name: Build and push rsyncd image
run-name: ${{ gitea.actor }} is building and pushing rsyncd image
on:
  push:
    paths:
      - 'rsyncd/**'
      - '.gitea/workflows/rsyncd.yaml'

env:
  RESULT_IMAGE_NAME: tools/rsyncd

jobs:
  build-and-push-image:
    runs-on: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}
          username: ${{ vars.PRIVATE_REGISTRY_USER }}
          password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Write internal CA cert
        run: |
          mkdir -p /tmp/buildkit-certs
          printf '%s\n' "${{ vars.PRIVATE_REGISTRY_CA_CERT }}" > /tmp/buildkit-certs/harbor-ca.pem

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."harbor.lan"]
              ca=["/tmp/buildkit-certs/harbor-ca.pem"]

      - name: Trust internal CA in BuildKit system store
        run: |
          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
          echo "Builder: $BUILDER"
          docker exec "$BUILDER" sh -c '
            echo "--- cert landscape ---"
            ls -la /etc/ssl/ /etc/ssl/certs/ 2>/dev/null | head -15
            for f in /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem; do
              [ -e "$f" ] || continue
              cat /etc/buildkit/certs/harbor.lan/harbor-ca.pem >> "$f"
              echo "Appended CA to $f"
              break
            done
          '
          docker restart "$BUILDER"
          sleep 5

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: rsyncd
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest