I am in a corporate environment behind a gateway that does DPI and often replaces the TLS certificate of most online resources with our corporate certificate. Many of our developers use images based on alpine linux to do their work and at peak times the network gets overloaded, builds crash because of failed
apk add commands and whatnot. So I set up an instance of Nexus with a caching proxy for alpine apk packages.
However, the Nexus is served behind TLS with a certificate signed by our internal CA which is obviously not in the list of default trusted CAs. Without doing
apk add ca-certificates I cannot do an
update-ca-certificates and without trusting our internal CA I cannot do
apk add. I would like to avoid exposing Nexus via insecure HTTP.
I can do a
wget our.cert.server.com/CA.crt, but
/etc/ssl/certs is empty and behavior doesn't change when I create
/etc/ssl/certs/ca-certificate(s).crt and copy the certificate into there.
How can I (or our developers) bootstrap alpine images for work in our network without too much of a change to our workflow?