feat: add custom BuildKit image with internal CA, use in workflows

.gitea/workflows/rsyncd.yaml

@@ -29,9 +29,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          buildkitd-config-inline: |
+          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
-            [registry."harbor.lan"]
-              insecure = true
 
       - name: Build and push image
         uses: docker/build-push-action@v6

.gitea/workflows/telegraf-snmp.yaml

@@ -29,9 +29,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          buildkitd-config-inline: |
+          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
-            [registry."harbor.lan"]
-              insecure = true
 
       - name: Build and push image
         uses: docker/build-push-action@v6

buildkit/Dockerfile

@@ -0,0 +1,3 @@
+FROM moby/buildkit:buildx-stable-1
+COPY internal-ca.crt /usr/local/share/ca-certificates/internal-ca.crt
+RUN apk add --no-cache ca-certificates && update-ca-certificates

buildkit/internal-ca.crt

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIUDkrlPsBijsQfGXRnhmcHZmuxD/0wDQYJKoZIhvcNAQEL
+BQAwgYoxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdl
+aXNlbmhlaW0xEDAOBgNVBAoMB1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQD
+DA9QUklWQVRFIFJPT1QgQ0ExHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYw
+HhcNMjIxMTI5MDc0NjQwWhcNMzIxMTI2MDc0NjQwWjCBijELMAkGA1UEBhMCREUx
+DzANBgNVBAgMBkhlc3NlbjETMBEGA1UEBwwKR2Vpc2VuaGVpbTEQMA4GA1UECgwH
+UHJpdmF0ZTELMAkGA1UECwwCSVQxGDAWBgNVBAMMD1BSSVZBVEUgUk9PVCBDQTEc
+MBoGCSqGSIb3DQEJARYNcGtpQGRyZXNpLnd0ZjCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAMGpQO8nqtbCyC6KkwlEStLBA0/UmXR331giHQDUhvpT9zf2
+4rzi+Ky0gOKtXyvU3NoYSseBeW4YhpSkOQRwiuUITBgD5E4X8p21wTefyJsQcqYz
+eaSNT6Kkbs7aYfRjzUDLJZlx83Oy7/7L127sYuMZTPfOTbl/j1AIYfUGV/E9+7Tw
+IyjPoN+1kRVfx5upaWI9MrIOYkl3jDQUbXthno09gmAgnXc5jt9pqn2JoxmfLRZS
+ZUFj/kHtI3TPjEZmAccfqsYYaWcgDCUX49g/w6WV/+xb6WFnqOxags4923ctzBtS
+gRINW03o4YJeisOGdB5Wxc33hDEsJGTcOQ64VUa1zYBLrmFz96xNTrXy5QIsdmzx
+J3+p2H0AmHKiPqzV3ICyMnNXOD918XPfD0mCFeYI5X4prCgW08GxEmJv0ACk9xGI
+2rKe7tijZ2DhVW2rSSIjvVCpjZD4X5NC+x7xMPP5WoaEMcW7nChhHb0XrThd9fc3
+3Ay0gkDDI3QtqbqKxFo4hUVnRZlRlzJIpRPjhDdanconxQnEZAUY5PeHS7bNH7Es
+6pIBz2EG3XHsdpvXkD2qF8gVBbGTC8KPVVAamTLNWfxT6goNuvwY0t8UUdmjcpVc
+mkNNmtkSh7uX1GYiWL4B+afVPwH5bGtJZ9ARNOw0pnaRnCXoA1YzRx9lyYwhAgMB
+AAGjYzBhMB0GA1UdDgQWBBRqRhe69ASml63w9Ik3WSTAs0EIfjAfBgNVHSMEGDAW
+gBRqRhe69ASml63w9Ik3WSTAs0EIfjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAU9bfHwVNetgq4E6GL2NQFl4WysQB
+7HIpEplGZ+ms1I7kaolBLVGpILYjXQ+tFHV1eXr8ry6+A4yyt11iKpQK+9bFUkPO
+OpprGvywwmfsEbq/e4FO+K+PGlwq+NpEJFtllkgyEDr3CEOdNuQNFyNyZ9nsZRIl
+XOqcQjswdHVoLPyxLMgQkAY7jDgkj51y2HQ3pbHACLVHQl6MV59pzn2ovtuGh8yu
+O87V8VcfmHros63y1V7CSILPUjnTuJK0jpPrtBvHSCOE0WCOgAh0faHQFvTeyFS4
+96eXgyFPK2OwxgAnnOxMOSTjCc8qxFSnBeE58FEsXB9JVE77rg0LJKnJljJTTCTi
+RBKeC2a9eoi3BzuOrG9IktD+t6QL06YH13goQv1NjkpjmeIbN0oFk15OtuDs+I2a
+QP+vYKAjBpkRwySF4Z53FueFWZNbO2USDwHhxjVSvDBV+laQqUdQjJlvuZCoGtLA
+rFkGcL8x36MjozVGpaKiISb/jHQv4KHuvdYvvYkBTU4OM1TUzbY/sI4LQL4gMoG/
+ujdwE8e8jvF8I3WSN39thmMjNrKbsEvCVO/akqJfVLKY1lD4nRzDEbDlgWZW8Zxf
+AsPACdUqqX/lXqMyWdzbpVKNuwJkrtri7N2NMMCo1YfjjzwaCFyu2S5IrZRqrejV
+6Edz+imlZBYWGlQ=
+-----END CERTIFICATE-----