From 847f0789185e37d4ffa87cfb2c7f50bba4558178 Mon Sep 17 00:00:00 2001 From: dresi Date: Thu, 11 Jun 2026 08:13:40 +0200 Subject: [PATCH] refactor: replace custom buildkit image with private CA from Gitea variable --- .gitea/workflows/buildkit.yaml | 29 ------------ .gitea/workflows/rsyncd.yaml | 9 +++- .gitea/workflows/telegraf-snmp.yaml | 24 +++------- buildkit/Dockerfile | 4 -- buildkit/ca-chain.crt | 69 ----------------------------- 5 files changed, 13 insertions(+), 122 deletions(-) delete mode 100644 .gitea/workflows/buildkit.yaml delete mode 100644 buildkit/Dockerfile delete mode 100644 buildkit/ca-chain.crt diff --git a/.gitea/workflows/buildkit.yaml b/.gitea/workflows/buildkit.yaml deleted file mode 100644 index 09215e3..0000000 --- a/.gitea/workflows/buildkit.yaml +++ /dev/null @@ -1,29 +0,0 @@ -name: Build and push buildkit image -run-name: ${{ gitea.actor }} is building and pushing buildkit image -on: - push: - paths: - - 'buildkit/**' - - '.gitea/workflows/buildkit.yaml' - -env: - RESULT_IMAGE_NAME: tools/buildkit-with-ca - -jobs: - build-and-push-image: - runs-on: docker - steps: - - name: Checkout - uses: actions/checkout@v5 - - - name: Log in to registry - uses: docker/login-action@v3 - with: - registry: ${{ vars.PRIVATE_REGISTRY_DOMAIN }} - username: ${{ vars.PRIVATE_REGISTRY_USER }} - password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }} - - - name: Build and push image - run: | - docker build -t ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest buildkit/ - docker push ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest diff --git a/.gitea/workflows/rsyncd.yaml b/.gitea/workflows/rsyncd.yaml index d8b923d..c2baa1f 100644 --- a/.gitea/workflows/rsyncd.yaml +++ b/.gitea/workflows/rsyncd.yaml @@ -23,13 +23,20 @@ jobs: username: ${{ vars.PRIVATE_REGISTRY_USER }} password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }} + - name: Install private CA certificate + run: | + echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | sudo tee /usr/local/share/ca-certificates/private-ca.crt > /dev/null + sudo update-ca-certificates + - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 with: - driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest + config-inline: | + [registry."harbor.lan"] + ca = ["/usr/local/share/ca-certificates/private-ca.crt"] - name: Build and push image uses: docker/build-push-action@v6 diff --git a/.gitea/workflows/telegraf-snmp.yaml b/.gitea/workflows/telegraf-snmp.yaml index f9d9c12..4555683 100644 --- a/.gitea/workflows/telegraf-snmp.yaml +++ b/.gitea/workflows/telegraf-snmp.yaml @@ -23,9 +23,9 @@ jobs: username: ${{ vars.PRIVATE_REGISTRY_USER }} password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }} - - name: Install Harbor CA certificate + - name: Install private CA certificate run: | - sudo cp buildkit/ca-chain.crt /usr/local/share/ca-certificates/harbor-ca.crt + echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | sudo tee /usr/local/share/ca-certificates/private-ca.crt > /dev/null sudo update-ca-certificates - name: Set up QEMU @@ -34,23 +34,9 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 with: - driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest - - - name: Debug TLS in BuildKit - run: | - BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1) - echo "=== Builder: $BUILDER ===" - docker exec "$BUILDER" sh -c ' - echo "=== Certs in ca-certificates.crt ===" - grep -c "BEGIN CERTIFICATE" /etc/ssl/certs/ca-certificates.crt 2>/dev/null || echo "not found" - echo "=== /etc/ssl/cert.pem ===" - ls -la /etc/ssl/cert.pem 2>/dev/null || echo "not found" - grep -c "BEGIN CERTIFICATE" /etc/ssl/cert.pem 2>/dev/null || echo "not found" - echo "=== TLS test harbor.lan ===" - wget -qO /dev/null https://harbor.lan/ 2>&1 && echo "TLS OK" || echo "TLS FAILED" - echo "=== TLS test token endpoint ===" - wget -qO /dev/null https://harbor.lan/service/token 2>&1 && echo "TLS OK" || echo "TLS FAILED" - ' + config-inline: | + [registry."harbor.lan"] + ca = ["/usr/local/share/ca-certificates/private-ca.crt"] - name: Build and push image uses: docker/build-push-action@v6 diff --git a/buildkit/Dockerfile b/buildkit/Dockerfile deleted file mode 100644 index 3ea647e..0000000 --- a/buildkit/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM moby/buildkit:buildx-stable-1 -COPY ca-chain.crt /usr/local/share/ca-certificates/ca-chain.crt -RUN apk add --no-cache ca-certificates && update-ca-certificates && \ - cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem diff --git a/buildkit/ca-chain.crt b/buildkit/ca-chain.crt deleted file mode 100644 index bbdc461..0000000 --- a/buildkit/ca-chain.crt +++ /dev/null @@ -1,69 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIF8zCCA9ugAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYoxCzAJBgNVBAYTAkRF -MQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdlaXNlbmhlaW0xEDAOBgNVBAoM -B1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQDDA9QUklWQVRFIFJPT1QgQ0Ex -HDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYwHhcNMjIxMTMwMTMyNTA3WhcN -MjcxMTI5MTMyNTA3WjCBhTELMAkGA1UEBhMCREUxDzANBgNVBAgMBkhlc3NlbjEQ -MA4GA1UECgwHUHJpdmF0ZTELMAkGA1UECwwCSVQxKDAmBgNVBAMMH1BSSVZBVEUg -SU5URVJNRURJQVRFIENBIEZPUiBLM1MxHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVz -aS53dGYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJydl5dW1gIlv+ -F+Bxz6wAw3ymnyG/TlnZXmLZpB+xRirVoItF1++BvxvbczSF2OWaXlzwYRHC6HAZ -zrAXgejl7g7lL1V3L/zMZfB/IKVduiJFjy3mS4RJwVlBToLVqnJpjWkrbPZuQE5C -qYeddzEDyNkaMKCMpziV9jUpqsguVPe583CAUB81HEB59+R+m6M+HjXESaIKdf/I -2xP7kef/Z9/MCJ6O1sgeKIKwm6zyg5gih2k2k4NDpQ59BDerwtdtEp7uBTdEYR7b -WsAmvuh8+WMQ9jii6fDaVQ/1Tz0qlXkXDcg9xGIvIbr34ffOSSTs+m35koNqkJ9L -1DaOCjB/vvCXaxxBTldqtLdqG/5WUiGSa4J0OwrSJbQ3U2yYn4TmrzfO7BjiiAGK -cdA2/9ApbwX3geE/uU/+tBBH5seQUzOD5iVt+/KNudlqvdsyE0HlWKx80JScbEqS -OHHr6sLKBkFgL4erleSMLw6+5igNuUWVT9O6H2yXYi8HMnOfS/qWzWxtm1g3zYts -ebZvQ7ItW8brsu2MDCK+Le0gWBz7mQLjnKi/fFIhGqizCRl4jvniFO6s75wJpC+b -/+AFH5e0s+Fnq1eKMZzxJtH98qYwkNAHSUX4+5aXcJzafL0kC6zyf9Loy4oUTmOo -cSlmB+coKCeB7veaAjvwvcMeFX50rwIDAQABo2YwZDAdBgNVHQ4EFgQUeYUoge3x -3Cwnn1sLB1Nn+VJv4ZowHwYDVR0jBBgwFoAUakYXuvQEppet8PSJN1kkwLNBCH4w -EgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQEL -BQADggIBAGB7Uv1hcM7uEp9oFy9cQ0dOVtPTy3lQ1MzDRBosQ+djiu3IlLUf0sxQ -4W0Y9r167y/M3wijym6x5SyDoix5rZr8062t6LzALoygE1nztsCjonR3WQMmloW9 -Kup3BlG9SrH4XyeBul0h4rrubIASCzCA5lAlyEV/19i5e3dMsQJsBNjolfjNAho1 -kWrNHmfO/sAPRDfvcRruoZpMWoNl5x563T+XfgJ7OY9edR+JwShMRY4tTkPLqdLm -1wCAjBY8bd7+oBfrhHA3tmCnWdUO3kcsX7V/oXvb47wi5jW6Xl/ucsKNVSOiCgjH -ClK6BPcFIVl2MQo0EWpMrU1SGS2KgRizsXaq9+1DYP9ks88flI1ivwQI2zynPxTa -C8kF8xpX3eI7DHpJDq605ZiN5aPoUq11Xt4RPmN0N9Qui8ZH4XtHpX4bACPtxQRU -jF6OkFNrCO04Nu1kjafDZYM5muLyr7yw12WiY3/E6traCayBJeisDCXP/dOzTepN -s5BICN8u55lUAx+5sXtqqjhlFGcsZXP/JQ///d2bxNZBXUPJVrAQxuRnH0WKJ1k/ -yuB3id+ut7sDcn7bkXBd9ngLvpIPbgzThrYCXGpMZ48+uqsMWq3K8oLUgjnq6xEr -7raZNna5ReBG3zhTvpo+5M8v7UjWOOTgJFq2FGdz0OwdJNvdd8iH ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIGBzCCA++gAwIBAgIUDkrlPsBijsQfGXRnhmcHZmuxD/0wDQYJKoZIhvcNAQEL -BQAwgYoxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdl -aXNlbmhlaW0xEDAOBgNVBAoMB1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQD -DA9QUklWQVRFIFJPT1QgQ0ExHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYw -HhcNMjIxMTI5MDc0NjQwWhcNMzIxMTI2MDc0NjQwWjCBijELMAkGA1UEBhMCREUx -DzANBgNVBAgMBkhlc3NlbjETMBEGA1UEBwwKR2Vpc2VuaGVpbTEQMA4GA1UECgwH -UHJpdmF0ZTELMAkGA1UECwwCSVQxGDAWBgNVBAMMD1BSSVZBVEUgUk9PVCBDQTEc -MBoGCSqGSIb3DQEJARYNcGtpQGRyZXNpLnd0ZjCCAiIwDQYJKoZIhvcNAQEBBQAD -ggIPADCCAgoCggIBAMGpQO8nqtbCyC6KkwlEStLBA0/UmXR331giHQDUhvpT9zf2 -4rzi+Ky0gOKtXyvU3NoYSseBeW4YhpSkOQRwiuUITBgD5E4X8p21wTefyJsQcqYz -eaSNT6Kkbs7aYfRjzUDLJZlx83Oy7/7L127sYuMZTPfOTbl/j1AIYfUGV/E9+7Tw -IyjPoN+1kRVfx5upaWI9MrIOYkl3jDQUbXthno09gmAgnXc5jt9pqn2JoxmfLRZS -ZUFj/kHtI3TPjEZmAccfqsYYaWcgDCUX49g/w6WV/+xb6WFnqOxags4923ctzBtS -gRINW03o4YJeisOGdB5Wxc33hDEsJGTcOQ64VUa1zYBLrmFz96xNTrXy5QIsdmzx -J3+p2H0AmHKiPqzV3ICyMnNXOD918XPfD0mCFeYI5X4prCgW08GxEmJv0ACk9xGI -2rKe7tijZ2DhVW2rSSIjvVCpjZD4X5NC+x7xMPP5WoaEMcW7nChhHb0XrThd9fc3 -3Ay0gkDDI3QtqbqKxFo4hUVnRZlRlzJIpRPjhDdanconxQnEZAUY5PeHS7bNH7Es -6pIBz2EG3XHsdpvXkD2qF8gVBbGTC8KPVVAamTLNWfxT6goNuvwY0t8UUdmjcpVc -mkNNmtkSh7uX1GYiWL4B+afVPwH5bGtJZ9ARNOw0pnaRnCXoA1YzRx9lyYwhAgMB -AAGjYzBhMB0GA1UdDgQWBBRqRhe69ASml63w9Ik3WSTAs0EIfjAfBgNVHSMEGDAW -gBRqRhe69ASml63w9Ik3WSTAs0EIfjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB -/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAU9bfHwVNetgq4E6GL2NQFl4WysQB -7HIpEplGZ+ms1I7kaolBLVGpILYjXQ+tFHV1eXr8ry6+A4yyt11iKpQK+9bFUkPO -OpprGvywwmfsEbq/e4FO+K+PGlwq+NpEJFtllkgyEDr3CEOdNuQNFyNyZ9nsZRIl -XOqcQjswdHVoLPyxLMgQkAY7jDgkj51y2HQ3pbHACLVHQl6MV59pzn2ovtuGh8yu -O87V8VcfmHros63y1V7CSILPUjnTuJK0jpPrtBvHSCOE0WCOgAh0faHQFvTeyFS4 -96eXgyFPK2OwxgAnnOxMOSTjCc8qxFSnBeE58FEsXB9JVE77rg0LJKnJljJTTCTi -RBKeC2a9eoi3BzuOrG9IktD+t6QL06YH13goQv1NjkpjmeIbN0oFk15OtuDs+I2a -QP+vYKAjBpkRwySF4Z53FueFWZNbO2USDwHhxjVSvDBV+laQqUdQjJlvuZCoGtLA -rFkGcL8x36MjozVGpaKiISb/jHQv4KHuvdYvvYkBTU4OM1TUzbY/sI4LQL4gMoG/ -ujdwE8e8jvF8I3WSN39thmMjNrKbsEvCVO/akqJfVLKY1lD4nRzDEbDlgWZW8Zxf -AsPACdUqqX/lXqMyWdzbpVKNuwJkrtri7N2NMMCo1YfjjzwaCFyu2S5IrZRqrejV -6Edz+imlZBYWGlQ= ------END CERTIFICATE-----