I have a nix expression that builds a virtualbox vm. As part of that process, I install a self-signed ssl certificate via
certfile = builtins.readFile ./certificate.crt
security.pki.certificates = [ certfile ];
That works fine. The problem is if I want to run a nixos-rebuild to reconfigure the vm. Since I no longer have access to the original certfile from the vm build process (because I'm running in the vm, not on the machine where I built the vm), I can't just include the file again through the same mechanism.
I've come up with three ideas on how to do this:
During the vm build process, place an extra copy of the cert under /root in the vm. Then I can just use this in my configuration.nix to pull in the certificate again:
security.pki.certificates = [ /root/cert ];
Since the certificate is always available for http download from an internal server, I could somehow use fetchUrl in the configuration.nix to download it every time I do a nixos-rebuild. I suppose the only downside to this would be introducing an external dependency.
Since the certificate is in /etc/ssl/ca-certificates.crt, I could somehow extract it from that file as part ofthe rebuild process and then feed it to security.pki.certificates again.
Ideas?