feat: add private ca for all internal web services

modules/base.nix

@@ -10,6 +10,11 @@
     ]
     ++ (import ../overlays args);
 
+  # Add my private PKI's CA certificate to the system-wide trust store.
+  security.pki.certificateFiles = [
+    ../certs/ecc-ca.crt
+  ];
+
   environment.systemPackages = with pkgs; [
     git # used by nix flakes
     git-lfs # used by huggingface models