Better documentation for connecting to self-hosted repos

[elastic-pangolin]

I have been trying for a week now to get this to work as a proof-of-concept, but it does not seem to be worth my time right now.

I want to scan repos on a self-hosted gitea, with a self-signed certificate.

Trufflehog would ideally run in a docker contain inside the gocd pipeline, and only proceed to clone and build the project if no credentials were found in the source repo. To do this, I have created a new Dockerfile in which I add the custom certificate, because I saw no other way to do it, is this right?

Now I can connect to the server and scan public repos on there, but to scan private ones, I need to authenticate. I have seen recommended to use ssh (not an option for a service account) or to use the scheme
https://user:password@gitea.custom.org
which seems to be a security risk (exposing username and password/PAT) in itself.
The flag --token=... is only available to scan e.g. github, not a 'plain' git.

How can I securely (i.e. via a docker secret) pass the authentication details to trufflehog?

Is the best option to clone and then scan the local repo with file:// ?

Please create some more documentation for this use-case.