Bump webpki crates and pin cacert 3.131.1 for the eMudhra CA compromise

rustls-webpki 0.103.3 -> 0.103.16 (RUSTSEC-2026-0382), webpki-roots
1.0.1 -> 1.0.10 (RUSTSEC-2026-0381) and webpki-root-certs 1.0.7 ->
1.0.10 (RUSTSEC-2026-0383). rustls-webpki 0.103.16 requires the
aws-lc-rs 1.18.2 / aws-lc-sys 0.46.0 bump.

The API host now serves its system CA bundle from cacert 3.131.1,
taken from a separate nixpkgs pin so the rainix nixpkgs input does not
move.

Author: findolor

Cargo.lock

@@ -9,6 +9,10 @@
     deploy-rs.url = "github:serokell/deploy-rs";
     crane.url = "github:ipetkov/crane";
 
+    # Pinned separately so the API host can take a newer CA bundle
+    # (cacert >= 3.131.1) without moving the rainix nixpkgs input.
+    nixpkgs-cacert.url = "github:NixOS/nixpkgs/f903b88037954e42a165c27b686201c2f242ae28";
+
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "rainix/nixpkgs";
 
@@ -27,6 +31,7 @@
       crane,
       disko,
       nixos-anywhere,
+      nixpkgs-cacert,
       ...
     }:
     let
@@ -36,6 +41,7 @@
     {
       nixosConfigurations.raindex-api = rainix.inputs.nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
+        specialArgs.cacert = nixpkgs-cacert.legacyPackages.x86_64-linux.cacert;
         specialArgs.raindexEnv = {
           name = "prod";
           virtualHost = apiHostname;

flake.lock

@@ -2,6 +2,8 @@
   pkgs,
   lib,
   modulesPath,
+  # CA bundle for the host, from its own nixpkgs pin (see flake.nix).
+  cacert,
   raindexEnv ? { },
   ...
 }:
@@ -178,6 +180,23 @@ in
     defaults.email = "ops@raindex.finance";
   };
 
+  # Serve the pinned CA bundle at the paths security.pki would populate from
+  # the rainix nixpkgs cacert. Overriding the etc entries avoids an overlay,
+  # which would rebuild everything that depends on cacert.
+  environment.etc =
+    lib.genAttrs
+      [
+        "ssl/certs/ca-certificates.crt"
+        "ssl/certs/ca-bundle.crt"
+        "pki/tls/certs/ca-bundle.crt"
+      ]
+      (_: {
+        source = lib.mkForce "${cacert}/etc/ssl/certs/ca-bundle.crt";
+      })
+    // {
+      "ssl/trust-source".source = lib.mkForce "${cacert.p11kit}/etc/ssl/trust-source";
+    };
+
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
@@ -235,7 +254,11 @@ in
     "d ${env.dataDir} 0775 root raindex -"
     "d ${env.dataDir}/logs 0775 raindex-api raindex -"
   ];
-  systemd.services = lib.mapAttrs mkService enabledServices;
+  systemd.services = lib.mapAttrs mkService enabledServices // {
+    # nix-daemon reads the read-only security.pki.caBundle, which still points
+    # at the rainix cacert.
+    nix-daemon.environment.CURL_CA_BUNDLE = lib.mkForce "/etc/ssl/certs/ca-certificates.crt";
+  };
 
   environment.systemPackages = with pkgs; [
     bat