How do I bootstrap an alpine image to work with a private repo proxy behind TLS?

Question

I am in a corporate environment behind a gateway that does DPI and often replaces the TLS certificate of most online resources with our corporate certificate. Many of our developers use images based on alpine linux to do their work and at peak times the network gets overloaded, builds crash because of failed apk add commands and whatnot. So I set up an instance of Nexus with a caching proxy for alpine apk packages.

However, the Nexus is served behind TLS with a certificate signed by our internal CA which is obviously not in the list of default trusted CAs. Without doing apk add ca-certificates I cannot do an update-ca-certificates and without trusting our internal CA I cannot do apk add. I would like to avoid exposing Nexus via insecure HTTP.

I can do a wget our.cert.server.com/CA.crt, but /etc/ssl/certs is empty and behavior doesn't change when I create /etc/ssl/certs/ca-certificate(s).crt and copy the certificate into there.

How can I (or our developers) bootstrap alpine images for work in our network without too much of a change to our workflow?

Answer 1

It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works:

wget our.cert.server.com/CA.crt
cat CA.crt >> /etc/ssl/cert.pem
sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories
apk update