Merge pull request 'ci: use CA-baked plugin-docker-buildx image for artifactapi push' (#6 ) from benvin/jellyfin-buildx-plugin-image into main

Reviewed-on: #6
ci: use CA-baked plugin-docker-buildx image for artifactapi push
2026-08-15 18:20:05 +10:00 · 2026-08-15 18:06:11 +10:00 · 2026-08-15 16:42:06 +10:00 · 2026-08-15 16:34:44 +10:00
1 changed files with 9 additions and 1 deletions
@@ -25,12 +25,20 @@ steps:
            cpu: 4

  # Build the runtime image and push it to the artifactapi local docker registry.
+  # The plugin image bakes artifactapi's internal (Vault) CA at
+  # /etc/docker/certs.d/<registry>/ca.crt; buildkit_config points the buildx
+  # docker-container builder at that in-image CA. buildkitd runs in its own
+  # container and performs the push, so it needs the CA via --config even though
+  # the plugin image already trusts it — buildx copies the referenced file in.
  - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
      registry: artifactapi.k8s.syd1.au.unkin.net
      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
      dockerfile: Dockerfile.runtime
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
      tags:
        - ${CI_COMMIT_TAG}
        - latest
Author	SHA1	Message	Date
benvin	248027aaea	Merge pull request 'ci: use CA-baked plugin-docker-buildx image for artifactapi push' (#6 ) from benvin/jellyfin-buildx-plugin-image into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #6	2026-08-15 18:20:05 +10:00
unkin-agent	0020ee2a58	ci: use CA-baked plugin-docker-buildx image for artifactapi push ci/woodpecker/pr/build Pipeline was successful Details Point the release docker step at the custom artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx image, which bakes artifactapi's internal Vault CA into /etc/docker/certs.d/<registry>/ca.crt. - Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx to the CA-baked custom image. - Drop the separate ca-trust step (and its almalinux9-base dependency) that staged the CA into the workspace. - Repoint buildkit_config ca= at the in-image baked CA path so the buildx docker-container builder still hands the CA to buildkitd for the push.	2026-08-15 18:06:11 +10:00
benvin	b1470f3158	Merge pull request 'ci: trust artifactapi internal CA when pushing docker-internal' (#5 ) from benvin/jellyfin-buildkit-ca into main ci/woodpecker/tag/docker Pipeline failed Details Reviewed-on: #5	2026-08-15 16:42:06 +10:00
unkin-agent	ec04b35b39	ci: trust artifactapi internal CA when pushing docker-internal ci/woodpecker/pr/build Pipeline was successful Details The v0.1.0 release pipeline built the runtime image fine but failed the push to artifactapi.k8s.syd1.au.unkin.net/docker-internal with a TLS x509 unknown-authority error: buildkit did not trust artifactapi's Vault-signed cert. Stage the internal CA into the shared workspace via the almalinux9-base image (already trusts the unkin CA; same image the RPM release pipelines use to reach artifactapi over HTTPS) and point the docker-buildx plugin at it through buildkit_config. buildx copies the referenced CA into the buildkitd container at builder-create time, so the push handshake now verifies. No credentials needed: anonymous push to docker-internal is allowed for trusted clients.	2026-08-15 16:34:44 +10:00