From eff07668add9ef2cad569d04231000f2c57b34a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 8 Jan 2026 12:30:27 +0100
Subject: [PATCH] nixos/pocket-id: add warnings for all currently known secrets

---
 nixos/modules/services/security/pocket-id.nix | 56 +++++++++++--------
 1 file changed, 34 insertions(+), 22 deletions(-)

diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 2b986e9d521b..3f1ca7453407 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -144,28 +144,40 @@ in
 
   config = mkIf cfg.enable {
     warnings =
-      optional (cfg.settings ? MAXMIND_LICENSE_KEY)
-        "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.MAXMIND_LICENSE_KEY` or `services.pocket-id.environmentFile` instead."
-      ++
-        concatMap
-          (
-            # Added 2025-05-27
-            setting:
-            optional (cfg.settings ? "${setting}") ''
-              `services.pocket-id.settings.${setting}` is deprecated.
-              See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1).
-            ''
-          )
-          [
-            "PUBLIC_APP_URL"
-            "PUBLIC_UI_CONFIG_DISABLED"
-            "CADDY_DISABLED"
-            "CADDY_PORT"
-            "BACKEND_PORT"
-            "POSTGRES_CONNECTION_STRING"
-            "SQLITE_DB_PATH"
-            "INTERNAL_BACKEND_URL"
-          ];
+      (concatMap
+        (
+          setting:
+          optional (cfg.settings ? "${setting}") ''
+            `services.pocket-id.settings.${setting}` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.${setting}` or `services.pocket-id.environmentFile` instead.
+          ''
+        )
+        [
+          "ENCRYPTION_KEY"
+          "MAXMIND_LICENSE_KEY"
+          "SMTP_PASSWORD"
+          "LDAP_BIND_PASSWORD"
+        ]
+      )
+      ++ (concatMap
+        (
+          # Added 2025-05-27
+          setting:
+          optional (cfg.settings ? "${setting}") ''
+            `services.pocket-id.settings.${setting}` is deprecated.
+            See [v1 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v1).
+          ''
+        )
+        [
+          "PUBLIC_APP_URL"
+          "PUBLIC_UI_CONFIG_DISABLED"
+          "CADDY_DISABLED"
+          "CADDY_PORT"
+          "BACKEND_PORT"
+          "POSTGRES_CONNECTION_STRING"
+          "SQLITE_DB_PATH"
+          "INTERNAL_BACKEND_URL"
+        ]
+      );
 
     systemd.tmpfiles.rules = [
       "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}"