From 17165069c25fed64f771acbb065762beb49995c5 Mon Sep 17 00:00:00 2001
From: dresi <git@dresi.wtf>
Date: Wed, 10 Jun 2026 15:37:07 +0200
Subject: [PATCH] fix: also inject internal CA into BuildKit system CA store

---
 .gitea/workflows/rsyncd.yaml        | 17 +++++++++++++++++
 .gitea/workflows/telegraf-snmp.yaml | 17 +++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/.gitea/workflows/rsyncd.yaml b/.gitea/workflows/rsyncd.yaml
index 87a848c..2f07f90 100644
--- a/.gitea/workflows/rsyncd.yaml
+++ b/.gitea/workflows/rsyncd.yaml
@@ -38,6 +38,23 @@ jobs:
             [registry."harbor.lan"]
               ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
+      - name: Trust internal CA in BuildKit system store
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "Builder: $BUILDER"
+          docker exec "$BUILDER" sh -c '
+            echo "--- cert landscape ---"
+            ls -la /etc/ssl/ /etc/ssl/certs/ 2>/dev/null | head -15
+            for f in /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem; do
+              [ -e "$f" ] || continue
+              cat /etc/buildkit/certs/harbor.lan/harbor-ca.pem >> "$f"
+              echo "Appended CA to $f"
+              break
+            done
+          '
+          docker restart "$BUILDER"
+          sleep 5
+
       - name: Build and push image
         uses: docker/build-push-action@v6
         with:
diff --git a/.gitea/workflows/telegraf-snmp.yaml b/.gitea/workflows/telegraf-snmp.yaml
index 254c5b2..733908d 100644
--- a/.gitea/workflows/telegraf-snmp.yaml
+++ b/.gitea/workflows/telegraf-snmp.yaml
@@ -38,6 +38,23 @@ jobs:
             [registry."harbor.lan"]
               ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
+      - name: Trust internal CA in BuildKit system store
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "Builder: $BUILDER"
+          docker exec "$BUILDER" sh -c '
+            echo "--- cert landscape ---"
+            ls -la /etc/ssl/ /etc/ssl/certs/ 2>/dev/null | head -15
+            for f in /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem; do
+              [ -e "$f" ] || continue
+              cat /etc/buildkit/certs/harbor.lan/harbor-ca.pem >> "$f"
+              echo "Appended CA to $f"
+              break
+            done
+          '
+          docker restart "$BUILDER"
+          sleep 5
+
       - name: Build and push image
         uses: docker/build-push-action@v6
         with: