From 4583820c4de01dac83887a245e8404de23c79727 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 01:25:09 +0100 Subject: [PATCH 1/6] nixos/pocket-id: reword option descriptions and warnings, fix links --- nixos/modules/services/security/pocket-id.nix | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 728756c0d77e..621f7634e144 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -44,10 +44,11 @@ in environmentFile = mkOption { type = path; description = '' - Path to an environment file loaded for the Pocket ID service. - + Path to an environment file to be loaded. This can be used to securely store tokens and secrets outside of the world-readable Nix store. + See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables). + Example contents of the file: MAXMIND_LICENSE_KEY=your-license-key ''; @@ -81,7 +82,7 @@ in description = '' Whether to disable analytics. - See [docs page](https://pocket-id.org/docs/configuration/analytics/). + See the [analytics documentation](https://pocket-id.org/docs/configuration/analytics/). ''; default = false; }; @@ -91,9 +92,9 @@ in default = { }; description = '' - Environment variables that will be passed to Pocket ID, see - [configuration options](https://pocket-id.org/docs/configuration/environment-variables) - for supported values. + Environment variables to be passed. + + See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables). ''; }; @@ -101,7 +102,7 @@ in type = path; default = "/var/lib/pocket-id"; description = '' - The directory where Pocket ID will store its data, such as the database. + The directory where Pocket ID will store its data, such as the database when using SQLite. ''; }; @@ -121,15 +122,15 @@ in config = mkIf cfg.enable { warnings = optional (cfg.settings ? MAXMIND_LICENSE_KEY) - "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead." + "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.environmentFile` instead." ++ concatMap ( # Added 2025-05-27 setting: optional (cfg.settings ? "${setting}") '' - config.services.pocket-id.settings.${setting} is deprecated. - See https://pocket-id.org/docs/setup/migrate-to-v1/ for migration instructions. + `services.pocket-id.settings.${setting}` is deprecated. + See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1). '' ) [ From e2effbddbdd3e335808807d5f1a2e0eb1108e3b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 01:07:59 +0100 Subject: [PATCH 2/6] nixos/pocket-id: add credentials option --- nixos/modules/services/security/pocket-id.nix | 31 +++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 621f7634e144..2b986e9d521b 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -19,6 +19,7 @@ let optionalAttrs ; inherit (lib.types) + attrsOf bool path str @@ -29,6 +30,10 @@ let format = pkgs.formats.keyValue { }; settingsFile = format.generate "pocket-id-env-vars" cfg.settings; + + exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"''; + exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars); + getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials; in { meta.maintainers = with maintainers; [ @@ -51,11 +56,29 @@ in Example contents of the file: MAXMIND_LICENSE_KEY=your-license-key + + Alternatively you can use `services.pocket-id.credentials` to define each variable in separate files. ''; default = "/dev/null"; example = "/var/lib/secrets/pocket-id"; }; + credentials = mkOption { + type = attrsOf path; + default = { }; + example = { + ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key"; + }; + description = '' + Environment variables which are loaded from the contents of the specified file paths. + This can be used to securely store tokens and secrets outside of the world-readable Nix store. + + See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables). + + Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file. + ''; + }; + settings = mkOption { type = submodule { freeformType = format.type; @@ -122,7 +145,7 @@ in config = mkIf cfg.enable { warnings = optional (cfg.settings ? MAXMIND_LICENSE_KEY) - "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.environmentFile` instead." + "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.MAXMIND_LICENSE_KEY` or `services.pocket-id.environmentFile` instead." ++ concatMap ( @@ -164,12 +187,16 @@ in User = cfg.user; Group = cfg.group; WorkingDirectory = cfg.dataDir; - ExecStart = getExe cfg.package; + ExecStart = pkgs.writeShellScript "pocket-id-start" '' + ${exportAllCredentials cfg.credentials} + ${getExe cfg.package} + ''; Restart = "always"; EnvironmentFile = [ cfg.environmentFile settingsFile ]; + LoadCredential = getLoadCredentialList; # Hardening AmbientCapabilities = ""; From eff07668add9ef2cad569d04231000f2c57b34a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 12:30:27 +0100 Subject: [PATCH 3/6] nixos/pocket-id: add warnings for all currently known secrets --- nixos/modules/services/security/pocket-id.nix | 56 +++++++++++-------- 1 file changed, 34 insertions(+), 22 deletions(-) diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 2b986e9d521b..3f1ca7453407 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -144,28 +144,40 @@ in config = mkIf cfg.enable { warnings = - optional (cfg.settings ? MAXMIND_LICENSE_KEY) - "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.MAXMIND_LICENSE_KEY` or `services.pocket-id.environmentFile` instead." - ++ - concatMap - ( - # Added 2025-05-27 - setting: - optional (cfg.settings ? "${setting}") '' - `services.pocket-id.settings.${setting}` is deprecated. - See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1). - '' - ) - [ - "PUBLIC_APP_URL" - "PUBLIC_UI_CONFIG_DISABLED" - "CADDY_DISABLED" - "CADDY_PORT" - "BACKEND_PORT" - "POSTGRES_CONNECTION_STRING" - "SQLITE_DB_PATH" - "INTERNAL_BACKEND_URL" - ]; + (concatMap + ( + setting: + optional (cfg.settings ? "${setting}") '' + `services.pocket-id.settings.${setting}` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.${setting}` or `services.pocket-id.environmentFile` instead. + '' + ) + [ + "ENCRYPTION_KEY" + "MAXMIND_LICENSE_KEY" + "SMTP_PASSWORD" + "LDAP_BIND_PASSWORD" + ] + ) + ++ (concatMap + ( + # Added 2025-05-27 + setting: + optional (cfg.settings ? "${setting}") '' + `services.pocket-id.settings.${setting}` is deprecated. + See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1). + '' + ) + [ + "PUBLIC_APP_URL" + "PUBLIC_UI_CONFIG_DISABLED" + "CADDY_DISABLED" + "CADDY_PORT" + "BACKEND_PORT" + "POSTGRES_CONNECTION_STRING" + "SQLITE_DB_PATH" + "INTERNAL_BACKEND_URL" + ] + ); systemd.tmpfiles.rules = [ "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}" From c3c16e4b0fc4e72e96cae2cb29c10697514ade24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 01:09:16 +0100 Subject: [PATCH 4/6] nixos/pocket-id: set ENCRYPTION_KEY in test This variable will be required in version 2. --- nixos/tests/pocket-id.nix | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix index 7f2a4a8255f8..bbef7e3c6dcf 100644 --- a/nixos/tests/pocket-id.nix +++ b/nixos/tests/pocket-id.nix @@ -1,5 +1,9 @@ -{ lib, ... }: +{ pkgs, lib, ... }: +let + # !!! Don't do this with real keys. The /nix store is world-readable! + ENCRYPTION_KEY = pkgs.writeText "pocket-id-encryption-key" "SUeAyRRFZ1uf03ClOE+o++BVENSE/Ptb9YFRF2Sk+zM="; +in { name = "pocket-id"; meta.maintainers = with lib.maintainers; [ @@ -16,6 +20,9 @@ settings = { PORT = 10001; }; + credentials = { + inherit ENCRYPTION_KEY; + }; }; }; @@ -32,6 +39,9 @@ DB_PROVIDER = "postgres"; DB_CONNECTION_STRING = "host=/run/postgresql user=${username} database=${username}"; }; + credentials = { + inherit ENCRYPTION_KEY; + }; }; services.postgresql = { From a6db2b8ed64017494c14bc122cf5406a319756ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 12:30:46 +0100 Subject: [PATCH 5/6] pocket-id: 1.16.0 -> 2.1.0 The version 2 release contains breaking changes. See https://pocket-id.org/docs/setup/major-releases/migrate-v2. --- doc/release-notes/rl-2605.section.md | 2 ++ nixos/modules/services/security/pocket-id.nix | 16 ++++++++++++++++ nixos/tests/pocket-id.nix | 1 - pkgs/by-name/po/pocket-id/package.nix | 10 +++++----- 4 files changed, 23 insertions(+), 6 deletions(-) diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index 41551208e0c0..c978cd8d338a 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -81,6 +81,8 @@ - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`. - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`. +- `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2). + - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore. diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 3f1ca7453407..08e9f32f7a2e 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -177,6 +177,22 @@ in "SQLITE_DB_PATH" "INTERNAL_BACKEND_URL" ] + ) + ++ (concatMap + ( + # Added 2026-01-08 + setting: + optional (cfg.settings ? "${setting}") '' + `services.pocket-id.settings.${setting}` is deprecated. + See [v2 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v2). + '' + ) + [ + "DB_PROVIDER" + "KEYS_PATH" + "KEYS_STORAGE" + "LDAP_ATTRIBUTE_ADMIN_GROUP" + ] ); systemd.tmpfiles.rules = [ diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix index bbef7e3c6dcf..d79866882c17 100644 --- a/nixos/tests/pocket-id.nix +++ b/nixos/tests/pocket-id.nix @@ -36,7 +36,6 @@ in enable = true; settings = { PORT = 10001; - DB_PROVIDER = "postgres"; DB_CONNECTION_STRING = "host=/run/postgresql user=${username} database=${username}"; }; credentials = { diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix index 79db3ac2f2fe..92c4a2847f47 100644 --- a/pkgs/by-name/po/pocket-id/package.nix +++ b/pkgs/by-name/po/pocket-id/package.nix @@ -12,18 +12,18 @@ }: buildGo125Module (finalAttrs: { pname = "pocket-id"; - version = "1.16.0"; + version = "2.1.0"; src = fetchFromGitHub { owner = "pocket-id"; repo = "pocket-id"; tag = "v${finalAttrs.version}"; - hash = "sha256-2tGd/gl0Pm5b5GfkTsChvZoWov4dwljwqDcitX5NKCY="; + hash = "sha256-tBjo5evQVRG0oembk1VfAfM3M/FJ4zPWV/9vgAWH9Kc="; }; sourceRoot = "${finalAttrs.src.name}/backend"; - vendorHash = "sha256-ttbiuYRWbn8KRZtg499R4NF/E9+B+fOylxZcMwNg69M="; + vendorHash = "sha256-hMhOG/2xnI/adjg8CnA0tRBD8/OFDsTloFXC8iwxlV0="; env.CGO_ENABLED = 0; ldflags = [ @@ -56,8 +56,8 @@ buildGo125Module (finalAttrs: { pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; pnpm = pnpm_10; - fetcherVersion = 1; - hash = "sha256-drXGcUHP7J7keGra7/x1tr9Pfh/wjzmtUE1yAybYXLQ="; + fetcherVersion = 3; + hash = "sha256-jhlHrekVk0sNLwo8LFQY6bgX9Ic0xbczM6UTzmZTnPI="; }; env.BUILD_OUTPUT_PATH = "dist"; From 65aed86b54fab5fc99e34b6162b147ba769c236f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 8 Jan 2026 12:38:01 +0100 Subject: [PATCH 6/6] nixos/pocket-id: convert v1 breaking changes from warnings to asserts --- nixos/modules/services/security/pocket-id.nix | 43 ++++++++++--------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 08e9f32f7a2e..65f9468f7e7e 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -143,6 +143,29 @@ in }; config = mkIf cfg.enable { + assertions = ( + map + ( + # Converted to assert 2026-01-08 + setting: { + assertion = !(cfg.settings ? "${setting}"); + message = '' + `services.pocket-id.settings.${setting}` is deprecated. + See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1). + ''; + }) + [ + "PUBLIC_APP_URL" + "PUBLIC_UI_CONFIG_DISABLED" + "CADDY_DISABLED" + "CADDY_PORT" + "BACKEND_PORT" + "POSTGRES_CONNECTION_STRING" + "SQLITE_DB_PATH" + "INTERNAL_BACKEND_URL" + ] + ); + warnings = (concatMap ( @@ -158,26 +181,6 @@ in "LDAP_BIND_PASSWORD" ] ) - ++ (concatMap - ( - # Added 2025-05-27 - setting: - optional (cfg.settings ? "${setting}") '' - `services.pocket-id.settings.${setting}` is deprecated. - See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1). - '' - ) - [ - "PUBLIC_APP_URL" - "PUBLIC_UI_CONFIG_DISABLED" - "CADDY_DISABLED" - "CADDY_PORT" - "BACKEND_PORT" - "POSTGRES_CONNECTION_STRING" - "SQLITE_DB_PATH" - "INTERNAL_BACKEND_URL" - ] - ) ++ (concatMap ( # Added 2026-01-08