fix: inject internal CA into BuildKit system trust store

Drop buildkitd.toml CA config approach — it does not apply to
BuildKit's OAuth token fetch which uses the Go system CA pool.
Instead append the CA cert to the BuildKit container's
/etc/ssl/certs/ca-certificates.crt and restart so buildkitd
picks it up via the system pool.

.gitea/workflows/rsyncd.yaml

@@ -26,27 +26,16 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Prepare BuildKit config with custom CA
-        run: |
-          CONFIG_DIR_PATH="${{ runner.temp }}/buildx-config"
-          mkdir -p "${CONFIG_DIR_PATH}"
-
-          CERT_FILE_PATH="${CONFIG_DIR_PATH}/ca.crt"
-          CONFIG_FILE_PATH="${CONFIG_DIR_PATH}/buildkitd.toml"
-
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > "${CERT_FILE_PATH}"
-
-          cat << EOF > "${CONFIG_FILE_PATH}"
-          [registry."${{ vars.PRIVATE_REGISTRY_DOMAIN }}"]
-            ca = ["${CERT_FILE_PATH}"]
-          EOF
-
-          echo "BUILDKIT_CONFIG=${CONFIG_FILE_PATH}" >> $GITEA_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          config: ${{ env.BUILDKIT_CONFIG }}
+
+      - name: Trust internal CA in BuildKit container
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | \
+            docker exec -i "$BUILDER" sh -c 'cat >> /etc/ssl/certs/ca-certificates.crt'
+          docker restart "$BUILDER"
+          sleep 5
 
       - name: Build and push image
         uses: docker/build-push-action@v6

.gitea/workflows/telegraf-snmp.yaml

@@ -26,27 +26,16 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Prepare BuildKit config with custom CA
-        run: |
-          CONFIG_DIR_PATH="${{ runner.temp }}/buildx-config"
-          mkdir -p "${CONFIG_DIR_PATH}"
-
-          CERT_FILE_PATH="${CONFIG_DIR_PATH}/ca.crt"
-          CONFIG_FILE_PATH="${CONFIG_DIR_PATH}/buildkitd.toml"
-
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > "${CERT_FILE_PATH}"
-
-          cat << EOF > "${CONFIG_FILE_PATH}"
-          [registry."${{ vars.PRIVATE_REGISTRY_DOMAIN }}"]
-            ca = ["${CERT_FILE_PATH}"]
-          EOF
-
-          echo "BUILDKIT_CONFIG=${CONFIG_FILE_PATH}" >> $GITEA_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          config: ${{ env.BUILDKIT_CONFIG }}
+
+      - name: Trust internal CA in BuildKit container
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | \
+            docker exec -i "$BUILDER" sh -c 'cat >> /etc/ssl/certs/ca-certificates.crt'
+          docker restart "$BUILDER"
+          sleep 5
 
       - name: Build and push image
         uses: docker/build-push-action@v6