diff options
| author | Michael Hoang <Enzime@users.noreply.github.com> | 2023-11-11 23:03:48 +1100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-11 23:03:48 +1100 |
| commit | 0f1ad801387445fdda01d080db8ecf169be8e793 (patch) | |
| tree | e4b80967493d2c5ae1c3ee1183995a9771d7f100 /modules | |
| parent | c8f385766ba076a096caa794309c40f89894d88a (diff) | |
| parent | 4fa7b5cdd14a0fee6edc8c8924e57422b0dcc9ef (diff) | |
Merge pull request #805 from yacinehmito/disable-pki
Add security.pki.installCACerts config
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/security/pki/default.nix | 10 | ||||
| -rw-r--r-- | modules/services/nix-daemon.nix | 5 |
2 files changed, 13 insertions, 2 deletions
diff --git a/modules/security/pki/default.nix b/modules/security/pki/default.nix index a92f2d5..d0f11d4 100644 --- a/modules/security/pki/default.nix +++ b/modules/security/pki/default.nix @@ -21,6 +21,14 @@ in { options = { + security.pki.installCACerts = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + Whether to enable certificate management with nix-darwin. + ''; + }; + security.pki.certificateFiles = mkOption { type = types.listOf types.path; default = []; @@ -71,7 +79,7 @@ in }; }; - config = { + config = mkIf cfg.installCACerts { security.pki.certificateFiles = [ "${cacertPackage}/etc/ssl/certs/ca-bundle.crt" ]; diff --git a/modules/services/nix-daemon.nix b/modules/services/nix-daemon.nix index 35476a0..584c226 100644 --- a/modules/services/nix-daemon.nix +++ b/modules/services/nix-daemon.nix @@ -63,7 +63,10 @@ in serviceConfig.EnvironmentVariables = mkMerge [ config.nix.envVars - { NIX_SSL_CERT_FILE = mkDefault config.environment.variables.NIX_SSL_CERT_FILE; + { + NIX_SSL_CERT_FILE = mkIf + (config.environment.variables ? NIX_SSL_CERT_FILE) + (mkDefault config.environment.variables.NIX_SSL_CERT_FILE); TMPDIR = mkIf (cfg.tempDir != null) cfg.tempDir; # FIXME: workaround for https://github.com/NixOS/nix/issues/2523 OBJC_DISABLE_INITIALIZE_FORK_SAFETY = mkDefault "YES"; |