refactor: replace custom buildkit image with private CA from Gitea variable

.gitea/workflows/buildkit.yaml

@@ -1,29 +0,0 @@
-name: Build and push buildkit image
-run-name: ${{ gitea.actor }} is building and pushing buildkit image
-on:
-  push:
-    paths:
-      - 'buildkit/**'
-      - '.gitea/workflows/buildkit.yaml'
-
-env:
-  RESULT_IMAGE_NAME: tools/buildkit-with-ca
-
-jobs:
-  build-and-push-image:
-    runs-on: docker
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Log in to registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}
-          username: ${{ vars.PRIVATE_REGISTRY_USER }}
-          password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}
-
-      - name: Build and push image
-        run: |
-          docker build -t ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest buildkit/
-          docker push ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest

.gitea/workflows/rsyncd.yaml

@@ -23,13 +23,20 @@ jobs:
           username: ${{ vars.PRIVATE_REGISTRY_USER }}
           password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}
 
+      - name: Install private CA certificate
+        run: |
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | sudo tee /usr/local/share/ca-certificates/private-ca.crt > /dev/null
+          sudo update-ca-certificates
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
+          config-inline: |
+            [registry."harbor.lan"]
+              ca = ["/usr/local/share/ca-certificates/private-ca.crt"]
 
       - name: Build and push image
         uses: docker/build-push-action@v6

.gitea/workflows/telegraf-snmp.yaml

@@ -23,9 +23,9 @@ jobs:
           username: ${{ vars.PRIVATE_REGISTRY_USER }}
           password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}
 
-      - name: Install Harbor CA certificate
+      - name: Install private CA certificate
         run: |
-          sudo cp buildkit/ca-chain.crt /usr/local/share/ca-certificates/harbor-ca.crt
+          echo "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" | sudo tee /usr/local/share/ca-certificates/private-ca.crt > /dev/null
           sudo update-ca-certificates
 
       - name: Set up QEMU
@@ -34,23 +34,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
-
-      - name: Debug TLS in BuildKit
-        run: |
-          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
-          echo "=== Builder: $BUILDER ==="
-          docker exec "$BUILDER" sh -c '
-            echo "=== Certs in ca-certificates.crt ==="
-            grep -c "BEGIN CERTIFICATE" /etc/ssl/certs/ca-certificates.crt 2>/dev/null || echo "not found"
-            echo "=== /etc/ssl/cert.pem ==="
-            ls -la /etc/ssl/cert.pem 2>/dev/null || echo "not found"
-            grep -c "BEGIN CERTIFICATE" /etc/ssl/cert.pem 2>/dev/null || echo "not found"
-            echo "=== TLS test harbor.lan ==="
-            wget -qO /dev/null https://harbor.lan/ 2>&1 && echo "TLS OK" || echo "TLS FAILED"
-            echo "=== TLS test token endpoint ==="
-            wget -qO /dev/null https://harbor.lan/service/token 2>&1 && echo "TLS OK" || echo "TLS FAILED"
-          '
+          config-inline: |
+            [registry."harbor.lan"]
+              ca = ["/usr/local/share/ca-certificates/private-ca.crt"]
 
       - name: Build and push image
         uses: docker/build-push-action@v6

buildkit/Dockerfile

@@ -1,4 +0,0 @@
-FROM moby/buildkit:buildx-stable-1
-COPY ca-chain.crt /usr/local/share/ca-certificates/ca-chain.crt
-RUN apk add --no-cache ca-certificates && update-ca-certificates && \
-    cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem

buildkit/ca-chain.crt

@@ -1,69 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIF8zCCA9ugAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYoxCzAJBgNVBAYTAkRF
-MQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdlaXNlbmhlaW0xEDAOBgNVBAoM
-B1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQDDA9QUklWQVRFIFJPT1QgQ0Ex
-HDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYwHhcNMjIxMTMwMTMyNTA3WhcN
-MjcxMTI5MTMyNTA3WjCBhTELMAkGA1UEBhMCREUxDzANBgNVBAgMBkhlc3NlbjEQ
-MA4GA1UECgwHUHJpdmF0ZTELMAkGA1UECwwCSVQxKDAmBgNVBAMMH1BSSVZBVEUg
-SU5URVJNRURJQVRFIENBIEZPUiBLM1MxHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVz
-aS53dGYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJydl5dW1gIlv+
-F+Bxz6wAw3ymnyG/TlnZXmLZpB+xRirVoItF1++BvxvbczSF2OWaXlzwYRHC6HAZ
-zrAXgejl7g7lL1V3L/zMZfB/IKVduiJFjy3mS4RJwVlBToLVqnJpjWkrbPZuQE5C
-qYeddzEDyNkaMKCMpziV9jUpqsguVPe583CAUB81HEB59+R+m6M+HjXESaIKdf/I
-2xP7kef/Z9/MCJ6O1sgeKIKwm6zyg5gih2k2k4NDpQ59BDerwtdtEp7uBTdEYR7b
-WsAmvuh8+WMQ9jii6fDaVQ/1Tz0qlXkXDcg9xGIvIbr34ffOSSTs+m35koNqkJ9L
-1DaOCjB/vvCXaxxBTldqtLdqG/5WUiGSa4J0OwrSJbQ3U2yYn4TmrzfO7BjiiAGK
-cdA2/9ApbwX3geE/uU/+tBBH5seQUzOD5iVt+/KNudlqvdsyE0HlWKx80JScbEqS
-OHHr6sLKBkFgL4erleSMLw6+5igNuUWVT9O6H2yXYi8HMnOfS/qWzWxtm1g3zYts
-ebZvQ7ItW8brsu2MDCK+Le0gWBz7mQLjnKi/fFIhGqizCRl4jvniFO6s75wJpC+b
-/+AFH5e0s+Fnq1eKMZzxJtH98qYwkNAHSUX4+5aXcJzafL0kC6zyf9Loy4oUTmOo
-cSlmB+coKCeB7veaAjvwvcMeFX50rwIDAQABo2YwZDAdBgNVHQ4EFgQUeYUoge3x
-3Cwnn1sLB1Nn+VJv4ZowHwYDVR0jBBgwFoAUakYXuvQEppet8PSJN1kkwLNBCH4w
-EgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQEL
-BQADggIBAGB7Uv1hcM7uEp9oFy9cQ0dOVtPTy3lQ1MzDRBosQ+djiu3IlLUf0sxQ
-4W0Y9r167y/M3wijym6x5SyDoix5rZr8062t6LzALoygE1nztsCjonR3WQMmloW9
-Kup3BlG9SrH4XyeBul0h4rrubIASCzCA5lAlyEV/19i5e3dMsQJsBNjolfjNAho1
-kWrNHmfO/sAPRDfvcRruoZpMWoNl5x563T+XfgJ7OY9edR+JwShMRY4tTkPLqdLm
-1wCAjBY8bd7+oBfrhHA3tmCnWdUO3kcsX7V/oXvb47wi5jW6Xl/ucsKNVSOiCgjH
-ClK6BPcFIVl2MQo0EWpMrU1SGS2KgRizsXaq9+1DYP9ks88flI1ivwQI2zynPxTa
-C8kF8xpX3eI7DHpJDq605ZiN5aPoUq11Xt4RPmN0N9Qui8ZH4XtHpX4bACPtxQRU
-jF6OkFNrCO04Nu1kjafDZYM5muLyr7yw12WiY3/E6traCayBJeisDCXP/dOzTepN
-s5BICN8u55lUAx+5sXtqqjhlFGcsZXP/JQ///d2bxNZBXUPJVrAQxuRnH0WKJ1k/
-yuB3id+ut7sDcn7bkXBd9ngLvpIPbgzThrYCXGpMZ48+uqsMWq3K8oLUgjnq6xEr
-7raZNna5ReBG3zhTvpo+5M8v7UjWOOTgJFq2FGdz0OwdJNvdd8iH
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGBzCCA++gAwIBAgIUDkrlPsBijsQfGXRnhmcHZmuxD/0wDQYJKoZIhvcNAQEL
-BQAwgYoxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdl
-aXNlbmhlaW0xEDAOBgNVBAoMB1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQD
-DA9QUklWQVRFIFJPT1QgQ0ExHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYw
-HhcNMjIxMTI5MDc0NjQwWhcNMzIxMTI2MDc0NjQwWjCBijELMAkGA1UEBhMCREUx
-DzANBgNVBAgMBkhlc3NlbjETMBEGA1UEBwwKR2Vpc2VuaGVpbTEQMA4GA1UECgwH
-UHJpdmF0ZTELMAkGA1UECwwCSVQxGDAWBgNVBAMMD1BSSVZBVEUgUk9PVCBDQTEc
-MBoGCSqGSIb3DQEJARYNcGtpQGRyZXNpLnd0ZjCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAMGpQO8nqtbCyC6KkwlEStLBA0/UmXR331giHQDUhvpT9zf2
-4rzi+Ky0gOKtXyvU3NoYSseBeW4YhpSkOQRwiuUITBgD5E4X8p21wTefyJsQcqYz
-eaSNT6Kkbs7aYfRjzUDLJZlx83Oy7/7L127sYuMZTPfOTbl/j1AIYfUGV/E9+7Tw
-IyjPoN+1kRVfx5upaWI9MrIOYkl3jDQUbXthno09gmAgnXc5jt9pqn2JoxmfLRZS
-ZUFj/kHtI3TPjEZmAccfqsYYaWcgDCUX49g/w6WV/+xb6WFnqOxags4923ctzBtS
-gRINW03o4YJeisOGdB5Wxc33hDEsJGTcOQ64VUa1zYBLrmFz96xNTrXy5QIsdmzx
-J3+p2H0AmHKiPqzV3ICyMnNXOD918XPfD0mCFeYI5X4prCgW08GxEmJv0ACk9xGI
-2rKe7tijZ2DhVW2rSSIjvVCpjZD4X5NC+x7xMPP5WoaEMcW7nChhHb0XrThd9fc3
-3Ay0gkDDI3QtqbqKxFo4hUVnRZlRlzJIpRPjhDdanconxQnEZAUY5PeHS7bNH7Es
-6pIBz2EG3XHsdpvXkD2qF8gVBbGTC8KPVVAamTLNWfxT6goNuvwY0t8UUdmjcpVc
-mkNNmtkSh7uX1GYiWL4B+afVPwH5bGtJZ9ARNOw0pnaRnCXoA1YzRx9lyYwhAgMB
-AAGjYzBhMB0GA1UdDgQWBBRqRhe69ASml63w9Ik3WSTAs0EIfjAfBgNVHSMEGDAW
-gBRqRhe69ASml63w9Ik3WSTAs0EIfjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
-/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAU9bfHwVNetgq4E6GL2NQFl4WysQB
-7HIpEplGZ+ms1I7kaolBLVGpILYjXQ+tFHV1eXr8ry6+A4yyt11iKpQK+9bFUkPO
-OpprGvywwmfsEbq/e4FO+K+PGlwq+NpEJFtllkgyEDr3CEOdNuQNFyNyZ9nsZRIl
-XOqcQjswdHVoLPyxLMgQkAY7jDgkj51y2HQ3pbHACLVHQl6MV59pzn2ovtuGh8yu
-O87V8VcfmHros63y1V7CSILPUjnTuJK0jpPrtBvHSCOE0WCOgAh0faHQFvTeyFS4
-96eXgyFPK2OwxgAnnOxMOSTjCc8qxFSnBeE58FEsXB9JVE77rg0LJKnJljJTTCTi
-RBKeC2a9eoi3BzuOrG9IktD+t6QL06YH13goQv1NjkpjmeIbN0oFk15OtuDs+I2a
-QP+vYKAjBpkRwySF4Z53FueFWZNbO2USDwHhxjVSvDBV+laQqUdQjJlvuZCoGtLA
-rFkGcL8x36MjozVGpaKiISb/jHQv4KHuvdYvvYkBTU4OM1TUzbY/sI4LQL4gMoG/
-ujdwE8e8jvF8I3WSN39thmMjNrKbsEvCVO/akqJfVLKY1lD4nRzDEbDlgWZW8Zxf
-AsPACdUqqX/lXqMyWdzbpVKNuwJkrtri7N2NMMCo1YfjjzwaCFyu2S5IrZRqrejV
-6Edz+imlZBYWGlQ=
------END CERTIFICATE-----