From a6db2b8ed64017494c14bc122cf5406a319756ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 8 Jan 2026 12:30:46 +0100
Subject: [PATCH] pocket-id: 1.16.0 -> 2.1.0

The version 2 release contains breaking changes.
See https://pocket-id.org/docs/setup/major-releases/migrate-v2.
---
 doc/release-notes/rl-2605.section.md          |  2 ++
 nixos/modules/services/security/pocket-id.nix | 16 ++++++++++++++++
 nixos/tests/pocket-id.nix                     |  1 -
 pkgs/by-name/po/pocket-id/package.nix         | 10 +++++-----
 4 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 41551208e0c0..c978cd8d338a 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -81,6 +81,8 @@
   - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`.
   - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`.
 
+- `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
+
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
   two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
   retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 3f1ca7453407..08e9f32f7a2e 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -177,6 +177,22 @@ in
           "SQLITE_DB_PATH"
           "INTERNAL_BACKEND_URL"
         ]
+      )
+      ++ (concatMap
+        (
+          # Added 2026-01-08
+          setting:
+          optional (cfg.settings ? "${setting}") ''
+            `services.pocket-id.settings.${setting}` is deprecated.
+            See [v2 migration guide](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
+          ''
+        )
+        [
+          "DB_PROVIDER"
+          "KEYS_PATH"
+          "KEYS_STORAGE"
+          "LDAP_ATTRIBUTE_ADMIN_GROUP"
+        ]
       );
 
     systemd.tmpfiles.rules = [
diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix
index bbef7e3c6dcf..d79866882c17 100644
--- a/nixos/tests/pocket-id.nix
+++ b/nixos/tests/pocket-id.nix
@@ -36,7 +36,6 @@ in
           enable = true;
           settings = {
             PORT = 10001;
-            DB_PROVIDER = "postgres";
             DB_CONNECTION_STRING = "host=/run/postgresql user=${username} database=${username}";
           };
           credentials = {
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index 79db3ac2f2fe..92c4a2847f47 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -12,18 +12,18 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "pocket-id";
-  version = "1.16.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2tGd/gl0Pm5b5GfkTsChvZoWov4dwljwqDcitX5NKCY=";
+    hash = "sha256-tBjo5evQVRG0oembk1VfAfM3M/FJ4zPWV/9vgAWH9Kc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";
 
-  vendorHash = "sha256-ttbiuYRWbn8KRZtg499R4NF/E9+B+fOylxZcMwNg69M=";
+  vendorHash = "sha256-hMhOG/2xnI/adjg8CnA0tRBD8/OFDsTloFXC8iwxlV0=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
@@ -56,8 +56,8 @@ buildGo125Module (finalAttrs: {
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
-      fetcherVersion = 1;
-      hash = "sha256-drXGcUHP7J7keGra7/x1tr9Pfh/wjzmtUE1yAybYXLQ=";
+      fetcherVersion = 3;
+      hash = "sha256-jhlHrekVk0sNLwo8LFQY6bgX9Ic0xbczM6UTzmZTnPI=";
     };
 
     env.BUILD_OUTPUT_PATH = "dist";