dw-ec

Allow use of ssh-agent instead of mounting SSH key

2

Mounting an SSH key into the docker-ssh-tunnel container requires that it be unprotected by a passphrase, or for the passphrase to be stored in the container config. This is insecure....

Make Docker internal DNS name resolution service available to OSX through the VPN

1

Using [4km3/dnsmasq](https://hub.docker.com/r/4km3/dnsmasq) it's possible to run a resolver that passes DNS queries through to Docker's internal name resolution service. This works for container names, as well as network alias names....

For improved security on multi-user systems, php-fpm pools can be isolated from each other, running under different user accounts and optionally in a chrooted code directory.

Allow user to override php.ini.j2 template file

3

Other templates such as www.conf.j2 can already be overridden by the user. Allow the php.ini.j2 template file to be overridden too.

We prefer to type mysql passwords in manually for slightly improved security. It'd be nice if there was an option not to install ~/.my.cnf.

File daemon should optionally reject any unsigned files during restores

1

### Use case At present, files that fail the PKI signature check during restore operations are restored anyway. To me, a signature check failure indicates either that the operator has...