", "err", err)
+		}
+	}
+}
+
+func OauthClientMetadata(cfg *config.Config, clientApp *oauth.ClientApp) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		doc := clientApp.Config.ClientMetadata()
+		var (
+			clientName = cfg.HostName
+			clientUri  = cfg.Uri()
+			jwksUri    = clientUri + "/oauth/jwks.json"
+		)
+		doc.ClientName = &clientName
+		doc.ClientURI = &clientUri
+		doc.JWKSURI = &jwksUri
+
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(doc); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}
+}
+
+func OauthJwks(clientApp *oauth.ClientApp) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		body := clientApp.Config.PublicJWKS()
+		if err := json.NewEncoder(w).Encode(body); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}
+}
+
+func OauthLoginPost(clientApp *oauth.ClientApp) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		l := log.FromContext(ctx).With("handler", "OauthLoginPost")
+
+		handle := r.FormValue("handle")
+
+		handle = strings.TrimPrefix(handle, "\u202a")
+		handle = strings.TrimSuffix(handle, "\u202c")
+		// `@` is harmless
+		handle = strings.TrimPrefix(handle, "@")
+
+		redirectURL, err := clientApp.StartAuthFlow(ctx, handle)
+		if err != nil {
+			l.Error("failed to start auth flow", "err", err)
+			panic(err)
+		}
+
+		w.Header().Set("HX-Redirect", redirectURL)
+		w.WriteHeader(http.StatusOK)
+	}
+}
+
+func OauthCallback(oauth *oauth.ClientApp, jar *sessions.CookieStore) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		l := log.FromContext(ctx).With("handler", "OauthCallback")
+
+		data, err := oauth.ProcessCallback(ctx, r.URL.Query())
+		if err != nil {
+			l.Error("failed to process oauth callback", "err", err)
+			panic(err)
+		}
+
+		// store session data to cookie jar
+		sess, _ := jar.Get(r, sessionName)
+		sess.Values[sessionDid] = data.AccountDID.String()
+		sess.Values[sessionId] = data.SessionID
+		if err = sess.Save(r, w); err != nil {
+			l.Error("failed to save session", "err", err)
+			panic(err)
+		}
+
+		if data.AccountDID.Method() == "plc" {
+			sess, err := oauth.ResumeSession(ctx, data.AccountDID, data.SessionID)
+			if err != nil {
+				l.Error("failed to resume atproto session", "err", err)
+				panic(err)
+			}
+			client := sess.APIClient()
+			err = atproto.IdentityRequestPlcOperationSignature(ctx, client)
+			if err != nil {
+				l.Error("failed to request plc operation signature", "err", err)
+				panic(err)
+			}
+		}
+
+		http.Redirect(w, r, "/register", http.StatusSeeOther)
+	}
+}
+
+func RegisterPost(cfg *config.Config, d *sql.DB, clientApp *oauth.ClientApp, jar *sessions.CookieStore) http.HandlerFunc {
+	plcop := func(ctx context.Context, did syntax.DID, sessId, token string) error {
+		sess, err := clientApp.ResumeSession(ctx, did, sessId)
+		if err != nil {
+			return fmt.Errorf("failed to resume atproto session: %w", err)
+		}
+		client := sess.APIClient()
+
+		identity, err := clientApp.Dir.LookupDID(ctx, did)
+		services := make(map[string]didplc.OpService)
+		for id, service := range identity.Services {
+			services[id] = didplc.OpService{
+				Type:     service.Type,
+				Endpoint: service.URL,
+			}
+		}
+		services[serviceId] = didplc.OpService{
+			Type:     serviceType,
+			Endpoint: cfg.Uri(),
+		}
+
+		rawServices, err := json.Marshal(services)
+		if err != nil {
+			return fmt.Errorf("failed to marshal services map: %w", err)
+		}
+		raw := json.RawMessage(rawServices)
+
+		signed, err := agnostic.IdentitySignPlcOperation(ctx, client, &agnostic.IdentitySignPlcOperation_Input{
+			Services: &raw,
+			Token:    &token,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to sign plc operatino: %w", err)
+		}
+
+		err = agnostic.IdentitySubmitPlcOperation(ctx, client, &agnostic.IdentitySubmitPlcOperation_Input{
+			Operation: signed.Operation,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to submit plc operatino: %w", err)
+		}
+
+		return nil
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		l := log.FromContext(ctx).With("handler", "RegisterPost")
+
+		sess, _ := jar.Get(r, sessionName)
+
+		var (
+			did     = syntax.DID(sess.Values[sessionDid].(string))
+			sessId  = sess.Values[sessionId].(string)
+			token   = r.FormValue("token")
+			doPlcOp = r.FormValue("plcop") == "on"
+		)
+
+		tx, err := d.BeginTx(ctx, nil)
+		if err != nil {
+			l.Error("failed to begin db tx", "err", err)
+			panic(err)
+		}
+		defer tx.Rollback()
+
+		if err := db.AddUser(tx, did); err != nil {
+			l.Error("failed to add user", "err", err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		if doPlcOp {
+			l.Debug("performing plc op", "did", did, "token", token)
+			if err := plcop(ctx, did, sessId, token); err != nil {
+				l.Error("failed to perform plc op", "err", err)
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+			}
+		} else {
+			// TODO: check if did doc already include the knot service
+			tx.Rollback()
+			panic("unimplemented")
+		}
+		if err := tx.Commit(); err != nil {
+			l.Error("failed to commit tx", "err", err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+	}
+}

knot2/server/handler/templates/register.html

···
+<!doctype html>
+<html lang="en" class="dark:bg-gray-900">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+    <meta name="description" content="knot server"/>
+    <title>Register to Knot</title>
+    <script src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.8/dist/htmx.min.js" integrity="sha384-/TgkGk7p307TH7EXJDuUlgG3Ce1UVolAOFopFekQkkXihi5u/6OCvVKyz1W+idaz" crossorigin="anonymous"></script>
+  </head>
+  <body>
+    {{ if (not .) }}
+      {{/* step 1. login */}}
+      <form hx-post="/oauth/login" hx-swap="none">
+        <input type="text" name="handle">
+        <button type="submit">Login</button>
+      </form>
+    {{ else }}
+      {{/* step 2. register user with plc operation */}}
+      <form hx-post="/register" hx-swap="none">
+        <input type="hidden" name="plcop" value="{{ if .PlcOp }}on{{ end }}">
+
+        <div>
+          <label for="handle">User Handle:</label>
+          <input type="text" name="handle" value="{{ .Did }}" readonly>
+        </div>
+
+        {{ if (not .Web) }}
+          <h2>Please enter your PLC Token you received in an email</h2>
+          <div>
+            <label for="token">PLC Token:</label>
+            <input type="text" name="token" required placeholder="XXXXX-XXXXX">
+          </div>
+
+          <button type="submit">add Knot to identity</button>
+        {{ else }}
+          <button type="submit">register to Knot</button>
+        {{ end }}
+      </form>
+    {{ end }}
+  </body>
+</html>

knot2/server/middleware/cors.go

···
+package middleware
+
+import "net/http"
+
+func CORS(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Set CORS headers
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		w.Header().Set("Access-Control-Max-Age", "86400")
+
+		// Handle preflight requests
+		if r.Method == "OPTIONS" {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}

knot2/server/middleware/requestlogger.go

···
+package middleware
+
+import (
+	"log/slog"
+	"net/http"
+	"time"
+
+	"tangled.org/core/log"
+)
+
+func RequestLogger(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		l := log.FromContext(ctx)
+
+		start := time.Now()
+
+		next.ServeHTTP(w, r)
+
+		// Build query params as slog.Attrs for the group
+		queryParams := r.URL.Query()
+		queryAttrs := make([]any, 0, len(queryParams))
+		for key, values := range queryParams {
+			if len(values) == 1 {
+				queryAttrs = append(queryAttrs, slog.String(key, values[0]))
+			} else {
+				queryAttrs = append(queryAttrs, slog.Any(key, values))
+			}
+		}
+
+		l.LogAttrs(ctx, slog.LevelInfo, "",
+			slog.Group("request",
+				slog.String("method", r.Method),
+				slog.String("path", r.URL.Path),
+				slog.Group("query", queryAttrs...),
+				slog.Duration("duration", time.Since(start)),
+			),
+		)
+	})
+}

knot2/server/oauth.go

···
+package server
+
+import (
+	"net/http"
+
+	atcrypto "github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"tangled.org/core/idresolver"
+	"tangled.org/core/knot2/config"
+)
+
+func newAtClientApp(cfg *config.Config) *oauth.ClientApp {
+	idResolver := idresolver.DefaultResolver(cfg.PlcUrl)
+	scopes := []string{"atproto", "identity:*"}
+	var oauthConfig oauth.ClientConfig
+	if cfg.Dev {
+		oauthConfig = oauth.NewLocalhostConfig(
+			cfg.Uri()+"/oauth/callback",
+			scopes,
+		)
+	} else {
+		oauthConfig = oauth.NewPublicConfig(
+			cfg.Uri()+"/oauth/client-metadata.json",
+			cfg.Uri()+"/oauth/callback",
+			scopes,
+		)
+	}
+	priv, err := atcrypto.ParsePrivateMultibase(cfg.OAuth.ClientSecret)
+	if err != nil {
+		panic(err)
+	}
+	if err := oauthConfig.SetClientSecret(priv, cfg.OAuth.ClientKid); err != nil {
+		panic(err)
+	}
+	// we can just use in-memory auth store
+	clientApp := oauth.NewClientApp(&oauthConfig, oauth.NewMemStore())
+	clientApp.Dir = idResolver.Directory()
+	clientApp.Resolver.Client.Transport = http.DefaultTransport
+	return clientApp
+}

knot2/server/routes.go

···
+package server
+
+import (
+	"database/sql"
+	"net/http"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/go-chi/chi/v5"
+	"github.com/gorilla/sessions"
+	"tangled.org/core/knot2/config"
+	"tangled.org/core/knot2/server/handler"
+	"tangled.org/core/knot2/server/middleware"
+)
+
+func Routes(
+	cfg *config.Config,
+	d *sql.DB,
+	clientApp *oauth.ClientApp,
+) http.Handler {
+	r := chi.NewRouter()
+
+	r.Use(middleware.CORS)
+	r.Use(middleware.RequestLogger)
+
+	r.Get("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("This is a knot server. More info at https://tangled.sh"))
+	})
+
+	jar := sessions.NewCookieStore([]byte(cfg.OAuth.CookieSecret))
+
+	r.Get("/register", handler.Register(jar))
+	r.Post("/register", handler.RegisterPost(cfg, d, clientApp, jar))
+	r.Post("/oauth/login", handler.OauthLoginPost(clientApp))
+	r.Get("/oauth/client-metadata.json", handler.OauthClientMetadata(cfg, clientApp))
+	r.Get("/oauth/jwks.json", handler.OauthJwks(clientApp))
+	r.Get("/oauth/callback", handler.OauthCallback(clientApp, jar))
+
+	r.Route("/{did}/{name}", func(r chi.Router) {
+		r.Get("/info/refs", handler.InfoRefs())
+		r.Post("/git-upload-pack", handler.GitUploadPack())
+		r.Post("/git-receive-pack", handler.GitReceivePack())
+	})
+
+	r.Get("/events", handler.Events())
+
+	// r.Route("/xrpc", func(r chi.Router) {
+	// 	r.Post("/"+tangled.GitKeepRefNSID, handler.GitKeepRef())
+	// })
+
+	return r
+}

knot2/server/server.go

···
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/urfave/cli/v3"
+	"tangled.org/core/knot2/config"
+	"tangled.org/core/knot2/db"
+	"tangled.org/core/log"
+)
+
+func Command() *cli.Command {
+	return &cli.Command{
+		Name:   "server",
+		Usage:  "run a knot server",
+		Action: Run,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "config",
+				Aliases:  []string{"c"},
+				Usage:    "config path",
+				Required: true,
+			},
+		},
+	}
+}
+
+func Run(ctx context.Context, cmd *cli.Command) error {
+	l := log.FromContext(ctx)
+	l = log.SubLogger(l, cmd.Name)
+	ctx = log.IntoContext(ctx, l)
+
+	configPath := cmd.String("config")
+
+	cfg, err := config.Load(ctx, configPath)
+	if err != nil {
+		return fmt.Errorf("failed to load config: %w", err)
+	}
+	fmt.Println("config:", cfg)
+
+	// TODO: start listening to jetstream
+
+	d, err := db.New(cfg.DbPath())
+	if err != nil {
+		panic(err)
+	}
+	err = db.Init(d)
+	if err != nil {
+		panic(err)
+	}
+
+	clientApp := newAtClientApp(&cfg)
+
+	mux := Routes(&cfg, d, clientApp)
+
+	l.Info("starting knot server", "address", cfg.ListenAddr())
+	err = http.ListenAndServe(cfg.ListenAddr(), mux)
+	if err != nil {
+		l.Error("server error", "err", err)
+	}
+
+	return nil
+}

nix/gomod2nix.toml

···
   [mod."github.com/dgryski/go-rendezvous"]
     version = "v0.0.0-20200823014737-9f7001d12a5f"
     hash = "sha256-n/7xo5CQqo4yLaWMSzSN1Muk/oqK6O5dgDOFWapeDUI="
+  [mod."github.com/did-method-plc/go-didplc"]
+    version = "v0.0.0-20250716171643-635da8b4e038"
+    hash = "sha256-o0uB/5tryjdB44ssALFr49PtfY3nRJnEENmE187md1w="
   [mod."github.com/distribution/reference"]
     version = "v0.6.0"
     hash = "sha256-gr4tL+qz4jKyAtl8LINcxMSanztdt+pybj1T+2ulQv4="

nix/modules/knot.nix

···
             description = "Enable development mode (disables signature verification)";
           };
         };
+
+        environmentFile = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          example = "/etc/appview.env";
+          description = ''
+            Additional environment file as defined in {manpage}`systemd.exec(5)`.
+
+            Sensitive secrets such as {env}`KNOT_COOKIE_SECRET`,
+            {env}`KNOT_OAUTH_CLIENT_SECRET`, and {env}`KNOT_OAUTH_CLIENT_KID`
+            may be passed to the service without making them world readable in the nix store.
+          '';
+        };
       };
     };
 
···
         text = ''
           #!${pkgs.stdenv.shell}
           ${cfg.package}/bin/knot keys \
-            -output authorized-keys \
-            -internal-api "http://${cfg.server.internalListenAddr}" \
-            -git-dir "${cfg.repo.scanPath}" \
-            -log-path /tmp/knotguard.log
+            -config ${cfg.stateDir}/config.yml \
+            -output authorized-keys
         '';
       };
 
···
               else "false"
             }"
           ];
-          ExecStart = "${cfg.package}/bin/knot server";
+          EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+          ExecStart = "${cfg.package}/bin/knot server -config ${cfg.stateDir}/config.yml";
           Restart = "always";
+          RestartSec = 5;
         };
       };
 

nix/vm.nix

···
             jetstreamEndpoint = jetstream;
             listenAddr = "0.0.0.0:6444";
           };
+          environmentFile = "${config.services.tangled.knot.stateDir}/.env";
         };
         services.tangled.spindle = {
           enable = true;