homelab/stack
1
0
Fork 0
Code Issues 70 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

[P9] Distribute Homelab CA cert to Docker and buildkit #102

New Issue
Closed
opened 2026-03-22 15:46:25 +00:00 by kert · 0 comments
kert commented 2026-03-22 15:46:25 +00:00
Owner
Copy Link

Problem

The Gitea registry is behind Traefik TLS with a self-signed wildcard cert (*.homelab.fhirworx.io, CA: Homelab CA). Buildkit and Docker daemon don't trust this CA, so HTTPS pushes to gitea.homelab.fhirworx.io will fail with certificate errors.

Solution

  • Copy traefik/certs/ca.crt into the Docker daemon's trusted certs dir
  • For rootless Docker: ~/.config/docker/certs.d/gitea.homelab.fhirworx.io/ca.crt
  • Configure buildkit via buildkit_config in the buildx plugin to trust the CA
  • Alternatively, mount the CA cert into buildkit via buildkit_driveropt

Depends on

  • DNS resolution (#101) so gitea.homelab.fhirworx.io resolves

Acceptance criteria

  • Docker daemon trusts Homelab CA (docker pull gitea.homelab.fhirworx.io/homelab/test works)
  • Buildkit trusts Homelab CA (buildx push over HTTPS works)
  • Remove insecure: true from all buildx steps
## Problem The Gitea registry is behind Traefik TLS with a self-signed wildcard cert (`*.homelab.fhirworx.io`, CA: `Homelab CA`). Buildkit and Docker daemon don't trust this CA, so HTTPS pushes to `gitea.homelab.fhirworx.io` will fail with certificate errors. ## Solution - Copy `traefik/certs/ca.crt` into the Docker daemon's trusted certs dir - For rootless Docker: `~/.config/docker/certs.d/gitea.homelab.fhirworx.io/ca.crt` - Configure buildkit via `buildkit_config` in the buildx plugin to trust the CA - Alternatively, mount the CA cert into buildkit via `buildkit_driveropt` ## Depends on - DNS resolution (#101) so `gitea.homelab.fhirworx.io` resolves ## Acceptance criteria - [ ] Docker daemon trusts Homelab CA (`docker pull gitea.homelab.fhirworx.io/homelab/test` works) - [ ] Buildkit trusts Homelab CA (buildx push over HTTPS works) - [ ] Remove `insecure: true` from all buildx steps
kert added this to the P9: CI/CD Unification milestone 2026-03-22 15:46:25 +00:00
kert added the ci label 2026-03-22 15:46:25 +00:00
kert closed this issue 2026-03-23 17:56:50 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label ci
Milestone
No items
No Milestone P9: CI/CD Unification
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#102
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?