From 35e6b554c3dae6675cdea85a903d8961b9894aca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 18 Aug 2026 00:50:29 +0200
Subject: [PATCH] nixos/portunus: replace dex' callbackURL with redirectURIs
 which allows multiple entries

---
 nixos/modules/services/misc/portunus.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 5bd5504201c4..0c224baa57f6 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.services.portunus;
-
 in
 {
   options.services.portunus = {
@@ -79,9 +78,15 @@ in
         type = lib.types.listOf (
           lib.types.submodule {
             options = {
+              redirectURIs = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+                description = "URLs where the OIDC client should redirect";
+              };
               callbackURL = lib.mkOption {
-                type = lib.types.str;
-                description = "URL where the OIDC client should redirect";
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                description = "URL where the OIDC client should redirect (deprecated, use redirectURIs)";
               };
               id = lib.mkOption {
                 type = lib.types.str;
@@ -93,7 +98,7 @@ in
         default = [ ];
         example = [
           {
-            callbackURL = "https://example.com/client/oidc/callback";
+            redirectURIs = [ "https://example.com/client/oidc/callback" ];
             id = "service";
           }
         ];
@@ -227,7 +232,7 @@ in
 
           staticClients = lib.forEach cfg.dex.oidcClients (client: {
             inherit (client) id;
-            redirectURIs = [ client.callbackURL ];
+            redirectURIs = client.redirectURIs ++ lib.optional (client.callbackURL != null) client.callbackURL;
             name = "OIDC for ${client.id}";
             secretEnv = "DEX_CLIENT_${client.id}";
           });