# Forgejo + Silent Mode CA cert baked into the trust store, so Forgejo's Go
# client can validate hephaestus.x's cert (issued by Argonautica) when it
# fetches OIDC discovery from https://hephaestus.x/auth/.well-known/... .
#
# Do NOT switch to USER git at the end — parent image's s6-overlay init needs
# to start as root (it drops to `git` internally). USER git broke s6-svscan
# with "unable to open .s6-svscan/lock: Permission denied".
FROM codeberg.org/forgejo/forgejo:10
COPY silent-mode-ca.crt /usr/local/share/ca-certificates/silent-mode-ca.crt
RUN update-ca-certificates