From a7fb530061e7a2a30a5bc7c333707c7eb22c3767 Mon Sep 17 00:00:00 2001
From: David Dyer <social_davidbdyer@icloud.com>
Date: Sun, 25 Oct 2026 19:09:34 -0400
Subject: [PATCH] Add step to trust home CA for improved security in Docker
 builds

---
 .gitea/workflows/build.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 5b23f89..06d435a 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -21,7 +21,20 @@ jobs:
       REPO: ${{ gitea.repository }}
       SHA: ${{ gitea.sha }}
     steps:
+      # Trust the home CA when one is configured: instance variable HOME_CA
+      # holds the root cert as PEM. Leave it unset on hosts with a public
+      # cert (the VPS) and this step is skipped.
+      - name: Trust home CA
+        if: ${{ vars.HOME_CA != '' }}
+        env:
+          HOME_CA: ${{ vars.HOME_CA }}
+        run: |
+          printf '%s\n' "$HOME_CA" > /usr/local/share/ca-certificates/home-ca.crt
+          update-ca-certificates
+
       - uses: actions/checkout@v4
+        env:
+          NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
 
       # node:24-trixie (Debian 13) has git and node but no Docker CLI. Install
       # the CLI and buildx from Docker's apt repo; the daemon is the runner's.