From 0cd3a94e6f19c746b22d8b6085715d83b17d2b7d Mon Sep 17 00:00:00 2001
From: dresi <git@dresi.wtf>
Date: Wed, 10 Jun 2026 14:59:26 +0200
Subject: [PATCH] fix: inject internal CA into BuildKit system trust store
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop buildkitd.toml CA config approach — it does not apply to
BuildKit's OAuth token fetch which uses the Go system CA pool.
Instead append the CA cert to the BuildKit container's
/etc/ssl/certs/ca-certificates.crt and restart so buildkitd
picks it up via the system pool.
---
 .gitea/workflows/rsyncd.yaml        | 27 ++++++++-------------------
 .gitea/workflows/telegraf-snmp.yaml | 27 ++++++++-------------------
 2 files changed, 16 insertions(+), 38 deletions(-)

diff --git a/.gitea/workflows/rsyncd.yaml b/.gitea/workflows/rsyncd.yaml
index 5d24d1e..6b1a5f8 100644
--- a/.gitea/workflows/rsyncd.yaml
+++ b/.gitea/workflows/rsyncd.yaml
@@ -26,27 +26,16 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Prepare BuildKit config with custom CA
-        run: |
-          CONFIG_DIR_PATH="${{ runner.temp }}/buildx-config"
-          mkdir -p "${CONFIG_DIR_PATH}"
-
-          CERT_FILE_PATH="${CONFIG_DIR_PATH}/ca.crt"
-          CONFIG_FILE_PATH="${CONFIG_DIR_PATH}/buildkitd.toml"
-
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > "${CERT_FILE_PATH}"
-
-          cat << EOF > "${CONFIG_FILE_PATH}"
-          [registry."${{ vars.PRIVATE_REGISTRY_DOMAIN }}"]
-            ca = ["${CERT_FILE_PATH}"]
-          EOF
-
-          echo "BUILDKIT_CONFIG=${CONFIG_FILE_PATH}" >> $GITEA_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          config: ${{ env.BUILDKIT_CONFIG }}
+
+      - name: Trust internal CA in BuildKit container
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | \
+            docker exec -i "$BUILDER" sh -c 'cat >> /etc/ssl/certs/ca-certificates.crt'
+          docker restart "$BUILDER"
+          sleep 5
 
       - name: Build and push image
         uses: docker/build-push-action@v6
diff --git a/.gitea/workflows/telegraf-snmp.yaml b/.gitea/workflows/telegraf-snmp.yaml
index adaa285..a38f6b2 100644
--- a/.gitea/workflows/telegraf-snmp.yaml
+++ b/.gitea/workflows/telegraf-snmp.yaml
@@ -26,27 +26,16 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Prepare BuildKit config with custom CA
-        run: |
-          CONFIG_DIR_PATH="${{ runner.temp }}/buildx-config"
-          mkdir -p "${CONFIG_DIR_PATH}"
-
-          CERT_FILE_PATH="${CONFIG_DIR_PATH}/ca.crt"
-          CONFIG_FILE_PATH="${CONFIG_DIR_PATH}/buildkitd.toml"
-
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > "${CERT_FILE_PATH}"
-
-          cat << EOF > "${CONFIG_FILE_PATH}"
-          [registry."${{ vars.PRIVATE_REGISTRY_DOMAIN }}"]
-            ca = ["${CERT_FILE_PATH}"]
-          EOF
-
-          echo "BUILDKIT_CONFIG=${CONFIG_FILE_PATH}" >> $GITEA_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          config: ${{ env.BUILDKIT_CONFIG }}
+
+      - name: Trust internal CA in BuildKit container
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | \
+            docker exec -i "$BUILDER" sh -c 'cat >> /etc/ssl/certs/ca-certificates.crt'
+          docker restart "$BUILDER"
+          sleep 5
 
       - name: Build and push image
         uses: docker/build-push-action@v6