feat: add CI workflow to build custom BuildKit image via plain docker build

.gitea/workflows/buildkit.yaml

@@ -0,0 +1,29 @@
+name: Build and push buildkit image
+run-name: ${{ gitea.actor }} is building and pushing buildkit image
+on:
+  push:
+    paths:
+      - 'buildkit/**'
+      - '.gitea/workflows/buildkit.yaml'
+
+env:
+  RESULT_IMAGE_NAME: tools/buildkit-with-ca
+
+jobs:
+  build-and-push-image:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}
+          username: ${{ vars.PRIVATE_REGISTRY_USER }}
+          password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}
+
+      - name: Build and push image
+        run: |
+          docker build -t ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest buildkit/
+          docker push ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest

.gitea/workflows/rsyncd.yaml

@@ -29,9 +29,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          buildkitd-config-inline: |
-            [registry."harbor.lan"]
-              insecure = true
+          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
 
       - name: Build and push image
         uses: docker/build-push-action@v6

.gitea/workflows/telegraf-snmp.yaml

@@ -29,9 +29,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          buildkitd-config-inline: |
-            [registry."harbor.lan"]
-              insecure = true
+          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest
 
       - name: Build and push image
         uses: docker/build-push-action@v6

buildkit/Dockerfile

@@ -0,0 +1,3 @@
+FROM moby/buildkit:buildx-stable-1
+COPY internal-ca.crt /usr/local/share/ca-certificates/internal-ca.crt
+RUN apk add --no-cache ca-certificates && update-ca-certificates

buildkit/internal-ca.crt

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIUDkrlPsBijsQfGXRnhmcHZmuxD/0wDQYJKoZIhvcNAQEL
+BQAwgYoxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZIZXNzZW4xEzARBgNVBAcMCkdl
+aXNlbmhlaW0xEDAOBgNVBAoMB1ByaXZhdGUxCzAJBgNVBAsMAklUMRgwFgYDVQQD
+DA9QUklWQVRFIFJPT1QgQ0ExHDAaBgkqhkiG9w0BCQEWDXBraUBkcmVzaS53dGYw
+HhcNMjIxMTI5MDc0NjQwWhcNMzIxMTI2MDc0NjQwWjCBijELMAkGA1UEBhMCREUx
+DzANBgNVBAgMBkhlc3NlbjETMBEGA1UEBwwKR2Vpc2VuaGVpbTEQMA4GA1UECgwH
+UHJpdmF0ZTELMAkGA1UECwwCSVQxGDAWBgNVBAMMD1BSSVZBVEUgUk9PVCBDQTEc
+MBoGCSqGSIb3DQEJARYNcGtpQGRyZXNpLnd0ZjCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAMGpQO8nqtbCyC6KkwlEStLBA0/UmXR331giHQDUhvpT9zf2
+4rzi+Ky0gOKtXyvU3NoYSseBeW4YhpSkOQRwiuUITBgD5E4X8p21wTefyJsQcqYz
+eaSNT6Kkbs7aYfRjzUDLJZlx83Oy7/7L127sYuMZTPfOTbl/j1AIYfUGV/E9+7Tw
+IyjPoN+1kRVfx5upaWI9MrIOYkl3jDQUbXthno09gmAgnXc5jt9pqn2JoxmfLRZS
+ZUFj/kHtI3TPjEZmAccfqsYYaWcgDCUX49g/w6WV/+xb6WFnqOxags4923ctzBtS
+gRINW03o4YJeisOGdB5Wxc33hDEsJGTcOQ64VUa1zYBLrmFz96xNTrXy5QIsdmzx
+J3+p2H0AmHKiPqzV3ICyMnNXOD918XPfD0mCFeYI5X4prCgW08GxEmJv0ACk9xGI
+2rKe7tijZ2DhVW2rSSIjvVCpjZD4X5NC+x7xMPP5WoaEMcW7nChhHb0XrThd9fc3
+3Ay0gkDDI3QtqbqKxFo4hUVnRZlRlzJIpRPjhDdanconxQnEZAUY5PeHS7bNH7Es
+6pIBz2EG3XHsdpvXkD2qF8gVBbGTC8KPVVAamTLNWfxT6goNuvwY0t8UUdmjcpVc
+mkNNmtkSh7uX1GYiWL4B+afVPwH5bGtJZ9ARNOw0pnaRnCXoA1YzRx9lyYwhAgMB
+AAGjYzBhMB0GA1UdDgQWBBRqRhe69ASml63w9Ik3WSTAs0EIfjAfBgNVHSMEGDAW
+gBRqRhe69ASml63w9Ik3WSTAs0EIfjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAU9bfHwVNetgq4E6GL2NQFl4WysQB
+7HIpEplGZ+ms1I7kaolBLVGpILYjXQ+tFHV1eXr8ry6+A4yyt11iKpQK+9bFUkPO
+OpprGvywwmfsEbq/e4FO+K+PGlwq+NpEJFtllkgyEDr3CEOdNuQNFyNyZ9nsZRIl
+XOqcQjswdHVoLPyxLMgQkAY7jDgkj51y2HQ3pbHACLVHQl6MV59pzn2ovtuGh8yu
+O87V8VcfmHros63y1V7CSILPUjnTuJK0jpPrtBvHSCOE0WCOgAh0faHQFvTeyFS4
+96eXgyFPK2OwxgAnnOxMOSTjCc8qxFSnBeE58FEsXB9JVE77rg0LJKnJljJTTCTi
+RBKeC2a9eoi3BzuOrG9IktD+t6QL06YH13goQv1NjkpjmeIbN0oFk15OtuDs+I2a
+QP+vYKAjBpkRwySF4Z53FueFWZNbO2USDwHhxjVSvDBV+laQqUdQjJlvuZCoGtLA
+rFkGcL8x36MjozVGpaKiISb/jHQv4KHuvdYvvYkBTU4OM1TUzbY/sI4LQL4gMoG/
+ujdwE8e8jvF8I3WSN39thmMjNrKbsEvCVO/akqJfVLKY1lD4nRzDEbDlgWZW8Zxf
+AsPACdUqqX/lXqMyWdzbpVKNuwJkrtri7N2NMMCo1YfjjzwaCFyu2S5IrZRqrejV
+6Edz+imlZBYWGlQ=
+-----END CERTIFICATE-----