Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#4) from benvin/buildx-ca-config into main

Reviewed-on: #4

.woodpecker/docker.yaml

@@ -1,23 +1,23 @@
 # Build and push the pdbmux container image on a v* tag. pdbmux is a k8s-only
 # daemon (deployed via argocd-apps), so it ships as an image. Mirrors the estate
-# convention: the woodpeckerci/plugin-docker-buildx plugin pushes to the Gitea
-# registry using the droneci / DRONECI_PASSWORD credentials.
+# convention: the CA-baked plugin-docker-buildx image pushes to the
+# artifactapi local docker registry (unauthenticated in-cluster push).
 when:
   - event: tag
     ref: refs/tags/v*
 
 steps:
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/pdbmux
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux
       dockerfile: Dockerfile
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       build_args:
         VERSION: ${CI_COMMIT_TAG}
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
       tags:
         - ${CI_COMMIT_TAG}
         - latest

README.md

@@ -124,7 +124,7 @@ estate direction — it is not shipped as a per-VM RPM/systemd service. The imag
 is built and pushed on every `v*` tag (`.woodpecker/docker.yaml`) to:
 
 ```
-git.unkin.net/unkin/pdbmux:<tag>
+artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:<tag>
 ```
 
 It is a minimal static (`CGO_ENABLED=0`) binary on a distroless base