TLS private key has to be world-readable on the host

[igor-alexandrov]

kamal-proxy runs as kamal-proxy (uid 1001), but Kamal writes the TLS files to the host as the SSH user, which is root by default. The apps-config directory is bind-mounted in, so the only mode that lets the proxy read the key is 0644, which is what Kamal uses: https://github.com/basecamp/kamal/blob/main/lib/kamal/cli/app/ssl_certificates.rb#L19.

That leaves the private key readable by every local user on the host and by any other container that mounts the same directory.

Tightening it on the Kamal side doesn't work:

$ docker run --rm --entrypoint sh basecamp/kamal-proxy:v0.9.2 -c 'id'
uid=1001(kamal-proxy) gid=1001(kamal-proxy) groups=1001(kamal-proxy)

# key.pem at 0600, owned by the uploading user
$ docker run --rm -v "$PWD/tls:/tls:ro" --entrypoint sh basecamp/kamal-proxy:v0.9.2 -c 'cat /tls/key.pem'
cat: /tls/key.pem: Permission denied

So the fix likely belongs here. Two options that would work:

• read the cert and key at startup, before dropping to kamal-proxy
• commit to a stable uid/gid so Kamal can chown the key and write it 0600

Happy to send a PR if you have a preference.