add writable option to services.ttyd

[carstoid]

addresses breaking change in ttyd 1.7.4, where the web terminal is now readonly by default, by providing a new option "writable"

see issue #268501

[atopuzov]

I think this should default to true as we run ${pkgs.shadow}/bin/login to basically allow shell over web. Or just better set to true without an additional parameter.
I ran into this when testing out 23.11 so we should back port this change.

For reference default behavior was changed in ttyd in tsl0922/ttyd@f8efcdd

[06kellyjac]

We could make it writable true for stateVersion 23.05 and earlier but I'd be against purposefully being insecure and out of line with the upstream project for users who have no existing usages to regress/break

[atopuzov]

but I'd be against purposefully being insecure

06kellyjac I don't think this is a secure/insecure thing. Without writeable the service that the service provides makes no sense.
Eg. ttyd service is set to run login

nixpkgs/nixos/modules/services/web-servers/ttyd.nix

Lines 185 to 194 in 47a0bce

	script = if cfg.passwordFile != null then ''
	PASSWORD=$(cat ${escapeShellArg cfg.passwordFile})
	${pkgs.ttyd}/bin/ttyd ${lib.escapeShellArgs args} \
	--credential ${escapeShellArg cfg.username}:"$PASSWORD" \
	${pkgs.shadow}/bin/login
	''
	else ''
	${pkgs.ttyd}/bin/ttyd ${lib.escapeShellArgs args} \
	${pkgs.shadow}/bin/login
	'';

and if it is set to not writeable you can't put in your username/password and log in into the server. Which kind of makes it useless.

[pbsds]

The login entrypoint should be configurable. Some might want to configure this to run htop, or glances, or nvtop, where writeable = false; might makes sense. But until then it would make sense to default to writeable = true;.

[infinisil]

How about making it an error if it's not set, with an explanatory message about this situation

[pbsds]

Suggested change

	type = types.bool;
	default = false;
	type = types.nullOr types.bool;
	default = null;

[pbsds]

and this in the config below

diff --git a/nixos/modules/services/web-servers/ttyd.nix b/nixos/modules/services/web-servers/ttyd.nix
index 3b1d87ccb483..2b652f367efb 100644
--- a/nixos/modules/services/web-servers/ttyd.nix
+++ b/nixos/modules/services/web-servers/ttyd.nix
@@ -165,6 +165,8 @@ in
       [ { assertion = cfg.enableSSL
             -> cfg.certFile != null && cfg.keyFile != null && cfg.caFile != null;
           message = "SSL is enabled for ttyd, but no certFile, keyFile or caFile has been specified."; }
+        { assertion = cfg.writeable != null;
+          message = "services.ttyd.writeable must be set"; }
         { assertion = ! (cfg.interface != null && cfg.socket != null);
           message = "Cannot set both interface and socket for ttyd."; }
         { assertion = (cfg.username != null) == (cfg.passwordFile != null);

[pbsds]

i continue the effort in #285314