1

Mount over the Internet

Chris Lu edited this page 2026-08-11 12:29:16 -07:00

Table of Contents

• Mount over the Internet
• Option A: expose only the filer
• Option B: direct volume access
• Certificates
• Caveats
• Verification

Mount over the Internet

This page covers running weed mount or the CSI driver on a different network than the SeaweedFS cluster, with only mTLS between them. For general TLS setup see Security Configuration.

The mount client opens exactly two paths:

• Filer gRPC (HTTP port + 10000, e.g. 8888 → 18888) for all metadata
• Volume server HTTP for file data — unless proxied through the filer, see Option A

The mount never talks to the master. Keep the master private in every setup.

The simplest and safest approach is still a VPN (WireGuard, Tailscale, or site-to-site): private addresses keep working and nothing is exposed. If you cannot use one, the two setups below expose only client-cert-gated ports. Both were verified end to end (see Verification).

Option A: expose only the filer

The mount proxies all reads and writes through the filer, so the volume servers stay private. Only two filer ports are exposed: gRPC and HTTPS.

Server side security.toml:

[grpc]
ca = "/etc/seaweedfs/ca.crt"

[grpc.filer]
cert = "/etc/seaweedfs/server.crt"
key = "/etc/seaweedfs/server.key"

# used by servers when dialing each other
[grpc.client]
cert = "/etc/seaweedfs/server.crt"
key = "/etc/seaweedfs/server.key"

# filer HTTPS; ca makes the port require and verify client certs
[https.filer]
cert = "/etc/seaweedfs/server.crt"
key = "/etc/seaweedfs/server.key"
ca = "/etc/seaweedfs/ca.crt"

Mount side security.toml:

[grpc]
ca = "/etc/seaweedfs/ca.crt"

[grpc.client]
cert = "/etc/seaweedfs/client.crt"
key = "/etc/seaweedfs/client.key"

[https.client]
enabled = true
cert = "/etc/seaweedfs/client.crt"
key = "/etc/seaweedfs/client.key"
ca = "/etc/seaweedfs/ca.crt"

Mount with:

weed mount -filer=filer.example.com:8888 -dir=/mnt/weed -volumeServerAccess=filerProxy

or set the CSI driver parameter volumeServerAccess: "filerProxy".

Trade-off: all data funnels through the filer, so its bandwidth becomes the ceiling.

Option B: direct volume access

Better throughput: the mount talks to volume servers directly, so every volume server is exposed on its HTTPS port.

Server side, replace [https.filer] with:

[https.volume]
cert = "/etc/seaweedfs/server.crt"
key = "/etc/seaweedfs/server.key"
ca = "/etc/seaweedfs/ca.crt"

Then:

• Run the filer with -disableHttp. Its HTTP port then serves only embedded static assets — no file API, no UI, no TUS, not even /healthz.
• Start each volume server with -publicUrl=<externally routable host:port> and mount with -volumeServerAccess=publicUrl if the internal addresses are not routable from the clients.
• The mount side security.toml is the same as Option A.
• Servers upload to each other over HTTP too, so the server-side security.toml also needs [https.client] enabled with the server cert.

Certificates

• gRPC verifies the chain against grpc.ca plus the CommonName only. The [https.*] sections use standard hostname verification, so server certs must carry SANs for every name or IP the clients dial.
• Any cert signed by grpc.ca is accepted. Use allowed_commonNames in the server-side [grpc.*] sections to narrow which client certs may connect.
• There is no CRL/OCSP support: a leaked cert stays valid until it expires. Keep lifetimes short.

Caveats

• The TLS handshake surface is open to the internet with no rate limiting. A VPN keeps that surface closed.
• These ports are safe to expose only with the client-cert (ca) settings above; without them, HTTP endpoints such as the filer UI and volume /status answer anyone.
• On a shared internal network with untrusted-but-not-hostile actors, this same setup applies and the caveats matter much less.

Verification

Both options were tested with 4.41: a rejected TLS handshake without a client cert on the filer HTTPS, volume HTTPS, and filer gRPC ports; plaintext HTTP rejected; -disableHttp leaving only static assets; and an 8 MB write and remount read-back with matching md5 through each path. In Option A the mount's only connections were the two filer ports, confirming data flows through the filer proxy.

Introduction

• Quick Start with weed mini
• Simplest S3 Bucket and User Setup
• Components
• Blob Store Architecture
• Getting Started
• Production Setup
• A typical step‐by‐step example
• Benchmarks
• FAQ
• Applications

API

• Master Server API
• Volume Server API
• Filer Server API
• Client Libraries
• SeaweedFS Java Client

Configuration

• Replication
• Store file with a Time To Live
• Failover Master Server
• Erasure coding for warm storage
• EC Bitrot Detection
• Server Startup via Systemd
• Environment Variables

Filer

• Filer Setup
• Directories and Files
• File Operations Quick Reference
• Data Structure for Large Files
• Filer Data Encryption
• Filer Commands and Operations
• Filer JWT Use
• TUS Resumable Uploads

Filer Stores

• Filer Cassandra Setup
• Filer Redis Setup
• Super Large Directories
• Path-Specific Filer Store
• Choosing a Filer Store
• Customize Filer Store

Management

• Admin UI
• Admin UI OIDC
• Worker
• Plugin Worker Scheduling

Advanced Filer Configurations

• Migrate to Filer Store
• Add New Filer Store
• Filer Store Replication
• Filer Active Active cross cluster continuous synchronization
• Filer as a Key-Large-Value Store
• Path Specific Configuration
• Filer Change Data Capture
• Filer Operation Serialization

FUSE Mount

• Mount on Windows
• FIO benchmark
• fstab and systemd mount
• POSIX Compliance
• Distributed POSIX Locks
• P2P reading in weed mount
• Mount over the Internet

WebDAV

SFTP Server

Cloud Drive

• Cloud Drive Benefits
• Cloud Drive Architecture
• Configure Remote Storage
• Azure Blob Storage Authentication
• Mount Remote Storage
• Cache Remote Storage
• Cloud Drive Quick Setup
• Gateway to Remote Object Storage

AWS S3 API

• Amazon S3 API
• Supported APIs vs Minio
• S3 Lifecycle
  • S3 Lifecycle Recipes
  • S3 Lifecycle Operator Guide
  • S3 Lifecycle Monitoring
  • S3 Lifecycle Troubleshooting
  • S3 Lifecycle Architecture
• S3 Lifecycle vs Volume TTL
• S3 Conditional Operations
• S3 CORS
• S3 Object Lock and Retention
• S3 Object Versioning
• S3 RenameObject
• S3 API Benchmark
• S3 API FAQ
• S3 Bucket Quota
• S3 Rate Limiting
• S3 API Audit log
• S3 Nginx Proxy
• Docker Compose for S3

S3 Table Bucket

• S3 Table Bucket
• S3 Table Bucket Commands
• S3 Tables Security
• SeaweedFS Iceberg Catalog
• Iceberg REST Catalog API
• Iceberg Table Maintenance
• SeaweedFS Lance Catalog
• Lance Maintenance Worker

Iceberg Integrations

• Spark Iceberg Integration
• Trino Iceberg Integration
• Dremio Iceberg Integration
• DuckDB Iceberg Integration
• Doris Iceberg Integration
• RisingWave Iceberg Integration
• Lakekeeper Iceberg Integration

Lance Integrations

• LanceDB Integration
• Spark Lance Integration
• DuckDB Lance Integration

S3 Authentication & IAM

• S3 Configuration - Start Here
• S3 Credentials (-s3.config)
• OIDC Integration (-s3.iam.config)
• Kubernetes ServiceAccount Authentication (IRSA-style)
• S3 Policy Variables
• S3 Policy Conditions
• S3 Bucket Policies
• Amazon IAM API
• AWS IAM CLI
• weed shell - Shell IAM Commands

Server-Side Encryption

• Server-Side Encryption
• Server-Side Encryption SSE-KMS
• Server-Side Encryption SSE-C

S3 Client Tools

• AWS CLI with SeaweedFS
• s3cmd with SeaweedFS
• rclone with SeaweedFS
• restic with SeaweedFS
• nodejs with Seaweed S3

Machine Learning

• TensorFlow with SeaweedFS
• Distributing AI Model Files for Multi-GPU Loading

HDFS

• Hadoop Compatible File System
• run Spark on SeaweedFS
• run HBase on SeaweedFS
• Run Trino on SeaweedFS
• Hadoop Benchmark
• HDFS via S3 connector

Replication and Backup

• Async Replication to another Filer [Deprecated]
• Async Backup
• Async Filer Metadata Backup
• Async Replication to Cloud [Deprecated]
• Kubernetes Backups and Recovery with K8up

Metadata Change Events

• Filer Metadata Events
• Filer Notification Webhook

Messaging

• Structured Data Lake with SMQ and SQL
• Seaweed Message Queue
• SQL Queries on Message Queue
• SQL Quick Reference
• PostgreSQL-compatible Server weed db
• Pub-Sub to SMQ to SQL
• Kafka to Kafka Gateway to SMQ to SQL

Use Cases

• Use Cases
• Actual Users

Operations

• System Metrics
• weed shell
• Data Backup
• Deployment to Kubernetes and Minikube
• Helm Chart Recipes
• Deployment with seaweed-up
  • seaweed-up Command Reference
  • Cluster Plan Workflow
  • Cluster Plan Inventory Reference
  • Cluster Plan Day 2 Operations

Rust Volume Server

• Rust Volume Server

Advanced

• Large File Handling
• Optimization
• Optimization for Many Small Buckets
• Volume Management
• Tiered Storage
• Cloud Tier
• Cloud Monitoring
• Load Command Line Options from a file
• SRV Service Discovery
• Volume Files Structure

Security

• Security Overview
• Security Configuration
• Cryptography and FIPS Compliance
• Run Blob Storage on Public Internet

Misc Use Case Examples

• UrBackup with SeaweedFS
• Docker Image Registry with SeaweedFS
• SeaweedFS in Docker Swarm
• Words from SeaweedFS Users
• Independent Benchmarks
• Hardware