How do I bootstrap an alpine image to work with a private repo proxy behind TLS?
It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works:

wget our.cert.server.com/CA.crt
cat CA.crt &gt;&gt; /etc/ssl/cert.pem
sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories
apk update