Add security.pki.installCACerts config

Made is possible to disable the management of
/etc/ssl/certs/ca-certificates.crt by Nix darwin.

1 files changed, 9 insertions, 1 deletions

diff --git a/modules/security/pki/default.nix b/modules/security/pki/default.nix
index a92f2d5..d0f11d4 100644
--- a/modules/security/pki/default.nix
+++ b/modules/security/pki/default.nix
@@ -21,6 +21,14 @@ in
 
 {
   options = {
+    security.pki.installCACerts = mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Whether to enable certificate management with nix-darwin.
+      '';
+    };
+
     security.pki.certificateFiles = mkOption {
       type = types.listOf types.path;
       default = [];
@@ -71,7 +79,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.installCACerts {
 
     security.pki.certificateFiles = [ "${cacertPackage}/etc/ssl/certs/ca-bundle.crt" ];