From 4c2ef22a9bb90ffbba45766268ace398d0b109fd Mon Sep 17 00:00:00 2001
From: dresi <git@dresi.wtf>
Date: Wed, 10 Jun 2026 15:27:26 +0200
Subject: [PATCH] fix: configure BuildKit registry CA via
 buildkitd-config-inline

---
 .gitea/workflows/rsyncd.yaml        | 17 +++++++++--------
 .gitea/workflows/telegraf-snmp.yaml | 19 +++++++++----------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.gitea/workflows/rsyncd.yaml b/.gitea/workflows/rsyncd.yaml
index 6b1a5f8..87a848c 100644
--- a/.gitea/workflows/rsyncd.yaml
+++ b/.gitea/workflows/rsyncd.yaml
@@ -26,16 +26,17 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      - name: Write internal CA cert
+        run: |
+          mkdir -p /tmp/buildkit-certs
+          printf '%s\n' "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > /tmp/buildkit-certs/harbor-ca.pem
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
-      - name: Trust internal CA in BuildKit container
-        run: |
-          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | \
-            docker exec -i "$BUILDER" sh -c 'cat >> /etc/ssl/certs/ca-certificates.crt'
-          docker restart "$BUILDER"
-          sleep 5
+        with:
+          buildkitd-config-inline: |
+            [registry."harbor.lan"]
+              ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
       - name: Build and push image
         uses: docker/build-push-action@v6
diff --git a/.gitea/workflows/telegraf-snmp.yaml b/.gitea/workflows/telegraf-snmp.yaml
index bcab9e0..254c5b2 100644
--- a/.gitea/workflows/telegraf-snmp.yaml
+++ b/.gitea/workflows/telegraf-snmp.yaml
@@ -26,18 +26,17 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      - name: Write internal CA cert
+        run: |
+          mkdir -p /tmp/buildkit-certs
+          printf '%s\n' "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > /tmp/buildkit-certs/harbor-ca.pem
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
-      - name: Trust internal CA in BuildKit container
-        run: |
-          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
-          echo "Builder: $BUILDER"
-          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > /tmp/internal-ca.crt
-          docker cp /tmp/internal-ca.crt "$BUILDER":/usr/local/share/ca-certificates/internal-ca.crt
-          docker exec "$BUILDER" update-ca-certificates
-          docker restart "$BUILDER"
-          sleep 5
+        with:
+          buildkitd-config-inline: |
+            [registry."harbor.lan"]
+              ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
       - name: Build and push image
         uses: docker/build-push-action@v6