Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.
It assumes systemd, which it uses to start sshd. It also restarts a systemd timer to shut sshd down in 5m. Ssh is set up (by defualt on Debian) to have KillMode=process, leaving the client instances alive, just killing the listen server.
I tend to agree with the top post. I've never felt that knock servers really deserve consideration. That said, the way that this knock server is so small, makes use of well known parts of the system as it is (systemd), is so low risk, and built around decent security building blocks (recursively) & not some ad-hoc protocol is kind of interesting and fun. This one is pretty easy to visualize.
This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy.
fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.
Pick a library. https://github.com/Eugeny/russh