From 4392f03db71ed9dc3f2dcb476a7c4fd643af0bb5 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Fri, 28 Mar 2025 10:22:26 +0100
Subject: [PATCH] nixos/cfssl: Add Disable Option

---
 nixos/modules/services/security/cfssl.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/services/security/cfssl.nix b/nixos/modules/services/security/cfssl.nix
index 2d0465d6a0b8..514442dbe437 100644
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@@ -164,6 +164,12 @@ in
       ];
       description = "Log level (0 = DEBUG, 5 = FATAL).";
     };
+
+    disable = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.commas;
+      description = "Endpoints to disable (comma-separated list)";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -218,6 +224,7 @@ in
               (opt "tls-remote-ca" tlsRemoteCa)
               (opt "db-config" dbConfig)
               (opt "loglevel" (toString logLevel))
+              (opt "disable" disable)
             ];
         }
         (lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {