Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#18 ) from benvin/buildx-ca-config into main

Reviewed-on: #18
ci: add buildkit_config CA trust for artifactapi push
2026-08-15 18:47:21 +10:00 · 2026-08-15 18:30:44 +10:00 · 2026-08-15 18:20:59 +10:00 · 2026-08-15 18:03:44 +10:00 · 2026-07-30 20:55:27 +10:00 · 2026-07-30 00:34:59 +10:00
3 changed files with 18 additions and 17 deletions
@@ -3,15 +3,15 @@ when:

 steps:
  - name: docker-build-operator
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
-      repo: git.unkin.net/unkin/bind-operator
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator
      dockerfile: Dockerfile.operator
      dry_run: true

  - name: docker-build-tsig-api
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
-      repo: git.unkin.net/unkin/bind-tsig-api
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api
      dockerfile: Dockerfile.tsigapi
      dry_run: true
@@ -4,27 +4,27 @@ when:

 steps:
  - name: docker-operator
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/bind-operator
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator
      dockerfile: Dockerfile.operator
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
      tags:
        - ${CI_COMMIT_TAG}
        - latest

  - name: docker-tsig-api
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/bind-tsig-api
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api
      dockerfile: Dockerfile.tsigapi
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
      tags:
        - ${CI_COMMIT_TAG}
        - latest
@@ -85,7 +85,8 @@ kubectl apply -f config/samples/

 Woodpecker runs `pre-commit` (gofmt + vet), `test`, and a dry-run image `build`
 on pull requests; pushing a `v*` tag builds and pushes
-`git.unkin.net/unkin/bind-operator` to the Gitea registry.
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator` (and
+`bind-tsig-api`) to the artifactapi local docker registry.

 ## Notes & caveats
Author	SHA1	Message	Date
benvin	8d5a231a78	Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#18 ) from benvin/buildx-ca-config into main Reviewed-on: #18	2026-08-15 18:47:21 +10:00
unkin-agent	f2b7d07006	ci: add buildkit_config CA trust for artifactapi push ci/woodpecker/pr/test Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details Point the buildx docker-container builder at artifactapi's in-image CA (/etc/docker/certs.d/.../ca.crt) so buildkitd, which runs in its own container and performs the push, trusts the registry. Applied to both push steps (docker-operator and docker-tsig-api). Proven in jellyfin-ha v0.1.2.	2026-08-15 18:30:44 +10:00
benvin	7e736248e4	Merge pull request 'ci: use CA-baked plugin-docker-buildx image for artifactapi push' (#17 ) from benvin/buildx-ca-plugin-image into main Reviewed-on: #17	2026-08-15 18:20:59 +10:00
unkin-agent	698ca8c102	ci: use CA-baked plugin-docker-buildx image for artifactapi push ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details	2026-08-15 18:03:44 +10:00
benvin	3a88fd95a0	Merge pull request 'ci: push images to artifactapi registry instead of gitea' (#16 ) from benvin/push-artifactapi into main Reviewed-on: #16	2026-07-30 20:55:27 +10:00
unkinben	eb65ad8f89	ci: push images to artifactapi registry instead of gitea ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details Hard switch of the docker push target from the Gitea registry to the artifactapi local docker registry (docker-internal); the Gitea VM and its registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since artifactapi accepts unauthenticated in-cluster pushes. Also updates the README push note (covers bind-operator + bind-tsig-api). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv	2026-07-30 00:34:59 +10:00