From f2ac6c83732102a006efd9b9e58c59b741c0460a Mon Sep 17 00:00:00 2001
From: Esa Kataja <ekataja@gmail.com>
Date: Sun, 6 Sep 2026 10:09:20 +0300
Subject: [PATCH] ci: skip TLS verification until the registry has a real cert

---
 .gitea/workflows/demo.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitea/workflows/demo.yaml b/.gitea/workflows/demo.yaml
index 0cd34ab..5b4a7ce 100644
--- a/.gitea/workflows/demo.yaml
+++ b/.gitea/workflows/demo.yaml
@@ -1,6 +1,12 @@
 name: demo
 on: [push]
 
+# ponytail: GIT_SSL_NO_VERIFY is here only because Traefik still serves its
+# default self-signed cert for git.kessinen.com. Remove it once the
+# LE-DNS01-cloudflare runbook has been run.
+env:
+  GIT_SSL_NO_VERIFY: "true"
+
 jobs:
   check:
     runs-on: ubuntu-latest