fix deploy: use insecure buildx image with http registry in buildkit

Buildkit runs in a docker-container driver where the self-signed CA
is not trusted. Instead of mounting certs into buildkit, configure
buildkit to push via HTTP — Traefik handles TLS termination at the
edge. Uses YAML anchors to DRY up the 5 buildx step configs.

.woodpecker/deploy.yml

@@ -6,15 +6,27 @@
 #
 # Image naming:
 #   gitea.homelab.fhirworx.io/homelab/<service>:sha-<8chars>
-#   gitea.homelab.fhirworx.io/homelab/<service>:latest
 #
-# The deploy step writes COMMIT_SHA=sha-<short> into .env so
-# compose.yml resolves the exact image just built.
+# Buildkit pushes via HTTP through Traefik (TLS terminated at edge).
+# DNS resolved by CoreDNS via Traefik UDP on the CI network.
 
 when:
   - event: push
     branch: main
 
+variables:
+  - &buildx_image woodpeckerci/plugin-docker-buildx:5-insecure
+  - &buildx_base
+    buildkit_driveropt: network=ci
+    buildkit_config: |
+      [registry."gitea.homelab.fhirworx.io"]
+        http = true
+    registry: gitea.homelab.fhirworx.io
+    username:
+      from_secret: registry_user
+    password:
+      from_secret: registry_pass
+
 steps:
   # ── Python package ──────────────────────────────────────────
   - name: build-package
@@ -39,20 +51,15 @@ steps:
 
   # ── Notebooks image ─────────────────────────────────────────
   - name: build-push-notebooks
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/notebooks
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: notebooks/Dockerfile
       context: notebooks/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: scan-notebooks
     image: woodpeckerci/plugin-trivy
@@ -69,20 +76,15 @@ steps:
 
   # ── Zotero image ────────────────────────────────────────────
   - name: build-push-zotero
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/zotero
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: zotero/Dockerfile
       context: zotero/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: scan-zotero
     image: woodpeckerci/plugin-trivy
@@ -98,7 +100,6 @@ steps:
       - build-push-zotero
 
   # ── Docs image ──────────────────────────────────────────────
-  # Needs bib.sqlite from host data dir in the build context.
   - name: prep-docs-context
     image: alpine:3
     volumes:
@@ -108,20 +109,15 @@ steps:
       - cp /host-data/bib.sqlite data/ 2>/dev/null || true
 
   - name: build-push-docs
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/docs
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: docs/Dockerfile
       context: .
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
     depends_on:
       - prep-docs-context
 
@@ -140,20 +136,15 @@ steps:
 
   # ── API image ───────────────────────────────────────────────
   - name: build-push-api
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/api
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: api/Dockerfile
       context: .
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: scan-api
     image: woodpeckerci/plugin-trivy
@@ -170,20 +161,15 @@ steps:
 
   # ── MC (MinIO Client) sidecar ────────────────────────────────
   - name: build-push-mc
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/mc
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: rustfs/Dockerfile.mc
       context: rustfs/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   # ── Upload scan results ─────────────────────────────────────
   - name: upload-notebooks-scan

.woodpecker/rebuild-all.yml

@@ -1,38 +1,41 @@
 when:
   - event: manual
 
+variables:
+  - &buildx_image woodpeckerci/plugin-docker-buildx:5-insecure
+  - &buildx_base
+    buildkit_driveropt: network=ci
+    buildkit_config: |
+      [registry."gitea.homelab.fhirworx.io"]
+        http = true
+    registry: gitea.homelab.fhirworx.io
+    username:
+      from_secret: registry_user
+    password:
+      from_secret: registry_pass
+
 steps:
   - name: build-push-notebooks
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/notebooks
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: notebooks/Dockerfile
       context: notebooks/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: build-push-zotero
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/zotero
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: zotero/Dockerfile
       context: zotero/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: prep-docs-context
     image: alpine:3
@@ -43,54 +46,39 @@ steps:
       - cp /host-data/bib.sqlite data/ 2>/dev/null || true
 
   - name: build-push-docs
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/docs
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: docs/Dockerfile
       context: .
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
     depends_on:
       - prep-docs-context
 
   - name: build-push-api
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/api
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: api/Dockerfile
       context: .
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: build-push-mc
-    image: woodpeckerci/plugin-docker-buildx
+    image: *buildx_image
     settings:
+      <<: *buildx_base
       repo: gitea.homelab.fhirworx.io/homelab/mc
-      registry: gitea.homelab.fhirworx.io
-      buildkit_driveropt: network=ci
       dockerfile: rustfs/Dockerfile.mc
       context: rustfs/
       tags:
         - "sha-${CI_COMMIT_SHA:0:8}"
         - latest
-      username:
-        from_secret: registry_user
-      password:
-        from_secret: registry_pass
 
   - name: scan-notebooks
     image: woodpeckerci/plugin-trivy