ci: use CA-baked plugin-docker-buildx image for artifactapi push #6

2026-08-15T18:06:44+10:00

unkin-agent commented

2026-08-15 18:06:44 +10:00

Point jellyfin-ha's release docker push at the CA-baked custom plugin image so it trusts artifactapi's internal Vault CA without the standalone workaround step.

The custom image (artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx) bakes the internal CA into /etc/docker/certs.d//ca.crt. The plugin creates its buildx builder with the docker-container driver, so buildkitd (in its own container) performs the push and still needs the CA handed to it via buildkit_config --config; the baked path just replaces the workspace-staged file.

Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx to the CA-baked artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest.
Remove the separate ca-trust step and its git.unkin.net/unkin/almalinux9-base dependency that staged the CA into the workspace.
Repoint buildkit_config ca= at the in-image baked CA path (/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt).
Keep image repo/tags/publish logic, resources, and serviceAccountName unchanged; leave the dry_run PR build pipeline untouched (it does not push).

Point jellyfin-ha's release docker push at the CA-baked custom plugin image so it trusts artifactapi's internal Vault CA without the standalone workaround step. The custom image (artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx) bakes the internal CA into /etc/docker/certs.d/<registry>/ca.crt. The plugin creates its buildx builder with the docker-container driver, so buildkitd (in its own container) performs the push and still needs the CA handed to it via buildkit_config --config; the baked path just replaces the workspace-staged file. - Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx to the CA-baked artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest. - Remove the separate ca-trust step and its git.unkin.net/unkin/almalinux9-base dependency that staged the CA into the workspace. - Repoint buildkit_config ca= at the in-image baked CA path (/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt). - Keep image repo/tags/publish logic, resources, and serviceAccountName unchanged; leave the dry_run PR build pipeline untouched (it does not push).

unkin-agent added 1 commit 2026-08-15 18:06:44 +10:00

ci: use CA-baked plugin-docker-buildx image for artifactapi push

ci/woodpecker/pr/build Pipeline was successful

Details

0020ee2a58

Point the release docker step at the custom
artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
image, which bakes artifactapi's internal Vault CA into
/etc/docker/certs.d/<registry>/ca.crt.

- Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx
  to the CA-baked custom image.
- Drop the separate ca-trust step (and its almalinux9-base dependency) that
  staged the CA into the workspace.
- Repoint buildkit_config ca= at the in-image baked CA path so the buildx
  docker-container builder still hands the CA to buildkitd for the push.

benvin merged commit 248027aaea into main

2026-08-15 18:20:05 +10:00

benvin deleted branch benvin/jellyfin-buildx-plugin-image

2026-08-15 18:20:05 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/jellyfin-ha#6