From e633d97804be25fa58ebe7de603241e369724c31 Mon Sep 17 00:00:00 2001
From: Darren Rambaud <225436867+debtquity@users.noreply.github.com>
Date: Sat, 28 Feb 2026 23:09:03 -0600
Subject: [PATCH] ory-hydra: init at 25.4.0

Several components of the Ory identity and access management system
already exist in nixpkgs (oathkeeper, kratos, keto). This is yet another
attempt to get it into nixpkgs as I do plan to write a nixos module that
leverages all of these components (predecessors:#393364 #145747,
both stale)

ory-hydra: impl suggestions

* remove redundant flag in presence of `-s` per
  https://github.com/NixOS/nixpkgs/pull/495436#discussion_r2869645904
  (see: http://tip.golang.org/doc/go1.22#linker)
* update `meta.description` per https://github.com/NixOS/nixpkgs/pull/495436#discussion_r2869646275

ory-hydra: add version check

* upstream has history of changing where buildinfo is stored and allow
  maintainers to update appropriately when this happens

ory-hydra: add `sqlite_omit_load_extension` tag

* consistency w/ upstream
---
 pkgs/by-name/or/ory-hydra/package.nix | 50 +++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 pkgs/by-name/or/ory-hydra/package.nix

diff --git a/pkgs/by-name/or/ory-hydra/package.nix b/pkgs/by-name/or/ory-hydra/package.nix
new file mode 100644
index 000000000000..97b54a394e3d
--- /dev/null
+++ b/pkgs/by-name/or/ory-hydra/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hydra";
+  version = "25.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ory";
+    repo = "hydra";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vcbJiwWoq7WA7K5WpD68za1VecNwdzqfyXuPfUpa1QU=";
+  };
+
+  vendorHash = "sha256-ADS1kBqSJXDwmCS4CCfiMvmlzzL39E0G4J2UEKXy2Qs=";
+
+  # `json1` not needed (see: https://github.com/ory/hydra/commit/93edc9ad894771c67f46ae2c57ee7e50382d73cd)
+  # `sqlite_omit_load_extension` consistency with upstream (see: https://github.com/ory/hydra/blob/master/.docker/Dockerfile-local-build#L20C58-L20C84). Will disable sqlite runtime extension loading (see: https://sqlite.org/loadext.html)
+  tags = [
+    "hsm"
+    "sqlite"
+    "sqlite_omit_load_extension"
+  ];
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-X github.com/ory/hydra/v2/driver/config.Version=v${finalAttrs.version}"
+    "-X github.com/ory/hydra/v2/driver/config.Commit=${finalAttrs.src.rev}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenID Certified™ OAuth 2.0 Server and OpenID Connect Provider";
+    homepage = "https://www.ory.com/hydra";
+    changelog = "https://github.com/ory/hydra/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      debtquity
+    ];
+    mainProgram = "hydra";
+  };
+})