Bind mounts support

[sairus2k]

Currently, Swiftwave only supports regular Docker volumes, but there's a crucial feature missing: bind mounts. This limitation affects several use cases, particularly when working with SSL certificates for SMTP servers.

Use Case Example: I'm trying to set up an SMTP server using nodemailer-smtp-server that requires SSL certificates. The server needs access to the SSL certificates generated by Swiftwave. While Swiftwave can generate SSL certificates, there's no direct way to share these certificates with the SMTP container through bind mounts.

[tanmoysrt]

@sairus2k
Bind mount disabled due to some limitation in cluster setup + allowing everything to bind will open up another level security issues (actually some misconfiguration and oversight will open up your servers root access to other stuff).

PS: SMTP Server works on TCP, so haproxy is not going to terminate SSL. So, that means, you need both certificate and private key of SSL.

https://nodemailer.com/extras/smtp-server/#tls-and-startls-notice

Solution -

1. Download the SSL certificate and private key of your domain from Domain Management > View SSL of Swiftwave Dashboard.
2. Somehow put it inside your app's volume. Also two ways to do that -
   a. Use Web console to get inside your app and put the certificate and key there.
   b. In app store, you will find an app File Browser, install that by mounting the same volume of your app to this one. Then just upload the cert and key from filebrowser's UI.

Some thoughts -

• Bind mount is never going to solve this issue actually. Binding proxies directory to your app means, it got access to all fullchain and private key. So, if somehow your one app get compromised other stuff will also.
• It's not also possible to provide support of auto mounting this cert, key to app by swiftwave.

Btw,
We are bringing some features that will make it possible to automate these stuffs. Like,ability to provide restricted tokens, so that your app can ask swiftwave to give those required infos (not limited to domain, anything).

In V3, we will use actually bind mount underthehood, so might provide some support for bind with restrictions.

[sairus2k]

Thanks for the quick reply. Your solution works, thank you. The only downside is that I have to manually update the keys when they expire, so it would be great if this could be automated.