From f2566e6f890e315deb14028f0bf24932006d830e Mon Sep 17 00:00:00 2001
From: riotpiaole <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 22 Jun 2026 12:21:38 -0700
Subject: [PATCH] build: pin docker builds to linux/amd64 and trust homelab CA
 at runtime

Building on arm64 Mac without GOOS/GOARCH produced amd64 node "exec format
error". The homelab CA was only trusted in the build stage, so the final
distroless runtime couldn't verify Authentik's TLS cert during OIDC discovery.
---
 .gitignore                | 2 ++
 Dockerfile                | 7 ++++++-
 Dockerfile.queue-operator | 4 +++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0ec0c0f..db1b685 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ cli-&-go-sdk-implementation-plan.md
 design.md
 kafka-management-tasks.md
 .claude/
+
+*.pem
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index d24835e..ecc7300 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,17 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+# forgejo.riotpiao.homelab.com's cert is signed by a homelab-private CA, not
+# a public one -- without this, `go mod download` can't fetch kmsvc-proto.
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/kmsvc-server ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/kmsvc-server ./cmd/server
 
 FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /out/kmsvc-server /kmsvc-server
 USER nonroot:nonroot
 ENTRYPOINT ["/kmsvc-server"]
diff --git a/Dockerfile.queue-operator b/Dockerfile.queue-operator
index 0922b49..2fbea99 100644
--- a/Dockerfile.queue-operator
+++ b/Dockerfile.queue-operator
@@ -1,10 +1,12 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
 
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /out/queue-operator /queue-operator