Point the release docker step at the custom
artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
image, which bakes artifactapi's internal Vault CA into
/etc/docker/certs.d/<registry>/ca.crt.
- Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx
to the CA-baked custom image.
- Drop the separate ca-trust step (and its almalinux9-base dependency) that
staged the CA into the workspace.
- Repoint buildkit_config ca= at the in-image baked CA path so the buildx
docker-container builder still hands the CA to buildkitd for the push.
The v0.1.0 release pipeline built the runtime image fine but failed the
push to artifactapi.k8s.syd1.au.unkin.net/docker-internal with a TLS
x509 unknown-authority error: buildkit did not trust artifactapi's
Vault-signed cert.
Stage the internal CA into the shared workspace via the almalinux9-base
image (already trusts the unkin CA; same image the RPM release pipelines
use to reach artifactapi over HTTPS) and point the docker-buildx plugin
at it through buildkit_config. buildx copies the referenced CA into the
buildkitd container at builder-create time, so the push handshake now
verifies. No credentials needed: anonymous push to docker-internal is
allowed for trusted clients.
The pinned jellyfin-ha-src fork sets global.json sdk 9.0.0 (rollForward
latestMinor), so the publish steps in build.yaml and docker.yaml must run
on the .NET 9 SDK. They referenced sdk:10.0, which fails the pinned build.
Repoint both publish steps to mcr.microsoft.com/dotnet/sdk:9.0.
Why:
- The build should pull from our own source fork so local HA patches can be
carried and pinned, rather than cloning the upstream GitHub tree directly.
How:
- Point the clone URL in the Makefile and both Woodpecker pipelines at
https://git.unkin.net/unkin/jellyfin-ha-src.git.
- Keep UPSTREAM_REF at d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad, which is the
seeded fork main, so the produced image is byte-identical for now; the
feature bump is a later change.
Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also repoints the Makefile IMAGE and README image paths.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin
unkin-agent
unkinben
gitadmin